search

roleoroleo / yi-hack-MStar

Custom firmware for Yi 1080p camera based on MStar platform
GNU General Public License v3.0
844 stars 112 forks source link

[Question] Support for YI Dome X #262

Closed adicrescenzo closed 3 years ago

adicrescenzo commented 3 years ago

Hi all,

I bought the model YI Dome X on amazon.

Those are the values reported above the box of the camera:

DID: BFUSY02.... SN: BY30EU.... Model: YYS.3017

I tried to flash the firmware y203c_0.3.6 but nothing happened to the camera, the default firmware is still working. The firmware version in the Yi Home app is 4.0.0.0F_201909251646

I thought that the DID value is the one to identify the camera model, is that correct? Is this camera supported for the hack? Many thanks in advance.

roleoroleo commented 3 years ago

DID is not enough. Based on fw version your cam is not supported.

adicrescenzo commented 3 years ago

DID is not enough. Based on fw version your cam is not supported.

Is the camera model correct for this hack? Are there any chance for the future to support this firmware version? Thanks

roleoroleo commented 3 years ago

I don't know. To check if it's possible to create an hack we need to dump the memory and analyze it.

adicrescenzo commented 3 years ago

How can I make it? I would really like to contribute

roleoroleo commented 3 years ago

See the wiki.

adicrescenzo commented 3 years ago

Done! Can you give some hints to find the 3 uart pads?

I took some pictures of the circuite board:

Back image

Front image

Front from another angle image

roleoroleo commented 3 years ago

The chip is MStar but I can't see uart pads.

PyryW commented 3 years ago

UART pads (circled red) can be found under the speaker module, which is attached to the PCB with two screws (circled green). Will post the dump soon if successful. DomeX

adicrescenzo commented 3 years ago

UART pads (circled red) can be found under the speaker module, which is attached to the PCB with two screws (circled green). Will post the dump soon if successful. DomeX

That’s a great news! Thank you very much for the hint. Tomorrow I’ll disassemble the speaker and I’ll try the make a memory dump with the uart interface.

PyryW commented 3 years ago

I managed to find my own UART adapter and have started the dump, the process seems to be extremely slow, (rootfs seems like it will take around 2 hours, which would mean home will take around 12 hours as it is six times larger). I suppose increasing the --step argument in the dump script would speed this up, but is there a risk of getting corrupted data then? The code for the dump script suggests a default step size of 256, while the wiki says 64 (which I'm using now)

roleoroleo commented 3 years ago

The uart you are using hasn't control signals (RTS and CTS). If you use big blocks data will be corrupted.

PyryW commented 3 years ago

The uart you are using hasn't control signals (RTS and CTS). If you use big blocks data will be corrupted.

I see, thank you. Guess I'll just leave it running overnight. Attached is the swapped sys_y30 file. I will update this message to include the home_y30 file tomorrow once the dump is finished. Edit: here they are sys_y30.swapped.img.zip home_y30.swapped.img.zip

TheTimeWalker commented 3 years ago

Any news about this? I can spend a beer as an incentive if this can be hacked

roleoroleo commented 3 years ago

Please try this: y30_0.3.8.tar.gz

But make a backup copy before you try.

PyryW commented 3 years ago

Awesome, flashed fine and at least for now I didn't find anything that didn't work. ONVIF (including PTZ), RTSP, SSH, Telnet, all seems to work. Thank you!

roleoroleo commented 3 years ago

Great!

TheTimeWalker commented 3 years ago

Keeping my promise, a beer in a restaurant/bar here costs 8 CHF, so I took that as the donation price

image

roleoroleo commented 3 years ago

Thank you for your donation!

adicrescenzo commented 3 years ago

Awesome, flashed fine and at least for now I didn't find anything that didn't work. ONVIF (including PTZ), RTSP, SSH, Telnet, all seems to work. Thank you!

Great news! Did you flash it copying the files on the sdcard?

wasserpanther commented 3 years ago

Flashed by extracting the tar.gz provided onto the sd card. Got all Camera functions working (PTZ, RTSP, etc.). One small issue: It seems that the camera looses the WiFi credentials after reboot, I used the "save config" option to see if they got saved in some of the config files but i could not find any information. Am I missing something there or could this be related to bug #66 ? Thanks for your work, donation is on its way :+1:

roleoroleo commented 3 years ago

It's a very old problem that affects all platforms, but only a few users. I have never been able to solve it

The "Save config" doesn't save wifi informations. You can save them only through the yi app.

Thank you for your donation!

WestLight-dev commented 3 years ago

Hi all,

one question: are home_y30 and home_y30m two different cameras? Or can I rename the file home_y30 to home_y30m?

Thank you!

roleoroleo commented 3 years ago

home_y30m and home_y30 are related to the same cam, but with different file formats. home_y30m is a file created to upgrade a file system, it's compressed bz2 or 7z and crypted and it's processed by a linux script. home_y30 is a file containing a file system image created to overwrite completely a partition, it's "compressed" squash or jffs2 and it's processed by u-boot.

WestLight-dev commented 3 years ago

I copied the two files (home_y30 and sys_y30) to the root of microSD but after rebooting the camera it did not work :-( .... nothing happens

adicrescenzo commented 3 years ago

Hi guys, I tried to make a copy of the firmware with the UART adapter but when I type the commands listed in the wiki like "sf probe", nothing appends. I've used a mac book pro with 115200 ad baud rate. Do you have any suggestions?

Flashing the new firmware I had no problems at all, everything works as expected. Great work @roleoroleo, my donation is on its way too.

Last question: is it possibile to start the recording with a web service invocation?

roleoroleo commented 3 years ago

Hi guys, I tried to make a copy of the firmware with the UART adapter but when I type the commands listed in the wiki like "sf probe", nothing appends. I've used a mac book pro with 115200 ad baud rate. Do you have any suggestions?

No suggestions, try to continue.

Flashing the new firmware I had no problems at all, everything works as expected. Great work @roleoroleo, my donation is on its way too.

Thank you for your donation.

Last question: is it possibile to start the recording with a web service invocation?

Like after a motion detection event?

adicrescenzo commented 3 years ago

Hi guys, I tried to make a copy of the firmware with the UART adapter but when I type the commands listed in the wiki like "sf probe", nothing appends. I've used a mac book pro with 115200 ad baud rate. Do you have any suggestions?

No suggestions, try to continue.

Ok I'll do it. If the command takes effect is there any feedback from the camera? In the guide published on the wiki there is a point "Stop the boot at the U-Boot prompt (should be "MStar #") pressing "Enter"." Even if I press enter the boot process continues, is it normal?

Flashing the new firmware I had no problems at all, everything works as expected. Great work @roleoroleo, my donation is on its way too.

Thank you for your donation.

Last question: is it possibile to start the recording with a web service invocation?

Like after a motion detection event?

No, I would like to start the recording manually invoking a web service. In the same way we can move the camera left or right. Thanks.

roleoroleo commented 3 years ago

In the guide published on the wiki there is a point "Stop the boot at the U-Boot prompt (should be "MStar #") pressing "Enter"." Even if I press enter the boot process continues, is it normal?

No, check if the TX pin is connected correctly.

No, I would like to start the recording manually invoking a web service. In the same way we can move the camera left or right. Thanks.

Currently is not possible to start a video recording but probably I could try to write a new ws that send a motion detection event to the system. The yi software should start a new record.

roleoroleo commented 3 years ago

https://github.com/roleoroleo/yi-hack-MStar/commit/f4504af6369bba8085353069dc9e95da50c665b4

Try these: ipc_cmd.gz record.sh.gz

The url is http://IP_CAM:8080/cgi-bin/record.sh?time=30

adicrescenzo commented 3 years ago

f4504af

Try these: ipc_cmd.gz record.sh.gz

The url is http://IP_CAM:8080/cgi-bin/record.sh?time=30

Great it works!! I've just see a little problem, the invocation to the web service is synchronous and the http call doesn't terminate until the time parameter is reached (e.g 30 or 60 seconds). Is there a way to make this call asynchronous?

Thanks

roleoroleo commented 3 years ago

Yes, I could fork the process.

WestLight-dev commented 3 years ago

I need your help! Please! I have a YI Dome X (6FUS) with 4.0.0.0 firmware ...I have tried everything, but nothing helped. I cannot overwrite the firmware.

roleoroleo commented 3 years ago

Does the camera work normally when you remove the sd card?

roleoroleo commented 3 years ago

@adicrescenzo https://github.com/roleoroleo/yi-hack-MStar/commit/922affb375d1420db6f07f7dc2577365cf4cca80

WestLight-dev commented 3 years ago

@roleoroleo Yes, it does. I have two other cameras (YI Outdoor 1080p) ... both of them worked immediately.

WestLight-dev commented 3 years ago

After switching on the camera (with sd card into) the yellow light goes on ... for about 20 seconds. Then the camera goes to the right and back again. Afterwards the light will glow blue.

roleoroleo commented 3 years ago

Try to change the sd card.

WestLight-dev commented 3 years ago

I tried with 2GB, 16GB and 64GB ... FAT32 formatted ... very strange :-(

roleoroleo commented 3 years ago

What the firmware version? I need all digits.

adicrescenzo commented 3 years ago

@adicrescenzo 922affb

Thank you very much! How can I get the new compiled firmware? I'll try to start the development myself but first of all I need to understand how it works :)

roleoroleo commented 3 years ago

If you don't want to wait the next release, try to build it yourself. See the wiki.

EDIT See the readme. https://github.com/roleoroleo/yi-hack-MStar#build-your-own-firmware If it's not enough ask me.

thoemmes86 commented 3 years ago

Good Morning,

and many many thanks for offering the support for this camera. I was waiting a very long time to get this camera supported. So the offering of a beer is for sure. Both Dome X cameras where able to install the firmware and work like a charm.

BUT: At least I found one Bug which is only available on one of those identical Dome X Devices. For ONLY ONE of them, the 'High res snapshot' is not working while the 'Low res snapshot' and all other functionalities are.

The configurations of both cameras are identical, I tried a reset of the camera, but nothing solved the issue. You may have an idea how to solve?

Kind Regards

WestLight-dev commented 3 years ago

@roleoroleo : current firmware is 4.0.0.0F_201909251646

roleoroleo commented 3 years ago

@thoemmes86 Is the yi fw version the same?

@WestLight-dev The fw version is ok, it's supported. Check please if sd is correctly detected from the cam (with yi app). Are you able to watch the videos recorded from the cam?

thoemmes86 commented 3 years ago

@roleoroleo Yes it is exactly the same.

roleoroleo commented 3 years ago

@roleoroleo Yes it is exactly the same.

Does high res stream work?

WestLight-dev commented 3 years ago

sd-card is detected correctly. I can see the logs and videos on the sd-card.

thoemmes86 commented 3 years ago

@roleoroleo Yes it is exactly the same.

Does high res stream work?

Yes everything else is working as expected. (As far as I have tested)

roleoroleo commented 3 years ago

@thoemmes86 Try to run the command manually. imggrabber -r HIGH -w -d > /tmp/sd/snap.jpg and post the output.

thoemmes86 commented 3 years ago

imggrabber -r HIGH -w -d > /tmp/sd/snap.jpg watermark on debug on Resolution: 1080 vaddr: 0xb4745000 - paddr: 0x23570000 - size: 368640 copy buffer: len 368640 copy again buffer: len 368640 Segmentation fault