Beta testing #3

roleoroleo · 2020-10-09T14:36:11Z

I open this issue to continue this thread
roleoroleo/yi-hack-Allwinner#157
in the right place.

roleoroleo · 2020-10-09T14:38:17Z

@lassieee
Could you share the file /dev/shm/fshare_frame_buf
I would like to study how to fix the stream.

lassieee · 2020-10-11T12:37:50Z

sorry for the delay.

/tmp/sd/wd_rtsp.log contains:
2020-10-03 06:34:01 - No running processes, restarting...
2020-10-03 06:34:14 - No running processes, restarting...
2020-10-03 06:34:26 - No running processes, restarting...
2020-10-03 06:34:39 - No running processes, restarting...
2020-10-03 06:34:51 - No running processes, restarting...
2020-10-03 06:35:03 - No running processes, restarting...
2020-10-03 06:35:16 - No running processes, restarting...
2020-10-03 07:02:34 - Starting RTSP watchdog...
2020-10-03 07:02:35 - No running processes, restarting...
2020-10-03 07:02:48 - No running processes, restarting...
2020-10-03 07:03:00 - No running processes, restarting...
2020-10-03 07:03:17 - Starting RTSP watchdog...
2020-10-03 07:03:18 - No running processes, restarting...
2020-10-03 07:03:30 - No running processes, restarting...
2020-10-03 07:03:43 - No running processes, restarting...
2020-10-03 07:03:55 - No running processes, restarting...
2020-10-03 07:04:07 - No running processes, restarting...
2020-10-03 07:04:20 - No running processes, restarting...
2020-10-03 07:04:32 - No running processes, restarting...
2020-10-03 07:04:45 - No running processes, restarting...
2020-10-03 07:04:57 - No running processes, restarting...
2020-10-03 07:05:09 - No running processes, restarting...
2020-10-03 07:05:22 - No running processes, restarting...

so I killed {wd_rtsp.sh} /bin/sh /tmp/sd/yi-hack/script/wd_rtsp.sh and I tried starting rRTSPServer -d 2>&1 but it quits saying port already in use. There is no other rRTSPServer process. I started rRTSPServer on port 555 in debugging, made a few connections and copied /dev/shm/fshare_frame_buf.
fshare_frame_buf.tar.gz

How do you read the contents of this shm file? Do you use shmcat?

roleoroleo · 2020-10-11T15:39:47Z

This file is a custom buffer filled with the h264 stream.
There is an header with a lot of unknown fields and the streams (both high and low res).
If your rtsp server doesn't work, probably yi changed the structure of this file and the grabber doesn't worl correctly.

When you receive the message that the port is already in use you have to wait 20 secs.
The process is terminated and it's not in memory but the socket remains in use for a long time.

I use an hex editor.

roleoroleo · 2020-10-11T16:05:17Z

fshare_frame_buf.tar.gz

The file is empty: all "00".
Could you try again?

lassieee · 2020-10-11T18:57:39Z

thank you for the explanation.

I tried a couple times, but every time the file is as good as empty:
$ xxd fshare_frame_buf | grep -v '0000 0000 0000 0000 0000 0000 0000 0000'
00000020: 0000 0000 0000 0000 0002 0000 0000 0000 ................
00000030: 0000 0000 0100 0000 0000 0000 0204 0000 ................
/run/media/casper/65F0-4F4B $ xxd fshare_frame_buf_2 | grep -v '0000 0000 0000 0000 0000 0000 0000 0000'
00000020: 0000 0000 0000 0000 0002 0000 0000 0000 ................
00000030: 0000 0000 0100 0000 0000 0000 0204 0000 ................
/run/media/casper/65F0-4F4B $ xxd fshare_frame_buf_3 | grep -v '0000 0000 0000 0000 0000 0000 0000 0000'
00000020: 0000 0000 0000 0000 0002 0000 0000 0000 ................
00000030: 0000 0000 0100 0000 0000 0000 0204 0000 ................

I tried without intervention, I tried with killing wd_rtsp.sh, sourcing env.sh and starting wd_rtsp.sh, and I tried with running rRSTPServer -d. In each case the file was empty.

roleoroleo · 2020-10-11T19:23:23Z

How do you copy the file?
Try a cp from /dev to /tmp and then ftp to transfer it to a pc.

Try also to kill rmm before the copy.
Frame buffer file is filled by rmm process.

Check if rmm is running.

lassieee · 2020-10-11T20:31:54Z

I tried multiple times, copying the file to /tmp and using ftp to get it to my laptop. The result is everytime the same. When I kill rmm the camera restarts in about 5 seconds.

starting rRSTPServer and connecting with mplayer:
root@yi-e209:/tmp/sd/yi-hack/bin# ./rRTSPServer -r high -a no -d
debug on
mapping file /dev/shm/fshare_frame_buf, size 1786156, to b6bc4000
closing the file /dev/shm/fshare_frame_buf
starting capture main loop

"ch0_0.h264" stream, from memory
Play this stream using the URL "rtsp://10.75.0.50/ch0_0.h264"
0 - fFrameSize 0 - fMaxSize 150000 - fLimitNumBytesToStream 0 - fPreferredFrameSize 0

$ mplayer rtsp://10.75.0.50:554/ch0_0.h264
MPlayer 1.4-10 (C) 2000-2019 MPlayer Team
do_connect: could not connect to socket
connect: No such file or directory
Failed to open LIRC support. You will not be able to use your remote control.

Playing rtsp://10.75.0.50:554/ch0_0.h264.
Resolving 10.75.0.50 for AF_INET6...

Couldn't resolve name for AF_INET6: 10.75.0.50
Connecting to server 10.75.0.50[10.75.0.50]: 554...

librtsp: server responds: ''
rtsp_session: unsupported RTSP server. Server type is 'unknown'.
libavformat version 58.29.100 (external)
libavformat file format detected.

When starting the rtsp server it say's "closing the file /dev/shm/fshare_frame_buf". Could that be the reason it is empty?

roleoroleo · 2020-10-12T07:20:09Z

h264grabber opens the file, maps it into memory and closes it.

The problem is that fshare_frame_buf is empty while rmm is running.
Does the cam work with the yi app?

lassieee · 2020-10-13T07:12:08Z

I'm not at home this week, but I took the camera with me. I think I kinda messed up. Instead of trying to change the wifi network, or making a hotspot with the same ssid and password, I pressed the reset button on the camera. I only get a blinking orange light now.
On top of that, I think my sd card is acting up, and I didn't bring another. I'll see if my kids' phones have a sd card lol.

I was able to get a full boot log for the first time, with the sd card reformatted and the hack in place:
minicom.log

I noticed that somewhere in the logs I saw a line that read "hit any key to stop autoboot", but for some reason it is not in the logs, and it doesn't respond to key presses.

roleoroleo · 2020-10-13T10:07:30Z

I noticed that somewhere in the logs I saw a line that read "hit any key to stop autoboot", but for some reason it is not in the logs, and it doesn't respond to key presses.

Yes, normally you have to press ENTER to stop u-boot.
The TX pin of the serial port must be connected.

lassieee · 2020-10-13T13:02:33Z

Ok, that'll have to wait until I'm back home and I receive the Flux I ordered. I also found some solder with resin core so I hope I'll be able to solder the wires properly.
I'll fiddle around with the camera later today. I just got new SD card so I'll see how it goes.

lassieee · 2020-10-13T14:02:23Z

I've been able to interrupt the boot proces, but I've no idea where to go from here:

Nothing updated, start normal boot
Hit any key to stop autoboot: 0
=>
=>
=>
=> helpprobe- probe sunxi card0 device
sunxi_flash- sunxi_flash sub-system
version - print monitor, compiler and linker version
=> help
? - alias for 'help'
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
env - environment handling commands
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
fatsize - determine a file's size
fatwrite- write file into a dos filesystem
fdt - flattened device tree utility commands
help - print command description/usage
mmc - MMC sub system
mmcinfo - display MMC info
part_update- part_update
printenv- print environment variables
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
source - run script from memory
sunxi_card0_probe- probe sunxi card0 device
sunxi_flash- sunxi_flash sub-system
version - print monitor, compiler and linker version
=> mmcinfo
curr_device:0
Device: SUNXI SD/MMC
Manufacturer ID: 2
OEM: 544d
Name: SA16G
Bus Speed: 25000000
Mode : SD Legacy
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 14.5 GiB
Bus Width: 4-bit
Erase Group Size: 512 Bytes
=>

It also seems /backup/init.sh on the camera is broken:
/backup/init.sh: line 158: syntax error: unexpected end of file (expecting "fi")

Factory/config.sh isn't triggered to copy a good version, so at this point I don't know what to try next.

roleoroleo · 2020-10-13T15:34:52Z

It also seems /backup/init.sh on the camera is broken:
/backup/init.sh: line 158: syntax error: unexpected end of file (expecting "fi")

Probably this is the problem.

Factory/config.sh isn't triggered to copy a good version, so at this point I don't know what to try next.

Follow this wiki:
https://github.com/roleoroleo/yi-hack-Allwinner/wiki/Unbrick-the-cam
but restore mtdblock4 and not mtdblock3.
This is the mtd partition schema:

dev:    size   erasesize  name
mtd0: 00060000 00001000 "uboot"
mtd1: 001d0000 00001000 "boot"
mtd2: 00120000 00001000 "rootfs"
mtd3: 00340000 00001000 "home"
mtd4: 00130000 00001000 "backup"
mtd5: 00020000 00001000 "env"
mtd6: 00010000 00001000 "mfg"
mtd7: 00010000 00001000 "conf"
mtd8: 00000000 00000000 "UDISK"

backup partition starts from
60000 + 1d0000 + 120000 + 340000 = 690000
and the size is 1245184 = 130000 (hex)

lassieee · 2020-10-13T15:49:08Z

Thanks for the info, unfortunately I didn't make a backup :-(

roleoroleo · 2020-10-13T16:01:08Z

I will send you the file.

lassieee · 2020-10-13T16:26:33Z

I will send you the file.

Thank you, much appreciated.

roleoroleo · 2020-10-13T19:48:56Z

Here it is:
mtdblock4_clean.jffs2.tar.gz

lassieee · 2020-10-14T15:01:04Z

Thanks! I have to give up for now though. I've been fiddling with my taped wires for two hours now, but the connections aren't stable. I really need to solder them. I'll be home next week to give the soldering a try.

mcanteri · 2020-10-17T12:37:40Z

Hi @roleoroleo
I have the Yi cam with the same board and same firmware version as mentioned before, I can help with testing if you tell me how to go on from the point you arrived.
I would like to backup the firmware before hacking it.

mcanteri · 2020-10-17T13:03:25Z

The only (minor) difference I see is on code of the processing unit, it is the same QG2101A but after I have L2010AA 6482 instead of L1026AA 63T2. Probably a different stock, later production.

roleoroleo · 2020-10-18T16:20:48Z

Follow this wiki to make a backup:
https://github.com/roleoroleo/yi-hack-Allwinner-v2/wiki/Dump-your-backup-firmware-(SD-card)

mcanteri · 2020-10-18T17:02:20Z

Ok, perfect, manually done via telnet.
I saw there are 9 block devices and actually the last one doesn't produce a file when dumped.
@roleoroleo what's next ?

roleoroleo · 2020-10-18T17:15:37Z

The last mtd block is empty.
Next, I need a copy of /dev/shm/fshare_frame_buf
But @lassieee already tried without success: the file is zero filled.

mcanteri · 2020-10-18T17:19:55Z

I have a dump made with hexdump and another with dd, which one is the right that you want ?
Mine seems not empty at all.

mcanteri · 2020-10-18T17:27:06Z

Here it is :-)
fshare_frame_buf.zip

roleoroleo · 2020-10-18T18:16:05Z

Thanks.

roleoroleo · 2020-10-18T19:50:04Z

I updated the sources based on your frame buffer file -> b6136e6
I will post a new version asap editing this post.
Please test it.

EDIT

Here it is:
y21ga_0.0.4.tar.gz

mcanteri · 2020-10-18T20:08:39Z

Great, happy to be useful 👍 :-)
Very interesting, so in some way in the frame buffer you can see the header size, the buffer size and offset. There is some "known" delimiter ? :)

mcanteri · 2020-10-18T20:17:52Z

BTW I have to delete all is on the SD card and untar the new hack, correct ?

lechk82 · 2020-10-27T09:10:33Z

I use IoBroker do you know how to set it up there? @lechk82

I am unfortunately not familiar with iobroker, but maybe this is helpful:
https://github.com/Haba1234/ioBroker.onvif

or this (german)
https://forum.iobroker.net/topic/3916/frage-skript-zur-steuerung-onvif-kameras

roleoroleo · 2020-10-27T10:33:42Z

I cloned the repo (used the 0.1.0 tag), ran the installation steps from the installation documentation, tried compiling, but it crashes on this:

checking whether we are cross compiling... configure: error: in `/home/name/yi-hack-Allwinner-v2/src/onvif_srvd/onvif_srvd/gsoap-2.8':
configure: error: cannot run C++ compiled programs.
If you meant to cross compile, use `--host'.
See `config.log' for more details
./gsoap-2.8/gsoap/wsdl/wsdl2h -d -t ./wsdl/typemap.dat  -o generated/onvif.h  wsdl/ptz.wsdl wsdl/media.wsdl wsdl/devicemgmt.wsdl wsdl/bf-2.xsd wsdl/common.xsd wsdl/t-1.xsd wsdl/onvif.xsd wsdl/b-2.xsd
make: ./gsoap-2.8/gsoap/wsdl/wsdl2h: Command not found
Makefile:222: recipe for target 'generated/onvif.h' failed
make: *** [generated/onvif.h] Error 127

Fixed here:
d553ac3

roleoroleo · 2020-10-28T20:00:20Z

Open new issues if you need help.

cebik · 2020-11-18T15:35:36Z

I've got BFUSY440KE should I test this solution? What should I do?
Default one not working.

roleoroleo · 2020-11-18T20:50:09Z

Use the released version.

cebik · 2020-11-18T20:52:42Z

Thx.. this worked: https://github.com/roleoroleo/yi-hack-Allwinner-v2 y21ga_0.1.2.tgz

samazw · 2020-11-19T13:04:29Z

Hi
I got also Yi Home 1080p BFUSY44EZS and tried different steps but no success.
Camera was brand-new (did not boot anytime before)

initial step: Backup of the camera as described in the wiki -> backup worked.

1st procedure

extracted y21ga_0.1.2.tgz to sd card and put it into camera
started camera
Result: LED is yellow and does not change status

2nd procedure

Removed sd card
started camera
after "waiting to connect" I connected the camera with yi home app
Result: Works as designed from yi but (for sure) without hack

-->
3rd procedure

again sd card formatted, extracted y21ga_0.1.2.tgz to sd card and put it into camera
started camera
Result: LED is yellow and does not change status

4th procedure

Removed sd card and started camera
Working again with app but not hacked.

Was there a step missing?

Regards
sam

roleoroleo · 2020-11-19T13:33:28Z

Did you try to connect to the web page?

samazw · 2020-11-19T13:39:33Z

Yes - as soon as I insert the sd card and boot the camera, it does not connect to my wifi. Just a yellow led.
Without sd card the camera works (only with the yi app) but no acces via web page.

Looks like nothing happend. The SD card works fine. (sandisk 16GB)

samazw · 2020-11-22T20:49:09Z

any other ideas regarding Yi Home 1080p BFUSY44EZS?

cebik · 2020-11-22T21:17:05Z

Other firmware than 9.0.19.02_202007141512 ?
(Extended www is under 8080 port.)

samazw · 2020-11-22T21:23:06Z

Same firmware. As mentioned just yellow light with SD Card and hack - no wifi. Wifi only without SD Card (therefore extended www not accessible under 8080 port) Am 22.11.2020 um 22:17 schrieb cebik <[email protected]>: Other firmware than 9.0.19.02_202007141512 ? (Extended www is under 8080 port.) — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#3 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACWAZ64FZAULTR7H7F3MT23SRF5VZANCNFSM4SKFDMLA>.

cebik · 2020-11-22T21:26:42Z

Try format sdcard from camera. After this remove card and copy (I don't remember) unpacked content of this file opened and copy with total commander to sdcard... Newest 7zip unpacking with errors that's why I done this with total commander.

samazw · 2020-11-22T21:50:20Z

unfortunately no success... I think I send it back to Amazon. Nevertheless thanks for your great work! Seems that yi made it bulletproof with this version of the camera :-(

cebik · 2020-11-22T23:23:31Z

It's double packed. Did you unpacked both files?

samazw · 2020-11-23T07:22:22Z

Maybe we´re talking about different files? I took this one which ich not double packed: https://github.com/roleoroleo/yi-hack-Allwinner-v2/releases --> y21ga_0.1.2.tgz.
This extracts the structure including files as:

Folders (including files for sure):

Factory
newbackup
yi-hack

File in main folder:
-lower_half_init.sh

I copied these as usual (previous versions of the yi-cameras to sd card as mentioned above.

cebik · 2020-11-23T08:04:07Z

No, It's ok. Maybe I got it wrong.
Should be ok.
Maybe try to check if telnet is available.

samazw · 2020-11-23T08:28:52Z

Thanks cebrik. Telnet is obviously not available...

cebik · 2020-11-23T16:48:57Z

Offcourse there is no wifi :D
Today I received 2 more cameras and they are working with this patch but I have a little bit different version (I bought them on Aliexpress 17$)

samazw · 2020-11-23T16:59:07Z

Hmm. Maybe I did something fundamentally wrong. Sorry for asking, but could you please write down in short steps how you did it? Really step-by-step (1. Unpacking camera 2.setup sd-card (formatting, copy unpacked stuff on it), 3. put sd-card into factory-new-camera 4. Power-on camera (insert usb cable) 5. Enjoy! This should be the steps, right? Or did you anything else? – Thanks, Cebik!

pep4n · 2020-11-23T20:33:59Z

Hmm. Maybe I did something fundamentally wrong. Sorry for asking, but could you please write down in short steps how you did it? Really step-by-step (1. Unpacking camera 2.setup sd-card (formatting, copy unpacked stuff on it), 3. put sd-card into factory-new-camera 4. Power-on camera (insert usb cable) 5. Enjoy! This should be the steps, right? Or did you anything else? – Thanks, Cebik!

Before inserting the SD you have to turn on the cam and connect WiFi via YI app for once. than proceed as described.
hope that helps,
p

cebik · 2020-11-23T21:00:24Z

True. I also first paired camera with standard application. Btw rtsp don't want to work with domoticz :/
But preview from camera working good :/

cebik · 2020-11-25T12:44:25Z

I think it is already working for him, since he has not spoken anymore.
It also works in domoticz - I ran out of a password and login in the configuration. Previously, it worked without it because the authorization is probably poorly identified.

samazw · 2020-11-25T13:42:02Z

Hi, sorry its still not working... have no idea on what to try else...

roleoroleo · 2020-11-27T19:43:28Z

Please open a new issue.

roleoroleo mentioned this issue Oct 9, 2020

New YI Home 1080P AI+ BFUSY44GEE with FW 9.0.19.02_202007141512 supported? roleoroleo/yi-hack-Allwinner#157

Closed

fklement mentioned this issue Oct 27, 2020

No compiled Firmware Files in Release #12

Closed

roleoroleo closed this as completed Oct 28, 2020

SmartM-ui mentioned this issue Jul 15, 2021

Save video when a motion is detected is not working correctly #227

Closed

ghost mentioned this issue Feb 2, 2022

Unstable highres rtsp stream #98

Closed

graham30rad mentioned this issue Mar 4, 2023

Not working on Y29GA #587

Closed

Beta testing #3

Beta testing #3

Comments

roleoroleo commented Oct 9, 2020 • edited Loading

roleoroleo commented Oct 9, 2020 • edited Loading

lassieee commented Oct 11, 2020 • edited Loading

roleoroleo commented Oct 11, 2020 • edited Loading

roleoroleo commented Oct 11, 2020

lassieee commented Oct 11, 2020

roleoroleo commented Oct 11, 2020 • edited Loading

lassieee commented Oct 11, 2020 • edited Loading

roleoroleo commented Oct 12, 2020

lassieee commented Oct 13, 2020 • edited Loading

roleoroleo commented Oct 13, 2020

lassieee commented Oct 13, 2020

lassieee commented Oct 13, 2020 • edited Loading

roleoroleo commented Oct 13, 2020 • edited Loading

lassieee commented Oct 13, 2020

roleoroleo commented Oct 13, 2020

lassieee commented Oct 13, 2020

roleoroleo commented Oct 13, 2020

lassieee commented Oct 14, 2020

mcanteri commented Oct 17, 2020

mcanteri commented Oct 17, 2020 • edited Loading

roleoroleo commented Oct 18, 2020

mcanteri commented Oct 18, 2020 • edited Loading

roleoroleo commented Oct 18, 2020 • edited Loading

mcanteri commented Oct 18, 2020

mcanteri commented Oct 18, 2020

roleoroleo commented Oct 18, 2020

roleoroleo commented Oct 18, 2020 • edited Loading

mcanteri commented Oct 18, 2020

mcanteri commented Oct 18, 2020

lechk82 commented Oct 27, 2020 • edited Loading

roleoroleo commented Oct 27, 2020

roleoroleo commented Oct 28, 2020

cebik commented Nov 18, 2020

roleoroleo commented Nov 18, 2020

cebik commented Nov 18, 2020 • edited Loading

samazw commented Nov 19, 2020

roleoroleo commented Nov 19, 2020

samazw commented Nov 19, 2020 • edited Loading

samazw commented Nov 22, 2020

cebik commented Nov 22, 2020

samazw commented Nov 22, 2020 via email

cebik commented Nov 22, 2020 • edited Loading

samazw commented Nov 22, 2020

cebik commented Nov 22, 2020

samazw commented Nov 23, 2020

cebik commented Nov 23, 2020

samazw commented Nov 23, 2020

cebik commented Nov 23, 2020

samazw commented Nov 23, 2020 via email • edited by roleoroleo Loading

pep4n commented Nov 23, 2020 • edited Loading

cebik commented Nov 23, 2020

cebik commented Nov 25, 2020

samazw commented Nov 25, 2020 via email • edited by roleoroleo Loading

roleoroleo commented Nov 27, 2020

roleoroleo commented Oct 9, 2020 •

edited

Loading

roleoroleo commented Oct 9, 2020 •

edited

Loading

lassieee commented Oct 11, 2020 •

edited

Loading

roleoroleo commented Oct 11, 2020 •

edited

Loading

roleoroleo commented Oct 11, 2020 •

edited

Loading

lassieee commented Oct 11, 2020 •

edited

Loading

lassieee commented Oct 13, 2020 •

edited

Loading

lassieee commented Oct 13, 2020 •

edited

Loading

roleoroleo commented Oct 13, 2020 •

edited

Loading

mcanteri commented Oct 17, 2020 •

edited

Loading

mcanteri commented Oct 18, 2020 •

edited

Loading

roleoroleo commented Oct 18, 2020 •

edited

Loading

roleoroleo commented Oct 18, 2020 •

edited

Loading

lechk82 commented Oct 27, 2020 •

edited

Loading

cebik commented Nov 18, 2020 •

edited

Loading

samazw commented Nov 19, 2020 •

edited

Loading

cebik commented Nov 22, 2020 •

edited

Loading

samazw commented Nov 23, 2020 via email •

edited by roleoroleo

Loading

pep4n commented Nov 23, 2020 •

edited

Loading

samazw commented Nov 25, 2020 via email •

edited by roleoroleo

Loading