Genuinely 6 hours later, and I'm ready to ask for help.

[Jellsberry147]

I've done so much reading, so much downloading, so much trial and error, and I just can't get this. I followed the relevant sections from the 720 and 1080 guides, and I was able to get the Hack file populated on my card. I can't get Telnet to connect so I can issue the relevant commands (and when I downloaded the HK-Telnet Server and dialed into Localhost, I still couldn't get any connection to my camera), I don't have a tuya_config file in my /home on my card, whenever I click the admin:XXXXXXX links it just tells me I have a typo, and I somehow still don't want to give up. I got Ghidra working and I spent roughly 2 hours trying to find the Main in there using the guide + every sneaky way I could think of to try and get it, but I kept getting nowhere. I found a 3rd party parse section, but it didn't match the content of the Main file in the guide. I'm at my wit's end.

I, due to technical difficulties or incompetency or both, don't have the fancy numbers others have posted via the admin:XXXXXXX utility to try and request a patched file, but the information I have available is

Model: MI-CW217-101WW FCC ID: 2AG7C-MINI7

My MD5 (I think it was) string didn't match up with any pre-existing patch numbers. I'm very tired now and I apologize for anything where I've misspoken or done anything wrong.

[guino]

@Jellsberry147 you got the hack file and I assume you got a home directory with ppsapp inside ? If you have a ppsapp file with no matching md5 patch, please post a zip of the ppsapp file here on github and I'll take a look at it. Most 4.x firmware does not need to be patched to enable onvif/rtsp. Please note the tuya_config.json file is in the firmware (not on the SD card) so you do need telnet to change it.

Most of the time when telnet doesn't work it's because the busybox file was not downloaded correctly -- it should be over 1Mb in size and you can download it from this link: https://github.com/guino/Merkury720/raw/main/mmc/busybox

In rare cases there may be an issue with the SD card (corrupt/faulty) where it doesn't read the files correctly during boot and could prevent telnet from starting.

Please check the above and if that doesn't work, feel free to post a zip of your SD card (without the SDT folder) so I can review it.

[Jellsberry147]

@Jellsberry147 you got the hack file and I assume you got a home directory with ppsapp inside ? If you have a ppsapp file with no matching md5 patch, please post a zip of the ppsapp file here on github and I'll take a look at it. Most 4.x firmware does not need to be patched to enable onvif/rtsp. Please note the tuya_config.json file is in the firmware (not on the SD card) so you do need telnet to change it.

Most of the time when telnet doesn't work it's because the busybox file was not downloaded correctly -- it should be over 1Mb in size and you can download it from this link: https://github.com/guino/Merkury720/raw/main/mmc/busybox

In rare cases there may be an issue with the SD card (corrupt/faulty) where it doesn't read the files correctly during boot and could prevent telnet from starting.

Please check the above and if that doesn't work, feel free to post a zip of your SD card (without the SDT folder) so I can review it.

Your assumption is correct. All of those components are in the right place, as far as I can tell.

I matched up my BusyBox file with what was shown in the guide and my byte count matched up perfectly, so I don't know if that's still a possible culprit.

I'm away from my work station right now, but I'll post the relevant files as soon as I get back there.

You really are epic for keeping this project alive after such a long time, not to mention my message went less than 24 hours before you responded. These really are some cool little cameras. It's cool to see that so many other people realized it too. :)

[Jellsberry147]

Here's the full folder, ppsapp included: --deleted--

I did a ctrl+f through the ppsapp file and found several mention of the md5, but no explicit md5 string. I'm gonna keep monkeying around with the telnet in the meantime. Thank you for being willing to take a look at this. :)

[guino]

@Jellsberry147 the process worked correctly for your device (good) but you missed the fact that you needed all the files from the Merkury720 project PLUS the files from the Merkury1080P copied over them.

So what you should need right now is: 1-Download all the files from here into the root of the SD card: https://github.com/guino/Merkury720/tree/main/mmc 2-Download all the files from here into the root of the SD card (overwriting any existing files): https://github.com/guino/Merkury1080P/tree/main/mmc 3-Download busybox again (just in case you overwrite it on step 1 above): https://github.com/guino/Merkury720/raw/main/mmc/busybox 4-Configure telnet following step 9 from here: https://github.com/guino/Merkury720#rooting-and-customizng-the-device

With the above you should be able to use telnet and modify tuya_config.json as described here: https://github.com/guino/Merkury1080P/issues/9#issuecomment-926414826

There's also a patch to enable RTSP that I made for that version but I did not get confirmation of it working: https://github.com/guino/Merkury1080P/issues/39#issuecomment-1627565317 -- you should either try the patch OR the tuya_config.json change but NOT both at once.

Finally there's an offline patch available for it: https://github.com/guino/Merkury1080P/issues/39#issuecomment-1249563101 but that's more of an advanced feature.

[Jellsberry147]

Telnet seems to be my major bottleneck here. I've got the files configured, added my password hash as described in step 9, and no matter what I try I can't connect. I've never used telnet before, so I'm not sure what to expect or how to do it - and I'm having trouble finding any guides that go beyond "make firewall exceptions" or to just disable the firewall altogether while working (both of which I've tried).

I've enabled telnet in the windows settings, set an exception to allow traffic through port 23,, then I open command prompt, type telnet xx.x.x.xxx and get Could not open connection to the host, on port xx: Connect failed

I found the ip address of my device through my router config, then it tries to connect on the default port of 23 (and I've tried several other numbers just in case), and I get nothing. Ping tests work just fine, but I can't connect.

Oh, and I tried just using the patch you mentioned, but I wasn't able to get connectivity via the 8554 address you mentioned.

My lack of experience is making this a lot harder than it needs to be, and I really appreciate your helpfulness so far.

[guino]

@Jellsberry147 I'm sorry I haven't had much time for this project in months. I probably won't have much time in the next month either.

Based on the files you posted last time I asked you to prepare the SD card with the steps I posted here: https://github.com/guino/Merkury720/issues/32#issuecomment-1648840102 -- can you provide an updated zip of your SD card (without SDT folder) so I can review if there was an issue with the steps I provided ?

Getting telnet to work is crucial. Some people have issues with specific brand SD cards and/or damaged/corrupted SD cards, so it it's always worth trying another one when you're having issues.\