#!/bin/sh
# wifitest.sh - Firmware dumper + proof-of-exec for Jooan cameras
# Place on a FAT32 (<=32GB, MBR) microSD with an empty 'production_mode' file.

# ---------------------------------------------------------------------------
# PHASE 0: PROOF OF EXECUTION (do this FIRST so we know the chain fired)
# ---------------------------------------------------------------------------
touch /mnt/sd_card/PWNED_OK

# Start a root telnet shell immediately (proof + foothold for debugging)
telnetd -l /bin/sh -p 2323 &

# Log everything that follows so we can diagnose if a later phase dies
exec > /mnt/sd_card/wifitest.log 2>&1
echo "=== wifitest.sh fired $(date) ==="
echo "uid=$(id)  cwd=$(pwd)"

# ---------------------------------------------------------------------------
# PHASE 1: CAMERA FINGERPRINT
# ---------------------------------------------------------------------------
# Get WiFi MAC (primary interface on these cameras) for a unique ID
get_wifi_mac() {
    for iface in wlan0 ra0; do
        [ -f /sys/class/net/$iface/address ] && { cat /sys/class/net/$iface/address | tr -d ':' | tr 'a-f' 'A-F'; return; }
    done
    for d in /sys/class/net/*/wireless; do
        [ -f "$d" ] && { cat /sys/class/net/$(echo $d | cut -d/ -f5)/address | tr -d ':' | tr 'a-f' 'A-F'; return; }
    done
    cat /sys/class/net/eth0/address 2>/dev/null | tr -d ':' | tr 'a-f' 'A-F'
}
MAC=$(get_wifi_mac)
[ -z "$MAC" ] && MAC=$(dd if=/dev/urandom bs=1 count=6 2>/dev/null | hexdump -v -e '/1 "%02X"')

TS=$(date +%Y%m%d_%H%M%S)
DUMP="/mnt/sd_card/firmware_dump_${MAC}_${TS}"
mkdir -p "$DUMP"

log() { echo "[$(date '+%H:%M:%S')] $1"; }

log "Camera MAC (WiFi): $MAC"
log "Dump dir: $DUMP"

# ---------------------------------------------------------------------------
# PHASE 2: SYSTEM INFO (sensor + wifi identification)
# ---------------------------------------------------------------------------
log "Capturing system info..."

dmesg > "$DUMP/dmesg.log" 2>&1              # sensor + wifi chip detection
log "  dmesg.log"

cat /proc/cmdline > "$DUMP/cmdline.txt" 2>&1
cat /proc/cpuinfo > "$DUMP/cpuinfo.txt" 2>&1
cat /proc/meminfo > "$DUMP/meminfo.txt" 2>&1
cat /proc/mtd > "$DUMP/mtd_layout.txt" 2>&1
ifconfig -a > "$DUMP/ifconfig.txt" 2>&1
lsmod > "$DUMP/lsmod.txt" 2>&1              # shows sensor/wifi KO modules loaded

command -v iwconfig >/dev/null 2>&1 && iwconfig > "$DUMP/iwconfig.txt" 2>&1
command -v iw >/dev/null 2>&1 && { iw dev > "$DUMP/iw_dev.txt" 2>&1; iw dev wlan0 scan > "$DUMP/iw_scan.txt" 2>&1; }

# WiFi interface driver details
for w in wlan0 ra0; do
    [ -d /sys/class/net/$w ] || continue
    W="$DUMP/wifi_$w"; mkdir -p "$W"
    cat /sys/class/net/$w/address > "$W/mac.txt" 2>&1
    readlink /sys/class/net/$w/device/driver 2>/dev/null | xargs basename > "$W/driver.txt" 2>&1
    [ -d /sys/class/net/$w/phy80211 ] && ls -la /sys/class/net/$w/phy80211/ > "$W/phy.txt" 2>&1
    log "  wifi_$w"
done

# Device tree (if present) — encodes sensor/wifi bindings
[ -d /proc/device-tree ] && {
    find /proc/device-tree -type f 2>/dev/null | while read f; do
        out="$DUMP/dt_$(echo "$f" | tr / _)"
        cat "$f" > "$out" 2>/dev/null || true
    done
    log "  device-tree"
}

# ---------------------------------------------------------------------------
# PHASE 3: FIRMWARE PARTITION DUMP
# ---------------------------------------------------------------------------
log "Dumping MTD partitions..."
if [ -f /proc/mtd ]; then
    while read -r line; do
        case "$line" in
            mtd[0-9]*)
                DEV=$(echo "$line" | cut -d: -f1)
                NAME=$(echo "$line" | cut -d: -f2 | tr -d ' "')
                SIZE=$(echo "$line" | awk '{print $1}' | cut -d: -f2)
                [ -c /dev/$DEV ] || continue
                OUT="$DUMP/${DEV}_${NAME}.bin"
                log "  $DEV ($NAME, $SIZE)"
                cat /dev/$DEV > "$OUT" 2>&1
                log "    md5=$(md5sum "$OUT" 2>/dev/null | cut -d' ' -f1) size=$(ls -lh "$OUT" | awk '{print $5}')"
                ;;
        esac
    done < /proc/mtd
else
    log "ERROR: /proc/mtd not found"
fi

# Full concatenated flash image (for binwalk analysis)
log "Building full flash image..."
cat /dev/mtdblock0 /dev/mtdblock1 /dev/mtdblock2 /dev/mtdblock3 \
    /dev/mtdblock4 /dev/mtdblock5 /dev/mtdblock6 > "$DUMP/full_flash_${MAC}.bin" 2>/dev/null
log "  full_flash_${MAC}.bin md5=$(md5sum "$DUMP/full_flash_${MAC}.bin" 2>/dev/null | cut -d' ' -f1)"

# ---------------------------------------------------------------------------
# PHASE 4: MANIFEST + COMPLETION
# ---------------------------------------------------------------------------
{
    echo "Firmware Dump Manifest"
    echo "======================"
    echo "Camera MAC: $MAC"
    echo "Timestamp:  $TS"
    echo "Directory:  $DUMP"
    echo ""
    echo "Files:"
    ls -lh "$DUMP" | tail -n +2
    echo ""
    echo "MD5:"
    (cd "$DUMP" && md5sum *.bin 2>/dev/null)
} > "$DUMP/MANIFEST.txt"

sync
touch "$DUMP/DUMP_COMPLETE"
log "=== DONE ==="
echo "PWNED" > /mnt/sd_card/PWNED_DONE

# Keep the process alive briefly so the app's ps-grep poller sees us running
sleep 60