EMOS IP-300

[jkolo]

I am requesting support to get RTSP up and running and get rid of cloud connectivity for an EMOS IP-300 camera.

None of the ways I found on your github are working. The only thing is that I managed to dump flash using ppsMmcTool.txt (hopefully whole and correctly).

I also managed to connect to the camera uart.

The ppsFactoryTool.txt file unfortunately does nothing. I am however also able to connect the camera to the network using the QRCode and it is pingable. Unfortunately nmap shows that only port 6668 is open. I connected the camera to a wifi network without internet access.

Below pictures of PCB:

[guino]

@jkolo your firmware dump seems good. Do you know the exact firmware version you're running ? this looks like one of the newer firmware versions 5.2x or newer where they have removed the S80network script which allowed the boot settings to work.

You can probably patch your initrun.sh and flash it directly into the device to root it (assuming you have the tools/skills for it).

Your device should 'detect' ppsFactoryTool.txt from a quick look at it but please notice some features may only work if you have already added the device to the phone app (or the device will stay in a 'brand new' state which disables basically everything until you enroll it on the phone app).

[jkolo]

I connected with the original software to the Tuya cloud. Below is a snapshot of the camera information. The camera works normally. It was also possible to enable ONVIF. Unfortunately when you cut its internet then ONVIF does not work. Home Assistant also does not have the option via ONVIF to control camera rotation, PIR motion detection or light control. I understand that in the solution from this repo I will also have nothing but root and the ability to run RSTP? I have ordered the CH341 programmer. I'm wondering if using the ppsMmcTool.txt file it would be possible to upload squashfs with a patched initrun.sh, just like I managed with the commands in ppsMmcTool.txt to dump the firmware. I also wonder if DevPack is not a sufficient programmer to manipulate the SPI memory.

[guino]

@jkolo it is usually possible to flash using the bootloader, but it's always risky so using a hardware programmer allows you to make a backup and restore it if you do something wrong.

If you already have ONVIF, then likely you have RTSP too (it's basically part of ONVIF). Telnet/rooting will probably not help a lot, but you could poke around their code and make something to do motion detection (monitoring the log output) and control rotation (rotation control can take time though).

Most of the devices I've seen require you to remove the SPI flash from the board before reading/writing it, so keep that in mind as these boards are very fragile and you'll need the right tools and skills to do it (i.e. heat gun and some practice on old broken boards).