search

AMoo-Miki / homebridge-tuya-lan

Homebridge plugin for IoT devices that use Tuya Smart's platform
MIT License
200 stars 51 forks source link

Security Cameras? #4

Open omniparker opened 5 years ago

omniparker commented 5 years ago

I was wondering if the Tuya Security Camera's may be possible. They work within the same app and I am able to get id and key in the normal manner. I tried to get the signature but don't see it in my logs. I bought the Mercury Security Camera from Walmart. It adds to the Tuya App like everything else. Would it be possible? What can I provide to help if it would be possible.

borte commented 4 years ago

Have been testing some more endpoints and done some fuzzing on the web server. From what i can find when disassembling and comparing to the code in github, mine is running mongoose 6.16. seems like that is a pretty common embedded lib for http and mqtt.

I have managed to crash my device once now by doing multiple requests to http://hostname/proc/kmsg. 1st request is fine and returns the first 4k of the file. 2nd request continues to read and returns the next 4k of the file. This is very strange since there is no state kept between the calls according to the code. Maybe there is a bug here that can be exploited. 3rd request hangs, and after some minutes the device restarts, looks like the whole thing is hanging so might be restarted by a watchdog or something.

This only seems to happen if trying to read files bigger than 4k

Will continue to poke at it and report findings..

Also the iperf endpoint looks like it can be exploited with a shell command injection, but it just hangs on mine, it has a check if the device is in some factory mode, but maybe there is a way to set that flag.

If anyone wants to try, i did a POST to http://hostname/flash/iperf3 { addr: "; some command" }

addr is formatted into this string "iperf3 -c %s -i 1 -w 448k -t 10" without validation or checks, and that is then sent over a local socket to the cmd_router process and then called in system(cmd) without any validation again.. so that should be exploitable if we are able to call it

itkfilelor commented 4 years ago

If anyone wants to try, i did a POST to http://hostname/flash/iperf3 { addr: "; some command" }

addr is formatted into this string "iperf3 -c %s -i 1 -w 448k -t 10" @borte, I'll try this tomorrow night if no one else gets to it first.

CrYpTo-GlItCh commented 4 years ago

I have the walmart 720p model, and did some digging as best I could; hopefully someone finds this information useful. The documentation I have linked, is based on the hardware and software I was able to identify through the exposed interface. There are 3 accounts on the device, one is named ppstrong, and ppstrong even has it's own flasher seperate from the default firmware flasher. This implies it is the hot loaded encryption package for the 3218 chipset likely the same used in the PPStrong 303010001 Mini. The other account aside from admin, is WeEye, the same technology used for pairing the previous mentioned PPStrong camera. The company has gone bust afaik.

The documentation for that camera lists: Password I.» rut-mm- man in r nn'lr] In the documentation along with other random setup text from a paper insert.

https://fccid.io/2AG7C303010001/User-Manual/User-Manual-3151771

I've also linked the mainboard and cpu listed here: http://11.11.11.254/proc/cpuinfo MNBD: https://gzhls.at/blob/ldb/0/b/4/1/700cafec77419c2d7705f376c974b8d0ff72.pdf CPU: http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0198e/index.html Note the board here appears to be an 80pin variant of the 152pin AK3918; similar to this one: https://www.anyka.com/en/productInfo.aspx?id=109 or here: https://www.cnx-software.com/2014/11/13/linux-based-bpi-d1-hd-camera-module-features-anyka-ak3918-arm9-processor/ They're generally very similar.

The device report it is running linux kernel 3.4.35 https://kernel.googlesource.com/pub/scm/linux/kernel/git/ralf/linux/+/linux-3.4.35 With Vulnerabilities: https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/version_id-160793/opmemc-1/Linux-Linux-Kernel-3.4.35.html and https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/version_id-160793/Linux-Linux-Kernel-3.4.35.html Also likely useful: http://images.news.f-secure.com/Web/FSecure/%7B43df9e0d-20a8-404a-86d0-70dcca00b6e5%7D_vulnerabilities-in-foscam-IP-cameras_report.pdf

The WeEye app used to connect those camera's by Hangzhou * (same place) is now called Meari on android.

I haven't had time to test any exploits, and it is unlikely I'll have much time to commit to it, but I really hope to see these busted.

As noted by @captaintofuburger https://medium.com/@lucasteske/reverse-engineering-cheap-chinese-vrcam-protocol-515c37a9c954 I wouldn't be surprised if we find much of JUAN's code on this identical AK3918 chip: http://www.juancctv.com/DownLoad.asp?seachkey=AK3918 We may be able to use their current firmware against them as well.

I often find alot of these chinese device exploits to be pretty universal across brands ;) We may find existing exploits from other similar applications, or a new method AK3918E2_C_rtsp_on.zip Here is another RTSP ON firmware fix I've found for another AK3918 chipset (Chinese V380 camera), on quick glance, it also appears to contain the same SOUP (SOAP+JSON) style syntax. Maybe we can gather some insight, or borrow from it to get ours working ;)

Notes for the 1080P variant. I have read that it is using the 3518 chipset here: https://cdn.hackaday.io/files/19356828127104/Hi3518%20DataSheet.pdf

Hopefully this helps someone identify an attack vector. GOOD LUCK.

norbeta commented 4 years ago

Hi all and thanks for all the effort coming this far.

I've been fiddling around with /proc, and what I've been most interested in is what ports that are actually open.

http://camera/proc/net/tcp

sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode 0: 00000000:1A0C 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 1245 1 c1868580 100 0 0 10 0 1: 00000000:0050 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 0 1105 1 c1868000 100 0 0 10 0 This translates to the only two listening TCP ports, which is 0.0.0.0:6668 and 0.0.0.0:80.

However, checking UDP as well shows me some ports that got my attention:

http://camera/proc/net/udp

sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode ref pointer drops 50: B000A8C0:C9D5 00000000:0000 07 00000000:00003E80 00:00000000 00000000 0 0 1271 2 c2293400 0 51: 00000000:73D6 00000000:0000 07 00000000:00000000 00:00000000 00000000 0 0 94476 2 c1d3c000 0 126: 0100007F:E421 0100007F:AF40 01 00000000:00000000 00:00000000 00000000 0 0 1104 2 c2292f00 0 157: 0100007F:AF40 0100007F:E421 01 00000000:00000000 00:00000000 00000000 0 0 1103 2 c2292c80 0 201: 00000000:7D6C 00000000:0000 07 00000000:00000000 00:00000000 00000000 0 0 94477 2 c1d3c280 0 211: 00000000:0E76 00000000:0000 07 00000000:00000000 00:00000000 00000000 0 0 1083 2 c2292780 0 212: 00000000:0E77 00000000:0000 07 00000000:00000000 00:00000000 00000000 0 0 1084 2 c2292a00 0

Line by line, this translates to: 1: : 51669. NMAP is unable to detect something here. 2: 0.0.0.0:29654. Random port opened when looking at the livefeed in the app. NMAP is unable to detect something here. 3 & 4: 127.0.0.1:58401 and 127.0.0.1:44846. Most likely two programs talking to each other. 5: 0.0.0.0: 32108. NMAP unable to detect something here. 6 & 7: 0.0.0.0: 3702 and 0.0.0.0:3703. NMAP shows tcpwrapped on these ports.

My camera is a Nedis Smart Life WIFICO20CWT, 1080p Pan/Tilt outdoor camera. Unfortunately this don't have an ejectable SD-card, so I'm unable to try the .ini-file hack.

Jordan-Jarvis commented 4 years ago

I uploaded the latest firmware. I saw it has been updated a few times on the camera so I decided to provide the latest firmware image.

I don't know if it helps, but I think it is always good to stay up to date.

https://github.com/da-ha3ker/Merkury-Smart_cam-720p-work/blob/master/merkury%20smart%20cam%20latest%20dump.bin

norbeta commented 4 years ago

Thanks, @da-ha3ker - I will have a look in it to see if there's any particular differences. I don't have the 720p camera though, I have the 1080p outdoor pan/tilt-camera which is running a firmware with the 4.9.37 kernel. You don't happen to have access to that firmware file somewhere?

The "Nedis" camera that I have is supposed to fix these firmware updates by itself, so no joy finding it on the website.

The software says MCU firmware 2.9.0.

Jordan-Jarvis commented 4 years ago

@norbeta I am sorry but I do not. I used a ch341a firmware programmer and reader with a clip onto the memory chip of my camera to get the dump I just uploaded, if you want one it is about 10$ on ebay. If I come across the 1080p one with pan and tilt I will try to get a firmware dump though.

cbytestech commented 4 years ago

ok so out of all, the only thing I haven't been able to try is @captaintofuburger "I have RTSP. No hardware hacking needed.

I was looking at the AK3918 docs, which is the SoC running on my camera. I figured there would still be underlying features/code that was disabled. There is.

Format a microsd card to fat32. (I used a 2gb one fwiw, was not SDHC SDXC etc). Make a file called "ceshi.ini" in the root of the SD card. Add this to the file: `[CONST_PARAM]

rtsp=1`

Boot up, and you will find RTSP is now open on 8554. I can snag a stream off rtsp://ip:8554/live/ch00_1 with no creds. This is similar to the method I found here:

https://medium.com/@lucasteske/reverse-engineering-cheap-chinese-vrcam-protocol-515c37a9c954

I just took a shot in the dark an hoped there wouldn't be any creds, but it looks like it is possible to query everything off the camera outside of the tuya ecosystem." -Nicholas J. Hess

cbytestech commented 4 years ago

Specs "deviceName": "059110444", "serialno": "059110444", "sn": "pp01030561c704068726", "licenseUsed": 1, "licenseId": "pp01030561c704068726", "p2p_uuid": "v2-0591104440000111A", "factory_code": 0, "factory_code_str": "", "model": "Mini 7C", "ip": "192.168.1.103", "mask": "255.255.255.0", "gw": "192.63.1.254", "mac": "7c:a7:b0:8a:f9:d9", "interface": "wlan0", "version": "2.7.3"

No luck so far, but the work done so far has gotten us farther than we were. so thank you to everyone!

cbytestech commented 4 years ago

After trying the ceshi seq specified...tried opening stream in chrome, nothing. this is from VLC live555 error: Failed to connect with rtsp://192.63.1.103:554/cam/realmonitor?channel=1&subtype=1 main error: connection failed: Connection refused by peer satip error:Failed to connect to RTSP server 192.63.1.103:554 main error: connection failed: Connection refused by peer access_realrtsp error: cannot connect to 192.63.1.103:554 live555 error: Failed to connect with rtsp://192.63.1.103:8554/live/ch00_1 main error: connection failed: Connection refused by peer satip error: Failed to connect to RTSP server 192.63.1.103:8554 main error: connection failed: Connection refused by peer access_realrtsp error: cannot connect to 192.63.1.103:8554

nickmeuir commented 4 years ago

I was able to make progress with a local custom app and the protocol. I'll try to post more when I get home tonight!

cbytestech commented 4 years ago

AWESOME!! -Nicholas J. Hess

On Thu, May 7, 2020 at 11:44 AM nickmeuir notifications@github.com wrote:

I was able to make progress with a local custom app and the protocol. I'll try to post more when I get home tonight!

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/AMoo-Miki/homebridge-tuya-lan/issues/4#issuecomment-625334551, or unsubscribe https://github.com/notifications/unsubscribe-auth/AFZMEGV3D7GY2OUW6C3NNVTRQLJNHANCNFSM4GMY7FQA .

ausced commented 4 years ago

@nickmeuir I'd be really curious to check out what you got! Could you upload it?

dreimer1986 commented 4 years ago

I have a funny camera too... I bought it as a Zeetopin .... whatever camera. Looking more closely we see a Meari Speed 5S. I have the same fun with slightly reduced features, like no Web config and only useable with a home calling app for a home calling camera... Favorite servers are: apis-eu-frankfurt.meari.com.cn (1850 connects a day) and p2pec-eu-paris.meari.com.cn (1250 connects a day). Anyways. Nomally you cannot do ANYTHING on the http side, and almost ANYTHING causes a login window. I tried all kinds of passwords and all kinds of proc/ etcetc links above and the funny thing is, sooner or later... it replies. Not for long, but it replies then. I decided to throw ALL links you already pasted above into it and d/l all I can get. The results are in the zip below. Maybe someone finds something useful here. I'd like to have some access it it, not necessarily root console, but some settings by http would be cool and some less calling home too ^^ Any idea where the httpd passwords might be? Any other nice stuff I missed?

mearifun.zip

b1ndm4n commented 4 years ago

are these cameras kickin our ass or what lol

ausced commented 4 years ago

I got one of those Ch341a eeprom programmer/reader and also dumped the memory. So far all I tried to do was to edit the bytes in a string that was written something like if I remember PPSDEBUG=off and changed it to PPSDEBUG=on but as expected after written the camera didn't boot and the red light stayed on, possibly because of a checksum validation upon start. Now interestingly enough, after flashing back the original dump, the camera does not work and the red light is flashing slowly. I'll try flashing it again and if it persists, I'll try using a spare esp8266 that I have laying around to write to the eeprom.

Edit: the light isn't blinking normally, it stays on for about 3 seconds and turns off for a fraction of a second. I think the device might be bootlooping as the light on the Ch341a board is flashing at the same time it turns back on.

Mrdindon commented 4 years ago

So I also got one of these and was able to attach to the console using a usb-to-ttl device.... I get a login prompt only once the device was paired to the network using the mobile app... I tried root/ad2c6d47 but that doesn't work.

here is the console boot log.... Do you have any idea what can be done to log in / enable rtsp ?

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2020.06.01 17:25:09 =~=~=~=~=~=~=~=~=~=~=~= U-Boot 2014.01-v1.2 (Nov 29 2019 - 20:40:59)Board: IPCAM RTS3903 CPU: 500M :rx5281 prid=0xdc02force spi nor modeDRAM: 64 MiB @ 1066 MHzSkipping flash_initFlash: 0 Bytesflash status is 0, 0, 0SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiBUsing default environmentIn: serialOut: serialErr: serialMMC: rtsmmc: 0flash status is 0, 0, 0SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiBKERNEL & DRV IS OKUSER IS OKmissing target file or read failedtuya verify failedboot kernelflash status is 0, 0, 0SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiBSF: 1507328 bytes @ 0x100000 Read: OK## Booting kernel from Legacy Image at 80100000 ...get header OKimage_get_kernel check hcrcimage_get_kernel print contents Image Name: linux_3.10 Created: 2019-05-11 8:41:43 UTC Image Type: MIPS Linux Kernel Image (uncompressed) Data Size: 1349581 Bytes = 1.3 MiB Load Address: 80401510 Entry Point: 80401510 Verifying Checksum ... OK Loading Kernel Image ... OKStarting kernel ...Linux version 3.10.27 (wenhe@embed) (gcc version 4.8.5 20150209 (prerelease) (Realtek RSDK-4.8.5p1 Build 2521) ) #2 PREEMPT Sat May 11 15:40:25 CST 2019 prom cpufreq = 500000000 prom memsize = 67108864 hw_ver: 0x2, hw_rev: 0x1, isp_ver: 0x1 prom eth mac = 00:00:00:00:00:00 bootconsole [early0] enabled CPU revision is: 0000dc02 FPU revision is: 01730001 Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Reserved contiguous memory at 0x423000(0x1618000) Zone ranges: Normal [mem 0x00000000-0x03ffffff] Movable zone start for each node Early memory node ranges node 0: [mem 0x00000000-0x03ffffff] icache: 32kB/32B, dcache: 16kB/32B, scache: 0kB/0B Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS1,57600 root=/dev/mtdblock2 rts_hconf.hconf_mtd_idx=1 rts-quadspi.channels=dual mtdparts=m25p80:8192k@0(global),128k@0k(boot),896k@128k(rootfs),1472k@1024k(kernel),704k@2496k(drv),2304k@3200k(user),2304k@5504k(backup),320k@7808k(mtd),64k@8128k(factory) PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 38072k/65536k available (3321k kernel code, 27464k reserved, 581k data, 192k init, 0k highmem) SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 Preemptible hierarchical RCU implementation. NR_IRQS:57 Calibrating delay loop... 497.66 BogoMIPS (lpj=995328) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 pinctrl core: initialized pinctrl subsystem NET: Registered protocol family 16 Init force reset registers rtsxb2 registered with IRQs INFO: initializing ISP memory ... INFO: initializing ISP device ... ISP camera platform devices added INFO: initializing SD controller ... INFO: initializing snd device ... snd resvd mem size : 1048576 INFO: initializing USB host ... INFO: initializing spi host ...0 spi platform id is ffffffff INFO: initializing I2C master ... INFO: initializing DMA controller ... INFO: initializing pinctrl device ... pinctrl_platform rts3903-pinctrl: rtspc registered with IRQs INFO: initializing ethernet devices ... INFO: initializing USB phy ... INFO: initializing watchdog controller ... INFO: initializing crypto device ... INFO: initializing cpu dvfs device ... bio: create slab at 0 rts_dmac rts3903-dmac: DesignWare DMA Controller, 4 channels INFO: realtek DMA engine inited usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb usbphy-platform usbphy-platform: Initialized Realtek IPCam USB Phy module Linux video capture interface: v2.00 Advanced Linux Sound Architecture Driver Initialized. NET: Registered protocol family 2 TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP: reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 RPC: Registered named UNIX socket transport module. RPC: Registered udp transport module. RPC: Registered tcp transport module. RPC: Registered tcp NFSv4.1 backchannel transport module. squashfs: version 4.0 (2009/01/31) Phillip Lougher NFS: Registering the id_resolver key type Key type id_resolver registered Key type id_legacy registered jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. msgmni has been set to 74 NET: Registered protocol family 38 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) io scheduler noop registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x18810000 (irq = 6) is a 16550A console [ttyS1] enabled, bootconsole disabled console [ttyS1] enabled, bootconsole disabled serial8250: ttyS1 at MMIO 0x18810100 (irq = 6) is a 16550A serial8250: ttyS2 at MMIO 0x18810200 (irq = 6) is a 16550A dbg_iomem initialized! rts-quadspi rts3903-qspi: force to set channels from quad mode to dual mode rts-quadspi rts3903-qspi: request 60000000 Hz, force to set 41666666 Hz rts-quadspi rts3903-qspi: found gd25q64c, expected mx25l12835f rts-quadspi rts3903-qspi: gd25q64c (8192 Kbytes) 9 cmdlinepart partitions found on MTD device m25p80 Creating 9 MTD partitions on "m25p80": 0x000000000000-0x000000800000 : "global" 0x000000000000-0x000000020000 : "boot" 0x000000020000-0x000000100000 : "rootfs" 0x000000100000-0x000000270000 : "kernel" 0x000000270000-0x000000320000 : "drv" 0x000000320000-0x000000560000 : "user" 0x000000560000-0x0000007a0000 : "backup" 0x0000007a0000-0x0000007f0000 : "mtd" 0x0000007f0000-0x000000800000 : "factory" rts-quadspi rts3903-qspi: Realtek QSPI Controller at 0x18030000 (irq 5) rtl8168 Gigabit Ethernet driver 8.038.00-NAPI loaded rtl8168 rts3903-r8168 (unregistered net_device): Get invalid MAC address from flash! eth%d: 0xb8400000, 00:00:00:00:00:00, IRQ 10 ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver ehci-rts: ehci-rts platform driver ehci-platform ehci-platform: EHCI Host Controller ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 ehci-platform ehci-platform: irq 11, io mem 0x18100000 ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00 usb usb1: New USB device found, idVendor=1d6b, idProduct=0002 usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb1: Product: EHCI Host Controller usb usb1: Manufacturer: Linux 3.10.27 ehci_hcd usb usb1: SerialNumber: ehci-platform hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver ohci-platform ohci-platform: Generic Platform OHCI Controller ohci-platform ohci-platform: new USB bus registered, assigned bus number 2 ohci-platform ohci-platform: irq 11, io mem 0x18180000 usb usb2: New USB device found, idVendor=1d6b, idProduct=0001 usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb2: Product: Generic Platform OHCI Controller usb usb2: Manufacturer: Linux 3.10.27 ohci_hcd usb usb2: SerialNumber: ohci-platform hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected i2c /dev entries driver Stopped watchdog timer timer margin: 8 sec TCP: cubic registered NET: Registered protocol family 17 Key type dns_resolver registered mtd1 name is boot hconf init failed ALSA device list: No soundcards found. VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 192K (803e0000 - 80410000) usb 1-1: new high-speed USB device number 2 using ehci-platform usb 1-1: New USB device found, idVendor=0bda, idProduct=f179 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: 802.11n usb 1-1: Manufacturer: Realtek usb 1-1: SerialNumber: 68572DD0266B Sat Oct 24 10:24:00 UTC 2015

| | | | | |
| | _ | |_ | |_ | | / | ' \/ | / \ '| | || () | |) __ \ || / |
|_____/|_._/|/____||

ntpclient: can't load library 'libsysconf.so' jffs2: notice: (268) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. rlx snd internal codec init soc-audio soc-audio.0.auto: ASoC: machine RLX_INTERN_CARD should use snd_soc_register_card() soc-audio soc-audio.0.auto: rlx-codec-digital <-> pcm-platform mapping ok soc-audio soc-audio.0.auto: rlx-codec-analog <-> pcm-platform mapping ok RTW: module init start RTW: rtl8188fu v5.3.0.1_28034.20180525 RTW: build time: May 11 2019 15:41:23 RTW: HW EFUSE RTW: 0x000: 29 81 00 FC 0B 00 00 00 00 0C 04 4C 10 07 00 00
RTW: 0x010: 21 23 25 27 29 2B 2A 2C 2E 30 32 02 FF FF FF FF
RTW: 0x020: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x030: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x040: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x050: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x060: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x070: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x0A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x0B0: FF FF FF FF FF FF FF FF 20 29 21 00 00 00 00 FF
RTW: 0x0C0: FF 12 00 10 00 FF 00 FF 00 00 FF FF FF FF FF FF
RTW: 0x0D0: DA 0B 79 F1 42 66 40 68 57 2D D0 26 6B 09 03 52
RTW: 0x0E0: 65 61 6C 74 65 6B 09 03 38 30 32 2E 31 31 6E 00
RTW: 0x0F0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x130: C1 B6 FF FF FF FF FF FF FF FF 00 11 FF FF FF FF
RTW: 0x140: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x150: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1B0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1C0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1D0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1E0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1F0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: hal_com_config_channel_plan chplan:0x20 RTW: rtw_regsty_chk_target_tx_power_valid return _FALSE for band:0, path:0, rs:0, t:-1 RTW: rtw_ndev_init(wlan0) if1 mac_addr=68:57:2d:d0:26:6b RTW: rtw_ndev_init(wlan1) if2 mac_addr=6a:57:2d:d0:26:6b usbcore: registered new interface driver rtl8188fu RTW: module init ret=0 rtscam:isp resvd mem addr : 0x00523000, size : 0x1518000 rtscam:rtscam_mem_init v:0xa0523000 p:0x00523000 s:0x00001518 rtscam:rtscam_lock_init rtscam:rtscam_soc_probe rtscam:rtscam_hx280_probe rtscam:hx280enc:HW at base <0x18060000> with ID <0x48317011> rtscam:rtscam_jpgenc_probe rtscam:rtscam_osd2_probe rtscam:rtstream_init (none) login: status: active CC: excute rts3903 platform script..rtscam:begin to load fw from isp.fw . rtscam:Load firmware size : 131024. rtscam:Found ISP 1.011 device rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1477, streamnum: 4, 4 rtscam:video device registered rtscam:rts3903-isp initialized begin_, action: 0Started watchdog timer Started watchdog timer mmc0: new high speed SDHC card at address e624 mmcblk0: mmc0:e624 SU04G 3.69 GiB mmcblk0: p1 /dev/mmcblk0 /dev/mmcblk0p1 /dev/mmcblk0 /dev/mmcblk0p1 FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. insmod: can't insert '/drv/modules/8188fu.ko': File exists [2015-10-24 10:24:11.263 tid(508) main.c main(69) Debug] begin__ [2015-10-24 10:24:11.263 tid(508) tycam_devcom_inf.c tycam_devcomstart(221) Debug] begin [2015-10-24 10:24:11.263 tid(508) tycam_devcom_inf.c tycam_devcom_start(227) Debug] dev abi md[1] md_track[0] pir[0] ptz[0] isp_ver[] [2015-10-24 10:24:11.264 tid(508) ty_wifi.c ty_hwl_wifi_init(653) Debug] bigin_ [2015-10-24 10:24:11.264 tid(508) ty_wifi.c ty_hwl_wifiinit(667) Debug] end [2015-10-24 10:24:11.370 tid(508) tuya_ipc_mgr_utils.c TUYA_IPC_SDK_INIT(152) Debug] SDK Version:

< TUYA IOT SDK V:4.1.1 BS:30.01_PT:2.2_LAN:3.3_CAD:1.0.1_CD:1.0.0 >

IPC DEFS < ENABLE_ECHO_SHOW:1 ENABLE_CHROMECAST:1 ENABLE_CLOUD_STORAGE:1 >'

< BUILD AT:2020_03_05_15_41_01 BY dongxk FOR linux_wifi AT rts3903 >

[2015-10-24 10:24:11.693 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:0 Enable:1 [2015-10-24 10:24:11.693 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(90) Debug] video_bitrate 1536, video_fps 20 [2015-10-24 10:24:11.705 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(98) Debug] init ring buffer success. channel:0 [2015-10-24 10:24:11.705 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:1 Enable:1 [2015-10-24 10:24:11.705 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(90) Debug] video_bitrate 512, video_fps 20 [2015-10-24 10:24:11.709 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(98) Debug] init ring buffer success. channel:1 [2015-10-24 10:24:11.710 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:2 Enable:0 [2015-10-24 10:24:11.710 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:3 Enable:0 [2015-10-24 10:24:11.710 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:4 Enable:0 [2015-10-24 10:24:11.710 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:5 Enable:0 [2015-10-24 10:24:11.711 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:6 Enable:0 [2015-10-24 10:24:11.711 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:7 Enable:0 [2015-10-24 10:24:11.711 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:8 Enable:0 [2015-10-24 10:24:11.711 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:9 Enable:1 [2015-10-24 10:24:11.712 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(84) Debug] audio_sample 8000, audio_databits 16, audio_fps 25 [2015-10-24 10:24:11.713 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(98) Debug] init ring buffer success. channel:9 [2015-10-24 10:24:11.713 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:10 Enable:1 [2015-10-24 10:24:11.714 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(98) Debug] init ring buffer success. channel:10 [2015-10-24 10:24:11.715 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:11 Enable:0 [2015-10-24 10:24:11.715 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:12 Enable:0 [2015-10-24 10:24:11.715 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:13 Enable:0 [2015-10-24 10:24:11.715 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:14 Enable:0 [2015-10-24 10:24:11.716 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:15 Enable:0 [01-01 18:12:15-- TUYA Debug][tuya_iot_com_api.c:94] init fs. Path: /etc/tuya/

[01-01 18:12:15-- TUYA Info][kv_storge.c:43] Init Kvs With File:/etc/tuya/

[01-01 18:12:15-- TUYA Debug][simplekv.c:916] path:/etc/tuya/

[01-01 18:12:15-- TUYA Debug][simplekv.c:952] get encrypt_key[£—¢US¾ñüùykRéâ]

[01-01 18:12:15-- TUYA Debug][simplekv.c:983] both file exist

[01-01 18:12:15-- TUYA Debug][simplekv.c:280] size in: 0 and final: 28700 And mag_rec_max: 512

[01-01 18:12:15-- TUYA Debug][simplekv.c:295] create data hd success

[01-01 18:12:15-- TUYA Debug][simplekv.c:1026] read from normal file

[01-01 18:12:15-- TUYA Debug][simplekv.c:736] curr db is V2. No need to upgrade

[01-01 18:12:15-- TUYA Debug][simplekv.c:526] head check success

[01-01 18:12:15-- TUYA Debug][simplekv.c:629] read and check head success

[01-01 18:12:15-- TUYA Debug][simplekv.c:1041] read from normal file success

[01-01 18:12:15-- TUYA Debug][uni_thread.c:161] Init Thread Del Mgr

[01-01 18:12:15-- TUYA Debug][simplekv.c:1079] init from normal file success.

[01-01 18:12:15-- TUYA Debug][sys_timer.c:63] system timer has been inited

[01-01 18:12:15-- TUYA Debug][sys_timer.c:63] system timer has been inited

[01-01 18:12:15-- TUYA Debug][sys_timer.c:63] system timer has been inited

[01-01 18:12:15-- TUYA Debug][online_log_serv.c:340] read from uf. max:0 first:0 last:0

[01-01 18:12:15-- TUYA Debug][online_log_serv.c:581] log serv init success

[01-01 18:12:15-- TUYA Debug][ty_work_queue.c:22] init work queue. stack size:2560 pro:3 num:2

[01-01 18:12:15-- TUYA Debug][ty_work_queue.c:27] ty work queue create success

[01-01 18:12:15-- TUYA Debug][uni_thread.c:220] Thread:sys_timer Exec Start. Set to Running Status

[01-01 18:12:15-- TUYA Debug][sys_timer.c:34] system timer process run.

tycam_kv_db_init start [01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:basic_conf isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:0 basic_conf

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:basic_conf find value.Len:432

tycam_kv_db_init done [01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:gw_bi isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:1 gw_bi

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:gw_bi find value.Len:160

[01-01 18:12:15-- TUYA Debug][tuya_ws_db.c:490] gw base read success

[01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:gw_bi isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:1 gw_bi

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:gw_bi find value.Len:160

[01-01 18:12:15-- TUYA Debug][tuya_ws_db.c:490] gw base read success

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2190] serial_no:(null)

[2015-10-24 10:24:12.391 tid(508) ty_wifi.c hwl_wf_set_country_code(580) Debug] Set Country Code:CN

[01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:gw_wsm isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:2 gw_wsm

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:gw_wsm find value.Len:128

[01-01 18:12:15-- TUYA Debug][tuya_ws_db.c:610] gw_wsm read success

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2219] gw_cntl.gw_wsm.stat:0

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2222] gw_cntl.gw_wsm.nc_tp:1

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2223] gw_cntl.gw_wsm.md:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:gw_di isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:3 gw_di

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:gw_di find value.Len:304

[01-01 18:12:15-- TUYA Debug][tuya_ws_db.c:756] gw_di read success

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2255] gw_cntl.gw_if.abi:0 input:0

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2256] gw_cntl.gw_if.product_key:jmj7mcderhdweyy4, input:jmj7mcderhdweyy4

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2257] gw_cntl.gw_if.tp:0, input:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:gw_ai isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:4 gw_ai

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:gw_ai find value.Len:176

[01-01 18:12:15-- TUYA Debug][tuya_ws_db.c:851] gw_ai read success

[01-01 18:12:15-- TUYA Debug][gw_intf.c:2415] enter success_proc

[01-01 18:12:15-- TUYA Debug][tuya_iot_wifi_api.c:358] register wifi network monitor. interval:5

[01-01 18:12:15-- TUYA Debug][uni_thread.c:220] Thread:wk_th-1 Exec Start. Set to Running Status

[01-01 18:12:15-- TUYA Debug][uni_thread.c:220] Thread:wk_th-0 Exec Start. Set to Running Status

[01-01 18:12:15-- TUYA Debug][uni_thread.c:220] Thread:cmmod Exec Start. Set to Running Status

[2015-10-24 10:24:12.393 tid(562) ty_wifi.c hwl_wf_station_disconnect(433) Debug] trace_ [2015-10-24 10:24:12.394 tid(508) ty_ipc_stream.c TUYA_APP_Enable_EchoShowChromecast(135) Debug] begin [2015-10-24 10:24:12.602] tuya_ipc_echoshow.c tuya_ipc_echoshow_init(821) begin_, video channel: 1 [2015-10-24 10:24:12.602] tuya_ipc_echoshow.c tuya_ipc_echoshowinit(865) end, video step(4500), audio step(2) [2015-10-24 10:24:12.602] tuya_ipc_chromecast.c tuya_ipc_chromecast_init(5RTW: wlan0- hw port(0) mac_addr =68:57:2d:d0:26:6b 69) video: chl(1), fps(20) audioRTW: wlan1- hw port(1) mac_addr =6a:57:2d:d0:26:6b : chl(10), fps(8) [01-01 18:12:15-- TUYA Debug][tuya_ipc_webrtc.c:364] begin___

[01-01 18:12:15-- TUYA Debug][tuya_ipc_webrtc.c:370] end___

[2015-10-24 10:24:12.603 tid(508) ty_ipc_stream.c TUYA_APP_Enable_EchoShow_Chromecast(185) Debug] end_ { "ptz": { "pan_cur": 0, "pan_total": 5440, "tilt_cur": 0, "tilt_total": 1138, "patrol": { "on": 0, "mode": 0, "tmode": 0, "start_time": "", "end_time": "" }, "presets": { "num": 0 }, "link_presets": { "link_num": 4, "point": [{ "seq": 0, "pan": 0, "tilt": 0, "zoom": 0 }, { "seq": 0, "pan": 0, "tilt": 0, "zoom": 0 }, { "seq": 0, "pan": 0, "tilt": 0, "zoom": 0 }, { "seq": 0, "pan": 0, "tilt": 0, "zoom": 0 }] } }, "track_enable": 0, "light": { "pir_status": 7, "pir_sensitivity": 1, "light_mode": 0, "light_duration": 60, "light_enable": 0 }, "pir_cfg": { "pir_status": 0, "pir_sensitivity": 0, "pir_num": 0 } } num: 0 [2015-10-24 10:24:12.608 tid(508) tycam_rts_device.c tycam_dev_streamstart(129) Debug] begin, product name [sc002wa2v5] version[1.1.3] build in Mar 6 2020 14:00:16 [2015-10-24 10:24:13.288 tid(508) tycam_rts_video.c tycam_rts_video_start(639) Debug] begin_ [2015-10-24 10:24:13.288 tid(508) tycam_rts_video.c tycam_rts_codec_spec_value(108) Debug] qp[35]mbrc_en[1] qp_range[2]delta[-4] mainQP_max_min[51][10-1572864] mainBT_max_min[524288][51-20] subQP_max_min[524288][131072-8788396] subBT_max_min[9612256][2000915364-1999598024] [2015-10-24 10:24:13.288 tid(508) ty_thread.c ty_threadcreate(43) Debug] begin [2015-10-24 10:24:13.159 tid(562) ty_wifi.c hwl_wf_wk_mode_set(304) Debug] WIFI Set Mode 2

[2015-10-24 10:24:13.289 tid(562) ty_wifi.c hwl_wf_all_ap_scan(173) Debug] begin_ [2015-10-24 10:24:13.290 tid(508) ty_thread.c ty_thread_create(73) Debug] end_, old thd name: tycam, create thd (vcap0) success, detach(0)! [2015-10-24 10:24:13.290 tid(508) ty_thread.c ty_threadcreate(43) Debug] begin [2015-10-24 10:24:13.291 tid(508) ty_thread.c ty_thread_create(73) Debug] end_, old thd name: tycam, create thd (vcap1) success, detach(0)! [2015-10-24 10:24:13.291 tid(508) tycam_rts_video.c tycam_rts_videostart(676) Debug] end [2015-10-24 10:24:13.291 tid(508) tycam_rts_audio.c tycam_rts_audio_start(255) Debug] begin_ [2015-10-24 10:24:13.291 tid(508) ty_thread.c ty_threadcreate(43) Debug] begin [2015-10-24 10:24:13.292 tid(508) ty_thread.c ty_thread_create(73) Debug] end_, old thd name: tycam, create thd (acap) success, detach(0)! [2015-10-24 10:24:13.292 tid(508) tycam_rts_audio.c tycam_rts_audiostart(270) Debug] end [2015-10-24 10:24:13.292 tid(508) tycam_rts_panel.c tycam_rts_panel_start(314) Debug] begin_ [2015-10-24 10:24:13.293 tid(596) ty_thread.c ty_threadproc(21) Debug] begin, handle: 0xaab0b8, context: 0xa12e90 [2015-10-24 10:24:13.294 tid(596) tycam_rts_audio.c tycam_rts_audio_proc(97) Debug] begin_ [2015-10-24 10:24:13.293 tid(595) ty_thread.c ty_threadproc(21) Debug] begin, handle: 0xaaafe0, context: 0xa12f5c [2015-10-24 10:24:13.298 tid(595) tycam_rts_video.c tycam_rts_video_proc(513) Debug] begin___ [2015-10-24 10:24:13.298 tid(595) tycam_rts_video.c tycam_rts_video_moduleinit(471) Debug] begin [2015-10-24 10:24:13.299 tid(595) tycam_rts_video.c tycam_rts_create_channels(330) Debug] begin_, id(1) width(640) height(360) [2015-10-24 10:24:13.300 tid(595) tycam_rts_video.c tycam_rts_wait_for_isp_load(69) Debug] check dev node return value: 0, cnt: 5 [2015-10-24 10:24:13.293 tid(508) tycam_rts_panel_universal.c ty_rts_panel_universal_get_func(386) Debug] begin_ [2015-10-24 10:24:13.293 tid(594) ty_thread.c ty_threadproc(21) Debug] begin, handle: 0xaaaf08, context: 0xa12f34 [2015-10-24 10:24:13.316 tid(594) tycam_rts_video.c tycam_rts_video_proc(513) Debug] begin___ [2015-10-24 10:24:13.317 tid(594) tycam_rts_video.c tycam_rts_video_module_init(471) Debug] [2015-10-24 10:24:13.302 tid(508) tycam_rts_panel_universal.c ty_rts_panel_universal_getfunc(390) Debug] end [2015-10-24 10:24:13.329 tid(508) tycam_rts_panel_universal.c ty_rts_panel_universal_start(278) Debug] begin_ [2015-10-24 10:24:13.330 tid(508) tycam_rts_gpio.c rts_initgpio(31) Debug] pin(11), direction(1), value(0) begin [2015-10-24 10:24:13.331 tid(594) tycam_rts_video.c tycam_rts_create_channels(330) Debug] begin_, id(0) width(1920) height(1080) [2015-10-24 10:24:13.331 tid(594) tycam_rts_video.c tycam_rts_wait_for_isp_load(69) Debug] check dev node return value: 0, cnt: 5 [2015-10-24 10:24:13.333 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(6), direction(1), value(1) [2015-10-24 10:24:13.338 tid(508) tycam_rts_panel_universal.c ty_rts_panel_universalstart(299) Debug] end [2015-10-24 10:24:13.338 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(19), direction(0), value(0) [2015-10-24 10:24:13.342 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(20), direction(1), value(1) [2015-10-24 10:24:13.346 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(21), direction(1), value(1) [2015-10-24 10:24:13.350 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(17), direction(1), value(0) [2015-10-24 10:24:13.706 tid(596) tycam_rts_audio.c tycam_rts_audio_proc(123) Debug] audio capture chn: 100, aec chn : 101 Table address = 0 8000 AECNS is created sucessfully [2015-10-24 10:24:13.708 tid(595) tycam_rts_video.c tycam_rts_set_h264_attr(130) Debug] h264_no[10]bitrate_mode[2] bitRate[262144]max-min[20971520-16384] qp[35][51-10] [2015-10-24 10:24:13.711 tid(594) tycam_rts_video.c tycam_rts_set_h264_attr(130) Debug] h264_no[11]bitrate_mode[2] bitRate[1048576]max-min[20971520-16384] qp[35][51-10] [2015-10-24 10:24:14.19 tid(595) tycam_rts_video.c tycam_rts_create_jpeg_channel(196) Debug] isp chn: 1, jpg chn : 20 [2015-10-24 10:24:14.20 tid(595) tycam_rts_video.c tycam_rts_create_jpeg_channel(214) Debug] ppctrl normal_compress_rate 0 [2015-10-24 10:24:14.36 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(18), direction(1), value(0) [2015-10-24 10:24:14.42 tid(508) ty_thread.c ty_thread_create(43) Debug] begin_ [2015-10-24 10:24:14.42 tid(508) ty_thread.c ty_thread_create(73) Debug] end_, old thd name: tycam, create thd (panel) success, detach(0)! [2015-10-24 10:24:14.43 tid(508) tycam_rts_panel.c tycam_rts_panelstart(343) Debug] end [2015-10-24 10:24:14.43 tid(508) tycam_rts_light.c tycam_rts_floodlight_start(482) Debug] do nothing [2015-10-24 10:24:14.43 tid(508) tycam_rts_device.c tycam_dev_streamstart(165) Debug] end [2015-10-24 10:24:14.43 tid(508) tycam_rts_device.c tycam_dev_get_encrypt_func(421) Debug] register hardware encrypt function, support ecb/cbc mode! [2015-10-24 10:24:14.44 tid(508) tycam_rts_video.c tycam_video_flip(716) Debug] begin_ [2015-10-24 10:24:14.45 tid(623) ty_thread.c ty_thread_proc(21) Debug] begin_, handle: 0xacd398, context: 0xa13050 [2015-10-24 10:24:14.45 tid(623) tycam_rts_panel.c tycam_rts_panelproc(133) Debug] begin [2015-10-24 10:24:14.553 tid(508) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 21, value: 0 [2015-10-24 10:24:14.553 tid(508) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 1, min: 0, max: 1, step: 1, default: 0, current: 0 [2015-10-24 10:24:14.558 tid(594) tycam_rts_video.c tycam_rts_create_channels(438) Debug] end_, id: 0, h264 chnno: 11, isp chnno: 0 maxAncBytes: 256, maxOutBufBytes: 768, frameLength: 1024 [2015-10-24 10:24:14.567 tid(595) tycam_rts_video.c tycam_rts_createchannels(438) Debug] end, id: 1, h264 chnno: 10, isp chnno: 1 [2015-10-24 10:24:14.582 tid(508) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 22, value: 0 [2015-10-24 10:24:14.582 tid(508) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 1, min: 0, max: 1, step: 1, default: 0, current: 0 [2015-10-24 10:24:14.583 tid(508) tycam_rts_video.c tycam_videoflip(729) Debug] end, flip: 0, value: 0 [2015-10-24 10:24:14.583 tid(508) tycam_rts_panel_universal.c ty_rts_panel_universal_status(109) Debug] on_off: 1, state: 0 [2015-10-24 10:24:14.584 tid(508) tycam_devcom_inf.c tycam_devcom_start(281) Debug] end_ [2015-10-24 10:24:14.584 tid(508) tycam_video_detect.c tycam_motion_detect_trackinginit(251) Debug] begin [2015-10-24 10:24:14.584 tid(508) tycam_video_detect.c tycam_motion_detect_tracking_init(255) Debug] end_ [2015-10-24 10:24:14.584 tid(508) tycam_devcom_inf.c tycam_devcomloop(359) Debug] begin [2015-10-24 10:24:14.602 tid(594) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 46, value: 1 [2015-10-24 10:24:14.602 tid(594) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 0, min: 0, max: 1, step: 1, default: 0, current: 1 [2015-10-24 10:24:14.603 tid(594) tycam_rts_osd.c tycam_rts_osd_start(446) Debug] begin_, chn[0], width[1920], height[1080] [2015-10-24 10:24:14.603 tid(594) ty_thread.c ty_thread_create(43) Debug] begin_ [2015-10-24 10:24:14.603 tid(594) ty_thread.c ty_threadcreate(73) Debug] end, old thd name: vcap0, create thd (osd0) success, detach(0)! [2015-10-24 10:24:14.604 tid(594) tycam_rts_osd.c tycam_rts_osd_start(464) Debug] end___ [2015-10-24 10:24:14.604 tid(594) tycam_rts_video.c tycam_rts_video_moduleinit(487) Debug] end [2015-10-24 10:24:14.604 tid(595) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 46, value: 1 [2015-10-24 10:24:14.605 tid(628) ty_thread.c ty_thread_proc(21) Debug] begin_, handle: 0xb2d128, context: 0xa13240 [2015-10-24 10:24:14.607 tid(628) tRTW: nolinked power save enter ycam_rts_osd.c tycam_rts_osd_proc(333) Debug] begin___, width(32), height(64) [2015-10-24 10:24:14.609 tid(595) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 1, min: 0, max: 1, step: 1, default: 0, current: 1 [2015-10-24 10:24:14.610 tid(595) tycam_rts_osd.c tycam_rts_osdstart(446) Debug] begin, chn[1], width[640], height[360] [2015-10-24 10:24:14.610 tid(595) ty_thread.c ty_thread_create(43) Debug] begin_ [2015-10-24 10:24:14.610 tid(595) ty_thread.c ty_thread_create(73) Debug] end_, old thd name: vcap1, create thd (osd1) success, detach(0)! [2015-10-24 10:24:14.611 tid(595) tycam_rts_osd.c tycam_rts_osdstart(464) Debug] end [2015-10-24 10:24:14.611 tid(595) tycam_rts_video.c tycam_rts_video_moduleinit(487) Debug] end [2015-10-24 10:24:14.611 tid(629) ty_thread.c ty_thread_proc(21) Debug] begin_, handle: 0xb452f8, context: 0xa13260 [2015-10-24 10:24:14.612 tid(629) tycam_rts_osd.c tycam_rts_osdproc(333) Debug] begin, width(12), height(24) [2015-10-24 10:24:14.672 tid(629) tycam_rts_osd.c tycam_rts_osd_proc(363) Debug] osd = 30 [2015-10-24 10:24:14.675 tid(628) tycam_rts_osd.c tycam_rts_osd_proc(363) Debug] osd = 31 [2015-10-24 10:24:14.977 tid(629) tycam_rts_osd.c set_osd_enable(220) Error] set osd2 fail, ret = -21 [2015-10-24 10:24:14.988 tid(628) tycam_rts_osd.c set_osd_enable(220) Error] set osd2 fail, ret = -21 index:0 bssid:F8-7B-8C-7A-59-2D RSSI:0 SSID:VIDEOTRON0179_RE

index:1 bssid:F0-79-59-D5-EB-58 RSSI:48 SSID:

index:2 bssid:3C-17-10-2E-4E-2E RSSI:81 SSID:BELL844

[2015-10-24 10:24:15.2 tid(562) ty_wifi.c hwl_wf_all_ap_scan(201) Debug] end___ [01-01 18:12:18-- TUYA Debug][wf_nw_cfg.c:485] sta search all ap and num: 3

[01-01 18:12:18-- TUYA Debug][wf_nw_cfg.c:501] channel:06 bssid:f8-7b-8c-7a-59-2d ssid:VIDEOTRON0179_RE

[01-01 18:12:18-- TUYA Debug][wf_nw_cfg.c:501] channel:08 bssid:f0-79-59-d5-eb-58 ssid:

[01-01 18:12:18-- TUYA Debug][wf_nw_cfg.c:501] channel:11 bssid:3c-17-10-2e-4e-2e ssid:BELL844

killall: wpa_supplicant: no process killed RTW: wlan0- hw port(0) mac_addr =68:57:2d:d0:26:6b RTW: wlan1- hw port(1) mac_addr =6a:57:2d:d0:26:6b RTW: nolinked power save leave RTW: assoc success [2015-10-24 10:24:15.717 tid(562) ty_wifi.c hwl_wf_wk_mode_set(304) Debug] WIFI Set Mode 1

killall: wpa_supplicant: no process killed [2015-10-24 10:24:15.751 tid(562) ty_wifi.c hwl_wf_wk_mode_set(304) Debug] WIFI Set Mode 1

[2015-10-24 10:24:15.751 tid(562) ty_slink.c ty_slink_start(120) Debug] begin_ [2015-10-24 10:24:15.751 tid(562) ty_slink.c ty_slink_start(143) Debug] end___ [2015-10-24 10:24:15.752 tid(562) tycam_sniffer.c tycamsniffer(47) Debug] begin [2015-10-24 10:24:15.752 tid(562) tycam_rts_speaker.c tycam_rts_device wlan0 entered promiscuous mode speaker_play_file(546) Debug] begin_ [2015-10-24 10:24:15.752 tid(562) ty_thread.c ty_thread_create(43) Debug] begin_ [2015-10-24 10:24:15.753 tid(562) ty_thread.c ty_threadcreate(73) Debug] end, old thd name: cmmod, create thd (spk) success, detach(0)! [2015-10-24 10:24:15.754 tid(562) tycam_rts_speaker.c tycam_rts_speaker_playfile(595) Debug] end [2015-10-24 10:24:15.754 tid(562) tycam_rts_panel_universal.c ty_rts_panel_universal_status(109) Debug] on_off: 1, state: 3 [2015-10-24 10:24:15.754 tid(562) tycam_qrcode_proc.c tycam_qrcode_start(147) Debug] begin_ [2015-10-24 10:24:15.755 tid(562) tycam_qrcode_proc.c tycam_qrcodestart(168) Debug] end [2015-10-24 10:24:15.755 tid(562) tycam_sniffer.c tycam_sniffer(61) Debug] end_ [2015-10-24 10:24:15.756 tid(635) ty_thread.c ty_thread_proc(21) Debug] begin_, handle: 0xb44b78, context: 0xa12ddc [2015-10-24 10:24:15.756 tid(635) tycam_rts_speaker.c tycam_rts_speakerproc(446) Debug] begin unhandled chunk: fact, size: 4 unhandled chunk: LIST, size: 26 [2015-10-24 10:24:15.758 tid(634) ty_slink.c ty_slink_proc(80) Debug] begin___ [2015-10-24 10:24:15.759 tid(634) ty_slink.c ty_slink_proc(90) Debug] success: g_device: wlan0 [2015-10-24 10:24:15.758 tid(636) tycam_qrcode_proc.c tycam_qrcodeproc(40) Debug] begin [2015-10-24 10:24:15.759 tid(636) tycam_qrcode_proc.c tycam_qrcode_proc(50) Debug] thres = 128 scale_flag = 0 [2015-10-24 10:24:15.760 tid(636) tycam_rts_video_detect.c tycam_rts_init_chn(33) Debug] begin_ [2015-10-24 10:24:15.760 tid(636) tycam_rts_video_detect.c tycam_rts_initchn(64) Debug] end [2015-10-24 10:24:15.760 tid(636) tycam_qrcode_proc.c tycam_qrcode_proc(62) Debug] tycam_dev_init_chn OK [2015-10-24 10:24:15.761 tid(636) tycam_qrcode_proc.c tycam_qrcode_proc(66) Debug] yuv420sp_data 640 360 [2015-10-24 10:24:15.762 tid(635) tycam_rts_speaker.c rts_speaker_start_playback(80) Debug] rate = 8000, format bit = 16, channels = 1 sh: 3: unknown operand [2015-10-24 10:24:16.192 tid(635) tycam_rts_speaker.c rts_speaker_start_playback(209) Debug] speaker enable OK!!!chan:102 103 104 [2015-10-24 10:24:16.214 tid(635) tycam_rts_speaker.c tycam_rts_speaker_proc(483) Debug] duration(1000) data_size(8005) avg_bytes_per_sec(8000) [01-01 18:12:19-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 8 [01-01 18:12:19-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 11 [01-01 18:12:20-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 6 [2015-10-24 10:24:17.341 tid(635) tycam_rts_speaker.c tycam_rts_speaker_proc(528) Debug] end_, sleep_time(1), count(0) [2015-10-24 10:24:17.343 tid(635) ty_thread.c ty_threadproc(32) Debug] end, handle: 0xb44b78 [2015-10-24 10:24:17.369 tid(624) tycam_rts_panel.c tycam_rts_panel_night_mode(228) Debug] night status: 0 [2015-10-24 10:24:17.371 tid(624) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 39, value: 0 [2015-10-24 10:24:17.371 tid(624) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 369, min: 0, max: 1, step: 1, default: 0, current: 0 [2015-10-24 10:24:17.373 tid(624) tycam_rts_dn_switch.c update_fps(41) Debug] [sensor fps]0 -> 20 [01-01 18:12:20-- TUYA Debug][tuya_iot_wifi_api.c:340] wifi netstat changed to:1 -->>

################status is 1 [2015-10-24 10:24:17.402 tid(561) tuya_ipc_mgr_utils.c __IPC_APP_mqtt_status_change_cb(67) Debug] status changed to offline [01-01 18:12:20-- TUYA Debug][tuya_iot_wifi_api.c:343] wifi netstat changed to:1 <<-- [01-01 18:12:20-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 8 [2015-10-24 10:24:17.694 tid(624) tycam_rts_panel.c tycam_rts_panel_night_mode(228) Debug] night status: 0 [2015-10-24 10:24:17.698 tid(624) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 39, value: 0 [2015-10-24 10:24:17.698 tid(624) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 694, min: 0, max: 1, step: 1, default: 0, current: 0 [2015-10-24 10:24:17.700 tid(624) tycam_rts_dn_switch.c update_fps(41) Debug] [sensor fps]20 -> 20 [01-01 18:12:21-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 11 [01-01 18:12:21-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 6 [01-01 18:12:21-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 8 [01-01 18:12:22-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 11 [01-01 18:12:22-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 6 [01-01 18:12:23-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 8 [01-01 18:12:23-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 11 [01-01 18:12:24-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 6 [01-01 18:12:24-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 8 [01-01 18:12:24-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 11 [01-01 18:12:25-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 6 IMG_1134

Mrdindon commented 4 years ago

So I also got one of these and was able to attach to the console using a usb-to-ttl device.... I get a login prompt only once the device was paired to the network using the mobile app... I tried root/ad2c6d47 but that doesn't work.

here is the console boot log.... Do you have any idea what can be done to log in / enable rtsp ?

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2020.06.01 17:25:09 =~=~=~=~=~=~=~=~=~=~=~= U-Boot 2014.01-v1.2 (Nov 29 2019 - 20:40:59)Board: IPCAM RTS3903 CPU: 500M :rx5281 prid=0xdc02force spi nor modeDRAM: 64 MiB @ 1066 MHzSkipping flash_initFlash: 0 Bytesflash status is 0, 0, 0SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiBUsing default environmentIn: serialOut: serialErr: serialMMC: rtsmmc: 0flash status is 0, 0, 0SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiBKERNEL & DRV IS OKUSER IS OKmissing target file or read failedtuya verify failedboot kernelflash status is 0, 0, 0SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiBSF: 1507328 bytes @ 0x100000 Read: OK## Booting kernel from Legacy Image at 80100000 ...get header OKimage_get_kernel check hcrcimage_get_kernel print contents Image Name: linux_3.10 Created: 2019-05-11 8:41:43 UTC Image Type: MIPS Linux Kernel Image (uncompressed) Data Size: 1349581 Bytes = 1.3 MiB Load Address: 80401510 Entry Point: 80401510 Verifying Checksum ... OK Loading Kernel Image ... OKStarting kernel ...Linux version 3.10.27 (wenhe@embed) (gcc version 4.8.5 20150209 (prerelease) (Realtek RSDK-4.8.5p1 Build 2521) ) #2 PREEMPT Sat May 11 15:40:25 CST 2019 prom cpufreq = 500000000 prom memsize = 67108864 hw_ver: 0x2, hw_rev: 0x1, isp_ver: 0x1 prom eth mac = 00:00:00:00:00:00 bootconsole [early0] enabled CPU revision is: 0000dc02 FPU revision is: 01730001 Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Reserved contiguous memory at 0x423000(0x1618000) Zone ranges: Normal [mem 0x00000000-0x03ffffff] Movable zone start for each node Early memory node ranges node 0: [mem 0x00000000-0x03ffffff] icache: 32kB/32B, dcache: 16kB/32B, scache: 0kB/0B Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS1,57600 root=/dev/mtdblock2 rts_hconf.hconf_mtd_idx=1 rts-quadspi.channels=dual mtdparts=m25p80:8192k@0(global),128k@0k(boot),896k@128k(rootfs),1472k@1024k(kernel),704k@2496k(drv),2304k@3200k(user),2304k@5504k(backup),320k@7808k(mtd),64k@8128k(factory) PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 38072k/65536k available (3321k kernel code, 27464k reserved, 581k data, 192k init, 0k highmem) SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 Preemptible hierarchical RCU implementation. NR_IRQS:57 Calibrating delay loop... 497.66 BogoMIPS (lpj=995328) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 pinctrl core: initialized pinctrl subsystem NET: Registered protocol family 16 Init force reset registers rtsxb2 registered with IRQs INFO: initializing ISP memory ... INFO: initializing ISP device ... ISP camera platform devices added INFO: initializing SD controller ... INFO: initializing snd device ... snd resvd mem size : 1048576 INFO: initializing USB host ... INFO: initializing spi host ...0 spi platform id is ffffffff INFO: initializing I2C master ... INFO: initializing DMA controller ... INFO: initializing pinctrl device ... pinctrl_platform rts3903-pinctrl: rtspc registered with IRQs INFO: initializing ethernet devices ... INFO: initializing USB phy ... INFO: initializing watchdog controller ... INFO: initializing crypto device ... INFO: initializing cpu dvfs device ... bio: create slab at 0 rts_dmac rts3903-dmac: DesignWare DMA Controller, 4 channels INFO: realtek DMA engine inited usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb usbphy-platform usbphy-platform: Initialized Realtek IPCam USB Phy module Linux video capture interface: v2.00 Advanced Linux Sound Architecture Driver Initialized. NET: Registered protocol family 2 TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP: reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 RPC: Registered named UNIX socket transport module. RPC: Registered udp transport module. RPC: Registered tcp transport module. RPC: Registered tcp NFSv4.1 backchannel transport module. squashfs: version 4.0 (2009/01/31) Phillip Lougher NFS: Registering the id_resolver key type Key type id_resolver registered Key type id_legacy registered jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. msgmni has been set to 74 NET: Registered protocol family 38 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) io scheduler noop registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x18810000 (irq = 6) is a 16550A console [ttyS1] enabled, bootconsole disabled console [ttyS1] enabled, bootconsole disabled serial8250: ttyS1 at MMIO 0x18810100 (irq = 6) is a 16550A serial8250: ttyS2 at MMIO 0x18810200 (irq = 6) is a 16550A dbg_iomem initialized! rts-quadspi rts3903-qspi: force to set channels from quad mode to dual mode rts-quadspi rts3903-qspi: request 60000000 Hz, force to set 41666666 Hz rts-quadspi rts3903-qspi: found gd25q64c, expected mx25l12835f rts-quadspi rts3903-qspi: gd25q64c (8192 Kbytes) 9 cmdlinepart partitions found on MTD device m25p80 Creating 9 MTD partitions on "m25p80": 0x000000000000-0x000000800000 : "global" 0x000000000000-0x000000020000 : "boot" 0x000000020000-0x000000100000 : "rootfs" 0x000000100000-0x000000270000 : "kernel" 0x000000270000-0x000000320000 : "drv" 0x000000320000-0x000000560000 : "user" 0x000000560000-0x0000007a0000 : "backup" 0x0000007a0000-0x0000007f0000 : "mtd" 0x0000007f0000-0x000000800000 : "factory" rts-quadspi rts3903-qspi: Realtek QSPI Controller at 0x18030000 (irq 5) rtl8168 Gigabit Ethernet driver 8.038.00-NAPI loaded rtl8168 rts3903-r8168 (unregistered net_device): Get invalid MAC address from flash! eth%d: 0xb8400000, 00:00:00:00:00:00, IRQ 10 ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver ehci-rts: ehci-rts platform driver ehci-platform ehci-platform: EHCI Host Controller ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 ehci-platform ehci-platform: irq 11, io mem 0x18100000 ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00 usb usb1: New USB device found, idVendor=1d6b, idProduct=0002 usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb1: Product: EHCI Host Controller usb usb1: Manufacturer: Linux 3.10.27 ehci_hcd usb usb1: SerialNumber: ehci-platform hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver ohci-platform ohci-platform: Generic Platform OHCI Controller ohci-platform ohci-platform: new USB bus registered, assigned bus number 2 ohci-platform ohci-platform: irq 11, io mem 0x18180000 usb usb2: New USB device found, idVendor=1d6b, idProduct=0001 usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb2: Product: Generic Platform OHCI Controller usb usb2: Manufacturer: Linux 3.10.27 ohci_hcd usb usb2: SerialNumber: ohci-platform hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected i2c /dev entries driver Stopped watchdog timer timer margin: 8 sec TCP: cubic registered NET: Registered protocol family 17 Key type dns_resolver registered mtd1 name is boot hconf init failed ALSA device list: No soundcards found. VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 192K (803e0000 - 80410000) usb 1-1: new high-speed USB device number 2 using ehci-platform usb 1-1: New USB device found, idVendor=0bda, idProduct=f179 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: 802.11n usb 1-1: Manufacturer: Realtek usb 1-1: SerialNumber: 68572DD0266B Sat Oct 24 10:24:00 UTC 2015

| | | | | | | | _ | |_ | |_ | | / | ' / | / \ '| | || () | |) \ || / | |_/|./|/____||

ntpclient: can't load library 'libsysconf.so' jffs2: notice: (268) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. rlx snd internal codec init soc-audio soc-audio.0.auto: ASoC: machine RLX_INTERN_CARD should use snd_soc_register_card() soc-audio soc-audio.0.auto: rlx-codec-digital <-> pcm-platform mapping ok soc-audio soc-audio.0.auto: rlx-codec-analog <-> pcm-platform mapping ok RTW: module init start RTW: rtl8188fu v5.3.0.1_28034.20180525 RTW: build time: May 11 2019 15:41:23 RTW: HW EFUSE RTW: 0x000: 29 81 00 FC 0B 00 00 00 00 0C 04 4C 10 07 00 00 RTW: 0x010: 21 23 25 27 29 2B 2A 2C 2E 30 32 02 FF FF FF FF RTW: 0x020: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x030: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x040: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x050: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x060: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x070: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x0A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x0B0: FF FF FF FF FF FF FF FF 20 29 21 00 00 00 00 FF RTW: 0x0C0: FF 12 00 10 00 FF 00 FF 00 00 FF FF FF FF FF FF RTW: 0x0D0: DA 0B 79 F1 42 66 40 68 57 2D D0 26 6B 09 03 52 RTW: 0x0E0: 65 61 6C 74 65 6B 09 03 38 30 32 2E 31 31 6E 00 RTW: 0x0F0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x130: C1 B6 FF FF FF FF FF FF FF FF 00 11 FF FF FF FF RTW: 0x140: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x150: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1B0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1C0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1D0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1E0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1F0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: hal_com_config_channel_plan chplan:0x20 RTW: rtw_regsty_chk_target_tx_power_valid return _FALSE for band:0, path:0, rs:0, t:-1 RTW: rtw_ndev_init(wlan0) if1 mac_addr=68:57:2d:d0:26:6b RTW: rtw_ndev_init(wlan1) if2 mac_addr=6a:57:2d:d0:26:6b usbcore: registered new interface driver rtl8188fu RTW: module init ret=0 rtscam:isp resvd mem addr : 0x00523000, size : 0x1518000 rtscam:rtscam_mem_init v:0xa0523000 p:0x00523000 s:0x00001518 rtscam:rtscam_lock_init rtscam:rtscam_soc_probe rtscam:rtscam_hx280_probe rtscam:hx280enc:HW at base <0x18060000> with ID <0x48317011> rtscam:rtscam_jpgenc_probe rtscam:rtscam_osd2_probe rtscam:rtstream_init (none) login: status: active CC: excute rts3903 platform script..rtscam:begin to load fw from isp.fw . rtscam:Load firmware size : 131024. rtscam:Found ISP 1.011 device rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1477, streamnum: 4, 4 rtscam:video device registered rtscam:rts3903-isp initialized begin_, action: 0Started watchdog timer Started watchdog timer mmc0: new high speed SDHC card at address e624 mmcblk0: mmc0:e624 SU04G 3.69 GiB mmcblk0: p1 /dev/mmcblk0 /dev/mmcblk0p1 /dev/mmcblk0 /dev/mmcblk0p1 FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. insmod: can't insert '/drv/modules/8188fu.ko': File exists [2015-10-24 10:24:11.263 tid(508) main.c main(69) Debug] begin__ [2015-10-24 10:24:11.263 tid(508) tycam_devcom_inf.c tycam_devcomstart(221) Debug] begin [2015-10-24 10:24:11.263 tid(508) tycam_devcom_inf.c tycam_devcom_start(227) Debug] dev abi md[1] md_track[0] pir[0] ptz[0] isp_ver[] [2015-10-24 10:24:11.264 tid(508) ty_wifi.c ty_hwl_wifi_init(653) Debug] bigin_ [2015-10-24 10:24:11.264 tid(508) ty_wifi.c ty_hwl_wifiinit(667) Debug] end [2015-10-24 10:24:11.370 tid(508) tuya_ipc_mgr_utils.c TUYA_IPC_SDK_INIT(152) Debug] SDK Version:

< TUYA IOT SDK V:4.1.1 BS:30.01_PT:2.2_LAN:3.3_CAD:1.0.1_CD:1.0.0 >

IPC DEFS < ENABLE_ECHO_SHOW:1 ENABLE_CHROMECAST:1 ENABLE_CLOUD_STORAGE:1 >'

< BUILD AT:2020_03_05_15_41_01 BY dongxk FOR linux_wifi AT rts3903 >

[2015-10-24 10:24:11.693 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:0 Enable:1 [2015-10-24 10:24:11.693 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(90) Debug] video_bitrate 1536, video_fps 20 [2015-10-24 10:24:11.705 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(98) Debug] init ring buffer success. channel:0 [2015-10-24 10:24:11.705 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:1 Enable:1 [2015-10-24 10:24:11.705 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(90) Debug] video_bitrate 512, video_fps 20 [2015-10-24 10:24:11.709 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(98) Debug] init ring buffer success. channel:1 [2015-10-24 10:24:11.710 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:2 Enable:0 [2015-10-24 10:24:11.710 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:3 Enable:0 [2015-10-24 10:24:11.710 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:4 Enable:0 [2015-10-24 10:24:11.710 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:5 Enable:0 [2015-10-24 10:24:11.711 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:6 Enable:0 [2015-10-24 10:24:11.711 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:7 Enable:0 [2015-10-24 10:24:11.711 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:8 Enable:0 [2015-10-24 10:24:11.711 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:9 Enable:1 [2015-10-24 10:24:11.712 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(84) Debug] audio_sample 8000, audio_databits 16, audio_fps 25 [2015-10-24 10:24:11.713 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(98) Debug] init ring buffer success. channel:9 [2015-10-24 10:24:11.713 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:10 Enable:1 [2015-10-24 10:24:11.714 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(98) Debug] init ring buffer success. channel:10 [2015-10-24 10:24:11.715 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:11 Enable:0 [2015-10-24 10:24:11.715 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:12 Enable:0 [2015-10-24 10:24:11.715 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:13 Enable:0 [2015-10-24 10:24:11.715 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:14 Enable:0 [2015-10-24 10:24:11.716 tid(508) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(81) Debug] init ring buffer Channel:15 Enable:0 [01-01 18:12:15-- TUYA Debug][tuya_iot_com_api.c:94] init fs. Path: /etc/tuya/

[01-01 18:12:15-- TUYA Info][kv_storge.c:43] Init Kvs With File:/etc/tuya/

[01-01 18:12:15-- TUYA Debug][simplekv.c:916] path:/etc/tuya/

[01-01 18:12:15-- TUYA Debug][simplekv.c:952] get encrypt_key[£—¢US¾ñüùykR�éâ]

[01-01 18:12:15-- TUYA Debug][simplekv.c:983] both file exist

[01-01 18:12:15-- TUYA Debug][simplekv.c:280] size in: 0 and final: 28700 And mag_rec_max: 512

[01-01 18:12:15-- TUYA Debug][simplekv.c:295] create data hd success

[01-01 18:12:15-- TUYA Debug][simplekv.c:1026] read from normal file

[01-01 18:12:15-- TUYA Debug][simplekv.c:736] curr db is V2. No need to upgrade

[01-01 18:12:15-- TUYA Debug][simplekv.c:526] head check success

[01-01 18:12:15-- TUYA Debug][simplekv.c:629] read and check head success

[01-01 18:12:15-- TUYA Debug][simplekv.c:1041] read from normal file success

[01-01 18:12:15-- TUYA Debug][uni_thread.c:161] Init Thread Del Mgr

[01-01 18:12:15-- TUYA Debug][simplekv.c:1079] init from normal file success.

[01-01 18:12:15-- TUYA Debug][sys_timer.c:63] system timer has been inited

[01-01 18:12:15-- TUYA Debug][sys_timer.c:63] system timer has been inited

[01-01 18:12:15-- TUYA Debug][sys_timer.c:63] system timer has been inited

[01-01 18:12:15-- TUYA Debug][online_log_serv.c:340] read from uf. max:0 first:0 last:0

[01-01 18:12:15-- TUYA Debug][online_log_serv.c:581] log serv init success

[01-01 18:12:15-- TUYA Debug][ty_work_queue.c:22] init work queue. stack size:2560 pro:3 num:2

[01-01 18:12:15-- TUYA Debug][ty_work_queue.c:27] ty work queue create success

[01-01 18:12:15-- TUYA Debug][uni_thread.c:220] Thread:sys_timer Exec Start. Set to Running Status

[01-01 18:12:15-- TUYA Debug][sys_timer.c:34] system timer process run.

tycam_kv_db_init start [01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:basic_conf isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:0 basic_conf

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:basic_conf find value.Len:432

tycam_kv_db_init done [01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:gw_bi isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:1 gw_bi

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:gw_bi find value.Len:160

[01-01 18:12:15-- TUYA Debug][tuya_ws_db.c:490] gw base read success

[01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:gw_bi isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:1 gw_bi

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:gw_bi find value.Len:160

[01-01 18:12:15-- TUYA Debug][tuya_ws_db.c:490] gw base read success

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2190] serial_no:(null)

[2015-10-24 10:24:12.391 tid(508) ty_wifi.c hwl_wf_set_country_code(580) Debug] Set Country Code:CN

[01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:gw_wsm isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:2 gw_wsm

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:gw_wsm find value.Len:128

[01-01 18:12:15-- TUYA Debug][tuya_ws_db.c:610] gw_wsm read success

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2219] gw_cntl.gw_wsm.stat:0

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2222] gw_cntl.gw_wsm.nc_tp:1

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2223] gw_cntl.gw_wsm.md:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:gw_di isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:3 gw_di

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:gw_di find value.Len:304

[01-01 18:12:15-- TUYA Debug][tuya_ws_db.c:756] gw_di read success

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2255] gw_cntl.gw_if.abi:0 input:0

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2256] gw_cntl.gw_if.product_key:jmj7mcderhdweyy4, input:jmj7mcderhdweyy4

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2257] gw_cntl.gw_if.tp:0, input:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1177] read key:gw_ai isFuzzy:0 skipCnt:0

[01-01 18:12:15-- TUYA Debug][simplekv.c:1217] find key:4 gw_ai

[01-01 18:12:15-- TUYA Debug][simplekv.c:1246] key:gw_ai find value.Len:176

[01-01 18:12:15-- TUYA Debug][tuya_ws_db.c:851] gw_ai read success

[01-01 18:12:15-- TUYA Debug][gw_intf.c:2415] enter success_proc

[01-01 18:12:15-- TUYA Debug][tuya_iot_wifi_api.c:358] register wifi network monitor. interval:5

[01-01 18:12:15-- TUYA Debug][uni_thread.c:220] Thread:wk_th-1 Exec Start. Set to Running Status

[01-01 18:12:15-- TUYA Debug][uni_thread.c:220] Thread:wk_th-0 Exec Start. Set to Running Status

[01-01 18:12:15-- TUYA Debug][uni_thread.c:220] Thread:cmmod Exec Start. Set to Running Status

[2015-10-24 10:24:12.393 tid(562) ty_wifi.c hwl_wf_station_disconnect(433) Debug] trace_ [2015-10-24 10:24:12.394 tid(508) ty_ipc_stream.c TUYA_APP_Enable_EchoShowChromecast(135) Debug] begin [2015-10-24 10:24:12.602] tuya_ipc_echoshow.c tuya_ipc_echoshow_init(821) begin_, video channel: 1 [2015-10-24 10:24:12.602] tuya_ipc_echoshow.c tuya_ipc_echoshowinit(865) end, video step(4500), audio step(2) [2015-10-24 10:24:12.602] tuya_ipc_chromecast.c tuya_ipc_chromecast_init(5RTW: wlan0- hw port(0) mac_addr =68:57:2d:d0:26:6b 69) video: chl(1), fps(20) audioRTW: wlan1- hw port(1) mac_addr =6a:57:2d:d0:26:6b : chl(10), fps(8) [01-01 18:12:15-- TUYA Debug][tuya_ipc_webrtc.c:364] begin___

[01-01 18:12:15-- TUYA Debug][tuya_ipc_webrtc.c:370] end___

[2015-10-24 10:24:12.603 tid(508) ty_ipc_stream.c TUYA_APP_Enable_EchoShow_Chromecast(185) Debug] end_ { "ptz": { "pan_cur": 0, "pan_total": 5440, "tilt_cur": 0, "tilt_total": 1138, "patrol": { "on": 0, "mode": 0, "tmode": 0, "start_time": "", "end_time": "" }, "presets": { "num": 0 }, "link_presets": { "link_num": 4, "point": [{ "seq": 0, "pan": 0, "tilt": 0, "zoom": 0 }, { "seq": 0, "pan": 0, "tilt": 0, "zoom": 0 }, { "seq": 0, "pan": 0, "tilt": 0, "zoom": 0 }, { "seq": 0, "pan": 0, "tilt": 0, "zoom": 0 }] } }, "track_enable": 0, "light": { "pir_status": 7, "pir_sensitivity": 1, "light_mode": 0, "light_duration": 60, "light_enable": 0 }, "pir_cfg": { "pir_status": 0, "pir_sensitivity": 0, "pir_num": 0 } } num: 0 [2015-10-24 10:24:12.608 tid(508) tycam_rts_device.c tycam_dev_streamstart(129) Debug] begin, product name [sc002wa2v5] version[1.1.3] build in Mar 6 2020 14:00:16 [2015-10-24 10:24:13.288 tid(508) tycam_rts_video.c tycam_rts_video_start(639) Debug] begin_ [2015-10-24 10:24:13.288 tid(508) tycam_rts_video.c tycam_rts_codec_spec_value(108) Debug] qp[35]mbrc_en[1] qp_range[2]delta[-4] mainQP_max_min[51][10-1572864] mainBT_max_min[524288][51-20] subQP_max_min[524288][131072-8788396] subBT_max_min[9612256][2000915364-1999598024] [2015-10-24 10:24:13.288 tid(508) ty_thread.c ty_threadcreate(43) Debug] begin [2015-10-24 10:24:13.159 tid(562) ty_wifi.c hwl_wf_wk_mode_set(304) Debug] WIFI Set Mode 2

[2015-10-24 10:24:13.289 tid(562) ty_wifi.c hwl_wf_all_ap_scan(173) Debug] begin_ [2015-10-24 10:24:13.290 tid(508) ty_thread.c ty_thread_create(73) Debug] end_, old thd name: tycam, create thd (vcap0) success, detach(0)! [2015-10-24 10:24:13.290 tid(508) ty_thread.c ty_threadcreate(43) Debug] begin [2015-10-24 10:24:13.291 tid(508) ty_thread.c ty_thread_create(73) Debug] end_, old thd name: tycam, create thd (vcap1) success, detach(0)! [2015-10-24 10:24:13.291 tid(508) tycam_rts_video.c tycam_rts_videostart(676) Debug] end [2015-10-24 10:24:13.291 tid(508) tycam_rts_audio.c tycam_rts_audio_start(255) Debug] begin_ [2015-10-24 10:24:13.291 tid(508) ty_thread.c ty_threadcreate(43) Debug] begin [2015-10-24 10:24:13.292 tid(508) ty_thread.c ty_thread_create(73) Debug] end_, old thd name: tycam, create thd (acap) success, detach(0)! [2015-10-24 10:24:13.292 tid(508) tycam_rts_audio.c tycam_rts_audiostart(270) Debug] end [2015-10-24 10:24:13.292 tid(508) tycam_rts_panel.c tycam_rts_panel_start(314) Debug] begin_ [2015-10-24 10:24:13.293 tid(596) ty_thread.c ty_threadproc(21) Debug] begin, handle: 0xaab0b8, context: 0xa12e90 [2015-10-24 10:24:13.294 tid(596) tycam_rts_audio.c tycam_rts_audio_proc(97) Debug] begin_ [2015-10-24 10:24:13.293 tid(595) ty_thread.c ty_threadproc(21) Debug] begin, handle: 0xaaafe0, context: 0xa12f5c [2015-10-24 10:24:13.298 tid(595) tycam_rts_video.c tycam_rts_video_proc(513) Debug] begin___ [2015-10-24 10:24:13.298 tid(595) tycam_rts_video.c tycam_rts_video_moduleinit(471) Debug] begin [2015-10-24 10:24:13.299 tid(595) tycam_rts_video.c tycam_rts_create_channels(330) Debug] begin_, id(1) width(640) height(360) [2015-10-24 10:24:13.300 tid(595) tycam_rts_video.c tycam_rts_wait_for_isp_load(69) Debug] check dev node return value: 0, cnt: 5 [2015-10-24 10:24:13.293 tid(508) tycam_rts_panel_universal.c ty_rts_panel_universal_get_func(386) Debug] begin_ [2015-10-24 10:24:13.293 tid(594) ty_thread.c ty_threadproc(21) Debug] begin, handle: 0xaaaf08, context: 0xa12f34 [2015-10-24 10:24:13.316 tid(594) tycam_rts_video.c tycam_rts_video_proc(513) Debug] begin___ [2015-10-24 10:24:13.317 tid(594) tycam_rts_video.c tycam_rts_video_module_init(471) Debug] [2015-10-24 10:24:13.302 tid(508) tycam_rts_panel_universal.c ty_rts_panel_universal_getfunc(390) Debug] end [2015-10-24 10:24:13.329 tid(508) tycam_rts_panel_universal.c ty_rts_panel_universal_start(278) Debug] begin_ [2015-10-24 10:24:13.330 tid(508) tycam_rts_gpio.c rts_initgpio(31) Debug] pin(11), direction(1), value(0) begin [2015-10-24 10:24:13.331 tid(594) tycam_rts_video.c tycam_rts_create_channels(330) Debug] begin_, id(0) width(1920) height(1080) [2015-10-24 10:24:13.331 tid(594) tycam_rts_video.c tycam_rts_wait_for_isp_load(69) Debug] check dev node return value: 0, cnt: 5 [2015-10-24 10:24:13.333 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(6), direction(1), value(1) [2015-10-24 10:24:13.338 tid(508) tycam_rts_panel_universal.c ty_rts_panel_universalstart(299) Debug] end [2015-10-24 10:24:13.338 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(19), direction(0), value(0) [2015-10-24 10:24:13.342 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(20), direction(1), value(1) [2015-10-24 10:24:13.346 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(21), direction(1), value(1) [2015-10-24 10:24:13.350 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(17), direction(1), value(0) [2015-10-24 10:24:13.706 tid(596) tycam_rts_audio.c tycam_rts_audio_proc(123) Debug] audio capture chn: 100, aec chn : 101 Table address = 0 8000 AECNS is created sucessfully [2015-10-24 10:24:13.708 tid(595) tycam_rts_video.c tycam_rts_set_h264_attr(130) Debug] h264_no[10]bitrate_mode[2] bitRate[262144]max-min[20971520-16384] qp[35][51-10] [2015-10-24 10:24:13.711 tid(594) tycam_rts_video.c tycam_rts_set_h264_attr(130) Debug] h264_no[11]bitrate_mode[2] bitRate[1048576]max-min[20971520-16384] qp[35][51-10] [2015-10-24 10:24:14.19 tid(595) tycam_rts_video.c tycam_rts_create_jpeg_channel(196) Debug] isp chn: 1, jpg chn : 20 [2015-10-24 10:24:14.20 tid(595) tycam_rts_video.c tycam_rts_create_jpeg_channel(214) Debug] ppctrl normal_compress_rate 0 [2015-10-24 10:24:14.36 tid(508) tycam_rts_gpio.c rts_init_gpio(31) Debug] pin(18), direction(1), value(0) [2015-10-24 10:24:14.42 tid(508) ty_thread.c ty_thread_create(43) Debug] begin_ [2015-10-24 10:24:14.42 tid(508) ty_thread.c ty_thread_create(73) Debug] end_, old thd name: tycam, create thd (panel) success, detach(0)! [2015-10-24 10:24:14.43 tid(508) tycam_rts_panel.c tycam_rts_panelstart(343) Debug] end [2015-10-24 10:24:14.43 tid(508) tycam_rts_light.c tycam_rts_floodlight_start(482) Debug] do nothing [2015-10-24 10:24:14.43 tid(508) tycam_rts_device.c tycam_dev_streamstart(165) Debug] end [2015-10-24 10:24:14.43 tid(508) tycam_rts_device.c tycam_dev_get_encrypt_func(421) Debug] register hardware encrypt function, support ecb/cbc mode! [2015-10-24 10:24:14.44 tid(508) tycam_rts_video.c tycam_video_flip(716) Debug] begin_ [2015-10-24 10:24:14.45 tid(623) ty_thread.c ty_thread_proc(21) Debug] begin_, handle: 0xacd398, context: 0xa13050 [2015-10-24 10:24:14.45 tid(623) tycam_rts_panel.c tycam_rts_panelproc(133) Debug] begin [2015-10-24 10:24:14.553 tid(508) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 21, value: 0 [2015-10-24 10:24:14.553 tid(508) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 1, min: 0, max: 1, step: 1, default: 0, current: 0 [2015-10-24 10:24:14.558 tid(594) tycam_rts_video.c tycam_rts_create_channels(438) Debug] end_, id: 0, h264 chnno: 11, isp chnno: 0 maxAncBytes: 256, maxOutBufBytes: 768, frameLength: 1024 [2015-10-24 10:24:14.567 tid(595) tycam_rts_video.c tycam_rts_createchannels(438) Debug] end, id: 1, h264 chnno: 10, isp chnno: 1 [2015-10-24 10:24:14.582 tid(508) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 22, value: 0 [2015-10-24 10:24:14.582 tid(508) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 1, min: 0, max: 1, step: 1, default: 0, current: 0 [2015-10-24 10:24:14.583 tid(508) tycam_rts_video.c tycam_videoflip(729) Debug] end, flip: 0, value: 0 [2015-10-24 10:24:14.583 tid(508) tycam_rts_panel_universal.c ty_rts_panel_universal_status(109) Debug] on_off: 1, state: 0 [2015-10-24 10:24:14.584 tid(508) tycam_devcom_inf.c tycam_devcom_start(281) Debug] end_ [2015-10-24 10:24:14.584 tid(508) tycam_video_detect.c tycam_motion_detect_trackinginit(251) Debug] begin [2015-10-24 10:24:14.584 tid(508) tycam_video_detect.c tycam_motion_detect_tracking_init(255) Debug] end_ [2015-10-24 10:24:14.584 tid(508) tycam_devcom_inf.c tycam_devcomloop(359) Debug] begin [2015-10-24 10:24:14.602 tid(594) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 46, value: 1 [2015-10-24 10:24:14.602 tid(594) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 0, min: 0, max: 1, step: 1, default: 0, current: 1 [2015-10-24 10:24:14.603 tid(594) tycam_rts_osd.c tycam_rts_osd_start(446) Debug] begin_, chn[0], width[1920], height[1080] [2015-10-24 10:24:14.603 tid(594) ty_thread.c ty_thread_create(43) Debug] begin_ [2015-10-24 10:24:14.603 tid(594) ty_thread.c ty_threadcreate(73) Debug] end, old thd name: vcap0, create thd (osd0) success, detach(0)! [2015-10-24 10:24:14.604 tid(594) tycam_rts_osd.c tycam_rts_osd_start(464) Debug] end___ [2015-10-24 10:24:14.604 tid(594) tycam_rts_video.c tycam_rts_video_moduleinit(487) Debug] end [2015-10-24 10:24:14.604 tid(595) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 46, value: 1 [2015-10-24 10:24:14.605 tid(628) ty_thread.c ty_thread_proc(21) Debug] begin_, handle: 0xb2d128, context: 0xa13240 [2015-10-24 10:24:14.607 tid(628) tRTW: nolinked power save enter ycam_rts_osd.c tycam_rts_osd_proc(333) Debug] begin___, width(32), height(64) [2015-10-24 10:24:14.609 tid(595) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 1, min: 0, max: 1, step: 1, default: 0, current: 1 [2015-10-24 10:24:14.610 tid(595) tycam_rts_osd.c tycam_rts_osdstart(446) Debug] begin, chn[1], width[640], height[360] [2015-10-24 10:24:14.610 tid(595) ty_thread.c ty_thread_create(43) Debug] begin_ [2015-10-24 10:24:14.610 tid(595) ty_thread.c ty_thread_create(73) Debug] end_, old thd name: vcap1, create thd (osd1) success, detach(0)! [2015-10-24 10:24:14.611 tid(595) tycam_rts_osd.c tycam_rts_osdstart(464) Debug] end [2015-10-24 10:24:14.611 tid(595) tycam_rts_video.c tycam_rts_video_moduleinit(487) Debug] end [2015-10-24 10:24:14.611 tid(629) ty_thread.c ty_thread_proc(21) Debug] begin_, handle: 0xb452f8, context: 0xa13260 [2015-10-24 10:24:14.612 tid(629) tycam_rts_osd.c tycam_rts_osdproc(333) Debug] begin, width(12), height(24) [2015-10-24 10:24:14.672 tid(629) tycam_rts_osd.c tycam_rts_osd_proc(363) Debug] osd = 30 [2015-10-24 10:24:14.675 tid(628) tycam_rts_osd.c tycam_rts_osd_proc(363) Debug] osd = 31 [2015-10-24 10:24:14.977 tid(629) tycam_rts_osd.c set_osd_enable(220) Error] set osd2 fail, ret = -21 [2015-10-24 10:24:14.988 tid(628) tycam_rts_osd.c set_osd_enable(220) Error] set osd2 fail, ret = -21 index:0 bssid:F8-7B-8C-7A-59-2D RSSI:0 SSID:VIDEOTRON0179_RE

index:1 bssid:F0-79-59-D5-EB-58 RSSI:48 SSID:

index:2 bssid:3C-17-10-2E-4E-2E RSSI:81 SSID:BELL844

[2015-10-24 10:24:15.2 tid(562) ty_wifi.c hwl_wf_all_ap_scan(201) Debug] end___ [01-01 18:12:18-- TUYA Debug][wf_nw_cfg.c:485] sta search all ap and num: 3

[01-01 18:12:18-- TUYA Debug][wf_nw_cfg.c:501] channel:06 bssid:f8-7b-8c-7a-59-2d ssid:VIDEOTRON0179_RE

[01-01 18:12:18-- TUYA Debug][wf_nw_cfg.c:501] channel:08 bssid:f0-79-59-d5-eb-58 ssid:

[01-01 18:12:18-- TUYA Debug][wf_nw_cfg.c:501] channel:11 bssid:3c-17-10-2e-4e-2e ssid:BELL844

killall: wpa_supplicant: no process killed RTW: wlan0- hw port(0) mac_addr =68:57:2d:d0:26:6b RTW: wlan1- hw port(1) mac_addr =6a:57:2d:d0:26:6b RTW: nolinked power save leave RTW: assoc success [2015-10-24 10:24:15.717 tid(562) ty_wifi.c hwl_wf_wk_mode_set(304) Debug] WIFI Set Mode 1

killall: wpa_supplicant: no process killed [2015-10-24 10:24:15.751 tid(562) ty_wifi.c hwl_wf_wk_mode_set(304) Debug] WIFI Set Mode 1

[2015-10-24 10:24:15.751 tid(562) ty_slink.c ty_slink_start(120) Debug] begin_ [2015-10-24 10:24:15.751 tid(562) ty_slink.c ty_slink_start(143) Debug] end___ [2015-10-24 10:24:15.752 tid(562) tycam_sniffer.c tycamsniffer(47) Debug] begin [2015-10-24 10:24:15.752 tid(562) tycam_rts_speaker.c tycam_rts_device wlan0 entered promiscuous mode speaker_play_file(546) Debug] begin_ [2015-10-24 10:24:15.752 tid(562) ty_thread.c ty_thread_create(43) Debug] begin_ [2015-10-24 10:24:15.753 tid(562) ty_thread.c ty_threadcreate(73) Debug] end, old thd name: cmmod, create thd (spk) success, detach(0)! [2015-10-24 10:24:15.754 tid(562) tycam_rts_speaker.c tycam_rts_speaker_playfile(595) Debug] end [2015-10-24 10:24:15.754 tid(562) tycam_rts_panel_universal.c ty_rts_panel_universal_status(109) Debug] on_off: 1, state: 3 [2015-10-24 10:24:15.754 tid(562) tycam_qrcode_proc.c tycam_qrcode_start(147) Debug] begin_ [2015-10-24 10:24:15.755 tid(562) tycam_qrcode_proc.c tycam_qrcodestart(168) Debug] end [2015-10-24 10:24:15.755 tid(562) tycam_sniffer.c tycam_sniffer(61) Debug] end_ [2015-10-24 10:24:15.756 tid(635) ty_thread.c ty_thread_proc(21) Debug] begin_, handle: 0xb44b78, context: 0xa12ddc [2015-10-24 10:24:15.756 tid(635) tycam_rts_speaker.c tycam_rts_speakerproc(446) Debug] begin unhandled chunk: fact, size: 4 unhandled chunk: LIST, size: 26 [2015-10-24 10:24:15.758 tid(634) ty_slink.c ty_slink_proc(80) Debug] begin___ [2015-10-24 10:24:15.759 tid(634) ty_slink.c ty_slink_proc(90) Debug] success: g_device: wlan0 [2015-10-24 10:24:15.758 tid(636) tycam_qrcode_proc.c tycam_qrcodeproc(40) Debug] begin [2015-10-24 10:24:15.759 tid(636) tycam_qrcode_proc.c tycam_qrcode_proc(50) Debug] thres = 128 scale_flag = 0 [2015-10-24 10:24:15.760 tid(636) tycam_rts_video_detect.c tycam_rts_init_chn(33) Debug] begin_ [2015-10-24 10:24:15.760 tid(636) tycam_rts_video_detect.c tycam_rts_initchn(64) Debug] end [2015-10-24 10:24:15.760 tid(636) tycam_qrcode_proc.c tycam_qrcode_proc(62) Debug] tycam_dev_init_chn OK [2015-10-24 10:24:15.761 tid(636) tycam_qrcode_proc.c tycam_qrcode_proc(66) Debug] yuv420sp_data 640 360 [2015-10-24 10:24:15.762 tid(635) tycam_rts_speaker.c rts_speaker_start_playback(80) Debug] rate = 8000, format bit = 16, channels = 1 sh: 3: unknown operand [2015-10-24 10:24:16.192 tid(635) tycam_rts_speaker.c rts_speaker_start_playback(209) Debug] speaker enable OK!!!chan:102 103 104 [2015-10-24 10:24:16.214 tid(635) tycam_rts_speaker.c tycam_rts_speaker_proc(483) Debug] duration(1000) data_size(8005) avg_bytes_per_sec(8000) [01-01 18:12:19-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 8 [01-01 18:12:19-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 11 [01-01 18:12:20-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 6 [2015-10-24 10:24:17.341 tid(635) tycam_rts_speaker.c tycam_rts_speaker_proc(528) Debug] end_, sleep_time(1), count(0) [2015-10-24 10:24:17.343 tid(635) ty_thread.c ty_threadproc(32) Debug] end, handle: 0xb44b78 [2015-10-24 10:24:17.369 tid(624) tycam_rts_panel.c tycam_rts_panel_night_mode(228) Debug] night status: 0 [2015-10-24 10:24:17.371 tid(624) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 39, value: 0 [2015-10-24 10:24:17.371 tid(624) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 369, min: 0, max: 1, step: 1, default: 0, current: 0 [2015-10-24 10:24:17.373 tid(624) tycam_rts_dn_switch.c update_fps(41) Debug] [sensor fps]0 -> 20 [01-01 18:12:20-- TUYA Debug][tuya_iot_wifi_api.c:340] wifi netstat changed to:1 -->>

################status is 1 [2015-10-24 10:24:17.402 tid(561) tuya_ipc_mgr_utils.c __IPC_APP_mqtt_status_change_cb(67) Debug] status changed to offline [01-01 18:12:20-- TUYA Debug][tuya_iot_wifi_api.c:343] wifi netstat changed to:1 <<-- [01-01 18:12:20-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 8 [2015-10-24 10:24:17.694 tid(624) tycam_rts_panel.c tycam_rts_panel_night_mode(228) Debug] night status: 0 [2015-10-24 10:24:17.698 tid(624) rts_video_com.c tycam_rts_set_attr(29) Debug] id: 39, value: 0 [2015-10-24 10:24:17.698 tid(624) rts_video_com.c tycam_rts_set_attr(31) Debug] type: 694, min: 0, max: 1, step: 1, default: 0, current: 0 [2015-10-24 10:24:17.700 tid(624) tycam_rts_dn_switch.c update_fps(41) Debug] [sensor fps]20 -> 20 [01-01 18:12:21-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 11 [01-01 18:12:21-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 6 [01-01 18:12:21-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 8 [01-01 18:12:22-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 11 [01-01 18:12:22-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 6 [01-01 18:12:23-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 8 [01-01 18:12:23-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 11 [01-01 18:12:24-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 6 [01-01 18:12:24-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 8 [01-01 18:12:24-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 11 [01-01 18:12:25-- TUYA Debug][wf_nw_cfg.c:100] Set New Channel 6 IMG_1134 Ascii art says "Lobster" ...

lcharles123 commented 4 years ago

So on the back of the PCB there are four UART pads. You can see them directly above the sd-card slot, I connected to them with an arduino during boot using 115200 baud and got the following output:

U-Boot 2013.10.0-AK_V2.0.03 (Jul 31 2019 - 16:11:47)

DRAM:  64 MiB
8 MiB
ANYKA SDHC/MMC4.0: 0
PPS:Jul 31 2019 16:11:49   anyka_c2:  1 ��� 0 
magic err
magic err
 Booting kernel from Legacy Image at 81808000 ...
   Image Name:   Linux-3.4.35
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2076240 Bytes = 2 MiB
   Load Address: 81808000
   Entry Point:  81808040
   Verifying Checksum ... OK
   XIP Kernel Image ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Meari Linux Kernel Version: 2.5.02

Unfortunately, it was not the gold mine I was hoping for. I am unable to send commands as I think this interface is locked down. Then I looked up the FCC filing and found some useful information about the chips used as my camera had the markings smudged and I couldn't read it. Link to the listing here. I found that the storage was a 64byte wide 8 MB chip that I was able to dump using a ch341a USB to serial converter. Attached is the dump, I can open it with 7-zip and see a lot of files including init stuff and other Linux related things. The problem is I don't see a shadow or passwd file anywhere. If someone knows more about Linux than I do please let me know. I would love to make a custom bin file to flash to the chip to gain more access. If we can get in and enable something like telnet then we would be able to get the hashes and run it through John the Ripper. If anyone wants to look at the bin file for themselves you can download it here.

Another note, it looks like a user named fjb is the owner of the files. Maybe a lead on a username?

Last thing. The SOC used in this camera is actually used in a lot of cameras, modifying a firmware of another camera that has onvif may also be an option. Just a thought.

here are the data sheet of anyka soc cpu http://caxapa.ru/thumbs/914089/ak3818ds.pdf the best result for uart that i found is 230400 8N1 , but the datasheet says that baud rate is programmable, how to do it? i am using a raspberry pi, and minicom to view in my cam, after fully discharged the capacitors, i can plug in and hit a key to interactive console, but the interaction to interface gets messed after some commands, here the list of available commands:

help
           ?       - alias for help
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
downimage- downimage   - download and write All-Image to FLASH device,partiton table from ENV partition.
downjffs2fs- load usr.jffs2 tftp
downkernel- load uImage tftp
downrootfs- load root.sqsh4 tftp
downsquashfs- load usr.sqsh4 tftp
downuboot- load uboot tftp
env     - environment handling commands
erase   - erase FLASH memory
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
flinfo  - print FLASH memory information
format  - erase uboot env
go      - start application at address 'addr'
help    - print command description/usage
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mw      - memory write (fill)
nm      - memory modify (constant address)
parts   - read out partitions table info.
parts_adjust- 
adjust parts info. Each part's size,offset etc.

ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
readcfg - read config from config.
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
setloadaddr- set loadaddr to  config infor .
sf      - spi flash sub-system:
tfdownjffs2fs- load usr.jffs2TF
tfdownkernel- load uImageTF
tfdownrootfs- load root.sqsh4TF
tfdownsquashfs- load usr.sqsh4TF
tfdownuboot- load u-boot.binTF
tftpboot- boot image via network using TFTP protocol
tfupdateimage- tfupdateimage   - download and write All-Image to FLASH device
updatecfg- update config from config infor table.
version - print monitor, compiler and linker version

anyka$

maybe i can set up a tftp for receiving some firmware, but there is an version that have rtsp or onvif or telnet open?

here some images of the board https://i.imgur.com/d2UXiS7.png https://i.imgur.com/Sy5Gq5L.png

Jordan-Jarvis commented 4 years ago

I got one of those Ch341a eeprom programmer/reader and also dumped the memory. So far all I tried to do was to edit the bytes in a string that was written something like if I remember PPSDEBUG=off and changed it to PPSDEBUG=on but as expected after written the camera didn't boot and the red light stayed on, possibly because of a checksum validation upon start. Now interestingly enough, after flashing back the original dump, the camera does not work and the red light is flashing slowly. I'll try flashing it again and if it persists, I'll try using a spare esp8266 that I have laying around to write to the eeprom.

Edit: the light isn't blinking normally, it stays on for about 3 seconds and turns off for a fraction of a second. I think the device might be bootlooping as the light on the Ch341a board is flashing at the same time it turns back on.

Did you make sure to validate your dump a few times with the chip? the nature of the dumper tools are that they are error prone, it is possible that the dump you edited was slightly corrupted. If you still can't get it to boot correctly you can download my latest bin and try flashing that one. assuming it is the 720p version. The SOC seems to have hard coded memory locations to boot from and others that it can assign depending on the firmware instructions. I have bricked my camera a few times but have been able to get it back up and running. @Everyone I am about at the point where Firmware Mod Toolkit can disassemble most of the firmware image and re-assemble it. I had to modify the underlying python code to enable it to work with the custom memory locations. There is most likely an easier way to do it, but that is what I got. I am running into issues with overflows into other memory regions though and need to modify where the new data is stored (I am attempting to add rtsp functions pulled from a firmware of a different smart camera with a similar SOC by adding dependencies and injecting them into the init process). Like I have said before. If anyone knows how to modify firmware, please reach out. This is my first time and I am learning as I go. There is a decent chance I will run into something that I will not know how to solve. Sorry I have been away so long. I am taking 19 credits at the moment and they are all 3rd year and 4th year classes. It is really kicking my butt haha!

Soneji commented 4 years ago

Hi, how do I connect to UART with arduino? Would like to help with this project as I also have one of these cameras - tried so much in software but didn't work

n0ggi3 commented 4 years ago

I believe I located an answer to the question asked above. Anyone still interested may find a solution here.

https://github.com/ct-Open-Source/tuya-convert

https://github.com/arendst/Tasmota

Soneji commented 4 years ago

Hey @n0ggi3 Cool find. I have had a look and I think the camera we are trying to get working uses https. I cannot find it in either of the projects. I think these projects are centered around ESP based devices, but if I am understanding correctly, this device uses a completely different SoC. Please correct me if I am wrong

StuDaBaiker commented 4 years ago

Tasmota is Esp only, http,and doesn't support any cameras. At least currently

russinnes commented 4 years ago

I will be digging more into this firmware when i get time. Mine is dumped from a BELL 5S rebranded board, but seems like it is more or less the same fw on many of the devices. I want to make this work with Home Assistant and maybe also remove the connection to the cloud services. Need to remove the cert pinning etc.

Any chance you could share the firmware dump? I've got a similar dump from a Merkury camera and pulled the file system out, having a browse as we speak. I also have a Bell 5s Clone but can't bleed the firmware out of it. Cheers.

jschwalbe commented 4 years ago

I got to the bottom of this and was sad - it's like watching a movie that ended an hour early! Any progress on getting rtsp streams on these cameras?

cbytestech commented 4 years ago

nothing to my knowledge, I'd like to know myself

jschwalbe commented 4 years ago

OK here's some interesting info I was able to find.

Go here: http://apis-us-west.meari.com.cn/api/thirdDevice/getDeviceForThirdDevice?userID=10000xxxxx <-- this is your personal userID for Meari. You can find it by sniffing the app with a man in the middle proxy, or just guess. (The x's represent digits.)

Notice that it shows your email address and the name and serial # of any camera you own.

Then go here: http://apis-us-west.meari.com.cn/api/thirdDevice/echoshow/getRtspUrl?userID=10000xxxxx&licenseID=yyyyy

What have we here? An rtsp:// url! I can't get it to work, though. Now it's your turn. Who knows RTSP protocol well enough to figure this out?

vinstech commented 3 years ago

So i got Tuya enabled camera too Aus Version https://www.bunnings.com.au/orion-1080p-smart-hd-grid-connect-outdoor-security-camera_p0178704

Thanks to this thread Managed to login with username: admin password: 056565099

and can access

http://local-ip >> /search (no credentials needed) /flash/upgrade/release_package /flash/upgrade/percent /devices/deviceinfo /sys/reboot

/proc/self/root/home/www/index.html

However i get a prompt for login when i try /cgi-bin/videostream.cgi and above passwords doesn't work.

any-ideas ?

pixelasticity commented 3 years ago

So i got Tuya enabled camera too Aus Version https://www.bunnings.com.au/orion-1080p-smart-hd-grid-connect-outdoor-security-camera_p0178704

Thanks to this thread Managed to login with username: admin password: 056565099

and can access

http://local-ip >> /search (no credentials needed) /flash/upgrade/release_package /flash/upgrade/percent /devices/deviceinfo /sys/reboot

/proc/self/root/home/www/index.html

However i get a prompt for login when i try /cgi-bin/videostream.cgi and above passwords doesn't work.

any-ideas ?

I have a different Tuya-based camera, but I can log in and access the same pages with the same username and password. I am also unable to access the videostream.

Suspect-byte commented 3 years ago

So i got Tuya enabled camera too Aus Version https://www.bunnings.com.au/orion-1080p-smart-hd-grid-connect-outdoor-security-camera_p0178704

Thanks to this thread Managed to login with username: admin password: 056565099

and can access

http://local-ip >> /search (no credentials needed) /flash/upgrade/release_package /flash/upgrade/percent /devices/deviceinfo /sys/reboot

/proc/self/root/home/www/index.html

However i get a prompt for login when i try /cgi-bin/videostream.cgi and above passwords doesn't work.

any-ideas ?

I have a different Tuya-based camera, but I can log in and access the same pages with the same username and password. I am also unable to access the videostream.

I have a Nedis WIFICDP10GY doorbell with the Hi3518 chipset. I got sort of the same problem. I can't access the /cgi-bin/videostream.cgi it will just not load in. But mine isn't asking for another password it just doesn't load in. Hopefully we can find a way to work around it or to fix it.

Suspect-byte commented 3 years ago

Hey guys, I have found a few interesting things. My doorbell is the model: "Bell 5S". I have been looking around on the internet and it is from a company Mearitek. I have contacted them to help me turn on the RTSP because it is possible with my model. They told me that they are working on an update for the RTSP. Now another thing I have found a the root password but in a hash. Is anyone experienced with hash cat. The password that I have found is "root:$1$12345678$CTq8UQyYrE.vbbG7E8Mtj1:0:0::/root:/bin/sh".

adamsweet commented 3 years ago

At least 3 people have tried cracking that password hash (it's buried in the comment history that is now hidden, starting 10th Feb 2020, my own attempt starting 2nd April 2020) before giving up when it became apparent that it was going to take something like 30 days to try all 7 char passwords and 2200 years to process all possible character combinations up to 8 chars. Since then I have a new GPU (2060) that is guessing around 4 times faster than my old one and maybe 10% faster than the EC2 GPU optimised instance I played with.

Using the suggestion from @captaintofuburger I decided not to waste time on lower case chars, I'm looking at this again (for technical exercise in mastering hashcat charsets and masks as much as anything) but I expect to give up when I see how long 8 if not 7 chars will take.

Something I noticed after looking at this again is that a password salt of 12345678 seems suspiciously non-coincidental, so it might mean any attempt to crack it will be garbage.

cbytestech commented 3 years ago

We found the hash as well way back. but if thats a new one since updates have been made that would be awesome!! I'm currently not in a place to hash it out but its relatively easy to get working.

On Wed, Sep 30, 2020, 5:14 AM Suspect-byte notifications@github.com wrote:

Hey guys, I have found a few interesting things. My doorbell is the model: "Bell 5S". I have been looking around on the internet and it is from a company Mearitek. I have contacted them to help me turn on the RTSP because it is possible with my model. They told me that they are working on an update for the RTSP. Now another thing I have found a the root password but in a hash. Is anyone experienced with hash cat. The password that I have found is "root:$1$12345678$CTq8UQyYrE.vbbG7E8Mtj1:0:0::/root:/bin/sh".

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/AMoo-Miki/homebridge-tuya-lan/issues/4#issuecomment-701268329, or unsubscribe https://github.com/notifications/unsubscribe-auth/AFZMEGUHU7SV3HQKBPOAZGDSILZJDANCNFSM4GMY7FQA .

Suspect-byte commented 3 years ago

Hi all,

After a long email chat with the official company called Mearitek. I got some great news if we can believe them. They told me that RTSP protocol will be enabled in the next update that will happen next week. Here is a copy of my email:

"Hello Dear Mark

Last night We had sent the new firmware to Nedis Team for test.

After they tested okay, We will push the firmware to sever. This action is expected to be done within next week.

Then your device will get the upgrade notification.

Once upgrade done, You will be able to see the RTSP.

VIVI Jiang

Senior Oversea Sales

Hangzhou Meari Technology"

Guys we got it!

sudds65 commented 3 years ago

Still nothing from Geeni and the Merkury cameras. Any updates @Suspect-byte? I've been hitting a wall on this.

LuCiLuna commented 3 years ago

I really hope that we get RTSP enabled on merkury cameras, it was a shame having 4 merkury indoor cams and 2 amiccom outdoor cams. The outdoor ones were onvif compliant, the indoor ones had no such capabilities, which killed me adding them to Agent.

I had done the same research as everyone did in the beginning, I did some sniffing and found the tuya credentials, found a couple of ports responding to Onvif from merkury cam (port 80)

I hope that here in a few days we get this beloved feature, it would really complete the smart home.

Suspect-byte commented 3 years ago

Still nothing from Geeni and the Merkury cameras. Any updates @Suspect-byte? I've been hitting a wall on this.

I haven't heard anything from them yet. But I will send them a email again

PoisonFlame commented 3 years ago

I'm using a MECO doorbell which also seems to be extended from MEARI family. Got a new update today to version 3.2.1.20200706 but doesn't seem to see anything RTSP related. Only difference I see is that before I could go to the cameras IP address port 80 and it would prompt me for username/password which I did not have thus couldn't access. Now it seems that port 80 is also closed after the update so not sure what happened there but can't access that basic authentication page anymore

10aseetommy commented 3 years ago

So I have confirmed the username and password for Walmart Mercury Cameras username: admin password: 056565099

The only Stream info Ive found so far is /cgi-bin/videostream.cgi /img/snapshot.cgi?size=2

and Ports 80 554 8554

I have a successful login, but no luck with the streams working on those ports. Hopefully we can figure out what stream will work and with port to use. If anyone else can crack that part we would be golden

wsegatto commented 3 years ago

SOLVED! Check this article: https://www.gadgetvictims.com/2019/10/tuyasmartlife-ip-camera-howellcam-yt08.html

I have downloaded the ONVIF Device Manager from here: https://sourceforge.net/projects/onvifdm/

I have input the IP and voilá, stream was retrieved correctly. Checking in the User Management section I could see my user/pass was admin/12345. In the Network section I saw the HTTP port was 80 and the RTSP port was 554.

image

image

cbytestech commented 3 years ago

I have to test it today but dude ..you rock! it's been ALMOST a year at least that I've been involved.

On Fri, Oct 23, 2020, 10:42 AM Will Segatto notifications@github.com wrote:

SOLVED! Check this article:

https://www.gadgetvictims.com/2019/10/tuyasmartlife-ip-camera-howellcam-yt08.html

I have downloaded the ONVIF Device Manager from here: https://sourceforge.net/projects/onvifdm/

I have input the IP and voilá, stream was retrieved correctly. Checking in the User Management section I could see my user/pass was admin/12345. In the Network section I saw the HTTP port was 80 and the RTSP port was 554.

[image: image] https://user-images.githubusercontent.com/35738729/97017826-c1d68700-1524-11eb-8dbe-e14cbd755d37.png

[image: image] https://user-images.githubusercontent.com/35738729/97017786-b84d1f00-1524-11eb-85c6-ffc05a3b6d21.png

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/AMoo-Miki/homebridge-tuya-lan/issues/4#issuecomment-715384995, or unsubscribe https://github.com/notifications/unsubscribe-auth/AFZMEGT4KCDCAJM356MCHSLSMGI45ANCNFSM4GMY7FQA .

sudds65 commented 3 years ago

I still wasn’t able to view the streams… :/

From: cbytestech notifications@github.com Sent: Friday, October 23, 2020 10:02 AM To: AMoo-Miki/homebridge-tuya-lan homebridge-tuya-lan@noreply.github.com Cc: Austin Suddarth austinsuddarth@gmail.com; Comment comment@noreply.github.com Subject: Re: [AMoo-Miki/homebridge-tuya-lan] Security Cameras? (#4)

I have to test it today but dude ..you rock! it's been ALMOST a year at least that I've been involved.

On Fri, Oct 23, 2020, 10:42 AM Will Segatto <notifications@github.com mailto:notifications@github.com > wrote:

SOLVED! Check this article:

https://www.gadgetvictims.com/2019/10/tuyasmartlife-ip-camera-howellcam-yt08.html

I have downloaded the ONVIF Device Manager from here: https://sourceforge.net/projects/onvifdm/

I have input the IP and voilá, stream was retrieved correctly. Checking in the User Management section I could see my user/pass was admin/12345. In the Network section I saw the HTTP port was 80 and the RTSP port was 554.

[image: image] https://user-images.githubusercontent.com/35738729/97017826-c1d68700-1524-11eb-8dbe-e14cbd755d37.png

[image: image] https://user-images.githubusercontent.com/35738729/97017786-b84d1f00-1524-11eb-85c6-ffc05a3b6d21.png

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/AMoo-Miki/homebridge-tuya-lan/issues/4#issuecomment-715384995, or unsubscribe https://github.com/notifications/unsubscribe-auth/AFZMEGT4KCDCAJM356MCHSLSMGI45ANCNFSM4GMY7FQA .

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/AMoo-Miki/homebridge-tuya-lan/issues/4#issuecomment-715396634 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AFJL756FZIMRURP2YFQD26LSMGLGBANCNFSM4GMY7FQA . https://github.com/notifications/beacon/AFJL752EAZA2XFNJV75ROKDSMGLGBA5CNFSM4GMY7FQKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOFKSBMGQ.gif

10aseetommy commented 3 years ago

Issue here is that we are talking about totally different cameras. The cameras I'm using are Walmart Mercury Cameras, enabled by geeni.
20201023_140437 20201023_140418

username: admin password: 056565099

The only Stream info Ive found so far is /cgi-bin/videostream.cgi /img/snapshot.cgi?size=2

and Ports 80 554 8554

I have a successful login, but no luck with the streams working on those ports. Hopefully we can figure out what stream will work and with port to use.

When you point the browser to the cameras ip, you get a successful log-in with that username and password, however the page is blank. I'm going to dig deeper in the next day or so and see if I can get the index of the root folder. May get us a step closer into solving the stream url. Hopefully there will be a way to change the firmware and add an rstp if anything, but I will keep posting.

vinstech commented 3 years ago

Yeah mine is also the same rebranded version which still doesn’t work Best to check and mention the fw info http:/deviceip/devices/deviceinfo

Mrdindon commented 3 years ago

Got that answer from LittleIf.... good luck !

At least they wish me a happy life... without rtsp, not possible !!

31E6E26C-4C1B-4B28-AB4C-C37DD7061059

Suspect-byte commented 3 years ago

Hi all, I have been sending emails to the official reseller of mearitek. My reseller is Nedis. They told me that they were busy with onvif support. It would be enable around the first week of november, but it could be later or sooner depending on how fast they are. I am just praying and hoping that it will be fixed soon!

Suspect-byte commented 3 years ago

@10aseetommy

Issue here is that we are talking about totally different cameras. The cameras I'm using are Walmart Mercury Cameras, enabled by geeni. 20201023_140437 20201023_140418

username: admin password: 056565099

The only Stream info Ive found so far is /cgi-bin/videostream.cgi /img/snapshot.cgi?size=2

and Ports 80 554 8554

I have a successful login, but no luck with the streams working on those ports. Hopefully we can figure out what stream will work and with port to use.

When you point the browser to the cameras ip, you get a successful log-in with that username and password, however the page is blank. I'm going to dig deeper in the next day or so and see if I can get the index of the root folder. May get us a step closer into solving the stream url. Hopefully there will be a way to change the firmware and add an rstp if anything, but I will keep posting.

Did you find anything helpful yet?

EliasKotlyar commented 3 years ago

Hello everyone,

I am living in Germany and purchased a "LSC Smart Connect IP-Kamera" which has the same chipset. Here is a link to the Product: https://www.action.com/de-de/p/dummy-3003038/

http:/deviceip/devices/deviceinfo is showing following:

![image](https://user-images.githubusercontent.com/9529505/98600018-36f3db80-22dd-11eb-98e6-02b85b6fb923.png

I tried logging in with admin:056565099, which seems to work, however the connection freezes and there is no output. I suppose the password is correct but the underlying admin panel was removed. Any other idea how to get the RTSP to work?

Many thanks in advanced

Slowfoxtrot commented 3 years ago

So I'm working on the Walmart doorbell from Merkury Innovations called the SMART WI-FI DOORBELL CAMERA. The model shows up as CW024 in the Geeni app. admin:056565099 works to login to the web interface. The only ports that are open are 80 and 6668. The /search url shows this:

{ "deviceName": "060233713", "serialno": "060233713", "sn": "pp01f72473570cec4fea", "licenseUsed": 1, "licenseId": "pp01f72473570cec4fea", "p2p_uuid": "v2-0602337130000111A", "factory_code": 0, "factory_code_str": "", "model": "Bell 9S", "ip": "192.168.0.234", "mask": "255.255.255.0", "gw": "192.168.0.1", "mac": "d4:d2:d6:17:95:9e", "interface": "wlan0", "version": "2.9.5" }

the /devices/deviceinfo page shows this:

{ "devname": "Smart Home Camera", "model": "Bell 9S", "serialno": "060233713", "softwareversion": "2.9.5", "hardwareversion": "BE9S_H1_V10_915", "firmwareversion": "ppstrong-c51-tuya2_merkury-2.9.5.20200331", "authkey": "DCLP66s9AdwkzeIXBPnq8jzhSaMjdjTA", "deviceid": "pp01f72473570cec4fea", "pid": "aaa", "WiFi MAC": "d4:d2:d6:17:95:9e" }

I can't figure out how to get Onvif working tho! If I try to connect in Onvif Device Manager I just get the following:

Additional information: The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Digest realm="onvif", qop="auth,auth-int", nonce="587343b5ca703a95f874", opaque="08138641"

What am I missing? Thanks!