search

ant-thomas / zsgx1hacks

Hacks for ZS-GX1 IP Camera and various Goke GK7102 based IP Cameras
363 stars 102 forks source link

Wanscam K* firmware on INQMEGA HIP291 #129

Open slydiman opened 4 years ago

slydiman commented 4 years ago

FYI We have just released the patch of the latest Wanscam K21 firmware 16.06.00.52 to use it on the camera INQMEGA IL-HIP291G-2M-AI with the sensor gc2033. https://4pda.ru/forum/index.php?showtopic=928641&st=900#entry89274008 Note the description is Russian. We have patched few drivers to work on GK7102 instead of GK7102S and gpio pins map inside the main app. It seems that the firmware Wanscam K series has been developed by ZSCam company. It works with SAP HD app and clones (YSee, WISE VR, Eyedot). It has very good and stable Onvif, RTSP and Web UI implementation. We have added telnet, ftp and other tools. We can help to adapt this firmware for other GK7102 cameras.

paus56 commented 4 years ago

Mod_Hip_02 HIP_Mod_Hip_03

svastarija commented 4 years ago

Hi, the download link does work on 4pda.ru, it give 404 error

paus56 commented 4 years ago

To download files from 4pda.ru you need to register and login to your account

I have attached the firmware mod file here... description of the installation to read on 4pda

HIP291G_Mod_ENG_04102019.ZIP

nishant2019 commented 4 years ago

Where can I get INQMEGA IL-HIP291G-1M-AI firmware ?

svastarija commented 4 years ago

To download files from 4pda.ru you need to register and login to your account

I have attached the firmware mod file here... description of the installation to read on 4pda

HIP291G_Mod_ENG_04102019.ZIP

Thanks.. greatly appreciated. I have tried to create an account on 4PDA but it is very hard for non RUS, since CAPTCHA is asking to add numbers in russian, making it very hard to gues.. anyway.. thanks

nishant2019 commented 4 years ago

To download files from 4pda.ru you need to register and login to your account I have attached the firmware mod file here... description of the installation to read on 4pda HIP291G_Mod_ENG_04102019.ZIP

Thanks.. greatly appreciated. I have tried to create an account on 4PDA but it is very hard for non RUS, since CAPTCHA is asking to add numbers in russian, making it very hard to gues.. anyway.. thanks

Try this website https://doorsgeek.blogspot.com/2015/08/4pdaru-loginregister-captcha-tutorial.html

paus56 commented 4 years ago

Обновление MOD прошивки от 20191014

Обновил mod прошивку для камер HIP291G

подробнее на 4PDA...

скачать прошивку также можно там: HIP291G_Mod_ENG_20191014

nishant2019 commented 4 years ago

Обновление MOD прошивки от 20191014

Обновил mod прошивку для камер HIP291G

* добавил поддержку сенсора **gc1034** ( камера HIP291G-1M-AI )

* добавил поддержку сенсора **gc2053** ( камера HIP291G-2M-AI )

подробнее на 4PDA...

скачать прошивку также можно там: HIP291G_Mod_ENG_20191014

как можно прошить мою камеру этой прошивкой? Можно ли использовать Uboot для этого?

paus56 commented 4 years ago

как можно прошить мою камеру этой прошивкой? Можно ли использовать Uboot для этого?

nishant2019 commented 4 years ago

  • можно использовать U-boot

  • также можно просто скопировать 3 файла из архива в корень SD карты.

получать это сообщение Mod FW programming eyeplus_ipc_gks_001 Unknown target.

камера IL-HIP291G-1M-AI

nishant2019 commented 4 years ago

Will this work on GK7102S based IL-HIP291G-1M-AI gc1034

paus56 commented 4 years ago

no work on GK7102S

nishant2019 commented 4 years ago

no work on GK7102S

any firmware for GK7102S

rufussckingston commented 4 years ago

I'm trying to D/L the Backup/restore zip files from the links in post 94, but am getting 404 errors... Can you post them here please.

https://4pda.ru/pages/go/?u=https%3A%2F%2Ftranslate.googleusercontent.com%2Ftranslate_c%3Fdepth%3D1%26rurl%3Dtranslate.google.com%26sl%3Dauto%26sp%3Dnmt4%26tl%3Den%26u%3Dhttps%3A%2F%2F4pda.ru%2Fforum%2Findex.php%253Fs%253D%2526showtopic%253D928641%2526view%253Dfindpost%2526p%253D81185843%26xid%3D17259%2C15700021%2C15700186%2C15700190%2C15700256%2C15700259%2C15700262%2C15700265%2C15700271%26usg%3DALkJrhiVLjS2CmRqiucvWJElFHn4MH4JcA&e=89925251

THX

paus56 commented 4 years ago

Backup.zip restore.zip

Keeze commented 4 years ago

Firmware also works on a INQMega PTZ381 https://www.banggood.com/2019-NEW-INQMEGA-PTZ381-HD-1080P-PTZ-360-Panoranic-Waterproof-IP-Camera-IR-Night-Version-Two-way-Audio-p-1542643.html?cur_warehouse=CN

IMG_20191101_220909 (2)

Thanks!

kirelam commented 4 years ago

I wish there was modded firmware for the gk7102S version

Op za 2 nov. 2019 23:19 schreef Kees notifications@github.com:

Firmware also works on a INQMega PTZ381 https://www.banggood.com/2019-NEW-INQMEGA-PTZ381-HD-1080P-PTZ-360-Panoranic-Waterproof-IP-Camera-IR-Night-Version-Two-way-Audio-p-1542643.html?cur_warehouse=CN

[image: IMG_20191101_220909 (2)] https://user-images.githubusercontent.com/6306958/68077634-40439180-fdc7-11e9-8efb-5c386e609e38.jpg

Thank!

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/ant-thomas/zsgx1hacks/issues/129?email_source=notifications&email_token=AI3ZKQQA2FWVDOEMOSAJIZTQRX4IZA5CNFSM4I3PXDQ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEC5GI5A#issuecomment-549086324, or unsubscribe https://github.com/notifications/unsubscribe-auth/AI3ZKQV32LNMR76XHJQQGNDQRX4IZANCNFSM4I3PXDQQ .

paus56 commented 4 years ago

Keeze Firmware also works on a INQMega PTZ381

This firmware supports all the functionality of the INQMega PTZ381 camera? PTZ works correctly with this firmware ? What type of sensor does your camera have?

Keeze commented 4 years ago

Firmware seems to fully support all features, including PTZ, had to flip the controls though (this cam hangs from a mount). Sensor is 

# ls /tmp | grep -F gc
gc2033
paus56 commented 4 years ago

Собрал прошивку для камер на процессоре GK7102S скачать можно там: Hip_Mod_20191103_ENG_7102S

возможны проблемы с голосовыми сообщениями... подробности на 4PDA

paus56 commented 4 years ago

!!!!! Возможны проблемы с мод прошивкой для камер на процессоре GK7102S подробнее читать там: http://4pda.ru/forum/index.php?s=&showtopic=928641&view=findpost&p=91290366

aalm commented 4 years ago

Hi,

could you share a log of "ipc" working correctly via console(=uart)? (of course, do censor if there's any UIDs/private info in it), thanks in advance:]

i have a camera with GK7102S(exactly like in this pic), and currently running the ipc from Hip_Mod_20191103_ENG_7102S does cause reboot almost instantly.

apparently it might atleast support the sensor(sc1135) my camera has: # strings /home/ipc | grep -C9 sc1135 ipc.c sensortype=%s [%d %s,%s, %d ]=>ret=%d, val:%s sc1145 [%d %s,%s, %d ]=>sc1145 sc2135 [%d %s,%s, %d ]=>sc2135 ov9750 [%d %s,%s, %d ]=>ov9750 sc1135 [%d %s,%s, %d ]=>sc1135 sc2315 [%d %s,%s, %d ]=>sc2315 sc2232 [%d %s,%s, %d ]=>sc2232 sc2235 [%d %s,%s, %d ]=>sc2235 jxf23 [%d %s,%s, %d ]=>jxf23 /tmp/.sensortype.ini

i guess i should begin reverse-engineering ipc, to figure out how to 'satisfy' the cause of reboot, since there was no obviously fatal errors visible via console.. the camera came with p2pcam originally, but i'd like to replace that.

paus56 commented 4 years ago

вот лог загрузки камеры на процессоре GK7102

20191130_mod_out.zip

aalm commented 4 years ago

@paus56 Thank you for the log & all the info you've shared about these cams :]

fwiw., i began taking a closer look at what "ipc" does, and i built strace(1) for that, which i wasn't able to find else where.

this is the last version that was on sourceforge from iirc. 2018, but i will try to get around to building a newer version from the official source later: static-strace-4.21.zip

about the failure i'm having, i'm now wondering if it's related to this: 04:08:09.418298 [76e8b384] open("/proc/mounts", O_RDONLY) = 12</proc/179/mounts> 04:08:09.421802 [76e8b4a4] read(12</proc/179/mounts>, "rootfs / rootfs rw 0 0\n/dev/root / ext2 rw,relatime,errors=continue 0 0\nproc /proc proc rw,relatime 0 0\ntmpfs /dev tmpfs rw,rela"..., 4096) = 483

so "ipc" is obviously looking at the mounts, and might not like seeing squashfs missing and/or ext2 there?

having rootfs/storage on anything but the 8M spi flash would be ideal for testing/hacking on these "firmwares".

Anon0ne commented 4 years ago

I tried this on the camera INQMEGA PTZ but it must have bricked it. Once I loaded the firmware on SD card and restart it.. I restart device in 3-5 minutes and it never come back online.

Now I have tried to connect to UART and access UBoot but I am getting no output at all from it.. did the flash chip get killed? wtf.

Anon0ne commented 4 years ago

Got a replacement today, and I dumped the mtd0 throught mtd4 and I cannot find a way to download the merge tool to share this firmware.

paus56 commented 4 years ago

теперь мод Wanscam K21 firmware может работать на этих камерах с SD карты без прошивки флеш... файлы и описание подробно там: http://4pda.ru/forum/index.php?s=&showtopic=928641&view=findpost&p=92865876

aalm commented 4 years ago

@paus56 i saw this was missing, works for me:] edit_config.arm.zip

Anon0ne commented 4 years ago

I need the edit devParam.dat and image merge tool from 4pda. The FTP file would help too but I cannot make am account there for anything.

If people want a copy of the newer firmware, and home folder. I want to take my info our first.

Anon0ne commented 4 years ago

Firmware seems to fully support all features, including PTZ, had to flip the controls though (this cam hangs from a mount). Sensor is

# ls /tmp | grep -F gc
gc2033

Careful I got a PTZ381 recently that did not take the firmware very well. In fact the flash chip quit responding all together. I will have to desolder old one to burn in CH341A.

There are ways to mod the new one with the zxsg hacks manually and safely.

aalm commented 4 years ago

We have patched few drivers to work on GK7102 instead of GK7102S and gpio pins map inside the main app. It seems that the firmware Wanscam K series has been developed by ZSCam company. It works with SAP HD app and clones (YSee, WISE VR, Eyedot). It has very good and stable Onvif, RTSP and Web UI implementation. We have added telnet, ftp and other tools. We can help to adapt this firmware for other GK7102 cameras.

@slydiman, @paus56, if you are familiar with C, and have been reversing the 'ipc', you might find my project interesting. In the end(once it's usable for rtsp etc.) the result should be much better than changing bytes in 'ipc' manually, i hope:] you can find the Work-In-Progress project from: https://github.com/aalm/gkipc_hooked

slazaris commented 4 years ago

Hello, is this firmware also compatible with IL-HIP291G-1M-AI, the 1MP version of the camera. Is it possible to flash back the original firmware in case something doesn't work. Can you also share a link with the original firmwares?

yomismo112 commented 4 years ago

Hi. I've bricked a Inqmega IL-HIP329G-1-C. I've tried flashing various versions of software but none has run. Is there a version of this software (HIP291G_Mod_ENG_04102019.ZIP) that i can flash directly to the eeprom? Thanks in advance.

Anon0ne commented 4 years ago

Hi. I've bricked a Inqmega IL-HIP329G-1-C. I've tried flashing various versions of software but none has run. Is there a version of this software (HIP291G_Mod_ENG_04102019.ZIP) that i can flash directly to the eeprom? Thanks in advance.

I did the same thing on the first one I got. I was unable to find anything to flash to it, I got the programmer but had no luck with the chip still on board. I read on 4pad.ru you have to remove it to flash it.

And you probably needed to have your own backup. I have a firmware backup but who knows if it works for others.

yomismo112 commented 4 years ago

Hello AnonOne. I've unbricked the camera at last. I explain you how: -With a programmer i extract the firmware from another camera (with the same processor and image sensor) that i own. -Then with this firmware i flash the old camera and the come back to life. -I've attached the firmware for if you want to probe. -When you flash the firmware it's important desolder the pin number 8 of the flash memory chip and select the correct type of flash memory in the programmer software (i use an CH341A). If you need help don´t doubt in ask me that you need. Sorry for my bad english, i'm spanish !!!!

firmware.zip

maartenjd commented 4 years ago

To download files from 4pda.ru you need to register and login to your account

I have attached the firmware mod file here... description of the installation to read on 4pda

HIP291G_Mod_ENG_04102019.ZIP

Hello paus56, I would like to put this firmware on my camera. When I look at the debug_cmd.sh file that you provided, this firmware needs 6 mtd-partitions: if [ -f $MNTPT/$FLASHBIN ];then dd if=/dev/mtd0 of=$MNTPT/mtd0.im dd if=/dev/mtd1 of=$MNTPT/mtd1.im dd if=/dev/mtd2 of=$MNTPT/mtd2.im dd if=/dev/mtd3 of=$MNTPT/mtd3.im dd if=/dev/mtd4 of=$MNTPT/mtd4.im dd if=/dev/mtd5 of=$MNTPT/mtd5.im

My camera now has 5: _mtdparts=gkflash:320K(U),1664K(K),1152K(R),2560K(A),-(H)

what gives [ 0.640000] 0x000000000000-0x000000050000 : "U" [ 0.650000] 0x000000050000-0x0000001f0000 : "K" [ 0.660000] 0x0000001f0000-0x000000310000 : "R" [ 0.670000] 0x000000310000-0x000000590000 : "A" [ 0.680000] 0x000000590000-0x000000800000 : "H"

I cannot install the HIP291G_Mod_ENG_04102019-firmware because it cannot find the /dev/mtd5. Are you sure that it needs 6 mtd-partitions? In that case I would like to see what is in the mtdparts-command line in the u-boot environment. Can you provide that?

Strangely, when I look in your 20191130mod.log, I also see only 5 mtd-partitions: [ 0.640000] 5 cmdlinepart partitions found on MTD device gk_flash [ 0.650000] Creating 5 MTD partitions on "gkflash": [ 0.650000] 0x000000000000-0x000000050000 : "U" [ 0.660000] 0x000000050000-0x0000001f0000 : "K" [ 0.670000] 0x0000001f0000-0x0000003c0000 : "R" [ 0.670000] 0x0000003c0000-0x000000410000 : "Cg" [ 0.680000] 0x000000410000-0x000000800000 : "H" so I begin to doubt if your debug_cmd.sh is correct? When I binwalk the firmware, I see the familiar addresses show up: 0x50000, 0x1f0000, 0x3c0000, 0x3c0000 and 0x410000, just as in your log file.

Just delete the mtd5-line from the script?

Or I could just manually flash the mtd1-4 partitions. I will see if that works.

paus56 commented 4 years ago

в файле debug_cmd.sh находится этот скрипт:

для создания бэкапа вашей оригинальной прошивки с количеством mtdX до 6... при этом реально блоков mtd может быть сколько угодно, но не больше 6... если их меньше, то они будут проигнорированы...

!!! я вам рекомендую НЕ ПРОШИВАТЬ камеру, а использовать прошивку, которая работает с SD карты без записи флеш...

kamilmirza commented 4 years ago

@slydiman @paus56 can we disable onvif or secure our video feed to use it as a indoor camera, like we could do it on original patched firmware of INQMEGA HIP291

lolomin commented 3 years ago

Hi,

Do you know if this firmware could work on Wanscam K64A please ? The original firmware is not stable, camera reboots often, RTSP is not secured by login/pass, Home position not available, Presets are not working, OnVif Left/Righ/Up/Down are inverted, no FTP Upload capabilities, max 15 fps ... big big regression comparing to HW* series from Wanscam.

Regards,

lolomin

AivanRam commented 3 years ago

Обновление MOD прошивки от 20191014

Обновил mod прошивку для камер HIP291G

* добавил поддержку сенсора **gc1034** ( камера HIP291G-1M-AI )

* добавил поддержку сенсора **gc2053** ( камера HIP291G-2M-AI )

подробнее на 4PDA...

скачать прошивку также можно там: HIP291G_Mod_ENG_20191014

Hi Amazing update, I just tested on a Y4A-WB, same processor than INQMEGA HIP291. It works perfectly, I have just some questions.

I am using Ysee to connect to my camera, there is updates on the firmware, is better not to touch this Updates? There is a way to save images and videos on ftp or free cloud, like onedrive, gdrive, etc?

It looks like the user has a bug, you can create users, it does not show them, but they works, also the device admin user crashes when you change the admin name "admin" for another.

Thanks!

svastarija commented 3 years ago

Could anyone post link to Hip_Mod_20191103_ENG_7102S ,all links are dead. thanks

Cryinman82 commented 2 years ago

Firmware also works on a INQMega PTZ381 https://www.banggood.com/2019-NEW-INQMEGA-PTZ381-HD-1080P-PTZ-360-Panoranic-Waterproof-IP-Camera-IR-Night-Version-Two-way-Audio-p-1542643.html?cur_warehouse=CN

IMG_20191101_220909 (2)

Thanks!

Hi! Is it possible to have the link of the good firmware who work? And if possible the how to? Thanks you by advance!

Cryinman82 commented 2 years ago

Firmware also works on a INQMega PTZ381 https://www.banggood.com/2019-NEW-INQMEGA-PTZ381-HD-1080P-PTZ-360-Panoranic-Waterproof-IP-Camera-IR-Night-Version-Two-way-Audio-p-1542643.html?cur_warehouse=CN

IMG_20191101_220909 (2)

Thanks!

Can you tell me which firmware you used? And the instructions link? Please!!!

csurf commented 1 year ago

@yomismo112 I have the same problem as you. I'm looking for a firmware bin file for my camera. My camera has the GK7102C chip, and un unknown image sensor. What are the specifications of your camera? I'm looking for any full eeprom image for the GK7102C that will at least allow me to reinstall U-Boot bootloader. I have tried flashing many images that I found here on github and on 4pda, but none of them have worked. All I see on the UART port is 'UGKMC'.

Wedmer commented 1 year ago

@csurf, can you provide photo of the board with readable labels on chip?

maartenjd commented 1 year ago

@csurf : I have put some FW-images (full and per partition) over here: https://www.dropbox.com/sh/buza1pkjqgbtcg5/AAA-Vcazu_2AYxdzk2GnHAxha?dl=0. It is the dump of an 8 MB image. 0.bin should be the u-boot image.

There is also the file fw0(HIP291G_Mod).img that I extracted from a HIP291G_Mod-fw-image and that also should contain the u-boot-loader.

As you have no serial access you will have to flash directly on the BIOS-chip.

csurf commented 1 year ago

@maartenjd thanks, but I'm fairly certain that those images won't work, since your camera is a GK7102S. I'm pretty sure that the GK7102C usese a different build that isn't compatible with either the GK7102 or GK7102S. It would be cool if someone who has access to a camera with a GK7102C and another variant could try uploading a different firmware to the GK7102C and see if it works.

At this point, I'm starting to wonder if my chip might be damaged since none of the firmware images I've been able to find online have worked. However, none of those images have been specifically for the GK7102C, so I still have some hope that I simply need the right image.

@Wedmer see pics pcb pcb2 cam

Wedmer commented 1 year ago

@csurf I've found firmware for GK7102C devices https://sv3c.com/fireware/

It looks like GK7102C was between GK7102S and GK72XX series.

csurf commented 1 year ago

@Wedmer interesting. I also previously found that same link, but the firmware appears to be in a special, proprietary package. I believe you must use their software in order to upgrade the firmware. I simply need the raw binary firmware image to flash to the SPI chip, but I do not know how to extract the pure firmware from those pkg / zip files.

paus56 commented 1 year ago

@csurf у вашей камеры: GK7102C + F37 CMOS sensor у меня есть две прошивки для GK7102C но в них нет поддержки F37 сенсора.. одна прошивка для флешь 8 MB, другая для флешь 16 MB какой размер вашей флешь памяти в камере ?