BLITZWOLF BW-YIC1 is it supoorted?

[Dreamoffice]

Hi all
ich have the Blitzwolf Dome Camera. Does any body know if this camera is already supported?
i did an dump of the camera.

br Dave

[roleoroleo]

Could you please post some pictures of the board?

[Dreamoffice]

[Dreamoffice]

[Dreamoffice]

[Dreamoffice]

I also dumped the memory. Do you need this?

[roleoroleo]

Yes please.

[Dreamoffice]

Should I send you the whole dump. Or only a file?

[roleoroleo]

I need mtd2, mtd3 and mtd4.

[Dreamoffice]

https://drive.google.com/file/d/1CnzDCk1r96DYhLEJAY3arco1uXJeNzS-/view?usp=drivesdk

[Dreamoffice]

https://drive.google.com/file/d/1CnzDCk1r96DYhLEJAY3arco1uXJeNzS-/view?usp=sharing

[ghost]

I just bought a Yiiot camera that is using the same firmware version "9.0.41.99_202103111513" and not sure I like being dependent on the Yi app so hope to try different firmware, waiting on uSD card at this time. Board is similar to yours, not sure what the camera type is, just labeled "Big Yiiot PTZ".

[Dreamoffice]

Looks good. I'm still waiting till roleo is answering. And then we will see if there is a chance to flash another firmware

[ghost]

Ok Dreamoffice, I'm going the "Build your own firmware" route although Linux is frustrating for me. First tried Fedora 34 then Debian 11 before resorting to the older Debian 10 to have a chance to install the listed dependencies, even then there was conflict with Bison and Bison++ but finally got the compile to finish which seemed like an hour to complete! Run as root because I'm not a sudoer LOL, so frustrating!

So now I'll have a look over that and try to add the model which for me is "b091qp" according to the serial debug. Worse case I think is I flash the backup made with a ch341a under Windows. It's going to take me a while since I'm in the deep end being a noob to all this but if it works will let you know. Did think this camera was going to be like the Yoosee I bought earlier but that uses an AK3918, however does support RTSP out of the box, well after having to use the android app to set it up. Both have dual antennae with only one connected to RF, the other has an open wire, not even coax so maybe it's supposed to act as a director/reflector? I'm using wired LAN so wonder if ditching WiFi is helpful?

Seems I'm rambling on, so good luck, hope you get what your after. Will update if successful.

[Dreamoffice]

i m not able to setup ssh on a debian machine running on the raspberry. i don t know ehre the problem is.
could you explain where you find your model?
now debian is up and running but i have the same problems with bison and libtidy5. how have you solved these problems?

gettings these errors:
checking whether the C compiler works... no configure: error: in /root/yi-hack-Allwinner-v2/src/alsa-lib/alsa-lib-1.1.4.1':
configure: error: C compiler cannot create executables
See config.log' for more details

[ghost]

I ended up running each install one by one. bison++ reverted bison so I reinstalled bison and bison++ is gone. For libtidy5 I used libtidy5deb1, no idea if that's the right thing to do. Added the references for b091qp, not sure of buffer offset and sizes so just used a common one for now. Loaded up the SD card and didn't go well. After removing the card due to failure the camera boot looped without option to use SD card and hence the mentioned brick recovery mode wasn't doable. So not as simple as I was hoping but I'm just doing monkey see monkey do without any real knowledge of what's going on so don't be put off by my own miserable failure but do be aware the recovery method may not work although to be fair I didn't spend any time trying to make it work since I have a hardware recovery solution.

Some of the product names listed in our current firmware: q705ssv, h50ga, y29ga, y21ga, y28ga, h51ga, h60ga, h31bg, h30ga, h52ga, h53ga, y19ga, b092qp, q321br, q321br_lsx, q321br_jd, q321br_aldz, q321br_aldz_3m, q321br_chw, q321ssv, q321ssv_3m, y041qp

[Dreamoffice]

my camera is now in boot loop. i m trying to get it back running by using the RX TX Method. hope to get it back running without the hack

[ghost]

Well I gave it another go and have a problem with no video, no LED's, no PTZ but can screen grab so better than before. Will have a fresh look tomorrow.

[Dreamoffice]

How are you doing the compiling?
I can not compile. I have errors all the time

[roleoroleo]

Did you create a backup of the flash before starting?

Well I gave it another go and have a problem with no video, no LED's, no PTZ but can screen grab so better than before. Will have a fresh look tomorrow.

To enable video you need to understand the structure of the buffer file and detect some values: size, offset, type of frames, etc...
The use of this file is not completely clear to me, so the code of the grabber I wrote is not simple.
If you have any questions, don't hesitate to ask.

[ghost]

To enable video you need to understand the structure of the buffer file and detect some values: size, offset, type of frames, etc...

For me I needed to understand chrome doesn't support rtsp nativly, just displays a blank page. Works ok in VLC. Told you I was a noob :D

[roleoroleo]

If you compiled the tree, added your model and made the rtsp work, I don't think you're a noob at all.
:)

[ghost]

@Dreamoffice I went with "debian-10.10.0-amd64-netinst.iso" and followed the instructions except ran as root, left bison++ out and used libtidy5deb1. Internet connection was required for compiling. The only other thing was I changed the packing part to just b091qp rather than all then extracted the compressed files to a 64GB FAT32 microSD.

My first noob mistake was thinking I could modify any init.sh but really should modify the one that comes with the firmware and that's my guess as to the reason for my boot loop result. Second try was with modified r40ga which at least has my model but I'll go with the one from the real deal + mod.

@roleoroleo Thanks, I'm going to stick with the "for educational purposes" for now, asking questions isn't as fun :D. Maybe later on!

[Dreamoffice]

@roleoroleo are the files ok?

[roleoroleo]

@Dreamoffice
Files are ok.
Did you apply any changes to your cam?
Is the backup in the factory state?

[Dreamoffice]

I can not do this. The cam is bricked after I try to update to r40ga

[roleoroleo]

I will create a restore procedure.
If your cam follows the boot procedure enough to start the sd, it should work.

[Dreamoffice]

Ok. Yes I think the boot is ok.

[roleoroleo]

@Dreamoffice
Try this unhack procedure:
unhack_b091qp.tar.gz

[ghost]

Almost the same as my attempt at "unhack_b091qp.tar.gz" except I seem to have a little extra with the wifi in the init.sh?

        echo "WIFI_TYPE:$WIFI_TYPE"
...
                elif [ "${WIFI_TYPE}" = "7" ];then
                        if [ ! -f /backup/ko/rdawfmac.ko ];then
                        cp  /tmp/sd/wifi_drive/rdawfmac.ko /backup/ko/
                        fi      

                        if [ ! -d /backup/ko/rda5995-usb ];then
                        cp  /tmp/sd/wifi_drive/rda5995-usb/  /backup/ko/ -rf
                        fi



        echo "--------------------------insmod wifi--------------------------"
...
                elif [ -f /backup/ko/rdawfmac.ko ];then
                        insmod /backup/ko/rdawfmac.ko

I'm a little surprised Dave has the same model suffix as myself of b091qp?

[ghost]

Hope you can get it sorted soon Dave. Did you find out the model number?

Seems to be a few things one can trip up on, took me a while to realize having carriage returns in a script file causes it to fail, only line feeds allowed! Will post settings once finished, still in discovery mode at the moment. Trying to adapt the lower_half_init.sh file to be closer to our version just doesn't seem to want to play.

[Dreamoffice]

No. I m not that familiar with this. I havnt found the model number. Where can I find it?

[ghost]

During the serial debug after init.sh starts (a little bit before the Big "Yi" and "Welcome to XiaoYi Linux." message. init.sh echo's "product_name=xxxxx" where xxxxx is the product number. While some device id's (DID) or SNo.s? may have the start of the DID being the product name or "suffix" mine does not with the first five alphanumeric characters being A492D.

If no access to serial debug then maybe search for /UBOOT in the firmware image. Can try mtdbackup0.bin in which you may see /uboot_xxxxx kernel_xxxxx rootfs_xxxxx where xxxxx represents the product name.

[Dreamoffice]

hi
this is all i can see during starting the cam

`
[38]HELLO! BOOT0 is starting Nov 14 2019 20:01:31!
[43]BOOT0 commit : 81c18ee
[46]board init start
[48]set pll start
[50]set pll end
[52][pmu]: bus read error
[54]board init ok
[56]chip id check OK
[58]DRAM BOOT DRIVE INFO: V0.41
[61]DRAM CLK = 528 MHz
[63]DRAM Type = 2 (2:DDR2,3:DDR3)
[67]DRAMC read ODT off.
[69]DRAM ODT off.
[71]DRAM SIZE =64 M
[78]DRAM simple test OK.
[80]rtc standby flag is 0x0, super standby flag is 0x0
[86]dram size =64
[88]spinor id is: 1c 70 17, read cmd: 03
[92]Succeed in reading toc file head.
[96]The size of toc is 4c000.
[148]Entry_name = optee
[152]Entry_name = u-boot
[156]Entry_name = dtb
[159]Jump to secend Boot.
MESSAGE: [0x0] TEE-CORE: OP-TEE version: sun8iw19p1_v0.6.0-12-g97f2688 #1 2019年 11月 08日 星期五 08:26:51 UTC arm
ERROR: [0x0] TEE-CORE:platform_standby_fdt_parse:126: no pmu node
ERROR: [0x0] TEE-CORE:sunxi_twi_parse_from_dt:84: no pmu node

U-Boot 2018.05 (Mar 03 2021 - 15:32:59 +0800) Allwinner Technology

[00.203]DRAM: 64 MiB
[00.205]Relocation Offset is: f9f94000
[00.216]secure enable bit: 0
[00.219]CPU=816 MHz,PLL6=600 Mhz,AHB=200 Mhz, APB1=100Mhz MBus=132Mhz
[00.225]gic: sec monitor mode
[00.228]flash init start
[00.230]workmode = 0,storage type = 3
SF: Detected en25qh64 with page size 256 Bytes, erase size 4 KiB, total 8 MiB
[00.247]sunxi flash init ok
[00.250]Loading Environment from SUNXI_FLASH... start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x3e00, len: 0x100
OK
[00.311]try sprite_led_gpio config
xxxxxxxxxxxxxxlijun uboot xiaoyiledinit
[00.318]sprite_led_gpio start
00.321update dtb dram start
[00.326]update dtb dram end
[00.328]update dts
root_partition is rootfs
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
set root to /dev/mtdblock2
[00.391]update part info
[00.393]update bootcmd
mmc driver ver uboot2018:2019-8-15 16:34:00
get mem for descripter OK !
[00.406]get sdc_wipe fail.
[00.408]get sdc0 sdc_erase fail.
[00.411]get sdc0 sdc_boot fail.
[00.414]get sdc0 sdc_odly_50M fail.
[00.417]get sdc0 sdc_sdly_50M fail.
[00.420]get sdc0 sdc_odly_50M_ddr fail.
[00.424]get sdc0 sdc_sdly_50M_ddr fail.
[00.427]get sdc0 sdc_freq fail.
[00.430]get sdc0 sdc_b0p fail.
[00.433]get card0_boot_para:sdc_ex_dly_used fail
[00.438]get card-pwr-gpios handler:1119307360
[00.442]get card0_boot_para:time_pwroff:200ms
[00.448]Using default timing para
[00.650]init mmc 0 clock and io
devnum 0, prv 43fbd4b8, bdesc 42b74844
SUNXI SD/MMC: 0
[00.658]==================== work mode: 0 0, sample_mode:0
[00.663]=============== start mmc_init_boot...
[00.682]Card did not respond to voltage select!
[00.686]mmc_init: -95, time 28
[00.688]mmc_init: mmc init fail, err -95
card0 init failed
No sd-card insert,will normal boot
Hit any key to stop autoboot: 0
start: 0x2e0, len: 0x1
start: 0x2e1, len: 0x1
start: 0x2e2, len: 0x2
[01.711]partinfo: name boot, start 0x20, size 0xf80
start: 0x300, len: 0x40
start: 0x340, len: 0xf3e
[02.212]android.hardware = sun8iw19p1

Booting kernel from Legacy Image at 45000000 ...

Image Name: ARM OpenWrt Linux-4.9.118
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2030264 Bytes = 1.9 MiB
Load Address: 40008000
Entry Point: 40008000
[02.280]Starting kernel ...

** 2 printk messages dropped ** [ 0.000000] ion_mem_reserve: err format for i on reserve list!
[ 0.100337] ion_heap_create: Invalid heap type 4
[ 0.106841] sunxi_i2c_probe()2213 - [i2c1] warning: failed to get regulator i d
[ 0.134939] uart uart0: get regulator failed
[ 0.165395] sunxi-wlan wlan: request pincrtl handle for device [wlan] failed
[ 0.173606] sunxi-wlan wlan: get gpio wlan_regon failed
[ 0.179533] sunxi-wlan wlan: get gpio chip_en failed
[ 0.185150] sunxi-wlan wlan: get gpio wlan_hostwake failed
[ 0.209202] mtd: partition "UDISK" is out of reach -- disabled
[ 0.304561] VE: get debugfs_mpp_root is NULL, please check mpp
[ 0.304561]
[ 0.578079] mmc:failed to get gpios
[ 0.623336] sunxi-mmc sdc1: smc 1 p1 err, cmd 52, RTO !!
[ 0.630215] sunxi-mmc sdc1: smc 1 p1 err, cmd 52, RTO !!
[ 0.640672] sunxi-mmc sdc1: smc 1 p1 err, cmd 8, RTO !!
[ 0.647418] sunxi-mmc sdc1: smc 1 p1 err, cmd 5, RTO !!
[ 0.654203] sunxi-mmc sdc1: smc 1 p1 err, cmd 5, RTO !!
[ 0.661003] sunxi-mmc sdc1: smc 1 p1 err, cmd 5, RTO !!
[ 0.667652] --->sunxi_daudio_dev_probe<--- strat.
[ 0.673010] sunxi-mmc sdc1: smc 1 p1 err, cmd 5, RTO !!
[ 0.679132] sunxi-mmc sdc1: smc 1 p1 err, cmd 55, RTO !!
[ 0.685178] sunxi-mmc sdc1: smc 1 p1 err, cmd 55, RTO !!
[ 0.691196] sunxi-mmc sdc1: smc 1 p1 err, cmd 55, RTO !!
[ 0.697263] sunxi-mmc sdc1: smc 1 p1 err, cmd 55, RTO !!
[ 0.703459] sunxi-mmc sdc1: smc 1 p1 err, cmd 1, RTO !!
[ 0.710774] --->sunxi_daudio_dev_probe<--- end.
[ 0.803253] write_efuse_to_reg_ver_3:getting efuse data bit out of 12-bit lim it
starting pid 557, tty '': '/etc/init.d/rcS boot'
[RCS]: /etc/init.d/S01udev
Populating /dev using udev: [ 1.345705] udevd[562]: could not create /run/ude v: No such file or directory
done
[RCS]: /etc/init.d/S02app
[ 1.526308] squashfs: SQUASHFS error: unable to read id index table
mount: mounting /dev/mtdblock3 on /home failed: Invalid argument
/backup/init.sh not exist!
[RCS]: /etc/init.d/S20urandom
read-only file system detected...done
starting pid 573, tty '/dev/console': '-/bin/sh'

BusyBox v1.27.2 () built-in shell (ash)

        __    __   _
        \ \  / /  | |
         \ \/ /   | |
          \  /    | |
          / /     | |
         /_/      |_|

---

Welcome to XiaoYi Linux.

root@(none):/#
`

[ghost]

Looks good up to SQUASHFS error, sounds like the /home partition (mtdblock3) is corrupt. I will attach my home partition so you can compare and see if it's okay. Then I guess you need to recover that partition. Almost there :)

home.zip

Don't worry about the name, I used 7zip and that's what it was extracted as but I believe it should be correct.

[Dreamoffice]

how should i do this compare if it is corrupt. sorry for my stupid questions, i havn t done this before :-(

[ghost]

The file I attached is so you can compare with your backup file mtdblock3.bin, they should be the same. Not sure why I bothered zipping the file but you will need to unzip it first.

Windows cmd window "FC /B home.img mtdblock3.bin"

or

Linux terminal "cmp home.img mtdblock3.bin"

This is to check the integrity of the partition file before restoring it.

I have to wonder why it is corrupt in case it was caused by restoring the backup partition to the wrong location, did you previously try that? I ask because if so the backup partition may be corrupt also.

I haven't used the wiki recovery method, I will have a look at it but best if Roleo leads. Personally I don't like the way they use hex numbers without a prefix or suffix designation, just doesn't seem right! Will try to have a play around this end to learn a bit more and get back to you if Roleo hasn't replied by then.

Well I broke my home partition and fixed it up using the debug port so have a better idea now.

I'm guessing this is your serial debug connection, you'll need to be quick with the 'Enter' key when powering on.

Would you post your mtd.txt file.

[roleoroleo]

0-Al's diagnosis is correct.
mtdblock3 (home partition) seems corrupted.
In addition to the binary comparison, if you have a linux machine you could try to check your backup file decompressing it with unsquashfs:
unsquashfs mtdblock3.bin

Recovery method described in the wiki works.
I used it 2 times.
But you have to use it carefully.

[Dreamoffice]

so i can use the unbrick tutorial to write the mtdblock3.bin?

this is my mtd.txt file

dev: size erasesize name
mtd0: 00060000 00001000 "uboot"
mtd1: 001f0000 00001000 "boot"
mtd2: 00120000 00001000 "rootfs"
mtd3: 00300000 00001000 "home"
mtd4: 00150000 00001000 "backup"
mtd5: 00020000 00001000 "env"
mtd6: 00010000 00001000 "mfg"
mtd7: 00010000 00001000 "conf"
mtd8: 00000000 00000000 "UDISK"

i use the unbrick tutorial with the hex address 650000

comparing the files makes an error

[ghost]

FC command originates from DOS days and means File Compare with the /B option meaning Binary. It can still be used today on Windows under a command shell, not the Powershell command you have tried which is a different command meaning Format Custom. The cmd console can be activated by running cmd.exe.

i use the unbrick tutorial with the hex address 650000

Okay, good to know. If using 650000 to restore the backup partition mtdblock4.bin this would corrupt the end of the home partition and most of the backup partition, should have been 0x670000. You will need to recover both mtdblock4.bin and mtdblock3.bin.

Here's how it looks in a little more detail

dev:	SPI Flash Address	Length 		Name	Block
=====================================================================
mtd0:	0x000000-0x05ffff	0x060000	uboot	mtdblock0.bin
mtd1:	0x060000-0x24ffff	0x1f0000	boot	mtdblock1.bin
mtd2:	0x250000-0x36ffff	0x120000	rootfs	mtdblock2.bin
mtd3:	0x370000-0x66ffff	0x300000	home	mtdblock3.bin
mtd4:	0x670000-0x7bffff	0x150000	backup	mtdblock4.bin
mtd5:	0x7c0000-0x7dffff	0x020000	env	mtdblock5.bin
mtd6:	0x7e0000-0x7effff	0x010000	mfg	mtdblock6.bin
mtd7:	0x7f0000-0x7fffff	0x010000	conf	mtdblock7.bin

FWIW I did the recovery a little differently

Connected a PC serial comport to camera debug serial using TTL 3.3V level signals.

Run comm's program at 115200 Baud to read and write to com port. (bits-parity-stop of 8-n-1 seems to work)

Power up camera while tapping the 'enter' key on the PC more than once a second, need to be quick to get into our recovery boot mode. Should see the => prompt if successful.

I ran the mmcinfo command instead of sunxi_card0_probe. Ends in the same result to mount the memory card I think

=> mmcinfo
curr_device:0
Device: SUNXI SD/MMC
Manufacturer ID: 3
OEM: 5344
Name: SU64G
Bus Speed: 25000000
Mode : SD Legacy
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 59.5 GiB
Bus Width: 4-bit
Erase Group Size: 512 Bytes

Then I check partition information with mmc par command

=> mmc par

Partition Map for MMC device 0  --   Partition Type: DOS

Part    Start Sector    Num Sectors     UUID            Type
  1     63              124728597       00000000-01     83

From this I can see device number is 0 and partition number is 1.

Can use fatls command to check the files on the memory card using the device and partition numbers.

=> fatls mmc 0:1
            record/
     3521   lower_half_init.sh
            newbackup/
            yi-hack/
            Factory.done/
 67108864   swapfile
            isp/
            log/
     3521   lower_half_init.sh.org
            System Volume Information/
 67108864   haha3.bin
  1376256   bk2.bin
  3145728   home.img
  3133440   squashed.bin
  3133440   modhome.bin
  1179648   modroot.bin
  1179648   rootfs.img

10 file(s), 7 dir(s)

Used sf probe command to look for the flash chip and activate it

=> sf probe
sf: bus-0 cs-0 spedd-50000000Hz mode-3000
SF: Detected XM25QH64A with page size 256 Bytes, erase size 4 KiB, total 8 MiB

Used fatload command to load the recovery file "home.img" from memory card device 0, partition 1 into RAM at 0x45000000

=> fatload mmc 0:1 0x45000000 home.img
3145728 bytes read in 272 ms (11 MiB/s)

Used the sf update command which both erases and writes the loaded RAM image at 0x45000000 to SPI flash address region 0x370000-0x66ffff (0x300000 bytes)

=> sf update 0x45000000 0x370000 0x300000
device 0 offset 0x370000, size 0x300000
1847296 bytes written, 1298432 bytes skipped in 15.754s, speed 204418 B/s

The reason for the "bytes skipped" is that I had a modified partition flashed before "modhome.bin" and the sf update method seems to intelligently only erase and update blocks that are different.

If happy all is okay then a reset command hopefully sees everything back to working as expected.
=> reset

Your recovery this way Dave might consist of the following commands

mmcinfo
mmc par
fatls mmc 0:1
sf probe
fatload mmc 0:1 0x45000000 mtdblock3.bin
sf update 0x45000000 0x370000 0x300000
fatload mmc 0:1 0x45000000 mtdblock4.bin
sf update 0x45000000 0x670000 0x150000
reset

Depends on what device and partition number is shown for "mmc par". Probably going to be the same (0:1) but check and adjust as necessary.

Perhaps the wiki way is better but I guess I just like to try things on my own since one learns (hopefully) from ones mistakes. :)

[Dreamoffice]

first of all THANKS A LOT @roleoroleo and @0-Al
the camera is now back and running. i found the product name like you just already mentioned "product_name=b091qp". now the camera is back on the stock firmware.

the file comparision with cmd worked. i used power shell and there it is not possible to do this

How can i do this?

Please, send me 3 copies of your /dev/shm/fshare_frame_buf
I need to check the format of the stream.

Make a copy.
Wait 5 secs.
Make a copy.
Wait 5 secs.
Make a copy.
Zip and send it to me.

Do i need SSH access for this?

[roleoroleo]

I didn't know that the b091qp model had a different mtd table.
This is the first time this has happened with allwinner-v2.

How can i do this?

Please, send me 3 copies of your /dev/shm/fshare_frame_buf
I need to check the format of the stream.
Make a copy.
Wait 5 secs.
Make a copy.
Wait 5 secs.
Make a copy.
Zip and send it to me.

Do i need SSH access for this?

Yes, connect with ssh and make a copy of the file with "cp" command.
Use filezilla to move these files on your pc.
Zip them with your favorite program.

[Dreamoffice]

how can i connect to the cam with SSH? do i need user and password?

Have you compiled a firmware for the b091qp?

[roleoroleo]

If you are a windows user, use putty to connect to the ip address of the cam.
User is "root" without password.

[ghost]

If you have windows ftp working you can run a command prompt (cmd.exe)
enter ftp ipaddress where ipaddress is the ip of the camera
login root no password?
enter "get /dev/shm/fshare_frame_buf 1.bin"
ftp> get /dev/shm/fshare_frame_buf 1.bin
then again with 2.bin and 3.bin, can cut and paste or use up arrow and edit previous entry. This will place the 3 files in your current directory, the one you ran the command from.

[Dreamoffice]

@0-Al
on what kind of system are you running debian for compiling the Yi Hack firmware?

could you give me a short introduction which file you are working on and how do you compile the firmware?

[ghost]

TLDR Debian is gone.

I was using a 10 year old laptop with dual core CPU.

Got side tracked with camera sensor being 1MP while producing an interpolated 1080p video. Why do that, it's not clearer and increases bandwidth, storage and processor time. So I wanted to try and use 720p 1:1 but killed Debian with some installs, wouldn't post. So back with Fedora which isn't compiling Yi-Hack without error. Originally I based the compilation on r40ga and making necessary changes to several files. Probably best to wait for Roleo's magic to add a real and better one to the repository.

What camera sensor do you have? It should be in the debug info shortly after "Welcome to XiaoYi Linux."

WIFI_TYPE:?
SENSOR_TYPE:??

My sensor type is 11 which is h63 and the board number also has the sensor model imprinted JX-H63.
Another give away is
debug : cedarc <H264InitVer2:6095>: h264Init: input_size[1280x720], output_size[1920x1080], virtual_period:0, color_format:1

[roleoroleo]

Do you want to try this beta?
b091qp_0.1.9.tar.gz

[Dreamoffice]

it s so frustrating.
i can not connect via SSH to the cam, and i can not connect to the web interface. Do i need to connect the cam to wifi or is ethernet ok?

is there a posibility to check if the hack is installed? i can install the r40ga hack but then the cam is bricked

[roleoroleo]

I will check if something is wrong in the image.
But I can't test it.

[roleoroleo]

The image seems ok.

is there a posibility to check if the hack is installed? i can install the r40ga hack but then the cam is bricked

Try with telnet instead of ssh.

EDIT

If you already hacked the cam with another file, you need to use unhack procedure.
Check the wiki.

[Dreamoffice]

I used the unhack file from @roleoroleo already. But I will check the procedure this evening

[roleoroleo]

Be sure to use b091qp_unhack

[ghost]

@roleoroleo Here's commands for white LEDs on/off in case it might be useful.
WLED.zip

[roleoroleo]

Thanks.

[Dreamoffice]

Finally i got it working.

1. format the SD Card like @0-Al described
2. install the unhack files on the camera
3. install the yi hack b091qp

now i can connect to the web interface. :-)

[roleoroleo]

Please check if rtsp stream and snapshot work.

[Dreamoffice]

This is the rtsp stream image:

this is the high res snapshot:

this is low res snapshot: low res is running.

now i have to find out how i can create the files from /dev/shm/fshare_frame_buf

[roleoroleo]

What's the resolution of the cam?
3k or full hd?

[ghost]

According to Dave's debug data it's using an F37 sensor, around 2.4MP effective IIRC so probably outputting 1920x1080 FHD unless like my 1MP camera they interpolate it to a higher resolution so could be outputting 8k ! :/

As I said earlier, surprised Dave has they same number b091qp as his uses a different sensor and Wifi chip. Does that make it more difficult to produce a b091qp generic hack? There was another user with b091qp in the issues tab, wonder what they have?

Anyway, looking at another cam at the moment, sold as a 3MP camera but it seems to be only 2MP, at least it's running at native resolution unlike the 1MP one meaning a clearer picture.

[roleoroleo]

The final solution is to check the fshare_frame_buf.
Please send me a copy of the file.

• Enter with ssh.
• Copy the file /dev/shm/fshare_frame_buf
• Extract from the cam with filezilla.
• Zip and send it to me.

[Dreamoffice]

thanks to @0-Al for this excellent tutorial how i can download easy this files

here are the files.
cam.zip

[roleoroleo]

h264 stream is coded in fullhd.
Try this new binaries:
rRTSPServer.gz
framefinder.gz
imggrabber.gz

[candidotsa]

hi @roleoroleo & @Dreamoffice. first of all thanks for the great work. i have a bw-yic1 and i follow the flash instructions but i can´t access the web interface. There is anything that i'm missing?
-i connect the camera on the official apk
-copy the files to a 8gb fat32 format sd card
-the camera as reboot and connect to wifi
-no connections on http://camera-ip:8080 (camera is online but not detected by official app and retrieves ping.)
thanks

[pengkaiwei]

hi @roleoroleo & @Dreamoffice. first of all thanks for the great work. i have a bw-yic1 and i follow the flash instructions but i can´t access the web interface. There is anything that i'm missing? -i connect the camera on the official apk -copy the files to a 8gb fat32 format sd card -the camera as reboot and connect to wifi -no connections on http://camera-ip:8080 (camera is online but not detected by official app and retrieves ping.) thanks

I am also in the same situation, wifi can not find the device, plug in the network cable directly, you can see the device ip, but there is still no image in rtsp

[roleoroleo]

I moved the web page to port 80.
Try again.

[candidotsa]

Thank you. I will try again tonight.

[candidotsa]

I moved the web page to port 80. Try again.

hi. @roleoroleo it's not working. maybe i'm doing something wrong.

log_wifi_connected.tar.gz

thanks for your help

[roleoroleo]

No, if the cam is already correctly hacked you don't need to apply unhack.
The hack procedure checks if init.sh contains telnetd and doesn't start the hack if not necessary.

But if you want, you can overwrite only the yi-hack folder.

[Dreamoffice]

Cool
it's running fine

[roleoroleo]

Is up/down inverted?
Is left/right inverted?

[Dreamoffice]

no it is not inverted

[roleoroleo]

@Dreamoffice
Could you please send me a picture of the wifi board.
I need to check the difference between BLITZWOLF BW-YIC1 and ESCAM PT202.
#281

[Dreamoffice]

[roleoroleo]

Thank you.

[Dreamoffice]

i m trying to connect the HA Yihack integration. but i m struggling, which user and password is needed?

[roleoroleo]

The password of the web interface, if you changed it.
Otherwise blank.

[Dreamoffice]

i get this errors
`Logger: homeassistant.config_entries
Source: custom_components/yi_hack/init.py:65
Integration: Yi Home Cameras with yi-hack (documentation)
First occurred: 30. Oktober 2021, 20:55:24 (3 occurrences)
Last logged: 11:22:06

Error setting up entry yi_hack_a2_a7acb4 for yi_hack
Traceback (most recent call last):
File "/usr/src/homeassistant/homeassistant/config_entries.py", line 304, in async_setup
result = await component.async_setup_entry(hass, self) # type: ignore
File "/config/custom_components/yi_hack/init.py", line 65, in async_setup_entry
CONF_AI_HUMAN_DETECTION_START_MSG: mqtt[CONF_AI_HUMAN_DETECTION_START_MSG],
KeyError: 'AI_HUMAN_DETECTION_START_MSG'`

[roleoroleo]

I'm in the middle of a breaking change.
Try again with the last commit.

[ghost]

This is the video file of the sd card, you can view it if necessary.

03M00S60.zip

Not necessary for me and if RTSP is working without problem then the frame rate doesn't seem to be a problem either. Thanks for sharing fshare_frame_buf.

[pengkaiwei]

@1-Al thanks.
Now my main problem is that the wifi doesn't work. Is your camera wifi available?

[ghost]

All my camera's are wired except for h60ga.

What if you modify "/tmp/sd/yi-hack/script/wifidhcp.sh" as

killall udhcpc
HN="yi-hack"
if [ -f /tmp/sd/yi-hack/etc/hostname ]; then
        HN=$(cat /tmp/sd/yi-hack/etc/hostname)
fi
#udhcpc -i wlan0 -b -s /backup/tools/default.script -x hostname:$HN 
udhcpc -i wlan0 -b -s /home/app/script/default.script -x hostname:$HN 

[roleoroleo]

I think this change can solve the problem.

[pengkaiwei]

modify "/tmp/sd/yi-hack/script/wifidhcp.sh"

killall udhcpc
HN="yi-hack"
if [ -f /tmp/sd/yi-hack/etc/hostname ]; then
        HN=$(cat /tmp/sd/yi-hack/etc/hostname)
fi
#udhcpc -i wlan0 -b -s /backup/tools/default.script -x hostname:$HN 
udhcpc -i wlan0 -b -s /home/app/script/default.script -x hostname:$HN 

@1-Al @roleoroleo @candidotsa The modify "/tmp/sd/yi-hack/script/wifidhcp.sh" is work for my cam, wifi is work.

Thanks!

[candidotsa]

Hi. I'm waiting to the next release. I have already tried with different cards, already use the files on this chat and nothing work. Probably is a bad procedure that I'm doing.😩 A sexta, 14/01/2022, 15:24, Geekman ***@***.***> escreveu:

…

hi @roleoroleo <https://github.com/roleoroleo> & @Dreamoffice <https://github.com/Dreamoffice>. first of all thanks for the great work. i have a bw-yic1 and i follow the flash instructions but i can´t access the web interface. There is anything that i'm missing? -i connect the camera on the official apk -copy the files to a 8gb fat32 format sd card -the camera as reboot and connect to wifi -no connections on http://camera-ip:8080 (camera is online but not detected by official app and retrieves ping.) thanks I am also in the same situation, wifi can not find the device, plug in the network cable directly, you can see the device ip, but there is still no image in rtsp — Reply to this email directly, view it on GitHub <#249 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASR3U5DX4FRPUTYQCJFOBOTUWA5ZVANCNFSM5DMMA3DQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you commented.Message ID: <roleoroleo/yi-hack-Allwinner-v2/repo-discussions/249/comments/1970272@ github.com>

[candidotsa]

hi. thanks to all.. its working 👍. i just slow format the sd card and copy the last release files.

[candidotsa]

hi to all. mine is working fine with wifi or cable. see if i can help.
beta.zip
stable.zip

thanks