Where we go from here. - pingumacpenguin/FH86XX_Cameras GitHub Wiki

Obviously getting root is just the beginning.

We know what architecture the camera uses, so it should be possible to compile some C code and run it on the camera from the SD card, and from there anything is possible.

We know how the flash is laid out, so it should be possible to dump, unpack and repack the flash partitions.

We know how to tar things to the SD card, and dump the flash partitions there.

We know there is a utility on the camera to flash upgrades.

We know how to control the White and IR lights.

We know how to send sound files to the speaker.

we know how to watch and listen to the rstp stream from the camera.

We should be able to use telnet (and "expect" scripts for example) or the camera's web app to control its motion, and where it sends alerts and so forth.

Controlling camera motion is probably where I'll focus next.