I collect some information about tx806,also include some example,you can develop it if you got time. Here is download link :TXW806.7z - 蓝奏云
Looking at the Taixin website and reading between the lines - TXW806-840 is a SoC built around the Chinese C-Sky CPU (CK803) - and there are GCC devkits for this beast
Whilst there aren’t links to documentation on the TXW806 page it looks like the documents on the other pages should be useful
I’ve got one of these things as a spur-of-the-moment $1 purchase from Aliexpress, with an eye to using it to read water/electricity meters (no interfaces available on the meters)
I get this from it:
C:\Program Files\nodejs\node.exe .\run_with_audio.js
{port: 3000, broadcastip: '255.255.255.255'}
bind options:[object Object]
socket listening 0.0.0.0:62468
broadcast Message sent.
...
connected! {address: '192.168.2.72', port: 22519}
{
"cmd": 111,
"result": -3
}
{
"cmd": 101,
"result": -3
}
{
"cmd": 111,
"result": -3
}
but no image sadly
EDIT: nvm, i had to kick it out of my wifi and connect to its hotspot first; NICE!
PS C:\Users\blusc\Desktop\A9_PPPP> node .\run_with_audio.js -b 192.168.169.255
{ port: 3000, broadcastip: '192.168.169.255' }
bind options:[object Object]
socket listening 0.0.0.0:64770
broadcast Message sent.
connected! { address: '192.168.169.100', port: 18657 }
{
"cmd": 111,
"result": 0
}
{
"cmd": 101,
"result": 0,
"time": 1609459490,
"stream": 0,
"icut": 2,
"power": 0,
"charging": 0,
"sysver": "7252_CY_IPC_2212162000",
"server_ver": "",
"upgrade": 0,
"rotmir": 0,
"lamp": 1
}
{
"cmd": 101,
"result": 0,
"time": 1609459490,
"stream": 0,
"icut": 2,
"power": 0,
"charging": 0,
"sysver": "7252_CY_IPC_2212162000",
"server_ver": "",
"upgrade": 0,
"rotmir": 0,
"lamp": 1
}
{
"cmd": 111,
"result": 0
}
{
"cmd": 111,
"result": 0
}
We actually got some great progress:
Now, who can i pay to turn this into a HASS addon + integration? x3
I have an A9 with a Taixin TXW817-810. Is it for the bin or do I have options for alternative firmware?
I’ve been reversing these ‘A9’ / ‘X5’ for a few days before finding this thread - my cameras were <$3 and are based on the Taixin TXW817 ; I’ve reversed a part of the P2P UDP communication and have a working (though incomplete) implementation here: GitHub - DavidVentura/cam-reverse
I have video and audio working, but Wifi setup is missing, so I’ve been using them in AP mode.
I’ve not worked into integrating my project anywhere, it should be considered a library that can be used by HA.
I’ve managed to get pairing and streaming working for multiple cameras – along with a super basic dashboard which just shows streams from all cameras; this is 2x X5 and 1x A9
1 Like
Interesting - is there a ready-made OCR module that can do this? I imagine a setup where the camera has an illuminator, wakes up every n time units, takes a picture of the digits and this is then OCRed and becomes a metric in HA.
To answer my own question - yes, and even has HA integration:
this is exciting. I’ll keep a watch on your GH. I don’t suppose you’ve found the hgSDK/Taixin (?) anywhere?
my factory fw boot log for the record
[0]00 00 17 00 57 0a 12 a0
[0]28 6e 00 00 00 00 00 00
[0]00 00 00 00 00 00 00 00
[0]08 19 75 05 38 66 89 a6
[0]4a a5 88 77 8e 67 00 00
[0]80 00 b7 ca a2 96 00 00
[0]00 16 00 00 0b 0a 00 00
[0]00 00 00 00 01 60 07 00
[0]00 00 00 40 00 04 40 00
[0]04 40 00 04 40 40 04 f1
[0]00 4c a0 14 4a 51 3c 85
[0]53 3c c5 03 cf 03 00 01
[0]00 02 fe 03 0f ae 04 0a
[0]02 00 fc 04 00 1f 00 1d
[0]00 03 48 00 00 00 00 0a
[0]00 00 00 00 00 10 e4 00
[0]f0 3c 0f
[0]validity: 1678e00d
** hgSDK-v2.5.1.7-26745, app-0, build time:Jan 18 2024 21:55:13 **
** libcore v2.5.1.7-26745, build time:Dec 18 2023 11:05:53
** libnetutils v2.5.1.7-26745, build time:Dec 18 2023 11:06:10
** libcommon v2.5.1.7-26745, build time:Dec 18 2023 11:05:58
** libosal v2.5.1.7-26745, build time:Dec 18 2023 11:05:52
** libatcmd v2.5.1.7-26745, build time:Dec 18 2023 11:05:59
** liblmac v2.5.1.7-26745, build time:Dec 18 2023 11:06:29
** libwifi v2.5.1.7-26745, build time:Dec 18 2023 11:06:42
------------------------------------------------------------------
[0] ------- system restart fault -----------
[0][soft_reset]
[0] ------- lvd fault -----------
[0] ---------------------------------------
[1]freemem:181032
[1]custom_mem_init:2000cdb0
[2]custom mem sram:53248
[2]skbpool init, total:27436 (0x2003d4d4~0x20044000), max per:80%
[initStaticParam][ 292]use serverseq=1,svr=d32983:43237`57:g6bb8b322:53
[4]syscfg_read OK!
[4]0[540] flashCfg params(103).ssid=FTYC535866GRDBZ,T a O V ۙ p\e\ s ) O d#12345678,2,1
[VerStr2Int][ 834]cVersion=62_1_2_15
[IpcCfgItemGet][1099]VerStr2Int=62_1_2_15:1040253455
[VerStr2Int][ 834]cVersion=62_1_2_15
get flash addr:fd000 size:4096,
[8]col_flag:1
[8]get_parse_cloud_id:204
[8]selfId:FTYC535866GRDBZ:15
[9]col_flag:1
[9]col_flag:2
[9]get_parse_cloud_id:204
[9]parId:LXKJIG:6
[IpcCfgInit][ 448]1:616-->get from ezConfig FTYC535866GRDBZ:ZZZZZ:
[IpcCfgInit][ 462]0-->get from ezConfig FTYC535866GRDBZ:ZZZZZ:
[parseEz2Sch][ 885]NULL==pVal || NULL==pSysSchext || strlen(0)<24
[12]IpcCfgInit:505 add w0 interface! 2 FTYC535866GRDBZ:12345678
[12]IpcCfgInit:507 add w0 interface! 2 FTYC535866GRDBZ:12345678
[IpcGpioInit][ 641]SDD_PIN_INPUT=1
[IpcGpioInit][ 650]PWR_PIN_INPUT=1
[IpcGpioInit][ 670]PIN_IN_KEY=1
[IpcGpioInit][ 687]PIN_IN_USB=0
[16]main:1007 add w0 interface! 2 FTYC535866GRDBZ:12345678
[18]lmac rx info size:36
[18]GAP0 : 200390d4
[18]GAP1 : 2003d4cc
[18]lmac rx buff:200390dc, size:17392, hw rx buff size:11256, ampdu:7, max subfrm:3
[19]lmac priv: 2001ba0c
[20]lmac tx : 2001be18
[20]lmac rx : 2001cfe4
[20]lmac ble rx: 00000000
[20]pack:10, bios_id:3
[21]use AMPM DPD!
[21]verf:0x6, ibpt:0xa, ibct:0xa, iref:0x9
[22]verfvco_trim:0x4, verfcp_trim:0x2, verfdiv_trim:0x5
[22]verfdsm_trim:0x4, verfvcc25_trim:0x1
[23]da cap:5, da gain:2
[25]txdcoc from:1, i:11, q:10
[26]tx imb from:1, pm:118, gm:1
[26]rx dcoc from:1
[26]g:0, ana:64, i:-3, q:1
[27]g:1, ana:64, i:-5, q:5
[27]g:2, ana:64, i:-5, q:5
[27]g:3, ana:64, i:-10, q:15
[28]g:4, ana:64, i:-10, q:14
[28]g:5, ana:64, i:-10, q:15
[28]g:6, ana:64, i:-10, q:15
[29]g:7, ana:68, i:-15, q:0
[29]rx imb from:1
[29]g:0, 8114, 4050
[29]g:1, 8120, 4047
[30]g:2, 8112, 4048
[30]g:3, 8110, 4047
[30]g:4, 8106, 4049
[30]g:5, 8114, 4045
[31]g:6, 8110, 4050
[31]g:7, 8110, 4047
[31]time offset:0, 29
[32]lmac test: 2001d78c
[33]set_bss_bw: 20M
[33]lmac_bgn_lo_freq_set: 2432
[34]set rts_threshold =2304
[35]lmac set mac0 addr:08:19:75:05:38:98
[35]ADKEY baud:239
[35]*** open ADC success!
[36]*** add success: ADC channel cnt = 1, name:257
[36]*** add success: ADC channel cnt = 2, name:258
[37]lmac_bgn_lo_freq_set: 2412
[39]lmac_bgn_lo_freq_set: 2412
[40]set rts_threshold =1600
[40]set ac= 0 aifs= 2 cw_min= 15 cwmax= 1023 txop= 79
[41]set ac= 1 aifs= 6 cw_min= 15 cwmax= 1023 txop= 79
[42]set ac= 2 aifs= 1 cw_min= 7 cwmax= 15 txop= 128
[42]set ac= 3 aifs= 1 cw_min= 3 cwmax= 7 txop= 65
[43]set ac= 0 aifs= 2 cw_min= 15 cwmax= 1023 txop= 79
[43]set ac= 1 aifs= 6 cw_min= 15 cwmax= 1023 txop= 79
[44]set ac= 2 aifs= 1 cw_min= 7 cwmax= 15 txop= 128
[45]set ac= 3 aifs= 1 cw_min= 3 cwmax= 7 txop= 65
[45]lmac set mac0 addr:ce:f7:82:c9:70:74
[46]lmac_bgn_lo_freq_set: 2447
[47]lmac set mac0 addr:ce:f7:82:c9:70:74
[48]lmac_bgn_lo_freq_set: 2447
[49]ieee80211_ap_ioctl:164::set channel 8
[50]set ac= 0 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
[50]set ac= 1 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
[51]set ac= 2 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
[51]set ac= 3 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
[52]main:1009 add w0 interface! 2 FTYC535866GRDBZ:12345678
[53]sys_network_init:463 add w0 interface! 2 FTYC535866GRDBZ:12345678
[54]sys_network_init:465 add w0 interface! 2 FTYC535866GRDBZ:12345678
JPG start
[55]csi_test start,iic init
[55]iic init finish,sensor reset & set sensor clk into 6M
hgdvp_set_baudrate:clock:480000000
[59]set sensor finish ,Auto Check sensor id
1--rsn--->6
2--rsn--->6
[359]to check id =4 num:0
[359]sensorCheckId:1050 preset :0
[360]SID: ff, 4, 78, 79,f0
1--rsn--->6
2--rsn--->6
[660]to check id =9b num:1
[660]sensorCheckId:1050 preset :0
[661]SID: 1, 9b, 42, 43,0
1--rsn--->6
2--rsn--->6
[961]to check id =a0 num:2
[961]sensorCheckId:1050 preset :0
[962]SID: 1, a0, 42, 43,0
1--rsn--->6
2--rsn--->6
[1262]to check id =a3 num:3
[1262]sensorCheckId:1050 preset :0
[1263]SID: 96, a3, 42, 43,f0
1--rsn--->6
2--rsn--->6
[1563]to check id =bb num:4
[1563]sensorCheckId:1050 preset :0
[1564]SID: ff, bb, 66, 67,f0
1--rsn--->6
2--rsn--->6
[1864]to check id =10 num:5
[1864]sensorCheckId:1050 preset :0
[1865]SID: 0, 10, 42, 43,f1
1--rsn--->6
2--rsn--->6
[2165]to check id =9d num:6
[2165]sensorCheckId:1050 preset :0
[2166]SID: 96, 9d, 42, 43,f0
1--rsn--->6
2--rsn--->6
[2466]to check id =c0 num:7
[2466]sensorCheckId:1050 preset :403105600
[2467]preset table num:2
[2467]SID: ff, c0, 62, 63,0
1--rsn--->6
2--rsn--->6
[2768]to check id =21 num:8
[2768]sensorCheckId:1050 preset :0
[2769]SID: ff, 21, 78, 79,f0
1--rsn--->6
2--rsn--->6
[3069]to check id =77 num:9
[3069]sensorCheckId:1050 preset :0
[3070]SID: 20, 77, 42, 43,a
1--rsn--->6
2--rsn--->6
[3370]to check id =26 num:10
[3370]sensorCheckId:1050 preset :0
[3371]SID: ff, 26, c0, c1,a
1--rsn--->6
2--rsn--->6
[3671]to check id =37 num:11
[3671]sensorCheckId:1050 preset :0
[3672]SID: ff, 37, dc, dd,fc
1--rsn--->6
2--rsn--->6
[3972]to check id =3a num:12
[3972]sensorCheckId:1050 preset :0
[3973]SID: ff, 3a, dc, dd,fc
1--rsn--->6
2--rsn--->6
[4273]to check id =36 num:13
[4273]sensorCheckId:1050 preset :0
[4274]SID: ff, 36, dc, dd,fc
1--rsn--->6
2--rsn--->6
[4574]to check id =3 num:14
[4574]sensorCheckId:1050 preset :0
[4575]SID: ff, 3, dc, dd,fd
1--rsn--->6
2--rsn--->6
[4875]to check id =20 num:15
[4875]sensorCheckId:1050 preset :0
[4876]SID: ff, 20, dc, dd,fd
1--rsn--->6
2--rsn--->6
[5001]main_wkq run work 0x2000cd7c (func:0x1803a308) use 5000 ticks
--------------------
local:ce:f7:82:c9:70:74
bios:3, pack:10
pwr idx: 0
chip-temperature: 30
freq:2447, bg_rssi:-85
cca: -70, -60, -62
tx: txq:0, ps:0, tx_stat_q:0,
tx dma:0, total tx:0, retry:0, tx lost:0, tx err:0
rx: frms:209, data:0
throughput: tx: 0 bps, rx: 0 bps
max gain:7
--------------------
[5176]to check id =96 num:16
[5176]sensorCheckId:1050 preset :0
[5177]SID: ff, 96, 60, 61,4
1--rsn--->6
2--rsn--->6
[5477]to check id =71 num:17
[5477]sensorCheckId:1050 preset :0
[5478]SID: a6, 71, 42, 43,2
1--rsn--->6
2--rsn--->6
[5778]to check id =a6 num:18
[5778]sensorCheckId:1050 preset :0
[5779]SID: a6, a6, 42, 43,2
[5779]checked ok id =a6 num:18
[5779]Auto Check sensor id finish
[5780]mclk:24000000MHz
hgdvp_set_baudrate:clock:480000000
[5780]init:1806ec60 u8Addrbytnum:1,u8Databytnum:1
[5781]SENSER....init
[5850]init table num:542
[5851]SENSR ident ok:640*480
[5851]csi init start --
[5851]csi set size ====>640*480
[5851]csi dvp_size_set
[5852]csi IRQ init
[5852]dvpirq_register:1 18028d58 18028d58
[5853]dvpirq_register:0 18028d44 18028d44
[5853]vppirq_register:0 18028b40 18028b40
[5853]vppirq_register:1 18028b44 18028b44
[5854]vppirq_register:2 18028b3c 18028b3c
[5854]vppirq_register:3 18028d14 18028d14
[5855]vppirq_register:4 18028d28 18028d28
[5855]vppirq_register:5 18028b1c 18028b1c
[5856]vppirq_register:6 18028b0c 18028b0c
[5856]vppirq_register:7 18028afc 18028afc
[5857]csi IRQ init finish,start get data
[5857]enable sdio irq[5858]clk:400000 width:1 power:UP
[5868]clk:400000 width:1 power:ON
[5878]read timeout pending set or rsp err:1 0
[5879]open_stream_available name:adc_audio
[5883]auadc power on
[5883]is CONFIG_UMAC4 2:2 FTYC535866GRDBZ:12345678
[5884]is CONFIG_UMAC4 2:2 FTYC535866GRDBZ:12345678:8
[5884]lmac_bgn_lo_freq_set: 2447
[5886]ieee80211_ap_ioctl:164::set channel 8
[5887]vif2 state WPA_DISCONNECTED -> WPA_COMPLETED
@eloop_init:287::start
user_[6057]dns sock :2
port:7070 fd:3
[6058]set_video_track:364
[6058]set_video_track source->track[t]:0 rtp:20027ED4
[6059]live audio_ex:20027E84
[6059]set_video_track:364
[6060]set_video_track source->track[t]:0 rtp:20028554
[6060]add w0 interface! 2:2 FTYC535866GRDBZ:12345678
[IpcSysInit][2203]gStartType=0,gDcOrBattery=0,gSysUpTime=6061
[normalRun][2089]normalRun--->0,gFctChkOn=0
[normalRun][2092]sysmode=0,t=6062
mutex create 0
[IlnkConnInit][ 137]init max connection--->[]->2
[IpcSdInit][1592]chk mmc dev, and mount it to sd
[IpcSdInit][1598]chk mmc dev, and mount it to sd
[IpcSdInit][1606]get storage status
[GetStorageInfo][ 186]totalBytes=0 M,freeBytes=0 M,usedBytes=0 M
[IpcSdInit][1622]create dir for rec&pic 4
[IpcSdDirCreate][1497]create dir for rec&pic 4
[IpcSdDirCreate][1501]create dir for rec&pic 4
[IpcSdDirCreate][1503]create dir for rec&pic 4
[IpcSdDirCreate][1505]create dir for rec&pic 4
[IpcSdDirCreate][1507]create SPECIALCAP_FOLDER 12
failed-create RECORD_FOLDER 12
[IpcSdInit][1627]IpcIlnkIdxInit=0
[IpcIlnkIdxInit][1465]gIdxPicLock created[0]
[IpcIlnkIdxInit][1467]gIdxRecLock created[0]
[IpcIlnkIdxInit][1469]gIdxSplLock created[0]
[IpcSdInit][1629]IpcIlnkIdxInit=0
[IpcPicIdxChk][1485]TFcard not mounted[0]
[IpcRecIdxChk][1530]TFcard not mounted[0]
[IpcSplIdxChk][1508]TFcard not mounted[0]
[IpcSdInit][1638]ok[0]--IpcSdInit[gSdInitFlag=1]
[recInit][ 677]IpcSdInit=0
[recInit][ 685]IpcRecMgrInit=0
[IpcP2pStart][ 559]p2p starte,bP2pStarted=[0] 3;4d449b8b;5c722d77;9a3f3ea2
[IpcP2pStart][ 596]p=558c9c:4b633e66:8`2g2d`32:5e,len=28,ret=1,d32983:43237`57:g6bb8b322:53
ifPsram=0 sNmb=1
cNmb=2
cBuf=12
svr0=1122121874
svr1=1379035718
svr2=4157381667
[IpcP2pStart][ 640]Success[0]--IlnkModP2pStart
[IpcP2pStart][ 646]IpcP2pStart=0
[normalRun][2124]normalRun--->4,gFctChkOn=0
[6082]p_sensor_cmd->id=0:a6
[6082]spaFlip=0
[6082]setPtzRun 0,-1,-1
[6083]ble_ll: set adv data, len=28
[6083]ble_ll: set scan_resp data, len=31
[6084]ble_ll: set adv en:1
[6084]ble_ll: set coexist en:1, decrease duty cycle:0
t_socket=4 strerror: Success
network interface: pt (Default)
MTU: 8486
MAC: 07 18 40 06 ce f7 82 c9 70 74 06 3f 77 30 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 00 00 00 01 00 00 00 34 f1 01 20 00 00 00 00 00 00 00 00 b8 00 60 00 00 00 00 00 94 b2 00 20 ac 54 00 20 2c 00 1c 00 80 00 00 00 00 00 ff ff ff ff ff ff ce f7 82 c9 70 74 08 06 45 00 00 2c 00 00 00 00 ff 11 bd be 7f 00 00 01 7f 00 00 01 c0 36 c0 36 00 18 bb bf 0c 01 74 00 01 00 00 00 00 00 00 00
FLAGS: UP LINK_DOWN ETHARP
ip address: 192.168.1.1
gw address: 192.168.1.1
net mask : 255.255.255.0
network interface: $[framememt_video_thread][ 443]bOK=0,gfps=0,gBps=1719,tm=6
$[6379]enable sdio irq[6379]clk:400000 width:1 power:UP
[6389]clk:400000 width:1 power:ON
[6399]read timeout pending set or rsp err:1 0
$$$$$$$[_mon100chk][1653]!gBatteryValue 1--->(2827):3200----->IpcShutdown
[6691]erase flash, 1 sectors ...
[6693]write flash, 540 bytes ...
[6696]verify flash ... OK
[6697]switch syscfg partition ... OK
[6698]syscfg_write OK! (addr:ff000, crc=f84d, size:540, last_addr:fe000)
[IpcRecSwitch][ 809]bOnOff=0 && pParam==NULL
$$[_mon500chk][1707]1--Mode=1,wlan=0:1,IDR=0,sd=0,conn=0,keep=0:-1:0,[0:1]wlan=2,run=0,rec=0,t=6182
$$[6900]enable sdio irq[6900]clk:400000 width:1 power:UP
[6911]clk:400000 width:1 power:ON
[6921]read timeout pending set or rsp err:1 0
$
Thanks
Managed to download the following list after creating an account.
I haven’t tried to use it yet, just looked at the datasheet.
It also looks to contain the SDK (e.g. TXW806_FPV-v2.4.0.7-24377_20230811223450.zip).
Hmm. I don’t see a UART flash option in the flasher util
Got your repo to connect to my DGOE camera but I am not getting any video. Do i need to be connected to it directly via its AP or can I get the video feed over the same network?
I was able to use that A9_PPPP repo to talk to my camera with DGOC prefix. But it would always die after a couple of hours. I took that code and rewrote it in C, available here GitHub - hyc/a9serv: Streaming server for A9 wifi cameras . Unlike the javascript version, this has no external dependencies and it’s only 10KB of code total.
It doesn’t do everything that the javascript code does; all this does is let you get video from an HTTP URL. But that’s all I was looking for, to hook into motion and do motion detection. Maybe it’d be nice to figure out how to mux the audio stream into there too, but I’d probably have to use ffmpeg’s libavformat for that or something, which again is a big mess of dependencies…
3 Likes
Please help…my a9 mini cam cannot connect through AP, how to hard reset? Tq
It’s been years and years, and still no progress…
After some searching (starting here 
) I found this project:
I’ve run it on Ubuntu Server. Both my X5 cameras were detected. And I added to HA links to MJPEG streams from my server. Both cameras are available from HA. And disconnected from Internet 