LSC camera wrong password

[karlzre]

Hi,
I bought a LSC/tuya outdoor camera from Action shop.
I'm trying to apply this hack to allow me to use this camera without the tuya app. (already applied on the doorbell :p)

i applied the ppsFactoryTool.txt file to allow acces on port 8090, but the admin:056565099 password doesn't works.
Any idea what can be the password or how i can try to find it ?

Firmware version is 4.0.6

Here is the camera model

Thx

[karlzre]

found for this one admin/admin

[guino]

@karlzre All firmware 4.0.6 that I have seen run linux so the links should work with admin:056565099 when using ppsFactoryTool.txt -- You should most definitely double check the IP address and the ppsFatoryTool.txt file and most importantly: TRY A DIFFERENT BROWSER.

The only other user/passwords I have seen are from a non-tuya app (also running ppsapp) but I highly doubt they will work for your device: #35 (comment)

[karlzre]

When i do the http://admin:056565099@192.168.x.x:8090/proc/cmdline i get this line, is this compatible as i see it's different compare yours.

setenv bootargs mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=192.168.1.99:::255.255.255.0 eth=00:55:7b:b5:7d:f7

If i apply the command in #13 point 2, i still get the same result .

[guino]

@karlzre if you have 4.0.6 firmware you may need to use these steps: https://github.com/guino/Merkury1080P#conclusion

[karlzre]

The firstone is patched and working with the user admin/admin and the process from https://github.com/guino/Merkury1080P

[chris0550]

I bought also the Indoor one.
Here are pictures:

[Keltharak]

Hello,
I try to hack my LSC outdoor camera too, but I can't figure out how to make the web server open with the ppsFactoryTool.txt file.
It seem's quiet simple reading the documentation but on my device nothing append when I insert the SDcard with my ppsFactoryTool.txt file.

The firmware of my camera is 2.10.24.

Thanks

[guino]

@Keltharak post a zip of your ppsFactoryTool.txt file and I can check it for you -- feel free to modify the wifi password in it.

[Keltharak]

@guino Thank you for your help.
ppsFactoryTool.zip
I just filled the file with my SSID et wifi password with notepad++.

[guino]

@Keltharak Your file is fine. Have you tried booting the camera with the ppsFactoryTool.txt file already in the SD Card? From the firmware files I've seen inserting the SD card at anytime with the file should enable the URLs but they may have changed it (I haven't seen 2.10.24 firmware yet).

[Keltharak]

@guino Thank you for the file check. I will retry this tomorow but I think y already tried that.

[guino]

@karlzre it is possibly tuya may have disabled that file/URL support in attempts to prevent our mods.

[Keltharak]

@guino I retry to boot with the ppsFactoryTool.txt file and de sd card in de device but I didn't notice anything better. TCP 80 or 8090 remain closed...
Anyone has an others ideas ???

[guino]

@Keltharak if ppsFactoryTool.txt is being ignored:
1-check that the SD card is formatted as FAT32 (not NTFS), and/or try a different SD card altogether.
2-maybe try to format the SD card using the phone app you used to setup the device, then copy ppsFactoryTool.txt to it to see if it works.
3-If neither of the above works you can try to get a copy of the flash using #11 -- if this works we can try to get the ppsapp file from it and I can review it to see if they disabled/changed ppsFactoryTool.txt and go from there.

In theory you could try to blind install the hack with cmdline settings from a similar device but I would advise against it as you may brick it.

[Keltharak]

@guino The procedure tu dump th flash doen't work neither on my device 😢
I don't have other SD card to test but my actual SD work fine on normal usage of the camera. Do you think there is a chance that the sd card could be the problem ?

[guino]

@Keltharak if you haven't tried different SD cards, that would be my first suggestion. Many SD cards just don't work during boot (but work fine after boot).
If #11 and different SD Cards didn't work then your only option would be to use a serial port adapter or hardware programmer (both require opening the device, dealing with cables, solder, etc).

[Keltharak]

Thanks for the advices. I will check with another sd card and if it still doesn't work maybe I will find some time to try the UART way :)
Thank very much for your time and all the information you shared around all these hacks, it is very instructive.

[corentinvds]

Hello !

I have the same problem with the LSC Smart Outdoor IP Camera 1080p HD from Action shop. The firmware is v2.10.32.

I have tried 2 SanDisk micro SD cards but the only open port remains 6668. I tried formatting the SD card via Windows, Linux and the LSC Android App.

Here is the zip with the content of my SD card: ipcamera.zip . I also tried only with the ppsFactoryTool.txt without success.

Files are copied from

• https://github.com/guino/Merkury720/tree/main/mmc
• https://github.com/guino/Merkury720/blob/main/mmc/busybox?raw=true
• https://github.com/guino/Merkury1080P/tree/main/mmc

The ppsFactoryTool.txt contains a valid SSID/password on my sd card.

Any help would be appreciated.

[guino]

@corentinvds it does seem like tuya may have disabled ppsFactoryTool.txt on newer firmware -- we won't know for sure until we get a copy of the flash or ppsapp from one of the newer firmware versions. There are only a few ways this can happen:
1-Someone is able to run #11 on the device (maybe also try using this modified ppsMmcTool.txt file for 4.x version on step 7: 1080p-getFlash.zip )
OR
2-Someone has a device that was rooted using one of the existed methods and later updated to a version 2.10.24 or newer
OR
3-Somoene has a hardware programmer/knowledge/skills to open the device and read the flash directly and post it (or at least the extracted ppsapp file)

Without the device there's not much else I can do.

[ioudeveldhuis]

Hello !

I have the same problem with the LSC Smart Outdoor IP Camera 1080p HD from Action shop. The firmware is v2.10.32.

I have tried 2 SanDisk micro SD cards but the only open port remains 6668. I tried formatting the SD card via Windows, Linux and the LSC Android App.

Here is the zip with the content of my SD card: ipcamera.zip . I also tried only with the ppsFactoryTool.txt without success.

Files are copied from

• https://github.com/guino/Merkury720/tree/main/mmc
• https://github.com/guino/Merkury720/blob/main/mmc/busybox?raw=true
• https://github.com/guino/Merkury1080P/tree/main/mmc

The ppsFactoryTool.txt contains a valid SSID/password on my sd card.

Any help would be appreciated.

I have the same issue.
What I can see is that my camera has firmware 2.10.33 so maybe that is the problem.

[guino]

@corentinvds @ioudeveldhuis for the LSC Smart Outdoor IP Camera you need to follow the information on this repo:
https://github.com/guino/LSCOutdoor1080P

[zajaaczki]

This hack will enable rtsp on smart indoor lsc?

[guino]

@zajaaczki each process is made specifically for each device type. For the LSC indoor you need to follow the information here: https://github.com/guino/LSC1080P