So yes, a local USER CA can be installed for "VPN and Apps" via the network adb bridge.
adb push ca.pem /data/local/tmp
adb shell am start -n com.android.certinstaller/.CertInstallerMain -a android.intent.action.VIEW -t application/x-x509-ca-cert -d file:///data/local/tmp/ca.pem
The certificate installer in the system menu doesn't work, but calling the intent via adb does work... But... You need SCRCPY running so you can answer all the required prompts and questions, as well as setting a screenlock due to how android does local CA things.
Now to setup a https server again to see if the phone-home service will talk to me.
Dang, looks like the certs required for the phone-home service to work are hard-coded in the app itself.
:(
Oh... This seems fun...
If you set a screen lock pin, and reboot...
The device will be stuck at a pre-boot password phase. Entering the PIN booted the device, and then it shut itself down right away. Booting again will do the same but without the shutdown.
So... uh, set a screenlock and reboot. done.
The screenlock can be a pin, password, swipe. etc.
Flock Safety Kill Chain thus far:
Press back button on camera three times quickly
connect to Flock-xxxxxx hotspot with PSK: security
curl -x PUT http://192.168.43.1:8080/api/v1/system/adb/enable
adb connect 192.168.43.1
scrcpy
set a PIN/PASSWORD
adb shell reboot -p
bye bye
since the camera has "encrypted" storage, the reboot will force the pre-boot password to be entered before loading the userdata partition. No userdata, no flock apps. No hotspot. Only USB adb bridge will get you scrcpy to then enter the password.
In theory you could use the usb adb to do some intent/keystroke commands to the screenlock screen, but scrcpy is already running, and easier.
If the camera doesn't get a boot password, it shuts down to a low power state until you press buttons on the internal boards locally.
I am no longer in possession of the above pictured flock safety camera. I have passed it on to the next person who may extract it's darker secrets. Look for updates in the future. I will link when that time comes.
kajer | sudo bash