Yi Cloud Dome 1080p dump in progress :)

BlueBlueBlob commented 5 years ago

img_20181231_144409

Hi all, I'm connected.

But I mess with the home partition before, so I'm waiting my second camera. I will send dump in the week :)

See you later all

BlueBlueBlob commented 5 years ago

Or I will compile a custom firmware. @shadow-1 : are your sdk links still up ?

shadow-1 commented 5 years ago

@BlueBlueBlob Yes the SDK's I hosted should still be up (link on main page). I never removed them.

mitchross commented 5 years ago

Hi @BlueBlueBlob Any update?

BlueBlueBlob commented 5 years ago

I'm waiting delivery. Today I will try to provide stock rootfs and home partitions for y19 (its code name). So people will able to unbrick.

phoxy84 commented 5 years ago

Sounds great, can't wait to use my camera. Now I only get the message that the camera does not work outside China :'(

BlueBlueBlob commented 5 years ago

Well... Next update in 1 week... I bought the Dome 1080p in white but it's not the Cloud 😂 I'm waiting the new one :/

cautroi01 commented 5 years ago

This is stock firmware from YI Technical Support for Yi Cloud Dome 1080p https://mega.nz/#!N0BHQAoY!XR5R-YI7NutOHSOr8ZL1sSPLeB7ipZP_pcPD5fAqQXg

BlueBlueBlob commented 5 years ago

This is stock firmware from YI Technical Support for Yi Cloud Dome 1080p https://mega.nz/#!N0BHQAoY!XR5R-YI7NutOHSOr8ZL1sSPLeB7ipZP_pcPD5fAqQXg

Thx but renaming with home_y19 is not wworking. Did they say how to apply ?

cautroi01 commented 5 years ago

The firmware working for me They say:

the firmware file for you to update the camera (do not unzip or rename the firmware, just copy it to SD card root)

If the issue still exists after that, then please help us take the camera firmware logs: I. insert a Micro SD card (8g-32g,FAT32,completely formatted) into the camera before power on II. keeps the camera running until the pairing issue occurs once again III. wait 5 minutes before removing the SD card from camera IV. copy all the logs and the zbar.raw under SD card via card-reader or laptop and send the files for us to check ( for example, the files will come in such format: log_SPM6EEMEL7N94JFM111A_tnp_init_finish.tar.gz log_SPM6EEMEL7N94JFM111A_yi_login.tar.gz)

BlueBlueBlob commented 5 years ago

The firmware working for me They say:

the firmware file for you to update the camera (do not unzip or rename the firmware, just copy it to SD card root)

If the issue still exists after that, then please help us take the camera firmware logs: I. insert a Micro SD card (8g-32g,FAT32,completely formatted) into the camera before power on II. keeps the camera running until the pairing issue occurs once again III. wait 5 minutes before removing the SD card from camera IV. copy all the logs and the zbar.raw under SD card via card-reader or laptop and send the files for us to check ( for example, the files will come in such format: log_SPM6EEMEL7N94JFM111A_tnp_init_finish.tar.gz log_SPM6EEMEL7N94JFM111A_yi_login.tar.gz)

Thx a lot :)

BlueBlueBlob commented 5 years ago

Ok I'm connected, but I can't enter command. I only see Yi process output even pressing enter.

phoxy84 commented 5 years ago

Will this work for both the Chinese and International version? I have Chinese version, can you test with that version as well? If I can help, let me know, allthough I have limited knowledge ;)

TheCrypt0 commented 5 years ago

The image linked by @cautroi01 isn't a firmware image. The suffix "m" means that it's an encrypted update, not a recovery image.

BlueBlueBlob commented 5 years ago

Yes but I was able to flash it. @TheCrypt0 : Do I have to pair my camera before to have shell cmd on ttl ?

BlueBlueBlob commented 5 years ago

After inserting sdcard

himci: card connected! himci: mmc1: valid phase shift [5, 3] Final Phase 0 mmc1: new ultra high speed SDR104 SDHC card at address aaaa mmcblk0: mmc1:aaaa SC32G 29.7 GiB mmcblk0: p1 stExposureAttr.stAuto.u8Compensation=60 killall: recbackup: no process killed umount: can't forcibly umount /tmp/cifs: No such file or directory stExposureAttr.stAuto.u8Compensation=60 p2p cur user(0) max_user_num(0) in_packet_loss(0) out_packet_loss(0) umount: can't remount tmpfs read-only umount: /dev/mtdblock5 busy - remounted read-only umount: can't remount tmpfs read-only stExposureAttr.stAuto.u8Compensation=58 can't run '/sbin/swapoff': No such file or directory The system is going down NOW! MMB LEAK(pid=1006): 0x83F46000, 12288 bytes, '' mmz_userdev_release: mmb<0x83F46000> mapped to userspace 0xb6fca000 will be force unmaped! Sent SIGTERM to all processes MMB LEAK(pid=965): 0x835A5000, 4096 bytes, 'AENC(0)StrmBuf' mmz_userdev_release: mmb<0x835A5000> mapped to userspace 0xb6f09000 will be force unmaped! MMB LEAK(pid=965): 0x835A6000, 32768 bytes, 'AENC(0) CirBuf' mmz_userdev_release: mmb<0x835A6000> mapped to userspace 0xb6d62000 will be force unmaped! MMB LEAK(pid=965): 0x835B3000, 16384 bytes, 'AO(0,0) CirBuf' mmz_userdev_release: mmb<0x835B3000> mapped to userspace 0xb6c5e000 will be force unmaped! MMB LEAK(pid=1006): 0x83F49000, 4096 bytes, 'CIPHER_BufIn' mmz_userdev_release: mmb<0x83F49000> mapped to userspace 0xb6fc9000 will be force unmaped! MMB LEAK(pid=1006): 0x83F4A000, 4096 bytes, 'CIPHER_BufOut' mmz_userdev_release: mmb<0x83F4A000> mapped to userspace 0xb6ece000 will be force unmaped! unlink cmd rsp urb Sent SIGKILL to all processes Requesting system reboot

****reboot by watchdog**** Restarting system.

System startup =========1 hello, open console

do_auto_sd_update: detect flash size: 0x1000000, gsdexist=1 Interface: MMC Device 0: Vendor: Man 035344 Snr 4a7710f6 Rev: 8.0 Prod: SC32G Type: Removable Hard Disk Capacity: 30436.5 MB = 29.7 GB (62333952 x 512) Partition 1: Filesystem: FAT32 "NO NAME " 245760 zbar.raw 36864 log_wifi_connected.tar.gz 40448 log_first_login.tar.gz system volume information/ record/ log/ test/ 1820774 home_y19m

4 file(s), 4 dir(s)

1: zbar.raw! 2: log_wifi_connected.tar.gz! 3: log_first_login.tar.gz! 4: home_y19m! u-boot_y19 not found!

env_y19 not found!

conf_y19 not found!

kernel_y19 not found!

rootfs_y19 not found!

home_y19 not found!

do_auto_update: detect flash size: 0x1000000

UBOOT:test pin high!

Hit any key to stop autoboot: 0 16384 KiB hi_fmc at 0:0 is now current device

Booting kernel from Legacy Image at 82000000 ...

Image Name: 7518-hi3518c-kernel Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1397928 Bytes = 1.3 MiB Load Address: 80008000 Entry Point: 80008000 Loading Kernel Image ... OK OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel. Booting Linux on physical CPU 0 Linux version 3.4.35 (zhangbao@ANTS-SH-SV02) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v300) ) #36 Tue Sep 26 09:54:23 CST 2017 CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177 CPU: VIVT data cache, VIVT instruction cache Machine: hi3518ev200 Memory policy: ECC disabled, Data cache writeback Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8636 Kernel command line: mem=34M console=ttyAMA0,115200 root=/dev/mtdblock4 rootfstype=jffs2 mtdparts=hi_sfc:256k(boot)ro,64k(env),64k(conf),1600k(os),1280k(rootfs),12992k(home),64k(vd1),64k(ver)!!! PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 34MB = 34MB total Memory: 30616k/30616k available, 4200k reserved, 0K highmem Virtual kernel memory layout: vector : 0xffff0000 - 0xffff1000 ( 4 kB) fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB) vmalloc : 0xc2800000 - 0xff000000 ( 968 MB) lowmem : 0xc0000000 - 0xc2200000 ( 34 MB) modules : 0xbf000000 - 0xc0000000 ( 16 MB) .text : 0xc0008000 - 0xc0348000 (3328 kB) .init : 0xc0348000 - 0xc0364e2c ( 116 kB) .data : 0xc0366000 - 0xc0387780 ( 134 kB) .bss : 0xc03877a4 - 0xc03b9d30 ( 202 kB) SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 NR_IRQS:32 VIC @fe0d0000: id 0x00641190, vendor 0x41 sched_clock: 32 bits at 49MHz, resolution 20ns, wraps every 86767ms Console: colour dummy device 80x30 Calibrating delay loop... 269.10 BogoMIPS (lpj=1345536) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 Initializing cgroup subsys freezer CPU: Testing write buffer coherency: ok Setting up static identity map for 0x80270d18 - 0x80270d70 dummy: NET: Registered protocol family 16 Serial: AMBA PL011 UART driver uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2 console [ttyAMA0] enabled uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 30) is a PL011 rev2 uart:2: ttyAMA2 at MMIO 0x200a0000 (irq = 25) is a PL011 rev2 bio: create slab at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb Switching to clocksource timer0 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP: reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. fuse init (API version 7.18) msgmni has been set to 59 io scheduler noop registered io scheduler deadline registered (default) io scheduler cfq registered brd: module loaded Check Flash Memory Controller v100 ... Found. SPI Nor(cs 0) ID: 0xc2 0x20 0x18 Block:64KB Chip:16MB Name:"MX25L128XX" SPI Nor total size: 16MB mtd: bad character after partition (!) 8 cmdlinepart partitions found on MTD device hi_sfc 8 cmdlinepart partitions found on MTD device hi_sfc Creating 8 MTD partitions on "hi_sfc": 0x000000000000-0x000000040000 : "boot" 0x000000040000-0x000000050000 : "env" 0x000000050000-0x000000060000 : "conf" 0x000000060000-0x0000001f0000 : "os" 0x0000001f0000-0x000000330000 : "rootfs" 0x000000330000-0x000000fe0000 : "home" 0x000000fe0000-0x000000ff0000 : "vd1" 0x000000ff0000-0x000001000000 : "ver" himii: probed ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver hiusb-ehci hiusb-ehci.0: HIUSB EHCI hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1 hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000 hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected i2c /dev entries driver hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed! hisi_i2c hisi_i2c.1: Hisilicon [i2c-1] probed! hisi_i2c hisi_i2c.2: Hisilicon [i2c-2] probed! TCP: cubic registered Initializing XFRM netlink socket NET: Registered protocol family 17 NET: Registered protocol family 15 lib80211: common routines for IEEE802.11 drivers Registering the dns_resolver key type VFS: Mounted root (jffs2 filesystem) on device 31:4. Freeing init memory: 112K ^Cusb 1-1: new high-speed USB device number 2 using hiusb-ehci ^C

        \  _  _   _  _ _ ___
        / /__/ \ |_/
       / __   /  -  _ ___
      / /  / /  / /

/ / / _/ _ __ ____\______

^C^C^Chimci: mmc1: valid phase shift [5, 3] Final Phase 0 mmc1: new ultra high speed SDR104 SDHC card at address aaaa mmcblk0: mmc1:aaaa SC32G 29.7 GiB Not recognise ACTION:change Not recognise ACTION:change mmcblk0: p1 ^C^C^C^Crm: can't remove '/sbin/reboot': No such file or directory exFAT: Version 1.2.9 ^Cvm.dirty_background_ratio = 2 vm.dirty_ratio = 2 vm.dirty_writeback_centisecs = 100 vm.dirty_expire_centisecs = 500 fs.mqueue.msg_max = 256

shadow-1 commented 5 years ago

@BlueBlueBlob Boot log does not give much away. 😞

I might investigate the Yi Outdoor camera firmware which also seems to have disabled terminal access. I have more information on that camera.

BlueBlueBlob commented 5 years ago

@shadow-1 just a question, regarding boot log and kernel information. The y19 is more h20 or y20 ? Because I'm waiting a second one, so I can flash rootfs from other model but I'm not sure :)

shadow-1 commented 5 years ago

@BlueBlueBlob Not sure what you are asking.

Your camera is looking for a y18 firmware file to flash from microSD card. I do not recommend renaming one of the other firmware files and flashing it. It can soft brick your camera with no way to recover (because we do not have a dump of the stock firmware to restore).

TheCrypt0 commented 5 years ago

Discord Server

I've just created a Discord server with a couple of channels. Invite link.

I'm posting this here too, in case someone wants to join have a easier direct communication. The main informations/discoveries about the cam will be posted on the issue too.

BlueBlueBlob commented 5 years ago

@shadow-1 : y19 not y18. rootfs is busy box and init.d script, do you think I can flash the rootfs from h20 ? Like you suggest for Outdoor camera with another rootfs. Sorry for my English :/

shadow-1 commented 5 years ago

@BlueBlueBlob I personally would not do it because it could brick your camera with no way of restoring it until we manage to get a backup of the stock firmware from another camera (using a different method).

BlueBlueBlob commented 5 years ago

Got it !

I have all partitions :)

I can start to play with rootfs :) Thx @shadow-1 : You shared a lot of informations in issue threads Just need some help to mount mtdblock :/

BlueBlueBlob commented 5 years ago

Well sorry I tried all the day, but I can not mount dumps :/ During this time I extracted last update from y19 : 1.9.3.0E_201812141519home_y19m

BlueBlueBlob commented 5 years ago

Dump complete

mecaz commented 5 years ago

Is there any progress?

BlueBlueBlob commented 5 years ago

@shadow-1 : do you want stock home_y19 and rootfs_y19 ?

shadow-1 commented 5 years ago

@BlueBlueBlob It would be helpful to have these files. I am sure an alternative firmware can be developed if it is similar to the other cameras in the series. 😄

BlueBlueBlob commented 5 years ago

@shadow-1 : sure. V4 is already working with it. Sorry, I thought you didn't have time. https://drive.google.com/folderview?id=18v0H6XF54KEcsUXGfRxgw3eWyk6hjIFG

Nomis9 commented 5 years ago

@BlueBlueBlob It would be helpful to have these files. I am sure an alternative firmware can be developed if it is similar to the other cameras in the series. 😄

Will you create modified firmware for Yi Cloud Dome 1080p? Thanks for answer

alienatedsec commented 3 years ago

@shadow-1 @BlueBlueBlob are you still in possession of those stock home_y19 and rootfs_y19 files?

shadow-1 / yi-hack-v3