List of which Models/ARM processors hack is needed?

[marcusademola]

Perhaps below list is helpful and would be great if you can help to populate. Especially the ARM processor list (if you opened the device please include also photo).

Model (label)	Product name	FCC ID	FCC Date	ARM processor
CMSXJ11A	IMILAB Wire-Free Home Security Camera	2APA9-IPC011A	07/31/2019	-
CMSXJ11AG	IMILAB Wire-Free Camera Gateway	2APA9-IPC011AG	07/05/2019	-
CMSXJ16A	IMILAB Home Security Camera Basic	2APA9-IPC016A	11/19/2018	MStar MSC313E AT38U96A 19328
CMSXJ19C	IMI Home Security Camera 1080p Global	2APA9-IPC019C	10/23/2019	-
CMSXJ19E	IMILAB Home Security Camera A1	2APA9-IPC019E	03/10/2020	Star SSC 323 ARM - too?
CMSXJ183	IMI Home Security Camera 1080p Global	2APA9-IPC009A	08/21/2018	Star SSC323 ACP025UA 193S ARM
CMSXJ25A	IMILAB EC3 Outdoor Security Camera	2APA9-IPC025B	04/15/2020	SSC325 AY00255B 2010J ARM
IPC019D	Smartthings Cam 360	2APA9-IPC019D	03/09/2020	Star SSC323 APC983UA 193J ARM
HMI205A	Mi Smart Plug Wifi	2APA9-HMI205A	04/27/2018	-
MJSXJ10CM	(product name)	-	-	Star SSC323 AP10DE8B 2114F-IM12 ARM
MJSXJ02CM	Mi Home Security Camera 360° 1080P	2APA9-IPC009A	08/21/2018	Star SSC323 ACP025UA 193S ARM

(status 19.12.2021 , previous versions 18.11.2021, 23.4.2020)

** = Originally the hack was done for just one model, maybe its possible to expand a little. Maybe this table can be added on wiki page, including status:)

[angadsingh]

do you know if the hack works with SXJ02ZM?

[marcusademola]

do you know if the hack works with SXJ02ZM?

I dont sorry, anyone else? If not would you like to give a try, document it well and publish here

[Povezi]

Does it work with CMSXJ25A ?

[teras]

This guy opened the CMSXJ16A device... https://github.com/telmomarques/xiaomi-360-1080p-hacks/issues/12#issuecomment-734817542

[cstrassburg]

CMSXJ19E uses a Star SSC 323 ARM too:

https://github.com/cstrassburg/cmsxj19e-hacks/blob/main/images/IMG_20210607_164115.jpg

[gelsoniezzi]

CMSXJ25A - SSC325 AY00255B 2010J AMR

[sihaizhishu]

Does it work with CMSXJ25A ?

No. I have tried this on IMILAB CMSXJ25A. It is not working with it :(

thanks @sunxueliang96 here is the firmware to recover the device: https://github.com/sunxueliang96/xiaomi-mijia-MIIO-documentsdocuments-examples-firmwares/blob/0b3a6eed97132cbb6017c749a66b2691871ec522/%E5%B0%8F%E7%B1%B3%E7%B1%B3%E5%AE%B6%E6%91%84%E5%83%8F%E5%A4%B4%E6%9C%80%E6%96%B0%E6%9C%80%E5%85%A8%E5%9B%BA%E4%BB%B6%E4%B8%8B%E8%BD%BD%E5%9C%B0%E5%9D%80.txt

[marcusademola]

Thanks for the inputs, updated the table, but its still not clear which models were succefully flashed (entered) so I didnt add hack-status column (yet). Feel free to input.

Meanwhile, I also discovered block diagram that might be useful. https://linux-chenxing.org/infinity6/ssc326d_blockdiagram.png

Someone also said there is model ipc013d MI HomeSecure 360, but I havent find reference

Btw you may want to use dustcloud to find telnet to the device https://github.com/dgiese/dustcloud (very interesting data DEFCON26 IoT Village Slides)

[pixjuan]

Here is what I manage to decipher for my MJSXJ10CM: SSC323 AP10DE8B 2114F-IM12 ARM

[0x7c9]

Here is what I manage to decipher for my MJSXJ10CM: SSC323 AP10DE8B 2114F-IM12 ARM

can be hacked too? With rtsp?

[pixjuan]

can be hacked too? With rtsp?

The RTSP hack doesn't work out of the box. I have time this summer, I will try to get it working

[0x7c9]

can be hacked too? With rtsp?

The RTSP hack doesn't work out of the box. I have time this summer, I will try to get it working

okay , i will wait for it.

[Cavairs]

тоже можно взломать? С ртсп?

Взлом RTSP не работает из коробки. У меня есть время этим летом, я постараюсь заставить его работать

waiting for. would be great

[thanasis00]

+1 from me as well! Waiting for updates, I can also help with testing and/or development.

[Twicer]

What possible do?

IMILAB C30 (looks like C21) STAR SSC337DE AS0081B 2048 ARM

Detects as : chuangmi.camera.021e01 FCC-ID 2APA9-CMSXJ21E FW: 021501_1.6.0_0077 Open Ports: 53 domain 67 dhcps 684 cobra-iiop-ssl 772cycleserv2 959 8001 vcom-tunnel 9103 bacula-sd 17494 17638 18228 19719 20425 26720 32777 rpc18 39217 42172 45818 49180 49393 51255 53571 57843

NAME=Buildroot VERSION=2017.08-00349-gb8cf9fb-dirty ID=buildroot VERSION_ID=2017.08 PRETTY_NAME="Buildroot 2017.08" MODEL_COMMIT=87f5fc5 COMMON_COMMIT=b8cf9fb CHUANGMI_VERSION=021501_1.6.0_0077

[+ +++ ---] ali_stream uptime: 406s/-s pids: 712/- [+ +++ +++] fetch_av uptime: 406s/406s pids: 715/714 [+ +++ ---] imi_agent uptime: 406s/-s pids: 719/- [- --- ---] imi_ota (service not activated) [+ +++ +++] miio_client_helper uptime: 406s/406s pids: 723/722 [+ +++ ---] miio_devicekit uptime: 406s/-s pids: 725/- [+ +++ ---] miio_record uptime: 337s/-s pids: 1074/- [+ +++ ---] miio_sdcard uptime: 406s/-s pids: 727/- [+ +++ ---] mortox uptime: 407s/-s pids: 703/- [+ +++ ---] mstar_algo uptime: 337s/-s pids: 1078/-

• cat /run/nas/debug cat: can't open '/run/nas/debug': No such file or directory
• ls -hAl /mnt/sdcard/MIJIA_RECORD_VIDEO ls: /mnt/sdcard/MIJIA_RECORD_VIDEO: No such file or directory
• log_diag_platform.sh /mnt/data/bin/log_diag.sh: line 1: log_diag_platform.sh: not found