GT111A Camera Root & De-Cloud

A cheap Wi-Fi PTZ camera — GT111A on an Anyka AK3918E — abandoned by its cloud app. The hardware was perfectly fine; the software made it unusable. My goal: run it fully locally, cloud-free, on open source.

45 default passwords, 30+ SD-card triggers and known CVEs all failed on this unit. The break came from reading the chipset’s open-source SDK: a factory-test service called daemon was accepting commands over the network with zero authentication.

I reverse-engineered its wire protocol byte by byte (length fields, checksum, response semantics). The file-name field ../../bin/busybox with the argument tcpsvd 0 2327 /bin/sh # opens a passwordless root shell — the trailing # comments out the junk the service appends. Persistence: a DES hash in the device’s writable partition; telnet root on every boot.

ARM926 core, 36 MB RAM, 8 MB SPI flash; Linux 3.4 + uClibc. Full flash dumped, squashfs partitions unpacked, boot chain (rcS → rc.local → service.sh) and 14 sensor modules mapped. The PTZ motors turned out to be driven by an MCU at I2C address 0x49 — discovered at this stage.

After root, an open-source stack went in from the SD card: the camera streamed H.264 720p + audio at rtsp://camera:554/vs0, steerable from a browser PTZ pad. Physically proven with two frames captured before and after a pan command — with the cloud software never running.

The persistence flash put this unit into a boot loop; it sits recoverable with hardware access (I hold the full backup). The method chain was proven and published to GitHub with bilingual docs; within a day it was indexed by security databases like Vulners and Sploitus — Vulners kaydı.

Live-stream frames, port scans and ffprobe output — all evidence files in the repo: github.com/4onurdemir/anyka-ak3918-gt111a-root-decloud

The “rehearsal fallacy”: a script that works by hand is not a script that works at boot — a rehearsal that doesn’t mirror the flashed conditions isn’t one. Recovery hardware comes before flashing. And flash is always the last step. These lessons became a 12-item checklist in the repo.