The camera shown in the picture is a new design based on YI IoT software and ANYKA AK3918 SoC. #236
Replies: 27 comments 38 replies
-
|
I have a very similar IP Cam to one in the closed thread. The layout of the PCB is similar but has a different rev # and date. I had been able to access it by FTP and telnet. Telnet required a simple hack, The flash is read only except for a small jffs2 partition that stores local WIFI settings, etc. |
Beta Was this translation helpful? Give feedback.
-
|
I'm adding 3 more photos;
|
Beta Was this translation helpful? Give feedback.
-
|
I have a very similar cam too. I wonder - what is "a simple hack" you used to telnet into it? |
Beta Was this translation helpful? Give feedback.
-
|
I'm not normally so cagey but I thought broadcasting the hack might cause back door to be closed. I'm now pretty sure the developer wouldn't care. |
Beta Was this translation helpful? Give feedback.
-
|
I am not sure that my hack will work for your camera, so as any ULA says use this recipe “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
In my case, I have found that the services.sh is invoked by sequences of the scripts started by inittab executing config.sh file at /mnt/debug/ if that one exists. To start telnetd service, you have to use SD card formatted as FAT32. Next step, create debug sub-dir and config.sh file on SD.
My config.sh has got the following script:
#! /bin/sh
# /mnt/debug/config.sh
telnetd &
# comment out the rest of the lines if you don’t want to connect the camera to YI services.
#killall -9 daemon
#killall -9 cmd_serverd
#killall -9 anyka_ipc
#killall -9 service.sh
#bind to your WiFi
#/bin/sh /usr/sbin/wifi_run.sh
#/bin/sh /usr/sbin/wpa_supplicant -B -iwlan0 -Dwext -f /tmp/wpa_log -c #/etc/jffs2/wpa_supplicant.conf
#/bin/sh /usr/share/udhcpc -i wlan0
#sleep 3
I don’t want any connectivity to the YI services, thus my script kills all services invoked by the service.sh including anyka_ipc. Unfortunately, I don’t know how to initiate the camera’s video drivers, which I guess are initiated by YI server. I noticed some transaction in-out between anyka_ipc, but I was not able to fetch any controls. Without it, any attempt to read the video stream from /dev/video ends with a stack overflow error.
I decided to use this method because it is easy to return to the factory setup just by removing sd card.
…________________________________
From: rleyden559 ***@***.***>
Sent: Monday, 20 March 2023 10:05 AM
To: alienatedsec/yi-hack-v5 ***@***.***>
Cc: Haps ***@***.***>; Mention ***@***.***>
Subject: Re: [alienatedsec/yi-hack-v5] The camera shown in the picture is a new design based on YI IoT software and ANYKA AK3918 SoC. (Discussion #236)
I'm not normally so cagey but I thought broadcasting the hack might cause back door to be closed. I'm now pretty sure the developer wouldn't care.
First, I noticed FTP was open on the cam. The android app conveniently tells you its IP address on the local network. Login: root, password: root, I think I just guessed.
The only writeable directory is /etc/fffs2, which contains local configuration files. Among the files is "time_zone.sh"
Normally this script has only one line as for example, " export TZ=GMT+08:00".
Add a second line, "/bin/telnetd &" to this file and copy/replace it in /etc/jffs2. After reboot, telnet in using root as the password.
Note that the original script is back so you would will have to to fix it again before rebooting again.
I was inspired by noting that service.sh (called in rc.local) does a "killall telnetd"
I hope this helps you.
Other progress: I used dd to copy all of the partitions to a SD card. Partition mtd1 looks like it contains the u_boot executable and partition mtd3 contains the boot.ini configuration. It seems like booting off the SD card could done by using the updater program. I looked at the instructions to do this and they appear to require commands, squasfs related that are not natively on my cam. Perhaps, I don't understand the method. Alternatively, perhaps the necessary tools could added to the SD card and run from there.
—
Reply to this email directly, view it on GitHub<#236 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AE7LCLBDA2P4J6GLYCPPV3LW46J3HANCNFSM6AAAAAAWAJJVPU>.
You are receiving this because you were mentioned.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
telnet My actions go to telnet We do not turn off the camera all this time so that our installed telnet does not fly off take mtd5.bin filder@filder-G31:~$ unsquashfs mtd5.bin [===============================================================/] 384/384 100% created 130 files folder will appear squashfs-root we go into it /sbin/service.sh start_service () and remove the line <> save now we pack everything back filder@filder-G31:~$ mksquashfs squashfs-root usr.sqsh4 -b 131072 -comp xz -Xdict-size 100% file name usr.sqsh4 the firmware asks for it filder@filder-G31:~$ binwalk -t mtd5.bin DECIMAL HEXADECIMAL DESCRIPTION0 0x0 Squashfs filesystem, little endian, version 4.0, filder@filder-G31:~$ mksquashfs squashfs-root usr.sqsh4 -b 131072 -comp xz -Xdict-size 100% Exportable Squashfs 4.0 filesystem, xz compressed, data block size 131072 put the resulting file in mmc and paste it into the camera By telnet [root@anyka ~]$ cd /sbin the system is updated, reboot and you have a permanent telnet with root do everything at your own peril and risk carefully |
Beta Was this translation helpful? Give feedback.
-
|
and remove the line killall telnetd save |
Beta Was this translation helpful? Give feedback.
-
|
Question |
Beta Was this translation helpful? Give feedback.
-
|
Great work filder35. In the factory configuration; |
Beta Was this translation helpful? Give feedback.
-
|
Perhaps changing factory.cfg.ini would result in a rtsp stream. ; cloud supported current, 1 -> supported, 0 -> unsupported Does not work. I will try other options. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the tip. |
Beta Was this translation helpful? Give feedback.
-
|
I tried to Ubuntu cross-compile a test program to run on the Anyka CPU under as;
I moved the executable to /mnt (SD card) and attempted to run through telnet as root. I got a “file not found”, which is because the default linker was not found.. The linker on the camera appears to be “/lib/ld-uClibc-0.9.33.2.so” so I tried’
Which gives Has anyone had success cross compiling programs? Or, better yet, found the Anyka toolchain and compiled programs natively, UPDATE: |
Beta Was this translation helpful? Give feedback.
-
|
As I wrote before, yes I have. You can build your own sdk and toolchain for 3918 using rootbuilder. I was able to successfully create development environment for 3918 and kernel 3.4.35.
…________________________________
From: rleyden559 ***@***.***>
Sent: Wednesday, 26 April 2023 7:16 AM
To: alienatedsec/yi-hack-v5 ***@***.***>
Cc: Haps ***@***.***>; Mention ***@***.***>
Subject: Re: [alienatedsec/yi-hack-v5] The camera shown in the picture is a new design based on YI IoT software and ANYKA AK3918 SoC. (Discussion #236)
I tried to Ubuntu cross-compile a test program to run on the Anyka CPU under as;
arm-linux-gnueabi-gcc hello.c -o hello
I moved the executable to /mnt (SD card) and attempted to run through telnet as root. I got a “file not found”, which is because the default linker was not found.. The linker on the camera appears to be “/lib/ld-uClibc-0.9.33.2.so” so I tried’
arm-linux-gnueabi-gcc -Wl,--dynamic-linker -Wl,/lib/ld-uClibc-0.9.33.2.so -o hello hello.c
Which gives
./hello: can't load library 'libc.so.6'
The camera may use “/lib/ libuClibc-0.9.33.2.so” but including that also did not work.
Has anyone had success cross compiling programs? Or, better yet, found the Anyka toolchain and compiled programs natively,
OpenIPC has a tempting section of packages to cross-compile with seemingly detailed instructions. https://github.com/OpenIPC/camerasrnd/blob/master/crosscompile/index.md However, the ones I’ve tried don’t work as written.
—
Reply to this email directly, view it on GitHub<#236 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AE7LCLFKVYHACN36FZF5SX3XDBA33ANCNFSM6AAAAAAWAJJVPU>.
You are receiving this because you were mentioned.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
I am happy to help you. As you have pointed out, there are many sdk/toolchains pretending that work with 3918 therefore before sending you the “recipe”, I would like to ask you to check that an image developed in my 3918 environments will work for you. I don’t want to create any confusion in case if my sdk does not support your particular HW. The image is linked as static and does not use any libraries. I am not sure that I would be able to attach the image to github post so in the worst scenario please point me, to where shall I send the image and source code. So far I was able to compile ffmpeg, ffmprobe and strace.
You are asking me, what is the rationale or goal of my anyka cameras' studies.
Well, A few months ago I bought a few cameras to secure my house and after 2-3 weeks, the cameras refused to connect to my Wi-Fi. The seller blamed everything but not his products, so I decided to hack them in order to get what I want. Furthermore, I am not interested to share with China spyware servers pictures from my backyard :)
Like you, I would like to implement a set of services that will suit my security system built up on Home Assistant. So an implementation of RTPS, ONVIF etc is paramount for me.
I have also considered OpenIPC, but it looks like some developers do not understand the open-source concept. Sorry for this digression.
I am more than happy to cooperate, define some scope of work etc.
[https://res-h3.public.cdn.office.net/assets/mail/file-icon/png/generic_16x16.png]helloworld<https://1drv.ms/u/s!Aqt-FGTf78f4ilW53S4uvpMlCcub>
[https://res-h3.public.cdn.office.net/assets/mail/file-icon/png/generic_16x16.png]helloworld.c<https://1drv.ms/u/s!Aqt-FGTf78f4ilZZORvFV9K_KQap>
…________________________________
From: rleyden559 ***@***.***>
Sent: Sunday, 30 April 2023 10:40 AM
To: alienatedsec/yi-hack-v5 ***@***.***>
Cc: Haps ***@***.***>; Mention ***@***.***>
Subject: Re: [alienatedsec/yi-hack-v5] The camera shown in the picture is a new design based on YI IoT software and ANYKA AK3918 SoC. (Discussion #236)
Haps-basset wrote As I wrote before, yes I have. You can build your own sdk and toolchain for 3918 using rootbuilder.
I must have missed it, but great!
Could you post a step-by-step procedure that you used?
Since my last post, I came to realize that my plan to compile a replacement for anyka_ipc had a serious problem. It seems that OpenIPC, despite its suggestive name, does not publish open source code to run an IP webcam. All I can find are scripts to modify systems or perhaps precompiled binaries for other SOC's than Anyka. So, my first real targets for cross compiling are reverse engineering tools, ltrace and strace, for example.
I would be happy if I could get the camera to sent out a rtsp video stream that I could manipulate on an external system. Externally, I would do motion detection and file management. I found the motion detection on the existing system is useless for me. It spits out constant false alarms (even at sensitivity "low") and seems to miss massive movement. As a test, I've run it side-by-side with a Raspberry PI setup with PiKrellcam. There is no real comparison.
I am curious about your goals and progress beyond building a toolchain.
—
Reply to this email directly, view it on GitHub<#236 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AE7LCLEDXJYCEGXXRSD6HI3XDW3WZANCNFSM6AAAAAAWAJJVPU>.
You are receiving this because you were mentioned.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
Thank you haps-basset for your quick reply. OK, needs filtering and other work. Also, aborts after spitting out 250k of output. Perhaps, out of memory. |
Beta Was this translation helpful? Give feedback.
-
|
Sorry for the link, I will try to fix it. I must admit I was lazy, and I responded to your post via Outlook, perhaps that is a reason for this "hiccup". |
Beta Was this translation helpful? Give feedback.
-
|
Hello. |
Beta Was this translation helpful? Give feedback.
-
|
aimer39_ak3918_defconfig.txt I had little free time and I wrote the procedure. Overall, the most time consuming was to recrieate the .config file.
|
Beta Was this translation helpful? Give feedback.
-
|
Hi, filder35, thanks for your support. In the last 6 months, I have browsed and reviewed all those sdk/tool-kits or tool-chins with minimal success. I have always found something missing e.g., config files or toolkit was compiled for a 32-bit host, too old Linux version etc. I wasted a lot of time only to find that some links were dead, or the owners did not respond to my requests or insisted on using the software "as is", which was pointless because the compilers crashed. So that is the reason why I decided to build another toolkit chain. |
Beta Was this translation helpful? Give feedback.
-
|
https://cloud.mail.ru/public/Rkwb/HThdw8EvF Try to drop it here. |
Beta Was this translation helpful? Give feedback.
-
|
haps-basset: Your note inspired me to look more closely at /dev/video0 on the running system. I downloaded ffmpeg Static Builds, https://johnvansickle.com/ffmpeg/ , (armel version) and they run OK from /mnt (SD card). |
Beta Was this translation helpful? Give feedback.
-
|
If you wish to build your own copy of v4l2, download source code from https://github.com/gjasny/v4l-utils |
Beta Was this translation helpful? Give feedback.
-
|
rleyden559: it means that we have got the same HW:) #! /bin/sh As I wrote before, the script is invoked by init executing on my sd card script called config.sh @ /mnt/debug directory. As a result of it the service.sh is killed and as such, stops the execution of service.sh which calls anyka_ipc image. Now, having OS running with WiFi service, you might start anyka_ipc via Telnet and observe all messages. I am quite sure that the anyka_ipc tries to connect to some services but what is needed to enable driver no idea. I will dump a copy of my ffmpeg and ffprob to the proposed dump |
Beta Was this translation helpful? Give feedback.
-
|
haps-basset: I'm having no success with your scripts. I put the above config.sh in the /mnt/debug directory. It does not seem to run on startup. I added a diagnostic line; |
Beta Was this translation helpful? Give feedback.
-
|
Hello there, I am sorry that I did not respond to your queries, but it looks like that is a quite big difference between your and my time zone. Using FTP, I listed the top level of the OS and I found an image called “init”. Knowing that the init will invoke /etc/inittab I just follow the set of actions scripted on my camera during init phase of the boot. The init invokes the following scripts in this particular order:
` # mount usr file-system.
`if test -f /etc/jffs2/yi.conf ; then if [ ! -e "/etc/jffs2/time_zone.sh" ];then if test -e /dev/mmcblk0p1 ;then if test -d /mnt/Factory ;then if test -d /mnt/debug ;then
if [ $DEBUG_MODE = 1 ]; then Now, what does my script, #! /bin/sh That is all PS. I am aware that the formatting is awful, so I will appreciate if you could help me to correct it. Many thanks |
Beta Was this translation helpful? Give feedback.
-
|
I have tried to dump ffmpeg/ffprobe to recommended dump spot but I am getting the following message |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
Sorry , I am getting the same message, "Only ..." |
Beta Was this translation helpful? Give feedback.
-
|
https://drive.google.com/drive/folders/1N6rPFDEV9BO5zbuOiiXrotl19G-zuO1h?usp=sharing |
Beta Was this translation helpful? Give feedback.
-
|
Done |
Beta Was this translation helpful? Give feedback.
-
|
Thank you. Link will be made available |
Beta Was this translation helpful? Give feedback.
-
|
I'm studying anyka_ipc in Ghidra, here are the screenshots. While I'm studying. Maybe someone will lead to the right thoughts. |
Beta Was this translation helpful? Give feedback.
-
|
Whoow, you are an incredibly brave man. I am too old and too lazy to learn another bloody assembler, :) so sorry I would not be able to help you ... If you don't mind, what do you think about the study of anyka_ipc output? You could use text messages as references to your code. Furthermore, strace dump shows all system calls read/write and those could be used to find what and when the app accessing drivers. Overall all the best! |
Beta Was this translation helpful? Give feedback.
-
|
I used famous AI and I got the following response:
The AI points to |
Beta Was this translation helpful? Give feedback.
-
|
https://github.com/burlizzi/qiwen/blob/main/platform/libmpi/src/venc/ak_venc.c |
Beta Was this translation helpful? Give feedback.
-
|
Following your recommendation, I have installed Ubuntu version 18:04.6 32-bits on my laptop as a VM of VirtualBox The kernel is: Os release: I have used a gcc compiler for ARM from recommended by your site: Unfortunately, attempt to compile “qiwen” gave me the following error: make Some headers are missing but what? The much better result I got when I compiled samples from anyka repository: [root@anyka /mnt/tests]$ ./iwlist Perhaps you will have more luck. |
Beta Was this translation helpful? Give feedback.
-
|
filder@filder: |
Beta Was this translation helpful? Give feedback.
-
|
filder35, many thanks for the links. I tried to compile the qiwen but I have got a problem with gcc version. I would say that gcc version 4 2 was used to compile the kernel 3.4.35 and on the 32-bit platform. The rootbuild selected by me builds an arm compiler but version 12. ak_common.c:631:19: warning: unused variable ‘value’ [-Wunused-variable] I got the following warning messages: and I don't know how to force the compiler to pass those warnings. Perhaps you will have more luck, complaining about the code on an old version of the Ubuntu. |
Beta Was this translation helpful? Give feedback.
-
|
You can try an early version of Buildroot there in the GCC 4.5 selection settings |
Beta Was this translation helpful? Give feedback.
-
|
Now I collect according to your instructions above. On ubuntu-16.04.6-desktop-i386 I'll unsubscribe what happens. |
Beta Was this translation helpful? Give feedback.
-
|
My story is like this. |
Beta Was this translation helpful? Give feedback.
-
|
filder35- Interesting story. Having a SD card and a writable storage definitely makes hacking easier. Do you see /dev/mmcblk0 or /dev/mmcblkop1 on your camera(s)? If they are present, you could try to mount them. I think the kernel will list them in /dev if the hardware is present. |
Beta Was this translation helpful? Give feedback.
-
|
Gentlemen, just a thought. We are using yi-hack-… repository posting plenty irrelevant to the repository posts. Perhaps is time to set up a repository e.g., E27-hack or whatever. We should not abuse the hospitality of our friends. |
Beta Was this translation helpful? Give feedback.
-
|
I don't mind |
Beta Was this translation helpful? Give feedback.
-
|
OK, can you set it up and point us there? |
Beta Was this translation helpful? Give feedback.
-
|
I am working on it :) |
Beta Was this translation helpful? Give feedback.
-
|
Dear haps-basset rleyden559, don't risk your cameras much, you can get a brick. I have a soldering station and I can solder and solder the flash as much as I can and I have flash drives in reserve. I can take risks. If you collect something, I can test it. And what kind of hardware do you have? I have SC_1345 sensor, rtl8188fu WiFi. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the advice. Yesterday I was trying to kill anyka_ipc and associated programs when the camera "locked up". On power cycle the app no longer can find the camera but I could ftp in. The SD card had been reformatted (yikes!!!). I'm guessing a hard reset will re-establish the app but I haven't tried yet. Nothing I did could possibly have commanded the reformat, The SD card had a lot of dumps and tools so it's a hassle put it together again. |
Beta Was this translation helpful? Give feedback.
-
|
With regard to your query about HW, I am not sure. The lsmod show modules/drivers for the following devices: |
Beta Was this translation helpful? Give feedback.
-
|
Update on SD card crash: The SD card wasn't reformatted as I thought but corrupted. I was able to re-establish communication with the Android app only by removing the card. I had already done the hardware reset so I can't say what the state of system was. This is an issue only because I had run from telnet with /mnt/Factory/config.sh present. |
Beta Was this translation helpful? Give feedback.
-
|
I killed the camera again. I will program the flash drive. There is a dump. Collected qiwen . And I can’t figure out how to introduce it into the camera. I solved it by changing files. Updated . Now the camera won't play my . Writes /etc/init.d/rc.local: line 29: /usr/sbin/camera.sh: Permission d |
Beta Was this translation helpful? Give feedback.
-
|
I am not keen to update the flash. I am thinking to create a root for the platform on my SD card and then use chroot to point it as a root of the system. |
Beta Was this translation helpful? Give feedback.
-
|
https://ricardojlrufino.wordpress.com/2022/02/15/hack-ipcam-anyka-booting-rootfs-from-sdcard/ |
Beta Was this translation helpful? Give feedback.
-
|
I had the same idea. Leaving the read only flash memory as a safe harbor that one can always fall back to makes sense. I'm not sure why you call it a horrible hack. It seems like there are many commercial products that have an analogous concept. |
Beta Was this translation helpful? Give feedback.
-
|
rleyden559 I agree with you about working with SD. We just change the algorithm of the device. External flash, broadcast to the network, recording to the DVR. And the internal flush is like a reserve airfield. |
Beta Was this translation helpful? Give feedback.
-
|
Well, perhaps we have got the different work experience and as such we got different view. I spent 40 years with Unix (Xenix, Solaris, HP-UX,DEC True Unix and, well... Linux.) I was lucky because, people who trained me and explained me Unix internals knew the topic in depth, mostly because they were not typical “trainers” but OS designers. Yes, I was lucky unfortunately SUN,DEC,HP and IBM Unix is dead. The chrood was always presented and used as a maintenance tool. It should not be used for production!. I think we should focus on the camera project, not judgment ideas. For me, usage of chrood will always be a horrible hack as the camera's os. |
Beta Was this translation helpful? Give feedback.
-
|
Cool idea, but I don't have UART console. I don't have tools to solder TX/RX cables to URAT -USB adaptor :( and as such I cannot control the boot process. My only access to the camera is telnet and ftp... |
Beta Was this translation helpful? Give feedback.
-
|
Not yet. I'm working on it. I'm trying to build the system in Buildroot 2017 using your config files. So far there are no errors. And I'm looking for a way to run on the SD card camera, I don't even have mmcblk0p1 in / dev. I don't understand the reasons yet. I'll post the results right away. |
Beta Was this translation helpful? Give feedback.
-
|
Be careful, my config may point to gcc ver 12... I was not able to change it. Check current config using make menuconfig. |
Beta Was this translation helpful? Give feedback.
-
|
https://drive.google.com/file/d/1fXXvbx84P6AQcOkuNvievrHEPRU9hFvT/view?usp=sharing #start system service |
Beta Was this translation helpful? Give feedback.
-
|
Many thanks, your init files are exactly as mine with rc,local exception. I know that you move service.sh to jffs2 partition ,but the jffes2 in your dump is empty. Is it a problem with jffs2 or was not mounted? |
Beta Was this translation helpful? Give feedback.
![https://res-h3.public.cdn.office.net/assets/mail/file-icon/png/generic_16x16.png]helloworld<https://1drv.ms/u/s!Aqt-FGTf78f4ilW53S4uvpMlCcub](https://res-h3.public.cdn.office.net/assets/mail/file-icon/png/generic_16x16.png]helloworld<https://1drv.ms/u/s!Aqt-FGTf78f4ilW53S4uvpMlCcub){kind=link}
![https://res-h3.public.cdn.office.net/assets/mail/file-icon/png/generic_16x16.png]helloworld.c<https://1drv.ms/u/s!Aqt-FGTf78f4ilZZORvFV9K_KQap](https://res-h3.public.cdn.office.net/assets/mail/file-icon/png/generic_16x16.png]helloworld.c<https://1drv.ms/u/s!Aqt-FGTf78f4ilZZORvFV9K_KQap){kind=link}
-
|
Hello, |
Beta Was this translation helpful? Give feedback.
-
|
I posted the first message from qiwen studies there. |
Beta Was this translation helpful? Give feedback.
-
I have just hacked access to the camera via Wi-Fi but because the camera does not Xiaomi Hi3518ev200 Chipset, thus I am not sure that you would be interested in the tarball of the camera system files. Please let me know
More information about AK3918 development, you can find in the following git repositories:
• ricardojlrufino/anyka_v380ipcam_experiments
• mucephi/anyka_ak3918_kernel
• ricardojlrufino/arm-anykav200-crosstool
Originally posted by @haps-basset in #195 (comment)
Beta Was this translation helpful? Give feedback.
All reactions