TheCrypt0 / yi-hack-v4

New Custom Firmware for Xiaomi Cameras based on Hi3518e Chipset. It features RTSP, SSH, FTP and more!
GNU General Public License v3.0
1.55k stars 218 forks source link

YI Dome Camera 1080p #154

Open v1ct0rv opened 4 years ago

v1ct0rv commented 4 years ago

Hi,

I have a YI Dome Camera 1080p model YHS.2016, I follow all the steps but nothing happens, this specific model is not supported?

baglio commented 4 years ago

Same here:

The camera just boots up as it normally does and nothing changes.

Dude88 commented 4 years ago

Hi, same here, any details?

GilDev commented 4 years ago

Same here. I’ve got the following model though, which is advertised as Yi Dome 1080p on AliExpress and works fine with the Yi IoT app (firmware version 7.0.00.73a_201812031453) but looks different.

IMG_20191029_191143

VitalyFedyunin commented 4 years ago

Mine is from the amazon https://www.amazon.com/gp/product/B01CW4BLG8 same symptoms.

Dude88 commented 4 years ago

Found my problem, my serial number starts with BFUS, not 6FUS ..... Seems that there is a new revision..... , Just ordered all cameras from the local stores, hopefully there will be one with 6FUS

baglio commented 4 years ago

Found my problem, my serial number starts with BFUS, not 6FUS ..... Seems that there is a new revision..... , Just ordered all cameras from the local stores, hopefully there will be one with 6FUS

Interesting. How can I check my serial number? Is it located directly on the product or is it shown somewhere inside the phone app?

Dude88 commented 4 years ago

Hi, im in the road at the moment, but there is a QR code on the box for the serial number, not the one for the app, maybe there is also one on the ground of the camera but not sure.

VitalyFedyunin commented 4 years ago

one on the ground of the camera

yes

GilDev commented 4 years ago

The QR Code on mine (weird variant I posted just above) is A0000000091WBN181011… I think I’ll never be able to install this firmware on it, too bad… 😕

michele8gr commented 4 years ago

The QR Code on mine (weird variant I posted just above) is A0000000091WBN181011… I think I’ll never be able to install this firmware on it, too bad… 😕

Hi Gil, do you have any update ? My cam have the same label. thks

GilDev commented 4 years ago

Well no, I don’t know if the firmware is easily adaptable and if someone will ever try to do it. I personally don’t have time nor lots of knowledge in this area to dig more right now…

michele8gr commented 4 years ago

Well no, I don’t know if the firmware is easily adaptable and if someone will ever try to do it. I personally don’t have time nor lots of knowledge in this area to dig more right now…

I hope that someone solve the issue. This is the printscreen when i try to access using telnet (other port are closed)

image

GilDev commented 4 years ago

Nice, at least it's something!

michele8gr commented 4 years ago

guys help us please to solve the issue. Thank you in advance.

Hataru80 commented 4 years ago

same problem whit serial BFUSY, i'll send back the cam :( sob

Hataru80 commented 4 years ago

The solution for BFUSY cam is use this firmware https://github.com/roleoroleo/yi-hack-MStar

GilDev commented 4 years ago

Damn, mine has “XY-R9820-K2(N)” on the back sticker, is there a way?

GillesC commented 4 years ago

Damn, mine has “XY-R9820-K2(N)” on the back sticker, is there a way?

I have the same Serial Number and have the same telnet output as @michele8gr. Flashing the Yi Dome 1080p (as it should normally be) is not working. Any pointers to a working solution is appreciated.

ghost commented 4 years ago

Having there same output as @michele8gr. Same s/w and no firmware that seems to work on this camera. Hope someone finds a solution.

Happyboy0980 commented 4 years ago

Mmm how did you open telnet.. ? Seems on my version xy-r9820-k2 this is even blocked...

LuckyBenski commented 4 years ago

Mmm how did you open telnet.. ? Seems on my version xy-r9820-k2 this is even blocked...

I simply run telnet 192.168.1.70 , no port details or anything.

RalfEngelberth commented 3 years ago

Hello, I have an XY-R9820-G1 with the Firmware 7.1.00 Can you give me a tip which firmware works here? I can't get a connection over Telnet. A00160 .....

RalfEngelberth commented 3 years ago

Hello, I opened the camera and took a picture of the circuit board. Can someone give me a tip on how to hack or open RTSP?

image

image

rauko70 commented 3 years ago

Take a look to https://github.com/cjj25/Yi-RTS3903N-RTSPServer

cjj25 commented 3 years ago

Hello, I opened the camera and took a picture of the circuit board. Can someone give me a tip on how to hack or open RTSP?

image

image

Thanks for the mention @rauko70

@RalfEngelberth if you're interested in accessing UART on that MVT9632 then drop me a message :)

The unpopulated header you see in the top left, it's the middle two pads.

I've managed to patch the uboot bootloader to enable UART for this board but annoyingly YI have used the RX/TX pins as dedicated GPIO too, so as soon as the driver loads.. no more UART. You can kill the init.sh before hand, useful for debugging nevertheless!

bondiblueos9 commented 2 years ago

@cjj25 how do you get the UART to work on the MVT9632? I have a camera with the same board (not the same camera, in fact it uses tuya instead of yi) specifically labeled MVT9632-SC2303_QJ.V1.1 and I wired up those pads but got nothing. I assumed from left to right they are ground, tx/rx, and 3.3v (measured), and I tried the tx and rx both ways.

cjj25 commented 2 years ago

@cjj25 how do you get the UART to work on the MVT9632? I have a camera with the same board (not the same camera, in fact it uses tuya instead of yi) specifically labeled MVT9632-SC2303_QJ.V1.1 and I wired up those pads but got nothing. I assumed from left to right they are ground, tx/rx, and 3.3v (measured), and I tried the tx and rx both ways.

Check your two middle pins are connected to the RTS3903N chip using continuity mode on your multimeter.

UART_RX = 39 UART_TX = 38

Note: they might be the other way around, but they're the right pins!

Pin one is marked with the white triangle, using the image above, the pin numbers are going upwards.

If you need any more help, create an issue on https://github.com/cjj25/Yi-RTS3903N-RTSPServer

Edit: I'd love to have a copy of your Tuya firmware dump