Closed Uiasdnmb closed 2 years ago
cjj25
commented
2 years ago Very interesting!
How were you able to obtain this log, which steps did you take? I'm assuming you telnet into the device and then try run the shell script manually?
When logging in via telnet (not running RTSPServer) what's the output of ps aux
Uiasdnmb
commented
2 years ago It's regular log.txt that's written onto SD card when booting the device normally (when i insert an empty card aka script is not executed).
I'm not able to telnet to the device without running the script, and when I do ps doesn't seem to accept aux argument (only raw command seems to work?).
Scenario 1: running the script
Scenario 2: running "trimmed script" that should only start the telnet.
cjj25
commented
2 years ago Everything looks as it should in that log, with the exception of maybe it's trying to do an update - can't quite tell.
Using the 'altered script', can you login and give me the output of ls /var/tmp/sd .. there are numerous checks in the YI binaries for certain files that will prevent from going into full production mode.
Uiasdnmb
commented
2 years ago It's Yi IoT Outdoor, also known as XY-R9520-V3. It's a static outdoor cam, no tilt or pan. It just stopped functioning randomly one day after a blackout I think.
There's nothing interesting in ls since only content of sd card is /wifi/config.sh to act as payload to turn on telnet, other things there get generated after boot.
I guess this is firmware dump (backup folder) right? 7.1.00.19A_201910181012 [corrupted].zip
I was also browsing around the filesystem but it doesn't tell me much since I don't know what to look for.
Since there's no audio cue after boot I tried to run amixer command but it only errors out with "amixer: can't load library ;libasound.so.2'".
I added the lib folder to trimmed script and if I also export LD_LIBRARY_PATH as in script then amixer works. But I still don't know how to play sample sound files (from /home/app/audio_file), I tried using /home/app/aacplay but this command doesn't seem to play anything.
cjj25
commented
2 years ago Thanks for sharing the firmware dump. I'll take a look tomorrow.
However, there is something in your log that might give us a clue as to what's going on. The blob that contains the product info might be corrupt or missing (notice the get_productinfo method failing in your log).
To check your audio, see my previous comment here.
cjj25
commented
2 years ago I've just looked into your firmware dump and the product info does appear to exist (mtdblock7) with the exception of it being 10 bytes larger than a previously submitted dump matching your firmware.
You're missing the device blob info in mtdblock6. This is a set of bytes that's passed to the driver so it knows how to control your device such as IR cut etc.
I'll post a link to a user submitted firmware backup.
In the mean time... here's something for you to try..
Do a fresh boot and telnet in, then do the following:
cd /var/tmp/sd/
mv wifi wifi_old
cd /home/app/
./init.shThen post the output here.
You'll need to take the SD card out and rename the folder back to wifi afterwards to enable the telnet hack again.
cjj25
commented
2 years ago A user posted their logs and device info with the same firmware here.
Notice the product information partition check.
If you download the backup.zip from above, copy the mtdblock6.bin to your sd.
BEWARE - THIS COULD BRICK YOUR DEVICE! Thankfully as your partition is empty, the risk is low.
Do the following:
cd /var/tmp/sd
dd if=./mtdblock6.bin of=/dev/mtdblock6
mgerald21
commented
2 years ago I own the same device XY-R9520-V3, but I'm unsure about the firmware version. The camera is currently unpaired and
/wifi/config.sh
is not executed. Any suggestions are welcome
cjj25
commented
2 years ago I own the same device XY-R9520-V3, but I'm unsure about the firmware version. The camera is currently unpaired and
/wifi/config.shis not executed. Any suggestions are welcome
What issues are you have with your camera? If they're not the same as this one (trying to get back to stock / factory reset) could you open another issue with more info, I'll be happy to help :)
cjj25
commented
2 years ago I'm eager to know how you get on with the mtdblock6 partition as it's something I've been planning to reverse engineer for a while (lack of time).
The blob is loaded into load_cpld_ssp which loads the device driver YI uses to interact with various aspects of the camera such as IR cut, light sensor (ADC) and pan tilt. The string of numbers each represent a function and/or GPIO pin map.
Here are some examples
Pan/Tilt = YES
Tuya [TA-R9820-K2](https://nullrefer.com/?https://expo.tuya.com/product/322496)/[TA-R9820-G1](https://nullrefer.com/?https://expo.tuya.com/product/459042) (FCC [XYTA-R9820-K2](https://fcc.report/FCC-ID/2APD7-R9820))
0x168 : 12232123100000000000000000000000
0x204 : 11111111110011000000000000000000Pan/Tilt = YES
XY/TA-R9820-F12, XY/TA-R9820-F11, XY/TA-R9820-F13, XY/TA-R9820- F14, XY/TA-R9820-K7, XY/TA-R9820-K8, XY/TA-R9820-K9, XY/TA-R9820-K10, XY/TA-R9820-Q11, IPC-A3610-A111, IPC/TA-A3610-XHR, XY/TA-R9520-V8, XY/TA- R9520-V9, IPC-R9520-V7, TA-A3410-R6, IPC-C3310-R7 , XY-W102R, TA-FD-BL6, TA-FD-BL7, TA-R9522-AFD FCC ID: 2APD7-XYTAR9820F12 https://fccid.io/2APD7-XYTAR9820F12/Internal-Photos/09-77622-IntPho-4381529
Firmware: 7.1.00.25A_202002271051
0x168 : 11131123100000000000000000000000
0x204 : 11111111110011000000000000000000Firmware: 7.1.00.19A_201910181012
0x168 : 11131123100000000000000000000000
0x204 : 11111111110011000000000000000000Note: Identical, firmware is probably interchangeable
Pan/Tilt = NO Possible PCB : Same as Victure SC210? Firmware: 7.1.00.19A_201910181012
0x168 : 21131113100000000000000000000000
0x204 : 11111111110011000000000000000000Notes compared to SC210 (which is pan tilt) 0x204 has the same layout - I believe this to be the GPIO map 0x168 differs - I believe this to be the product features map (so the software knows it has pan/tilt etc)
Uiasdnmb
commented
2 years ago I ran init.sh after removing the payload but it didn't do anything. It was actually stuck in an infinite loop of trying to update and failing, it never completed and kept running.
After 4 minutes which I think is the recording segment cutoff telnet got polluted with 12-28 14:15:44.165 mp4record.c:1063|record_file() mp4 file create failed that appeared every 0.04 second so I shut down the device at this point.
It didn't write anything to the log, everything was output in telnet window but it was full of invalid calls to /backup/cloudAPI that spit out their entire help manual and list of commands.
Copying mtdblock6 seemed to have helped - device boots with audio cue and pressing reset button does restart it into pairing mode. I can run the app and show it the QR code and it connects to wifi. After that though... I'm not sure if it's the apps fault or something is still wrong with the camera because pairing always times out and it doesn't show upp in camera list.
cjj25
commented
2 years ago Ok, well that's great news.
Unfortunately, I think your device is now linked / identifying itself as the camera we originally took that mtdblock6 from and YI has linked it to THEIR account.
However, all is not lost. Do you have a QR code on your camera? If so, what's the output / serial when scanned.
Check the camera for any serial numbers or IDs on the outside - post back.
Uiasdnmb
commented
2 years ago cjj25
commented
2 years ago Ok, try flash this version (attached) mtdblock6.zip
cjj25
commented
2 years ago We can also obtain the other DID value from the sniffing the data to the mobile app (if it's still paired to your account)
Uiasdnmb
commented
2 years ago Pairing still timing out, I think log is the same aside from updated device id. Sadly removing and trying to pair it again was one of the first thing I attempted so we won't be able to sniff it
cjj25
commented
2 years ago I think there might be something wrong with the Yi services at the moment.
@mgerald21 is having the exact same problem with a stock (brand new) camera.
I've just tried to pair two separate cameras here and they all timeout too.
I guess it's too early to tell whether the patch to your mtdblock6 has worked?
Uiasdnmb
commented
2 years ago Yeah I just wanted to report what's happening as soon as possible. Guess we have to give it a bit of time and I'll try to pair it again later, I was thinking about unpairing one of my working cams to see if it works but if you say ppl can't pair anything either I won't be doing that.
cjj25
commented
2 years ago Here's another report (21 hours ago) of similar problem on Yi Community forum.
More from August.. might have to tweak and investigate the firmware this end if still the same after 1 week.
cjj25
commented
2 years ago Just checking to see if you've had any luck yet?
Uiasdnmb
commented
2 years ago I reset my other camera (Smart IP Camera, XY-R9620-K2) firmware 7.1.00.19A_201910181012 and it works and pairs successfully (by the way payload works on it too, I only ran tried trimmed version but I assume you can run RTSP server on it as well).
I've compared logs of pairing and the difference seems to be that in working IP camera I get:
04-19 11:55:37.912 cloud.c:2303|webapi_do_reset_by_specified_server() now do reset
04-19 11:55:37.912 cloud.c:2315|webapi_do_reset_by_specified_server() cmd = /backup/cloudAPI -c 139 -keySec kdMxv_REDACTED_ -url https://plt-api-de.xiaoyi.com/v4/ipc/reset -uid TNPXGAB-_REDACTED_ -version 7.1.00.19A_201910181012 -mac E0:09:BF:_REDACTED_
12-30 14:34:22.679 cloud.c:2324|webapi_do_reset_by_specified_server() {"code":"20000"}
12-30 14:34:22.679 cloud.c:2330|webapi_do_reset_by_specified_server() webapi_do_reset success {"code":"20000"}
12-30 14:34:23.610 cloud.c:2426|webapi_do_login() now do login
12-30 14:34:23.611 cloud.c:2453|webapi_do_login() cmd = /backup/cloudAPI -c 138 -url "https://plt-api-de.xiaoyi.com/v4/ipc/on_line" (...)
12-30 14:34:24.416 cloud.c:2465|webapi_do_login() {"code":"20000", (...) }
12-30 14:34:24.417 cloud.c:2482|webapi_do_login() webapi_do_login success
then it does webapi_do_bindkey() and webapi_get_dev_info()While in broken cam I get webapi_do_reset_by_specified_server() {"code":"20243"} about 4 times before it gives up and never goes to login.
I tried to force call backup/cloudApi -c138 through telnet with mac and keysec from this device but it also returned 20243.
cjj25
commented
2 years ago Very interesting!
Now you can do the actual pairing, did you try the pairing with the original device blob I sent (mtdblock6) rather than the patched version?
Perhaps I could give you a mtdblock6 from a device I know to be 100% offline and never paired.
Uiasdnmb
commented
2 years ago Hope you didn't misunderstand, the broken camera still refuses to pair I just have another similar one lying around that has no issues so I just used it to see how logs of successful pairing look like.
cjj25
commented
2 years ago I've got a feeling it's checking the mac, keysec and uid/did on the server end.
Did you copy the EXACT line from the camera that does pair (including the uid) and try run it on the camera that fails?
Uiasdnmb
commented
2 years ago Tried few combinations, exact line from working camera, line with swapped MAC only, line with swapped keySec, line with same keySec. Only thing I accomplished is by running reset command with keySec from working cam it got removed from the app even though I used mac of broken one. It turns out that wasn't the best idea, looks like their server is messed up and enters some kind of corrupted state as now even the camera that worked refuses to pair and times out (also gets code 20243 in logs).
I'll try asking on official support forum see if they know or care.
cjj25
commented
2 years ago I've just done some digging in the firmware and it looks like the reset command does indeed remove act as an 'unpair' type of call.
However, there "on_line" endpoint might be what you really want and in the logs it's truncated.
This is the format for the call: %s -c 138 -url "%s/v4/ipc/on_line" -key %s -keySec %s -uid %s -version %s -ssid "%s" -mac %s -ip %s -signal_quality %d -packetloss %d -p2pconnect %d -p2pconnect_success %d -apmode %s -tfstat %d
The log mentioned cloudAPI but this is misleading, it's actually /home/app/cloud
Here's some other endpoints for you to investigate:
%s -c 145 -url "%s/vmanager/ipc/firmware/upgrade/silent" -did %s -sname %s -version %s
%s -c 139 -keySec %s -url %s/v4/ipc/reset -uid %s -version %s -mac %s
%s -c 137 -key %s -keySec %s -url %s/v4/ipc/qr_bind -uid %s
%s -c 138 -url "%s/v4/ipc/on_line" -key %s -keySec %s -uid %s -version %s -ssid "%s" -mac %s -ip %s -signal_quality %d -packetloss %d -p2pconnect %d -p2pconnect_success %d -apmode %s -tfstat %d
%s -c 311 -url %s/v4/ipc/check_did -uid %s -keySec %s
%s -c 142 -url %s/v4/ipc/deviceinfo -uid %s -keySec %s
%s -c 414 -url %s/v4/ipc/upload_data -uid %s -keySec %s -filename %s
%s -c 192 -url "%s/ipc/monitor/heartbeat" -did %s -version %s -mac %s -heart_time %llu -p2p_status %d
%s -c 144 -url "%s/ipc/firmware/update" -seq %d -did %s -currentCode %s -targetCode %s -region %s -status %d
%s -c 136 -url %s/v2/ipc/sync_time Notice the QR bind? Try this...
strings mtdblock6More notes:
qr_bind expects to receive a 'code' in JSON(maybe?) for it to be successfulsprintf so even though the output is truncated on the screen, if you use my strace binary I compiled for this chipset, then you'll be able to see the full command output.Uiasdnmb
commented
2 years ago Isn't UID the User ID (aka account that tried to pair w/ device)? Pretty sure that info comes from the QR code and there's no issue with fetching that. Right now I'm gonna assume it's server fault as I did repeat pairing calls that succeeded before but they just returned error code from server. Maybe I'll try playing with it a bit tomorrow but I hope there's some kind of meaningful feedback from the official forum (I'll link post here when it appears bc apparently they have to approve it).
cjj25
commented
2 years ago I assumed it was the user ID too but the logs appear to give different information..
12-28 16:06:28.106 cloud.c:2315|webapi_do_reset_by_specified_server() cmd = /backup/cloudAPI -c 139 -keySec 8lKlQBD766fw6Djt -url https://plt-api-de.xiaoyi.com/v4/ipc/reset -uid TNPXGAB-523068-MVNLZ -version 7.1.00.19A_201910181012 -mac 44:EF:BF:_REDACTED_
When I sniff the packets from the Android APP for paired cameras, each cam has a unique uid..
Uiasdnmb
commented
2 years ago I don't seem to be able to feed any arguments into /home/app/cloud, it just tries to invoke reset 3 times then says "pairing timed out".
Endpoints don't seem to matter much, I get 20243 returned from everything aside from sync time and update firmware (and check_did returns 404). I also tried making new account and different phone but to no avail.
I think the key to it remains running a successful reset but it might be messed up on server side because as I mentioned - I unpaired and made working cam useless by running cloudAPI reset with its keySec and UID on broken one. I guess if you're willing to kill one of your own cams you can try it yourself.
cjj25
commented
2 years ago I'm happy to give this a whirl for you, I have around 5 donor cameras floating around that I used for reverse engineering.
To ensure we don't waste any time / black listing the DID or UID, can you summarise 1. the initial problem and 2. the things you've tried (commands) and then I'll work from there?
I don't believe the 20243 command is a ban (I hope) but more of a status, possibly an unpaired status.
I'll capture the packets for the pairing processing and see exactly what's being sent so we can try make sense of these statuses a bit more.
Uiasdnmb
commented
2 years ago I don't know what else can I say, I'll just try to summarize everything:
Whether I include payload doesn't seem to matter but if I do I still have to show the QR code before it's executed and telnet opens up.
Uiasdnmb
commented
2 years ago Was playing around a little and noticed that I'm able to invoke reset command on global(?) and us servers (plt-api.xiaoyi.com and plt-api-us.xiaoyi.com) as well and they returned 20000 properly, but after a while they started returning 20243 as well which leads me even further to believe that it's a corrupted state on server side which leaves device in some kind of unpaired limbo.
I was however able to pair cam2 to US before it became corrupted since I only ran those commands for cam1. I think my cam2 is now busted on eu server and cam1 is irredeemable since its original uid and keysec is gone and I busted the ones from patched mtdblock on all servers. Perhaps patching in SN without updating UID and keysec was not the best idea since those are the variables that are being sent to the server.
cjj25
commented
2 years ago Not had chance to look into this yet as working on different project.
Great research you've done though! The camera with the different status, maybe you can pair this one now?
Uiasdnmb
commented
2 years ago Cam1 still doesn't pair anywhere. I've actually had a bit of regret earlier as I realized I made a mistake (before posting here) - SD card I was using had logs of cam1 from when it was working but I formatted it to play around with scripts and now it's unrecoverable. Now I know it contained keySec and UID that could be used to revive the cam.
cjj25
commented
2 years ago I feel your pain!
Did you do a low level format or high level on the SD card? Most formatting tools do high level by default which leaves the original data behind.
Perhaps try a tool like Recuva or GetDataBackNTFS / FAT for Windows or PhotoRec for linux...
It's worth a try?
Uiasdnmb
commented
2 years ago I did try data recover but as I said it's the card that I was using to push scripts backups etc. onto. Unluckily log is gone but 30gb of old recordings remained intact.
cjj25
commented
2 years ago Give the support team here a shot (the live chat) https://forum.yitechnology.com/t/pairing-has-timed-out-for-all-4x-newly-yi-home-camera-1080p-ai/5832/7
Don't mention any of what we've done... but report back.
I've just tried to pair 4 cameras, all saying "Pairing has timed out"
What are your cameras branded as? Mine are 'Cacagoo'
Uiasdnmb
commented
2 years ago They don't appear to have any brand printed on them, just your default OEM design I got from Aliexpres.
cjj25
commented
2 years ago @Uiasdnmb, did you manage to make any progress on this / contact the support?
Uiasdnmb
commented
2 years ago Nope, I gave up and bought cameras from other brand. Support was of no help and were just deflective since they're third party cams.
I guess we've learned that it's possible to recreate damaged mtdblock6 if you pull the sdcard and get UID and keysec from logs (or from a backup), and as long as you have NOT deleted cam from the app it should work again. Re-pairing it is just a mess and cams seem to get randomly banned or stuck in pairing limbo.
cjj25
commented
2 years ago Expensive research but at least we learned something. I use Reolink cameras as my main security cameras but the cheapo ones for nature cameras.
Thanks for the update
Not sure how appropriate this is but this is the only place on the entire internet where anyone discusses this device.
My camera is on 7.1.00.19A_201910181012 fw and it appears to be soft bricked - doesn't react to reset key, when it boots there's no audio cue and never shows up in Yi IoT app.
It does connect to the wifi (can ping it no problem), it toggles IR light and it does print to the log file as well.
Click to see log file
```log 10-24 10:24:08.077 dispatch.c:4480|main() sysversion:7.1.00.19A_201910181012 10-24 10:24:08.329 dispatch.c:727|get_productinfo() 10-24 10:24:08.329 dispatch.c:731|get_productinfo() product info partition exist! 10-24 10:24:08.329 dispatch.c:755|get_productinfo() product info partition is empty, check if backup exist! 10-24 10:24:08.329 dispatch.c:780|get_productinfo() backup not exist, read tmp files! 10-24 10:24:08.329 dispatch.c:383|get_tmp_did() did not exist, read tmp files 10-24 10:24:08.329 cloud.c:5399|sys_init() open share mem ok 10-24 10:24:08.650 dispatch.c:1209|get_config() got sn(UloZ8hO2..._REDACTED_) 10-24 10:24:08.650 dispatch.c:1210|get_config() got pwd(_REDACTED_) 10-24 10:24:08.650 dispatch.c:1211|get_config() got ssid(_REDACTED_) 10-24 10:24:08.650 dispatch.c:1212|get_config() got tnp_init_string(MMFBJPLJICFGKJHFOJFFPMELHPCFFAGCHEEJKPIDINBKDABIPMIIAONIPBCLBBKNPLKPDKPENIDOAJCP) 10-24 10:24:08.731 dispatch.c:4574|main() hw_type(2) 10-24 10:24:08.731 dispatch.c:4583|main() open_cpld fail 10-24 10:24:08.731 dispatch.c:4608|main() ioctl(536899605) error(25),Inappropriate ioctl for device 10-24 10:24:08.731 dispatch.c:4609|main() ioctl(536899606) error(25),Inappropriate ioctl for device 10-24 10:24:08.731 dispatch.c:4610|main() ioctl(536899603) error(25),Inappropriate ioctl for device 10-24 10:24:08.731 dispatch.c:4637|main() open_ptz fail 10-24 10:24:08.733 dispatch.c:501|choose_server() in choose_server, region_id = 1, api_server = https://plt-api.xiaoyi.com, sname = RealPJ, dlproto = micn 10-24 10:24:08.733 dispatch.c:501|choose_server() in choose_server, region_id = 16, api_server = https://plt-api-de.xiaoyi.com, sname = RealPJ, dlproto = mieu 10-24 10:24:08.733 dispatch.c:4683|main() ioctl(536899612) error(25),Inappropriate ioctl for device 10-24 10:24:08.734 dispatch.c:4731|main() init ok, cost time(656 ms) 10-24 10:24:08.779 mp4record.c:1293|main() recordevent_init finish 10-24 10:24:09.018 p2p_tnp.c:6741|main() fshare_open ok 10-24 10:24:09.324 dispatch.c:2532|do_mq_process() dispatch got (0x7f) 10-24 10:24:09.324 dispatch.c:4368|do_mq_process() Process (0x7f) end 10-24 10:24:09.324 p2p_tnp.c:2055|p2p_set_tnp_init_status() p2p_set_tnp_init_status 1 send_msg ok! 10-24 10:24:09.505 watch_process.c:116|get_watch_info() check_interval=10 12-12 09:35:46.213 watch_process.c:134|get_watch_info() process=dispatch;cmd=cd /home/app;./dispatch &; 12-12 09:35:46.213 watch_process.c:134|get_watch_info() process=cloud;cmd=cd /home/app;./cloud &; 12-12 09:35:46.214 watch_process.c:134|get_watch_info() process=rmm;cmd=reboot; 12-12 09:35:46.214 watch_process.c:134|get_watch_info() process=p2p_tnp;cmd=cd /home/app;./p2p_tnp &; 12-12 09:35:46.214 watch_process.c:134|get_watch_info() process=mp4record;cmd=cd /home/app;./mp4record &; 12-12 09:35:46.214 watch_process.c:134|get_watch_info() process=arp_test;cmd=cd /home/app;./arp_test &; 12-12 09:35:46.214 watch_process.c:134|get_watch_info() process=oss;cmd=cd /home/app;./oss &; 12-12 09:35:46.551 dispatch.c:2316|p_worker() DISPATCH_SET_DEFAULT_TIME 1639301746 12-12 09:35:46.551 mp4record.c:1304|main() init_finish(1), start_with_reset(0) 12-12 09:35:46.551 mp4record.c:1312|main() fshare_open ok 12-12 09:35:46.551 dispatch.c:1715|do_monitor_wifi() ioctl(536899588) error(25),Inappropriate ioctl for device 12-12 09:35:46.551 dispatch.c:1716|do_monitor_wifi() ioctl(536899594) error(25),Inappropriate ioctl for device 12-12 09:35:46.551 dispatch.c:1718|do_monitor_wifi() wifi disconnected, now reconnect wifi 12-12 09:35:46.551 dispatch.c:1630|reset_wifi_module() now reset wifi module 12-12 09:35:53.987 rmm.c:1401|msg_proc() pid[820] 12-12 09:35:54.903 dispatch.c:1730|do_monitor_wifi() wpa connected , now dhcp 12-12 09:35:55.250 dispatch.c:1732|do_monitor_wifi() wpa connected , now dhcp finish 12-12 09:35:55.869 watch_process.c:171|check_watch_info() cloud crashed! 12-12 09:35:55.869 watch_process.c:171|check_watch_info() p2p_tnp crashed! 12-12 09:35:55.869 watch_process.c:171|check_watch_info() arp_test crashed! 12-12 09:35:56.277 dispatch.c:1478|check_wifi_connect() bssid(70:4f:57:d9:ee:a1) 12-12 09:35:56.277 dispatch.c:1500|check_wifi_connect() ip(192.168.0.150) 12-12 09:35:56.289 dispatch.c:1511|check_wifi_connect() gw(192.168.0.1) 12-12 09:35:57.345 dispatch.c:1520|check_wifi_connect() gwmac(24:4B:_REDACTED_) 12-12 09:35:57.361 dispatch.c:1530|check_wifi_connect() mask(255.255.255.0) 12-12 09:35:57.392 dispatch.c:1540|check_wifi_connect() mac(44:EF:_REDACTED_) 12-12 09:35:57.535 dispatch.c:1561|check_wifi_connect() signal_quality(81) 12-12 09:35:57.535 dispatch.c:1755|do_monitor_wifi() ioctl(536899585) error(25),Inappropriate ioctl for device 12-12 09:35:57.536 dispatch.c:1756|do_monitor_wifi() ioctl(536899594) error(25),Inappropriate ioctl for device 12-12 09:35:58.593 dispatch.c:1586|check_wifi_connect() signal_quality(88) 12-12 09:36:05.878 watch_process.c:171|check_watch_info() cloud crashed! 12-12 09:36:05.885 watch_process.c:171|check_watch_info() p2p_tnp crashed! 12-12 09:36:06.010 cloud.c:5399|sys_init() open share mem ok 12-12 09:36:06.288 cloud.c:2113|need_update() cmd = /backup/cloudAPI -c 145 -url "https://plt-api-de.xiaoyi.com/vmanager/ipc/firmware/upgrade/silent" -did -sname RealPJ -version 7.1.00.19A_201910181012 12-12 09:36:06.288 cloud.c:5288|yi_sync_time() cmd=/backup/cloudAPI -c 136 -url http://plt-api-de.xiaoyi.com/v2/ipc/sync_time 12-12 09:36:06.289 p2p_tnp.c:6741|main() fshare_open ok 12-12 09:36:06.407 dispatch.c:2532|do_mq_process() dispatch got (0x7f) 12-12 09:36:06.407 dispatch.c:4368|do_mq_process() Process (0x7f) end 12-12 09:36:06.407 p2p_tnp.c:2055|p2p_set_tnp_init_status() p2p_set_tnp_init_status 1 send_msg ok! 12-12 09:36:06.407 dispatch.c:2532|do_mq_process() dispatch got (0x7f) 12-12 09:36:06.408 dispatch.c:4368|do_mq_process() Process (0x7f) end 12-12 09:36:06.408 p2p_tnp.c:2055|p2p_set_tnp_init_status() p2p_set_tnp_init_status 2 send_msg ok! 12-12 09:36:06.408 cloud.c:2121|need_update() ret = 12-12 09:36:06.597 cloud.c:5295|yi_sync_time() {"code":"20000","time":1640553676100} 12-12 09:36:06.597 cloud.c:520|cloud_set_time() msg snd success 12-12 09:36:06.598 cloud.c:5307|yi_sync_time() yi_sync_time ok! 12-12 09:36:06.598 cloud.c:5383|sync_time() sync_time ok! 12-12 09:36:06.598 dispatch.c:2532|do_mq_process() dispatch got (0x71) 12-12 09:36:06.603 cloud.c:4435|yi_proc() yi_proc ok, update time[100] 12-12 09:36:06.609 cloud.c:2426|webapi_do_login() now do login 12-12 09:36:06.610 cloud.c:2453|webapi_do_login() cmd = /backup/cloudAPI -c 138 -url "https://plt-api-de.xiaoyi.com/v4/ipc/on_line" -key 0Jt0i7MbMMV2M0e -keySec -uid -version 7.1.00.19A_201910181012 -ssid "_REDACTED_" -mac 44:EF:BF:_REDACTED_ -ip 192.168.0.150 -signal_quality 88 -packetloss 0 -p2pconnect 0 -p2pconnect_success 0 -apmode false -tfstat 10000 12-26 21:21:16.100 dispatch.c:2608|do_mq_process() DISPATCH_SET_TIME 1640553676 12-26 21:21:16.100 dispatch.c:4368|do_mq_process() Process (0x71) end 12-26 21:21:16.101 dispatch.c:2532|do_mq_process() dispatch got (0x92) 12-26 21:21:16.101 dispatch.c:3078|do_mq_process() set DISPATCH_SET_PANORAMA_CAPTURE_STATE [0x0] 12-26 21:21:16.101 dispatch.c:4368|do_mq_process() Process (0x92) end 12-26 21:21:16.110 cloud.c:2465|webapi_do_login() 12-26 21:21:17.383 rmm.c:705|motion_proc() pid[952] 12-26 21:21:17.453 motion_detect.c:84|modet_init() modet_init img wid-hei:320-192, thresh:2 12-26 21:21:17.466 mp4record.c:729|record_init() got video main vps=0 sps=34 pps=10, ts=4171137679, framerate=0 width=0 height=0 12-26 21:21:17.534 mp4record.c:751|record_init() got video sub sps=33 pps=9, ts=4171137754, framerate=20 width=640 height=360 12-26 21:21:17.534 mp4record.c:782|record_init() got audio aac config, ts=4171136400 12-26 21:21:17.534 mp4record.c:1330|main() mp4 mode got sd exist 12-26 21:21:17.550 mp4record.c:995|record_file() record_init finish 12-26 21:21:17.550 mp4record.c:729|record_init() got video main vps=0 sps=34 pps=10, ts=4171137679, framerate=0 width=0 height=0 12-26 21:21:17.552 mp4record.c:751|record_init() got video sub sps=33 pps=9, ts=4171137754, framerate=20 width=640 height=360 12-26 21:21:17.553 mp4record.c:782|record_init() got audio aac config, ts=4171136400 12-26 21:21:20.786 cloud.c:2121|need_update() ret = 12-26 21:21:25.811 cloud.c:2121|need_update() ret = 12-26 21:21:27.147 cloud.c:2465|webapi_do_login() 12-26 21:21:30.839 cloud.c:2121|need_update() ret = 12-26 21:21:35.866 cloud.c:2121|need_update() ret = 12-26 21:21:39.292 dispatch.c:2532|do_mq_process() dispatch got (0x400e) 12-26 21:21:39.292 dispatch.c:4368|do_mq_process() Process (0x400e) end 12-26 21:21:45.175 cloud.c:2465|webapi_do_login() 12-26 21:21:58.805 mp4record.c:938|send_mp4rcd_heartbeat_msg() msg snd success 12-26 21:21:58.805 dispatch.c:2532|do_mq_process() dispatch got (0xe7) 12-26 21:21:58.805 dispatch.c:4104|do_mq_process() got rcd heartbeat 12-26 21:21:58.805 dispatch.c:4368|do_mq_process() Process (0xe7) end 12-26 21:21:59.176 cloud.c:4538|yi_proc() webapi_do_login fail 12-26 21:22:12.199 dispatch.c:2532|do_mq_process() dispatch got (0x400e) 12-26 21:22:12.199 dispatch.c:4368|do_mq_process() Process (0x400e) end 12-26 21:22:15.387 watch_process.c:171|check_watch_info() cloud crashed! 12-26 21:22:15.428 cloud.c:5399|sys_init() open share mem ok 12-26 21:22:15.679 cloud.c:5288|yi_sync_time() cmd=/backup/cloudAPI -c 136 -url http://plt-api-de.xiaoyi.com/v2/ipc/sync_time 12-26 21:22:15.679 cloud.c:2113|need_update() cmd = /backup/cloudAPI -c 145 -url "https://plt-api-de.xiaoyi.com/vmanager/ipc/firmware/upgrade/silent" -did -sname RealPJ -version 7.1.00.19A_201910181012 12-26 21:22:15.679 cloud.c:2121|need_update() ret = 12-26 21:22:15.903 cloud.c:5295|yi_sync_time() {"code":"20000","time":1640553735869} 12-26 21:22:15.903 cloud.c:520|cloud_set_time() msg snd success 12-26 21:22:15.904 cloud.c:5307|yi_sync_time() yi_sync_time ok! 12-26 21:22:15.904 cloud.c:5383|sync_time() sync_time ok! 12-26 21:22:15.100 dispatch.c:2532|do_mq_process() dispatch got (0x71) 12-26 21:22:15.100 dispatch.c:2608|do_mq_process() DISPATCH_SET_TIME 1640553735 12-26 21:22:15.100 dispatch.c:4368|do_mq_process() Process (0x71) end 12-26 21:22:15.103 cloud.c:4435|yi_proc() yi_proc ok, update time[119] 12-26 21:22:15.106 cloud.c:2426|webapi_do_login() now do login 12-26 21:22:15.106 cloud.c:2453|webapi_do_login() cmd = /backup/cloudAPI -c 138 -url "https://plt-api-de.xiaoyi.com/v4/ipc/on_line" -key 0Jt0i7MbMMV2M0e -keySec -uid -version 7.1.00.19A_201910181012 -ssid "_REDACTED_" -mac 44:EF:BF:_REDACTED_ -ip 192.168.0.150 -signal_quality 88 -packetloss 0 -p2pconnect 0 -p2pconnect_success 0 -apmode false -tfstat 10000 12-26 21:22:15.108 dispatch.c:2532|do_mq_process() dispatch got (0x92) 12-26 21:22:15.109 dispatch.c:3078|do_mq_process() set DISPATCH_SET_PANORAMA_CAPTURE_STATE [0x0] 12-26 21:22:15.109 dispatch.c:4368|do_mq_process() Process (0x92) end 12-26 21:22:15.129 cloud.c:2465|webapi_do_login() 12-26 21:22:19.796 cloud.c:2121|need_update() ret = 12-26 21:22:24.845 cloud.c:2121|need_update() ret = 12-26 21:22:29.883 cloud.c:2121|need_update() ret = 12-26 21:22:30.164 cloud.c:2465|webapi_do_login() 12-26 21:22:34.900 cloud.c:2121|need_update() ret = 12-26 21:22:39.193 mp4record.c:938|send_mp4rcd_heartbeat_msg() msg snd success 12-26 21:22:39.193 dispatch.c:2532|do_mq_process() dispatch got (0xe7) 12-26 21:22:39.193 dispatch.c:4104|do_mq_process() got rcd heartbeat 12-26 21:22:39.193 dispatch.c:4368|do_mq_process() Process (0xe7) end 12-26 21:22:44.300 dispatch.c:2532|do_mq_process() dispatch got (0x400e) 12-26 21:22:44.300 dispatch.c:4368|do_mq_process() Process (0x400e) end 12-26 21:22:48.196 cloud.c:2465|webapi_do_login() 12-26 21:23:04.197 cloud.c:4538|yi_proc() webapi_do_login fail 12-26 21:23:14.608 watch_process.c:171|check_watch_info() cloud crashed! 12-26 21:23:14.625 cloud.c:5399|sys_init() open share mem ok 12-26 21:23:14.822 cloud.c:5288|yi_sync_time() cmd=/backup/cloudAPI -c 136 -url http://plt-api-de.xiaoyi.com/v2/ipc/sync_time 12-26 21:23:14.822 cloud.c:2113|need_update() cmd = /backup/cloudAPI -c 145 -url "https://plt-api-de.xiaoyi.com/vmanager/ipc/firmware/upgrade/silent" -did -sname RealPJ -version 7.1.00.19A_201910181012 12-26 21:23:14.822 cloud.c:2121|need_update() ret = 12-26 21:23:14.963 cloud.c:5295|yi_sync_time() {"code":"20000","time":1640553795835} 12-26 21:23:14.963 cloud.c:520|cloud_set_time() msg snd success 12-26 21:23:14.963 cloud.c:5307|yi_sync_time() yi_sync_time ok! 12-26 21:23:14.963 cloud.c:5383|sync_time() sync_time ok! 12-26 21:23:15.100 dispatch.c:2532|do_mq_process() dispatch got (0x71) 12-26 21:23:15.100 dispatch.c:2608|do_mq_process() DISPATCH_SET_TIME 1640553795 12-26 21:23:15.100 dispatch.c:4368|do_mq_process() Process (0x71) end 12-26 21:23:15.102 cloud.c:4435|yi_proc() yi_proc ok, update time[20] 12-26 21:23:15.103 dispatch.c:2532|do_mq_process() dispatch got (0x92) 12-26 21:23:15.103 dispatch.c:3078|do_mq_process() set DISPATCH_SET_PANORAMA_CAPTURE_STATE [0x0] 12-26 21:23:15.103 dispatch.c:4368|do_mq_process() Process (0x92) end 12-26 21:23:15.105 cloud.c:2426|webapi_do_login() now do login 12-26 21:23:15.105 cloud.c:2453|webapi_do_login() cmd = /backup/cloudAPI -c 138 -url "https://plt-api-de.xiaoyi.com/v4/ipc/on_line" -key 0Jt0i7MbMMV2M0e -keySec -uid -version 7.1.00.19A_201910181012 -ssid "_REDACTED_" -mac 44:EF:BF_REDACTED_ -ip 192.168.0.150 -signal_quality 88 -packetloss 0 -p2pconnect 0 -p2pconnect_success 0 -apmode false -tfstat 10000 12-26 21:23:15.152 cloud.c:2465|webapi_do_login() 12-26 21:23:16.843 dispatch.c:2532|do_mq_process() dispatch got (0x400e) 12-26 21:23:16.844 dispatch.c:4368|do_mq_process() Process (0x400e) end 12-26 21:23:17.154 motion_detect.c:454|modet_process() small action[0/1605] (small:1)! msarr[24][40]: 94, cnt:2/3, thresh:65, time:1640553797 sec 12-26 21:23:19.930 cloud.c:2121|need_update() ret = 12-26 21:23:20.469 mp4record.c:938|send_mp4rcd_heartbeat_msg() msg snd success 12-26 21:23:20.471 dispatch.c:2532|do_mq_process() dispatch got (0xe7) 12-26 21:23:20.471 dispatch.c:4104|do_mq_process() got rcd heartbeat 12-26 21:23:20.471 dispatch.c:4368|do_mq_process() Process (0xe7) end 12-26 21:23:24.951 cloud.c:2121|need_update() ret = 12-26 21:23:25.183 cloud.c:2465|webapi_do_login() 12-26 21:23:25.671 motion_detect.c:418|modet_process() IsMotion(1/1719)(small:3)------ y-x[20][8]: ms-cnt(thresh):131(ave:86)-13/48(65-6), msSta(60-0):56-21-27-42-85-90-248 time:1497(1640553805-671524). . discd:1, nt:0 12-26 21:23:25.763 motion_detect.c:284|modet_isBiggerMove() Bigger move. old:0, new:28, thresh:20. ms:0-179 oldtick:0 now:1498 12-26 21:23:25.764 rmm.c:865|motion_proc() ###fmy: got a new motion start pause_motion =0 motion =1 unlock_motion=2098 12-26 21:23:25.766 rmm.c:876|motion_proc() send_motion_start_msg. old:28, new:28 12-26 21:23:25.768 dispatch.c:2532|do_mq_process() dispatch got (0x7c) 12-26 21:23:25.768 dispatch.c:2687|do_mq_process() g_dispatch_info.mmap_info->motion_type =0, motion_time =[1640553805] 12-26 21:23:25.769 dispatch.c:4368|do_mq_process() Process (0x7c) end 12-26 21:23:25.772 rmm.c:615|send_motion_start_msg() msg snd success ```What's most relevant is I was able to run this script to extract the firmware backup AND run RTSPServer without problems.
Is there anyway to force it (through telnet or by reuploading firmware) back to factory settings so it's possible to pair it with IoT app again?