deltatangolima / orion_sc008ha Goto Github PK

Hi, im working on a similar project with a different tuya camera and came to about the same point that you are. Do you have Discord so we can chat maybe?

I have a similar camera with anyka uboot (password protected) and you can make uboot read ppsMmcTool preparing it with 'mkimage':

$ mkimage -A arm -O linux -T script -C none -n ppsMmcTool -a 0x42000000 -d inputFile ppsMmsTool.txt

I used 'script' as type above but it doesn't seem to be looking for a script, instead it seems to be directly executing the binary loaded at that address. The problem is that it can't be a very big code as it will only load around 4Kb of data, so it seems like a way for them to execute some code that uses the already loaded u-boot functions OR it self loads from mmc/network/etc.

Here's the output I got -- notice it doesn't show 'magic err' or 'shorter than offset + len' during that startup:

hisi-sdhci: 0
PPS:Mar 18 2020 19:07:17 meari_c5    0
button
cmd:fatload mmc 0 0x42000000 ppsMmcTool.txt 1020
reading ppsMmcTool.txt
4128 bytes read in 3 ms (1.3 MiB/s)
data abort
pc : [<43f7fbb8>]          lr : [<d3ed8f15>]
reloc pc : [<4080bbb8>]    lr : [<d0764f15>]
sp : 43f33da8  ip : 43fb095c     fp : 00000018
r10: 43f35dd8  r9 : 43f33ee0     r8 : 00000000
r7 : 00000000  r6 : 43f45c28     r5 : 43f35e60  r4 : 00000001
r3 : 43f35e40  r2 : 00000000     r1 : 00000428  r0 : 56190527
Flags: nzCv  IRQs off  FIQs off  Mode SVC_32
Resetting CPU ...

Obviously it is crashing the CPU because I only put in u-boot script commands (text) in the file hoping that it would load/execute the script, but doesn't seem to be the case.

I don't want to go writing code just to get access to this thing but I may invest in a hardware SPI reader (which I can use on this and other boards) to read/write the onboard flash chip directly to gain access, but I am still wondering if it's worth the effort.

Hello,
I was looking for some help following your tutorial. I can't identify where the files and folders you suggest.
I have the same model as mentioned in your github, but the directory generated by plugging in an SD card doesn't reflect your description.

Any help would be greatly appreciated.

Here is my boot from the SD card:
bcm2708-rpi-0-w.dtb config.txt LICENCE.broadcom
bcm2708-rpi-b.dtb COPYING.linux LICENSE.oracle
bcm2708-rpi-b-plus.dtb os_config.json
bcm2708-rpi-cm.dtb fixup_cd.dat overlays
bcm2709-rpi-2-b.dtb fixup.dat bcm2710-rpi-3-b.dtb
fixup_db.dat start_cd.elf bcm2710-rpi-3-b-plus.dtb fixup_x.dat start_db.elf
bcm2710-rpi-cm3.dtb issue.txt start.elf
bootcode.bin kernel7.img start_x.elf
cmdline.txt kernel.img 'System Volume Information'

And here is my nmap:
Completed NSE at 08:01, 0.15s elapsed
Initiating NSE at 08:01
Completed NSE at 08:01, 0.00s elapsed
Nmap scan report for 192.168.1.99
Host is up (0.0060s latency).
Not shown: 990 closed tcp ports (reset)
PORT STATE SERVICE VERSION
7676/tcp open upnp Samsung AllShare upnpd 1.0 (UPnP 1.1)
8001/tcp open nagios-nsca Nagios NSCA
8002/tcp open ssl/nagios-nsca Nagios NSCA
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=SmartViewSDK/organizationName=SmartViewSDK/countryName=KR
| Subject Alternative Name: IP Address:127.0.0.1
| Issuer: commonName=SmartViewSDK Root Ceritificate Authority/organizationName=SmartViewSDK/countryName=KR
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2016-09-21T08:36:31
| Not valid after: 2036-09-21T08:36:31
8080/tcp open http lighttpd
|_http-server-header: WebServer
|http-title: 404 - Not Found
| http-methods:
| Supported Methods: OPTIONS GET HEAD POST
9080/tcp open http Mongoose httpd
|http-title: Site doesn't have a title (application/json).
| http-methods:
| Supported Methods: GET HEAD POST OPTIONS
9999/tcp open abyss?
32768/tcp open nagios-nsca Nagios NSCA
32769/tcp open nagios-nsca Nagios NSCA
32770/tcp open nagios-nsca Nagios NSCA
32771/tcp open nagios-nsca Nagios NSCA
MAC Address: 68:27:37:0A:79:C0 (Samsung Electronics)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Uptime guess: 4.806 days (since Sat Dec 31 12:40:18 2022)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: All zeros
TRACEROUTE
HOP RTT ADDRESS
1 6.02 ms 192.168.1.99
NSE: Script Post-scanning.
Initiating NSE at 08:01
Completed NSE at 08:01, 0.00s elapsed
Initiating NSE at 08:01
Completed NSE at 08:01, 0.00s elapsed
Initiating NSE at 08:01
Completed NSE at 08:01, 0.00s elapsed
Read data files from: C:\Program Files (x86)\Nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 65.29 seconds
Raw packets sent: 1023 (45.806KB) | Rcvd: 1020 (41.598KB)

Thanks for your repo, it helped me a lot :)

I have a Meari BULLET4S, with same HiSilicon HI3518ERNCV300 board.
https://fccid.io/2AG7C-BULLET4S
https://fccid.io/2AG7C-BULLET4S/Internal-Photos/Internal-Photos-4652314

I also gave up cracking the meari_c5 root password and messing with ppsMmcTool.txt.
With $3 AliExpress CH341A programmer (with 3.3v modification) I managed to successfully extract the firmware.
Unfortunately with a SOP8 test clip it could not read it, I had to desolder the QH64AHIG chip from the pcb.
Probably I needed certain CS/RESET/HOLD pins set high/low according to the datasheet.
https://lcsc.com/product-detail/Others_XMC-XM25QH64AHIG_C328461.html
https://datasheet.lcsc.com/szlcsc/1811072025_XMC-XM25QH64AHIG_C328461.pdf
But I'll mess with this later, at least now I have a backup :)

I don't like the Tuya firmware and just want to access RTSP locally.
Most promising project I could find is OpenIPC.
https://openwrt.org/docs/techref/hardware/soc/soc.hisilicon.hi35xx
https://openipc.org/
http://alpha.openipc.org/firmware/
https://github.com/openipc
But it's only for Hi3518EV100/Hi3518EV200/Hi3516CV300/[..] not HI3518ERNCV300.

Datasheet specs for Hi3518EV200 and Hi3518EV300 are very different.
http://www.hisilicon.com/-/media/Hisilicon/pdf/Surveillance_mobilecam/Hi3518EV200.pdf
http://www.hisilicon.com/-/media/Hisilicon/pdf/Surveillance_mobilecam/Hi3518EV300.pdf

I see "Huawei LiteOS/Linux-4.9-based SDK" and found these Huawei/HiSilicon repositories.
But not sure if I can compile something useful from this.
https://github.com/OpenHarmony-mirror/vendor_hisi_hi35xx_hardware
https://github.com/OpenHarmony-mirror/vendor_hisi_hi35xx_hi35xx_init
https://github.com/OpenHarmony-mirror/vendor_hisi_hi35xx_hi3518ev300
https://github.com/OpenHarmony-mirror/vendor_hisi_hi35xx_hi3518ev300_uboot
https://github.com/OpenHarmony-mirror/vendor_hisi_hi35xx_middleware
https://github.com/OpenHarmony-mirror/vendor_hisi_hi35xx_middleware_source_third_party_ffmpeg
https://github.com/OpenHarmony-mirror/vendor_hisi_hi35xx_platform
https://github.com/OpenHarmony-mirror/vendor_hisi_hi35xx_thirdparty_uboot_src

Any ideas for other custom firmware or where to go from here?