New YI Home 1080P AI+ BFUSY44GEE with FW 9.0.19.02_202007141512 supported?

[RestOp]

Hello,
New YI Home 1080P AI+ BFUSY44GEE with FW 9.0.19.02_202007141512
I just got this cam https://www.amazon.es/gp/product/B01MR82NFZ
On the back side of Cam is BFUSY44GEE. Date on box 2020.09
I made a backup of FW. Here it is: https://drive.google.com/drive/folders/1ifFIDG4G0v-aIKrE_4kcy3elXd5Bsae3
Can not understand if it is supported or not. Could you please look and say if I need to send it back to amazon?

Thanks a lot!

[danielk117]

Same here... two cams with firmware 9.0.19.02_202007141512, just bought on amazon germany yesterday.
DID: BFUSY44...
SN: BY21GAEU...
Date: 2020.09

So a y21ga? I'm afraid it is neither an MStar nor an Allwinner.

[lassieee]

me too. Got mine yesterday from amazon:
firmware 9.0.19.02_202007141512
DID: BFUS440PE...
SN: BY21GAEUW...
chip is a QG2101A
not sure if there's a hacked firmware for this model already.

[danielk117]

Thanks for the teardown images 👍
I tought these internal model names (like y20ga) came from the DID, but your board is marked as y29ga...

I think there isnt a hacked firmware for this device, because its just too new. But the QG2101A isnt new at all (see #70).
I hope @roleoroleo can tell if it belongs to MStar or Allwinner. 😃

[RestOp]

I hope also, in other way it must be send back to amazon 😌 I do need this cam if i can not intergrate it in HA 😀
Guys, have you found any alternative to these cams in same price?

[danielk117]

Guys, have you found any alternative to these cams in same price?

No...

[roleoroleo]

I think it's an Allwinner model.
But the flash partitions are different.
home is a read only squashfs.
A new hack is needed.

[RestOp]

I think it's an Allwinner model.
But the flash partitions are different.
home is a read only squashfs.
A new hack is needed.

It means we can forget and send it back or any chances in visible future?🤪

[roleoroleo]

Moreover, the flash size is 8MB and not 16MB like the "current" Allwinner.
I think that the hack is possible but only using the external SD.
Like the sonoff hack:
https://github.com/roleoroleo/sonoff-hack

[roleoroleo]

See here:
#105

Same hardware.

[lassieee]

Sounds like a starting point. I wish I had the tools and skills to help in any way. If there is anything you think I could help with, please let me know!

[danielk117]

home is a read only squashfs.
A new hack is needed.

You mean we need a root for this model?
A a new hacks sounds like weeks or months, if anything is coming.

@RestOp Alternative in same price? I bought a 4pack of these cams on amazon germany just two weeks ago. All cams are 9FUS und flashable with this allwinner hack. But all cams have a disturbing noise coming trough the microphone (before and after hacking). So I wanted to send them back and bought new single ones (this new unknown model 😞).

[roleoroleo]

Analyzing the file init.sh probably we could create an hack, like the Allwinner model.
But without a cam, I can't do it.

[roleoroleo]

lower_half_init.sh contains the same hack:

if [ -f "/tmp/sd/Factory/factory_test.sh" ]; then
        /tmp/sd/Factory/config.sh
        exit
fi

I could try to create a new telnet hack.

[lassieee]

First of all thank you very much for your time and effort Roleo, it's much appreciated!
I can imagine you really do need one of these new cams to create a successful hack, so perhaps we could:
A) see how many people are interested and split the cost so you can buy one of these cams to hack it, without any guarantees
B) I could send you my cam by mail and when you're done with it, you can return it
C) try to explain how the hacking procedure goes. I lack (proper) smd skills and jtag tools, but I'm a Linux engineer so I'm not completely clueless, and I can do some really simple soldering too.

[roleoroleo]

I think I could start without a cam.
Then, if necessary, A would be the best.
In the meantime, if someone wants to try ...
y21_hack.tar.gz --- REMOVED

[danielk117]

@roleoroleo I will give a try 😉

[danielk117]

Factory was renamed to Factory.done, but no telnet

[roleoroleo]

So, the script is executed but telnet doesn't start.

[RestOp]

So, the script is executed but telnet doesn't start.

What does it means? No way to hack?

[roleoroleo]

No, no...
The hack s possible.

[roleoroleo]

Ok, try this:
y21_hack.tar.gz

[lassieee]

Factory has been renamed to Factory.done, contains the file lower_half_init.sh which contains '/usr/sbin/telnetd &' (same as with your previous tar). Unfortunately nothing listens on port 23.
I was wondering if there is a telnetd in /usr/sbin, so i tried to ls -l /usr/sbin > /tmp/sd/Factory/sbin.txt but sbin.txt doesn't get created.

[lassieee]

wait, scratch that, i reformatted my sd card and tried again, i got a telnet prompt now!

[roleoroleo]

Ok.
Now the long part.

1. We need to create a new repo
2. Copy the Allwinner tree
3. Change all programs moving the binary from /home/yi-hack/ to /tmp/sd/yi-hack/
4. Check if h264grabber works or the framebuffer structure is changed
5. Check all compiled programs
6. ...

[RestOp]

Unfortunatly, i'm not linux-friendly, but i'm study-friendly😎 so if any help from me needed, let me know!

[lassieee]

Cool! If I can help in any way, please let me know :-)

[danielk117]

Great 👍🏻 Will try it tonight 😊

[roleoroleo]

I'm starting to create the new repo.
And effectiverly, without a cam it is very difficult. I can't ask you to try a new fw every 5 minutes.
Probably I need a cam...

[RestOp]

I'm starting to create the new repo.
And effectiverly, without a cam it is very difficult. I can't ask you to try a new fw every 5 minutes.
Probably I need a cam...

Understand, maybe u can try to make few different revisions and we will try them all and comment behavior?

[roleoroleo]

This is the final (at the moment) version of the hack.
It overwrites /backup/init.sh with a "better" version that runs a shell script on the sd card at the end of the procedure.
If you install this hack you could start a new firmware on sd . If you remove the sd, the cam starts with the original fw.
y21ga_hack.tar.gz

[danielk117]

If you need the unhack procedure to remove the hack:
unhack_y21ga.tar.gz --- REMOVED

The LED remains orange. No matter if with or without SD card.
But Factory was renamed.

[roleoroleo]

Very strange.

[danielk117]

The camera does nothing except the orange LED.

[roleoroleo]

Apply again the hack.

[lassieee]

system.sh should start automatically.
You don't have to run it (if the procedure works).
Check if the processes are runnings: httpd, ftpdf, mqttv4, etc...

EDIT

Found the problem...
One more time around the block.
y21ga_0.0.2.tar.gz

I have no processes like httpd or ftpd running. I also can't find a binary for httpd. I've read that's part of busybox, but I'm unable to start if from a little test script. It says httpd not found.
I'm such a busybox n00b lol

[danielk117]

Apply again the hack.

Nothing happend. Factory isnt renamed anymore. I think its bricked.

[roleoroleo]

Nothing happend. Factory isnt renamed anymore. I think its bricked.

Did you clean the sd?
Is telnetd running?

EDIT

Maybe your init.sh is not in correct linux format (CR-LF)?
In this case the hack procedure cannot start.
But I can help you to unbrick the cam with a serial connection, if you want.

[roleoroleo]

I have no processes like httpd or ftpd running. I also can't find a binary for httpd. I've read that's part of busybox, but I'm unable to start if from a little test script. It says httpd not found.
I'm such a busybox n00b lol

I thought httpd was in the original busybox, but it's not there.
I will add it.

[lassieee]

thanks. Can you also add hostname? that's missing as well

[roleoroleo]

0.0.3: httpd and hostname
Please let me know if httpd starts.
y21ga_0.0.3.tar.gz

[roleoroleo]

@danielk117
This is the unbrick procedure for the older model:
https://github.com/roleoroleo/yi-hack-Allwinner/wiki/Unbrick-the-cam
I think it's pretty the same.
But you have to restore mtdblock4.

If you are able to connect the uart with a usb-serial adapter I can help you.

[lassieee]

Ok, found it. In a previous version, we didn't have httpd so httpd couldn't start. Adding telnetd to /backup/init.sh DID work, so the check in Factory/config.sh skips copying newbackup/init.sh to /backup/init.sh because the hack is supposedly already in place.
httpd is running! and so is ftpd, rstp..

Great work!

minor detail, y21ga_0.0.3/yi-hack/www/record is a symlink

more minor stuff:

serial number isn't filled, as well as free/total memory
Which part of /tmp/mmap.info is the serial number?

[roleoroleo]

Good!!!
This result is better than all my expectations.

Ok, found it. In a previous version, we didn't have httpd so httpd couldn't start. Adding telnetd to /backup/init.sh DID work, so the check in Factory/config.sh skips copying newbackup/init.sh to /backup/init.sh because the hack is supposedly already in place.
httpd is running! and so is ftpd, rstp..

Ok, new users shouldn't have this problem.

/tmp/sd/record:
Fixed removing the ln command from compile.www
Try to remove the symlink manually and it should work.
init.sh creates a bind mount.

Serial number:
The command (inside status.json cgi) is
SERIAL_NUMBER=$(dd bs=1 count=20 skip=592 if=/tmp/mmap.info 2>/dev/null | cut -c1-20)
dd and cut are present, probably the mmap.info file is different. Actually is offset=592, len=20
Check your mmap.info.

Memory:
free command is missing, I will add it in the next release.

Please check if rtsp stream is running and if the snapshot service works.
The 2 most complicated pieces.

[danielk117]

@danielk117
This is the unbrick procedure for the older model:
https://github.com/roleoroleo/yi-hack-Allwinner/wiki/Unbrick-the-cam
I think it's pretty the same.
But you have to restore mtdblock4.

If you are able to connect the uart with a usb-serial adapter I can help you.

I think this happend because i have the first hack installed (with the modified lower_half_init.sh and so on).
Yes, I'm able to connect to uart (i own a TTL-interface and on @lassieee photos I see at least a RX, so there will probably be a marked TX too).
I'm still deciding whether to unscrew the device and destroy the warranty seal or just send the camera back (and hope that Amazon simply writes the device off as defective). 🙄

[roleoroleo]

Ok, let me know if you need help.
I'm sorry about that.

[pep4n]

@danielk117
This is the unbrick procedure for the older model:
https://github.com/roleoroleo/yi-hack-Allwinner/wiki/Unbrick-the-cam
I think it's pretty the same.
But you have to restore mtdblock4.
If you are able to connect the uart with a usb-serial adapter I can help you.

I think this happend because i have the first hack installed (with the modified lower_half_init.sh and so on).
Yes, I'm able to connect to uart (i own a TTL-interface and on @lassieee photos I see at least a RX, so there will probably be a marked TX too).
I'm still deciding whether to unscrew the device and destroy the warranty seal or just send the camera back (and hope that Amazon simply writes the device off as defective). 🙄

I would recommend to send it back as DOA.
Usually they don't check returns less than 40€.

@roleoroleo I will start helping to test as soon as my ordered microSDs will arrive. But from what I read so far sounds really promising! Thank you!!

[lassieee]

Memory:
free command is missing, I will add it in the next release.

Please check if rtsp stream is running and if the snapshot service works.
The 2 most complicated pieces.

I need some more time to test, but it's a busy day today.
tail is missing. adding it from a busybox:1.27.2 container doesn't work, i get the error "/tmp/sd/yi-hack/bin/tail: line 1: syntax error: unexpected "("" . how do you add these?
both rtsp stream and snapshot do not work.
after killing the wd_rtsp.sh scrint and runngin it manually: Failed to create RTSP server: bind() error (port number: 554): Address in use. It seems as if it keeps restarting.

i tried killing the wd_rtsp.sh script and running rRTSPServer in debug mode, and it seems I can connect with vlc player, but i have no image.

/tmp/mmap.info does not contain my serial number, at least not my SN that's on the box (this file does contain my DID though). I'll check later if i can find a file which has my SN in it.

[roleoroleo]

tail is missing. adding it from a busybox:1.27.2 container doesn't work, i get the error "/tmp/sd/yi-hack/bin/tail: line 1: syntax error: unexpected "("" . how do you add these?

There are 2 different busybox. The first one is the original bb and is on the read only rootfs partitions.
The second one (added by this project) is on the sd card and we can change it.
I will add tail.

both rtsp stream and snapshot do not work.
after killing the wd_rtsp.sh scrint and runngin it manually: Failed to create RTSP server: bind() error (port number: 554): Address in use. It seems as if it keeps restarting.

When you receive this message, wait 30 seconds and try again.

i tried killing the wd_rtsp.sh script and running rRTSPServer in debug mode, and it seems I can connect with vlc player, but i have no image.

Probably the problem is h264grabber. We need to study the framegrabber file.

/tmp/mmap.info does not contain my serial number, at least not my SN that's on the box (this file does contain my DID though). I'll check later if i can find a file which has my SN in it.

Ok.

[danielk117]

Ok, let me know if you need help.
I'm sorry about that.

No problem, I am aware of the risk that the camera could break. 😉

[roleoroleo]

https://github.com/roleoroleo/yi-hack-Allwinner-v2
Please contribute.

[RestOp]

Hello,

https://github.com/roleoroleo/yi-hack-Allwinner-v2
Please contribute.

Have i understood right, that we can already try to install new FW?
But on the link

i got old repository

So where could i find new FW?

[pep4n]

It's WIP and no release was built yet.

[roleoroleo]

The link https://github.com/roleoroleo/yi-hack-Allwinner-v2 is ok.
The readme is not updated.

At the moment the hack is not enough stable to create a release.

[roleoroleo]

Please, continue this thread here:
roleoroleo/yi-hack-Allwinner-v2#3

[lohacker84]

hi good morning I would need you to send me the firmware 9.0.19.02_202007141512 as since I updated to the firmware New y21ga_9.0.19.12_202102241808 everything is blurry at night. I hope you can help me because this really does not look good

[Jaragar]

Hello, New YI Home 1080P AI+ BFUSY44GEE with FW 9.0.19.02_202007141512 I just got this cam https://www.amazon.es/gp/product/B01MR82NFZ On the back side of Cam is BFUSY44GEE. Date on box 2020.09 I made a backup of FW. Here it is: https://drive.google.com/drive/folders/1ifFIDG4G0v-aIKrE_4kcy3elXd5Bsae3 Can not understand if it is supported or not. Could you please look and say if I need to send it back to amazon?

Thanks a lot!
Hi could you send me a copy of the full firmware I would like to do some work with it and see if I can use it to create a new hack.
[email protected]