# Bypass video capture limit on Ray-Ban Stories

Frida hook on STLMcuSettingHandler in Ray-Ban Stories View app swapped a settings command ID to VideoCaptureDurationMs, extending video capture beyond the 30s limit.

- Payout: $1,500
- Severity: low
- Program: Meta / Facebook
- Credited: Philippe Harewood
- Disclosed: 2021-11-05
- Write-up quality: 6/10
- Original: https://philippeharewood.com/bypass-video-capture-limit-on-ray-ban-stories/
- Library page: https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-bypass-video-capture-limit-on-ray-ban-stories
- Tags: domain:iot domain:mobile impact:integrity kind:bounty platform:blog sev:low tech:android technique:reverse-engineering technique:source-review vuln:access-control vuln:business-logic

**Target:** iOS View (Assistant) app / STLMcuSettingHandler firmware setting command
**Root cause:** The View app's writeSetting:value:completion: sends arbitrary Int32 setting IDs/values to the glasses firmware without restricting which settings the UI is allowed to modify, so a hooked call can substitute VideoCaptureDurationMs (0x8004) for a legitimate UI setting.
**Steps:**
1. Reverse StellaWifiService.apk and locate `Uint32SettingsEnum.smali`; note `VideoCaptureDurationMs:I = 0x8004`
2. Identify `STLMcuSettingHandler - writeSetting:value:completion:` as the shared path for UI settings like LED brightness (0x8038/0x8037)
3. Write Frida script hooking that method and overwrite `args[2]=ptr(0x8004)`, `args[3]=ptr(0xea60)` (60000 ms)
4. Run `frida -U View -l video-length.js`
5. In View app settings toggle any System alerts option (e.g. LED brightness) to trigger the hooked call
6. Next video capture records 60s instead of the 30s limit
**How found:** Enumerated firmware settings exposed via the View app, noticed all UI settings share one writeSetting handler, and hypothesized that any enum ID in Uint32SettingsEnum could be written through it, then tested by swapping in VideoCaptureDurationMs.
**Exploitation:** Attacker with local device access runs Frida against the View app, hooks the setting-write method, and substitutes the setting ID/value so the firmware persists a 60s capture duration; no remote vector described.
**Insight:** When a mobile app proxies device settings to firmware over a generic setter, enumerate the firmware's settings enum and check whether the app validates which IDs the UI may write; a single shared setter often accepts any enum value.