Unable to apply the hack on YI Dome U Pro 2K - h60ga

[kyutov]

I have tried to perform the hack on my YI Dome U Pro 2K cam (which is h60ga) twice, but in both cases I ended up bricking it. The second time I have applied the hack while the cam was connected to Putty via serial connection.

Here is the complete log, which I have extracted while I was trying to apply the hack:

[133]HELLO! BOOT0 is starting Nov 14 2019 20:01:31! [138]BOOT0 commit : 81c18ee [141]board init start [143]set pll start [146]set pll end [147][pmu]: bus read error [150]board init ok [152]chip id check OK [154]DRAM BOOT DRIVE INFO: V0.41 [157]DRAM CLK = 528 MHz [159]DRAM Type = 2 (2:DDR2,3:DDR3) [163]DRAMC read ODT off. [165]DRAM ODT off. [168]DRAM SIZE =64 M [174]DRAM simple test OK. [177]rtc standby flag is 0x0, super standby flag is 0x0 [182]dram size =64 [185]spinor id is: c8 40 17, read cmd: 03 [189]Succeed in reading toc file head. [193]The size of toc is 4c000. [246]Entry_name = optee [249]Entry_name = u-boot [253]Entry_name = dtb [256]Jump to secend Boot. MESSAGE: [0x0] TEE-CORE: OP-TEE version: sun8iw19p1_v0.6.0-12-g97f2688 #1 2019年 11月 08日 星期五 08:26:51 UTC arm ERROR: [0x0] TEE-CORE:platform_standby_fdt_parse:126: no pmu node ERROR: [0x0] TEE-CORE:sunxi_twi_parse_from_dt:84: no pmu node

U-Boot 2018.05 (Mar 08 2021 - 23:23:22 +0800) Allwinner Technology

[00.300]DRAM: 64 MiB [00.303]Relocation Offset is: f9f94000 [00.314]secure enable bit: 0 [00.316]CPU=816 MHz,PLL6=600 Mhz,AHB=200 Mhz, APB1=100Mhz MBus=132Mhz [00.323]gic: sec monitor mode [00.325]flash init start [00.328]workmode = 0,storage type = 3 SF: Detected gd25q64 with page size 256 Bytes, erase size 4 KiB, total 8 MiB [00.344]sunxi flash init ok [00.347]Loading Environment from SUNXI_FLASH... start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x3e00, len: 0x100 OK [00.408]try sprite_led_gpio config xxxxxxxxxxxxxxlijun uboot xiaoyiledinit [00.416]sprite_led_gpio start 00.419update dtb dram start [00.423]update dtb dram end [00.425]update dts root_partition is rootfs start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 set root to /dev/mtdblock2 [00.488]update part info [00.491]update bootcmd mmc driver ver uboot2018:2019-8-15 16:34:00 get mem for descripter OK ! [00.503]get sdc_wipe fail. [00.505]get sdc0 sdc_erase fail. [00.508]get sdc0 sdc_boot fail. [00.511]get sdc0 sdc_odly_50M fail. [00.514]get sdc0 sdc_sdly_50M fail. [00.518]get sdc0 sdc_odly_50M_ddr fail. [00.521]get sdc0 sdc_sdly_50M_ddr fail. [00.525]get sdc0 sdc_freq fail. [00.527]get sdc0 sdc_b0p fail. [00.530]get card0_boot_para:sdc_ex_dly_used fail [00.535]get card-pwr-gpios handler:1119307360 [00.539]get card0_boot_para:time_pwroff:200ms [00.545]Using default timing para [00.748]init mmc 0 clock and io devnum 0, prv 43fbd42c, bdesc 42b74844 SUNXI SD/MMC: 0 [00.755]==================== work mode: 0 0, sample_mode:0 [00.761]=============== start mmc_init_boot... card_caps:0x3000000a host_caps:0x3000003f [00.825]unable to read ssr [00.828]unable to read ssr [00.831]the mode SD Legacy (freq : 25 MHz) check_file [/one_h60ga.bin] exsit check_file [/one_h60ga.bin] exsit start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 part_name:boot start_offset:0x20 part_size:1900544 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 part_name:rootfs start_offset:0xea0 part_size:1179648 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 part_name:home start_offset:0x17a0 part_size:3407872 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 part_name:backup start_offset:0x31a0 part_size:1245184 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 part_name:env start_offset:0x3b20 part_size:131072 Nothing updated, start normal boot Hit ctrl + q to stop autoboot: 0 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 [01.959]partinfo: name boot, start 0x20, size 0xe80 start: 0x300, len: 0x40 start: 0x340, len: 0xe10 [02.436]android.hardware = sun8iw19p1

Booting kernel from Legacy Image at 45000000 ...

Image Name: ARM OpenWrt Linux-4.9.118 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1875896 Bytes = 1.8 MiB Load Address: 40008000 Entry Point: 40008000 [02.502]Starting kernel ...

[106]HELLO! BOOT0 is starting Nov 14 2019 20:01:31! [111]BOOT0 commit : 81c18ee [114]board init start [116]set pll start [119]set pll end [120][pmu]: bus read error [123]board init ok [125]chip id check OK [127]DRAM BOOT DRIVE INFO: V0.41 [130]DRAM CLK = 528 MHz [132]DRAM Type = 2 (2:DDR2,3:DDR3) [136]DRAMC read ODT off. [138]DRAM ODT off. [141]DRAM SIZE =64 M [147]DRAM simple test OK. [150]rtc standby flag is 0x0, super standby flag is 0x0 [155]dram size =64 [158]spinor id is: c8 40 17, read cmd: 03 [162]Succeed in reading toc file head. [166]The size of toc is 4c000. [218]Entry_name = optee [222]Entry_name = u-boot [226]Entry_name = dtb [229]Jump to secend Boot. MESSAGE: [0x0] TEE-CORE: OP-TEE version: sun8iw19p1_v0.6.0-12-g97f2688 #1 2019年 11月 08日 星期五 08:26:51 UTC arm ERROR: [0x0] TEE-CORE:platform_standby_fdt_parse:126: no pmu node ERROR: [0x0] TEE-CORE:sunxi_twi_parse_from_dt:84: no pmu node

U-Boot 2018.05 (Mar 08 2021 - 23:23:22 +0800) Allwinner Technology

[00.272]DRAM: 64 MiB [00.275]Relocation Offset is: f9f94000 [00.287]secure enable bit: 0 [00.289]CPU=816 MHz,PLL6=600 Mhz,AHB=200 Mhz, APB1=100Mhz MBus=132Mhz [00.295]gic: sec monitor mode [00.298]flash init start [00.300]workmode = 0,storage type = 3 SF: Detected gd25q64 with page size 256 Bytes, erase size 4 KiB, total 8 MiB [00.317]sunxi flash init ok [00.320]Loading Environment from SUNXI_FLASH... start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x3e00, len: 0x100 OK [00.381]try sprite_led_gpio config xxxxxxxxxxxxxxlijun uboot xiaoyiledinit [00.388]sprite_led_gpio start 00.391update dtb dram start [00.396]update dtb dram end [00.398]update dts root_partition is rootfs start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 set root to /dev/mtdblock2 [00.461]update part info [00.463]update bootcmd mmc driver ver uboot2018:2019-8-15 16:34:00 get mem for descripter OK ! [00.476]get sdc_wipe fail. [00.478]get sdc0 sdc_erase fail. [00.481]get sdc0 sdc_boot fail. [00.484]get sdc0 sdc_odly_50M fail. [00.487]get sdc0 sdc_sdly_50M fail. [00.490]get sdc0 sdc_odly_50M_ddr fail. [00.494]get sdc0 sdc_sdly_50M_ddr fail. [00.497]get sdc0 sdc_freq fail. [00.500]get sdc0 sdc_b0p fail. [00.503]get card0_boot_para:sdc_ex_dly_used fail [00.508]get card-pwr-gpios handler:1119307360 [00.512]get card0_boot_para:time_pwroff:200ms [00.517]Using default timing para [00.720]init mmc 0 clock and io devnum 0, prv 43fbd42c, bdesc 42b74844 SUNXI SD/MMC: 0 [00.728]==================== work mode: 0 0, sample_mode:0 [00.733]=============== start mmc_init_boot... card_caps:0x3000000a host_caps:0x3000003f [00.800]unable to read ssr [00.802]unable to read ssr [00.806]the mode SD Legacy (freq : 25 MHz) check_file [/one_h60ga.bin] exsit check_file [/one_h60ga.bin] exsit start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 part_name:boot start_offset:0x20 part_size:1900544 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 part_name:rootfs start_offset:0xea0 part_size:1179648 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 part_name:home start_offset:0x17a0 part_size:3407872 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 part_name:backup start_offset:0x31a0 part_size:1245184 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 part_name:env start_offset:0x3b20 part_size:131072 Nothing updated, start normal boot Hit ctrl + q to stop autoboot: 0 start: 0x2e0, len: 0x1 start: 0x2e1, len: 0x1 start: 0x2e2, len: 0x2 [01.933]partinfo: name boot, start 0x20, size 0xe80 start: 0x300, len: 0x40 start: 0x340, len: 0xe10 [02.410]android.hardware = sun8iw19p1

Booting kernel from Legacy Image at 45000000 ...

Image Name: ARM OpenWrt Linux-4.9.118 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1875896 Bytes = 1.8 MiB Load Address: 40008000 Entry Point: 40008000 [02.476]Starting kernel ...

Any suggestions what is causing the bricking of the cam and why the hack cannot be applied to it?

[roleoroleo]

dd: writing '/dev/mtdblock4': No space left on device

This message is not good. Probably the partition image is not correct. I'll check your log in depth tonight.

[roleoroleo]

I don't know why but the previous archive is corrupted. The partition image has the wrong size. This file is ok: sdhack_mtd_h60ga.tar.gz

Based on your log, you should be able to recover this cam without using the serial adapter. Try to use the link above to restore it.

[kyutov]

I have used the above file and I was able to successfully hack the cam. The comportment of the cam however is exactly the same as the one, which I have described above when I have managed to hack the cam with the modifiedinit.sh file. Basically when I start the cam, it enters in reboot loops. When I connect the cam to Putty and execute the following commands:

setenv loglevel 8
setenv console ttyS0,115200
run bootcmd

it works without any issues, but I cannot understand what is causing the reboot loops. I have tried to enable the swap, but this didn't helped either.

[roleoroleo]

Probably it's a race condition. Try to run the same without setenv loglevel 8 Only

setenv console ttyS0,115200
run bootcmd

[ghost]

setenv loglevel 8
setenv console ttyS0,115200
run bootcmd

When I tested mine I had these set automatically so I could have software monitor the serial port for reboots, haven't tried it without!

[NdR91]

Hello guys. I'm going to buy a DOME U PRO today and I will be available to test it if you need help. What file should I use to hack/test it?

I see the last release is dated August..

[roleoroleo]

I could send you a new method to try, if you agree. This new approach should avoid the risk of bricking.

[NdR91]

Ok, is that the one you put in the Wiki? Or a new one?

EDIT: i will receive them tomorrow.

[roleoroleo]

No, a new one.

[NdR91]

Fine. I'll give it a try.

Do I need to do some stuff to give you a feedback?

[roleoroleo]

Simply check if it works. h60ga_0.1.9_u.tar.gz

[NdR91]

Simply check if it works.

h60ga_0.1.9_u.tar.gz

Hello. What I noticed is that "Factory" is missing. Can I proceed?

[roleoroleo]

Yes, Factory is missing because the upgrade procedure is made by the bootloader. The Factory folder is mandatory when the upgrade is made after the boot of the os.

[NdR91]

You are great! Thank you for your work!!

Tell me if you need some data or what...😁

[NdR91]

Hello @roleoroleo, I have some troubles with the hack. But only on one of the two Dome U Pro I bought.

In the second one the RTSP method is not working. It gives me authentication error both on vlc and frigare...

[roleoroleo]

Check if you are using special chars (some not allowed char) in username or password. If not, try to reconfigure the cam after a factory reset. Maintenance -> Reset to yi-hack default

[NdR91]

I don't have any user or psw configured. I'll try with a reset

[NdR91]

Perfect, the reset worked! Ty!

[kyutov]

Simply check if it works. h60ga_0.1.9_u.tar.gz

I was able to successfully hack my can with this file as well. With the new hack procedure, the cam works without issues after I have applied the hack. It doesn't go in restart loops as when I have hacked it with the other hack procedure :+1:

[roleoroleo]

Happy to have solved the problem. :)

[pannal]

Hey @roleoroleo, I've just ordered two of these cameras. Is this procedure with h60ga_0.1.9_u.tar.gz preferred over the one in the wiki?

[roleoroleo]

Yes, use this archive. I will update the wiki with the next release.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[lnx85]

Hi @roleoroleo, tried to install the hack on my Yi Dome U Pro 2K and it works but I'm having a problem: if I go to the Snapshot tab of the web interface it shows the snapshot correctly but after a couple of seconds the yicam reboot itself. I don't have a serial: how can I help you?

[roleoroleo]

Read the faq page in the wiki.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.