Smart Solar IP Camera v4.0.117

[BmdOnline]

I'm trying to customize this model.

Connecting with Tuya Smart, the camera is v4.0.117. An upgrade to v4.0.120 is suggested. I don't install it.

What I've tried, without success :

• option 3 from this repository
• method from Merkury720/Merkury1080P repository

Each time, only 6668 port is opened :

$ nmap -p- 192.168.0.155 Starting Nmap 7.94 ( https://nmap.org ) at 2024-05-20 00:26 CEST Nmap scan report for 192.168.0.155 Host is up (0.041s latency). Not shown: 65534 closed tcp ports (conn-refused) PORT STATE SERVICE 6668/tcp open irc

Nmap done: 1 IP address (1 host up) scanned in 13.59 seconds

I'm using a Sandisk 64Gb, FAT32 MicroSD. Each time "DCIM" folder is created on the card, so it doesn't seem to be related to the card.

I don't know what else to do for the moment. I will try to open the camera, but I don't know how to do without damaging it.

[BmdOnline]

It works.

rootfs contains full rcS script and all removed files once running

/lib/modules/cywdhd.ko
/lib/modules/3.10.14-Archon/cywdhd.ko
/lib/firmware/fw_bcm43438a1.bin
/stone/main

Now we can access main process if needed.

[BmdOnline]

I've tried to kill main process : camera restarts. I've tried to copy main file into stone folder : camera restarts.

Maybe some files on sdcard may be created for enabling some features. Or adding some parameters in config files... but I don't know what to look for.

Some stuff for investigating :

$ strings main | grep -F sdcard | sort | uniq
/mnt/sdcard/%s.%s.txt
/tmp/mnt/sdcard/
/tmp/mnt/sdcard/DCIM
/tmp/mnt/sdcard/DCIM/%04d/%02d/%02d
/tmp/mnt/sdcard/DCIM/%04d/%02d/%02d/
/tmp/mnt/sdcard/biz.dat
/tmp/mnt/sdcard/factory/
/tmp/mnt/sdcard/factory/factory.ini
/tmp/mnt/sdcard/factory/insmod_usb/insmod_usb.sh
/tmp/mnt/sdcard/factory/network_config.ini
/tmp/mnt/sdcard/factory_update
/tmp/mnt/sdcard/sn_play
/tmp/mnt/sdcard/tuya.dat
/tmp/mnt/sdcard/update.bin
insmod /tmp/mnt/sdcard/factory/asix.ko
insmod /tmp/mnt/sdcard/factory/dwc2.ko
insmod /tmp/mnt/sdcard/factory/usb-common.ko
insmod /tmp/mnt/sdcard/factory/usbcore.ko
insmod /tmp/mnt/sdcard/factory/usbnet.ko
rm /tmp/mnt/sdcard/tuya.dat
sdcard is full ,mkidr test fail
sdcard not exist!
sdcard_info

$ strings main | grep -F \.cfg | sort | uniq
/config/common//imp.cfg
/config/common/battery_last.cfg
/config/common/key.cfg
/config/common/net.cfg
/config/common/reconnect_info.cfg
/config/common/sys.cfg
/config/common/wifi.cfg
/config/dat/dev.cfg
/config/dat/factory.cfg
/config/dat/sn.cfg
open dev.cfg failed!
open factory.cfg error!
open key.cfg error!
open sn.cfg error!
open update.cfg error!
read file factory.cfg failed.
update.cfg

$ strings main | grep -F \.ini | sort | uniq
.init
/tmp/mnt/sdcard/factory/factory.ini
/tmp/mnt/sdcard/factory/network_config.ini
read factory.ini file failed.

$ strings main | grep -F \.dat | sort | uniq
!NULL==mask.data
.cpr.dat.hex
.data
.data.rel.ro
/conf/dat/biz.dat
/conf/dat/tuya.dat
/config/dat/biz.dat
/config/dat/ctcc.dat
/config/dat/dot.dat
/config/dat/tuya.dat
/store/biz.dat
/store/tuya.dat
/tmp/mnt/sdcard/biz.dat
/tmp/mnt/sdcard/tuya.dat
NULL==mask.data
b.data[i] != 0
biz.dat
calloc pcontainer->pelem[%d].data failed
cpr.dat
ctcc.dat
dot.dat
rm /tmp/mnt/sdcard/tuya.dat
tutk.dat
tuya.dat

$ strings main | grep -F https: | sort | uniq
# https://curl.haxx.se/docs/http-cookies.html
https://
https://%s%s/%s%s%s&v=1.0&bucket=%s&typath=%s
https://%s.%s%s?Expires=%d&OSSAccessKeyId=%s&Signature=%s&v=1.0&bucket=%s&security-token=%s
https://%s.%s%s?X-Amz-Security-Token=%s&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=%s&X-Amz-Date=%s&X-Amz-Expires=60&X-Amz-SignedHeaders=host&bucket=%s&v=1.0&X-Amz-Signature=%s
https://a2-ueaz.tuyaus.com/d.json
https://a2-weaz.tuyaeu.com/d.json
https://a2.tuyacn.com/d.json
https://a2.tuyaeu.com/d.json
https://a2.tuyaus.com/d.json

$ strings main | grep -F .com | sort | uniq
*.tuya.com0
*.tuya.com0
*.tuya.com1
*.tuyaaf.com1
*.tuyaas.com1
*.tuyacn.com1
*.tuyaeu.com1
*.tuyain.com1
*.tuyajp.com1
*.tuyarf.com1
*.tuyasa.com1
*.tuyaus.com1
*.wgine.com1
.comment
ftp@example.com
https://a2-ueaz.tuyaus.com/d.json
https://a2-weaz.tuyaeu.com/d.json
https://a2.tuyacn.com/d.json
https://a2.tuyaeu.com/d.json
https://a2.tuyaus.com/d.json
iot_world@tuya.com1
m2.tuyacn.com
m2.tuyaeu.com
m2.tuyaus.com
mes.wisdomep.com
mq.gw.tuyacn.com
time.pool.aliyun.com
time.twc.weather.com
time.windows.com

$ strings main | grep -F .cn | sort | uniq
*.tuya-inc.cn1
cn.ntp.org.cn
de.ntp.org.cn
edu.ntp.org.cn
jp.ntp.org.cn
kr.ntp.org.cn
sgp.ntp.org.cn
tw.ntp.org.cn
us.ntp.org.cn

$ strings main | grep -F rtsp | sort | uniq
===============rtsp url:%s
rtsp
rtsp://%s:%d/h264/1/main/av_stream
rtspUrl

[guino]

@BmdOnline when you killed the main process, did you try running it immediately after (from SD card) ? If we kill the main process on other cameras (ppsapp) the camera also restarts because of the watchdog, but (in most cases) if we start the main process again it keeps working -- which allows us to run a modified/patched version of the main application.

We even made a 'watchdog feeder' for the other camera types which allowed us to keep the device running while the main application was not running. I doubt the same code would work for this device, but I'm sure it would be possible to do something similar. I also have seen some separate tools (on specific devices) to disable the watchdog altogether, sometimes it's just a parameter in an executable with unrelated name (so only way to know is execute whatever tools may be available hoping to see some parameter information).

[BmdOnline]

@guino, I've just tried this script

set -x
kill -9 `pidof main`
kill -9 `pidof alps`
cp /tmp/mnt/sdcard/mtdblock3.rootfs/stone/main /stone/main
/usr/bin/alps &
/stone/main &
sleep 0.3
rm -f /stone/main &

Camera keeps alive longer, but restarts after approximately 15 seconds. I've tried to play with alps and main scripts together, same behavior.

[guino]

@BmdOnline I don't know if you've tried this yet but I assume you have tried it:

• without killing/re-running alps
• just running main from the SD card (without copying it first)
• copying main before killing it (to save time between killing/re-running it)

If you've tried the above and it none of it helped then we would have to modify the flash to run the main application from the SD card (when available) instead of running it from the flash memory -- otherwise there's no point in even trying to modify the main application.

[mihovilkolaric]

Hi,

keeping the camera alive is rather easy ... looking at `ls -l /proc/91/fd/ (91 is the pid of the main-process) showed that it accesses /dev/watchdog.

So I just tried watch -n 1 "echo 1 > /dev/watchdog" in one telnet-session, and in another I could kill main (connection to LSC-App failed of course), while the telnet-session kept alive for minutes:

root@Zeratul:~]# kill 91
[root@Zeratul:~]# date
Sat Jun 15 23:32:10 CST 2024
[root@Zeratul:~]# date
Sat Jun 15 23:36:02 CST 2024
[root@Zeratul:~]#

[BmdOnline]

Yes, it works. I imagine we can create a new camera software, or a patched version of main process, enabling rtsp, avoid use of tuya servers...

BTW, feeding watchdog seems to prevent camera to enter sleep mode.

[gtxaspec]

You can try running thingino firmware on it. The streamer and associated sources are fully open, as well as the build system being buildroot based.

[mihovilkolaric]

Hi all, I also did some tests in restarting the main-application. Interesting finding: Copy main from sdcard before killing running instance leads to immediate reboot.

Thus I used following approach: While feeding the watchdog by a shell-script rom another terminal, I used: [root@Zeratul:sdcard]# kill 91 ; cp stone/main /stone/ ; /stone/main > main_log.txt (I haven't touched alps so far)

Which lead to a reboot after ~15 sec, as @BmdOnline described. However, it produced following log: main_log.txt

Some findings in the log: Main complains about another missing file: [0;32;31m[-][ERROR][muart_get_key][202] open key.cfg error!

(Looks like it is expected in /config/common/:

$ strings stone/main | grep key.cfg
/config/common/key.cfg
open key.cfg error!

but not present on my cam.)

and the last line that makes it to the logfile is: [06-19 22:26:25-- TUYA Err][mqtt_client.c:1283] __mq_recv err op_ret:-1 recv_len:0

(no idea yet which o the two conditions trigger the reboot - but as I was still feeding it externally, it is rather an explicit reboot, than a watchdog-restart.

[mihovilkolaric]

You can try running thingino firmware on it. The streamer and associated sources are fully open, as well as the build system being buildroot based.

Do you know which existing model/build is similar to this hardware, and do you think that booting the "stock" linux, killing main, and running thingino's streamer (while feeding the watchdog externally) might work (as a "proof of concept")?

[BmdOnline]

Binaries from wz_mini_hacks are working. For example, I can start ffmpeg from wz_mini_hacks.

@gtxaspec, maybe we can use go2rtc_linux_mipsel ? How can we configure it without entire SD_ROOT package ?

Things to do :

• [ ] fully prevent camera restart feeding watchdog prevent restat only for 5mn.
• [ ] wake up camera without tuya app I've tried to analyse network request with wireskark but it's beyond my skills. Maybe broadcast packet ? mac request ?
• [ ] Replace main process with another streamer How to compile a standalone thingino's streamer ? How to use go2rtc ?

[gtxaspec]

1.if you keep feeding the watchdog and it reboots after 5 minutes, there could be an external mcu that has it's own watchdog. can you please share photos of the entire pcb board, back and front?

3. go2rtc won't work without heavy modifications. you'll need a v4l video device to use ffmpeg to interface to go2rtc or feed go2rtc an rtsp stream.

you can download precompiled prudynt binaries from: https://github.com/gtxaspec/prudynt-t/

[BmdOnline]

[gtxaspec]

judging by the two sets of UART tx/rx pads, there is an external MCU. you should inspect the board chip by chip, and see which one is an MCU

[mihovilkolaric]

Regarding "wake up without tuya app": From my wireshark-traces, I understand following:

• after startup, MCU of the camera connects to the WIFI, requests an IP using DHCP
• then queries the IPs of "a2.tuyaeu.com" and "m2.tuyaeu.com" (using DNS)
• then there are several encrypted TCP connections: 1 to m2.tuyaeu.com:8883 (Secure MQTT) and 4 to a2.tuyaeu.com:443 (HTTPS)
• finally, the MCU opens an unencrypted MQTT-Connection to m2.tuyaeu.com:1883 and subscribes for the topics "d", "w" and a string, that is also used as client-ID in "Connect Command" => This connection remains open, and the camera "refreshes" it every 30s with an "Authentication Exchange". This connection is used for waking up the camera: When selecting it in the LSC-App, the camera receives a "Publish Message" for the topic "w" (and some unknown string as value). This triggers that the MQTT-Connection is closed, and the linux boots.

So, maybe it is possible using an own DNS-Server to redirect m2.tuyaeu.com to the IP of a custom "faked" MQTT-Server, which is then used to trigger the wake-up-messages. But this is (yet) highly theoretical.

[BmdOnline]

judging by the two sets of UART tx/rx pads, there is an external MCU. you should inspect the board chip by chip, and see which one is an MCU

Camera side : NS4152M : NS4152X Series 3.0W Mono Class D Audio Power Amplifier

Front side : XMC chip Ingenic T31 4057AN : Lithium-Ion Battery Management Chip PUYA chip on first picture below, we can follow tracks from TX (2nd) / RX (3rd) to this chip on second picture, we can read PUYA, but I can't read the chip reference.

We also have another board inside the camera (last picture below). I assume it was for motion and IR sensors.

[BmdOnline]

  This connection is used for waking up the camera: When selecting it in the LSC-App, the camera receives a "Publish Message" for the topic "w" (and some unknown string as value). This triggers that the MQTT-Connection is closed, and the linux boots.

From what you say, the network connection and IP address are still active even when the camera is hibernating ? I thought there would only be an sort of a wake on lan.

When camera is active :

# nmap -p- 192.168.0.155
Starting Nmap 7.95 ( https://nmap.org ) at 2024-06-20 23:44 CEST
Nmap scan report for 192.168.0.155
Host is up (0.036s latency).
Not shown: 65533 closed tcp ports (reset)
PORT     STATE SERVICE
23/tcp   open  telnet
6668/tcp open  irc
MAC Address: A8:41:xx:xx:xx:xx (AzureWave Technology)

When camera is inactive :

# nmap -p- 192.168.0.155
Starting Nmap 7.95 ( https://nmap.org ) at 2024-06-20 23:47 CEST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 1.51 seconds

[BmdOnline]

you can download precompiled prudynt binaries from: https://github.com/gtxaspec/prudynt-t/

Tried :

• Kill main, replace with watchdog feeder.
• Kill / don't kill alps

# ./prudynt-T31-static
[INFO:main.cpp]: PRUDYNT Video Daemon: Apr 24 2024 05:12:27_cf065ef
[INFO:main.cpp]: Starting Prudynt Video Server.
[INFO:IMP.cpp]: LIBIMP Version IMP-1.1.6
[INFO:IMP.cpp]: SYSUTILS Version: SYSUTILS-1.1.6
[INFO:IMP.cpp]: CPU Information: T31-ZC
[INFO:IMP.cpp]: Sensor:
[ERROR:IMP.cpp]: System Init Failed
[ERROR:main.cpp]: IMP initialization failed.

[BmdOnline]

PUYA chip on first picture below, we can follow tracks from TX (2nd) / RX (3rd) to this chip on second picture, we can read PUYA, but I can't read the chip reference.

Seem to be PUYA PY32 F030... (maybe F030F16) https://www.puyasemi.com/en/py32_series.html#common https://py32.org/en/mcu/PY32F030xx.html

[gtxaspec]

you can download precompiled prudynt binaries from: https://github.com/gtxaspec/prudynt-t/

Tried :

• Kill main, replace with watchdog feeder.
• Kill / don't kill alps

# ./prudynt-T31-static
[INFO:main.cpp]: PRUDYNT Video Daemon: Apr 24 2024 05:12:27_cf065ef
[INFO:main.cpp]: Starting Prudynt Video Server.
[INFO:IMP.cpp]: LIBIMP Version IMP-1.1.6
[INFO:IMP.cpp]: SYSUTILS Version: SYSUTILS-1.1.6
[INFO:IMP.cpp]: CPU Information: T31-ZC
[INFO:IMP.cpp]: Sensor:
[ERROR:IMP.cpp]: System Init Failed
[ERROR:main.cpp]: IMP initialization failed.

for prudynt, you need to make sure another streamer is not running, and second, you need to configure /etc/prudynt.cfg with the sensor info, name, i2c address, etc. then try and run

[gtxaspec]

PUYA chip on first picture below, we can follow tracks from TX (2nd) / RX (3rd) to this chip on second picture, we can read PUYA, but I can't read the chip reference.

Seem to be PUYA PY32 F030... (maybe F030F16) https://www.puyasemi.com/en/py32_series.html#common https://py32.org/en/mcu/PY32F030xx.html

yeah that looks like its it. have you tried to read the UART logs of the MCU? that would help.

[BmdOnline]

• Sensor is jxf37p

  # cat /proc/jz/isp/isp-m0
  ****************** ISP INFO **********************
  Software Version : H20220209a
  SENSOR NAME : jxf37p
  SENSOR OUTPUT WIDTH : 1920
  SENSOR OUTPUT HEIGHT : 1080
  ISP OUTPUT FPS : 15 / 1
  SENSOR OUTPUT RAW PATTERN : BGGR
  ISP Top Value : 0xb4742009
  ISP Runing Mode : Day
  ISP Custom Mode : Disable
  ISP WDR Mode : Disable
  SENSOR Integration Time : 34 lines
  SENSOR Max Integration Time : 2246 lines
  SENSOR analog gain : 0
  MAX SENSOR analog gain : 158
  SENSOR digital gain : 0
  MAX SENSOR digital gain : 0
  ISP digital gain : 0
  MAX ISP digital gain : 64
  ISP Tgain DB : 0
  ISP EV value: 34
  ISP EV value log2: 333411
  ISP EV value us: 1007
  ISP EV min int: 2
  ISP EV min again: 1024
  ISP WB weighted rgain: 350
  ISP WB weighted bgain: 451
  ISP WB color temperature: 4191
  ISP AWB Start rgain 262: bgain 290
  Saturation : 128
  Saturation : 128
  Sharpness : 128
  Contrast : 128
  Brightness : 124
  Antiflicker : 0
  Mirror: Enable, Flip: Enable
  debug : ch0 done 4137,ip done 4157,0,0,0,0,0,0
  debug1 : 0,0,900

• i2c address is 0x40

  # ./busybox i2cdetect 0
  i2cdetect: WARNING! This program can confuse your I2C bus
  Continue? [y/N] y
   0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
  00:          -- -- -- -- -- -- -- -- -- -- -- -- --
  10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
  20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
  30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
  40: UU -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
  50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
  60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
  70: -- -- -- -- -- -- -- --

• cat prudynt.cfg

  
  general: {
      loglevel: "DEBUG";  # Logging level. Options: DEBUG, INFO, WARNING, ERROR.
  };

sensor: { model: "jxf37p"; # Sensor model. i2c_address: 0x40; # I2C address of the sensor. fps: 24; # Frames per second captured by the sensor. width: 1920; # Width of the sensor's image (in pixels). height: 1080; # Height of the sensor's image (in pixels). };

* `prudynt-T31-static` output

./prudynt-T31-static

[INFO:main.cpp]: PRUDYNT Video Daemon: Apr 24 2024 05:12:27_cf065ef [DEBUG:Logger.cpp]: Logger Init. [INFO:main.cpp]: Starting Prudynt Video Server. [INFO:IMP.cpp]: LIBIMP Version IMP-1.1.6 [INFO:IMP.cpp]: SYSUTILS Version: SYSUTILS-1.1.6 [INFO:IMP.cpp]: CPU Information: T31-ZC [DEBUG:IMP.cpp]: IMP_OSD_SetPoolSize == 131072 [DEBUG:IMP.cpp]: ISP Opened! [INFO:IMP.cpp]: Sensor: jxf37p [DEBUG:IMP.cpp]: Sensor Added [DEBUG:IMP.cpp]: Sensor Enabled ---- FPGA board is ready ---- Board UID : 30AB6E51 Board HW ID : 72000460 Board rev. : 5DE5A975 Board date : 20190326

[DEBUG:IMP.cpp]: IMP System Initialized [DEBUG:IMP.cpp]: IMP_ISP_EnableTuning enabled [DEBUG:IMP.cpp]: ISP Tuning Defaults set [DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetSensorFPS == 24 [DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetISPRunningMode == 0 [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnRotate == 0 [DEBUG:IMP.cpp]: IMP_FrameSource_CreateChn created [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_GetChnFifoAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnFifoAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_SetFrameDepth set [DEBUG:Encoder.cpp]: Encoder Group created [ERROR:Encoder.cpp]: IMP_Encoder_SetbufshareChn(1, 0) enabled [DEBUG:Encoder.cpp]: Encoder Channel 0 created [DEBUG:Encoder.cpp]: Encoder Channel 0 registered [DEBUG:Encoder.cpp]: OSD enabled [DEBUG:OSD.cpp]: OSD init begin [DEBUG:OSD.cpp]: FREETYPE init failed. [ERROR:Encoder.cpp]: OSD Init Failed [ERROR:main.cpp]: Encoder initialization failed.

* OSD disabled in cfg

./prudynt-T31-static

[INFO:main.cpp]: PRUDYNT Video Daemon: Apr 24 2024 05:12:27_cf065ef [DEBUG:Logger.cpp]: Logger Init. [INFO:main.cpp]: Starting Prudynt Video Server. [INFO:IMP.cpp]: LIBIMP Version IMP-1.1.6 [INFO:IMP.cpp]: SYSUTILS Version: SYSUTILS-1.1.6 [INFO:IMP.cpp]: CPU Information: T31-ZC [DEBUG:IMP.cpp]: IMP_OSD_SetPoolSize == 131072 [DEBUG:IMP.cpp]: ISP Opened! [INFO:IMP.cpp]: Sensor: jxf37p [DEBUG:IMP.cpp]: Sensor Added [DEBUG:IMP.cpp]: Sensor Enabled ---- FPGA board is ready ---- Board UID : 30AB6E51 Board HW ID : 72000460 Board rev. : 5DE5A975 Board date : 20190326

[DEBUG:IMP.cpp]: IMP System Initialized [DEBUG:IMP.cpp]: IMP_ISP_EnableTuning enabled [DEBUG:IMP.cpp]: ISP Tuning Defaults set [DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetSensorFPS == 24 [DEBUG:IMP.cpp]: IMP_ISP_Tuning_SetISPRunningMode == 0 [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnRotate == 0 [DEBUG:IMP.cpp]: IMP_FrameSource_CreateChn created [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_GetChnFifoAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_SetChnFifoAttr set [DEBUG:IMP.cpp]: IMP_FrameSource_SetFrameDepth set [DEBUG:Encoder.cpp]: Encoder Group created [ERROR:Encoder.cpp]: IMP_Encoder_SetbufshareChn(1, 0) enabled [DEBUG:Encoder.cpp]: Encoder Channel 0 created [DEBUG:Encoder.cpp]: Encoder Channel 0 registered [DEBUG:Encoder.cpp]: OSD disabled [DEBUG:Encoder.cpp]: IMP_System_Bind(FS, ENC) [ERROR:Encoder.cpp]: IMP_FrameSource_EnableChn() == -1 [ERROR:main.cpp]: Encoder initialization failed.

[gtxaspec]

run logcat and share the output please

[BmdOnline]

yeah that looks like its it. have you tried to read the UART logs of the MCU? that would help.

I have strange behaviour when I'm connecting to GND/TX/RX pins. Camera doesn't starts correctly, finally camera fully resets (lost all parameters). I have no console output.

run logcat and share the output please

Normal usage of camera

# logcat
I/OSD     (   91): IMP_OSD_SetPoolSize:524288
D/Sample-Common(   91): sample_system_init start
D/IMP-ISP (   91): ~~~~~~ IMP_ISP_Open[331] ~~~~~~~
D/IMP-ISP (   91): sensor:jxf37p, widht = 1920, height = 1080
I/IMP-ISP (   91): IMP_ISP_AddSensor,487: paddr = 0x0, size = 0x477e70
I/Alloc Manager(   91): MEM Alloc Method is kmalloc
D/KMEM Method(   91): CMD Line Rmem Size:25165824, Addr:0x02800000
D/KMEM Method(   91): alloc->mem_alloc.method = kmalloc
D/KMEM Method(   91):                   alloc->mem_alloc.vaddr = 0x73a3c000
D/KMEM Method(   91):                   alloc->mem_alloc.paddr = 0x02800000
D/KMEM Method(   91):                   alloc->mem_alloc.length = 25165824
I/Alloc Manager(   91): MEM Manager Method is continuous
I/IMP Alloc APIs(   91): Sensor Width:1920 Height:1080 init_vw:1920 init_vh:1080
I/IMP Alloc APIs(   91): FASTSTART_EN width:1920 height:1080 nrvbs:2 ncubuf_len:4685424 wdrbuf_len:0
I/IMP Alloc APIs(   91): ncubuf alloc use g_ncubuf_alloc
D/System  (   91): IMP_System_Init Zeratul SDK Version:1.1.5-667713c9-Tue Aug 30 16:27:21 2022 +0800, built: Aug 31 2022 10:14:25
D/System  (   91): system_init()
D/System  (   91): Calling DSystem
D/System  (   91): Calling FrameSource
D/System  (   91): [ignored]read /proc/cpuinfo ret is NULL
D/System  (   91): Calling IVS
D/System  (   91): Calling OSD
D/System  (   91): Calling Encoder
D/System  (   91): Calling FB
I/FB      (   91): FB device open error:No such file or directory
I/FB      (   91): FB is unavailable
D/Sample-Common(   91): ImpSystemInit success
E/MemPool (   91): IMP_Encoder_GetPool(64):chnNum: 0 not bind pool
I/Encoder (   91): encChn=0,srcFrameCnt=3,srcFrameSize=3133440
I/Encoder (   91): encChn=0,srcStreamCnt=2,enc_chn->stream_frame_size=949248
E/MemPool (   91): IMP_Encoder_GetPool(64):chnNum: 1 not bind pool
I/Encoder (   91): encChn=1,srcFrameCnt=3,srcFrameSize=353280
I/Encoder (   91): encChn=1,srcStreamCnt=2,enc_chn->stream_frame_size=119808
W/Encoder (   91): Jpeg channel will not share buff
E/MemPool (   91): IMP_Encoder_GetPool(64):chnNum: 5 not bind pool
I/Encoder (   91): encChn=5,srcFrameCnt=2,srcFrameSize=353280
I/Encoder (   91): encChn=5,srcStreamCnt=1,enc_chn->stream_frame_size=287104
D/System  (   91): system_bind(): bind DST-OSD-0(4.0.0) to SRC-Framesource-0(0.0.0)
D/System  (   91): system_bind(): bind DST-Encoder-0(1.0.0) to SRC-OSD-0(4.0.0)
D/System  (   91): system_bind(): bind DST-OSD-1(4.1.0) to SRC-Framesource-1(0.1.0)
D/System  (   91): system_bind(): bind DST-Encoder-1(1.1.0) to SRC-OSD-1(4.1.0)
I/OSD     (   91): IMP_OSD_CreateRgn(1202) create handle=0 success
I/OSD     (   91): IMP_OSD_CreateRgn(1202) create handle=1 success
I/Framesource(   91): [chn1]: width = 640 height = 360
E/VBM     (   91): VBMCreatePool()-1: w=640 h=360 f=842094158
E/VBM     (   91): VBMCreatePool()-1: pool->config.fmt.fmt.pix.sizeimage=353280 sizeimage=353280
E/Framesource(   91): IMP_FrameSource_GetPool(3296):chnNum: 1 not bind pool
E/VBM     (   91): VBMCreatePool()-1: sizeimage=353280
I/VBM     (   91): PoolId:1, frame=0x13be680, frame->priv=0x13be6a8, frame[0].virAddr=74f0b000, frame[0].phyAddr=3ccf000
I/VBM     (   91): PoolId:1, frame=0x13beaa0, frame->priv=0x13beac8, frame[1].virAddr=74f61400, frame[1].phyAddr=3d25400
I/Framesource(   91): [chn0]: width = 1920 height = 1080
E/VBM     (   91): VBMCreatePool()-0: w=1920 h=1080 f=842094158
E/VBM     (   91): VBMCreatePool()-0: pool->config.fmt.fmt.pix.sizeimage=0 sizeimage=3133440
E/Framesource(   91): IMP_FrameSource_GetPool(3296):chnNum: 0 not bind pool
I/IMP Alloc APIs(   91): VBMPool0 alloc use g_VBMPool0_alloc
E/VBM     (   91): VBMCreatePool()-0: sizeimage=3133440
I/VBM     (   91): PoolId:0, frame=0x140be40, frame->priv=0x140be68, frame[0].virAddr=73eb4000, frame[0].phyAddr=2c78000
I/VBM     (   91): PoolId:0, frame=0x140c260, frame->priv=0x140c288, frame[1].virAddr=741b1000, frame[1].phyAddr=2f75000
I/ai      (   91): AI Enable: 1
I/ai      (   91): AI Enable Chn: 1-0
I/ai      (   91): EXIT AI Enable Chn: 1-0
I/ai      (   91): AI Set Vol: 90
I/ai      (   91): AI Set Gain: 30
I/ai      (   91): AI NS ENABLE: mode = 2
I/ai      (   91): AI HPF Enable
I/ai      (   91): HPF version is: Ingenic High Pass Filter 1.1.0
I/ai      (   91): AI AGC ENABLE: targetLevelDbfs = 12, compressionGaindB = 41, limiterEnable =1
I/ao      (   91): AO Enable: 0
I/ao      (   91): AO Ch Enable: 0:0
I/ao      (   91): EXIT AO Ch Enable: 0:0
I/ao      (   91): AO Set Vol: 45
I/ao      (   91): AO Get Gain: 28
I/TTFF    (   91): [frame_pooling_thread--419 Channel:1 ]:1086(ms)
I/Encoder (   91): framePriv->i_fps_num=15, framePriv->i_fps_den=1
D/Encoder (   91): enc_chn->index=1, gopAttr->uGopCtrlMode=2, gopAttr->uGopLength=30, gopAttr->uNotifyUserLTInter=0, gopAttr->uMaxSameSenceCnt=2, gopAttr->bEnableLT=0, gopAttr->uFreqLT=0, gopAttr->bLTRC=0
D/Encoder (   91): enc_chn->index=1, enc_chn->chnFpsMask=1, enc_chn->inFrmRate.frmRateNum=15, enc_chn->inFrmRate.frmRateDen=1, enc_chn->setFrmRate.frmRateNum=15, enc_chn->setFrmRate.frmRateDen=1, rcAttr->outFrmRate.frmRateNum=15, rcAttr->outFrmRate.frmRateDen=1
D/Encoder (   91): do_day_night_change(672):enc_chn->inStat.is_day=1
I/TTFF    (   91): [IMP_Encoder_GetStream_Impl--2558 Channel:1 ]:1089(ms)
I/ao      (   91): AO Set Vol: 45
D/Encoder (   91): IMP_Encoder_SetChnFrmRate:encChn=0, enc_chn->setFrmRate.frmRateNum=15, enc_chn->setFrmRate.frmRateDen=1
D/Encoder (   91): IMP_Encoder_SetChnFrmRate:encChn=1, enc_chn->setFrmRate.frmRateNum=15, enc_chn->setFrmRate.frmRateDen=1
I/TTFF    (   91): [frame_pooling_thread--419 Channel:0 ]:1554(ms)
I/Encoder (   91): framePriv->i_fps_num=15, framePriv->i_fps_den=1
D/Encoder (   91): enc_chn->index=0, gopAttr->uGopCtrlMode=2, gopAttr->uGopLength=30, gopAttr->uNotifyUserLTInter=0, gopAttr->uMaxSameSenceCnt=2, gopAttr->bEnableLT=0, gopAttr->uFreqLT=0, gopAttr->bLTRC=0
D/Encoder (   91): enc_chn->index=0, enc_chn->chnFpsMask=1, enc_chn->inFrmRate.frmRateNum=15, enc_chn->inFrmRate.frmRateDen=1, enc_chn->setFrmRate.frmRateNum=15, enc_chn->setFrmRate.frmRateDen=1, rcAttr->outFrmRate.frmRateNum=15, rcAttr->outFrmRate.frmRateDen=1
D/Encoder (   91): do_day_night_change(672):enc_chn->inStat.is_day=1
I/Encoder (   91): framePriv->i_fps_num=15, framePriv->i_fps_den=1
D/Encoder (   91): enc_chn->index=5, gopAttr->uGopCtrlMode=2, gopAttr->uGopLength=0, gopAttr->uNotifyUserLTInter=0, gopAttr->uMaxSameSenceCnt=1, gopAttr->bEnableLT=0, gopAttr->uFreqLT=0, gopAttr->bLTRC=0
D/Encoder (   91): enc_chn->index=5, enc_chn->chnFpsMask=1, enc_chn->inFrmRate.frmRateNum=15, enc_chn->inFrmRate.frmRateDen=1, enc_chn->setFrmRate.frmRateNum=15, enc_chn->setFrmRate.frmRateDen=1, rcAttr->outFrmRate.frmRateNum=15, rcAttr->outFrmRate.frmRateDen=1
D/Encoder (   91): do_day_night_change(672):enc_chn->inStat.is_day=1
I/TTFF    (   91): [IMP_Encoder_GetStream_Impl--2558 Channel:5 ]:1559(ms)
I/TTFF    (   91): [IMP_Encoder_GetStream_Impl--2558 Channel:0 ]:1569(ms)
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
I/VBM     (   91): fval[0].frame=0x13be680
I/VBM     (   91): fval[0].vaddr=0x74f0b000
I/VBM     (   91): fval[0].paddr=0x3ccf000
I/VBM     (   91): fval[0].ref=0
I/VBM     (   91): fval[1].frame=0x13beaa0
I/VBM     (   91): fval[1].vaddr=0x74f61400
I/VBM     (   91): fval[1].paddr=0x3d25400
I/VBM     (   91): fval[1].ref=0
I/VBM     (   91): fval[2].frame=0x140be40
I/VBM     (   91): fval[2].vaddr=0x73eb4000
I/VBM     (   91): fval[2].paddr=0x2c78000
I/VBM     (   91): fval[2].ref=0
I/VBM     (   91): fval[3].frame=0x140c260
I/VBM     (   91): fval[3].vaddr=0x741b1000
I/VBM     (   91): fval[3].paddr=0x2f75000
I/VBM     (   91): fval[3].ref=0
I/VBM     (   91): fval[4].frame=(nil)
I/VBM     (   91): fval[4].vaddr=0x0
I/VBM     (   91): fval[4].paddr=0x0
I/VBM     (   91): fval[4].ref=0
I/VBM     (   91): fval[5].frame=(nil)
I/VBM     (   91): fval[5].vaddr=0x0
I/VBM     (   91): fval[5].paddr=0x0
I/VBM     (   91): fval[5].ref=0
I/VBM     (   91): fval[6].frame=(nil)
I/VBM     (   91): fval[6].vaddr=0x0
I/VBM     (   91): fval[6].paddr=0x0
I/VBM     (   91): fval[6].ref=0
I/VBM     (   91): fval[7].frame=(nil)
I/VBM     (   91): fval[7].vaddr=0x0
I/VBM     (   91): fval[7].paddr=0x0
I/VBM     (   91): fval[7].ref=0
I/VBM     (   91): fval[8].frame=(nil)
I/VBM     (   91): fval[8].vaddr=0x0
I/VBM     (   91): fval[8].paddr=0x0
I/VBM     (   91): fval[8].ref=0
I/VBM     (   91): fval[9].frame=(nil)
I/VBM     (   91): fval[9].vaddr=0x0
I/VBM     (   91): fval[9].paddr=0x0
I/VBM     (   91): fval[9].ref=0
I/VBM     (   91): fval[10].frame=(nil)
I/VBM     (   91): fval[10].vaddr=0x0
I/VBM     (   91): fval[10].paddr=0x0
I/VBM     (   91): fval[10].ref=0
I/VBM     (   91): fval[11].frame=(nil)
I/VBM     (   91): fval[11].vaddr=0x0
I/VBM     (   91): fval[11].paddr=0x0
I/VBM     (   91): fval[11].ref=0
I/VBM     (   91): fval[12].frame=(nil)
I/VBM     (   91): fval[12].vaddr=0x0
I/VBM     (   91): fval[12].paddr=0x0
I/VBM     (   91): fval[12].ref=0
I/VBM     (   91): fval[13].frame=(nil)
I/VBM     (   91): fval[13].vaddr=0x0
I/VBM     (   91): fval[13].paddr=0x0
I/VBM     (   91): fval[13].ref=0
I/VBM     (   91): fval[14].frame=(nil)
I/VBM     (   91): fval[14].vaddr=0x0
I/VBM     (   91): fval[14].paddr=0x0
I/VBM     (   91): fval[14].ref=0
I/VBM     (   91): fval[15].frame=(nil)
I/VBM     (   91): fval[15].vaddr=0x0
I/VBM     (   91): fval[15].paddr=0x0
I/VBM     (   91): fval[15].ref=0
I/VBM     (   91): fval[16].frame=(nil)
I/VBM     (   91): fval[16].vaddr=0x0
I/VBM     (   91): fval[16].paddr=0x0
I/VBM     (   91): fval[16].ref=0
I/VBM     (   91): fval[17].frame=(nil)
I/VBM     (   91): fval[17].vaddr=0x0
I/VBM     (   91): fval[17].paddr=0x0
I/VBM     (   91): fval[17].ref=0
I/VBM     (   91): fval[18].frame=(nil)
I/VBM     (   91): fval[18].vaddr=0x0
I/VBM     (   91): fval[18].paddr=0x0
I/VBM     (   91): fval[18].ref=0
I/VBM     (   91): fval[19].frame=(nil)
I/VBM     (   91): fval[19].vaddr=0x0
I/VBM     (   91): fval[19].paddr=0x0
I/VBM     (   91): fval[19].ref=0
I/VBM     (   91): fval[20].frame=(nil)
I/VBM     (   91): fval[20].vaddr=0x0
I/VBM     (   91): fval[20].paddr=0x0
I/VBM     (   91): fval[20].ref=0
I/VBM     (   91): fval[21].frame=(nil)
I/VBM     (   91): fval[21].vaddr=0x0
I/VBM     (   91): fval[21].paddr=0x0
I/VBM     (   91): fval[21].ref=0
I/VBM     (   91): fval[22].frame=(nil)
I/VBM     (   91): fval[22].vaddr=0x0
I/VBM     (   91): fval[22].paddr=0x0
I/VBM     (   91): fval[22].ref=0
I/VBM     (   91): fval[23].frame=(nil)
I/VBM     (   91): fval[23].vaddr=0x0
I/VBM     (   91): fval[23].paddr=0x0
I/VBM     (   91): fval[23].ref=0
I/VBM     (   91): fval[24].frame=(nil)
I/VBM     (   91): fval[24].vaddr=0x0
I/VBM     (   91): fval[24].paddr=0x0
I/VBM     (   91): fval[24].ref=0
I/VBM     (   91): fval[25].frame=(nil)
I/VBM     (   91): fval[25].vaddr=0x0
I/VBM     (   91): fval[25].paddr=0x0
I/VBM     (   91): fval[25].ref=0
I/VBM     (   91): fval[26].frame=(nil)
I/VBM     (   91): fval[26].vaddr=0x0
I/VBM     (   91): fval[26].paddr=0x0
I/VBM     (   91): fval[26].ref=0
I/VBM     (   91): fval[27].frame=(nil)
I/VBM     (   91): fval[27].vaddr=0x0
I/VBM     (   91): fval[27].paddr=0x0
I/VBM     (   91): fval[27].ref=0
I/VBM     (   91): fval[28].frame=(nil)
I/VBM     (   91): fval[28].vaddr=0x0
I/VBM     (   91): fval[28].paddr=0x0
I/VBM     (   91): fval[28].ref=0
I/VBM     (   91): fval[29].frame=(nil)
I/VBM     (   91): fval[29].vaddr=0x0
I/VBM     (   91): fval[29].paddr=0x0
I/VBM     (   91): fval[29].ref=0
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run
W/Framesource(   91): IMP_FrameSource_EnableChn(1868):chn=1, channel->state is run

Then running prudynt

I/OSD     ( 3700): IMP_OSD_SetPoolSize:131072
D/IMP-ISP ( 3700): ~~~~~~ IMP_ISP_Open[331] ~~~~~~~
I/IMP-ISP ( 3700): IMP_ISP_AddSensor,480: paddr = 0x0, size = 0x477e70
I/Alloc Manager( 3700): MEM Alloc Method is kmalloc
D/KMEM Method( 3700): CMD Line Rmem Size:25165824, Addr:0x02800000
D/KMEM Method( 3700): alloc->mem_alloc.method = kmalloc
D/KMEM Method( 3700):                   alloc->mem_alloc.vaddr = 0x75f0a000
D/KMEM Method( 3700):                   alloc->mem_alloc.paddr = 0x02800000
D/KMEM Method( 3700):                   alloc->mem_alloc.length = 25165824
I/Alloc Manager( 3700): MEM Manager Method is continuous
D/System  ( 3700): IMP_System_Init SDK Version:1.1.6-a6394f42-Mon Dec 5 14:39:51 2022 +0800, built: Dec 29 2022 15:38:51
D/System  ( 3700): system_init()
D/System  ( 3700): Calling DSystem
D/System  ( 3700): Calling FrameSource
D/System  ( 3700): [ignored]read /proc/cpuinfo ret is NULL
D/System  ( 3700): Calling IVS
D/System  ( 3700): Calling OSD
D/System  ( 3700): Calling Encoder
D/System  ( 3700): Calling FB
D/Encoder ( 3700): IMP_Encoder_SetbufshareChn: encChn:1, shareChn:0
E/MemPool ( 3700): IMP_Encoder_GetPool(64):chnNum: 0 not bind pool
I/Encoder ( 3700): encChn=0,srcFrameCnt=3,srcFrameSize=3133440
I/Encoder ( 3700): encChn=0,srcStreamCnt=2,enc_chn->stream_frame_size=949248
D/System  ( 3700): system_bind(): bind DST-Encoder-0(1.0.0) to SRC-Framesource-0(0.0.0)
E/Framesource( 3700): [chn0]: VIDIOC_S_FMT error
E/Framesource( 3700): [chn0]: chn_attr.picWidth=1920, chn_attr.picHeight=1080, chn_attr.pixFmt=10
E/Framesource( 3700): [chn0]: chn_attr.crop.enable=0, chn_attr.crop.top=0, chn_attr.crop.left=0, chn_attr.crop.width=1920, chn_attr.crop.height=1080
E/Framesource( 3700): [chn0]: chn_attr.fcrop.enable=0, chn_attr.fcrop.top=0, chn_attr.fcrop.left=0, chn_attr.fcrop.width=0, chn_attr.fcrop.height=0
E/Framesource( 3700): [chn0]: chn_attr.scaler.enable=0, chn_attr.scaler.outwidth=640, chn_attr.scaler.outheight=360
E/Framesource( 3700): IMP_FrameSource_EnableChn(): chn 0 reset channel attr error

[gtxaspec]

E/Framesource( 3700): [chn0]: VIDIOC_S_FMT error indicates that there is a toolchain version mismatch between the modern prudynt streamer and the built-in kernel + kernel modules for the ISP and sensor.

so unless you recompile prudynt with the ancient gcc 4.7.2 ingenic toolchain, not going to work, unless you do a full thingino install. thingino & prudynt are compiled with gcc13/14

[gtxaspec]

can you run this too? for reference to get the gpio map for your device:

mount -t debugfs none /sys/kernel/debug
cat /sys/kernel/debug/gpio

[BmdOnline]

E/Framesource( 3700): [chn0]: VIDIOC_S_FMT error indicates that there is a toolchain version mismatch between the modern prudynt streamer and the built-in kernel + kernel modules for the ISP and sensor.

so unless you recompile prudynt with the ancient gcc 4.7.2 ingenic toolchain, not going to work, unless you do a full thingino install. thingino & prudynt are compiled with gcc13/14 thingino means reflash camera.

I prefer to recompile prudynt, but I have to create an entire build environment...

can you run this too? for reference to get the gpio map for your device:

[root@Zeratul:~]# mount -t debugfs none /sys/kernel/debug
[root@Zeratul:~]# cat /sys/kernel/debug/gpio
GPIOs 0-31, GPIO A:

GPIOs 32-63, GPIO B: gpio-41 (sysfs ) out lo gpio-43 (sysfs ) out lo gpio-50 (oob irq ) in lo gpio-52 (home key ) in lo gpio-53 (mmc_detect ) in lo gpio-59 (sysfs ) out lo gpio-60 (IR_N ) out lo gpio-61 (IR_P ) out lo gpio-62 (sysfs ) out lo gpio-63 (sysfs ) out lo

GPIOs 64-95, GPIO C:

[gtxaspec]

try https://github.com/Dafang-Hacks/mips-gcc472-glibc216-64bit

[BmdOnline]

try https://github.com/Dafang-Hacks/mips-gcc472-glibc216-64bit

Seem so be too complicated for me. too many dependencies, errors...

Building deps : Right from the start, to compile freetype. fatal error: bzlib.h: No such file or directory

Trying to build prudynt : unrecognized command line option '-std=c++20'