search

guino / Merkury1080P

Merkury1080P (CW017) Rooting and Customization
78 stars 16 forks source link

New supported device: LSC Smart Home Camera "Mini 16S" #6

Closed ranjowd closed 3 years ago

ranjowd commented 3 years ago

Got ONVIF working on a Merkury1080-ish device with firmware 4.0.6 followed by the instructions on https://github.com/guino/Merkury1080P (modified the 3 instructions) allthough I didn't got the RTSP port getting visible but I'm already happy with ONVIF.

{ "devname": "Smart Home Camera", "model": "Mini 16S", "serialno": "100361201", "softwareversion": "4.0.6", "hardwareversion": "M16S_A2_V10_F37", "firmwareversion": "ppstrong-a3-tuya2_lsc-4.0.6.20210311", "pid": "aaa", }

Original MD5: 363543651299a6178a4ba77727cc39b5

Perhaps @guino sees why the RTSP ports are not working. Original binary is included in the ZIP as well.

Patch may be added to to the https://github.com/guino/ppsapp-rtsp/issues/1 list ppsapp_Mini16S.zip

guino commented 3 years ago

@ranjowd nice work! I'll add it to the list. These 4.0.6 versions don't seem to have the old RTSP code -- only ONVIF (which has a RTSP server as part of it using rtsp://IP:8554//Streaming/Channels/101 URL.

guino commented 3 years ago

@ranjowd the patch for this version was already posted on the list 2 days ago maybe you didn't see it or did you try it and it didn't work ?

EDIT: Contents of patch seem exactly the same so I assume you just didn't see it.

ranjowd commented 3 years ago

Oops, I was working on this 2 days ago and realised today that I wanted to contribute the patch to others. The patch wasn't on the list when I was looking for it. We were probably making the patch at the exact same moment :) Still it was really fun to do, it was my first try to decompile a binary file and using a hex editor. Thanks to your explanation it wasn't too difficult. Although it would be nice if Ghidra is able to save a modified binary file by itself rather than using a hex editor next to it.

gielie commented 2 years ago

@ranjowd Hi have the same cam and firm/hardware and i have tried the hack on this camera but I can't get it to work. The output of http://IP:8090/proc/cmdline is mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

This is right, right?

and the result of http://IP:8090/proc/self/root/mnt/mmc01/hack is done

i have put the busybox file in the root as well as your ppsapp_Mini16S (changed the name in ppsapp) I get the home folder after the hack but i don't have telnet nor any port open (except 8090) what is see is that the original ppsapp file size is smaller then the one you provided for this cam, shouldn't they be the same size?

could you share your modified 3 instruction files.

some update.

I can get telnet working but no stream, it seems the cgi-bin gets deleted once the cam is booting. I can't figure out why, anyone?

guino commented 2 years ago

@gielie post a zip of you SD card files without the SDT directory and I can review. The patch for this ppsapp is posted in https://github.com/guino/ppsapp-rtsp/issues/1

if anything is being deleted from the SD card you should check how much space is left in the SD card - hopefully should be at least 2GB. There are reports that a bad format/partition of the SD card may cause it to be reformatted on reboot so you may want to try repartition/reformat in windows/linux etc to see if the files stay.

gielie commented 2 years ago

I created a new one from my own original. But the thing is cgi-bin keeps being removed at boot no matter what I try

maybe you can find what is wrong (or what im doing wrong) --deleted--

guino commented 2 years ago

@gielie your ppsapp file in the root of the SD car is NOT patched -- it is the same as the original ppsapp (from home/app directory) this must be why you can't get onvif working. Just go to https://github.com/guino/ppsapp-rtsp/issues/1 and download the patch and follow the how to patch guide next to it. There's notrhing wrong in your SD card contents that would cause it to delete the cgi-bin directory but I did notice it was formatted in a MAC and this may be why the device may not be liking it.

IF you want to get the cgi directory working (for mjpeg/snap/play/etc) you should try to format a 4GB (or larger) SD card on a linux machine or windows machine (FAtT32) then just copy the files into it and hopefully the device won't mess with it -- also always make sure you 'eject' the SD card correctly before removing it from the computer to prevent data corruption issues. I would most definitely suggest you try a different SD card if possible -- you do not have to reapply the hack, just copy the files over from one SD card to the other after preparing it.

ranjowd commented 2 years ago

You can also try to format the SD card from de LSC menu in the phone app. Maybe that will help getting the SD card in the right partition type.

My http://IP:8090/proc/cmdline is: mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

gielie commented 2 years ago

hi,

my output is the same mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

I can't get it to work, I tried a new sd card, format it on different computers and cam itself but every time the folder cgi-bin gets deleted, even if the cam stays on, put the folder on the sd card, back in the cam and poef, dir gone. I tried to create some other dir and they disappear too even if remove the home folder and put it back on it will remove the home folder. So there must be something I can't see what's happening to cam

i have reset the cam without any hack and placed a folder on the sd card and this gets deleted also, so it seems that the cam is deleting all unwanted folders on the sd card, I have no idea why and why other people don't have this problem.

guino commented 2 years ago

@gielie Do any FILES (not folders) get deleted? What is the size of the SD card?

gielie commented 2 years ago

@guino left it alone for a while; I use a 16 gb SD card (tried a new one, same result) and any extra folder gets deleted, no files only folders. so for example if I create a folder named test, it gets deleted. If I create a bogus file, it stays on the card.

i have no idea what is happening.

guino commented 2 years ago

@gielie I have never seen that before. I have only seen ppsapp delete anything (files/folders) when the SD card is full, so unless there's some formatting issue with the SD cards you're using I'd expect it to leave everything along until the card is full. Have you tried partition+formatting the SD card from a computer (ie windows, linux, mac) and seeing if the device leaves the folders alone?

gielie commented 2 years ago

I’m sorry guys, im a bit of a dumb f*, found out the stupid error on my side. On the part where I have changed the snap.cgi I did not leave out the 0x in the code. I did now and everything works great, thanks a lot and sorry I’ve wasted your time on this.

guino commented 2 years ago

@gielie glad it’s working and thanks for pointing out the problem so others can pay attention to that.

Wysiwyg44530 commented 2 years ago

Hi, I bought this cam a few days ago, I don't have to patch it the firmawre is OK. However I have to turn onvif_enable on 1 with telnet and I can'i log : connexion refused... Is there a way to modify the json file : /home/cfg/tuya_config.json ? Thanks. Wysiwyg

guino commented 2 years ago

@Wysiwyg44530 telnet is only available after rooting the device. Did you follow the rooting steps described in https://github.com/guino/Merkury1080P#conclusion ? If so did you get all expected responses or did any step fail?

Wysiwyg44530 commented 2 years ago

Hello,Thanks for answering.Here are the results of the commands :

I've joined a screen capture of the content of mmc.Thanks for helping.

guino commented 2 years ago

@Wysiwyg44530 1-You need to go into github and reply on the issue in order to post attachments (I did NOT receive any attachments you sent by email) 2-You seem to have rooted the device correctly, if telnet is not working you may want to check the size of your busybox file on the SD card (it should be around 1Mb). This is the download link for it: https://github.com/guino/BazzDoorbell/blob/master/mmc/busybox?raw=true 3-You have the same version on this thread and there's a new change (we just found) required to get the files from the SD card (but it should not be required for your device). The initrun.sh line 7 should be changed from tar xzf /opt/pps/app.tar.gz -C /mnt/mmc01/ to tar xf /opt/pps/app.* -C /mnt/mmc01/

The above should hopefully let you connect by telnet and give you the home directory with ppsapp (but you should not need anything for it).

If you still have issues, please post a zip of your SD card files (without the SDT folder) in the github issue and I can review it.

Wysiwyg44530 commented 2 years ago

Here is the zip of my SD card : SD_card_files.zip For now, I still can't telnet...

guino commented 2 years ago

@Wysiwyg44530 I see some busybox crash errors -- please try this busybox instead: https://github.com/guino/Merkury720/blob/main/mmc/busybox?raw=true

Other than that I see: -cleanup.cgi not configured (highly recommended to keep free space on the SD card so it won't get erased) -passwd file not configured (required so you can login to telnet) -dropbearmulti not downloaded correctly (but it is only required if you plan to use ssh into the device)