no1knows commented 7 years ago

I'm trying to hack the XiaoFang 1080p camera (i.e. this: http://www.gearbest.com/ip-cameras/pp_487830.html)

I've got root access over serial and worked out what filename to include on the microSD (that gets launched on insert): "snx_autorun.sh" so I can now easily change the root password and launch telnetd. It already runs boa web server (albeit with no content to serve, yet).

fritz-smh - could you give me some pointers on compiling the rtsp binary so I can create a version for the XiaoFang?

mitchelp commented 7 years ago

Or with simple bash script?

jonnycastaway commented 7 years ago

@mitchelp yes, thats all possible from now! a little hint i came across by my testings. the best results comes out when you first take the led on and then the ir_cut lens and vice versa to disable all.

jonnycastaway commented 7 years ago

And here a little Summary of my work today:

the tools resides in /bin

ir_init process - checked: gpio_ms1 -n 2 -m 1 -v 0 gpio_aud write 1 1 0 gpio_aud write 0 2 1 gpio_aud write 1 0 0

ir_led - checked: on gpio_aud write 1 0 1 off gpio_aud write 1 0 0

ir_cut lens - checked: on gpio_ms1 -n 2 -m 1 -v 1 off gpio_ms1 -n 2 -m 1 -v 0

light sensor - checked: gpio_aud read 2 1 is day, 0 then the dark night rises ;-)

finished for today, i'm going home now

vicfergar commented 7 years ago

Great work @jonnycastaway!! 👍

It would be nice to have another daemon that checks continuously the light sensor and set "ir cut lens" and "ir led" according to the returned value. What do you think??

dmolner commented 7 years ago

Do you thing is possible the image no in BW? all time colour?

no1knows commented 7 years ago

Impressive stuff, @jonnycastaway!

@vicfergar judging by the console output of iSC3S, that's exactly what it did - periodically read the light sensor and switch on the IR led and filter when it got dark enough. I'll run a few tests to see if there's enough logging output to work out the default thresholds that iSC3S uses.

GB505 commented 7 years ago

What about being able to change the time embedded into the video files / feed so it's not in Chinese time. Even enabling NTP so it can update the date and time from a NTP Source ?

jonnycastaway commented 7 years ago

@no1knows for the lightsensor there is no threshold. iSC3S did the same i did: read the value from gpio and if 1 comes back it is day and otherwise its night. i think in 2 hours i have little time to write a script that we can start from rc.local etc. in background that automatically reads the gpio and if it's night, switch the ir_leds and the ir_cut lens on. i think thats not a big task. read lightsensor, store returned data in a variable, check if it's 0 or 1 and switch the ir-stuff, sleep a time, read lightsensor again, check if the return data is equal the older data and if not switch the ir-stuff again. this is exactly what the ir_ctl example from the sdk did.

samtap commented 7 years ago

@GB505 ntpdate is already available but there's no zoneinfo. You need to specify a timezone-offset (from China I believe) in /etc/TZ. I'm working on a script to automate it.

It's probably quite straightforward, given all the example code, to integrate ir-filter control in the rtsp server binary. It would perform much better (low detection time) compared to running some script every five seconds. Did you guys already notice there're two usable video devices? Only one has the timestamp overlay.

jonnycastaway commented 7 years ago

@dmolner you have a little error in your thinking ;-) the sensor switches not to BW. It's all time colour. even when the ir_cut lens is active. the BW colour comes from this:

There is not enough light for the sensor but the sensor can "see" infrared light. so we power on some ir-leds that lights up things like a flashlight. the ir-spectrum is very broad but the ir-led emits only a very small piece of the sprectrum. and so the sensor "see" only this small piece and thats why ist shows BW. You can test it when you let the ir_led and the ir_cut lens on and then got with a flashlight in the dark room an lighten up anything, its coloured except the rest thats in the dark ;-)

dmolner commented 7 years ago

@jonnycastaway Thank you for the information.

If I unplug the leds and ir-cut I can see the image in color in the night? I use a camera for weather and prefer color.

jonnycastaway commented 7 years ago

@dmolner yes, let ir-leds and ir-cut disabled and all is done when there is enough light for the sensor. the problem is that the camera-sensor takes the light thats been reflected by an object and digitize it. is there not nough light reflected (because its dark outside) the sensor can not take this light. the other point is the light sensitivity of the sensor and the objective. when the daylight or the lamp in the room is not enough we power up the ir-led. why ir? because humans can't see ir-light. but the sensor can. and voila, enough reflected (ir) light for the sensor. But while the sprectrum of the ir-led, in contrast to our visible light, is so small the sensor see no colours. on this site: http://www.vividlight.com/articles/2915.htm is a graphic where you can see the spectrums. i hope that clears the question a bit.

no1knows commented 7 years ago

Here's a script to check the status of the light sensor every three seconds and turn on/off the IR leds and filter depending on the result:

#!/bin/sh
echo "IR script started"

# ir_init
gpio_ms1 -n 2 -m 1 -v 0
gpio_aud write 1 1 0
gpio_aud write 0 2 1
gpio_aud write 1 0 0

# ir loop
IR_ON=0
while :
do
    DAY="$(gpio_aud read 2)"
    if [ $DAY -eq 1 ]
    then
        if [ $IR_ON -eq 1 ]
        then
            gpio_aud write 1 0 0
            gpio_ms1 -n 2 -m 1 -v 0
            IR_ON=0
        fi
    else
        if [ $IR_ON -eq 0 ]
        then
        gpio_aud write 1 0 1
        gpio_ms1 -n 2 -m 1 -v 1
        IR_ON=1
        fi
    fi
    sleep 3
done

Just pop it in /etc/rtsp/ir.sh and then chmod a+x /etc/rtsp/ir.sh

To have it start up on boot, add the following to /etc/init.d/rc.local:

echo "Start IR script..."
/etc/rtsp/ir.sh &

jonnycastaway commented 7 years ago

@no1knows hey cool, but i think you should implement a variable for the past DAY value. so you can check it to the actual DAY value and only change gpios when its not equal.

i think like this (but bash scripting is not my thing):

!/bin/sh

dn_past=1 dn_act=1

gpio_ms1 -n 2 -m 1 -v 0 gpio_aud write 1 1 0 gpio_aud write 0 2 1 gpio_aud write 1 0 0

while : do

dn_act=$( gpio_aud read 2 )

if [ "$dn_act" != "$dn_past" ]
then
    if [ "$dn_act" = "0" ]
    then
        gpio_aud write 1 0 1
        gpio_ms1 -n 2 -m 1 -v 1
    else
        gpio_ms1 -n 2 -m 1 -v 0
        gpio_aud write 1 0 0
    fi
    dn_past=$dn_act
fi
sleep 3

done

no1knows commented 7 years ago

@jonnycastaway good idea - see edited code above! I also added the ir_init commands.

jonnycastaway commented 7 years ago

@no1knows perfect, i tested it and its perfect!

samtap commented 7 years ago

I've uploaded an archive containing my current work here: https://mega.nz/#!eN4DzApJ!ZpHGRUTriSk9wn7ygr7e-wOdAqaHpqXtCHkNdPkhQs8

As long as we don't have a reliable way to flash original images as a recovery mechanism, I want to make as little changes as possible to system files. It's far too easy to make a mistake in a script and brick the device (or at least cause a lot of work to redo everything after a factory reset). So I'm using the sdcard for all hacks. This is safer since you can mount it somewhere else to correct mistakes etc, as a last resort you can always put a vfat-formatted card in the device to start a telnetd with the snx_autorun.sh trick (been doing that a LOT during development!)

Usage

Extract the archive to an sdcard with a single ext2-formatted partition. I know this is inconvenient for Windows users but a Linux device needs a Linux filesystem :P
Place fang_hacks.sh in /etc and rc.local in /etc/init.d (feel free to modify to your liking) For the time being you'll need the snx_autorun.sh trick once, to place these two files on the device. Use wget, put them on the card with snx_autorun.sh or manually mount the ext2-formatted card to copy them over.
Reboot

The first time the script runs, it patches a file in /etc/hotplug to enable automatic mounting of ext2 volumes. You can also set the TZ but I need to make a conversion function to account for the weird offset (I'm using GMT-1 in TZ, while I'm actually in GMT+1 zone). Note that you could do the first run manually, if it fails you'll still have telnetd on port 23 to recover. When finished it places firstrun_completed in /etc so remove this file if you want to re-apply.

The script then runs everything in the /etc/scripts folder on the sdcard. Currently there're a couple of scripts to stop cloud stuff, start telnetd on port 2323 and run snx_rtsp_server. The telnetd on port 2323 will take you directly into the right environment so no need to mess with PATH, LD_LIBRARY_PATH etc.

Included

snx_rtsp_server
snx_ir_ctl
busybox with many addons like tcpsvd, ftpd, nc I can trivially include other stuff if there're any requests?

DISCLAIMER

This is work in progress! Obviously it's been barely tested at all so please give it a try and don't get mad when something breaks ;-)

Next steps

Start a github project?
Script improvements for robustness / logging
Get rid of hardcoded /media/mmcblk0p1 path
Manage wpa_supplicant, currently cloud apps still run for ~ 30 secs to get wlan0 up.
Create a noob-friendly sdcard image (including a small vfat partition with snx_autorun.sh to bootstrap everything)
Add more scripts and applications :-)

vicfergar commented 7 years ago

Hi everybody,

I'm trying to reproduce these steps in my xiaofang camera. I can connect using telnet with the SD card trick and copy/modify files as explained in the summary.

The only problem that I have found is a space limitation 😟. I can not copy "snx_rtsp_server" file into the "/etc/rtsp" directory.

If I put the file into the SD card and run the server, it works as spected. Anyone else experiencing free space problems?

PS: I've updated to the last firmware available with MiHome before change anything.

roger- commented 7 years ago

@samtap Can you point me to where in SN986_1.50_037a_20151022_1049 the source for the RTSP server is? I've found the source for a project with the same file name here but I'm not sure if it's the same code. There's a more up-to-date version here too.

@petero-dk Any luck with finding an updated SDK?

cycloptux commented 7 years ago

Followed samtap's steps and I managed to run RTSP server. It seems the hotplug patch is failing:

patching file sdcard
Possibly reversed hunk 2 at 103
Hunk 2 FAILED 91/92.
                        echo "find snx_autorun.sh" > /dev/console
                        /media/$MDEV/snx_autorun.sh
                fi
+               exit 0
+       fi
+
+       grep -w $MDEV /tmp/mmc.ext2.log
+       if [ $? == 0 ]; then
+               mount /dev/$MDEV /media/$MDEV
+               echo "1" > /tmp/$MDEV
                exit 0
        fi
 else

It seemed I had to run the script everytime to make it work, but I hadn't got time to test thoroughly. I was trying to add ir script inside scripts folder as well, but it was making the camera hang. Launching the script manually after everything was up worked, but it will stop on reboot as is. RTSP /unicast stream doesn't seem to have any time overlay, is it normal?

petero-dk commented 7 years ago

@roger- still unsuccessful but continuing to try.

jonnycastaway commented 7 years ago

@vicfergar to get you an overview, the only files i copied to my cams (in /etc/rtsp) are (ls -la snapshot):

427 Jan 1 08:13 ir_ctrl.sh 51631 Jan 11 2017 libsnx_rc.so 1120784 Jan 11 2017 snx_rtsp_server

the rest of tools are be present in the cam by default. or only little changes in default present files. the ir_ctrl.sh i wrote directly on the cam but can be copied also. this all

the df command let me see that 85% of /etc are in use. so there is space left ;-)

Filesystem 1K-blocks Used Available Use% Mounted on /dev/root 14520 14520 0 100% / dev 512 0 512 0% /dev /dev/mtdblock4 1024 868 156 85% /etc tmpfs 36956 0 36956 0% /tmp lock 18476 0 18476 0% /var/lock log 18476 92 18384 0% /var/log run 18476 12 18464 0% /var/run spool 18476 0 18476 0% /var/spool tmp 18476 0 18476 0% /var/tmp mq 18476 0 18476 0% /var/mq media 18476 0 18476 0% /media

samtap commented 7 years ago

@roger the rtsp server is in snx_sdk/app/example/src/ipc_func/rtsp_server/ If you want to test other apps just build and place on sd-card, it's easy ;-). But I think the rtspserver code is hardware dependent (you can use the sdk to work out what is needed to make latest v4l2rtspserver code work on our hardware)

@cycloptux It works for me on old firmware. Are you running latest version perhaps?

vicfergar commented 7 years ago

@jonnycastaway I only copied these 3 files in /etc/rtsp but snx_rtsp_server can not be copied. I will check later df command as you explained and share the results. Thanks for your help! 😃

panosmark commented 7 years ago

Hi Great Work from everyone envolved!!!!! I have managed to enable telnet access according to the instructions. I would like to ask if you think we can have rtsp running without stopping the default cloud app. Is it possible to have them both running?

fijter commented 7 years ago

Good stuff again, and thanks for the snx_ir_ctl binary @samtap! Seems like this only works for the IR cut filter, not the IR lights though :/ @panosmark I don't think this is an option since the cloud service binary keeps the video device occupied so in order to enable RTSP we have to stop it first but who knows ;)

cycloptux commented 7 years ago

@samtap I'm running latest version. I was falling asleep when I wrote that message, I'll try to be as clear as I can. When I use your script, the patch fails and it doesn't add the ext2 automatic mount to /etc/hotplug/sdcard, but it still puts the firstrun_complete file in /etc/ so that on next boot rc.local tries to run /etc/fang_hacks.sh, which fails because it can't find the mount point. Since firstrun_complete is actually there, the 'if' skips activating telnetd on port 23 (2323 one wouldn't activate either because the script is on the SD card), so I have to use the snx_autostart.sh on another SD, then swap SD with the ext2 one, rm firstrun_complete and rerun fang_hacks.sh. I'm at work now and can't reboot the camera, otherwise I would lose telnet access (I'm connecting through an SSH tunnel now), but this is my /etc/hotplug/sdcard with the system running, don't know if it can be useful to fix the hotplug.patch:

#!/bin/sh

if [ $ACTION = "add" ]; then
        mkdir -p /media/$MDEV

        grep -w "3" /proc/mmc/pwroff
        $status = $?

        if [ ! -x /tmp/mmc.all.log ] || [ $status == 0 ]; then
#               sleep 1

                ps > /tmp/mmc.ps.log
                grep -w "lsblk" /tmp/mmc.ps.log
                if [ $? == 0 ]; then
                        echo "1" > /tmp/mmc.ps2.log
                        exit 0
                fi

                grep -w "1" /proc/mmc/removal
                if [ $? == 0 ]; then
                        exit 0
                fi

                grep -w "1" /proc/mmc/pwroff
                if [ $? == 0 ]; then
                        killall -9 lsblk
                        exit 0
                fi

                sleep 1
#               ps > /tmp/mmc.ps.log
#               grep -w "lsblk" /tmp/mmc.ps.log
#               if [ $? == 0 ]; then
#                       echo "1" > /tmp/mmc.ps2.log
#                       exit 0
#               fi

#               echo "2" > /tmp/mmc.ps2.log

                echo "0x1" >/proc/mmc/pwroff
                lsblk -o KNAME,FSTYPE /dev/mmc* > /tmp/lsblk.log
                echo "0x0" >/proc/mmc/pwroff

                grep "mmc" /tmp/lsblk.log > /tmp/mmc.all.log

                grep "vfat" /tmp/mmc.all.log > /tmp/mmc.vfat.log
                grep "exfat" /tmp/mmc.all.log > /tmp/mmc.exfat.log
                grep "ntfs" /tmp/mmc.all.log > /tmp/mmc.ntfs.log
        fi

        grep -w $MDEV /tmp/mmc.vfat.log
        if [ $? == 0 ]; then
#               sleep 1
                grep -w "1" /proc/mmc/removal
                if [ $? == 0 ]; then
                        exit 0
                fi

                mount -t vfat -o rw /dev/$MDEV /media/$MDEV
                echo "1" > /tmp/$MDEV
                mount -o remount,rw /dev/$MDEV
                echo "1" > /tmp/guozhixin
                if [ -f /media/$MDEV/snx_autorun.sh ]; then
                        echo "find snx_autorun.sh" > /dev/console
                        /media/$MDEV/snx_autorun.sh
                fi
                exit 0
        fi

        grep -w $MDEV /tmp/mmc.exfat.log
        if [ $? == 0 ]; then
                mount /dev/$MDEV /media/$MDEV
                #mount.exfat-fuse /dev/$MDEV /media/$MDEV
                echo "1" > /tmp/$MDEV
                mount -o remount,rw /dev/$MDEV
                echo "2" > /tmp/guozhixin
                if [ -f /media/$MDEV/snx_autorun.sh ]; then
                        echo "find snx_autorun.sh" > /dev/console
                        /media/$MDEV/snx_autorun.sh
                fi
                exit 0
        fi

        grep -w $MDEV /tmp/mmc.ntfs.log
        if [ $? == 0 ]; then
                ntfs-3g /dev/$MDEV /media/$MDEV
                echo "1" > /tmp/$MDEV
                #mount -o remount,rw /dev/$MDEV
                echo "3" > /tmp/guozhixin
                if [ -f /media/$MDEV/snx_autorun.sh ]; then
                        echo "find snx_autorun.sh" > /dev/console
                        /media/$MDEV/snx_autorun.sh
                fi
                exit 0
        fi
else
        umount /dev/$MDEV
        rm -rf /media/$MDEV
        rm -f /tmp/$MDEV
        rm -f /tmp/guozhixin
        echo "0x3" >/proc/mmc/pwroff
fi

EDIT: Also, I let the RTSP server run overnight and it crashed (don't know why, I just found it deactivated) after 4-5 hours.

jonnycastaway commented 7 years ago

@fijter Did u test the ir control script from @no1knows? It automatically read the Lightsensor and switch ir_cut lens and ir_leds. I'm not a friend of compiled binarys even it can run with a script (just my 2 cent) so i searched for the tools and @no1knows implemented it in a script. It runs perfect since yesterday without aborts.

arhue commented 7 years ago

@samtap I need some help. I'll make a video and post it on YouTube/write everything down on my blog if you can help me out so that others can get this working too.

Extract the archive to an sdcard with a single ext2-formatted partition. I know this is inconvenient for Windows users but a Linux device needs a Linux filesystem :P

Understood that. The full archive should be extracted in the SD card root right? Not the "hacks" folder only correct?

Place fang_hacks.sh in /etc and rc.local in /etc/init.d (feel free to modify to your liking) For the time being you'll need the snx_autorun.sh trick once, to place these two files on the device. Use wget, put them on the card with snx_autorun.sh or manually mount the ext2-formatted card to copy them over.

Totally confused. /etc and /etc/init.d are of the IPcam internal file system right or is it referring to sdcard as root? What's the "snx_autorun.sh trick"? Is it used to get telnet access?

Thanks.

no1knows commented 7 years ago

Do we have a sense for what people are looking for out of the camera? I only want an [authenticated] rtsp server, automatic IR lens/filter control, and telnet access. Do people also want an FTP server? Anything else? Do people care about losing the Xiaomi cloud functionality? I don't.

I suspect the only way all our good work is going to benefit most people is if we create @samtap's "noob-friendly sdcard image" that allows people to download a .zip (or .img, if necessary), extract it to a microSD card in Windows, maybe tweak a couple of .conf txt files, insert into camera, done. We can add some "undo" functionality too, in case they want to go back to stock.

If people only want an rtsp server, automatic IR lens/filter control, telnet access, and ftpd, and don't care about losing Xiaomi cloud functionality - this should be pretty straightforward.

petero-dk commented 7 years ago

@no1knows Additionally I would really enjoy ONVIF support with events, and/or standalone events. Once/if I get the real SDK I am going to look into motion detection.

At home I have small scale setup, where we agree the design of these cameras are quite nice, and with the above features they will fit into our home security setup.

Only having an RTSP stream requires more of the server and I am trying to reduce load on that already.

P.S. Really could not care less with the original Xiaomi Cloud features. Would disable in a heartbeat anyway.

P.P.S you guys really work fast, I haven`t had time to work properly on this yet and you have already solved many cool issues already. Good work!

samtap commented 7 years ago

I accidentally left logging enabled in hacks/scripts/02-rtsp-server

LOG=/tmp/rtsp_server.log
#LOG=/dev/null

Unless you're debugging, it's best to comment the first line and un-comment the second. The output of snx_rtsp_server will quickly fill up /tmp and that may be why it crashed @cycloptux?

I'll try to fix some bugs and improve the script over the weekend.

cycloptux commented 7 years ago

@arhue the hacks folder has to be in the ext2 partition. I'll try to see if the SD can have an ext2 partition for the scripts and a fat32 partition for the continuous recording files. Anyways, hacks folder has to be on the SD card to be mounted. rc.local and fang_hacks.sh will remain on the internal memory of the camera. HOW you put them on the camera depends on you. I loaded them on a web server and downloaded with wget, but you can eventually manually mount the SD card and move them with cp/mv. To get telnet access the first time, you need a fat32 formatted SD card (it wasn't working to me when I put it in my ext2 SD card, not sure if I was doing something wrong) with snx_autorun.sh on it. Inside you will put:

#!/bin/sh
telnetd &

After the camera boots, you can insert the fat32 card, wait for the hammer sound and connect to telnet. Then move rc.local and fang_hacks, set permissions and reboot.

@samtap I'll check df /tmp size and disable logging. I'll let you know if it crashes again. I hate vi, is there a better editor I may have missed in your included tools?

Edit:

~ # df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/root                14520     14520         0 100% /
dev                        512         4       508   1% /dev
/dev/mtdblock4            1024       260       764  25% /etc
tmpfs                    36956      5128     31828  14% /tmp
lock                     18476         0     18476   0% /var/lock
log                      18476       200     18276   1% /var/log
run                      18476        16     18460   0% /var/run
spool                    18476         0     18476   0% /var/spool
tmp                      18476         0     18476   0% /var/tmp
mq                       18476         0     18476   0% /var/mq
media                    18476         0     18476   0% /media
/dev/mmcblk0p1         7638904     18796   7232064   0% /media/mmcblk0p1
~ # ls -l /tmp
-rwxr-xr-x    1 root     root           585 Jan 12 03:47 boa.conf
-rw-------    1 root     root             0 Jan 12 03:47 error_log
-rw-r--r--    1 root     root       1179680 Jan 12 03:51 log.txt
-rw-rw-rw-    1 root     root            58 Jan 12 03:54 lsblk.log
-rw-rw-rw-    1 root     root            41 Jan 12 03:54 mmc.all.log
-rw-rw-rw-    1 root     root             0 Jan 12 03:54 mmc.exfat.log
-rw-rw-rw-    1 root     root             0 Jan 12 03:54 mmc.ntfs.log
-rw-rw-rw-    1 root     root          2395 Jan 12 03:54 mmc.ps.log
-rw-rw-rw-    1 root     root             0 Jan 12 03:54 mmc.vfat.log
-rw-r--r--    1 root     root       4021928 Jan 12 19:54 rtsp_server.log
-rwxr-xr-x    1 root     root           235 Jan 12 03:47 wpa_supplicant.conf
drwxr-xr-x    3 root     root            80 Jan 12 03:51 www

Overall, memory seems to be fine, but rtsp_server.log is indeed big. Also, I'll try to manually patch /etc/hotplug/sdcard when I get home later and see if it mounts the ext2 partition on boot. I still can't reboot the cam remotely.

@no1knows I work in cyber security and an authenticated rtsp server would actually be a good idea, but it's not a top priority at this stage. I would add it before it goes "live" with a noob-friendly image, defaulted on. Most routers have port forwarding set to deny unset requests, but some may not be or someone may have a wrong rule. If that's the case, anyone in the world would then be able to look at your camera over the internet just by knowing your public ip... I don't care about losing cloud functionality, but I can't see any way to set camera options at the moment (ie how would I enable/disable continuous recording now? I don't have any timestamp in my rtsp stream, how would I enable it? etc). Since the camera doesn't have any motor, motion detection and alarms may be implemented with an external tool (I use motionEye on my RPi and it can do that with a raw rtsp stream), still it's something high-end cameras always have and it'd be nice to have at some point.

duelago commented 7 years ago

@samtap Thank you for your guide! My camera is up and running. My only problem is that the hack doesn't work after a reboot. No rtsp, normal telnet or telnet:2323 I have to use my FAT32 SD card and the snx_autorun.sh trick, remove the firstrun_completed file and run fang_hacks.sh again after a swapped back to my ext2 card.

Don't know why...

roger- commented 7 years ago

@no1knows

I haven't looked at the RTSP source yet, but if its based on live555 then authentication will be trivial to add.

I believe I saw in some SDK documentation that there's also a snx_xxx executable that will do motion detection ROI. Making that work and somehow accessible could be useful.

arhue commented 7 years ago

@cycloptux Perfect! Will try it out once I get my hands on a SD card. Need to search if I have one. Thank you so much for that explanation. Getting Nginx running to transfer files is not a problem at all.

Also is there a password for telnet? RTSP url is rtsp://camip/unicast right?

BTW motion detection is supported by many software based DVRs. Also does the camera need to talk to Xiaomi's servers during any time after I complete these hacks or can I proceed to drop all forwards from this camera to the outside world? IP cameras talking to the outside world is a little scary!

petero-dk commented 7 years ago

@arhue The username is root and password is "ismart12"

And having motion detection on the device will have the software based DVR use less resources. Which means more cameras per DVR or the ability to do other things.

arhue commented 7 years ago

@petero-dk Thank you. I saw that in one of the posts but was a little confused.

And having motion detection on the device will have the software based DVR use less resources. Which means more cameras per DVR or the ability to do other things.

Ah right. I'm amazed that the good folks on here managed to get so much working in a day. :D

vicfergar commented 7 years ago

@no1knows I have tested the ir.sh script and have figure out that the behavior of the ir cut-off filter switch is inverted. It should be active during the day and unactive during dark situations. I also have reduced the sleep time for a faster response.

With this script you will hear a mecanical sound indicating filter switch.

#!/bin/sh
echo "IR script started"

# ir_init
gpio_ms1 -n 2 -m 1 -v 0
gpio_aud write 1 1 0
gpio_aud write 0 2 1
gpio_aud write 1 0 0

# ir loop
IR_ON=0
while :
do
    DAY="$(gpio_aud read 2)"
    if [ $DAY -eq 1 ]
    then
        if [ $IR_ON -eq 1 ]
        then
            gpio_ms1 -n 2 -m 1 -v 1
            gpio_aud write 1 0 0
            IR_ON=0
        fi
    else
        if [ $IR_ON -eq 0 ]
        then
            gpio_ms1 -n 2 -m 1 -v 0
            gpio_aud write 1 0 1
            IR_ON=1
        fi
    fi
    sleep 1
done

vicfergar commented 7 years ago

@jonnycastaway I have checked the system free space using the df command. Looks like I have more space used than you 😟. I'll try to figure out what files are taking all the space.

~ # df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                13.3M     13.3M         0 100% /
dev                     512.0K         0    512.0K   0% /dev
/dev/mtdblock4            1.0M   1016.0K      8.0K  99% /etc
tmpfs                    36.1M     24.0K     36.1M   0% /tmp
lock                     18.0M         0     18.0M   0% /var/lock
log                      18.0M     56.0K     18.0M   0% /var/log
run                      18.0M     12.0K     18.0M   0% /var/run
spool                    18.0M         0     18.0M   0% /var/spool
tmp                      18.0M         0     18.0M   0% /var/tmp
mq                       18.0M         0     18.0M   0% /var/mq
media                    18.0M         0     18.0M   0% /media
/dev/mmcblk0p1           14.7G      2.5M     14.7G   0% /media/mmcblk0p1

EDIT: Sorry I posted the disk state after trying to copy the rtsp server with and receiving the error: cp: write error: No space left on device

Here is the output without the file:

/etc/rtsp # df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                13.3M     13.3M         0 100% /
dev                     512.0K         0    512.0K   0% /dev
/dev/mtdblock4            1.0M    376.0K    648.0K  37% /etc
tmpfs                    36.1M     24.0K     36.1M   0% /tmp
lock                     18.0M         0     18.0M   0% /var/lock
log                      18.0M     56.0K     18.0M   0% /var/log
run                      18.0M     12.0K     18.0M   0% /var/run
spool                    18.0M         0     18.0M   0% /var/spool
tmp                      18.0M         0     18.0M   0% /var/tmp
mq                       18.0M         0     18.0M   0% /var/mq
media                    18.0M         0     18.0M   0% /media
/dev/mmcblk0p1           14.7G      2.5M     14.7G   0% /media/mmcblk0p1

cycloptux commented 7 years ago

@samtap Found out why your hotplug.patch wasn't working on my end, and it seems @duelago had my same issue. The problem isn't in the diff file, it's in the way you apply the patch. Change patch -N < "$2" to patch < "$2" (without the forward option) in fang_hacks.sh, line 24. It will successfully patch /etc/hotplug/sdcard on first boot. I don't know if you used -N argument on purpose, but it's actually causing the patch to fail.

roger- commented 7 years ago

@samtap

I added authentication to the RTSP server, see here for a modified version of main.cpp. Just replace the original one with this and rebuild. I haven't tested it since I don't have a cross compilation environment yet, but please let me know if it works.

There's a new parameter that sets the user/pass in this format: snx_rtsp_server -A username:password.

duelago commented 7 years ago

@cycloptux Thank you. The patch < "$2" trick worked for me :)

no1knows commented 7 years ago

@vicfergar do you see a difference in the video feed when you switch between gpio_ms1 -n 2 -m 1 -v 0 and gpio_ms1 -n 2 -m 1 -v 1 after you've turned the IR LEDs on with gpio_aud write 1 0 1 ? I don't. In fact, there's no visible difference between our scripts in terms of video output. I don't think the gpio_ms1 command does anything? Perhaps the filter is engaged automatically when the IR LEDs are turned on?

cycloptux commented 7 years ago

I tried both scripts and can confirm I don't see any difference as well. Purple halo everywhere on both versions.

jonnycastaway commented 7 years ago

@no1knows @cycloptux i see a difference on my cameras and i can clearly hear the click sound. the filter is not engaged automatic with the leds. if you switch the leds by hand you hear no click at the camera itself. the ir_cut lens is clear so you can't see a difference on the day. keep in mind that this ir-leds not only send ir-light. there is a visible piece anyway. so you can see the leds burning. an real ir-only led you would'nt see shine. the circles you see are the visible piece that reflects, in my environment on a 3 glasses window. but let's test this out again ;-)

jonnycastaway commented 7 years ago

Ok, i found the secret in the example file and here it is: (@no1knows this should be added in the ir_ctl.sh script)

when the ir_leds switch to on and the ir_cut lens switched the example do also the folowing: echo 0x0 > /proc/isp/filter/saturation this switches the sensor to black&white

when it's day and the ir things switches off ist does: echo 0x40 > /proc/isp/filter/saturation to come back to the normal mode

#!/bin/sh
echo "IR script started"
# ir_init
gpio_ms1 -n 2 -m 1 -v 1
gpio_aud write 1 1 0
gpio_aud write 0 2 1
gpio_aud write 1 0 0

sleep 3

# ir loop
IR_ON=0

while :
do
        DAY="$(gpio_aud read 2)"
        if [ $DAY -eq 1 ]
        then
                if [ $IR_ON -eq 1 ]
                then
                        gpio_ms1 -n 2 -m 1 -v 1
                        gpio_aud write 1 0 0
                        echo 0x40 > /proc/isp/filter/saturation
                        IR_ON=0
                fi
        else
                if [ $IR_ON -eq 0 ]
                then
                       echo 0x0 > /proc/isp/filter/saturation
                        gpio_aud write 1 0 1
                        gpio_ms1 -n 2 -m 1 -v 0
                        IR_ON=1
                fi
        fi
        sleep 3
done

i think thats the key ;-) to make it clear, this is also not a trick from me. this is exactly what the original tool also did!

@dmolner stay away from this lines in your script. it will switch you in the night to Black&White ;-)

s-bed commented 7 years ago

Awesome work guys. I'm still waiting for my 3 units to arrive... Did you guys find an auto update script? It'd be interesting to download to the firmware.

Also, does the MI home app auto updates or is there a prompt?

duelago commented 7 years ago

@chakal There is a prompt

jonnycastaway commented 7 years ago

If anyone is willing to stream in tcp (because of vpn behaviors like me) then switch the line in rc.local /etc/rtsp/snx_rtsp_server -W 1920 -H 1080 -Q 15 -b 4096 -a -P 554 -T 8554 &

-P is the UDP Port (0 = disabled) -T is the TCP Port (0 = disabled)

fritz-smh / yi-hack

Creating a version for the XiaoFang 1080p camera #118

!/bin/sh

Usage

Included

DISCLAIMER

Next steps