search

samtap / fang-hacks

Collection of modifications for the XiaoFang WiFi Camera
1.67k stars 340 forks source link

Unable to flash original firmware.../etc/fang_hacks.cfg still there....and doesn't start as original #418

Open mikkel75 opened 5 years ago

mikkel75 commented 5 years ago

Hi, One of my cams got messed up when I by accident (after successful hack) chose wrong wifi settings in web interface. I have tried to change these but without success - so no I tried to revert to original firmware by running FIRMWARE_660R.bin copied to /tmp/ as described elseware - I have mounted a serial terminal.

/tmp # ./FIRMWARE_660R.bin
image table size:0x0000003c
index:0
reservations:0x12345678
offset:0x00005e84
size:0x00001000
flash start address:0x00001000
flash end address:0x00001fff

index:20
reservations:0x12345678
offset:0x00006e84
size:0x002e5c54
flash start address:0x000c0000
flash end address:0x003bffff

index:40
reservations:0x12345678
offset:0x002ecad8
size:0x006d3070
flash start address:0x003c0000
flash end address:0x00abffff

fwupdate end!
/tmp #

But after reboot I get this:

/tmp # reboot
The system is going down NOW!
Sent SIGTERM to all procesRTL871X: rtw_cmd_thread(wlan0) _rtw_down_sema(&pcmdpriv->cmd_queue_sema) return _FAIL, break
ses
Sent SIGKILL to all processes
RRTL871X: rtw_dev_shutdown
Restarting system.

U-Boot 2011.09 (Nov 24 2016 - 03:23:06)

DRAM:  64 MiB
MMC:   SD Card not detect
mmci_host_init error - -1

SPI FLASH: 16 MB
In:    serial
Out:   serial
Err:   serial
GPIO[2] is high
Hit any key to stop autoboot:  0
roofsr size = 0x6d3070
## Booting kernel from Legacy Image at 00008000 ...
   Image Name:   Linux-2.6.35.12
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3038112 Bytes = 2.9 MiB
   Load Address: 00008000
   Entry Point:  00008040
   Verifying Checksum ... OK
   XIP Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.35.12 (fedora@localhost.localdomain) (gcc version 4.5.2 (SONiX GCC-4.5.2 Release 2011-12-06) ) #27 Thu Dec 22 18:48:16 PST 2016
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00057177
CPU: VIVT data cache, VIVT instruction cache
Machine: SONiX SN98600 Development Platform
Memory policy: ECC disabled, Data cache writeback
CPU: found ITCM 16k @ ffff4000, enabled
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 init=/linuxrc mem=64M isp=10M vc=12M vo=0M mtdparts=snx-spi:768k(uboot),3072k(kernel),7168k(rootfs),4096k(rescue),1024k(etc),256k(userconfig)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 36836k/36836k available, 28700k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc4800000 - 0xe0000000   ( 440 MB)
    lowmem  : 0xc0000000 - 0xc4000000   (  64 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0026000   ( 120 kB)
      .text : 0xc0026000 - 0xc04ec000   (4888 kB)
      .data : 0xc050a000 - 0xc0535440   ( 174 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:96
Console: colour dummy device 80x30
console [ttyS0] enabled
Calibrating delay loop... 200.29 BogoMIPS (lpj=1001472)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
0x00a00000 bytes system memory reserved for isp device at 0x005ec000
0x00c00000 bytes system memory reserved for vc device at 0x00fec000
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Linux media interface: v0.10
Linux video capture interface: v2.00
Advanced Linux Sound Architecture Driver Version 1.0.23.
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource ft_clocksource
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
exFAT: Version 1.2.9
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.14)
msgmni has been set to 71
async_tx: api initialized (async)
io scheduler noop registered (default)
SONIX UART driver, (c) 2013 Sonix
snx_uart.0: ttyS0 at MMIO 0x98a00000 (irq = 8) is a SONiX
snx_uart.1: ttyS1 at MMIO 0x98b00000 (irq = 10) is a SONiX
brd: module loaded
loop: module loaded
6 cmdlinepart partitions found on MTD device snx-spi
Creating 6 MTD partitions on "snx-spi":
0x000000000000-0x0000000c0000 : "uboot"
0x0000000c0000-0x0000003c0000 : "kernel"
0x0000003c0000-0x000000ac0000 : "rootfs"
0x000000ac0000-0x000000ec0000 : "rescue"
0x000000ec0000-0x000000fc0000 : "etc"
0x000000fc0000-0x000001000000 : "userconfig"
snx_spi_init register
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
usbcore: registered new interface driver zd1211rw
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
snx_ehci snx_ehci.0: snx_ehci
snx_ehci snx_ehci.0: new USB bus registered, assigned bus number 1
snx_ehci snx_ehci.0: irq 24, io mem 0x90800000
snx_ehci snx_ehci.0: USB 0.0 started, EHCI 0.96
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: snx_ehci
usb usb1: Manufacturer: Linux 2.6.35.12 ehci_hcd
usb usb1: SerialNumber: sonix-ehci
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
SONIX SNX I2C adapter driver, (c) 2012 Sonix
snx_i2c.0: SNX I2C0 controller at 0x98300000 (irq = 1)
I2C GPIO driver INIT
snx_i2c.1: SNX I2C1 controller at 0x98400000 (irq = 2)
snx_hdma snx_hdma: SNX AHB DMA Controller (memcpy memset), 4 channels
SNX AHB DMA driver register
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
usbcore: registered new interface driver snd-usb-audio
ALSA device list:
  No soundcards found.
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (575 buckets, 2300 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
tunl0: Disabled Privacy Extensions
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
ip6tnl0: Disabled Privacy Extensions
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
VFS: Mounted root (cramfs filesystem) readonly on device 31:2.
Freeing init memory: 120K
hub 1-0:1.0: /run/media/fedora/software/SN986_1.50_P2P_TUTK_050a_20160921_1712/snx_sdk/kernel/linux-2.6.35.12/src/drivers/usb/core/hub.c 3351: state 7 ports 1 chg 0002 evt 0000
hub 1-0:1.0: port 1, status 0503, change 0000, 480 Mb/s
Create device file
snx_crypto driver loaded.
sonix crypto diver register
sonix_nvram_init
Init nvram id: 1303281516
Init nvram_crc id: 0x65535
nvram_check crc = 11359 crc_ref = 65535
[nvram_check:725] CRC error
SONIX Kernel NVRAM initialized
starting pid 529, tty '': '/etc/init.d/rcS'
Load drivers...
usb 1-1: new high speed USB device using snx_ehci and address 2
Sonix GPIO Driver
usb 1-1: New USB device found, idVendor=0bda, idProduct=0179
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: 802.11n NIC
usb 1-1: Manufacturer: Realtek
usb 1-1: SerialNumber: 34CE00E0CA38
driver loaded.
sonix snx_aud_gpio diver register
Load video drivers...
Load audio drivers...
SNX_AUDIO: driver register.
SNX_SIGMA: adc submod driver init ok.
snx_isp snx_isp.0: [ISP] isp_camera_probe
soc-camera-pdrv soc-camera-pdrv.0: Probing soc-camera-pdrv.0
scan:sc2135
SNX_R2R: dac submod driver init ok.
sc2135 stop streaming
0x0103 = 0x00
0x0100 = 0x00
0x3e03 = 0x03
0x3e01 = 0x46
0x3e08 = 0x00
0x3e09 = 0x10
0x3416 = 0x11
0x3300 = 0x20
0x3301 = 0x08
0x3303 = 0x30
0x3306 = 0x78
0x330b = 0xd0
0x3309 = 0x30
0x3308 = 0x0a
0x331e = 0x26
0x331f = 0x26
0x3320 = 0x2c
0x3321 = 0x2c
0x3322 = 0x2c
modprobe: module 'mt7601Usta' 0x3323 = 0x2c
not found
0x330e = 0x20
0x3f05 = 0xdf
0x3f01 = 0x04
0x3626 = 0x04
0x3312 = 0x06
0x3340 = 0x03
0x3341 = 0x68
0x3342 = 0x02
0x3343 = 0x20
0x3333 = 0x10
0x3334 = 0x20
0x3621 = 0x18
0x3626 = 0x04
0x3635 = 0x34
0x3038 = 0xa4
0x3630 = 0x84
0x3622 = 0x0e
0x3620 = 0x62
0x3627 = 0x08
0x3637 = 0x87
0x3638 = 0x86
0x3034 = 0xd2
0x5780 = 0xff
0x5781 = 0x0c
0x5785 = 0x10
0x3d08 = 0x01
0x3640 = 0x00
0x3662 = 0x82
0x335d = 0x00
0x4501 = 0xa4
0x3333 = 0x00
0x3627 = 0x02
0x3620 = 0x62
0x5781 = 0x04
0x3333 = 0x10
0x3306 = 0x69
0x3635 = 0x52
0x3636 = 0x7c
0x3631 = 0x84
0x3637 = 0x88
0x3306 = 0x6b
0x330b = 0xd0
0x3630 = 0x84
0x303a = 0x07
0x3039 = 0x76
0x3343 = 0x40
0x3f04 = 0x02
0x3f05 = 0x04
0x3340 = 0x03
0x3341 = 0xe5
0x3207 = 0x4e
0x335d = 0x20
0x3368 = 0x02
0x3369 = 0x00
0x336a = 0x04
0x336b = 0x65
0x330e = 0x20
0x3367 = 0x05
0x3620 = 0x92
0x3634 = 0xd2
0x3633 = 0x17
0x3315 = 0x02
0x3334 = 0xa0
0x3312 = 0x00
0x335e = 0x02
0x335f = 0x0a
0x3306 = 0x60
0x3f04 = 0x01
0x3f05 = 0xf7
0x303a = 0x15
0x3039 = 0x2e
0x3035 = 0x25
0x3034 = 0x2e
0x3036 = 0x00
0x320c = 0x04
0x320d = 0x65
0x320e = 0x04
0x320f = 0xb0
0x3368 = 0x02
0x3369 = 0x4b
0x363a = 0x04
0x336b = 0xb0
0x3306 = 0x70
0x3640 = 0x01
0x3034 = 0x2e
0x3633 = 0x16
0x3211 = 0x14
sensor:sc2135 (id:0x2135) driver loadded
sc2135 start streaming
IQ.bin OK!
ubIdx = 6, fps = 25
priv->uwMaxExpL = 1440, info->frame_rate = 25
snx_isp snx_isp.0: ISP Camera driver loaded
snx_sd_initial:1289: SD initialisation done.
snx_sd_initial:1289: SD initialisation done.
snx_vc snx_vc: sonix_vc device registered as /dev/video1
snx_vc snx_vc: sonix_vc device registered as /dev/video1
snx_vc snx_vc: sonix_vc device registered as /dev/video2
snx_vc snx_vc: sonix_vc device registered as /dev/video2
RTL871X: module init start
RTL871X: rtl8188eu v4.3.24_16705.20160509
RTL871X: build time: Jan 19 2017 06:53:17
RTL871X:
usb_endpoint_descriptor(0):
RTL871X: bLength=7
RTL871X: bDescriptorType=5
RTL871X: bEndpointAddress=81
RTL871X: wMaxPacketSize=512
RTL871X: bInterval=0
RTL871X: RT_usb_endpoint_is_bulk_in = 1
RTL871X:
usb_endpoint_descriptor(1):
RTL871X: bLength=7
RTL871X: bDescriptorType=5
RTL871X: bEndpointAddress=2
RTL871X: wMaxPacketSize=512
RTL871X: bInterval=0
RTL871X: RT_usb_endpoint_is_bulk_out = 2
RTL871X:
usb_endpoint_descriptor(2):
RTL871X: bLength=7
RTL871X: bDescriptorType=5
RTL871X: bEndpointAddress=3
RTL871X: wMaxPacketSize=512
RTL871X: bInterval=0
RTL871X: RT_usb_endpoint_is_bulk_out = 3
RTL871X: nr_endpoint=3, in_num=1, out_num=2

RTL871X: USB_SPEED_HIGH
RTL871X: CHIP TYPE: RTL8188E
RTL871X: rtw_hal_config_rftype RF_Type is 3 TotalTxPath is 1
RTL871X: Chip Version Info: CHIP_8188E_Normal_Chip_TSMC_D_CUT_1T1R_RomVer(0)
RTL871X: _ConfigNormalChipOutEP_8188E OutEpQueueSel(0x05), OutEpNumber(2)
RTL871X: EEPROM type is E-FUSE
RTL871X: Boot from EFUSE, Autoload OK !
RTL871X: SetHwReg8188E: bMacPwrCtrlOn=1
bFWReady == _FALSE call reset 8051...
RTL871X: =====> _8051Reset88E(): 8051 reset success .
RTL871X: efuse_read_phymap_from_txpktbuf bcnhead:0
RTL871X: efuse_read_phymap_from_txpktbuf len:123, lenbak:123, aaa:123, aaabak:123
RTL871X: efuse_read_phymap_from_txpktbuf read count:121
RTL871X: EEPROM ID=0x8129
RTL871X: VID = 0x0BDA, PID = 0x0179
RTL871X: Customer ID: 0x00, SubCustomer ID: 0xCD
RTL871X: Hal_ReadPowerSavingMode88E...bHWPwrPindetect(0)-bHWPowerdown(0) ,bSupportRemoteWakeup(1)
RTL871X: ### PS params=>  power_mgnt(0),usbss_enable(0) ###
RTL871X: ======= Path 0, Channel 1 =======
RTL871X: Index24G_CCK_Base[0][1] = 0x2b
RTL871X: Index24G_BW40_Base[0][1] = 0x2d
RTL871X: ======= Path 0, Channel 2 =======
RTL871X: Index24G_CCK_Base[0][2] = 0x2b
RTL871X: Index24G_BW40_Base[0][2] = 0x2d
RTL871X: ======= Path 0, Channel 3 =======
RTL871X: Index24G_CCK_Base[0][3] = 0x2a
RTL871X: Index24G_BW40_Base[0][3] = 0x2c
RTL871X: ======= Path 0, Channel 4 =======
RTL871X: Index24G_CCK_Base[0][4] = 0x2a
RTL871X: Index24G_BW40_Base[0][4] = 0x2c
RTL871X: ======= Path 0, Channel 5 =======
RTL871X: Index24G_CCK_Base[0][5] = 0x2a
RTL871X: Index24G_BW40_Base[0][5] = 0x2c
RTL871X: ======= Path 0, Channel 6 =======
RTL871X: Index24G_CCK_Base[0][6] = 0x29
RTL871X: Index24G_BW40_Base[0][6] = 0x2b
RTL871X: ======= Path 0, Channel 7 =======
RTL871X: Index24G_CCK_Base[0][7] = 0x29
RTL871X: Index24G_BW40_Base[0][7] = 0x2b
RTL871X: ======= Path 0, Channel 8 =======
RTL871X: Index24G_CCK_Base[0][8] = 0x29
RTL871X: Index24G_BW40_Base[0][8] = 0x2b
RTL871X: ======= Path 0, Channel 9 =======
RTL871X: Index24G_CCK_Base[0][9] = 0x29
RTL871X: Index24G_BW40_Base[0][9] = 0x2b
RTL871X: ======= Path 0, Channel 10 =======
RTL871X: Index24G_CCK_Base[0][10] = 0x29
RTL871X: Index24G_BW40_Base[0][10] = 0x2b
RTL871X: ======= Path 0, Channel 11 =======
RTL871X: Index24G_CCK_Base[0][11] = 0x29
RTL871X: Index24G_BW40_Base[0][11] = 0x2b
RTL871X: ======= Path 0, Channel 12 =======
RTL871X: Index24G_CCK_Base[0][12] = 0x29
RTL871X: Index24G_BW40_Base[0][12] = 0x2b
RTL871X: ======= Path 0, Channel 13 =======
RTL871X: Index24G_CCK_Base[0][13] = 0x29
RTL871X: Index24G_BW40_Base[0][13] = 0x2b
RTL871X: ======= Path 0, Channel 14 =======
RTL871X: Index24G_CCK_Base[0][14] = 0x29
RTL871X: Index24G_BW40_Base[0][14] = 0x2b
RTL871X: EEPROMRegulatory = 0x0
RTL871X: hal_com_config_channel_plan chplan:0x20
RTL871X: CrystalCap: 0x23
RTL871X: EEPROM Customer ID: 0x 0
RTL871X: EEPROM : AntDivCfg = 0, TRxAntDivType = 3
RTL871X: Board Type: 0x 0
RTL871X: ThermalMeter = 0x14
RTL871X: rtw_hal_read_chip_info in 270 ms
RTL871X: init_channel_set((null)) ChannelPlan ID:0x20, ch num:13
RTL871X: NR_RECVBUFF: 8
RTL871X: MAX_RECVBUF_SZ: 4000
RTL871X: NR_PREALLOC_RECV_SKB: 16
RTL871X: Enable CONFIG_FIX_NR_BULKIN_BUFFER
RTL871X: rtw_alloc_macid((null)) if1, hwaddr:ff:ff:ff:ff:ff:ff macid:1
RTL871X: rtw_macaddr_cfg mac addr:34:ce:00:e0:ca:38
RTL871X: bDriverStopped:True, bSurpriseRemoved:False, bup:0, hw_init_completed:0
RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=34:ce:00:e0:ca:38
usbcore: registered new interface driver rtl8188eu
RTL871X: module init ret=0
Set hostname ...
Executing script (enabled: 1)
Cloud apps are disabled
Mounting /media/mmcblk0p1
mount: mounting /dev/mmcblk0p1 on /media/mmcblk0p1 failed: No such file or directory
Starting boa webserver...
right_count=3  value=0 last_value=0
CGI scripts not found in /media/mmcblk0p1/bootstrap/www!
Failed to find hacks in /media/mmcblk0p2/data!
Failed to find /media/mmcblk0p2/data!
right_count=3  value=0 last_value=0
right_count=3  value=0 last_value=0
right_count=3  value=0 last_value=0
right_count=3  value=0 last_value=0
right_count=3  value=0 last_value=0
right_count=3  value=0 last_value=0
right_count=3  value=0 last_value=0
right_count=3  value=0 last_value=0
right_count=3  value=0 last_value=0
not in singleboard test
starting pid 619, tty '/dev/ttyS0': '/sbin/getty -L ttyS0 115200 vt100'

Xiaofang3 login: root

It does not start as an original cam, and I still see fang_hack files in /etc ??

/usr # ls /etc
TZ                   hosts                passwd
Wireless             hotplug              profile
app                  inetd.conf           protocols
config               init.d               rc
dropbear             inittab              resolv.conf
ds_font_table        ir_cut               sdOkFlag
fang_hacks.cfg       mdev.conf            services
fang_hacks.cfg.bak   miio                 shadow
fang_hacks.sh        miio_client          syslog.conf
firmware             mtab                 twowayaudio.conf
fstab                network              wpa_supplicant.conf
group                no_update_list
hostname             os-release

Any suggestions??

kirilnedev commented 5 years ago

I have exactly exactly the same situation as you... in my case the wifi was not starting at all, so I connected via serial, enabled WLAN0, connected it to wifi, got DHCP IP etc... network works... but I am unable to reset it to factory... I have another camera which is with stock firmware.. if you know how can I get the firmware from the working one I can clone it

kirilnedev commented 5 years ago

Ok I managed to get it back to work with Xiaomi MiHome app. What I did:

  1. While connected via serial cable I edited the /etc/fang_hacks.cfg
    • Changed the DISABLE_CLOUD to 0
    • Changed the NETWORK_MODE to 0 This should enable the cloud software on the camera.
  2. Restarted the camera
  3. Held the SETUP button for 3-4 seconds until I heard the sound... so I can find it in the MiHome app
  4. Added the camera to my MiHome App At this point I had the camera setup and recognized, but the firmware it was using was not allowing it to be used outside of China. Once I click on it, it shows the normal screen for 1-2 seconds and then popped up a disclaimer that you can only use this camera in China
  5. I clicked on the camera and then quickly clicked on the three dots in the upper right part (before the disclaimer shows) then went to General Settings and Firmware update .. I had to do this 3-4 times until I got to the latest version (3.3.4.242) After I installed the latest version it started working normally with the Xiaomi app. In the meantime I was monitoring through the serial console, and managed to get a link to one of the latest firmware's including the access key so I obtained a copy of the BIN file in case someone needs a newer firmware
untouchable3500 commented 4 years ago

hi, I'm having the same problem you had, do you still have the updated firmware

kirilnedev commented 4 years ago

Hi there.. not sure if you got the previous e-mail as the attachment was too big and it got rejected.

Here's the firmware file I managed to obtain from Xiaomi's servers: https://1drv.ms/u/s!AlQ2nWIRBjnmgp4lnFdIeHY4_o6QfA?e=4F8d6R

I hope this helps you

Kind Regards, Kiril

On Thu, Apr 2, 2020 at 11:31 AM untouchable3500 notifications@github.com wrote:

hi, I'm having the same problem you had, do you still have the updated firmware

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/samtap/fang-hacks/issues/418#issuecomment-607732100, or unsubscribe https://github.com/notifications/unsubscribe-auth/AH3AQ3XP3SABYLI6DA32F6TRKRLQJANCNFSM4HIDUHMA .

sh4tteredd commented 3 years ago

did you found any solutions? I have the exact problem.

elig0n commented 3 years ago

I have another camera which is with stock firmware.. if you know how can I get the firmware from the working one I can clone it

@kirilnedev I'm not sure about getting the firmware but you can clone the various partitions of xiaofnag by sending an image of each them (they are at /dev/mtdblockN see /proc/mtd) over network with nc (on sdcard at data/usr/bin/nc)and rewrite them to the other device via tftpboot or maybe with sdcard. If you try and it worked for you please let us know.

elig0n commented 3 years ago

Mounting /media/mmcblk0p1 mount: mounting /dev/mmcblk0p1 on /media/mmcblk0p1 failed: No such file or directory Starting boa webserver... right_count=3 value=0 last_value=0 CGI scripts not found in /media/mmcblk0p1/bootstrap/www! Failed to find hacks in /media/mmcblk0p2/data! Failed to find /media/mmcblk0p2/data!

@mikkel75 It can't read sdcard, did you put it in ?