ez Share hacking notes (WiFi SD cards)

tl;dr: I found a way to download arbitrary files off an ez Share, but no way to list the files. Also ez Share only runs as an access point with a DHCP server which makes it super awkward.

I’m trying to get a working WiFi SD card. This is a thing that acts like a normal SD card, typically for a camera, but also has an embedded system so you can download files from it over WiFi with the card sitting in your camera. I want to use this to get data off a device that writes to an SD card and has no network interface.

Eye-Fi pioneered this tech way back in 2005. They’re gone now. Transcend made a line of WiFi SD cards for awhile. So did Toshiba with their FlashAir. They’re all off the market or only buyable for ridiculous prices. The only thing left on the market is a Chinese product called ez Share.

Long story short, ez Share is not suitable for general file usage. It’s got a very restricted design that makes it only good for photos and only in an awkward WiFi way. I’ve got some detailed notes below on my hacking attempts. Meanwhile I fond a FlashAir I could get from Germany (via eBay) for $50 so I’ve ordered that, it should be more amenable.

ez Share limitations

The WiFi only runs as an access point. You can’t make the card act like a client on your existing WiFi network. That means you have to swap your WiFi adapter to its network to download from it.

The other big problem is the card only presents a Web UI. And that web server seems hellbent on making sure you only download images from specific directories. It only wants to serve files in directories named DCIM/100CANON or DCIM/EOSMISC. And those files need to have image or video extensions. See below for a partial workaround to download arbitrary files. But I can’t get a file listing.

I couldn’t find any sign of a firmware update capability. Too bad, that might be a way to hack the thing to be more useful. Update: Biorn says there’s a way to update firmware via USB and some details here.

ez Share resources

These ez Share cards have been around for 8 years or so, but surprisingly there’s precious little information in English from folks trying to hack them. Either because they weren’t sold in to the US/Europe or because they’re so inflexible. Here’s some links I did find:

  • A download script in bash. Seems to be written for a different firmware than I have, the methods don’t work.
  • GitHub repo for that download script.
  • A clever hack to use the card with a microscope that writes to another directory. He corrupts a FAT32 filesystem to create the equivalent of a hardlinked directory.
  • Hardware notes on using the card without a camera. Doesn’t address software problems.
  • Game console hackers at GBA Temp have tried using it to run games without much success I could find.
  • An official manual.
  • The default root password is “admin”.
  • The ez Share creates a WiFi access point with SSID “ez Share”, password “88888888”.
  • My card is version 4.4.0. In detail:
    LZ1001EDPG:4.4.0:2014-07-28:62 LZ1001EDRS:4.4.0:2014-07-28:62 SPEED:-H:SPEED

Download files

I poked around at the web server trying to coerce it to give out more info than it wanted to. The big success is I was able to download arbitrary files with URLs like this:

http://ezshare.card/download?fname=2071A5~1.EDF&fdir=..\DATALOG\20210719

Note the ..\ in the path name, to get out of DCIM. The filename has to be the 8 character version; it’s a FAT32 filesystem but the firmware doesn’t seem to know it. Also there’s no ftype specified; that’s needed to avoid the “file extension must be a .jpg or other image/movie format” code.

Unfortunately trying similar tricks to get a listing of files via the web interface at /photo did not work. Neither did trying to download a whole folder; you can do that with images in the DCIM directory but apparently not with arbitrary files.

Below are some very detailed notes on exactly what I tried / learned

ez Share file and directory URLs

List photos
http://ezshare.card/photo?
http://ezshare.card/photo?vtype=0&fdir=100CANON&ftype=0&devw=320&devh=356&folderFlag=0

List videos
http://ezshare.card/photo?vtype=0&fdir=100CANON&ftype=1&devw=320&devh=356&folderFlag=0

Alternate file list? From another firmware:
http://192.168.4.1/dir?dir=A:

Download an image
http://ezshare.card/download?fname=MESQUA~1.JPG&fdir=EOSMISC&ftype=0&time=1391742389

Hack to download any file:
http://ezshare.card/download?fname=2071A5~1.EDF&fdir=..\DATALOG\20210719

Download selected photos:
http://ezshare.card/download?num=2&fdir=EOSMISC&folderFlag=0&fn1=MESQUA%7E1.JPG&fn2=202107%7E1.JPG

Download folder:
http://ezshare.card/download?fdir=EOSMISC&ftype=0&num=2&folderFlag=0

Doesn’t work but looks like it should: hack to download any folder
http://ezshare.card/download?fdir=..\DATALOG&ftype=0&num=2&folderFlag=0
http://ezshare.card/download?fdir=..\DATALOG\20210719&ftype=0&num=2&folderFlag=0

other ez Share URLs

First page:
http://ezshare.card/publicdir/welcome.htm?

Redirects to /publicdir/sendir
Redirects to
http://ezshare.card/photo

Change config screen (password)
http://ezshare.card/publicdir/index.htm

Admin page:
http://ezshare.card/config?vtype=0

Cloud Lab advertisement
http://ezshare.card/i-share/res/clab_en.htm

Version request (reported)
http://192.168.4.1/client?command=version
LZ1001EDPG:4.4.0:2014-07-28:62 LZ1001EDRS:4.4.0:2014-07-28:62 SPEED:-H:SPEED