22.x.x.x firmware - GOKE GK7102 SoC

[se-msys]

Just for information.

I bought this ESCAM "button" Q6. It uses 22.x.x.x series of the same style of firmware. The SoC is a GOKE Electronics GK7102. My plan is to enable telnetd and reconfigure video bitrate (it's rather low for the moment)

http://www.gokemicro.com/GK7102.html

Example firmware upgrade file it tries to fetch:
http://upg.cloudlinks.cn/upg/22/00/npcupg_22.00.00.14.bin

[hhrhhr]

the latest firmware (22.00.00.16) already has a working telnetd and an empty root password.

[csirk51]

hi,
unfortunately the later firmwares close telnet option, but reduce bitrate and quality. Is there a way to add possibility to work with exec_sz=0x18c7 firmwares too?
br.
Feri

[ohinckel]

@mada3k / @csirk51, please have a look at the my PR #3, which adds support for 22.x.x.x versions.

[csirk51]

Thanks for the help, it works great:)

[ohinckel]

Just because I'm interested: @csirk51 can you tell me which modification do you do with the firmware? How to enable telnetd for later firmware which do not open this port? And: do you know how to flash the device in a manual way? Or how do you do the flashing?

[csirk51]

Before (no telnet available firmwares) I had to use serial pins to get into the device to open telnet for modifications, it was really annoying.
To enable telnet, just put /bin/busybox telnetd into /npc/boot.sh, so it will load on boot (user is root and there is no password).
The changes I often make on Digoo M1Q (/npc/config/video_sc1135.xml) and M1Z (/npc/config/video_sc1135.xml) Stream0 are the following:

• increase vi_framerate to 25
• increase fps to 25
• reduce h264_gop_N to 25
• increase h264_cbr_avg_bps to 4000000 (6000000 on M1Z)
• increase h264_vbr_min_bps to 2000000 (3000000 on M1Z)
• increase h264_vbr_max_bps to 4000000 (6000000 on M1Z)
• reduce h264_qp_min_I to 12
• reduce h264_qp_min_P to 15

[ohinckel]

Do you do this all manually or do you use some script or patch files to modify the firmware? Maybe you provide your final configuration since I'm also using a Digoo M1Q.

Do you have some documentation about all these settings? How do you know what to change?

[csirk51]

I got my camera into bootloop before with wrong config, so I do it manually on the new firmwares for safety, than flash it to the cameras.
About settings... I searched a lot what they could stand for, these are the ones I can see some improvement in quality after the modifications.

[ohinckel]

@csirk51 thanks for your feedback.

But how do you flash an img file? Simply do a dd of the parts (app, jffs) into the correct mdblock devices on the camera? I'm interested in the concrete flashing procedure because I don't want to brick the cam by simply coping the data into the md devices. But maybe this is the way of manual flashing.

[csirk51]

I just use the gm_app_fw.py script the way it is written on the main page:

• unpack the firmware (-u)
• mount the firmware (-m)
• modify the parameters on the mounted filesystem (in /mnt/fw_app/)
• create a new image of the modified filesystem (mkfs.jffs2 -r /mnt/fw_app/ -o modified.jffs2)
• pack the firmware using the new jffs and the old elf files
• flash the modified firmware with ipc debugging tool or tinyipctools

[WRH2000]

I have one of the more recent M1Q's with the 22.0.0.17 firmware, it does not have Telnet open, just 53, 554, and 5000...@csirk51 how are you getting access to the Telnet port? Can busybox be loaded without tapping the serial pins on the pcb?

[csirk51]

You can download the .17 firmware from here (sent by digoo support).
Modify this one if you need .17 with working telnet.

[mookyu]

How can I modify the resolution and bitrate of rtsp video stream?

[ciast]

I've M1Z version with 22.0.0.40 firmware. @csirk51 how to enable ftp access? I tried to put boot.sh in npc folder (microsd card) with:

#!/bin/sh

/bin/busybox telnetd

but without success. Do You have any solution?

[ohinckel]

@ciast, I guess the script is not executed when put on SD card. You need to flash a custom firmware to the device which includes the modified boot.sh script.

Just download a official firmware and try to extract the contents using the script from this repo.

[csirk51]

"/bin/busybox telnetd" is for telnet, not for ftp.
For ftp, you should check https://github.com/ant-thomas/zsgx1hacks, I didnt try it yet but maybe...

[k4300m]

Firmware 22.0.0.40
Just unpacked/mounted/modified/repacked/flashed the firmware.
I had put "/bin/busybox telnetd" after rows:

#start npc boot

and

ulimit -s 2048

After reboot telnet works, root without password.

[hrch3k]

I have yoosee cam with 21.00.00.90 version firmware. What do we need so we can we add support for 21.xx.xx.xx?

[ohinckel]

I think this issue can be closed since PR #3 is already merged which adds support for 22.xx.xx.xx firmwares.

@hrch3k, I suggest to create a new issue for this version.

[tiagofreire-pt]

Firmware 22.0.0.40
Just unpacked/mounted/modified/repacked/flashed the firmware.
I had put "/bin/busybox telnetd" after rows:

#start npc boot

and

ulimit -s 2048

After reboot telnet works, root without password.

To enable the telnet just paste the following line and reboot after that:

echo '/bin/busybox telnetd' >> /npc/boot.sh

[Kobbe1]

By accident I bricked my Digoo DG-M1X/M1Q cam which uses the GK7102 SoC by modifiying the boot.sh file - now it wont finish boot as it does not execute boot.sh.

I can get into u-boot, but found no way to actually get a shell or modifiy the boot.sh from there ...
I used the py tool provided here to unpack the firmware "npcupg_22.00.00.40.bin" - and it seems boot.sh is actually part of it. So now I wonder if there is a way for me to flash above image? Maybe through kermit (loadb) in u-boot? (I cant get ethernet to work so cant use TFTP ....)

U-Boot 2012.10 (Sep 29 2006 - 00:20:41) for GK7102 rb jxh42 v1.00 (GOKE)

HAL:  20151223 
DRAM:  64 MiB
Flash: 16 MiB
16 MiB
NAND:  SPINAND MID = 0xff, DID = 0xffff, Data = 0x1ffffff !spinand_board_init[1581]: No support this SPI nand!
SF: Detected GD25Q128C with page size 256 B, sector size 64 KiB, total size 16 MiB
In:    serial
Out:   serial
Err:   serial
Net:   arm_freq(600MHz)..............0x112032
use int MII..............
gk7101
Hit any key to stop autoboot:  5 ��� 4 ��� 3 ��� 2 ��� 1 ��� 0 
[PROCESS_SEPARATORS] run sfboot
[PROCESS_SEPARATORS] setenv bootargs console=${consoledev},${baudrate} noinitrd mem=${mem} rw ${rootfstype} init=linuxrc ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}:${netdev} mac=${ethaddr} phytype=${phytype};sf probe 0 0;sf read ${loadaddr} ${sfkernel} ${filesize}; bootm
SF: Detected GD25Q128C with page size 256 B, sector size 64 KiB, total size 16 MiB
put param to memory
mem size (35)
bsb size (2)

the kernel image is zImage or Image
entry = 0xc1000000 
## Transferring control to Linux (at address c1000000)...

Starting kernel ...

machid = 3988 r2 = 0xc0000100 
Uncompressing Linux... done, booting the kernel.
[    0.000000] Booting Linux on physical CPU 0
[    0.000000] Linux version 3.4.43-gk (user15@ubuntu) (gcc version 4.6.1 (crosstool-NG 1.18.0) ) #56 PREEMPT Fri Sep 29 00:24:56 PDT 2006
[    0.000000] CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), cr=00c5387d
[    0.000000] CPU: VIPT aliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Goke GK7102 RB_JXH42 board V2.00
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] AHB: 0x90000000  0xf2000000  -- 0x1000000
[    0.000000] APB: 0xa0000000  0xf3000000  -- 0x1000000
[    0.000000] PPM: 0xc0000000  0xc0000000  -- 0x200000
[    0.000000] BSB: 0xc2500000  0xf5000000  -- 0x200000
[    0.000000] DSP: 0xc2700000  0xf6000000  -- 0x1900000
[    0.000000] hal version = 20151223 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8890
[    0.000000] Kernel command line: console=ttySGK0,115200 noinitrd mem=35M rw mtdparts=gk7101_flash:256K(boot),64K(bootenv),2560K(kernel),7168K(rootfs),1024K(rom),5312K(APP) rootfstype=squashfs root=/dev/mtdblock3 init=linuxrc ip=192.168.1.229:192.168.1.225:192.168.1.1:255.255.255.0:"gk7101":eth0 mac=3C:97:0E:22:E1:14 phytype=0
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 35MB = 35MB total
[    0.000000] Memory: 30760k/30760k available, 5080k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xff600000 - 0xffe00000   (   8 MB)
[    0.000000]     vmalloc : 0x82800000 - 0xff000000   (1992 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x82300000   (  35 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80413000   (4140 kB)
[    0.000000]       .init : 0x80413000 - 0x80433000   ( 128 kB)
[    0.000000]       .data : 0x80434000 - 0x8045cd00   ( 164 kB)
[    0.000000]        .bss : 0x8045cd24 - 0x8048edf8   ( 201 kB)
[    0.000000] NR_IRQS:128
[    0.000000] >> gk7101 init irq vic1...
[    0.000000] >> gk7101 init irq vic2...
[    0.000000] gk7101 init vic...
[    0.000000] mach gk7101 init timer...
[    0.000000] sched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps every 4294967286ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttySGK0] enabled
[    0.010000] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 512
[    0.080000] CPU: Testing write buffer coherency: ok
[    0.090000] Setting up static identity map for 0xc0542e30 - 0xc0542e68
[    0.100000] NET: Registered protocol family 16
[    0.110000] gk7101 init timer...
[    0.110000] Init HW timer for DSP communication
[    0.120000] gk7101 init gpio...
[    0.120000] gpiochip_add: registered GPIOs 0 to 63 on device: gk7101-gpio0
[    0.130000] gpio map init...
[    0.130000] create proc dir
[    0.140000] gk7101 register devices 8
[    0.140000] gk7101 register I2C
[    0.280000] bio: create slab <bio-0> at 0
[    0.290000] spi spi.0: gk7101 SPI Controller 0 created 
[    0.290000] spi spi.0: master is unqueued, this is deprecated
[    0.300000] usbcore: registered new interface driver usbfs
[    0.310000] usbcore: registered new interface driver hub
[    0.310000] usbcore: registered new device driver usb
[    0.320000] i2c regbase: 0xf3003000 
[    0.320000] i2c i2c.0: i2c irq:registers 9
[    0.330000] i2c i2c.0: GK7101 I2C[0] adapter[i2c-0] probed!
[    0.340000] FS-Cache: Loaded
[    0.340000] CacheFiles: Loaded
[    0.350000] cfg80211: Calling CRDA to update world regulatory domain
[    0.360000] gk7101-sd gk7101-sd.0: Slot0 req_size=0x00010000, segs=16, seg_size=0x00010000
[    0.390000] gk7101-sd gk7101-sd.0: GK7101 SD/MMC[0] has 1 slots @ 46000000Hz, [0x09e130b0:0x00000000]
[    0.400000] NET: Registered protocol family 2
[    0.400000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.410000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.420000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.430000] TCP: Hash tables configured (established 2048 bind 2048)
[    0.440000] TCP: reno registered
[    0.440000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.450000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.450000] NET: Registered protocol family 1
[    0.460000] RPC: Registered named UNIX socket transport module.
[    0.470000] RPC: Registered udp transport module.
[    0.470000] RPC: Registered tcp transport module.
[    0.480000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.490000] mdma init...
[    0.490000] mdma request irq: 54 
[    0.500000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.510000] NFS: Registering the id_resolver key type
[    0.520000] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    0.530000] msgmni has been set to 60
[    0.540000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
[    0.550000] io scheduler noop registered
[    0.550000] io scheduler deadline registered
[    0.560000] io scheduler cfq registered (default)
[    0.570000] uart.0: ttySGK0 at MMIO 0xa0005000 (irq = 31) is a gk7101uart
[    0.570000] uart.1: ttySGK1 at MMIO 0xa001f000 (irq = 15) is a gk7101uart
[    0.580000] uart.2: ttySGK2 at MMIO 0xa001e000 (irq = 27) is a gk7101uart
[    0.600000] brd: module loaded
[    0.610000] loop: module loaded
[    0.610000] adc initialized (10:11)
[    0.620000] slram: not enough parameters.
[    0.620000] speed_mod is 0
[    0.630000] gk7101_flash gk7101_flash.0: GD25Q128C (16384 Kbytes)
[    0.630000] 6 cmdlinepart partitions found on MTD device gk7101_flash
[    0.640000] Creating 6 MTD partitions on "gk7101_flash":
[    0.650000] 0x000000000000-0x000000040000 : "boot"
[    0.650000] 0x000000040000-0x000000050000 : "bootenv"
[    0.660000] 0x000000050000-0x0000002d0000 : "kernel"
[    0.670000] 0x0000002d0000-0x0000009d0000 : "rootfs"
[    0.680000] mmc0: new high speed SDHC card at address 0001
[    0.680000] 0x0000009d0000-0x000000ad0000 : "rom"
[    0.690000] 0x000000ad0000-0x000001000000 : "APP"
[    0.700000] GKETH_init
[    0.700000] [GKETH_drv_probe] eth_base = 0xf200e000
[    0.710000] mii id = 0 
[    0.710000] ###### PHY Reset.1.0.2
[    0.830000] mdiobus_register: PHY[0] whose id 0x00000000 
[    0.830000] goke MII Bus: probed
[    0.840000] gk7101-eth gk7101-eth.0: MAC Address[3e:97:0e:22:e1:14].
[    0.850000] usbcore: registered new interface driver cdc_wdm
[    0.850000] usbcore: registered new interface driver libusual
[    0.860000] musb-hdrc: version 6.0, ?dma?, otg (peripheral+host)
[    0.870000] musb phy Begin initial sequence ...
[    1.110000] gk7101 musb init end...
[    1.120000] musb-hdrc musb-hdrc: MUSB HDRC host driver
[    1.120000] musb-hdrc musb-hdrc: new USB bus registered, assigned bus number 1
[    1.130000] vm : ffde0000, phy : c21a0000
[    1.130000] dma_buf alloc ok!
[    1.140000] hub 1-0:1.0: USB hub found
[    1.140000] hub 1-0:1.0: 1 port detected
[    1.150000] musb-hdrc musb-hdrc: USB Host mode controller at f0006000 using PIO, IRQ 26
[    1.160000] platform add gk7101 musb...
[    1.160000] mousedev: PS/2 mouse device common for all mice
[    1.170000] input: GKInput as /devices/virtual/input/input0
[    1.180000] Protocol NEC[0]
[    1.180000] ir request irq: 62 
[    1.180000] IR Host Controller probed!
[    1.190000] gk7101 rtc init...
[    1.190000] rtc base: 0xf2080000 
[    1.190000] os read tm: t=0 
[    1.200000] gk7101-rtc gk7101-rtc: rtc core: registered gk7101-rtc as rtc0
[    1.200000] i2c /dev entries driver
[    1.210000] gk7101_wdt: GK7101 Watchdog Timer, (c) 2014 Goke Microelectronics
[    1.220000] [gk7101_wdt_init]: init
[    1.220000] [gk7101_wdt_probe]: probe
[    1.230000] [gk7101_wdt_probe]: probe mapped wdt_base=f3006000
[    1.230000] watchdog inactive, reset disabled, irq disabled
[    1.240000] mmcblk0: mmc0:0001 SD16G 29.5 GiB 
[    1.250000]  mmcblk0: p1
[    1.250000] IPv4 over IPv4 tunneling driver
[    1.260000] gre: GRE over IPv4 demultiplexor driver
[    1.260000] ip_gre: GRE over IPv4 tunneling driver
[    1.270000] TCP: cubic registered
[    1.270000] Initializing XFRM netlink socket
[    1.280000] NET: Registered protocol family 10
[    1.290000] IPv6 over IPv4 tunneling driver
[    1.290000] NET: Registered protocol family 17
[    1.300000] NET: Registered protocol family 15
[    1.300000] lib80211: common routines for IEEE802.11 drivers
[    1.310000] Registering the dns_resolver key type
[    1.320000] VFP support v0.3: implementor 41 architecture 1 part 20 variant b rev 5
[    1.330000] os read tm: t=0 
[    1.330000] gk7101-rtc gk7101-rtc: setting system clock to 1970-01-01 00:00:00 UTC (0)
[    1.340000] net eth0: ###### GKETH_start_hw
[    1.350000] net eth0: ###### GKETH_phy_start_aneg...
[    1.350000] ADDRCONF(NETDEV_UP): eth0: link is not ready
[    1.610000] usb 1-1: new high-speed USB device number 2 using musb-hdrc
[    2.350000] PHY: 0:00 - Link is Up - 100/Full
[    2.360000] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    2.380000] IP-Config: Complete:
[    2.380000]      device=eth0, addr=192.168.1.229, mask=255.255.255.0, gw=192.168.1.1
[    2.390000]      host="gk7101", domain=, nis-domain=(none)
[    2.390000]      bootserver=192.168.1.225, rootserver=192.168.1.225, rootpath=
[    2.410000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[    2.420000] Freeing init memory: 128K
Starting logging: OK
Starting mdev...
Initializing random number generator... read-only file system detected...done
Starting network...
ip: RTNETLINK answers: File exists
[    7.830000] gk_vi_init
[    7.830000]  request_irq...24 ok-- video_sync
[    7.830000]  request_irq...59 ok-- video_frame_last_pixel
[    7.850000]  request_irq...61 ok-- video_frame
[    7.850000]  gk7101_is_valid_gpio_irq...
[    8.040000] crypto initialized (10:11)
[    8.120000] Media driver version (gcc version 4.6.1 (crosstool-NG 1.18.0) (uClibc)) v1.1.2 #svn r8850 Wed Jul 6 17:44:23 CST 2016
/npc/boot.sh: line 1: start: not found
[   11.480000] rtusb init rt2870 --->
[   11.500000] 
[   11.500000] 
[   11.500000] === pAd = 82a82000, size = 1581168 ===
[   11.500000] 
[   11.520000] <-- RTMPAllocTxRxRingMemory, Status=0
[   11.520000] <-- RTMPAllocAdapterBlock, Status=0
[   11.530000] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x8
[   11.540000] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x4
[   11.550000] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x5
[   11.550000] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x6
[   11.560000] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x7
[   11.570000] RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x9
[   11.570000] STA Driver version-JEDI.MP1.mt7601u.v1.5
[   11.580000] Compile time-Jul 26 2006,19:39:19
[   11.590000] ==>WaitForAsicReady MAC_CSR0=0x76010500
[   11.590000] ==>WaitForAsicReady MAC_CSR0=0x76010500
[   11.610000] NVM is EFUSE
[   11.610000] Endpoint(8) is for In-band Command
[   11.610000] Endpoint(4) is for WMM0 AC0
[   11.620000] Endpoint(5) is for WMM0 AC1
[   11.620000] Endpoint(6) is for WMM0 AC2
[   11.630000] Endpoint(7) is for WMM0 AC3
[   11.630000] Endpoint(9) is for WMM1 AC0
[   11.640000] Endpoint(84) is for Data-In
[   11.640000] Endpoint(85) is for Command Rsp
[   11.650000] 80211> RFICType = 3
[   11.650000] NumOfChan ===> 58
[   11.660000] 80211> Number of channel = 0x44
[   11.660000] 80211> Number of rate = 12
[   11.670000] 80211> CurTxPower = 0 dBm
[   11.670000] 80211> TxStream = 0
[   11.680000] crda> requlation requestion by core: 00
[   11.680000] 80211> CFG80211_Register
[   11.700000] MSC msc_proc_create: 82a82000
[   11.750000] usbcore: registered new interface driver rt2870

[Kobbe1]

Well guess what, this actually worked.
I 1st unpacked the firmware (bin) using gmfwtools, then in uboot did 'loadb 0xC1000000 38400'. Uploaded the jff file through Kermit.
Then 'sf erase 0x000000ad0000 0x530000'
and
'sf write 0xC1000000 0x000000ad0000 0x0028573c'

And the device was running again.

[OzDrDj]

Hi There,
I have many of these cheap Cloud Storage Intelligent Cameras (Intelligent, OMG) and recently they upgraded the firmware to 16.0.2.0222 and since then the ONVIF feed does not work to iSpy. Opening the Camera I see it has a Goke 7102 Chip inside so i guess this firmware would work. I have tried the IPCtools software on both my computers but it doesnt find the camera. I just want to upload the firmware to the camera, Many instructions say to just put the Firmware into the root directory of an SD card formatted fat 32. Reset the camera and it should upload. But I can not seem to get that to happen.
Can someone please point me in the direction of newbie instructions of how to get the firmware onto the camera.
Please, I have 12 Cameras all bolted on to my house and none of them work.
Thanks Thanks Thank in advance.