Hooray, bricked my camera!

[holtek86]

I have a Mini 11S camera hardware version M11S_A2_V10_F37 with ppstrong-a3-tuya2_merkury-4.0.6.20210207 firmware that I have successfully rooted and then patched ppsapp using the appropriate file from https://www.marcrobledo.com/RomPatcher.js/ The camera apparently connects up to my network but I can;'t get a picture off of it using any of the URL's provided, nor will the app find the camera anymore. So am I out a camera or is there any way to either make this work or put it back the way it was?

[guino]

If you used the process from https://github.com/guino/BazzDoorbell/issues/13 (the recommended method) then all you have to do is boot without a SD card inserted and it should boot with the stock firmware .

if the camera doesn’t boot without a SD card then chances are you have a hardware issue unrelated to the root process (unless you ran the wrong version of ppsapp which could potentially mess with your settings and prevent it from working).

[guino]

@holtek86 I confused the device you are using, on this device you should just be able to boot without a SD card (without the hack), so if you camera isn't starting without a SD card you likely have a hardware issue (unless you mixed ppsapp versions which can create permanent 'damage' on the settings).

[holtek86]

It won't even boot without the SD card, just hangs with a blinking red status light. With the card, it comes up to a solid blue status light and I can get to the command line and status pages and verify that it's hacked. I can easily see how ppsapp could have been patched incorrectly and I don't know how to even tell if it's borked or revert the camera back to factory default. I did buy another camera but I really don't want to brick that one too since it's kinda mission critical. Unfortunately, I was too stupid to back up the original ppsapp off the SD card. Is there any way I can find that file somewhere or is it unique to this particular hardware instance?

[guino]

@holtek86 can you try booting with the SD card but without ppsFactoryTool.txt ? If you can post your initrun.sh and your /proc/cmdline it would be helpful for me to know there's nothing mismatched with the hack. It seems odd that the camera boots (to some extent) with the SD card but not without it (unless you used the hack from https://github.com/guino/BazzDoorbell/issues/2 which was not meant for your firmware).

[holtek86]

OK, it occurred to me that when I was trying to boot the camera without the sd card the flashing red light meant that it lost its registration with the mothership. I went back into the app and re-added it and it worked again.

So, let's try this again

I Followed the instructions exactly, confirmed it was hacked, tried to patch ppsapp using the online rom patcher. This time it goes into an endless boot loop and i can't get to any of the network URL's anymore. If I pull the sd card, it works with the app. If I delete the patched ppsapp from the sd card i can get to the camera again and it still shows being hacked. What am I doing wrong? The ppsapp does go in the root directory?

I did notice that the MD5 of the ppsapp does not match what is shown on the patch for

ppstrong-a3-tuya2_merkury-4.0.6.20210207 | M11S_A2_V10_F37 -- | -- , (e5e559715d01cf8060d56ba97ce4a79c) this is what the patch app shows:  Furthermore, the patch script does not save anything as ppsapp-rtsp in anything but firefox it saves it as ppsapp.txt In firefox it shows up as a "octet-stream" so I have doubts that this rom patcher thing is working correctly. This really shouldn't be this difficult! Any advice would be most welcome. devname | "Smart Home Camera" -- | -- model | "Mini 11S" serialno | "063777488" softwareversion | "4.0.6" hardwareversion | "M11S_A2_V10_F37" firmwareversion | "ppstrong-a3-tuya2_merkury-4.0.6.20210207" identity | "MR2010162401411828" authkey | "xxxxxx" deviceid | "xxxxxxx" pid | "aaa" WiFi MAC | "b4:fb:e3:41:63:ea" ETH MAC | "00:00:00:00:00:00"

[holtek86]

mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

[guino]

@holtek86 try just placing the ORIGINAL ppsapp (no patching) in the root of SD card. If it boot loops with it there but works fine without ppsapp on the root of SD card then you may need to follow Dan’s extra steps described here: https://github.com/DanTLehman/orion_sc008ha

If it works fine with the original ppsapp on the root of the SD card then something must be wrong with the patched ppsapp (bad patch or bad patching).

Some devices and/or firmware do not like it when you kill ppsapp and restart it (which is what the hack does by default).