This video documents the successful reverse engineering of a wireless "pill camera," from a non-functional PCB to a live video feed. The primary method used is voltage glitching on the Texas Instruments CC1310 microcontroller to bypass security and gain JTAG access, enabling a full firmware dump. Subsequent analysis of the firmware reveals the communication protocol, including a light sensor wake-up trigger, dual data rates for status and image data (300 kbit/s and 4 Mbit/s, respectively), and the 868 MHz transmission frequency. The project culminates in a demonstration where custom firmware on a second microcontroller successfully requests and receives the camera's video feed, which is identified as headerless JPEG (MJPEG) and displayed in a custom web application.
Hacking a Pill Camera to Reveal its Secrets
0:23 Voltage Glitching for Access: A ChipWhisperer is used to perform voltage glitching on the Texas Instruments CC1310 microcontroller during its boot sequence. This attack successfully bypasses security, grants JTAG access, and allows for a complete dump of the device's firmware from its flash memory.
2:14 Protocol Analysis: Reverse engineering the firmware dump reveals the communication protocol. The camera wakes from sleep mode when a light sensor is activated. It then transmits low-speed status packets (300 kbit/s) at 868 MHz, containing information like a camera ID and counters. The firmware also contains a flag for a 920 MHz US version.
3:39 Emulating the Receiver: To get video, custom firmware is developed for a separate CC1310 board. This board acts as the receiver, listening for the camera's status packets and sending the correct response to command the camera to begin transmitting its high-speed (4 Mbit/s) video data stream.
5:40 Cracking the Video Format: The video stream's encoding is identified as simple headerless JPEG, which is characteristic of an MJPEG stream. A basic web tool is created to receive the raw data and display the resulting image.
6:05 Successful Operation and Device Context: The project is a success, with the pill camera wirelessly transmitting a clear, wide-angle fisheye image. The creator identifies the manufacturer as Ankong and explains the camera's intended use: a large external magnet guides the pill, while a belt with multiple receivers uses triangulation to determine its precise location within the body.