New Cam, New Firmware? Hack possible? Cacagoo EU WiFi IP Kamera (XY-R9420-F2)

[zackfuchtel]

Hello,

How to hack these? Need RTSP only, but other features welcome also.

I got an new cam. This one: https://www.amazon.de/CACAGOO-%C3%9CberwachungsKamera-innen-wlan-handy-CACAGOO-1080P-WLAN-IP-Kamera-Babyphone-mit-2-Wege-Audio/dp/B07MS85YLT

FW version 7.1.00.25A_202002271051 - Possible FW Name on SD-root maybe r10m. https://github.com/TheCrypt0/yi-hack-v4/issues/163

Factory/factory_test.sh seems to be working, I got a backup with bins and mtd.txt

dev:    size   erasesize  name
mtd0: 00800000 00010000 "global"
mtd1: 00030000 00010000 "boot"
mtd2: 00150000 00010000 "kernel"
mtd3: 001c0000 00010000 "rootfs"
mtd4: 00300000 00010000 "userdata"
mtd5: 001a0000 00010000 "rootfs_backup"
mtd6: 00010000 00010000 "vd1"
mtd7: 00010000 00010000 "conf"

Boot Log:

10-24 10:24:08.008 cloud.c:5399|sys_init() open share mem ok
10-24 10:24:08.213 dispatch.c:4482|main() sysversion:7.1.00.25A_202002271051
10-24 10:24:08.467 dispatch.c:727|get_productinfo() 
10-24 10:24:08.467 dispatch.c:731|get_productinfo() product info partition exist!
10-24 10:24:08.467 dispatch.c:735|get_productinfo() product info partition is not empty, read it!
10-24 10:24:08.467 dispatch.c:787|get_productinfo() hardware version is not empty, read it!
10-24 10:24:08.467 dispatch.c:789|get_productinfo()  ptz_en[1] ptz_dir hor[1] ver[1] cds[3] mirror[1] resolution[1] def_x[00] def_y[0] isp[0] 
10-24 10:24:08.467 dispatch.c:1209|get_config() got sn(o9SGLaTgd9SDlEuCUkA9fAH6UYxwIo1w)
10-24 10:24:08.467 dispatch.c:1210|get_config() got pwd(XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
10-24 10:24:08.467 dispatch.c:1211|get_config() got ssid(XXXXXXXXX)
10-24 10:24:08.467 dispatch.c:1212|get_config() got tnp_init_string(MMFBJPLJXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXKPENIDOAJCP)
10-24 10:24:08.467 dispatch.c:4576|main() hw_type(2)
10-24 10:24:08.468 p2p_tnp.c:6741|main() fshare_open ok
10-24 10:24:08.807 dispatch.c:501|choose_server() in choose_server, region_id = 1, api_server = https://plt-api.xiaoyi.com, sname = RealPJ, dlproto = micn
10-24 10:24:08.941 dispatch.c:501|choose_server() in choose_server, region_id = 16, api_server = https://plt-api-de.xiaoyi.com, sname = RealPJ, dlproto = mieu
10-24 10:24:08.955 ptz_ctl.c:124|ptz_stop() PTZ stop OK
10-24 10:24:08.962 dispatch.c:4733|main() init ok, cost time(873 ms)
10-24 10:24:09.033 mp4record.c:1293|main() recordevent_init finish
10-24 10:24:09.410 dispatch.c:2534|do_mq_process() dispatch got (0x7f)
10-24 10:24:09.410 dispatch.c:4370|do_mq_process() Process (0x7f) end
10-24 10:24:09.410 watch_process.c:116|get_watch_info() check_interval=10
10-24 10:24:09.631 watch_process.c:134|get_watch_info() process=dispatch;cmd=cd /home/app;./dispatch &;
10-24 10:24:09.631 watch_process.c:134|get_watch_info() process=cloud;cmd=cd /home/app;./cloud &;
10-24 10:24:09.632 watch_process.c:134|get_watch_info() process=rmm;cmd=reboot;
10-24 10:24:09.632 watch_process.c:134|get_watch_info() process=p2p_tnp;cmd=cd /home/app;./p2p_tnp &;
10-24 10:24:09.632 watch_process.c:134|get_watch_info() process=mp4record;cmd=cd /home/app;./mp4record &;
10-24 10:24:09.632 watch_process.c:134|get_watch_info() process=arp_test;cmd=cd /home/app;./arp_test &;
10-24 10:24:09.632 watch_process.c:134|get_watch_info() process=oss;cmd=cd /home/app;./oss &;
02-24 14:11:09.100 dispatch.c:2318|p_worker() DISPATCH_SET_DEFAULT_TIME 1614175869
02-24 14:11:09.139 mp4record.c:1304|main() init_finish(1), start_with_reset(0)
02-24 14:11:09.140 mp4record.c:1306|main() mp4 mode start init_finish
02-24 14:11:09.141 mp4record.c:1312|main() fshare_open ok
02-24 14:11:09.147 dispatch.c:1720|do_monitor_wifi() wifi disconnected, now reconnect wifi
02-24 14:11:15.427 rmm.c:1541|msg_proc() pid[805]
02-24 14:11:15.990 dispatch.c:1732|do_monitor_wifi() wpa connected , now dhcp
02-24 14:11:16.392 dispatch.c:1734|do_monitor_wifi() wpa connected , now dhcp finish
02-24 14:11:16.596 ptz_ctl.c:124|ptz_stop() PTZ stop OK
02-24 14:11:17.433 dispatch.c:1478|check_wifi_connect() bssid(48:8f:5a:23:6f:56)
02-24 14:11:17.433 dispatch.c:1500|check_wifi_connect() ip(192.168.178.69)
02-24 14:11:17.446 dispatch.c:1511|check_wifi_connect() gw(192.168.178.254)
02-24 14:11:18.443 watch_process.c:171|check_watch_info() cloud crashed!
02-24 14:11:18.443 watch_process.c:171|check_watch_info() p2p_tnp crashed!
02-24 14:11:18.443 watch_process.c:171|check_watch_info() arp_test crashed!
02-24 14:11:18.522 dispatch.c:1520|check_wifi_connect() gwmac(48:8F:5A:C6:93:18)
02-24 14:11:18.570 dispatch.c:1530|check_wifi_connect() mask(255.255.255.0)
02-24 14:11:18.671 dispatch.c:1540|check_wifi_connect() mac(38:01:46:79:C7:BD)
02-24 14:11:18.817 dispatch.c:1561|check_wifi_connect() signal_quality(83)
02-24 14:11:19.877 dispatch.c:1586|check_wifi_connect() signal_quality(83)
02-24 14:11:24.832 ptz_ctl.c:124|ptz_stop() PTZ stop OK
02-24 14:11:27.777 ptz_ctl.c:124|ptz_stop() PTZ stop OK
02-24 14:11:27.837 ptz_ctl.c:124|ptz_stop() PTZ stop OK
02-24 14:11:27.841 ptz_ctl.c:124|ptz_stop() PTZ stop OK
02-24 14:11:28.255 ptz_ctl.c:124|ptz_stop() PTZ stop OK
02-24 14:11:28.453 watch_process.c:171|check_watch_info() cloud crashed!
02-24 14:11:28.465 watch_process.c:171|check_watch_info() p2p_tnp crashed!
02-24 14:11:28.577 cloud.c:5399|sys_init() open share mem ok
02-24 14:11:28.865 cloud.c:5288|yi_sync_time() cmd=/backup/cloudAPI -c 136 -url http://plt-api-de.xiaoyi.com/v2/ipc/sync_time 
02-24 14:11:28.865 cloud.c:2113|need_update() cmd = /backup/cloudAPI -c 145 -url "https://plt-api-de.xiaoyi.com/vmanager/ipc/firmware/upgrade/silent" -did A0016000P4KTVE200709 -sname RealPJ -version 7.1.00.25A_202002271051 
02-24 14:11:28.870 p2p_tnp.c:6741|main() fshare_open ok
02-24 14:11:29.055 dispatch.c:2534|do_mq_process() dispatch got (0x7f)
02-24 14:11:29.056 dispatch.c:4370|do_mq_process() Process (0x7f) end
02-24 14:11:29.056 p2p_tnp.c:2055|p2p_set_tnp_init_status() p2p_set_tnp_init_status 1 send_msg ok!
02-24 14:11:29.056 dispatch.c:2534|do_mq_process() dispatch got (0x7f)
02-24 14:11:29.056 dispatch.c:4370|do_mq_process() Process (0x7f) end
02-24 14:11:29.056 p2p_tnp.c:2055|p2p_set_tnp_init_status() p2p_set_tnp_init_status 2 send_msg ok!
02-24 14:11:29.057 dispatch.c:2534|do_mq_process() dispatch got (0x7f)
02-24 14:11:29.057 dispatch.c:4370|do_mq_process() Process (0x7f) end
02-24 14:11:29.057 p2p_tnp.c:2055|p2p_set_tnp_init_status() p2p_set_tnp_init_status 3 send_msg ok!
02-24 14:11:29.057 p2p_tnp.c:6470|tnp_proc() PPPP_API Version: d2020e06 210.2.14.6
02-24 14:11:29.304 p2p_tnp.c:6480|tnp_proc() PPPP_NetworkDetect() ret = 0
02-24 14:11:29.305 p2p_tnp.c:6481|tnp_proc() -------------- NetInfo: -------------------
02-24 14:11:29.305 p2p_tnp.c:6482|tnp_proc() Internet Reachable     : YES
02-24 14:11:29.305 p2p_tnp.c:6483|tnp_proc() P2P Server IP resolved : YES
02-24 14:11:29.305 p2p_tnp.c:6484|tnp_proc() P2P Server Hello Ack   : YES
02-24 14:11:29.305 p2p_tnp.c:6485|tnp_proc() Local NAT Type         :
02-24 14:11:29.305 p2p_tnp.c:6496|tnp_proc()  Port-Restricted Cone
02-24 14:11:29.305 p2p_tnp.c:6503|tnp_proc() My Wan IP : 92.116.33.71
02-24 14:11:29.305 p2p_tnp.c:6504|tnp_proc() My Lan IP : 192.168.178.69
02-24 14:11:29.305 p2p_tnp.c:6506|tnp_proc() InitStr(MMFBJPLJXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXKPENIDOAJCP)
02-24 14:11:29.305 p2p_tnp.c:6507|tnp_proc() did(TNPXGAC-405638-FDCZC)
02-24 14:11:29.307 dispatch.c:2534|do_mq_process() dispatch got (0x7f)
02-24 14:11:29.307 dispatch.c:4370|do_mq_process() Process (0x7f) end
02-24 14:11:29.307 p2p_tnp.c:2055|p2p_set_tnp_init_status() p2p_set_tnp_init_status 4 send_msg ok!
02-24 14:11:29.615 cloud.c:5295|yi_sync_time() {"code":"20000","time":1614178357910}
02-24 14:11:29.616 cloud.c:520|cloud_set_time() msg snd success
02-24 14:11:29.616 cloud.c:5307|yi_sync_time() yi_sync_time ok!
02-24 14:11:29.616 cloud.c:5383|sync_time() sync_time ok!
02-24 14:11:29.616 cloud.c:4435|yi_proc() yi_proc ok, update time[8]
02-24 14:52:37.100 dispatch.c:2534|do_mq_process() dispatch got (0x71)
02-24 14:52:37.100 dispatch.c:2610|do_mq_process() DISPATCH_SET_TIME 1614178357 
02-24 14:52:37.101 dispatch.c:4370|do_mq_process() Process (0x71) end
02-24 14:52:37.102 cloud.c:2426|webapi_do_login() now do login 
02-24 14:52:37.102 cloud.c:2453|webapi_do_login() cmd = /backup/cloudAPI -c 138 -url "https://plt-api-de.xiaoyi.com/v4/ipc/on_line" -key XXXXXXXXXXXW -keySec XXXXXXXXXXXXrW -uid TNPXGAC-405638-FDCZC -version 7.1.00.25A_202002271051 -ssid "XXXXXXXXXXXXX" -mac 38:01:46:79:C7:BD -ip 192.168.178.69 -signal_quality 83 -packetloss 0 -p2pconnect 0 -p2pconnect_success 0 -apmode false -tfstat 10000 
02-24 14:52:37.105 dispatch.c:2534|do_mq_process() dispatch got (0x92)
02-24 14:52:37.105 dispatch.c:3080|do_mq_process() set DISPATCH_SET_PANORAMA_CAPTURE_STATE [0x0]
02-24 14:52:37.105 dispatch.c:4370|do_mq_process() Process (0x92) end
02-24 14:52:37.205 cloud.c:2121|need_update() ret = {"code":1,"msg":"SUCCESS","result":{"needUpdate":"false","downloadPath":null,"downloadTime":null,"version":null,"sdFlag":null,"message":null,"md5Code":null,"fileName":null,"forceUpdate":null}}
02-24 14:52:38.195 cloud.c:2465|webapi_do_login() {"code":"20000","appParam":"","css_flag":0,"css_mode":0,"codingProtocol":"265","abilityTable":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXA0B41E0B286D1CB41E7FD090AA7822771418950E08993F2EE8E17DEF90B7C1D5D6485621BDFB5B445991F248724F19EB472C4D5B6CC3D594EF73C279BCEEDDC35A37B49B4B2468E91333FCB06F1BF125E9D356A5A860959F23977492114E1203AA6345CA5834BC2A4216D05312E5D912A23F6751A7530CBA9DAE9CF1A80A09EA147038855F69452E43531F7E66F3D101A1624FF56DC9C998F88FD0EDA66A587DB5B3A0947696473330BD43ABBAA07D2E54434A04D2C01CAADBC1A7CC40F701B6AAA32BDA72906E04567C4636CC08B2709B84819EC9C83058F8109AD8D18702B4036597907917195C82A301D8A2539C437732424F5679C3E00E252FAEA9F6CBDEABD5D93DADFDD76206E682D7CE9B5B0B9573577665E9941FF9B3C7525841D48A2B2F247D000ACDD43CC163C65AAB95A77063915BD9FA20502FB11A6506F2820B26A88CBDFED5650B66956C07C07AF4936B2780865EE4EE5565C6F617D242C916546DB9AF9DADF1A3C51C1D013016A9D2E8DCF40D29559E1221F74F479248CD83FAD1B30ADD6B999C8C556A7316104F75D98EE4E6E2D0CD60DB834DAE151E93E11F196ECA9AE61BE126E467792F5CE0F8C7898A8C4538DF1566EFD0034A76A8C57DC4B0BEB9DFE56FAE0B5442A16B97A771783F5AC9774329F9148E349747EA16EA0B45AFAF29686B6F80052718FA5E7ED033456AE401C0351D2E6FC1142C92F74A639DD47C0BE5A9E9AC58F4A381A7F224AD0E833F69DDB4AF59B50ADEC59C0BE065852A214339EE314A739F3CB60131F0432F4657249676AC9E570D1A7206DA113300B15724C186CF8E83599AC7B9EB5568607B5ABBD78809AB1AF25BF0CC13823E793D1B085F527E76F2997C8D7A949BEF2E60E720FD8E0ACB5B330200D45725D88EFF5E144BC1E40A29C5C0A9577C9457E39E3E393F606FD006AB48D401669664EE29A80D729EBCD7C20E52078EE9650EE2A47DD4FC9ED9962ACE14CF53261C0B4632B2BF8A84752297B48ABE5905A5EAF680EE5CF68467D2C114A2CD6D2DDFA930564588DBB6485C374EE153D881578FE5AF521A845C2C3F9485BB616BFFFA42480997BCBDA106AAD0E283E4D73E30048EFED9F355FBA263B954CDD54B92C2EB6205F3XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX3527DC8343FD5B0A4AF803A834A0C845D446753282BC8768710F6455EC4461322D7B0C4399DA85AA0A779E91A4892A2E70FBBA6396EB9B723ADB4421DACEF8C7E6B0DF06B9493710FE0C01A7B939E0BE871FDC8781C293A5E773794560CFDE8D8AED9B54DB3A5FA90868FCAF8383204B1D9A15B2705D72056A0930FAC96E5554F7BA3778007B030D8F40BA0E3B477168885106CFF47F0583C1855594011C0D25D60E42FB27E1A3CF0B04DB87F8F5C4712EAE3CF3455FEAE74A41B18E08248BBC82DF2CEC9F4EB0BF2C5A13DFB94E29CFBC861253CD71D79495FDA97D1FFC482E56F00EC8B320AE6E6E74C50D1FD7FA4B6D9F6441136D9E406CCD28CA96ED0A93997D177282F44B23CBDD36886665C55864045694C431F104C87859F0C53A55DC275459ABCFA7D077F174C0F304D43FD2B92BA2893B1C3D6AF853BFFC17F87C62BE6346C84E92319D53B1D3F1D4ABEC860BBBC7AD560A3D15DE923DB84075BAD3A3781F45DC913C0CFAFE8CC0A08B588C9EB7D48C7FF52EB12BB76DEB3845AFC8FD1D923D745B1D56ADF9502137978D7FCFC896AB3BA20B261825996531A99C36D2AEE0DC2A319C988AA1EB66E97229ABFD79BEC1A4933A5481EDD507B4C84292A52CE8EA302C2B7182F3EDBB4C790BBD28648CF69B18A421DC23AE19DDE0D2C401EB5A3792D696568ACF4832C970AC3A6B58650B24D9AF7299AA8D506B168079BD99CF543BE5E6EA9985850D14495E2FBA694E3AA53552DEC6B234629D0069866C7051627B7F89AD6CBBCC99FD0FC8A30E0D038180AC9B87611E88ED4AA3691BC0858DE52D48E801ABAD8D332D17D7B117E2072B4D71263D7E33E7CA3AE12120939EC62F9BD6512B98EFFDC1E5C4F30A920B868C93BF0114DD999996C3D0497935580FB01AEDD1AF165C6394ABD8FFCA69A7563F58FC9EFD0EB463374DCEB21D87A84F7CAD40AE0465F27418B83C90376BFA6DB939F9722238BB1673518AA7B9BB194982B95980B50FCBFC81A6FB96AD0C97EAC24F87BAB8AFDD832553F03CDD22D70660B512B4751BA744AAACC993E27FAB8E3CA15013295D70340DF42858E8388C05C2264540FC0AA1A287B9FA4745D754F52C36F12C6D7863BF26455255472B4FCD44E4CCE8D2FFABCF83B1D88958F0F7FBB15BD889593DEA461DF7DB3497FE1028F152508450B2056121AE25AF1AD3F7AB03672251DF6EF3414823B77667C9D12092989CC32550DFD5C36B6BD68F180246B18B9F283CD8A5641B2485826A3EEDA707998B88196B8BF637722FA9979287D923D090CAD525716CF604647E9EC10CEB2A204ABAE1DF82E15D83EC8E185EF5C7387B110A8AF6699C0FDF35A141941E814EF5F8970A584AAB316FFEBD43C73286E6712D536BA6C730F3F143BA52EB67D21B9D596C40C5E29F50E6B0046C3E11F3A1A9D066F0C7D34D4BCBE87DD5A48BA109420A3181316B49C0305DD4FB248946973824B04B9CF04FBE4385EE24BD80E8CE03EE6837A1CFB57FF3D4BF0DD2BE65BB92516F8D46DAB9AC86B86B07F5F95661344221A629084CCD26045A7BFABF701E88844B8AAEAC77D2D526EA9AA537FBB0EDD8BCC6F92F49722D6F0BF148E30D7604F36E03946704DFDD963C45313546511B5483B08FDD25E4E07EFD211B4A4BF9BDD62CD9F72508BE1E0550B1A1903D3C26FB453E7C76995457EC761708D1AD3A6A0BB3D63C49CDD2ADBBCC876AF29E61826F177DF3E0A46FEC3C7752863F8992B1746F3409F0C3915D20A3"}
02-24 14:52:38.195 cloud.c:2482|webapi_do_login() webapi_do_login success
02-24 14:52:38.196 dispatch.c:2534|do_mq_process() dispatch got (0x8c)
02-24 14:52:38.196 dispatch.c:2998|do_mq_process() set DISPATCH_SET_CLOUD_STORAGE_OFF
02-24 14:52:38.196 dispatch.c:4370|do_mq_process() Process (0x8c) end
02-24 14:52:38.196 dispatch.c:2534|do_mq_process() dispatch got (0x94)
02-24 14:52:38.196 dispatch.c:3010|do_mq_process() set DISPATCH_SET_CLOUD_STORAGE_MODE_MOTION_DETECT
02-24 14:52:38.196 dispatch.c:4370|do_mq_process() Process (0x94) end
02-24 14:52:38.199 dispatch.c:2534|do_mq_process() dispatch got (0x100)
02-24 14:52:38.199 dispatch.c:4356|do_mq_process() do DISPATCH_APPLY_ABILITY_SETS
02-24 14:52:38.200 dispatch.c:4370|do_mq_process() Process (0x100) end
02-24 14:52:38.200 cloud.c:2973|webapi_get_dev_info() cmd=/backup/cloudAPI -c 142 -url https://plt-api-de.xiaoyi.com/v4/ipc/deviceinfo -uid XXXXXXXXXXXXXXXXXX -keySec XXXXXXXXXXXXXXXXXXXX
02-24 14:52:38.593 rmm.c:844|motion_proc() pid[951]
02-24 14:52:38.593 motion_detect.c:84|modet_init() modet_init img wid-hei:320-192, thresh:0
02-24 14:52:38.613 mp4record.c:729|record_init() got video main vps=0 sps=34 pps=10, ts=3565622591, framerate=20 width=1920 height=1080
02-24 14:52:38.613 mp4record.c:751|record_init() got video sub sps=33 pps=9, ts=3565622489, framerate=20 width=640 height=360
02-24 14:52:38.613 mp4record.c:782|record_init() got audio aac config, ts=3565621172
02-24 14:52:38.614 mp4record.c:1330|main() mp4 mode got sd exist
02-24 14:52:38.627 mp4record.c:995|record_file() record_init finish
02-24 14:52:38.640 mp4record.c:729|record_init() got video main vps=0 sps=34 pps=10, ts=3565622591, framerate=20 width=1920 height=1080
02-24 14:52:38.640 mp4record.c:751|record_init() got video sub sps=33 pps=9, ts=3565622489, framerate=20 width=640 height=360
02-24 14:52:38.640 mp4record.c:782|record_init() got audio aac config, ts=3565621172
02-24 14:52:39.207 cloud.c:2980|webapi_get_dev_info() {"code":"20000","data":{"css_flag":0,"css_mode":0,"appParam":"","tz_offset":3600000,"timezone":"GMT+01:00","language":"en-US","doorbellCoolingDuration":"0"}}
02-24 14:52:39.209 cloud.c:2168|webapi_do_tnp_on_line() now do webapi_do_tnp_on_line 
02-24 14:52:39.209 cloud.c:2179|webapi_do_tnp_on_line() cmd = /backup/cloudAPI -c 141 -url "https://plt-api-de.xiaoyi.com/v4/tnp/on_line" -keySec XXXXXXXXXXXXXXX -uid XXXXXXXXXXXXXXXXXXXXXXX-version 

[timluther]

This looks a lot like the bootlog on the camera I just bought (https://www.amazon.co.uk/gp/product/B08DHQW25B/ref=ppx_yo_dt_b_asin_title_o02_s00?ie=UTF8&psc=1) with the brand name 'Maysly'. Seems to use Yi software but I'd like to run my own on it, view it through a web interface instead of their app etc. Did you get anywhere with your camera?

[zackfuchtel]

No, I have returned cam after a few days if trying.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.