9

I'm trying to dump the storage of Xiaomi Home camera. It comes with USB port, that if inserted while RESET is pressed is recognized in Linux as a SCSI device. I tried mounting the SCSI disc with no success, any idea what's this interface for and how can I dump it?

[dmesg log]
[   63.698810] usb 1-10: new high-speed USB device number 7 using xhci_hcd
[   63.846904] usb-storage 1-10:1.0: USB Mass Storage device detected
[   63.847238] scsi host9: usb-storage 1-10:1.0
[   64.852610] scsi 9:0:0:0: Direct-Access     Grain    GM8136           1.11 PQ: 0 ANSI: 2
[   64.853053] sd 9:0:0:0: Attached scsi generic sg6 type 0
[   64.853593] sd 9:0:0:0: [sdf] Attached SCSI removable disk

$ lsscsi  -s
[0:0:0:0]    disk    ATA      SanDisk SDSSDA24 70RL  /dev/sda 
[1:0:0:0]    disk    ATA      KINGSTON SV300S3 BBF0  /dev/sdb 
[2:0:0:0]    disk    ATA      ST2000DM006-2DM1 CC26  /dev/sdc 
[3:0:0:0]    disk    ATA      MAXTOR STM350063 E     /dev/sdd 
[5:0:0:0]    cd/dvd  ASUS     DRW-24D5MT       1.00  /dev/sr0 
[8:0:0:0]    disk    Generic  STORAGE DEVICE   0828  /dev/sde 
[9:0:0:0]    disk    Grain    GM8136           1.11  /dev/sdf
Mellowcandle
  • 4,795
  • 6
  • 34
  • 47
  • 1
    I assume you mean "without success" or "with no success" instead of "with success"? – NirIzr Oct 21 '18 at 07:24
  • 1
    I had a similar (but unsolved problem) but I think you could use a tool like sg_raw or write a program that sends SCSI commands over USB. – gipi Oct 21 '18 at 12:16
  • 2
    Did you try dding the devices? – NirIzr Oct 22 '18 at 06:31
  • 1
    When you say, "tried mounting the SCSI disc without success" what do you mean? Which mount options did you try, and what error messages did you receive? Like Nirlzr said, if you can dd the disc and copy some of the first bits off of it you might be able to use binwalk or some other tool to find filesystem signatures that would tell you how to mount it properly. – dingo_kinznerhook Oct 23 '18 at 21:01
  • 1
    Have you considered that this is no disk at all, but an interface that piggybacks on existing SCSI tooling? For example I have seen plenty of USB devices identify themselves as HID even though they weren't really HID in the strict sense. Just because the USB HID support is very good and widespread and it's easy to build on it. Of course this may still be a disk, it's just a though. I also second the idea of reading the whole block device, if it presents itself as such and then using Binwalk or similar tools to make sense of that. – 0xC0000022L Oct 24 '18 at 13:37
  • @NirIzr Yes, I tried DD'ing. doesn't work: dd: failed to open '/dev/sdf': No medium found – Mellowcandle Oct 25 '18 at 05:39
  • @0xC0000022L I think you're right. I don't think it's used as disc – Mellowcandle Oct 25 '18 at 05:40
  • @Mellowcandle going by this the camera (yes, despite the name it seems to be the same company) appears to run a Linux. So chances are you'd be able to go the other route and analyze the firmware to see what it's supposed to present itself as in terms of SCSI device. Also, I was thinking that perhaps - since the cam supports it - there may be no SD card inserted, which would match the error you gave for dd. Unfortunately it seems you need to provide some serial number to access the firmware. So I am out of luck. Chances are you can get source even. – 0xC0000022L Oct 25 '18 at 07:27
  • 1
    Lots of useful information at https://debugdump.com/t_812.html. – fpmurphy Oct 27 '18 at 04:14

1 Answers1

2

The term SCSI in the device description is a bit of a misnomer: it does not mean that it is a SCSI disk but just refers to the fact that the USB Mass Storage device class uses some of the SCSI protocol commands in its communications (similar to some ATA devices). Probably the most well known command is INQUIRY that is used to identify the device and its parameters. See an example here.

I doubt you’ll be able to dump anything via USB, it is probably used to communicate with the host, possibly via some custom protocol. Try to find the manufacturer’s software that can talk to the device and RE it. Or just open it and look for some flash chip you can dump.

Igor Skochinsky
  • 36,553
  • 7
  • 65
  • 115