Introduction #
So this will be part2 and this post will actualy be about modifying the firmware on the camera.
Preparing #
So now i will prpeare for the next stage which is uploading the custom firmware. Thingino supports flashing it from the sdcard and our camera’s U-boot has commands to read from an sdcard so i prerpared an sdcard. I formatted a random sdcard i had laying around to be FAT32. After that i inserted it into the camera. Then i ran ‘mmcinfo’ and my sdcarc gets detected!
isvp_t23# mmcinfo
Device: msc
Manufacturer ID: ac
OEM: 5759
Name: ASTCTran Speed: 50000000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 29.4 GiB
Bus Width: 1-bitLets continue to the next s5tep. I want to backup the firmware and i wil do that from within Linux. I will make a full flash backup so i can restore when i want to. Below are instructions for backing up the stock-firmware but if you dont care about that/dont need a copy of the stock firmware you can skipp it and Move to the flashing-thingino section
Backing up stock-firmware. #
So lets first change the bootargs to boot us into that low level shell. So interrupt u-boot like before and paste the command.
setenv bootargs 'console=ttyS1,115200n8 mem=39436K@0x0 rmem=25600K@0x2683000 init=/bin/sh rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(uboot),1792k(kernel),960k(rootfs),4800k(app),384k(config)'And after that enter ‘boot’ to bootup the system. Easy peasy!
So lets first run the commands that initialise and mount stuff. I put it in a nice copy-pasteable blob below.
Mount the required directories. #
mount -t tmpfs tmpfs /dev
mkdir -p /dev/pts
mkdir -p /dev/shm
mount -a
echo /sbin/mdev > /proc/sys/kernel/hotplug
/sbin/mdev -s && echo "mdev is ok......"And those few lines are all we need to be able to copy the raw partitions to the sdcard and to have the OS ready for basic copying of the stock fw.
Lets copy the firmware #
So now we can copy the firmware. Lets first look at the partitions a bit better. Because we will copy them directly from mtd we dont need to mount them anywhere.
Lets have a look at the partition table #
Lets first have a look at the mtd partitons. For this run: cat /proc/mtd. Which will result in the following list below.
~ # cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00008000 "uboot"
mtd1: 001c0000 00008000 "kernel"
mtd2: 000f0000 00008000 "rootfs"
mtd3: 004b0000 00008000 "app"
mtd4: 00060000 00008000 "config"And here we see our mtd partitions exactly as the kernel described and we saw apear previously.
Lets mount the sdcard #
So now we have to mount the sdcard. But wait, remember that we bypassed the normal initialisation process? That means it also did not get to load the kernel drivers needed for talking to the sdcard. We must load them manually but where are they? A lot of Linux based firmwares store them at the regular location which is in /lib/modules/{kernel_version}. But when we try to ’ls’ that directory it does not exist. But before we draw conclusions lets have a look and see if our sdcard already appears in /dev. Usually as: /dev/mmcblk0p{partition_number}.
~ # ls /dev
pts ptypd ram0
shm ptype ram1
mem ptypf ram2
kmem ttypa ram3
null ttypb ram4
zero ttypc ram5
full ttypd ram6
random ttype ram7
urandom ttypf ram8
ptyp0 ttyS1 ram9
ptyp1 i2c-0 loop0
ptyp2 i2c-1 loop1
ptyp3 mtd0 loop2
ptyp4 mtd0ro loop3
ptyp5 mtd1 loop4
ptyp6 mtd1ro loop5
ptyp7 mtd2 loop6
ptyp8 mtd2ro loop7
ptyp9 mtd3 ram10
ttyp0 mtd3ro ram11
ttyp1 mtd4 ram12
ttyp2 mtd4ro ram13
ttyp3 soc_vpu ram14
ttyp4 network_throughput ram15
ttyp5 network_latency mtdblock0
ttyp6 cpu_dma_latency mtdblock1
ttyp7 jz_adc_aux_0 mtdblock2
ttyp8 rmem root
ttyp9 log_main mtdblock3
tty ipu mtdblock4
console rfkill mmcblk0
ptmx bus mmcblk0p1
kmsg watchdog0 zram0
ptypa watchdog zram1
ptypb net
ptypc loop-controlAnd yeah it already is detected, so i think they baked the kernel modules for the sdcard into the kernel. Linux allows either embedding modules directly in the kernel or leave them as kernel modules to be loaded in at run time. Typically the linux menuconfig allows you to either press ‘y’ to build-in the module/driver or press ’m’ to build the driver as a module. SO lets try mounting the sdcard to an already existing folder in /mnt called ‘sdcard’
~ # ls /mnt
sdcard nfs
~ # ls /mnt/sdcard
~ # mount -t vfat /dev/mmcblk0p1 /mnt/sdcard
~ # ls /mnt/sdcard/
test.txtAnd i created a text file on the sdcard to verify we can see it mounted and it works!.
Lets use ‘dd’ command to copy over the partitions to files on the sdcard. #
Now we can use the ‘dd’ command that pretty much every embeded linux has built-in. ‘dd’ can be used to copy the contents of a device node (eg /dev/mtd0) to an output file (eg uboot.bin). So execute the commands below and you should have all partitions as their own named files on the sdcard and you have a firmware dump.
~ # cd /mnt/sdcard
/mnt/sdcard # dd if=/dev/mtd0 of=mtd0.bin
/mnt/sdcard # dd if=/dev/mtd1 of=mtd1.bin
/mnt/sdcard # dd if=/dev/mtd2 of=mtd2.bin
/mnt/sdcard # dd if=/dev/mtd3 of=mtd3.bin
/mnt/sdcard # dd if=/dev/mtd4 of=mtd4.binand below you can see how the proess looked.
~ # cd /mnt/sdcard
/mnt/sdcard # dd if=/dev/mtd0 of=mtd0.bin
512+0 records in
512+0 records out
262144 bytes (256.0KB) copied, 0.113742 seconds, 2.2MB/s
/mnt/sdcard # dd if=/dev/mtd1 of=mtd1.bin
3584+0 records in
3584+0 records out
1835008 bytes (1.8MB) copied, 0.802137 seconds, 2.2MB/s
/mnt/sdcard # dd if=/dev/mtd2 of=mtd2.bin
1920+0 records in
1920+0 records out
983040 bytes (960.0KB) copied, 0.433362 seconds, 2.2MB/s
/mnt/sdcard # dd if=/dev/mtd3 of=mtd3.bin
9600+0 records in
9600+0 records out
4915200 bytes (4.7MB) copied, 2.217146 seconds, 2.1MB/s
/mnt/sdcard # dd if=/dev/mtd4 of=mtd4.bin
768+0 records in
768+0 records out
393216 bytes (384.0KB) copied, 0.171345 seconds, 2.2MB/s
/mnt/sdcard # ls
mtd4.bin mtd3.bin mtd2.bin mtd1.bin mtd0.bin test.txtAnd that is it. Alternatively you can now name the files but i will keep it like this. Alos to assemble the firmware into 1 binary i use the ‘cat’ command to do so.
cat mtd0.bin mtd1.bin mtd2.bin mtd3.bin mtd4.bin > Full_firmware-dump.binAnd we should see its 8 megabytes which is our flash size!
/mnt/sdcard # ls -l Full_firmware-dump.bin
-rwxr-xr-x 1 root root 8388608 Jan 1 00:11 Full_firmware-dump.binSo now we have a copy of the stock-firmware and we can move on to flashing thingino-firmware. Because i did not setup the camera with the app and wifi, i dumped the full firmware dump on my CDN and this firmware is clean of any personal details (due to not setting itup in the app) so i can share it safely. You can download it by clicking This link, incase you need it.
Flashing thingino-firmware. #
SO lets flash the firmware now to free ourselves from the cloud and enahnce our camera’s privacy and to prevent it from being able to be bricked remotely. So first, what is thingino-firmware?
What is thingino-firmware? #
So thingino-firmware is a community powered project that aims to replace the stock-firmware on cameras powered by Ingenic SOC’s with a opensource privacy focussed 100% Local running firmware. The firmware makes use of ONVIF which is an open standard interface for IP cameras and other IP security products. It is combined with streaming protocols like RTSP (real-time streaming protocol). The firmware uses the ISVP platform and its tools/drivers but ofcourse the application binary/binaries running atop is opensource. Also Homeassistant supports it through onvif and you can add thingino-powered cameras in HA to your dashboard. Thingino-firmware website And as you can see there are a ton of supported cameras/cameras with their own modified version of it that fits the hardware.
Choosing the firmware that works for my camera. #
So we can see, there is obviously no mention of ‘Kruidvat indoor’ in the list, but i do think the hardware design could be similar to a name-brand one. We know it uses a T23 chip, Sc2336 camera cmos sensor and a Atbm6012(bx) wifi chip and has 8 Megabytes of flash. But i do see a model that looks very similar… The Sonoff Slim gen2.
So i think my Kruidvat indoor camera in reality is a rebranded Sonoff-slim-gen2. Lets try the firmware shall we? And its also an 8 Megabyte firmware file.
Actually flashing the firmware. #
So scroling around in the Github repository of the project we see a wiki. We also see that they provide a updater that automatically does the upgrading and flashing for us so lets try that. Navigate to This link. So just folow the instructions and lets see if it works. Flash this sd.img file to an sdcard and it will automatically create a fat32 sdcard with autoupdate-full.bin on it.
First attempt #
Lets try it and see if it works. Welp sadly it does not flash/accpet the firmware and moves on to booting its stock linux OS.
U-Boot SPL 2013.07 (Nov 18 2023 - 10:39:44)
Board info: T23N
apll_freq = 1188000000
mpll_freq = 1200000000
sdram init start
DDR clk rate 600000000
image entry point: 0x80100000
U-Boot 2013.07 (Nov 18 2023 - 10:39:44)
Board: ISVP (Ingenic XBurst T23 SoC)
DRAM: 64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 215k for U-Boot at: 83fc8000
Reserving 32784k for malloc() at: 81fc4000
Reserving 32 Bytes for Board Info at: 81fc3fe0
Reserving 124 Bytes for Global Data at: 81fc3f64
Reserving 128k for boot params() at: 81fa3f64
Stack Pointer at: 81fa3f48
Now running in RAM - U-Boot at: 83fc8000
MMC: msc: 0
the manufacturer 85
SF: Detected P25Q64H
In: serial
Out: serial
Err: serial
Net: ====>PHY not found!Jz4775-9161
Hit any key to stop autoboot: 0
the manufacturer 85
SF: Detected P25Q64H
--->probe spend 4 ms
otabakpaddr:0x0
malloc for update package [81fcaaa0]
Warning, file: 0:jzt23Nall.bin does not exist
Warning, file: 0:jzt23Nsd.bin does not exist
Warning, file: 0:jzt23Nota.bin does not exist
the manufacturer 85
SF: Detected P25Q64H
--->probe spend 4 ms
SF: 1835008 bytes @ 0x40000 Read: OK
--->read spend 591 ms
## Booting kernel from Legacy Image at 80600000 ...
Image Name: Linux-3.10.14__isvp_pike_1.0__
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1589036 Bytes = 1.5 MiB
Load Address: 80010000
Entry Point: 803c9f70
Verifying Checksum ... OK
Uncompressing Kernel Image ... OKWe do see that it mentions some specific update files so lets give that a try.
Warning, file: 0:jzt23Nall.bin does not exist
Warning, file: 0:jzt23Nsd.bin does not exist
Warning, file: 0:jzt23Nota.bin does not exist2nd attempt #
So i renamed the binary i downloaded from thingino-website to: jzt23Nall.bin, lets give it a try. Welp sadly still fails. I think it requires a signed firmware sadly.
--->probe spend 4 ms
otabakpaddr:0x0
malloc for update package [81fcaaa0]
open file jzt23Nall.bin success! start read data!
data read ok, size: 8388608
file_fat_read:8388608
decrypt update pack [<NULL>]error
desc:00000000
max_image_len:32
the manufacturer 85
SF: Detected P25Q64HStill no dice it does not work..
Lets move on to another method #
So i do know that some cameras are a bit picky and dont allow flashing custom firmware with the vendors tools due to signing of firmware or simply rejecting any custom format. So i do know that thingino has This article in their wiki describing a handy update method that bypasses the vendor’s firmware completely. It does require physicall access to the board and flash so we have to tear it down again. This camera alos uses the same specifications so maybe my kruidvat indoor is in reality Galayou-G7 hardware+software in a sonoff-slim-gen2 package. So lets follow the steps. First we download the firmware then we write it to the sdcard and after that we put a autoupdate-full.bin file on the sdcard’s fat partition. Insert in the camera and now we have to briefly short some pins of the flash chip so the camera skips the flash and instead boots of the U-boot binary on the sdcard (hopefully). So i decided to short pins 5-6 like they said and plugged inthe camera. No vendor’s uboot and after a second we see that it works! We now booted into the Thingino-uboot image. Make sure to immideatly remove the short across pins 5 and 6 as it wil start to write the firmware to the flash 1 second after it. And if everything goes well you should see a similar output to below.
Thingino U-Boot for Ingenic T23N SPL 2013.07-g779c94b (Dec 19 2024 - 23:07:17 PST)
nf = 100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
nf = 100 nr = 1 od0 = 1 od1 = 2
cppcr is 06405100
apll_freq = 1188000000
mpll_freq = 1200000000
sdram init start
DDR clk rate 600000000
image entry point: 0x80100000
Thingino U-Boot for Ingenic 2013.07-g779c94b (Dec 19 2024 - 23:07:17 PST)
Architecture: XBurst 1
Platform: ISVP
Built profile: T23N
SOC Model: T23N
DRAM: 64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 701k for U-Boot at: 83f50000
Reserving 32800k for malloc() at: 81f48000
Reserving 32 Bytes for Board Info at: 81f47fe0
Reserving 124 Bytes for Global Data at: 81f47f64
Reserving 256k for boot params() at: 81f07f64
Stack Pointer at: 81f07f48
Now running in RAM - U-Boot at: 83f50000
MMC: msc: 0
Net: HW address for ETH: 02:4C:EA:2F:45:D5
Net: HW address for WLAN: 02:4C:EA:2F:45:D6
In: serial
Out: serial
Err: serial
KEY: Reset button undefined
GPIO: gpio_default: No GPIO env settings provided
ETH: Searching for valid PHY
ETH: Error: Invalid PHY configuration.
ETH: PHY not found!
GPIO: gpio_default_net: No GPIO env settings provided
GPIO: gpio_mmc_power: No GPIO env settings provided
GPIO: gpio_ircut: 52i 53i 49i 50i 57i 58i
GPIO: gpio_user: No GPIO env settings provided
GPIO: gpio_motor_v: No GPIO env settings provided
GPIO: gpio_motor_h: No GPIO env settings provided
MMC: Checking for autoupdate files...
FAT: loading autoupdate-full.done
FAT: loading autoupdate-uboot.bin
FAT: loading autoupdate-full.bin
JZSFC: Flash chip ID: 856017
SF: Detected P25Q64H (85 60 17 85 00)
Erasing flash from address 0x0 to 0x800000 (length: 0x800000)
flash write...
writing autoupdate-full.done
MMC: Flag file autoupdate-full.done created
MMC: Auto-update completed successfully.
MMC: Checking for kernel image from MMC...
MMC: Kernel file not found.
MMC: Checking for boot/env files...
FAT: loading boot.scr
FAT: Unable to read file boot.scr **
FAT: loading uEnv.txt
FAT: Unable to read file uEnv.txt **
MMC: Auto-update is set to 'full'. Resetting the device...
reset in 4msClick This ) button to get the full upgrade + thingino-firmware bootlog.
And if everything goes well we see a login prompt. Now we can move on to configuring it.
Configuring thingino-firmware #
So if everything goes well we should see a new Wifi Accesppoint popup on our phone or computer. But i dont yet see it do this, so we will debug a bit. When you first installed the firmware you can login with user and password both being: root. Then it asks you to create a new password. Keep this password safe. We did see these messages
Starting wireless interface
Wireless module GPIO is not set
Loading atbm6012bx module with parameters atbm_printk_mask=0
Set MAC address to 02:4c:ea:2f:45:d6
ip: SIOCGIFINDEX: No such device
WiFi password missing
Starting WPA Supplicant
Interface 'wlan0' does not exist.
Wireless interface wlan0 not found
Starting network
Ethernet GPIO does not need a toggle
run-parts /etc/network/if-pre-up.d
eth0 does not exist or is a USB device, skipping MAC address setup
ip link set eth0 up
ip: SIOCGIFFLAGS: No such device
run-parts /etc/network/if-pre-up.d
ip addr add 127.0.0.1/8 dev lo
ip link set lo up
run-parts /etc/network/if-up.d
DHCPv6 disabled on lo
run-parts /etc/network/if-pre-up.d
ip link set usb0 up
ip: SIOCGIFFLAGS: No such device
run-parts /etc/network/if-pre-up.d
WLAN disabled, no password
run-parts: /etc/network/if-pre-up.d/disable_wlan: exit status 1And when we do ‘ifconfig’ in the shell we dont see any wlan0 or other interface than the ’lo’ loopback interface. So indeed this camera does not seem to be a standard sonoff-slim-gen2 but maybe the GPIO assignments are wrong. I know the WIFI chip has an enable line which the SOC must toggle to enable it. Myabe the gpio set by the sonoff-slim-gen2 is not compatible. Actually lets first debug what env variables are ste in uboot and if it even has a definition for a GPIO. run ‘fw_printenv’ which shows the U-boot environment variables.
root@ing-sonoff-s2-45d6 ~# fw_printenv
baseaddr=0x80600000
baudrate=115200
boot_complete=false
bootcmd=sf probe;setenv bootargs mem=${osmem} rmem=${rmem} console=${serialport},${baudrate}n8 panic=${panic_timeout} root=${root} rootfstype=${rootfstype} init=${init} mtdparts=${mtdparts};sf read ${baseaddr} ${kern_addr} ${kern_size};bootm ${baseaddr}
bootdelay=1
disable_eth=true
disable_sd=false
enable_updates=true
ethaddr=02:4c:ea:2f:45:d5
gatewayip=192.168.1.1
gpio_button=14
gpio_ircut=52I 53I 49I 50I 57I 58I
init=/init
ipaddr=192.168.1.10
kern_addr=0x80000
kern_size=0x178000
mtdparts=jz_sfc:256k(boot),32k(env),224k(config),1504k(kernel),5568k(rootfs),8800k@0x768000(extras),15872k@0x80000(upgrade),16384k@0(all)
netmask=255.255.255.0
osmem=41M@0x0
panic_timeout=10
rmem=23M@0x2900000
root=/dev/mtdblock4
rootfstype=squashfs
serialport=ttyS1
serverip=192.168.1.254
soc=t23
stderr=serial
stdin=serial
stdout=serial
wlan_mac=02:4c:ea:2f:45:d6
sysupgrade_complete=trueAnd no wlan-gpio or something seems to be set. Maybe thats why it cant enable the wifi chip as it obviously does not know what pin it uses.Lets have a look at Another section of the wiki. But wait lets also read This. Aww they are deprecated… Last time i used thingino there was a whole list. Why did the devs decide to do this? This is realy dissapointing! Welp, lets try to flash the galayou-g7 firmware then and try again. Sadly it seems that that has completely other pins as now even the statusled wont come on So i wil revert back to the sonoff firmware and maybe try some stuff or find common I/O’s. That will be it for now i think. I will upload another article with the camera working and the wlqn gpio number when the camera is working. Okay, signing off, bye!