RTSP stops working without access to the Internet.

Hi there, Sorry, maybe this is the wrong place to ask the question, but this is the best I could find so far.

Issue: my camera has ONVIF support, but as soon as I turn off it's access to the Internet - RTSP and ONVIF stop working in a short period of time. RTSP can be accessed on rtsp://IP:8554/main and rtsp://IP:8554/sub. No sound. As this is a camera in the bedroom, I prefer it to be disconnected from the internet and connected only to local Zoneminder server.

This is the camera:

Works with the app Smart Life. Version: V8.37.5

I could turn on ONVIF support and get urls via Onvif Device Manager. VLC shows streams without sound. When I thought that setup is finished and cut the internet for the camera - in a short while everything stopped working. It seems that the camera tries to get settings from the server and goes back to defaults when it can't connect.

I couldn't find the way to enable http access on 80 or 8090 as described here: https://github.com/guino/BazzDoorbell/issues/2

However, I managed to enable telnet by uploading the file 'product.cof' with telnet=1 option. Login root password dgiot010 got me the access to the system. There I can see BusyBox v1.26.2 (2022-06-29 19:04:37 CST) built-in shell (ash)

So, I'm asking questions here as this is the first place where I could to something with this camera :)

Can you please point me to the direction where I can find out and maybe fix the issue? Thanks.

@hubaksis Chances are this is some code in the device that is preventing it from working without access to the tuya servers. Since you have telnet access the first thing I would try is to see if disabling the internet causes telnet to stop working as well (i.e. when RTSP stops working), then restoring internet access to see if telnet stays working when RTSP comes back. The point of this test is to check if the device is rebooting, or disconnecting from the network in any fashion, so if the telnet stays running the whole time it is likely something in the main application code that we would have to review with ghidra (and hopefully disable). It could be very helpful to execute ps -w in telnet before disabling internet, then execute the command after everything is back up for comparison (to see if any process was killed/restarted).

You can post a zip of your main application here if you'd like me to take a quick look at it. Based on the information you posted above I expect you can copy it to the SD card with this telnet command: cp /usr/bin/dgiot /mnt/ -- make sure you wait at least 15s then the dgiot file should be in the SD card so you can post it.

@guino @hubaksis Have you guys found a solution for this? I have the same camera and I would like to use it without internet connection.

@jelteswinnen I need a copy of the dgiot application file to be able to look at it, otherwise I can’t do anything.

--deleted-- @guino Hi, i've the same problem when I block internet for my camera. I joined my dgiot if you can take a look please. For further informations you can tell me.

@rhamdoud I haven't had much time lately to look at this project but I'll try to take a look as soon as I have a chance.

@rhamdoud I spent some time looking at the main application provided and noticed it constantly monitored the mqtt status from the tuya server and performed different functions based on that. I made a patch to disable that monitoring in case you wish to try it: dgiot-offline.zip

You can try it like this:

boot the device with internet (and the patched dgiot in the SD card)
open telnet, execute ps to find the process number for dgiot
use kill #### to kill the dgiot application in telnet and run the patched one from the SD card -- you may need to do that quickly in order to avoid a reboot of the device.
If it doesn't reboot/crash it should ignore the mqtt status from the tuya server, meaning you should be able to to turn off the internet and it should continue to run.

If it crashes/reboots when attempting the above I'm afraid the only way to move forward would be if you wanted to re-flash the device (which requires opening it, requires the right tools, etc) -- basically use 'Option 1' to modify the boot script so it mounts/runs dgiot from the SD card, then we can try different patches.

Without the device I'm limited on testing/investigation since I can't look at all the boot scripts and try to make changes to find anything we can use to modify it.

The patched dgiot doesn't block cloud access. It seems that the camera also reboots after a few seconds. I tried multiple ways of blocking internet access while keeping the rtsp alive. Blocking 1443 and 8883 for outgoing traffic causes the rtsp stream to stop working. Only blocking one of those ports either has no effect (1443) or also stops rtsp (8883). Looking over the dgiot binary to see if there is a secret config param to diable cloud access was also unsuccessful.

What I havent tried is to cut off the connection to aws:8883 and/or aws:1443 after it has been established. My firewall can't do something like this, but it might be something to try.

Oh, I got the camera back and can continue experiments with it. What I've done: created a clean SD card with one file, enabling telnet. In Tuya App options turned on ONVIF.

ps -w does not work
ps T shows all the processes

# ps T
  PID USER       VSZ STAT COMMAND
    1 root      1304 S    init
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 SW   [kworker/0:0]
    5 root         0 SW<  [kworker/0:0H]
    6 root         0 SW   [kworker/u2:0]
    7 root         0 SW<  [lru-add-drain]
    8 root         0 SW   [oom_reaper]
    9 root         0 SW<  [writeback]
   10 root         0 SW   [kcompactd0]
   11 root         0 SW<  [crypto]
   12 root         0 SW<  [bioset]
   13 root         0 SW<  [kblockd]
   14 root         0 SW<  [cfg80211]
   15 root         0 SW   [kworker/0:1]
   16 root         0 SW   [kswapd0]
   30 root         0 SW   [spi0]
   31 root         0 SW   [kworker/u2:1]
   33 root         0 SW<  [bioset]
   34 root         0 SW<  [bioset]
   35 root         0 SW<  [bioset]
   36 root         0 SW<  [bioset]
   37 root         0 SW<  [bioset]
   38 root         0 SW<  [bioset]
   39 root         0 SW   [spi1]
   72 root         0 SW<  [fh_aes.0]
   86 root         0 SW<  [ipv6_addrconf]
   87 root         0 SW   [kworker/0:2]
   88 root         0 SW<  [kworker/0:1H]
   89 root         0 SW   [kworker/0:3]
   90 root         0 SW<  [bioset]
   91 root         0 SW   [mmcqd/0]
  106 root       752 S <  /sbin/udevd -d
  200 root         0 SWN  [jffs2_gcd_mtd5]
  205 root      1304 S    /sbin/getty -L console 115200 vt100
  213 root         0 SW   [ssv6xxx_hci_tx_]
  214 root         0 SW<  [ssv6xxx_cong_wq]
  215 root         0 SW   [ssv6xxx_rx_task]
  216 root         0 SW<  [ssv6xxx_house_k]
  217 root         0 SW<  [ssv6xxx_tx_done]
  218 root         0 SW<  [ssv6xxx_scan_wq]
  235 root         0 DW   [xbus-rx]
  256 root      333m S    ./dgiot
  263 root      333m S    ./dgiot
  280 root      333m S    ./dgiot
  281 root      333m S    ./dgiot
  282 root      333m S    ./dgiot
  290 root      333m S    ./dgiot
  291 root      333m D    ./dgiot
  292 root      333m S    ./dgiot
  293 root      333m S    ./dgiot
  294 root      333m S    ./dgiot
  295 root      333m S    ./dgiot
  303 root      333m S    ./dgiot
  304 root      333m S    ./dgiot
  308 root      333m S    ./dgiot
  309 root      333m S    ./dgiot
  310 root      333m S    ./dgiot
  312 root      333m S    ./dgiot
  313 root      333m S    {sys_timer} ./dgiot
  314 root      333m S    {cmmod} ./dgiot
  315 root      333m S    {wk_th-0} ./dgiot
  316 root      333m S    {wk_th-1} ./dgiot
  318 root      333m S    {lpc_task} ./dgiot
  319 root      333m S    ./dgiot
  320 root      333m S    ./dgiot
  321 root      333m S    ./dgiot
  348 root      333m S    ./dgiot
  351 root      333m S    ./dgiot
  352 root      333m S    ./dgiot
  402 root      333m S    {mq_cntl_ta} ./dgiot
  425 root      333m S    {streamer} ./dgiot
  435 root      333m S    {tuya_p2p} ./dgiot
  436 root      333m S    {tuya_p2p_async_} ./dgiot
  437 root      333m S    {tuya_p2p_mqtt_t} ./dgiot
  438 root      333m S    {tuya_p2p_lan_ta} ./dgiot
  439 root      333m S    {p2p_mqtt} ./dgiot
  440 root      333m S    ./dgiot
  441 root      333m S    ./dgiot
  499 root      333m S    {cloud_storage} ./dgiot
  504 root      333m S    {AI_detect_stora} ./dgiot
  506 root      333m S    ./dgiot
  507 root      333m S    ./dgiot
  508 root      333m S    ./dgiot
  509 root      333m S    {rtspThread} ./dgiot
  510 root      333m S    {onvifThread} ./dgiot
  511 root      333m S    {onvifDiscovery} ./dgiot
  533 root      333m S    {p2p_video} ./dgiot
  534 root      333m S    {p2p_mqtt} ./dgiot
  258 root      2284 S    ./daemon
  273 root      1296 S    telnetd
  284 root         0 SW   [jpeg_kick]
  285 root         0 SW   [bgm_kick]
  286 root         0 SW   [bgm_sw]
  287 root         0 SW   [bgm_conf]
  288 root         0 SW   [vpu_task]
  289 root         0 SW   [hhe_manage]
  345 root      2160 S    wpa_supplicant -Dnl80211 -iwlan0 -c /tmp/wpa_supplic
  346 root         0 SW   [kworker/u2:2]
  385 root      1308 S    udhcpc -b -i wlan0 -h dgiot -s /usr/share/udhcpc/def
  447 root         0 SW   [kworker/u2:3]
  790 root      1304 S    -sh
  817 root      1296 R    ps T

#

# ps

PID USER       VSZ STAT COMMAND
    1 root      1304 S    init
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 SW   [kworker/0:0]
    5 root         0 SW<  [kworker/0:0H]
    6 root         0 SW   [kworker/u2:0]
    7 root         0 SW<  [lru-add-drain]
    8 root         0 SW   [oom_reaper]
    9 root         0 SW<  [writeback]
   10 root         0 SW   [kcompactd0]
   11 root         0 SW<  [crypto]
   12 root         0 SW<  [bioset]
   13 root         0 SW<  [kblockd]
   14 root         0 SW<  [cfg80211]
   15 root         0 SW   [kworker/0:1]
   16 root         0 SW   [kswapd0]
   30 root         0 SW   [spi0]
   31 root         0 SW   [kworker/u2:1]
   33 root         0 SW<  [bioset]
   34 root         0 SW<  [bioset]
   35 root         0 SW<  [bioset]
   36 root         0 SW<  [bioset]
   37 root         0 SW<  [bioset]
   38 root         0 SW<  [bioset]
   39 root         0 SW   [spi1]
   72 root         0 SW<  [fh_aes.0]
   86 root         0 SW<  [ipv6_addrconf]
   87 root         0 SW   [kworker/0:2]
   88 root         0 SW<  [kworker/0:1H]
   89 root         0 SW   [kworker/0:3]
   90 root         0 SW<  [bioset]
   91 root         0 SW   [mmcqd/0]
  106 root       752 S <  /sbin/udevd -d
  200 root         0 SWN  [jffs2_gcd_mtd5]
  205 root      1304 S    /sbin/getty -L console 115200 vt100
  213 root         0 SW   [ssv6xxx_hci_tx_]
  214 root         0 SW<  [ssv6xxx_cong_wq]
  215 root         0 SW   [ssv6xxx_rx_task]
  216 root         0 SW<  [ssv6xxx_house_k]
  217 root         0 SW<  [ssv6xxx_tx_done]
  218 root         0 SW<  [ssv6xxx_scan_wq]
  236 root         0 DW   [xbus-rx]
  257 root      330m S    ./dgiot
  259 root      2284 S    ./daemon
  270 root      1296 S    telnetd
  281 root         0 SW   [jpeg_kick]
  282 root         0 SW   [bgm_kick]
  283 root         0 SW   [bgm_sw]
  284 root         0 SW   [bgm_conf]
  285 root         0 SW   [vpu_task]
  286 root         0 DW   [hhe_manage]
  340 root         0 SW   [kworker/u2:2]
  343 root      2160 S    wpa_supplicant -Dnl80211 -iwlan0 -c /tmp/wpa_supplic
  362 root         0 SW   [kworker/u2:3]
  385 root      1308 S    udhcpc -b -i wlan0 -h dgiot -s /usr/share/udhcpc/def
  592 root      1304 S    -sh
  629 root      1296 R    ps

After the camera started, I started teInet, VLC and tuya app. I turned off internet access on the router. Everything continued working for at least 10 minutes. Closing tuya app did not stop VLC stream. I was able to connect with VLC and with reconnect with Tuya app even after the camera did not have access to the Internet. So, my assumption is that the camera needs Internet only on the start.
I rebooted the camera without the access to the Internet. VLC and Tuya app couldn't connect to the camera. I allowed the access, but it did not help. In some time the camera rebooted and RTSP stream become available.
I have attached dgiot dumped by the command cp /usr/bin/dgiot /mnt/

dgiot.zip

@guino @michaelkleinhenz Can you please explain how to get the patched dgiot? In the message above I can see the link to dgiot-offline.ips, which is just a few bytes in comparison with 5mb of original dgiot.

Also, there is some addition to my message above. Without access to the internet VLC stream pauses, but is not interrupted. The stream in VLC freezes for some time and then continues. After a minute or two after loosing internet connection VLC continues the stream with a delay, however reconnecting to the stream shows it again in real time. In about 10 minutes stream does stop completely and Tuya app also cannot connect to the camera.

Ok, interesting, I need to try it with waiting a bit to see if the rtsp stream reappears.

The IPS file is a binary patch. You'll need the original binary and an IPS patch tool for your operating system. There are also a bunch of online tools available.

@hubaksis you can use this online tool to patch the file with the steps listed:

Here's how to patch:

After the hack is installed: power off the device, remove the SD card and take it to a computer
Go to https://www.marcrobledo.com/RomPatcher.js/ DO NOT CLICK ON CREATOR MODE
Click ‘choose file’ in front of ‘ROM file’ and select the original ppsapp file under /home/app/ppsapp on the SD card (assuming you didn’t do anything to it since the hack was installed)
VERIFY that the md5 value displayed matches the md5 from the list below (listed with the patch for your ppsapp)
Click ‘choose file’ in front of ‘Patch file’ and select the zip file you downloaded from the list below
Click ‘apply patch’ and save/download the file to the root of the SD card (the default file name will likely be ppsapp-rtsp)
Rename the saved/downloaded file on the root of the SD card to ppsapp (make sure it has no .txt or any extension) — verify the size is exactly the same as the size of /home/app/ppsapp in the SD card (which should be a few megabytes)
Properly eject/unmount the SD card from computer (i.e. windows using the tray icons, linux umount command, etc)
Insert SD card to device and power it on

Thank you. I have applied the patch. My next steps were with the blocked access to the internet.

ps find the process number for ./dgiot
kill [number]
./mnt/dgiot

Camera reboots almost immediately after running a new version. Camera also reboots after the second step if you don't run anything.

I started to use this one just in case:

kill [number] && ./mnt/dgiot

and got the following dump.

# kill 256 && ./mnt/dgiot
ver: 8.37.5
wifi is 6256p
open watchdog dev fail
2024-02-20 11:17:36 [1708427856:403] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/etc/conf/product.cof] failed! section[CONST_PARAM] key[manua            l_ircut]

2024-02-20 11:17:36 [1708427856:409] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/etc/conf/product.cof] failed! section[CONST_PARAM] key[hardt            ype]
CThreadManager::CThreadManager()>>>>>>>>>
err(wdt_keep_alive,22): Bad file descriptor

mount: mounting /dev/mmcblk0p1 on /mnt failed: Device or resource busy
2024-02-20 11:17:36 [1708427856:432] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[AGING_SETTING] key[aging_te            st]

2024-02-20 11:17:36 [1708427856:432] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[ircut_flip            ]

2024-02-20 11:17:36 [1708427856:432] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[image_flip            ]

2024-02-20 11:17:36 [1708427856:433] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[manual_irc            ut]

2024-02-20 11:17:36 [1708427856:433] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[ptz_opposi            te_run]

2024-02-20 11:17:36 [1708427856:433] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[play_vol]

2024-02-20 11:17:36 [1708427856:433] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[capture_vo            l]

2024-02-20 11:17:36 [1708427856:434] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[lamp_board            ]

2024-02-20 11:17:36 [1708427856:434] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[lamp_board            _value]

2024-02-20 11:17:36 [1708427856:434] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[lamp_board            _value_method]

2024-02-20 11:17:36 [1708427856:434] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[ud_len]

2024-02-20 11:17:36 [1708427856:435] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[lr_len]

2024-02-20 11:17:36 [1708427856:435] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[ud_dir]

2024-02-20 11:17:36 [1708427856:435] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[lr_dir]

2024-02-20 11:17:36 [1708427856:437] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[ud_notuse]

2024-02-20 11:17:36 [1708427856:438] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[check_spee            d]

2024-02-20 11:17:36 [1708427856:438] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[Day2Night]

2024-02-20 11:17:36 [1708427856:440] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[Night2Day]

2024-02-20 11:17:36 [1708427856:440] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[run_speed]

2024-02-20 11:17:36 [1708427856:441] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[run_ud_spe            ed]

2024-02-20 11:17:36 [1708427856:441] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[track_spee            d]

2024-02-20 11:17:36 [1708427856:442] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[up_len]

2024-02-20 11:17:36 [1708427856:443] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[brightness            _day]

2024-02-20 11:17:36 [1708427856:443] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[brightness            _night]

2024-02-20 11:17:36 [1708427856:444] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[tracker_st            ep_multiple]

2024-02-20 11:17:36 [1708427856:445] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[tracker_st            op_overtime]

2024-02-20 11:17:36 [1708427856:446] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[tracker_lr            _dir]

2024-02-20 11:17:36 [1708427856:446] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[tracker_ud            _dir]

2024-02-20 11:17:36 [1708427856:448] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[light_ctrl            ]

2024-02-20 11:17:36 [1708427856:448] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[ir_led_ctr            l]

2024-02-20 11:17:36 [1708427856:450] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[smartir_en            ]

2024-02-20 11:17:36 [1708427856:450] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[single_lig            ht_en]

2024-02-20 11:17:36 [1708427856:451] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[pwmfrequen            cy]

2024-02-20 11:17:36 [1708427856:451] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[twowayradi            o_vol]

2024-02-20 11:17:36 [1708427856:452] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[hardtype]

2024-02-20 11:17:36 [1708427856:453] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[speaker_re            versed]

2024-02-20 11:17:36 [1708427856:453] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[auto_light            _off]

2024-02-20 11:17:36 [1708427856:454] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[auto_light            _off_time]

2024-02-20 11:17:36 [1708427856:455] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[private_mo            torstatus]

2024-02-20 11:17:36 [1708427856:456] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[md_thresho            ld_low]

2024-02-20 11:17:36 [1708427856:457] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[md_thresho            ld_mid]

2024-02-20 11:17:36 [1708427856:458] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[md_thresho            ld_high]

2024-02-20 11:17:36 [1708427856:458] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[sensor_mod            e]

2024-02-20 11:17:36 [1708427856:459] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[voice_thre            shold_low]

2024-02-20 11:17:36 [1708427856:460] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[voice_thre            shold_high]

2024-02-20 11:17:36 [1708427856:460] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[DEFAULT_SETTING] key[langua            ge]

2024-02-20 11:17:36 [1708427856:461] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[DEFAULT_SETTING] key[forceB            urnLicense]

2024-02-20 11:17:36 [1708427856:462] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[STATION] key[stationssid]

2024-02-20 11:17:36 [1708427856:463] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[STATION] key[stationpwd]

2024-02-20 11:17:36 [1708427856:619] DGIOT ../../Main.cpp 0859 checkDevLicense(): get from eeprom.

err(wdt_keep_alive,22): Bad file descriptor
CryptoRead error
2024-02-20 11:17:37 [1708427857:696] DGIOT ../../Main.cpp 0908 checkDevLicense(): get from /etc/conf/deviceinfo.

insmod: can't insert '/usr/modules/motor_gpio.ko': File exists
[dsp] version: V1.1.0.P20(gf838ce1),build: 2022-02-18
isp version:            V1.1.0.P12(g6dc09ce)
ispcore version:        V1.1.0.P18(gce94162)
ADV_ISP version:                V1.1.0.P15(g51736cf), build: 2021-12-21
set cis_clk_out freq: 24000000 hz
111111111111111
mipi version:           V1.1.0(gfb40983)
file_name is ./day_mis4001_mipi_attr.hex
Error: Cann't load sensor hex file!
file_name is ./night_mis4001_mipi_attr.hex
Error: Cann't load sensor hex file!
pstCeCfg is 0--0--0--0
==================AudioCreate start==================
[ACW_MPI] version: V1.1.0.P14(gb3c8c03),build: 2021-12-20
set_IN_config fail -2146238457
set_out_config fail -2146238457
CPacketManagerImp::CPacketManagerImp()>>>>>>>>>
sm_packetBuf null use self heap memory!
Adjust Page!
Packet usage : 0K / 767K, 0%

----------------------[02-20 11:17:38]
printJsonValue

========in AencAACStreamProc=========

========in AencG711uStreamProc=========

size = 512
MOTO test!!!
        ---zzb: ../../Net/NetConfigHook.cpp-Line56: =[{"Auth":"WPA2PSK","Channel":6,"Enable":false,"EncrypType":"CCMP","GateWay":"192.168.0.255","HostIP":"192.168.0.1","Keys"            :"12345678","Netmask":"255.255.255.0","SSID":"dgiot"}
]--
2024-02-20 11:17:38 [1708427858:160] DGIOT ../../Storage/StorageManager.cpp 0308 Init(): Disk Free Size : 7618420736

2024-02-20 11:17:38 [1708427858:162] DGIOT ../../Storage/DiskManager.cpp 0094 Init(): Disk ---> total : 7801405440, used : 182984704, free : 7618420736

2024-02-20 11:17:38 [1708427858:163] DGIOT ../../Net/NetConfigHook.cpp 0075 Init(): ======================================CNetConfigHook::Init()====================1=========            =========

NetSetEthMac cmd ifconfig eth0 hw ether 62:6c:53:20:01:14
ifconfig: SIOCSIFHWADDR: Device or resource busy
2024-02-20 11:17:38 [1708427858:194] DGIOT ../../Net/NetConfigHook.cpp 0095 Init(): ======================================CNetConfigHook::Init()====================2=========            =========

Threads:
               Name            PID  Prior State
_______________________________________________________
                    Main        678   64  Normal
                 FeedDog        690   50  Normal
            TimerManager        702   50  Normal
                  Pooled        703   50  Normal
             AudioPrompt        715   50  Normal
                     PTZ        716   50  Normal
          IndicaotrLight        704   50  Normal
            AudioManager        714   50  Normal
            CDiskManager        721   50  Normal
         CStorageManager        720   50  Normal
_________________________________________
          NoName 450 Idel
    EventManager 1000 Idel
vedio avcodec_parameters_from_context ret : 0
audio avcodec_parameters_from_context ret : 0
Output #0, mp4, to '/mnt/DCIM/2024/02/20/tmp_1708427802190.mp4-new':
    Stream #0:0: Video: hevc, yuv420p(GBR), 2880x1620, q=2-31, 1048 kb/s, 15 fps, 15 tbr, 1000k tbc
    Stream #0:1: Audio: aac, 8000 Hz, 1 channels, s16
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2324] serial_no:(null)
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2353] gw_cntl.gw_wsm.stat:2
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2356] gw_cntl.gw_wsm.nc_tp:6
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2357] gw_cntl.gw_wsm.md:0
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2358] gw_cntl.gw_wsm.dns_prio:1
unm_set_dns_cache_priority ->1
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2392] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2393] gw_cntl.gw_if.product_key:c7zkhbbp7kb6yorg, input:c7zkhbbp7kb6yorg
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2394] gw_cntl.gw_if.tp:0, input:0
unm_set_dns_region 3
unw_add_dns_cache [http://a.tuyaus.com/d.json]<->[318164215]
unw_add_dns_cache [https://a2.tuyaus.com/d.json]<->[1679101814]
unw_add_dns_cache [m2.tuyaus.com]<->[753648327]
unw_add_dns_cache [m2.tuyaus.com]<->[753648327]
unw_add_dns_cache [baal.tuyaus.com]<->[753702113]
Cap(CaptureGetChannels , 2302):===========>Middleware CaptureGetChannels
Cap(CaptureCreate , 2366):===========>Middleware CaptureCreate ch 0
channel_max is 1
ADV_SMARTIR version:            V1.1.0.P15(g51736cf), build: 2021-12-21
CCaptureManager::start(0)(1)......
sched set 98, 2
get wifi info ...
===========>Middleware WifiApModeDestroy
killall: udhcpd: no process killed
killall: hostapd: no process killed
err(wdt_keep_alive,22): Bad file descriptor
wait pic_start fail, errno=0
err(wdt_keep_alive,22): Bad file descriptor
2024-02-20 11:17:41 [1708427861:490] DGIOT ../../Storage/StorageManager.cpp 1657 DoRecoverRcdProc(): recover tmp mp4 file take 3325 ms

2024-02-20 11:17:41 [1708427861:491] DGIOT ../../Storage/StorageManager.cpp 1661 DoRecoverRcdProc(): delete record file : /mnt/DCIM/2024/02/20/tmp_1708427802190.mp4

wait pic_start fail, errno=0

There are clearly errors with reading data from a config file, so I took the content of the file from /etc/conf/product.cof and added it to the file that I created on the SD card to enable telnet. This is the result:

[CONST_PARAM]
twowayradio_vol=20
voice_threshold_high=400
voice_threshold_low=600
sensor_mode=1
md_threshold_high=230
md_threshold_mid=225
md_threshold_low=220
auto_light_off_time=6
auto_light_off=0
private_motorstatus=0
speaker_reversed=0
pwmfrequency=1
single_light_en=1
smartir_en=0
ir_led_ctrl=0
light_ctrl=0
tracker_ud_dir=0
tracker_lr_dir=0
up_len=40
tracker_stop_overtime=30
tracker_step_multiple=4
track_speed=1300000
run_ud_speed=1400000
Day2Night=1400
Night2Day=320
run_speed=1400000
check_speed=1400000
ud_notuse=0
lr_dir=0
ud_dir=0
lr_len=500
brightness_night=200
brightness_day=200
ud_len=230
lamp_board_value_method=50
lamp_board_value=900
lamp_board=1
capture_vol=28
play_vol=85
ptz_opposite_run=0
image_flip=1
ircut_flip=1

[DEFAULT_SETTING]
language=0
telnet=1

After restarting the camera, killing the original dgiot, starting the patched one the result is below. Camera turns upside down, waits a bit and then reboots.

ver: 8.37.5
wifi is 6256p
open watchdog dev fail
2024-02-20 11:43:48 [1708429428:569] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/etc/conf/product.cof] failed! section[CONST_PARAM] key[manual_ircut]

2024-02-20 11:43:48 [1708429428:573] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/etc/conf/product.cof] failed! section[CONST_PARAM] key[hardtype]
CThreadManager::CThreadManager()>>>>>>>>>
err(wdt_keep_alive,22): Bad file descriptor

mount: mounting /dev/mmcblk0p1 on /mnt failed: Device or resource busy
2024-02-20 11:43:48 [1708429428:597] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[AGING_SETTING] key[aging_test]

2024-02-20 11:43:48 [1708429428:598] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[manual_ircut]

2024-02-20 11:43:48 [1708429428:602] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[hardtype]

2024-02-20 11:43:48 [1708429428:604] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[DEFAULT_SETTING] key[forceBurnLicense]

2024-02-20 11:43:48 [1708429428:605] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[STATION] key[stationssid]

2024-02-20 11:43:48 [1708429428:606] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[STATION] key[stationpwd]

2024-02-20 11:43:48 [1708429428:762] DGIOT ../../Main.cpp 0859 checkDevLicense(): get from eeprom.

err(wdt_keep_alive,22): Bad file descriptor
CryptoRead error
2024-02-20 11:43:49 [1708429429:798] DGIOT ../../Main.cpp 0908 checkDevLicense(): get from /etc/conf/deviceinfo.

insmod: can't insert '/usr/modules/motor_gpio.ko': File exists
[dsp] version: V1.1.0.P20(gf838ce1),build: 2022-02-18
sys init error -2146877312
==================AudioCreate start==================
[ACW_MPI] version: V1.1.0.P14(gb3c8c03),build: 2021-12-20
set_IN_config fail -2146238457
set_out_config fail -2146238457

========in AencAACStreamProc=========

CPacketManagerImp::CPacketManagerImp()>>>>>>>>>
sm_packetBuf null use self heap memory!
Adjust Page!
Packet usage : 0K / 767K, 0%

----------------------[02-20 11:43:50]
printJsonValue

========in AencG711uStreamProc=========

size = 512
MOTO test!!!
        ---zzb: ../../Net/NetConfigHook.cpp-Line56: =[{"Auth":"WPA2PSK","Channel":6,"Enable":false,"EncrypType":"CCMP","GateWay":"192.168.0.255","HostIP":"192.168.0.1","Keys":"12345678","Netmask":"255.255.255.0","SSID":"dgiot"}
]--
2024-02-20 11:43:50 [1708429430:159] DGIOT ../../Storage/StorageManager.cpp 0308 Init(): Disk Free Size : 7781711872

2024-02-20 11:43:50 [1708429430:160] DGIOT ../../Storage/DiskManager.cpp 0094 Init(): Disk ---> total : 7801405440, used : 19693568, free : 7781711872

2024-02-20 11:43:50 [1708429430:161] DGIOT ../../Net/NetConfigHook.cpp 0075 Init(): ======================================CNetConfigHook::Init()====================1==================

NetSetEthMac cmd ifconfig eth0 hw ether 62:6c:53:20:01:14
ifconfig: SIOCSIFHWADDR: Device or resource busy
2024-02-20 11:43:50 [1708429430:186] DGIOT ../../Net/NetConfigHook.cpp 0095 Init(): ======================================CNetConfigHook::Init()====================2==================

Threads:
               Name            PID  Prior State
_______________________________________________________
                    Main        570   64  Normal
                 FeedDog        579   50  Normal
            TimerManager        591   50  Normal
                  Pooled        592   50  Normal
            AudioManager        600   50  Normal
          IndicaotrLight        593   50  Normal
             AudioPrompt        601   50  Normal
                     PTZ        602   50  Normal
            CDiskManager        607   50  Normal
         CStorageManager        606   50  Normal
_________________________________________
          NoName 340 Idel
    EventManager 1000 Idel
vedio avcodec_parameters_from_context ret : 0
audio avcodec_parameters_from_context ret : 0
Output #0, mp4, to '/mnt/DCIM/2024/02/20/tmp_1708429392052.mp4-new':
    Stream #0:0: Video: hevc, yuv420p(GBR), 2880x1620, q=2-31, 1048 kb/s, 15 fps, 15 tbr, 1000k tbc
    Stream #0:1: Audio: aac, 8000 Hz, 1 channels, s16
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
2024-02-20 11:43:51 [1708429431:646] DGIOT ../../Storage/StorageManager.cpp 1657 DoRecoverRcdProc(): recover tmp mp4 file take 1483 ms

2024-02-20 11:43:51 [1708429431:647] DGIOT ../../Storage/StorageManager.cpp 1661 DoRecoverRcdProc(): delete record file : /mnt/DCIM/2024/02/20/tmp_1708429392052.mp4

2024-02-20 11:43:51 [1708429431:652] DGIOT ../../Storage/StorageManager.cpp 1664 DoRecoverRcdProc(): delete record file : /mnt/DCIM/2024/02/20/tmp_1708429392052.mp4-recover

2024-02-20 11:43:51 [1708429431:653] DGIOT ../../Storage/StorageManager.cpp 1673 DoRecoverRcdProc(): rename /mnt/DCIM/2024/02/20/tmp_1708429392052.mp4-new to /mnt/DCIM/2024/02/20/20240220114312-20240220114347.mp4

2024-02-20 11:43:51 [1708429431:654] DGIOT ../../Storage/StorageManager.cpp 1725 DoRecoverRcdProc(): delete record file : /mnt/DCIM/2024/02/20/tmp_1708429392052.mp4-new

[01-01 18:12:15-- TUYA Notice][gw_intf.c:2324] serial_no:(null)
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2353] gw_cntl.gw_wsm.stat:2
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2356] gw_cntl.gw_wsm.nc_tp:6
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2357] gw_cntl.gw_wsm.md:0
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2358] gw_cntl.gw_wsm.dns_prio:1
unm_set_dns_cache_priority ->1
err(wdt_keep_alive,22): Bad file descriptor
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2392] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2393] gw_cntl.gw_if.product_key:c7zkhbbp7kb6yorg, input:c7zkhbbp7kb6yorg
[01-01 18:12:15-- TUYA Notice][gw_intf.c:2394] gw_cntl.gw_if.tp:0, input:0
unm_set_dns_region 3
unw_add_dns_cache [http://a.tuyaus.com/d.json]<->[318164215]
unw_add_dns_cache [https://a2.tuyaus.com/d.json]<->[1679101814]
unw_add_dns_cache [m2.tuyaus.com]<->[753648327]
unw_add_dns_cache [m2.tuyaus.com]<->[753648327]
unw_add_dns_cache [baal.tuyaus.com]<->[753702113]
Cap(CaptureGetChannels , 2302):===========>Middleware CaptureGetChannels
Cap(CaptureCreate , 2366):===========>Middleware CaptureCreate ch 0
channel_max is 1
FHAdv_Osd_Init failed with -2146877311
===========>Middleware WifiStationModeCreate
*Wow, my wifi credentials here in the format [ssid],[password]*
killall: udhcpd: no process killed
killall: hostapd: no process killed
get wifi info ...
===========>Middleware WifiApModeDestroy
err(wdt_keep_alive,22): Bad file descriptor
killall: udhcpd: no process killed
killall: hostapd: no process killed
cmd : wpa_supplicant -Dnl80211 -iwlan0 -c /tmp/wpa_supplicant.conf -f /tmp/wpa_output &
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
2024-02-20 11:43:52 [1708429432:554] DGIOT ../../Net/NetConfigHook.cpp 0420 ThreadProc():

=========ENUM_INDICATOR_LIGHT_FAST_FLICKER============

x_max_steps=4000,y_max_steps=1840,x_cur_step=2000,y_cur_step=920
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
wifi connected...
udhcpc -b -i wlan0 -h dgiot -s /usr/share/udhcpc/default.script
udhcpc: option -h NAME is deprecated, use -x hostname:NAME
udhcpc: started, v1.26.2
Setting IP address 0.0.0.0 on wlan0
udhcpc: sending discover
udhcpc: sending select for 192.168.1.246
udhcpc: lease of 192.168.1.246 obtained, lease time 864000
Setting IP address 192.168.1.246 on wlan0
Deleting routers
route: ioctl 0x890c failed: No such process
Adding router 192.168.1.1
Recreating /var/nm/resolv.conf
 Adding DNS server 192.168.1.1
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
[01-01 18:12:25-- TUYA Err][app_agent.c:2070] unsupport frame type:64
err(wdt_keep_alive,22): Bad file descriptor
unw_gethostbyname m2.tuyaus.com, prio 1
use custom api to get ip for domain m2.tuyaus.com
use system dns ip 918315780 for domain m2.tuyaus.com
unw_add_dns_cache [m2.tuyaus.com]<->[918315780]
[01-01 12:00:11-- TUYA Err][mqtt_client.c:1169] mqtt socket connect fail. retry_cnt:0 op_ret:-703 errno:-25

Oh, and the last test. I started the camera with the internet access. Run the tyua app. Run VLC and connected to the stream Then I turned off WiFi. Then I killed the process and started a new one. The result is the same - the camera rebooted almost immediately with the following log:

ver: 8.37.5
wifi is 6256p
open watchdog dev fail
2024-02-26 10:38:53 [1708943933:587] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/etc/conf/product.cof] failed! section[CONST_PARAM] key[manual_ircut]

2024-02-26 10:38:53 [1708943933:590] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/etc/conf/product.cof] failed! section[CONST_PARAM] key[hardtype]
CThreadManager::CThreadManager()>>>>>>>>>
err(wdt_keep_alive,22): Bad file descriptor

mount: mounting /dev/mmcblk0p1 on /mnt failed: Device or resource busy
2024-02-26 10:38:53 [1708943933:615] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[AGING_SETTING] key[aging_test]

2024-02-26 10:38:53 [1708943933:615] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[manual_ircut]

2024-02-26 10:38:53 [1708943933:619] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[CONST_PARAM] key[hardtype]

2024-02-26 10:38:53 [1708943933:621] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[DEFAULT_SETTING] key[forceBurnLicense]

2024-02-26 10:38:53 [1708943933:621] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[STATION] key[stationssid]

2024-02-26 10:38:53 [1708943933:622] DGIOT ../../tuya/Tuya_common.cpp 0302 read_profile_string(): parse ini file[/mnt/product.cof] failed! section[STATION] key[stationpwd]

2024-02-26 10:38:53 [1708943933:785] DGIOT ../../Main.cpp 0859 checkDevLicense(): get from eeprom.

err(wdt_keep_alive,22): Bad file descriptor
CryptoRead error
2024-02-26 10:38:54 [1708943934:831] DGIOT ../../Main.cpp 0908 checkDevLicense(): get from /etc/conf/deviceinfo.

insmod: can't insert '/usr/modules/motor_gpio.ko': File exists
[dsp] version: V1.1.0.P20(gf838ce1),build: 2022-02-18
isp version:            V1.1.0.P12(g6dc09ce)
ispcore version:        V1.1.0.P18(gce94162)
ADV_ISP version:                V1.1.0.P15(g51736cf), build: 2021-12-21
set cis_clk_out freq: 24000000 hz
111111111111111
mipi version:           V1.1.0(gfb40983)
file_name is ./day_mis4001_mipi_attr.hex
Error: Cann't load sensor hex file!
file_name is ./night_mis4001_mipi_attr.hex
Error: Cann't load sensor hex file!
pstCeCfg is 0--0--0--0
==================AudioCreate start==================
[ACW_MPI] version: V1.1.0.P14(gb3c8c03),build: 2021-12-20
set_IN_config fail -2146238457
set_out_config fail -2146238457
CPacketManagerImp::CPacketManagerImp()>>>>>>>>>
sm_packetBuf null use self heap memory!
Adjust Page!
Packet usage : 0K / 767K, 0%

----------------------[02-26 10:38:55]
printJsonValue

========in AencAACStreamProc=========

========in AencG711uStreamProc=========

size = 512
MOTO test!!!
        ---zzb: ../../Net/NetConfigHook.cpp-Line56: =[{"Auth":"WPA2PSK","Channel":6,"Enable":false,"EncrypType":"CCMP","GateWay":"192.168.0.255","HostIP":"192.168.0.1","Keys":"12345678","Netmask":"255.255.255.0","SSID":"dgiot"}
]--
2024-02-26 10:38:55 [1708943935:302] DGIOT ../../Storage/StorageManager.cpp 0308 Init(): Disk Free Size : 7625560064

2024-02-26 10:38:55 [1708943935:304] DGIOT ../../Storage/DiskManager.cpp 0094 Init(): Disk ---> total : 7801405440, used : 175845376, free : 7625560064

2024-02-26 10:38:55 [1708943935:305] DGIOT ../../Net/NetConfigHook.cpp 0075 Init(): ======================================CNetConfigHook::Init()====================1==================

NetSetEthMac cmd ifconfig eth0 hw ether 62:6c:53:20:01:14
ifconfig: SIOCSIFHWADDR: Device or resource busy
2024-02-26 10:38:55 [1708943935:334] DGIOT ../../Net/NetConfigHook.cpp 0095 Init(): ======================================CNetConfigHook::Init()====================2==================

Threads:
               Name            PID  Prior State
_______________________________________________________
                    Main        843   64  Normal
                 FeedDog        850   50  Normal
            TimerManager        862   50  Normal
                  Pooled        863   50  Normal
          IndicaotrLight        864   50  Normal
            AudioManager        874   50  Normal
             AudioPrompt        875   50  Normal
                     PTZ        876   50  Normal
            CDiskManager        881   50  Normal
         CStorageManager        880   50  Normal
_________________________________________
          NoName 450 Idel
    EventManager 1000 Idel
vedio avcodec_parameters_from_context ret : 0
audio avcodec_parameters_from_context ret : 0
Output #0, mp4, to '/mnt/DCIM/2024/02/26/tmp_1708943793360.mp4-new':
    Stream #0:0: Video: hevc, yuv420p(GBR), 2880x1620, q=2-31, 1048 kb/s, 15 fps, 15 tbr, 1000k tbc
    Stream #0:1: Audio: aac, 8000 Hz, 1 channels, s16
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
[01-01 18:12:15:326 TUYA Notice][gw_intf.c:2324] serial_no:(null)
[01-01 18:12:15:329 TUYA Notice][gw_intf.c:2353] gw_cntl.gw_wsm.stat:2
[01-01 18:12:15:330 TUYA Notice][gw_intf.c:2356] gw_cntl.gw_wsm.nc_tp:6
[01-01 18:12:15:331 TUYA Notice][gw_intf.c:2357] gw_cntl.gw_wsm.md:0
[01-01 18:12:15:331 TUYA Notice][gw_intf.c:2358] gw_cntl.gw_wsm.dns_prio:0
unm_set_dns_cache_priority ->0
[01-01 18:12:15:463 TUYA Notice][gw_intf.c:2392] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:15:463 TUYA Notice][gw_intf.c:2393] gw_cntl.gw_if.product_key:c7zkhbbp7kb6yorg, input:c7zkhbbp7kb6yorg
[01-01 18:12:15:464 TUYA Notice][gw_intf.c:2394] gw_cntl.gw_if.tp:0, input:0
unm_set_dns_region 3
unw_add_dns_cache [http://a.tuyaus.com/d.json]<->[318164215]
unw_add_dns_cache [https://a2.tuyaus.com/d.json]<->[1679101814]
unw_add_dns_cache [m2.tuyaus.com]<->[753648327]
unw_add_dns_cache [m2.tuyaus.com]<->[753648327]
unw_add_dns_cache [baal.tuyaus.com]<->[753702113]
err(wdt_keep_alive,22): Bad file descriptor
Cap(CaptureGetChannels , 2302):===========>Middleware CaptureGetChannels
Cap(CaptureCreate , 2366):===========>Middleware CaptureCreate ch 0
channel_max is 1
CCaptureManager::start(0)(1)......
sched set 98, 2
ADV_SMARTIR version:            V1.1.0.P15(g51736cf), build: 2021-12-21
get wifi info ...
===========>Middleware WifiApModeDestroy
killall: udhcpd: no process killed
killall: hostapd: no process killed
Cap(CaptureForceIFrame , 2615):===========>Middleware CaptureForceIFrame
Cap(CaptureForceIFrame , 2615):===========>Middleware CaptureForceIFrame
Cap(CaptureSetOSDSwitch , 2668):===========>CaptureSetOSDSwitch
Cap(CaptureSetFormat , 2749):===========>Middleware CaptureSetFormat
Cap(CaptureSetFormat , 2749):===========>Middleware CaptureSetFormat
CCaptureManager::start(1)(1)......
Cap(CaptureStart , 2763):===========> start Middleware CaptureStart,channel=0,dwType=0
Cap(CaptureStart , 2763):===========> start Middleware CaptureStart,channel=0,dwType=1
CAlarmManager::instance()->start()...
Cap(CaptureGetChannels , 2302):===========>Middleware CaptureGetChannels
CAlarm::CAlarm()>>>>>>>>>
CAlarm::Start()>>>>>>>>>

==============MotionDetectCreate==================

MD version:             V1.1.0.P15(g51736cf), build: 2021-12-21
err(wdt_keep_alive,22): Bad file descriptor
err(wdt_keep_alive,22): Bad file descriptor
===========>Middleware WifiStationModeCreate
[my_wifi_ssid_here],[my_wifi_password_here]
vedio avcodec_parameters_from_context ret : 0
audio avcodec_parameters_from_context ret : 0
Output #0, mp4, to '/mnt/DCIM/2024/02/26/tmp_1708943939371.mp4':
    Stream #0:0: Video: hevc, yuv420p(GBR), 2880x1620, q=2-31, 1048 kb/s, 15 fps, 15 tbr, 1000k tbc
    Stream #0:1: Audio: aac, 8000 Hz, 1 channels, s16
killall: udhcpd: no process killed
killall: hostapd: no process killed
err(wdt_keep_alive,22): Bad file descriptor

@hubaksis from the log, it looks like the watchdog isn't being 'freed' when you kill the application, so basically if you kill dgiot the device will restart because you won't be able to open the watchdog (to prevent it from restarting). We'd have to take a look at your startup files to see if there's a way to execute dgiot from the SD card directly, that is, without running the one from the internal flash. You'd have to provide a zip of the firmware dump or just zip the / into a file in the SD card so I could review them -- either way there's no guarantee we can find a way to do it.

Thanks for looking into it. Should I just cp -r /[all directories] /mnt/?

@hubaksis that command should be fine, then you'll have to zip it to post it on github.

I'm working on the same problem. And reached the same point now. It's so frustrating...

happy to hear of any success in this regard.

Greetings Fred

I had the following idea: Do you think it might be possible?

Let everything run as it was, but additionally start a new process, which reads the camera data and offers it as rtsp stream. What wold be needed for this approach?

"start a new process, which reads the camera data and offers it as rtsp stream." - That is what I tried at first, I even wrote some code (you can see it here: https://github.com/guino/BazzDoorbell/tree/master/streamer) but it still requires looking at the code in ghidra to find the ring buffer address, plus you have an extra process on a device with limited amount of memory... bottom line is: it was much easier to 'mod' the existing application to provide RTSP than write it from scratch. It is not impossible, just requires someone with a lot of time.

I tried intalling mediamtx and ffmpeg. mediamtx does run, but i could not figure out how to get the video-stream into it.

The "ring buffer"? I guess that's where the video-data is stored? Any more ideas on this?

dgiot-7.6.32.zip here is my version of dgiot

I had another idea: Maybe it is possible to redirect the internet-traffic to my own server without the device noticing it's not the original server. Any thoughts on this?

The hosts file is read-only though. But maybe the traffic can be re-routed inside the router?

These devices usually have a hardware/chip encoding function which gets the camera feed, encodes it and places it in a 'ring buffer' (circular buffer) where it keeps writing to the end of it until it runs out then it goes back to writing at the start. It's usually not that hard to find the memory in the application where it's stored, but the application usually gets 'notified' when new data arrives and an outside application would simply have to 'monitor' it which can be tricky and CPU intensive.

You should be able to use mount --bind to point the hosts file to a file in the SD card, the main issue is that you'd have to find and change the certificates in the application (or it will not talk to the untrusted server). Finally you'd have to implement the required server functions -- all of that takes time. From what I have seen the RTSP feed is also encrypted, so you'd have to decrypt it too.

I have seen some SDKs floating around for these boards, and it may be easier to use an SDK to write a whole new application that will just serve RTSP than to do any of stuff mentioned above. It's sad but I think they just do this on purpose, I mean: they sell you a cheap device which only works with their cloud stuff so you're locked in to their services. There are some projects like open_ipc that aim to flash a whole new firmware without manufacturer cloud, but hardware support is very limited. I personally stopped buying these devices -- if I need something I just get on aliexpress and look for anything with RTSP readily available, pay a little more and not have to deal with any cloud stuff.

guino / LSC1080P

RTSP stops working without access to the Internet. #3

Here's how to patch: