Cannot get Bullet 4S to work with hack

[LucaNeel]

I've tried several of your guides and issue explanations to get me through it. This is my camera information:

{ "devname": "Smart Home Camera", "model": "Bullet 4S", "softwareversion": "2.10.5", "hardwareversion": "B4S_V10_H1_2063", "firmwareversion": "ppstrong-c51-tuya2_lcs-2.10.5.20210806", "pid": "aaa", }

I've tried Merkury720 and Merkury1080p with the 3 overwritten files, all lead to the same issue, I can't get the ip=30 to show up, meaning it won't boot from the sd card.

I think I need to this your link for my hardware (but not sure): https://github.com/guino/BazzDoorbell/issues/2 If this is the correct guide to follow for my firmware, you referenced to: 'edit the provided 'env' so it has the below contents. I'm new to Github, but I can't find those referenced/attach files.

If I have those files, do I ONLY place those 3 on the sd-card? Or do I copy the files from Merkury-720/mmc first?

Sorry if I don't understand correctly, but I would really like a bit of help.

[LucaNeel]

Also, I have a # infront of MDNUM, and this is my cmdline return: mem=37M console=ttyAMA0,115200n8 mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=5 ppsWatchInitEnd

[LucaNeel]

Sorry, I am new to Github, I keep closing the incident on accident.

By executing steps from https://github.com/guino/BazzDoorbell/issues/13 by finding the files, I was able to boot and find the ip=30 after my proc/cmdine.

One thing to note is I could not get the /tmp/hack page to show up, gave me an error 500, I've heard you say it doesnt really matter as long as the hack folder is there in different issues, so I ignored it.

I then executed https://github.com/guino/BazzDoorbell/issues/2 from step 8, got the same directory, for some reason I did have a few extra files, like: dropbearmulti, mqtt_pub, hosts, upload.html.

I edited custom.sh to this (i thought I should enable onvif aswell, i think I only need RSTP though):

!/bin/sh

if [ ! -e /tmp/customrun ]; then echo custom > /tmp/customrun cp /mnt/mmc01/passwd /etc/passwd /mnt/mmc01/busybox telnetd /mnt/mmc01/busybox httpd -c /mnt/mmc01/httpd.conf -h /mnt/mmc01 -p 8080 if [ -e /mnt/mmc01/ppsapp ]; then PPSID=$(ps | grep -v grep | grep ppsapp | awk '{print $1}') kill $PPSID

/mnt/mmc01/set record_enable 0

/mnt/mmc01/set enable_event_record 1

/mnt/mmc01/set onvif_enable 1 /mnt/mmc01/ppsapp & fi

/mnt/mmc01/offline.sh &

fi if [ ! -e /tmp/cleanupdate +%Y%m%d ]; then rm -rf /tmp/cleanup* touch /tmp/cleanupdate +%Y%m%d /mnt/mmc01/cgi-bin/cleanup.cgi > /tmp/cleanup.log fi

For my httpd.conf file I did this (not sure if the format is correct): /:admin:admin

Upload ppsapp from home/app/ to RomPatcher.js, looked for a patch in https://github.com/guino/ppsapp-rtsp/issues/1 matching my MD5 hash: fa879a12c0194222afb9d3d0e80dafea For some reason I got a patch for the 'Bell 8S' not the 'Bell 4S', anyways, since you said the MD5 hash has to match, I went with it.

Device is not bricked, startsup fine, two startup beeps aswell, I can access it again, my proc/cmdline is now: mem=37M console=ttyAMA0,115200n8 mtdparts=hisfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=5 ppsWatchInitEnd - ip=${T///$'\x20'}:::::;T=\"sleep5;mkdir-p/mnt/mmc01;mount-tvfat/dev/mmcblk0p1_/mnt/mmc01;/mnt/mmc01/initrun.sh&\";eval mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=5 ppsWatchInitEnd

However, I cannot seem to connect to the camera via RTSP in VLC. Ive changd the VLC RTS -> TCP just to be sure. Ive tried these links: rtsp://192.168.178.158:8554 rtsp://admin:admin@192.168.178.158:8554 rtsp://admin:admin@192.168.178.158:8554//Streaming/Channels/101 (as stated in patch file under my md5 hash) rtsp://admin:admin@192.168.178.158:8554//Streaming/Channels/102 (as stated in patch file under my md5 hash) rtsp://admin:admin@192.168.178.158:8554/Streaming/Channels/101 rtsp://admin:admin@192.168.178.158:8554/Streaming/Channels/102

And all above with port 8555 (as mentioned in patch overview)

Port scans shows port 8080 (TCP) is open voor BusyBox https, that's about it. I dont know if RTSP is working or not.

EDIT: '(i thought I should enable aswell' to '(i thought I should enable onvif aswell' Tested all RTSP links with 8555

[guino]

@LucaNeel post a zip of your SD card contents (without the SDT folder) and I will take a look.

[LucaNeel]

sdcopy.zip I attached the folder, I cant seem to find an SDT folder by the way.

[guino]

@LucaNeel Your files seem fine (including the patched ppsapp). What I'd like you to do/check is: 1-Remove or Rename ppsFactoryTool.txt from the SD Card -- some versions don't start up completely while that file is in the SD card (we only need it to root the device -- you already did that). 2-Make sure the device is enrolled on the phone app (tuya, smardlife, lcs, etc) -- most devices will not boot up completely if they're not enrolled in the phone app (it initializes the device information/files/etc). After it's enrolled you don't need to use the phone app for anything if you don't need it. 3-Make sure the device has internet access -- most devices will not boot up completely if they can't read the date/time from tuya servers. 4-OPTIONAL you can remove the # from #/mnt/mmc01/set onvif_enable 1 in custom .sh if you want it to try and enable onvif for you. 4-OPTIONAL to use snap/mjpeg - You haven't set the address in mjpeg/snap.cgi files -- it should be: 56e6b0 for your device 5-OPTIONAL to use play.cgi - You haven't set the address in play.cgi -- it should be: 571f94 for your device

[LucaNeel]

Alright, when I am home tomorrow morning I will apply your comments. I didnt know you had to/could link them, anyways, I used the Smartlife app for the cameras initially, then I connect them to home assistant via Tuya IoT platform.

When I remove the ppsFactoryTool.txt file the lamp stays red and doesnt come up when I check the deviceinfo page. How do I know if it boots properly when I remove the file? 2 beeps with about 10 seconds in between?

And sorry, but what is the purpose of mjpeg enabled? Dont know if im going to use it, if I enable it just to have it enabled for whenever, will other thongs behave differently? Im all new to IOT and stuff, sorry.

And final question, how do I know a device is rooted? Even if I dont have the sd card in it? So I can check and know for myself when I try my other (newer) cameras. When the deviceinfo shows the ip=30 thing or?

[guino]

@LucaNeel The process you followed to get your ppsapp file is what we call rooting -- that is, gives you full access to the device to make changes, etc. Your device is rooted otherwise you'd not have your ppsapp file.

You don't have to use snap/mjpeg/play if you don't want to -- configuring the files just gives you the ability to use these features if you want to. snap.cgi-gives you a quick snapshot/image of the camera, mjpeg-same as snap but refreshes automatically, play.cgi allows you to play wav files (on sd card/device) thru the device's speaker.

The best thing to do is verify the device is working with the phone app (whichever app you chose) -- if it works on the app it should not be in 'factory mode' and should work with RTSP/ONVIF/etc.

[LucaNeel]

@guino thanks I understand the things I'm doing now, I managed to get it working and get the RTSP stream up correctly in VLC and eventually my Home Assistant dashboard. Thanks a lot for taking the time to help me, the quick responses and the initial figuring out all of this, good luck with your future projects

[guino]

@LucaNeel Thanks for reporting back!