Access problem to ak3918 UART

[ghost]

I bought a few 5GHz cameras from Amazon, built upon Anka ak3918ev200 SoC. I have read your blogs and git repositories about your experiments with v380ipcam and I would like to repeat some of your experiments, but I found a few issues. I found on the PCB URAT port, but I cannot use it because inittab prohibits access to it.

ttySAK0::respawn:/sbin/getty -L ttySAK0 115200 vt100 # GENERIC_SERIAL

I was able to connect to CAMERAS WiFi AP, but only ftpd service works. I can get most files, but I cannot put any. I think the /var mode is r/w so I am thinking about crontab usage, but I am not sure what kind of services are activated. Nmap found only port 21 ftp, so I am assuming that ftp service is only active. Because URAT getty is blocked, can you suggest any hacks on how to get to the camera shell?

[ricardojlrufino]

You can use telnet to root access: https://ricardojlrufino.wordpress.com/2022/02/14/hack-ipcam-anyka-teardown-and-root-access/

[ricardojlrufino]

Please share photos of your camera

[ghost]

By default, the camera has got disabled telnetd service, but I found a solution for it. If SD card root has a debug directory and file called config.sh then init will execute this script and as such I was able to get telnet access. I was able to start most services, including Wi-Fi, but I cannot get access to the video mechanism. It looks that the ANYKA environment uses v4l library and as such the camera driver exposes /dev/video0. I was not able to connect any built-by me apps such as ffmpeg, v4l utils. The apps hang. On the contrary anyka_ipc works fine, using strace I was able to trace anyka_ipc app connecting to the video driver, but I was not able to record ioctls. If you wish, I am happy to share with details. Haps

[ghost]

I sent you the requested information and photos of the camera, but I accidentally closed the "issue" so I am not sure that you received the photos. Sorry. I hate YI software, it is not only poorly written, but it is also spyware and now quite expensive payware. I like the camera's design, especially the easy installation aspect, but SW stolen from an open source concept without any ability to change is just (#@&#@ so, I would like to diminish YI-IOT software by replacement with something more appropriate, such as RTPS/ONVIF. I have seen some projects such as YI-hack-* but those projects apply changes to different SoCs than ANYKA. I was not able to find a workable SDK/chaintool kit so I recreated for modern uClibs and uClibs used by camera manufacturers but without success. I was able to compile ffmpeg, v4lv2 and others but none of them was able to read from /dev/video0. I cannot find any control required for ioctls even using trace. Because your study of ANYKA environment is more advanced than my preliminary studies, I wonder if would you be interested in any form of collaboration to hack the $#*$# YI software allowing others to forget about this BS? Any support in this matter highly appreciated Haps

---

From: Ricardo JL Rufino @.> Sent: Monday, 9 January 2023 9:16 PM To: ricardojlrufino/anyka_v380ipcam_experiments @.> Cc: Haps @.>; Author @.> Subject: Re: [ricardojlrufino/anyka_v380ipcam_experiments] Access problem to ak3918 UART (Issue #8)

Please share photos of your camera

— Reply to this email directly, view it on GitHubhttps://github.com/ricardojlrufino/anyka_v380ipcam_experiments/issues/8#issuecomment-1375419248, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AE7LCLBFDRDPGUYFNB5Y4H3WRPUADANCNFSM6AAAAAAQ2I276Y. You are receiving this because you authored the thread.Message ID: @.***>

[ricardojlrufino]

I have been testing with Yi-Home, are good cameras also the Soc is much more powerful Here is a hack replacement with her https://github.com/roleoroleo/yi-hack-Allwinner-v2

Unlike the Yi-Hack, I was able to make direct access to the image sensor, the advantage of this is that you can apply image processing algorithms. samples: https://youtu.be/o10Hf9vFvKs https://github.com/ricardojlrufino/yicam_qrcode

On yi-hack the frames are captured H.264, and to decode internally need to much of CPU (using ffmpeg)

[ricardojlrufino]

By default, the camera has got disabled telnetd service, but I found a solution for it. If SD card root has a debug directory and file called config.sh then init will execute this script and as such I was able to get telnet access. I was able to start most services, including Wi-Fi, but I cannot get access to the video mechanism

You can get imagem/video/mic using samples: https://github.com/ricardojlrufino/anyka_v380ipcam_experiments/tree/master/apps

[ghost]

I have already tried to use Allwinner hack but without success. The Alliwinner uses different Soc not ak3918, and compiled code using Allienwiner tool-chain does not work so... As I have said I built sdk/tool-chain for Anyka SoC using rootbuilder and I was able to compile code for old and new uClibs but ... I have got a problem with camera's video driver. The driver's exposes /dev/videoX device, but any attempt to read the video stream from the device using ffmpeg or v4l crashes. I don't have source code of kernel device module, so hacking this component is difficult, furthermore strace did not show so much during tracing execution of ffmpeg. Do you have any idea how to troubleshoot /dev/videoX ?

[ricardojlrufino]

Use this toolchain: https://github.com/ricardojlrufino/anyka_v380ipcam_experiments/tree/master/toolchain

And: https://github.com/ricardojlrufino/anyka_v380ipcam_experiments/tree/master/apps/ak_record https://github.com/ricardojlrufino/anyka_v380ipcam_experiments/blob/master/apps/ak_record/ak_record_run.sh and: https://github.com/ricardojlrufino/anyka_v380ipcam_experiments/tree/master/apps/ak_snapshot

[ghost]

Last year I tried to use your tool-chain and it did not work, something was missing. Furthermore, suggested tool-chain is for kernel 2.5 not 3.4.5. I was able to recreate the SDK/toolchaine exactly to the level of the camera environment (kernel 3.4.5 and uClib 2.5.x) so I can build any application ffmpg etc. but none of them can connect /read dev/video. I don't have code and I don't know how video drive works. So your idea to use another SDK not quite complete environment is just useless.

[ricardojlrufino]

Strange, with the toolchain I passed I can even create kernel modules. Perhaps your camera comes with a different kernel. https://github.com/ricardojlrufino/anyka_v380ipcam_experiments/tree/master/kernel

[ghost]

Well, based on my studies of the camera environment:

The OS is a Linux kernel version 3.4.35 for armv5tejl, the Linux main lib is uClib version 0.9.33.2

The toolkit GCC-4.8.5 + Binutils-2.24 + ulcibc-0.9.33.2

The kernel modules are: ssv6x5x (WiFi), akcamera (camera).

When I used your toolchain/kit I had some problems with libs dependencies, hence I reconstructed the toolchain and SDK for the camera’s environment 3.4.35/4.8 GCC.

Because I cannot connect to the tx/rx pads (too small, and I could not distinguish what is what) I am not keen to rebuild the kernel because I would not be able to interact with the boot sequence in case of any hiccups. In this circumstance, I decided to develop my apps using Anyka’s camera environment and I can compile any source code that complies with the environment. I was able to build FFmpeg, video4linux library your examples (apart kernel dependent). My biggest problem is that I don’t know how the Anyka video system works. I thought that they used v4l libs because the kernel exposes /dev/vidoX device. Unfortunately, I cannot read any stream from the device. FFmpeg /FFporbe -i /dev/video0 crashes saying “segment fault” but why? (I know what segment fault means).

When I execute anyka’s anyka_ipc app the app somehow reads the stream from /dev/video0 and streams video. I think the anyka_ipc is some kind of SOAP/json application, but I don’t have any APIs.

I think last year mid-year, I tried to insert your modules, but my kernel was not happy.

So in nutshell,

1. Could you confirm that your camera’s environment uses /dev/video devices?
2. Can you send me your camera kernel version, and sdk environment components versions?
3. I am not keen to play with kernel, because I might lose already limited control.
4. I don’t know how to troubleshoot video drivers in embedded environment. The strace is quite limited. Can you suggest some strategy?

---

From: Ricardo JL Rufino @.> Sent: Saturday, 21 January 2023 10:54 PM To: ricardojlrufino/anyka_v380ipcam_experiments @.> Cc: Haps @.>; State change @.> Subject: Re: [ricardojlrufino/anyka_v380ipcam_experiments] Access problem to ak3918 UART (Issue #8)

Strange, with the toolchain I passed I can even create kernel modules. Perhaps your camera comes with a different kernel. https://github.com/ricardojlrufino/anyka_v380ipcam_experiments/tree/master/kernel

— Reply to this email directly, view it on GitHubhttps://github.com/ricardojlrufino/anyka_v380ipcam_experiments/issues/8#issuecomment-1399241854, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AE7LCLEKQTSP75R35CMYI3DWTPIQ5ANCNFSM6AAAAAAQ2I276Y. You are receiving this because you modified the open/close state.Message ID: @.***>

[ricardojlrufino]

1. YES But it uses a special driver to interact with camera sensor

2. all infos is on the page: https://ricardojlrufino.wordpress.com/2022/02/14/hack-ipcam-anyka-teardown-and-root-access/

3. from the specs you passed it seems to be the same camera

4. No, this topic is quite complicated. You always need to have the manufacturer's SDK, using pure video4linux will be difficult to work. try compile ffmeg using my toolchain: Compatible ffmpeg: /anyka_v380ipcam_experiments/build_libs/ffmpeg_404/

Put '/rootfs_v1basic' on sd card and boot your camera. https://ricardojlrufino.wordpress.com/2022/02/15/hack-ipcam-anyka-booting-rootfs-from-sdcard/