cjj25
Firmware rtsp3903n+45 camera from NL
I found you got a similar board as I (https://user-images.githubusercontent.com/31572463/136786404-db857b44-ab6a-4585-aebe-1f5aa3b5d77f.jpg) could you please let me know which pins you used for uart? I'd gladly share the firmware, if it will be possible to access uart.
Found this one as well https://github.com/TheCrypt0/yi-hack-v4/issues/154 I tried those those pads in the middle both ways and no output on my CP2102 showed.
Can you post the exact model of this camera and maybe an online shop url?
It'll give me a clue as to what firmware its running and if I know of any known payloads you could try via the SD.
It's Kruidvat Smart
https://www.kruidvat.nl/kruidvat-smart-indoor-ip-camera/p/5314128?gclid=Cj0KCQjwteOaBhDuARIsADBqRehNUKIbFA0hlQAVy9L2kdPxGX0-fsCEMcw0oAUh52urPL-edkCT__AaAssuEALw_wcB
I tried some sdcard payloads like Mercury720/1080 but interesting part everything I put on sdcard being removed during camera boot process. I'll investigate more and report.
On Tue, Oct 25, 2022, 23:47 cjj25 @.***> wrote:
Can you post the exact model of this camera and maybe an online shop url?
It'll give me a clue as to what firmware its running and if I know of any known payloads you could try via the SD.
— Reply to this email directly, view it on GitHub https://github.com/cjj25/Yi-RTS3903N-RTSPServer/issues/29#issuecomment-1291178935, or unsubscribe https://github.com/notifications/unsubscribe-auth/AHBD5763Q3OSHBQIUEEJNKTWFBIPTANCNFSM6AAAAAAROC7QJY . You are receiving this because you authored the thread.Message ID: @.***>
There is "Kruidvat Smart Home" Android app for control. Device info in the app says that "Main module" and "MCU module" version is 5.2.7.
There is a manual book in the box which says the exact model is "SH.63.224". Here is the link on pdf, though it's in Dutch and there is nothing useful IMHO. https://handleidingkwijt.com/kruidvat-sh-63-224-ip-camera/
On Tue, Oct 25, 2022, 23:47 cjj25 @.***> wrote:
Can you post the exact model of this camera and maybe an online shop url?
It'll give me a clue as to what firmware its running and if I know of any known payloads you could try via the SD.
— Reply to this email directly, view it on GitHub https://github.com/cjj25/Yi-RTS3903N-RTSPServer/issues/29#issuecomment-1291178935, or unsubscribe https://github.com/notifications/unsubscribe-auth/AHBD5763Q3OSHBQIUEEJNKTWFBIPTANCNFSM6AAAAAAROC7QJY . You are receiving this because you authored the thread.Message ID: @.***>
Yes, I tried with all binaries combinations, unfortunately no luck, nothing changes. I tried as well mercury1080p solution without any luck. Going to try LSC solution from Guino next week, just found new discussion, I have those cams as well, maybe it will work for Kruidvat.
What HW could I use to dump firmware in case of failure? I tried to find an flash memory chip, but quick look didn't give any result. Any suggestion?
On Fri, Nov 25, 2022, 22:23 cjj25 @.***> wrote:
Did you try this method?
— Reply to this email directly, view it on GitHub https://github.com/cjj25/Yi-RTS3903N-RTSPServer/issues/29#issuecomment-1327891573, or unsubscribe https://github.com/notifications/unsubscribe-auth/AHBD57ZGA2J3WE6BPHWZYNTWKEU6RANCNFSM6AAAAAAROC7QJY . You are receiving this because you authored the thread.Message ID: @.***>
For taking a dump of your SOIC8 chip, something like this should work for you.
I use the same board as this camera for my development, but it was originally a Yi based camera.
When you tried my Tuya RTSP method, did it create a backup folder on the root of your SD card?
No backup folder. It doesn't run the scripts during the startup, looks like something differs in the firmware. And it shows pretty strange fw version in the app. Thanks for advice, I'll do more tests and try to take a dump, if there will be no success.
On Fri, Nov 25, 2022, 22:46 cjj25 @.***> wrote:
For taking a dump of your SOIC8 chip, something like this https://amzn.eu/d/duR98jg should work for you.
I use the same board as this camera for my development, but it was originally a Yi based camera.
When you tried my Tuya RTSP method, did it create a backup folder on the root of your SD card?
— Reply to this email directly, view it on GitHub https://github.com/cjj25/Yi-RTS3903N-RTSPServer/issues/29#issuecomment-1327898595, or unsubscribe https://github.com/notifications/unsubscribe-auth/AHBD576FSQ3DRYLPIM2A7BDWKEXTVANCNFSM6AAAAAAROC7QJY . You are receiving this because you authored the thread.Message ID: @.***>
It's certainly a firmware I've not seen before! I'd love to have a copy to create a payload for it.
Keep us in the loop!
So no luck with other payload methods I found, going to proceed with the programmer. I believe this one is same as you posted? https://www.amazon.nl/dp/B08TVNPTQK/
On Fri, Nov 25, 2022, 22:55 cjj25 @.***> wrote:
It's certainly a firmware I've not seen before! I'd love to have a copy to create a payload for it.
Keep us in the loop!
— Reply to this email directly, view it on GitHub https://github.com/cjj25/Yi-RTS3903N-RTSPServer/issues/29#issuecomment-1327903669, or unsubscribe https://github.com/notifications/unsubscribe-auth/AHBD576I62Z2QQI2LXKTJTTWKEYWHANCNFSM6AAAAAAROC7QJY . You are receiving this because you authored the thread.Message ID: @.***>
That should do the trick.
Do you have access to a soldering iron? I remove my chips before reading them as attempting while still soldered to the PCB often fails.
So bingo, I got it. 8MB of pure happiness. binwalk says there is tons of interesting inside. Here you go @cjj25 : https://mega.nz/folder/eeZk0QSB#HUh2Q7p-OytEX52cmvk68g
I'll leave chip detached(kh25l6436f) for a while, so let me know, if there something else I could dump from it.
https://github.com/guino/LSC1080P here it describes how to get working telnet without breaking the device, it's enough to put product.cof file with specific text on sdcard.
So bingo, I got it. 8MB of pure happiness. binwalk says there is tons of interesting inside. Here you go @cjj25 : https://mega.nz/folder/eeZk0QSB#HUh2Q7p-OytEX52cmvk68g
I'll leave chip detached(kh25l6436f) for a while, so let me know, if there something else I could dump from it.
Welcome to the world of tinkering... this might be the start of dumping many flash chips!
Your firmware appears to be a hybrid of this project (dgiot).
Interesting link you posted, I've checked your firmware and confirm there are references in the main binary for that file.. specifically:
/mnt/mmc/mmc1/product.cof/etc/conf/product.cof
These are the default settings cooked into your firmware: `/etc/conf/product.cof
[CONST_PARAM]
lamp_board=0
capture_vol=100
play_vol=100
ptz_opposite_run=2
image_flip=0
ircut_flip=0
[DEFAULT_SETTING]
telnet=0
language=1100
[SENSITIVE]
day_num=0
night_num=0
The Tuya IPC SDK that's cooked into the binary does contain the RTSP ability and can most likely be patched the same way as I do the other binaries, specifically between 0x0047b544 (tuya entry) and 0x007bd1c4 (start streams).
Have you tested enabling telnet with the method you posted?
There's also references to it in the `/etc/init.d/ (commented out)
I was able to get telnet access, tried to find any possible secret option to enable rtsp in an easy way, but no luck so far.
Please see this issue posted on my other repo (exact same firmware) and how he managed to use my other RTSPServer. (edit: Looks like you were already aware of it)
Also, interesting WiFi defaults: SSID: TP-LINK_DG Password: dgiot0202
I was able to get telnet access, tried to find any possible secret option to enable rtsp in an easy way, but no luck so far.
I've not flashed your firmware to my dev camera yet.
Could you give me the output of the following command "cat /proc/mtd" and "dmesg"
Then possibly run the make_backup.sh script on an SD (you'll need to modify in the script paths from /tmp/sd/ to /mnt/mmc/mmc1/) so we have all the individual blocks and their correct sizes (makes it easier rebuilding the firmware parts).
dev: size erasesize name
mtd0: 00800000 00010000 "global"
mtd1: 00040000 00010000 "boot"
mtd2: 00010000 00010000 "hconf"
mtd3: 001c0000 00010000 "kernel"
mtd4: 00540000 00010000 "rootfs"
mtd5: 000b0000 00010000 "userdata"```
~ # dmesg
turn off boot console early0
hconf type 3, size 0x10000, ebsize 0x10000
is_header invalid header: magic 0xffffffff, num -1, len -1
hconf_init hconf init success
ALSA device list:
No soundcards found.
Warning: unable to open an initial console.
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 180K (80483000 - 804b0000)
usb 1-1: New USB device found, idVendor=0bda, idProduct=f179
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: 802.11n
usb 1-1: Manufacturer: Realtek
usb 1-1: SerialNumber: 68B9D34E5708
rlx snd internal codec init
soc-audio soc-audio.0.auto: ASoC: machine RLX_INTERN_CARD should use snd_soc_register_card()
soc-audio soc-audio.0.auto: rlx-codec-digital <-> pcm-platform mapping ok
soc-audio soc-audio.0.auto: rlx-codec-analog <-> pcm-platform mapping ok
rtscam:isp resvd mem addr : 0x005c0000, size : 0x157f000
mmc0: new SDHC card at address 0001
mmcblk0: mmc0:0001 SD8GB 7.28 GiB
mmcblk0: p1
rtscam:rtscam_mem_init v:0xa05c0000 p:0x005c0000 s:0x0000157f
rtscam:rtscam_lock_init
rtscam:rtscam_soc_probe
rtscam:rtscam_hx280_probe
rtscam:hx280enc:HW at base <0x18060000> with ID <0x48317011>
rtscam:rtscam_jpgenc_probe
rtscam:rtscam_osd2_probe
rtscam:rtstream_init
usbcore: registered new interface driver rtl8188fu
jffs2: notice: (389) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
rtscam:begin to load fw from isp.fw
rtscam:Load firmware size : 131024.
rtscam:begin to load fw from /lib/firmware/SC1245.bin
rtscam:Load firmware size : 131024.
rtscam:Found ISP 1.011 device
rtscam:video device <rts3903-isp> registered
rtscam:rts3903-isp initialized
Started watchdog timer
Started watchdog timer
MS_MHal_GPIO_Pad_Oen: setting gpio_direction_output 19
MS_MHal_GPIO_Pad_Oen: setting gpio_direction_output 17
MS_MHal_GPIO_Pad_Oen: setting gpio_direction_output 16
MS_MHal_GPIO_Pad_Oen: setting gpio_direction_output 15
MS_MHal_GPIO_Pad_Oen: setting gpio_direction_output 11
MS_MHal_GPIO_Pad_Oen: setting gpio_direction_output 14
MS_MHal_GPIO_Pad_Oen: setting gpio_direction_output 22
MS_MHal_GPIO_Pad_Oen: setting gpio_direction_output 18
gpio_init ---- ret = 0
ker_driver_init
FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
rtscam:get regulator io fail
rtscam:get io power fail
rtscam:get regulator analog fail
rtscam:get analog power fail
rtscam:get regulator core fail
rtscam:get core power fail
(motor = 0, time = 2500000
(motor = 1, time = 3500000```
~ # ps au
ps: invalid option -- a
~ # ps -au
ps: invalid option -- a
~ # ps u
ps: invalid option -- u
~ # ps -u
ps: invalid option -- u
~ # ps
PID USER VSZ STAT COMMAND
1 root 1244 S init
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
4 root 0 SW [kworker/0:0]
5 root 0 SW< [kworker/0:0H]
6 root 0 SW [kworker/u2:0]
7 root 0 SW [rcu_preempt]
8 root 0 SW [rcu_bh]
9 root 0 SW [rcu_sched]
10 root 0 SW< [khelper]
11 root 0 SW< [writeback]
12 root 0 SW< [bioset]
13 root 0 SW< [kblockd]
14 root 0 SW [khubd]
15 root 0 SW [kworker/0:1]
16 root 0 SW< [cfg80211]
17 root 0 SW [kswapd0]
18 root 0 SW [fsnotify_mark]
19 root 0 SW< [crypto]
28 root 0 DW [enable_swp_task]
29 root 0 SW< [dwc_otg]
30 root 0 SW< [deferwq]
31 root 0 SW [kworker/u2:1]
32 root 0 SW< [kworker/0:1H]
255 root 0 SW [kworker/u2:2]
270 root 0 SW [mmcqd/0]
390 root 0 SWN [jffs2_gcd_mtd5]
403 root 149m S ./dgiot
404 root 1240 S /bin/getty -L ttyS1 57600 vt100
412 root 2008 S ./daemon
426 root 1240 R telnetd
482 root 0 SW [RTW_CMD_THREAD]
491 root 1116 S wpa_supplicant -Dwext -iwlan0 -c /etc/conf/wpa_supplicant.conf
525 root 1240 S udhcpc -b -i wlan0 -h dgiot -s /usr/share/udhcpc/default.script
565 root 1244 S -sh
708 root 0 SW [kworker/0:2]
1358 root 1240 R ps
~ # mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
none on /sys/kernel/debug type debugfs (rw,relatime)
ramfs on /var type ramfs (rw,relatime)
ramfs on /dev type ramfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/mtdblock5 on /etc/conf type jffs2 (rw,relatime)
/dev/mmcblk0p1 on /mnt/mmc/mmc1 type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)```
Ok, place this patched binary on your sd card.
Use ps to find the pid of the currently running application, for example the output shows 403.. kill it via kill -9 403
Browse to your sdcard using cd /mnt/mmc/mmc1/ and run ./dgiot.patched
See if it starts, what's its output and if its stable, check RTSP on rtsp://{IP_ADDRESS}:8554/
dgiot.patched.zip extract this
I updated the link above, added there backup.7z with flash partitions dumps. Segmentation fault:
/mnt/mmc/mmc1 # ./dgiot.patched
Segmentation fault (core dumped)
Better, might be working. But there is another problem, if I kill dgiot process and run another one, it prints a lot of debug and device reboots after saying "===========>Middleware WifiStationModeCreate". Here I'm posting the stock dgiot output and the patched one.
I believe that's reconnecting to WiFi.
Can you perform the same actions but this time pipe the output to a log file.
For example ./dgiot.patched > /tmp/output.log
Then reconnect to telnet and grab the /tmp/output.log (cat /tmp/output.log) or pipe it to the sdcard
Hm, interesting, but it doesn't write to file, when I place it on sdcard. Anyway I was able to save the log to /etc/conf, it almost same, just several more lines about wifi. After that device reboots, even, if I start stock dgiot binary. dgiot_log_patched2.txt
Yeah it's getting mixed up because it's already initialised its state (we don't want to be overwriting the flash just yet).
Here are some key locations that you may need to delete before starting the patched binary:
- rm -rf /tmp/regs
- rm -rf /tmp/tuya.log
We basically want to start the binary like it's a fresh instance / new boot.
Let me know if that allows it to start, if not we might need to overwrite the partition.
I cannot see any files in /tmp. find says there is not tuya.log anywhere. I tried to kill other processes but without any luck. Is it possible to replace FS on root partition with some RW filesystem?