Unable to Root the camera

Woolfy025 commented 3 years ago

I picked up 2 of the 1080P Merkury cameras and haven't been able to get this hack setup. Both Tuya and Geeni apps do not show the current firmware. It only asks me to update to version 2.10.1 when I open the stream.

Tried 2 different SD cards with the same results. 8GB SD card is formatted FAT32 and here are the files in the root directory:

busybox env initrun.sh ppsFactoryTool ppsMmcTool

This is just a general summary of the steps I took to create it on the Card:

1: Copied the 3 files over to the root of the SD card / Downloaded and saved BusyBox to the Root 2: Saved ppsFactoryTool.txt to Root of the SD card / manually added my wifi and password as mentioned(Saved file) 3: Ejected SD card/put it in the camera while off, and held down reset button for 5 seconds

After that, I tried all the URL links and still nothing. It just doesn't wont connect / or give me any information. The 1 camera is connected to my home network so, I don't know what's going on. What app tells you the firmware of the camera? Am I missing a file or did I miss a step? I was just confused cause part of the steps refer back to the 720p camera so, I'm not sure if I missing something.

guino commented 3 years ago

@Woolfy025 you should try just ppsFactoryTool.txt to see if you can at least get the URLs working. Be sure to try the URLs with port 8090 (the default is 80 when not specified) and you should also try admin:admin for user:password (as well as the admin:056565099).

The only way to know the firmware version is the /devices/deviceinfo URL or using the app — in your case it seems the apps are asking to update the firmware and the screen to know the version is blocked by that popup. Since the popup asks to update to 2.10.1 and you can’t get URLs working it is probably safe to assume your firmware is 2.10.0.

It is better to install the hack without updating first but if you can’t get the URLs working right now then chances are that your firmware is already on 2.10.0 you can probably go ahead and update it — the screen that shows the version will be in the properties button while viewing the stream (after the update popup).

I have never tried this but you could try something like this: -power on camera with internet available -verify the app can find the camera (ie try to view stream) -close/kill phone app -unplug your router from internet (so you no longer have internet but the router stays on) -put your phone in airplane mode and only enable wifi (so your phone is connected to router but has no internet even thru cell service) -open the app and try accessing the camera

It is possible the above would allow you to see the stream without having to update the firmware (without showing a popup). If it does show a popup it should be safe to say “yes” to update knowing it won’t be able to download it since the internet is not available. As long as you can get to the stream after the popup you should be able to click the properties button and view the firmware version under “device update” or something similar.

From what I have seen all devices on 2.x.x firmware can work with ppsFactoryTool.txt - if you’re having trouble with it: modify it with a fake wifi password and post a zip of it here so I can review the format. You don’t have to push reset or have any other files in the SD card for it to work. You should be able to just insert the SD card with the file while the device is ON and it should recognize the file (but powering the device on with the SD should be fine too).

Woolfy025 commented 3 years ago

So, I tried just as you described and it still wasn't able to connect. I saved all the links and tried them but nothing happened. Are most of the links supposed to redirect? This one http://admin:056565099@IP:8090/devices/deviceinfo redirects to:

http://ip:8090/devices/deviceinfo

Every combination of username password I tried for each link which was everyone I could find on both the 720p / 1080 camera pages(Including the 8090 ones). Decided to upgrade just one of the cameras V2.10.1 and it finally gives me access to the full menu. Previously it just nagged me about updating the firmware, and would close the video stream if I cancelled out of it.

Tried those steps as before with the new firmware and still nothing. I couldn't do the router reset thing you mentioned as people are still on it. I tryed what you mentioned with the ppsFactoryTool.txt file, and zipped it for you to take a look at.

If you don't see anything wrong with that file I think I'll just leave the cameras as they are. While it would be nice if they were rooted, I can live with how they are functioning now. Thanks

ppsFactoryTool.zip

guino commented 3 years ago

@Woolfy025 the ppsFactoryTool.txt file format seems correct. With the file in the SD card and version 2.10.x you should be able to access the URLs in port 80 like http://admin:056565099@IP/devices/deviceinfo -- please notice that the admin:056565099 part is the user+password to login in the URL, it is normal for the user:password to not show on the address bar (it's not a redirect) but I have heard of people having issues with specific browsers so I recommend trying a different one since you're having issues (I have always used firefox without problems).

My main question for you right now is you say you 'can't get the URLs working' -- what happens when you try to access the URL ? does it give you a username/password prompt over and over ? or does it just not give you any response at all (i.e. timeout) or does it give you some HTTP error (i.e. 404, 500 etc) ?

Depending on what's happening when you're trying to access the URL it may give us a hint of how to fix the problem.

Woolfy025 commented 3 years ago

I have tried both Edge browser (With extensions) and on plain Google Chrome. I don't have the cameras connected in my house at the moment but I think the main error on Edge says:

"Hmmm… can't reach this page Check if there is a typo in ip."

Chrome has this error:

This site can’t be reached / check if there is a typo in ip. If spelling is correct, try running Windows Network Diagnostics. DNS_PROBE_FINISHED_NXDOMAIN

No popups to enter a username / password or anything. I will give Firefox a try tomorrow though, and see how it goes. I have the cameras out in a barn currently so I have to bring them inside to test them.

I just have the camera plugged into the wall outlet, was I supposed to have it connected to my laptop? I don't think one of the steps mentioned it but just had a thought maybe that's why. I run the camera on my main wifi network. The laptop is connected to that as well when I try to access that link.

I just wonder if I was to upgrade one of the cameras to the highest firmware, and try all the steps over again if that would make a difference. I don't know if you have the cameras on hand but a tutorial video would probably help a lot. If not, that's ok. I'll try again tomorrow and let you know how it goes.

guino commented 3 years ago

@Woolfy025 try firefox but mainly double check the IP address you are using — it is not the ip displayed in the app and you probably have to find the ip on your router (and it may be changing if your device is off for a little bit).

Woolfy025 commented 3 years ago

I tried all those things and still nothing. The things that I do notice though is once I put the modified SD card in, the whole device goes offline from my network. When I setup the camera normally I get 192.168.1.9 as an IP address. I turn off the camera, pull the card and plug it back in, then the camera flashes blue and then goes solid blue.

From there I can access the camera from the app and see the IP address in my router. Is it possible that this camera is a newer hardware revision? Would that have anything to do with it not working? It looks exactly like the same camera but mine came in a 2 pack. Here are all the links I have tried in Firefox:

http://admin:admin@192.168.1.9/proc/cmdline

http://user:password@192.168.1.9/proc/cmdline

http://admin:admin@192.168.1.9:8080/cgi-bin/snap.cgi

http://admin:056565099@192.168.1.9:8090/devices/deviceinfo

http://admin:admin@192.168.1.9:8090/devices/deviceinfo

http://user:password@192.168.1.9:8090/devices/deviceinfo

I'll keep trying it the files and maybe I'll get lucky and it works. Would connecting to the uart port help at all? I have a ttl serial cable and can try to dump a firmware or something. You might have to walk me through as that is beyond what I can do as far as getting files. Connecting to is and getting shell access shouldn't be an issue though. It also says that I'm on the latest firmware (2.10.1) but I know you mentioned other firmwares upto 4.0 so, I don't know whats going on with that.

guino commented 3 years ago

@Woolfy025 when you insert a SD card with ppsFactoryTool.txt the device disconnects from the wifi and connects to whatever wifi specified in ppsFactoryTool.txt - by your description it seems like you may just have the wrong wifi name or password in the file (or it’s misspelled).

The firmware version is only dependent on brand of the device as the manufacturer defines which firmware to be used by the device. I would rather have 2.x firmware than 4.x firmware as it has better RTSP support.

I would check the information on ppsFactoryTool before trying anything involving soldering work. If anything disconnect and try connecting with the same information from your phone to make sure you can connect.

Woolfy025 commented 3 years ago

It's working! I was about ready to give up, and decided to insert the SD card WHILE the camera was on, and previously setup to my phone.(Without resetting or anything). The first command I tried was this one:

http://admin:056565099@192.168.1.9/proc/cmdline

I login and it outputs this info:

mem=37M console=ttyAMA0,115200n8 mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=5 ppsWatchInitEnd

So I guess I'll just have to follow the rest of the setup but it looks like I'm good now. I had checked my wifi username and password and they were all fine before I put the card back into the camera. How strange for it to suddenly work when I just stick the SD card back into it. I do appreciate helping me trying to sort it out! thanks

Woolfy025 commented 3 years ago

I'm missing the " ip=30" line it seems so, I'll need to figure out what to do next. I have tried 2 different SD cards though. I'll check the other threads and try different things. I did get another output file from one of the commands:

guino commented 3 years ago

@Woolfy025 the firmware ppstrong-c51-tuya2_geeni-2.10.1.20210207 already has an existing patch -- so we know it CAN work on that firmware/hardware/device. You may need to try to partition+format the SD card in linux (some have reported it only working after that) or you may need to try other SD cards. At the very least double check it is formatted as FAT32 (and not exFat or NTFS) or you can try to go in the app and ask it to 'format' the card from there.

Woolfy025 commented 3 years ago

Well....I give up. I tried 4 different SD cards between formatting it in Windows / Ubuntu and on the Camera. Nothing works. Was nice I got this far but it doesn't look like it's gonna work. Hopefully this thread helps someone else. Thank you for the help.

guino / Merkury1080P

Unable to Root the camera #3