Popular A9 mini Wi-Fi camera & the HA challenge

DividedMute · May 19, 2022, 9:51am

I really appreciate your project. I have a same problem ( I bought 2 a9 camera and want to connect it with my nvr)

sorenmichaelsen · May 28, 2022, 9:34pm

Hi all.
I guess this is the standard issue with cheap bought Chinese cameras.
I have another one, a V380, and there I found a “hack” online that might be worth trying here as well.

Create a textfile called ceshi.ini on an empty fat32 formatted sd card.
The file has to contain the following:

[CONST_PARAM]
 rtsp=1

Save it and turn off the camera. Insert the SD card and turn on the cam and wait.
I don’t know how or if it will work with the A9. On the V380 it said some strange things and the camera spun up and down.
After a few minutes I rebooted the camera and I can now access the stream on: rtsp://xxxx:[email protected]/live/ch00_1

Again, I dont know if it works. I but it could be worth a shot?

terraprint · June 10, 2022, 6:21am

Thanks! I hadn’t seen the “JFIF” and thought these packets might be encrypted, but they’re definitely not… good for us, I guess.

Just like you said I was able to remove the first 8 bytes and combine packets. I found the start and end of images by looking for the JPEG image start [0xff, 0xd8] and image end [0xff, 0xd9] flags.

I updated the github repo with a new script that renders the stream (camera_feed.py) : little-stars-hack/camera_feed.py at 3152a989af9f0cdde8e237860e273819b954beac · K-Francis-H/little-stars-hack · GitHub

It’s a little janky but it is able to get a slow (~5fps) feed to show up on my computer from the python script. I used python Tkinter canvas and I’m pretty convinced that’s not the best way to render a stream but it does work well enough for my cameras. The script may be adaptable to other cameras with a few parameters adjusted (camera ip, ports, initiation payloads)

DEEFRAG · June 12, 2022, 9:40pm

Inspired by the githubcom/K-Francis-H/little-stars-hack/blob/main/camera_feed_pygame.py file and some other file. I used it as a base to create my own Python Script: A9/a9.py at main · DEEFRAG/A9 · GitHub
What it does: See the Live-Stream of the A9 mini WiFi-Camera in your Browser. It sets up a Server and presents a MJPG Stream to the URL: http://127.0.0.1:8081/cam.mjpg or you can also use cam.html at the end.
Use the AP Mode of the Camera and connect your Device with it. Then run the script like this: python3 a9.py
Have fun

from http.server import BaseHTTPRequestHandler, HTTPServer
from socketserver import ThreadingMixIn
from socket import *
import struct

def initiate_camera(sock):
	size = sock.sendto(struct.pack('>BB', 0x30, 0x67), ('192.168.4.153', 8070))
	size += sock.sendto(struct.pack('>BB', 0x30, 0x66), ('192.168.4.153', 8070))
	size += sock.sendto(struct.pack('>BB', 0x42, 0x76), ('192.168.4.153', 8080))
	return (size == 6)

def packet_is_image_start(buf):
	for i in range(0, len(buf)-1):
		if(buf[i] == 0xff and buf[i+1] == 0xd8):
			return True
	return False

def packet_is_image_end(buf):
	for i in range(0, len(buf)-1):
		if(buf[i] == 0xff and buf[i+1] == 0xd9):
			return True
	return False

class CamHandler(BaseHTTPRequestHandler):
	def do_GET(self):
		if self.path.endswith('.mjpg'):
			self.send_response(200)
			self.send_header('Content-type', 'multipart/x-mixed-replace; boundary=--jpgboundary')
			self.end_headers()
			frame = bytearray()
			while camera_initialized:
				(buf, rinfo) = s.recvfrom(4096)
				port = rinfo[1]
				if(port == 8080):
					if(packet_is_image_start(buf)):
						frame = bytearray(buf)[8:]
					else:
						frame += bytearray(buf)[8:]
					if(packet_is_image_end(buf)):
						self.send_header('Content-type', 'image/jpeg')
						self.send_header('Content-length', len(frame))
						self.end_headers()
						self.wfile.write(frame)
						self.wfile.write(b"\r\n--jpgboundary\r\n")
			return

		if self.path.endswith('.html'):
			self.send_response(200)
			self.send_header('Content-type', 'text/html')
			self.end_headers()
			self.wfile.write(b'<html><head></head><body><img src="http://127.0.0.1:8081/cam.mjpg"/></body></html>')
			return

class ThreadedHTTPServer(ThreadingMixIn, HTTPServer):
	"""Handle requests in a separate thread."""

if __name__ == '__main__':
	s = socket(AF_INET, SOCK_DGRAM)
	s.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
	s.bind(('',0))
	camera_initialized = initiate_camera(s)
	server = ThreadedHTTPServer(('localhost', 8081), CamHandler)
	print("server started at http://127.0.0.1:8081/cam.html")
	server.serve_forever()

valexi · July 1, 2022, 11:25am

I hope we can get stream from this camera some day directly to HA.

I was able to enable FTP server to browse video material of the SD card. Here is how:
https://www.domoticz.com/forum/viewtopic.php?p=290401#p290401

Use telnet to login, username: root password is empty.
Then run command:

CODE: SELECT ALL

busybox tcpsvd -vE 0.0.0.0 21 ftpd /mnt/sd

This starts FTP server and you can browse SD card files and recordings.

Then I went to /mnt/userdata/config
Create new file: ftpserver.sh with content:

CODE: SELECT ALL

#!/bin/sh
busybox tcpsvd -vE 0.0.0.0 21 ftpd /mnt/sd

Then use command:

CODE: SELECT ALL

chmod +x ftpserver.sh

Then add startup script to start.sh in the same folder in the end after “/usrsys/app/appUpgrade.sh &”:

CODE: SELECT ALL

/mnt/userdata/config/ftpserver.sh &

Then type reboot and FTP server will be started on every boot.
Still have not been able to enable RTSP.

openshwprojects · July 27, 2022, 7:03pm

Hey, can anyone do a full dump of this BK7252 memory with this tool:

Commandline:
python uartprogram cameradump.bin -d com9 -r -l 0x200000 -s 0x0
The important thing here is to start from 0x0 and not the usual 0x11000 or smth like that offset.
Thanks!

MrKittenK · August 3, 2022, 3:42pm

Is this of any use at all?

I just purchased 4 of these a9 style cameras, 2 boxed a a9 the other 2 are more generic packaging.

If I can run any tests I happy to use one as a donor to take apart, run code etc etc

Info…

Wifi ap names:

The two a9’s show up as FTY7xxxxxxxxxx
These come with instructions for ftycampro, I refuse to use it as it asks for make phone calls permissions and wont start without it.

The other two are a DGOA-xxxxxx-ZZURD
and a ACCQxxxxxxPYKRG.

The DGOA works with hdwificampro.

The ACCQ works woth little stars

I have taken some pictures of each pcb.

Fty x2 (Both boards are Identical)

DGOA (only board to have the ir leds)

ACCQ

Tamadite · August 3, 2022, 8:48pm

Here you go what I got:

python uartprogram cameradump.bin -d com3 -r -l 0x200000 -s 0x0
UartDownloader....
Read Getting Bus...
Gotten Bus...
Set baudrate successful
len: 200000
startAddr: 0
Reading 0
ReadSector Failed 0

And for some reason the camera is now unresponsive…

Tamadite · August 4, 2022, 5:35am

The camera becomes responsive after the battery gets disconnected/reconnected of after the battery runs out.
I have tried it again but starting from 0x11000, same result:

python uartprogram cameradump.bin -d com3 -r -l 0x200000 -s 0x11000
UartDownloader....
Read Getting Bus...
Gotten Bus...
Set baudrate successful
len: 200000
startAddr: 11000
Reading 11000
ReadSector Failed 11000

MrKittenK · August 4, 2022, 3:40pm

Interesting development…

My ISP sent me this in an email.
The only new devices I’ve tried to use are these cameras…

"We’re writing to let you know that a device connected to your home network has been identified as having a potential Multicast DNS vulnerability.

Multicast DNS is commonly used to share music and video streaming services between devices on your home network. When exposed to the wider Internet, it can be misused by 3rd parties in order to commit abuse.

It is therefore important that you follow the advice in this letter.

What has happened?

We suspect the device may have been misconfigured by you, someone in your household or without your knowledge. If the settings are left unchanged they can be exploited to unwittingly participate in malicious activities, for example a Distributed Denial of Service (DDoS) attack."

Tamadite · August 4, 2022, 7:48pm

This is how these “cameras for dummies” work. Just look at the sniffed traffic above. I would not call it a vulnerability but a “feature”.

MrKittenK · August 5, 2022, 12:17am

Exactly!! Any vulnerability is a new avenue to pursue imho

Since we seem to have basically an sdk for the chip and pinout… could a new firmware be developed for these devices, something more generic that doesnt phone home?

Are the chips locked from having an update flashed?
Would we have to spoof the OTA update?
Is the sdcard avaliable for update?
Could we activate the supposed Bluetooth le supposedly on board the BK7252 chip?
Could we add to the gpio that’s unpopulated?

These are the avenues I’d like to go down.
I’m happy to setup an airgapped system to test.
I’d also happily use one of my devices as a sacrificial testbed.

My ‘programing’ skills are limited to mostly esp8266/arduino/html/server management.
However I’m a fast learner.

If anyone wants to chip In on these ideas, please do

FalkW · August 10, 2022, 4:26pm

I would love to, even though I am not a hardware freak, screwing around until it works, but my programming skills are quite good (C# C++) although limited to Interface and Game Development.
Somebody mentioned contacting the seller for the source code, I mean, yeahh, I contacted them ill see what i can do.
I have bought: 1080P HD Kamera A9 IP Kamera Nacht Version Micro Stimme Drahtlose Recorder Mini Camcorder Video Überwachung kamera wifi Kamera|Mini-Camcorder| - AliExpress
And the manual: https://media.s-bol.com/Y78oROPGWVDn/original.pdf

I would love if this could be my first ‘hacking’ project to learn a bit more how computers work.

FalkW · August 10, 2022, 4:33pm

And this apparently didn’t work for me sadly, I wasn’t able to find the cameras local IP, I couldn’t even find it on my DHCP. Using IP Scanner also gave me 0 results, on the network of the cam as well as the wifi network the camera got connected to.

Two things to mention
The source code of the app (apk) you can decompile as somebody already did, to get some information, maybe somebody could agian take a look at this, there is maybe some stuff. I would love to do it myself but I have no idea what to look for if I would even understand the code… As the encryption stuff and so on is completely new to me

FalkW · August 11, 2022, 1:11am

And also looking at the source code, there is apparently some stuff going on with rtsp, these are some variables:

 private static final String USER_INFO = "(?:[a-zA-Z0-9\\$\\-\\_\\.\\+\\!\\*\\'\\(\\)\\,\\;\\?\\&\\=]|(?:\\%[a-fA-F0-9]{2})){1,64}(?:\\:(?:[a-zA-Z0-9\\$\\-\\_\\.\\+\\!\\*\\'\\(\\)\\,\\;\\?\\&\\=]|(?:\\%[a-fA-F0-9]{2})){1,25})?\\@";
    public static final Pattern WEB_URL = Pattern.compile("(((?:(?i:http|https|rtsp)://(?:(?:[a-zA-Z0-9\\$\\-\\_\\.\\+\\!\\*\\'\\(\\)\\,\\;\\?\\&\\=]|(?:\\%[a-fA-F0-9]{2})){1,64}(?:\\:(?:[a-zA-Z0-9\\$\\-\\_\\.\\+\\!\\*\\'\\(\\)\\,\\;\\?\\&\\=]|(?:\\%[a-fA-F0-9]{2})){1,25})?\\@)?)?(?:" + DOMAIN_NAME + ")(?:" + PORT_NUMBER + ")?)(" + PATH_AND_QUERY + ")?" + WORD_BOUNDARY + ")");
    private static final String WEB_URL_WITHOUT_PROTOCOL = ("((?:\\b|$|^)(?<!:\\/\\/)((?:" + STRICT_DOMAIN_NAME + ")(?:" + PORT_NUMBER + ")?)(?:" + PATH_AND_QUERY + ")?" + WORD_BOUNDARY + ")");
    private static final String WEB_URL_WITH_PROTOCOL = ("((?:\\b|$|^)(?:(?:(?i:http|https|rtsp)://(?:(?:[a-zA-Z0-9\\$\\-\\_\\.\\+\\!\\*\\'\\(\\)\\,\\;\\?\\&\\=]|(?:\\%[a-fA-F0-9]{2})){1,64}(?:\\:(?:[a-zA-Z0-9\\$\\-\\_\\.\\+\\!\\*\\'\\(\\)\\,\\;\\?\\&\\=]|(?:\\%[a-fA-F0-9]{2})){1,25})?\\@)?)(?:" + RELAXED_DOMAIN_NAME + ")?(?:" + PORT_NUMBER + ")?)(?:" + PATH_AND_QUERY + ")?" + WORD_BOUNDARY + ")");
    private static final String WORD_BOUNDARY = "(?:\\b|$|^)";

These weird characters are apparently the regex protocoll?

EDIT::

WOW I can’t reply more than 3 times to the same thread? really?
Anyways, I got a bit of Logcat Log which shows, what it finds the camera in the Local Areal Network
And when it gets a preview Image for that camera

--------- beginning of main
08-23 23:31:53.381 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:31:53.385 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:31:53.389 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:31:53.394 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:31:53.396 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:31:53.409 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:31:53.411 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:31:54.410 31682 31682 E LOG     : NNN--zhaogenghuai position1:0
08-23 23:31:54.457 31682 31682 E LOG     : NNN--zhaogenghuai position1:0
08-23 23:31:54.485 31682 31682 E LOG     : NNN--zhaogenghuai 5
08-23 23:31:54.544 31682 31682 E LOG     : NNN--SHIXZHAO------1
08-23 23:31:54.572 31682 31682 E LOG     : NNN--HeatThread start
08-23 23:31:55.183 31682 31682 E LOG     : NNN--zhaogenghuai CallBackDel:DBG913403FNDPG
08-23 23:31:55.237 31682 31682 E LOG     : NNN--ZHAO--Start
08-23 23:31:55.237 31682 31682 E LOG     : NNN--ZHAO--str:vodafone.de
08-23 23:31:55.240 31682 31682 E LOG     : NNN--ZHAO--Exception
08-23 23:31:55.272 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:31:55.274 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:31:55.276 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:31:55.278 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:31:55.280 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:31:55.281 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:31:55.283 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:31:55.285 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:31:55.295 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:31:55.296 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:31:55.358 31682 31682 E LOG     : NNN--HeatThread StopHeat
08-23 23:31:55.794 31682 31682 E LOG     : NNN--StartPPPP--StopPPPP停止连接 DBG913403FNDPG
08-23 23:31:56.626 31682 31682 E LOG     : NNN--进入后台运行
08-23 23:36:09.712 31682 31682 E LOG     : NNN--ZHAO--Start
08-23 23:36:09.712 31682 31682 E LOG     : NNN--ZHAO--str:vodafone.de
08-23 23:36:09.714 31682 31682 E LOG     : NNN--ZHAO--Exception
08-23 23:36:14.721 31682 32221 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:36:14.736 31682 32221 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:36:14.820 31682 32221 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:36:14.823 31682 32221 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:36:14.826 31682 32221 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:36:14.922 31682 32221 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:36:14.926 31682 32221 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:36:15.024 31682 32221 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:10.228 31682 31682 E LOG     : NNN--进入后台运行
08-23 23:37:17.494 31682 32389 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:17.593 31682 32389 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:17.596 31682 32389 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:17.694 31682 32389 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:17.705 31682 32389 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:17.796 31682 32389 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:17.805 31682 32389 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:17.899 31682 32389 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:31.422 31682 32452 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:31.518 31682 32452 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:31.523 31682 32452 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:31.620 31682 32452 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:31.627 31682 32452 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:31.723 31682 32452 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:31.728 31682 32452 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:31.825 31682 32452 E LOG     : NNN--strName:beken_camera  strDeviceID:DBG-913403-FNDPG  strIpAddr:192.168.0.225
08-23 23:37:37.044 31682 31682 E LOG     : NNN--zhaogenghuai2 listAdapter.getCount() < 20
08-23 23:37:37.055 31682 31682 E LOG     : NNN--zhaogenghuai2 StopPPPP(did);
08-23 23:37:37.056 31682 31682 E LOG     : NNN--zhaogenghuai2 StartPPPP(did):DBG913403FNDPG
08-23 23:37:37.086 31682 31682 E LOG     : NNN--zhaogenghuaiUpdataCameraStatus did:DBG913403FNDPG  status:0
08-23 23:37:37.092 31682 31682 E LOG     : NNN--ZHAO--Start
08-23 23:37:37.092 31682 31682 E LOG     : NNN--ZHAO--str:vodafone.de
08-23 23:37:37.096 31682 31682 E LOG     : NNN--ZHAO--Exception
08-23 23:37:37.122 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:37:37.124 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:37:37.129 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:37:37.132 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:37:37.136 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:37:37.137 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:37:37.140 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:37:37.142 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:37:37.172 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:37:37.174 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:37:37.410 31682 32472 E LOG     : NNN--BSCallBack_TYPEMODE:{
08-23 23:37:37.410 31682 32472 E LOG     :      "cmd":  100,
08-23 23:37:37.410 31682 32472 E LOG     :      "admin":        1,
08-23 23:37:37.410 31682 32472 E LOG     :      "result":       0,
08-23 23:37:37.410 31682 32472 E LOG     :      "mode": 110,
08-23 23:37:37.410 31682 32472 E LOG     :      "type": 100,
08-23 23:37:37.410 31682 32472 E LOG     :      "restrict":     0,
08-23 23:37:37.410 31682 32472 E LOG     :      "checkstr":     "PGU"
08-23 23:37:37.410 31682 32472 E LOG     : }
08-23 23:37:37.412 31682 31682 E LOG     : NNN--zhaogenghuaiUpdataCameraStatus did:DBG913403FNDPG  resetrict:0
08-23 23:37:37.413 31682 32472 E LOG     : NNN-- connectChannelStatusInterface1 ================= null
08-23 23:37:37.418 31682 31682 E LOG     : NNN--zhaogenghuaiUpdataCameraStatus did:DBG913403FNDPG  status:2
08-23 23:37:37.455 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:37:37.459 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:37:37.464 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:37:37.467 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:37:37.470 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:37:37.471 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:37:37.474 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:37:37.476 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:37:37.478 31682 31682 E LOG     : NNN--zhaogenghuai position:0
08-23 23:37:37.479 31682 31682 E LOG     : NNN--zhaogenghuai path:/storage/emulated/0/HDWiFiCam/picid/DBG913403FNDPG.jpg
08-23 23:37:37.496 31682 32472 E LOG     : NNN--ZHAORECEVE SHIXTRANS did:DBG913403FNDPG  buffer:{
08-23 23:37:37.496 31682 32472 E LOG     :      "cmd":  128,
08-23 23:37:37.496 31682 32472 E LOG     :      "result":       0
08-23 23:37:37.496 31682 32472 E LOG     : }
08-23 23:37:37.496 31682 32472 E LOG     : NNN--ZHAORECEVE SHIXTRANS did:DBG913403FNDPG  strJason:{
08-23 23:37:37.496 31682 32472 E LOG     :      "cmd":  128,
08-23 23:37:37.496 31682 32472 E LOG     :      "result":       0
08-23 23:37:37.496 31682 32472 E LOG     : }LEN:29

openshwprojects · August 19, 2022, 9:54am

It seems that I have found some strange Arduino Core port that might support BK7252 chip.
Details here, on my BK7231 firmware research topic on Elektroda:
https://www.elektroda.com/rtvforum/viewtopic.php?p=20150746#20150746

NCO3 · September 4, 2022, 3:08pm

Hi there,
I’m wondering which app you are using, because I just found this very camera in one of my closets.
Any hints about the app would make it easier for me to connect for a start.
Thanks

konstantint · September 13, 2022, 10:43am

Sharing some info for future reference:

I have a camera with the A9_L2-V7 20210823 printed on its PCB. The PCB design is quite similar (although not in every minor detail) to the image by @mb_EQNvD3CjP here. The AP name starts with BCCQ.

PXL_20220913_102726434.MP1688×1676 404 KB
The Python code by @DEEFRAG works out of the box for me. In particular, the camera does seem to always assign itself the fixed IP address 192.168.4.153 in AP mode.

konstantint · September 13, 2022, 10:43am

I tried connecting the FTDI USB2TTL chip to the D+/D- USB pins as @Tamadite descibed above. Some stuff is being constantly printed to the serial terminal then (also, pressing the ON or MODE buttons seems to prompt an output burst), but it is not any sort of legible ASCII - looks more like some encrypted / binary / garbage data. I wonder if it could be due to some misconfiguration of the serial stream?

Screenshot from 2022-09-13 12-36-28996×698 14.2 KB

Tamadite · September 13, 2022, 6:29pm

that screenshot looks to me like wrong baud speed configuration.