No programmer, No UART, No problem! #2

guino · 2020-12-05T06:03:51Z

(Side comment you can skip -- Based on the interest in this project I went ahead and spent some more time (a lot actually) in ghidra looking at the boot loader code and managed to get the ppsMmcTool.txt file format figured out and found a way to use it to modify the boot settings in order to run a script in the SD card during boot process of the camera)

I assume the steps below can be used for any device using this PPStrong boot loader (Tuya cameras/doorbells like Geeni, Merkury, Bazz, Meari, etc).

Please check your device firmware version in the phone App OR with http://admin:[email protected]/devices/deviceinfo .

For 2.7.x firmware you should use the information on this project instead: https://github.com/guino/Merkury720

Special note for 2.9.0 firmware: this firmware is a bit trickier to get RTSP working (mjpeg/snap work the same), so if you have that version you need to use #13 along with the files/steps provided by @DanTLehman here: https://github.com/DanTLehman/orion_sc008ha

For 2.9.x you should be able to use the steps here or in #13 (either method should work).

Special note for 2.10.0 firmwae: This firmware (and newer) have port 80 closed by default -- so to use the http://admin:05656... links below you have to RIGHT CLICK this link: https://github.com/guino/Merkury720/raw/main/ppsFactoryTool.txt select "Save as.." and save this file to the root of the SD card. EDIT the file (avoid copy/paste the contents of it) and modify only the ssid and password as the file requires specific format to work. When the device detects the file (in the right format) it will disconnect and re-connect the wifi (to the ssid specified) and will OPEN port 80 so the http://admin:05656... links work.

Special note for 4.0.x firmwae: This firmware (and newer) have port 80 closed by default -- so to use the http://admin:05656... links below you have to RIGHT CLICK this link: https://github.com/guino/Merkury720/raw/main/ppsFactoryTool.txt select "Save as.." and save this file to the root of the SD card. EDIT the file (avoid copy/paste the contents of it) and modify only the ssid and password as the file requires specific format to work. When the device detects the file (in the right format) it will disconnect and re-connect the wifi (to the ssid specified) and will OPEN port 8090 so the http://admin:05656... links work but you have to add :8090 to every URL, for instance: http://admin:[email protected]:8090/devices/deviceinfo. Depending on the device you have you may need to use the information and files from https://github.com/guino/Merkury1080P#conclusion

WARNING: The process below will require a SD card with initrun.sh to always be present during power-on or the device WILL NOT BOOT. If you modify/remove this file the device may not boot. The process is always reversible but keep that in mind. You may choose to use #13 as it does not require a SD card to boot the device (it is a new/improved method).

These are the steps to hack (root) your device:

1-Verify your camera/doorbell is compatible using its local IP address (i.e. 192.168.x.x, etc) -- this is NOT the public IP displayed in the TUYA app (and likely other apps), if you're reading this there's a good chance you know how to find the IP from your router. Open a web browser and load this address: http://admin:[email protected]/proc/cmdline the result (kernel command line) should be something like this:

mem=36 console=ttyAMA0,115200n8 mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=5 ppsWatchInitEnd

Copy/save that response (kernel command line) as we'll need it next (and also in case you want to restore original settings) -- If you get no response, or some very different response, please stop now -- chances are you're using the wrong IP or this won't work for your device (advanced users can still check/try #11 and #12) . Feel free to post your kernel command line if you have questions.

1.1 ADDENDUM-I highly recommend you get a backup of your flash memory using #11 -- there's no risk or side-effect from trying. It's better to have a backup and not need it than needing the backup and not having it.

1.2 ADDENDUM-Open this URL http://admin:056565099@ip/proc/self/root/etc/init.d/S90PPStrong and check if you have these lines:

# debug
#MTDNUM=5

If your MTDNUM line does not have a # in front you must use #13. If your line has # in front or you don't have that line, you can proceed with the steps below.

2-Edit the provided 'env' so it has the below contents (following details below):

bootargs=mem=36 console=ttyAMA0,115200n8 mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=0 ppsWatchInitEnd ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,T

VERY IMPORTANT DETAILS ABOUT THIS FILE:
-The part after bootargs= should be the same as you got on step 1 (from your device) with the ppsAppParts=0 (instead of ppsAppParts=5).
-The file has one single line "bootargs=..." and a new line (enter) at the end. It is a long line (on purpose) so it may show up as multiple lines in a browser so please account for it. A sample env file is attached for your conveninence.
-The single line MUST have the same exact size as I posted above (924 characters + new line). Your kernel command line may be different which may require you to adjust (remove or add) to the ThankYou... text so that you match the size of the line.
-There's a 0x00 (Zero character) at the end of the file -- if this is removed by your text editor (ie notepad, etc) you'll need to be sure it is there (or the process will not work). You may need to use a hex editor to change the last character to a "00" making sure there's at least a new line (0A) at the end of the line before the "00". Again the sample env file is a good reference.

3-Copy these 3 files (attached) to the root of a fat32 formatted SD card (do not place them in any 'folders'): env, ppsMmcTool.txt and initrun.sh -- MAKE SURE there's no 'upgrade.bin' file in the SD card or this could cause problems. Be sure to properly 'eject' (or unmount) the SD card before removing it from the computer.

4-Power off your device and insert the SD card with the 3 files in the SD card slot.

5-Press-and-hold the reset button, then power on the device (i.e. power wires/USB cable) and continue holding the reset button for 5 seconds after power on then let the device boot. It will take longer than usual (precisely 10 seconds longer) for it to fully boot up as that's part of the initial boot script.

6-Repeat step 1, this time your kernel command line should look like this:

mem=36 console=ttyAMA0,115200n8 mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=0 ppsWatchInitEnd ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,T mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppPart

(Notice how the 'ppsAppPart' is cut off at the end -- that's the intention and as long as it doesn't say ppsAppParts=n it should work)

7-Now browse to this address: http://admin:[email protected]/proc/self/root/tmp/hack -- it should say "done" which is the indication everything is working as designed.

8-You can now delete ppsMmcTool.txt and env files from the SD card but there's no harm leaving them there. You MUST always have initrun.sh in the SD card during boot or the device WILL NOT BOOT.

9-Download the mmc files and place them in the SD card (root directory). SEPARATELY download busybox from https://github.com/guino/BazzDoorbell/blob/master/mmc/busybox?raw=true and place it on the SD card (root directory). Your SD card should look like this:

drwxr-xr-x    2 wagner   root          8192 Dec 31  1979 bin
drwxr-xr-x    2 wagner   root          8192 Dec 31  1979 lib
-rwxr-xr-x    1 wagner   root           263 Jan 27 11:29 set
-rwxr-xr-x    1 wagner   root          7956 Jan 15 16:47 jpeg-arm
drwxr-xr-x    8 wagner   root          8192 Dec 31  1979 home
-rwxr-xr-x    1 wagner   root           102 Dec  4 15:31 ppsMmcTool.txt
-rwxr-xr-x    1 wagner   root           927 Dec  4 18:00 env
-rwxr-xr-x    1 wagner   root          1115 Dec  5 00:15 initrun.sh
-rwxr-xr-x    1 wagner   root            40 Nov 24 15:28 passwd
-rwxr-xr-x    1 wagner   root       1152216 Nov 23 18:50 busybox
drwxr-xr-x    2 wagner   root          8192 Jan 14 23:13 cgi-bin
-rwxr-xr-x    1 wagner   root          1327 Nov 24 00:28 index.html
-rwxr-xr-x    1 wagner   root            18 Nov 24 00:22 httpd.conf
-rwxr-xr-x    1 wagner   root           539 Dec  2 16:46 custom.sh
drwxr-xr-x    3 wagner   root          8192 Aug 30 12:10 SDT

NOTES:

SDT is created by the device. home, lib and bin are created by the hack once it is installed.
busybox should have 1152216 bytes (download link listed above)
for telnet access either set the password hash in passwd file (get a hash here usin the calculate 'DES' button and copy the value) OR add -l /bin/sh to the telnetd line in custom.sh
enter a user:password in httpd.conf -- these are plain text values (no hashes).
for mjpeg/snap.cgi support you have to adjust the address for JPEG address in snap.cgi and mjpeg.cgi as posted with your ppsapp patch (or found with ghidra) -- this should work even if you don't patch ppsapp (on step below). The URL should be like this: http://user:password@IP:8080/cgi-bin/snap.cgi (with user:password from httpd.conf)

IMPORTANT: The main application on the device will delete the SD card contents when free space is low so backup your files and either disable recording OR let it run the provided cleanup.cgi to prevent your files from being deleted. The last 5 lines of the custom.sh file will run cleanup.cgi once-a-day by default. You can remove the last 5 lines of custom.sh if you don't want that to run OR you can disable recording entirely by removing the # from the #/mnt/mmc01/set record_enable 0 in custom.sh. If your device/app doesn't have a motion-only recording (event recording) option you can enable it by removing the # from the line #/mnt/mmc01/set enable_event_record 1 in custom.sh — there are more details here: #2 (comment)

10-For RTSP: DO NOT run a different version of ppsapp on your device or you may brick it. Your original ppsapp can be found under /home/app/ppsapp of the SD card. Please check guino/ppsapp-rtsp#1 to see if your ppsapp has already been patched -- use the site in the first post of the link to patch your own ppsapp file (double check that the md5 matches when patching it) and place it on the root of your SD card with the name ppsapp then reboot. There's a full guide on https://github.com/guino/ppsapp-rtsp if you're computer savvy and want to try patching ppsapp yourself. I prefer that you post (create a new issue) your ppsapp (along with http://admin:[email protected]/devices/deviceinfo information) so I patch it than get your flash corrupted by using a corrupt/wrong ppsapp.

NOTE 1: It has also been reported that VLC for MAC has issues playing the RTSP streams from these devices (so try different devices/applications if you have issues with VLC on MAC).
NOTE 2: It has also been reported that the default VLC playback is over UDP and causes the camera to use a lot of CPU/resources and causes it to reboot in about 13 minutes of viewing the RTSP feed. You can fix this by starting VLC like this:

vlc --rtsp-tcp rtsp://ip:8554

OR you can go into VLC settings and selecting RTP over RTSP (TCP) : in 'Simple' mode click 'Tools > Preferences > Input / Codecs and select 'RTP over RTSP (TCP)' at the bottom, them click 'Save'. In 'Advanced' mode click 'Tools > Preferences > Input / Codecs > Demuxers > RTP/RTSP and select 'RTP over RTSP (TCP)' then click 'Save'

TROUBLESHOOTING / RESTORE

If you wish to 'restore' the operation of your camera with SD card (remove the 'hack'):

1-Edit/create the env file to be this:

bootargs=mem=36 console=ttyAMA0,115200n8

NOTE: You should match the mem and console parameters as they were originally (step 1 of install process) and the env file must also have the new line (0x0A) and 0x00 (Zero character) at the end.

2-Copy ppsMmcTool.txt and env to the root of SD card (initrun.sh is NOT needed).

3-Follow steps 4, 5 and 6 of the install process, on step 6 the kernel command line should look like it was originally (before any changes).

If for some reason you can't get the the initrun.sh script to run please post a copy of your env file (zip format so I can verify it) and your kernel command line (before and after install attempt) so I can take a look.

If you'd like to buy me a beer/coffee in appreciation of the effort I put in to make the above possible, feel free to:
http://paypal.me/wbbo
cash app: $wbbo

Enjoy!

ppshack.zip

The text was updated successfully, but these errors were encountered:

solidssss · 2020-12-05T09:49:38Z

Thank you so much for sharing this!
At step 6 I'm getting the same text as in step 1. Not sure what I'm doing wrong.
This is what I'm getting from step 1:
mem=64M console=ttySAK0,115200n8 mtdparts=spi0.0:256k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,2496k(sys),4608k(app),640k(cfg) ppsAppParts=5 ip=192.168.1.xx:::255.255.255.0 eth=xx:xx:xx:xx:xx:xx

Could you please take a look at my env file? Here it is
ppsMmcTool.txt and initrun.sh is also on the root of the sd card. I noticed that a folder called SDT with files is also created when I boot the camera.
I got a Nedis camera (WIFICI20CGY)

rkkoszewski · 2020-12-05T10:46:30Z

@solidssss That basically means that it did not work for you.

I was just trying it out on my Nedis camera (Also Tuya) with the same result. The ppsMmcTool.txt way has eider been patched out or the different cameras are using a different format.

I'll try to hook up my reader to the UART port to see if it shows some kind of error.

Just for notes, my cmdline is similar to yours but still different:
mem=23M ethphy=3#3 console=ttyAMA0,115200 loglevel=0 ppsdebug=off mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg),2240k(sys),5m(app),448k(cfg) ppsAppParts=5 ip=192.168.1.10:::255.255.255.0 eth=xx:xx:xx:xx:xx:xx

LouDnl · 2020-12-05T12:01:16Z

Great effort 👌🏻👌🏻👍🏻👍🏻

jandy123 · 2020-12-05T12:08:26Z

My cmd line is same as @guino, just instead of mem=36 I have mem=37M. Please notice the additional "M". Could this be your problem @rkkoszewski, @solidssss ? I will also try, but have to find a uSD card.

Btw., which fw do you guys have on your cams ?

adwiraguna · 2020-12-05T12:17:51Z

can you please hack my ppsapp?
my camera is Bullet 4S, firmware version 2.9.7
thanks.

ppsapp

jandy123 · 2020-12-05T13:11:49Z

I can confirm, it works here too ! Great !
Thanks @guino.

Edit: Btw. I have fw version 2.9.6. Still my ppsapp is different in size than the one uploaded by @guino. Time to fire up ghidra...

solidssss · 2020-12-05T13:23:01Z

My cmd line is same as @guino, just instead of mem=36 I have mem=37M. Please notice the additional "M". Could this be your problem @rkkoszewski, @solidssss ? I will also try, but have to find a uSD card.

Btw., which fw do you guys have on your cams ?

I tried without the "M", but it still isn't working.
Here is some info of the device:
{"devname":"Smart Home Camera","model":"Speed 4C","serialno":"xxxxxxxxx","softwareversion":"2.7.4","hardwareversion":"S4C_A1_V10_1245","firmwareversion":"ppstrong-a2-tuya2_teco-2.7.4.20191111"

LouDnl · 2020-12-05T15:06:00Z

@guino would it be possible for you to send me the dump of your flash chip? It seems that my readout is corrupted in the part before u-boot which contains the magic part. This is due to my clip not being stable enough. I've removed the chip from the board and get stable readouts now.

guino · 2020-12-05T18:10:15Z

Thank you so much for sharing this!
At step 6 I'm getting the same text as in step 1. Not sure what I'm doing wrong.
This is what I'm getting from step 1:
mem=64M console=ttySAK0,115200n8 mtdparts=spi0.0:256k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,2496k(sys),4608k(app),640k(cfg) ppsAppParts=5 ip=192.168.1.xx:::255.255.255.0 eth=xx:xx:xx:xx:xx:xx

Could you please take a look at my env file? Here it is
ppsMmcTool.txt and initrun.sh is also on the root of the sd card. I noticed that a folder called SDT with files is also created when I boot the camera.
I got a Nedis camera (WIFICI20CGY)

@solidssss I sent a request to access the file in google, I'll wait for access or you can just attach the env file here. But I'll tell you right now that if the line didn't change at all, it can only be:
-You didn't hold reset while powering on the device (it can be hard)
OR
-The env file was not correct
OR
-Your firmware may be too different for it to work -- please provide the information from http://admin:056565099@IP/devices/deviceinfo when you can.

guino · 2020-12-05T18:14:04Z

ppsAppParts=5

@rkkoszewski I would expect any device that has that ppsAppParts=5 to work, but I only have looked at 2 firmware files so I have no way of knowing. If you have a UART/TTL 3.3V and can get to the serial terminal it may be helpful if you send me the terminal output while you're powering it on with the reset button pressed (with the 3 files in place). Chances are it will show whatever it is not liking. You can also post the http://admin:056565099@IP/devices/deviceinfo so I have an idea.

guino · 2020-12-05T18:17:33Z

My cmd line is same as @guino, just instead of mem=36 I have mem=37M. Please notice the additional "M". Could this be your problem @rkkoszewski, @solidssss ? I will also try, but have to find a uSD card.

Btw., which fw do you guys have on your cams ?

Mine is 2.9.6 if I didn't post it before.

guino · 2020-12-05T18:19:24Z

can you please hack my ppsapp?
my camera is Bullet 4S, firmware version 2.9.7
thanks.

ppsapp

I will take a look today.

guino · 2020-12-05T18:20:38Z

I can confirm, it works here too ! Great !
Thanks @guino.

Edit: Btw. I have fw version 2.9.6. Still my ppsapp is different in size than the one uploaded by @guino. Time to fire up ghidra...

It takes me 5 mins if you zip/post it here...

guino · 2020-12-05T18:23:42Z

My cmd line is same as @guino, just instead of mem=36 I have mem=37M. Please notice the additional "M". Could this be your problem @rkkoszewski, @solidssss ? I will also try, but have to find a uSD card.
Btw., which fw do you guys have on your cams ?

I tried without the "M", but it still isn't working.
Here is some info of the device:
{"devname":"Smart Home Camera","model":"Speed 4C","serialno":"xxxxxxxxx","softwareversion":"2.7.4","hardwareversion":"S4C_A1_V10_1245","firmwareversion":"ppstrong-a2-tuya2_teco-2.7.4.20191111"

This looks like older firmware which should be simpler to get into, I'm going to send you a few links to see if you can provide more information. It is possible your booloader may not even have a password in which case the UART route could be an easy option.

solidssss · 2020-12-05T18:27:00Z

@guino
I'm sure that I pressed and held the reset button during power on, I can feel it clicking.
You should be able to access the env file from google drive now.
Here's some info from my device:
{"devname":"Smart Home Camera","model":"Speed 4C","serialno":"xxxxxxxxx","softwareversion":"2.7.4","hardwareversion":"S4C_A1_V10_1245","firmwareversion":"ppstrong-a2-tuya2_teco-2.7.4.20191111"

guino · 2020-12-05T18:28:52Z

@guino would it be possible for you to send me the dump of your flash chip? It seems that my readout is corrupted in the part before u-boot which contains the magic part. This is due to my clip not being stable enough. I've removed the chip from the board and get stable readouts now.

I will zero my cfg partition and post it since the fw.bin has serial/key info which could cause problems if passed around. Or you can provide me a way to send it privately (email, url, etc).

LouDnl · 2020-12-05T18:52:17Z

@guino would it be possible for you to send me the dump of your flash chip? It seems that my readout is corrupted in the part before u-boot which contains the magic part. This is due to my clip not being stable enough. I've removed the chip from the board and get stable readouts now.

I will zero my cfg partition and post it since the fw.bin has serial/key info which could cause problems if passed around. Or you can provide me a way to send it privately (email, url, etc).

Do you have discord? LouD#4930

guino · 2020-12-05T19:07:06Z

can you please hack my ppsapp?
my camera is Bullet 4S, firmware version 2.9.7
thanks.

ppsapp

@adwiraguna Here's the patched ppsapp to enable RTSP:
--deleted/not working--

guino · 2020-12-05T19:29:57Z

Do you have discord? LouD#4930

@LouDnl Sorry don't have discord, I barely have skype/whatsapp. Here's my bin file with the enc and cfg partitions zeroed out:
public-bazz-2.9.6.zip

If your enc and cfg partitions are the same size (or smaller than mine) I would expect you could just copy them into this bin file and flash it to your device. All enc partitions I've seen are 64k and if your cfg partition is bigger there's a good chance most of it is empty which would allow you to just copy the used part into the bin file. Something to try at least.

LouDnl · 2020-12-05T19:49:50Z

Do you have discord? LouD#4930

@LouDnl Sorry don't have discord, I barely have skype/whatsapp. Here's my bin file with the enc and cfg partitions zeroed out:
public-bazz-2.9.6.zip

If your enc and cfg partitions are the same size (or smaller than mine) I would expect you could just copy them into this bin file and flash it to your device. All enc partitions I've seen are 64k and if your cfg partition is bigger there's a good chance most of it is empty which would allow you to just copy the used part into the bin file. Something to try at least.

Thanks, both my partitions seem in tact. Will try 👍🏻👍🏻

guino · 2020-12-05T20:06:02Z

@solidssss your env file appears to be fine. Can you open this http://admin:056565099@IP/proc/self/root/etc/init.d/S90PPStrong and post the response here -- it seems like the bootloader is different (older) and that may be causing the difference. Only way for me to find out would be if you connected onto the UART and provided the output while doing step 5 of the install. If you have a way to plug into the UART email me and we can try a few things.

LouDnl · 2020-12-05T21:40:22Z

Well I think I indeed completely bricked my camera 💸 the led doesn't even come on anymore. Everything gets power but thats about it. This happened before I took off the chip from the pcb when I turned it on but forgot to take off the pcb clip 🤦🏻‍♂️ some power must have gone somewhere it shouldnt have.

Gonna check my uart wiring tomorrow because they have power at the pcb. I hope thats it but I dont think so as the led wont even light up.

But as this is really searching for a needle in a haystack I might aswell buy a new one.

guino · 2020-12-05T21:55:23Z

@LouDnl sorry to hear that - I am assuming you saw my warning about making the 3.3v mod to the programmer. On the UART front I always connect GND, TX and RX (leave power disconnected) and power the camera by normal means (usb or doorbell wiring) - again UART ttl level is 3.3v
I also have noticed that when reading/writing the flash (with pin 6 disconnected) the light on the device would faintly turn on, but I limited connection of the clip to when I needed it.

LouDnl · 2020-12-05T23:17:47Z

@LouDnl sorry to hear that - I am assuming you saw my warning about making the 3.3v mod to the programmer. On the UART front I always connect GND, TX and RX (leave power disconnected) and power the camera by normal means (usb or doorbell wiring) - again UART ttl level is 3.3v
I also have noticed that when reading/writing the flash (with pin 6 disconnected) the light on the device would faintly turn on, but I limited connection of the clip to when I needed it.

Yea my uart vcc isnt connected either, I meant the rx/tx have power from the chip like they should but something else isnt working. I didn't mod my ch341a board, havent had any problems in the past but I should have been more carefull. All other times I took the clip straight off, if it even stayed on as they usually dont. But this time it did and I forgot about it when I turned it on. So something backfired and I dont know what.

adwiraguna · 2020-12-06T03:07:28Z

can you please hack my ppsapp?
my camera is Bullet 4S, firmware version 2.9.7
thanks.
ppsapp

@adwiraguna Here's the patched ppsapp to enable RTSP:
--deleted not working--

thank you very much @guino, but different from your original ppsapp-rtsp it doesn't open rtsp stream on port 8554.

guino · 2020-12-06T03:28:35Z

can you please hack my ppsapp?
my camera is Bullet 4S, firmware version 2.9.7
thanks.
ppsapp

@adwiraguna Here's the patched ppsapp to enable RTSP:
--deleted not working--

thank you very much @guino, but different from your original ppsapp-rtsp it doesn't open rtsp stream on port 8554.

I will run it on mine and see what the log shows - if you enabled Telnet on yours you should be able to kill the running ppsapp and run this one from the terminal and see it it starts rtsp on a different port or if it shows an error.

adwiraguna · 2020-12-06T03:33:29Z

can you please hack my ppsapp?
my camera is Bullet 4S, firmware version 2.9.7
thanks.
ppsapp

@adwiraguna Here's the patched ppsapp to enable RTSP:
--deleted not working--

thank you very much @guino, but different from your original ppsapp-rtsp it doesn't open rtsp stream on port 8554.

I will run it on mine and see what the log shows - if you enabled Telnet on yours you should be able to kill the running ppsapp and run this one from the terminal and see it it starts rtsp on a different port or if it shows an error.

I'm having trouble login to telnet, because I don't know the correct hash to use in passwd file

guino · 2020-12-06T04:01:13Z

I'm having trouble login to telnet, because I don't know the correct hash to use in passwd file

Do a passwordless telnet , just run telnetd like this:

/mnt/mmc01/busybox tenetd -l /bin/sh

savas20041 · 2022-07-16T10:45:33Z

Hello, can you please help me, I can't get any further. I have this model.

This comes out when I enter this url http://admin:[email protected]/proc/cmdline

console=/dev/null LX_MEM=0x3fe0000 mma_heap=mma_heap_name0,miu=0,sz=0x1d00000 pcbversion=B3S_S1_V10 sensor=gc2063mipi

What should I do next? My English isn't that good either.

samezrp · 2022-11-26T21:41:20Z

I have problem with accessing:

/proc/cmdline

after boot with initrun.sh.
Normally it runs on port 80 (strange as according to your description it should be 8090 and 80 is supposed to be closed). Anyway I have all data available. After running it with env and initrun.sh there is no answer on 80 nor 8090 port.

My camera details:

devname "Smart Home Camera" model "Bell 8S" softwareversion "2.10.5" hardwareversion "BE8S_H1_V10_433" firmwareversion "ppstrong-c51-tuya2_lcs-2.10.5.20210806"
Funniest thing is that mjpeg, snap are working, I have access via 8080, telnet is ok but when I try to run any command it reroutes me to https and no result.
I can run VLC and rtsp, but on shinobi there is no access.

[edit]
I have found solution for below question on another topics, so I'm currently reading them.
"Another question is how to run mqtt? On mmc I can see shortcut similar to busybox, but I cannot find any mqtt_pub executable to download."

alcomys · 2024-04-10T22:57:25Z

I really like the time you spend to make this happen, but the manual along this site i one big mess.
where do i have to start in here?
how do i become that ppsapp file? do i have to read the memory chip on my doorbell?
i cannot find how to start this procedure for my doorbell.
Maybe it has to do with my Autism but I'm an electronics freak, so I'm not an complete noob.

Thanks guys

guino · 2024-04-15T16:40:16Z

@alcomys can you post a picture of your device and check the version of the firmware using the phone app ? You can usually check the firmware version by clicking on the 'device update' option in the settings of the camera. I can point you to the instructions based on the version. If you know the model of the doorbell that may help as well.

Jak12-3 · 2024-05-01T00:54:35Z

Absolutely love the amount of effort you've put into documenting this!!

alcomys · 2024-09-22T14:56:04Z

Just to let you know:

Last night i enabled (busybox) telnet on the doorbell, edited the /home/cfg/tuya_config.json to set "onvif_enable" to 1, rebooted the camera and the streams are working on rtsp://admin:admin@IPADDRESS:8554/Streaming/Channels/101 and /102. And the doorbell is still connected to the Tuya Cloud (using the LSC App).

Running the original firmware on the Doorbell of Action NL:
"devname":"Smart Home Camera"
"model":"Bell 8S"
"softwareversion":"2.9.7"
"hardwareversion":"BE8S_H1_V10_433"
"firmwareversion":"ppstrong-c51-tuya2_lcs-2.9.7.20201020"
So i didn't need to use any patched ppsapp. The rtsp stream is connected to Zoneminder for almost 24 hours now. Also repeated this sequence on another doorbell with 2.9.7. That one is also working.

@RGlintmeijer
Can you tell me the exact steps you did to get it work?
I became crazy at all the different steps and links to other steps.
My version is the same as yours but i can't get the rtsp to work.
You told that you edited the tuya_config.json, I did that too but no results, did i miss some steps?
Also it is not clear is if need the ppsapp to the root of the SD and if or have to change the #/mnt/mmc01/set onvif_enable 1 to /mnt/mmc01/set onvif_enable 1, It looks like this step has the same function to enable ONVIF. I did try both the options but no result.

Maybe you can point me to the right direction? because i got mad and confused.

Thanks

guino · 2024-10-01T16:33:42Z

@alcomys feel free to post a zip (on github issue) of your SD card contents (without SDT folder) for review.

This was referenced Dec 5, 2020

Security Cameras? AMoo-Miki/homebridge-tuya-lan#4

Open

ppsMmcTool.txt DeltaTangoLima/orion_sc008ha#1

Closed

AvgAlice mentioned this issue Apr 26, 2022

Issues with rooting Mini 11S guino/Merkury1080P#29

Closed

guino mentioned this issue Jul 21, 2022

Hello, can you please help me, I can't get any further. I have this model. #80

Open

guino mentioned this issue Aug 5, 2022

patch request Action LSC Smart Connect video-deurbel guino/ppsapp-rtsp#41

Open

wangxiaoming1986 mentioned this issue Aug 22, 2022

Damn, I bricked my camera! guino/Merkury1080P#36

Open

guino mentioned this issue Sep 12, 2022

Help needed to patch 2.10.6 guino/Merkury720#28

Open

LucaNeel mentioned this issue Sep 18, 2022

Cannot get Bullet 4S to work with hack guino/Merkury1080P#40

Closed

guino mentioned this issue Sep 21, 2022

Merkury Mi-CW017 help guino/Merkury1080P#41

Open

guino mentioned this issue Oct 8, 2022

Patch request - Feit Electric Smart Indoor Camera, FW 4.0.8 guino/ppsapp-rtsp#46

Open

sinclairfr mentioned this issue Oct 24, 2022

Lost RTSP stream, still can access the telnet #89

Closed

guino mentioned this issue Dec 1, 2022

I have problem with accessing /proc/cmdline #92

Open

guino mentioned this issue Dec 8, 2022

Integrating Onvif (ie Home Assistant) #8

Open

DeltaTangoLima mentioned this issue Jan 5, 2023

Help with the README.md DeltaTangoLima/orion_sc008ha#4

Closed

WeterPeter mentioned this issue Mar 1, 2023

Stuck at step #6 - SOLVED! #41

Open

johan-van-marion mentioned this issue Mar 2, 2023

ppsapp patch request for LSC smart video doorbell 5.2.2 (ppstrong-a3-tuya2_general-5.2.2.20210914) #85

Open

hubaksis mentioned this issue Mar 5, 2023

RTSP stops working without access to the Internet. guino/LSC1080P#3

Open

mascencerro mentioned this issue Mar 14, 2023

Merkury720P 2.7.10 firmware rooting struggle guino/Merkury720#29

Closed

This was referenced May 13, 2023

no stream, no telnet need a little help #105

Open

Merkury 1080P (MIC-CW017-101W) - Firmware Version 4.0.7 - Patch Request guino/Merkury1080P#39

Open

guino mentioned this issue Jun 14, 2024

Tuya V33.50.82 #119

Open

Repository owner deleted a comment from Rols38 Jun 14, 2024

guino mentioned this issue Jun 20, 2024

JPEG Address question #121

Open

Repository owner deleted a comment from Shadowws326 Jun 20, 2024

guino mentioned this issue Oct 1, 2024

After the new method of installing the hack my doorbell reboots at it self #124

Open

No programmer, No UART, No problem! #2

No programmer, No UART, No problem! #2

Comments

guino commented Dec 5, 2020 • edited Loading

TROUBLESHOOTING / RESTORE

solidssss commented Dec 5, 2020 • edited Loading

rkkoszewski commented Dec 5, 2020

LouDnl commented Dec 5, 2020

jandy123 commented Dec 5, 2020

adwiraguna commented Dec 5, 2020

jandy123 commented Dec 5, 2020 • edited Loading

solidssss commented Dec 5, 2020

LouDnl commented Dec 5, 2020

guino commented Dec 5, 2020 • edited Loading

guino commented Dec 5, 2020 • edited Loading

guino commented Dec 5, 2020 • edited Loading

guino commented Dec 5, 2020

guino commented Dec 5, 2020

guino commented Dec 5, 2020

solidssss commented Dec 5, 2020

guino commented Dec 5, 2020

LouDnl commented Dec 5, 2020

guino commented Dec 5, 2020 • edited Loading

guino commented Dec 5, 2020

LouDnl commented Dec 5, 2020

guino commented Dec 5, 2020

LouDnl commented Dec 5, 2020

guino commented Dec 5, 2020 • edited Loading

LouDnl commented Dec 5, 2020

adwiraguna commented Dec 6, 2020 • edited by guino Loading

guino commented Dec 6, 2020 • edited Loading

adwiraguna commented Dec 6, 2020 • edited by guino Loading

guino commented Dec 6, 2020

savas20041 commented Jul 16, 2022

samezrp commented Nov 26, 2022 • edited Loading

alcomys commented Apr 10, 2024

guino commented Apr 15, 2024

Jak12-3 commented May 1, 2024

alcomys commented Sep 22, 2024

guino commented Oct 1, 2024

guino commented Dec 5, 2020 •

edited

Loading

solidssss commented Dec 5, 2020 •

edited

Loading

jandy123 commented Dec 5, 2020 •

edited

Loading

guino commented Dec 5, 2020 •

edited

Loading

guino commented Dec 5, 2020 •

edited

Loading

guino commented Dec 5, 2020 •

edited

Loading

guino commented Dec 5, 2020 •

edited

Loading

guino commented Dec 5, 2020 •

edited

Loading

adwiraguna commented Dec 6, 2020 •

edited by guino

Loading

guino commented Dec 6, 2020 •

edited

Loading

adwiraguna commented Dec 6, 2020 •

edited by guino

Loading

samezrp commented Nov 26, 2022 •

edited

Loading