News:

Added a Wiki, please help to add pages to the wiki! - http://wiki.openipcam.com

Author Topic: XMeye Hi3518E-based camera module  (Read 42029 times)

  • ***
August 09, 2015, 08:46:02 am
Xiong Mai elects not to support JPEG snapshots, but Foscam does (using larger NAND flash ram and DRAM sizes) and there is a HiSilicon JPEG encoder kernel module loaded. 

Module                  Size  Used by
hi3518_jpege           48265  1

Submitting this module to the Online Disassembler provided a peek inside.  The Sofia program is too large to submit to the ODA, but I'd wager there are callouts from Sofia's 'snap' functionality to this JPEG Encoder kernel module, and they will illustrate its use to generate JPEG snapshot files.

Yes, I'm very well aware of what Foscam and other Network IP Cameras can do with snapshots using their firmware:

http://107.170.59.150/

As one example. Foscam camera models C1-2, FI9803P and the FI9816P all use the HiSilicon Hi3518E SoC ("System on a Chip") and they can and do provide snapshots using a URL directly from their firmware inside those cameras.

That said. This forum threads title was about this manufacturers specific 6510 camera module which is based on the HiSilicon Hi3518E SoC and this manufacturers stock firmware.

The reason why you see the module in the firmware that you do. Is because the firmware in this camera module does render snapshots. However this manufacturer does this in their own proprietary way which does not inculde the support of grabbing snapshots using a URL.

All the manufacturers applicatons as well as their ActiveX interface use thier proprietary snapshot module, contained in their stock firmware.

"The 6510 camera module only has a total of 8 MB of memory. Which is why Wi-Fi is no longer supported with the stock manufacturers firmware for them. Due to buffer issues which caused instability issues. The 6510 camera modules current stock firmware .bin file provided by the manufacturer is 6.5 MB."

Storing multiple snapshots in this specific camera modules memory. Is not a good idea because of the potential memory usage it may require. Which is why the other methods shown in my prior post here, may be a better choice:

http://www.openipcam.com/forum/index.php/topic,1183.msg4630.html#msg4630

While HiSilicon SoC's can support many standard features. Not all manufacturers choose to implement every standard feature that can or could be implemented when using a HiSilicon SoC, with their firmware for HiSilicon SoC's. Which is the case for this specific manufacturers camera modules and NVR/DVR product lines.

I just don't want to give others false hopes here. Because I have been told by this manufacturer that this will never become reality anytime soon.

I'm in constant communications with this manufacturers engineers and tech support staff who have clearly stated that there are no plans to support pulling snapshots from their camera modules using URL methods:

http://www.ipcamtalk.com/showthread.php?p=39874#post39874

Don
« Last Edit: August 09, 2015, 12:56:42 pm by TheUberOverLord »

  • No avatar
  • *
August 09, 2015, 12:59:51 pm
No false hopes here, just optimistic hacking.  If you browse the URL <camera IP>:<camera port>/index.htm after logging into the camera, you'll receive a toolbar across the bottom of the screen, where the fifth option is 'snapshot'.  Here are the lines of HTML code behind that button:

<div style="margin: 0 0 0 5px;">
    <a title='snap' id='snap' class="p8" href="javascript:;" onclick='ocx.BMPCapturePicture("C:\\BMP")'>
    </a>
</div>


This is a call to their ActiveX module, which immediately returns a failure/error response. Unfortunately, it doesn't explain WHY it failed, but I presume they've removed the BMPCapturePicture() code from their ActiveX object.  Also, who stores a BMP file when PNG and JPG are so much more effective?



  • ***
August 09, 2015, 08:41:56 pm
No false hopes here, just optimistic hacking.  If you browse the URL <camera IP>:<camera port>/index.htm after logging into the camera, you'll receive a toolbar across the bottom of the screen, where the fifth option is 'snapshot'.  Here are the lines of HTML code behind that button:

<div style="margin: 0 0 0 5px;">
    <a title='snap' id='snap' class="p8" href="javascript:;" onclick='ocx.BMPCapturePicture("C:\\BMP")'>
    </a>
</div>


This is a call to their ActiveX module, which immediately returns a failure/error response. Unfortunately, it doesn't explain WHY it failed, but I presume they've removed the BMPCapturePicture() code from their ActiveX object.  Also, who stores a BMP file when PNG and JPG are so much more effective?

;D http://www.polaniec.pl/uploads/download/ola/Kamera/OCX%20SDK%20Manual%28V2.3%29.pdf

We first need to clarify some terms:

Grab a snapshot = Using HTML and/or scripting and other programmatic methods to grab a snapshot using a URL without the need to;

a) Be forced to save a snapshot to a local drive first.

b) Be forced to use a utility on the host device to display the grabbed snapshot in a non-HTML window. After the snapshot is saved to disk.

Example below of grabbing a snapshot live and in real-time using a URL to do so;

This is a live and real-time snapshot shown below. Being grabbed from a Foscam Network IP Camera. Resized to be much smaller than the actual 1280x720 grabbed snapshot received.

Please notice how it did not require you to save this grabbed snapshot to a local disk on the device that you are using to display this web page. Nor did it open a non-html window afterwards to display the saved snapshot on the device that you are using to display this web page.



Note: If you refresh this web page then a new snapshot above will be grabbed and displayed. That's what grabbing a snapshot allows.

Being forced to save a snapshot to a local drive and afterwards being forced to display that saved snapshot in a non-HTML window =

What using this manufacturers proprietary methods in their applications, including their ActiveX does. See below for more details.

As stated by me in a prior post here ("Please see item #5") at the link below:

http://www.openipcam.com/forum/index.php/topic,1183.msg4630.html#msg4630

It always has been possible to be forced to save a snapshot to a local drive and then be forced to open a non-HTML window to display that saved snapshot using this manufacturers proprietary ActiveX interface and it's other applications.

If your snapshot saving is failing while using a IE ("Internet Explorer") browser with this manufacturers camera modules and their stock ActiveX and firmware, then it's because:

a) You have not configured the local configuration properly in your IE browser window for these cameras. The default location of where snapshots/pictures will be stored is on the D drive. If you don't have an active D drive on the host computer using the IE browser to save snapshots when you click the "Snapshot" button in the IE browser window. Then saving and displaying snapshots will always fail until you correct your local configuration in your IE browser window. Not because this manufacturer has abandoned saving .bmp snapshots to a local drive on a host computer accessing these cameras using a IE browser.

Please click the image below for a larger image of same


b) This manufacturers proprietary ActiveX interface when used with a IE browser, requires you to add the cameras IP Address and/or DDNS ("Without a port") to your IE "Trusted Sites" because that's the only way that ActiveX is allowed to write to the host computers local drives to save snapshots.





Instructions on how to add your cameras IP Address and/or DDNS to IE trusted sites:

http://windows.microsoft.com/en-us/windows/security-zones-adding-removing-websites#1TC=windows-7

Once you get everything properly setup. When using the snapshot button in IE. It will work.



Please click the image below for a larger image of same


As you can see when using this manufacturers proprietary snapshot methods. The snapshots are in fact forced to be saved to a local drive and are also in fact saved as .bmp images and then afterwards forced to also be displayed in a non-HTML window, after they are saved.

This is not grabbing a snapshot. It's forcing a snapshot to be saved to a local disk and then forcing that saved snapshot on disk to be displayed in a non-HTML window afterwards.

I thought that I had made myself clear. That this manufacturers proprietary snapshot methods don't allow grabbing a snapshot using a URL. They do allow forcibly saving a snapshot to a local drive and then forcibly displaying that saved snapshot from the local drive in it's own non-HTML window, but not in a web page first and skipping all these other things.

This means for example. That it requires a running host device such as a computer, tablet, phone or TV using one of the manufacturers applications, including their ActiveX, which must first store the snapshot to a local drive or SD card and then force that saved snapshot to be displayed in a non-html window and cannot simply grab a snapshot to be displayed in a web page when using this manufacturers proprietary snapshot interfaces. As both my examples above and below can do and does with other Network IP Cameras.

Even the Hikvision ActiveX SDK .pdf documentation which you link to above. Shows that the snapshot is being forced to be saved to a local disk using Hikvisions standard ActiveX methods and cannot simply be grabbed or displayed in a web page first, using those methods in their documentation:

Code: [Select]
BOOL JPEGCapturePicture(long lChannelNum, short iPicSize, short iPicQuality, LPCTSTR lpSavePath, BOOL bShowSaveFile)

lpSavePath: Set the path for saving BMP image, “C:\OCXJPEGCaptureFiles” is default. And the image will be in folder named JPEGCapture

BOOL BMPCapturePicture(LPCTSTR lpSavePath, BOOL bShowSaveFile)

lpSavePath: Set the path for saving BMP image, “C:\OCXBMPCaptureFiles” is default. And the image will be in folder named BMPCapture
bShowSaveFile: if show the BMPCapture folder after grabbing BMP image

Here is also proof that in fact the JavaScript code you reference in your quoted post here is not failing ("When you follow my steps above") and has not been removed from this manufacturers ActiveX. By using a debugger with a breakpoint set when the snapshot button in the IE web page is clicked on and then stepping into the HTML/JavaScript to complete the process:

Please click the image below for a larger image of same


The snapshot is in fact forced saved to a local disk and then forced to be opened afterwards in a non-HTML window.

Unlike what grabbing a live real-time snapshot using a URL allows. Please see my live real-time example of grabbing a snapshot below. Resized to be much smaller than the actual 1280x720 grabbed snapshot received. To display to any website visitors here a snapshot which does not force that website visitor here to first save the snapshot to their local drive and then afterwards open that saved snapshot in a non-HTML window with the device they are using to view this web page:



So point being. When grabbing a snapshot using a URL one is not first forced to save that snapshot to a local disk using a forced filename nor is one forced afterwards to display that saved snapshot in a non-HTML window.

Of course when truly grabbing a snapshot using a URL one can choose to save that snapshot using the filename of their choice. But it is not forced upon them to do so.

So even if you tapped into this manufacturers proprietary ActiveX interface to save snapshots to your local drive. You would be forced to open a non-HTML window to display a snapshot for every snapshot you were forced to save to your local drive. Which would be a nightmare to use programmatically. Compared to the other four methods to get snapshots shown here:

http://www.openipcam.com/forum/index.php/topic,1183.msg4630.html#msg4630

Which is why I said in my prior post here that I did not want to give others here false hopes on attempting to use this manufacturers proprietary interfaces to use for programmatically trying to get snapshots from this manufacturers camera modules or NVR/DVR product line. I was and am trying to save others time by letting them know that they would be much better off to first try using the other four methods shown in the above link.

It's again important to note as I have stated in a prior post here. That this manufacturers engineers and tech support staff have already stated, even weeks ago. That there are no methods supplied by the manufacturer to only grab snapshots without first saving those snapshots to a local drive or SD card with their camera modules and NVR/DVR product line and that there are no plans to change that.

I believe that the manufacturers engineers and tech support staff are telling the truth and are not saying what they are saying out of ignorance about how their firmware and software operates which they designed and that they also have no reason to lie about this.

I also have no reason to lie about the conversations I have had with this manufacturers staff. I would enjoy being able to support their products with more of the free tools I offer for Network IP Camera owners. That work with many other Network IP Cameras and NVR/DVR product lines.

Don
« Last Edit: August 10, 2015, 09:43:22 am by TheUberOverLord »

  • No avatar
  • *
August 10, 2015, 09:54:10 am
Thanks again for the always-helpful information, Don. 8) After re-defining IE security settings and establishing "local config" settings using their web page, I was able to save a bitmap image file to my local hard drive in the specified directory.

I spent some time reviewing the NetSurveillance.OCX ActiveX object yesterday. The Online Disassembler identified it as compressed code in the PECompact 2.0 format. Uncompressing the OCX yielded the underlying code for reverse engineering.  Together with Wireshark captures of the TCP/IP communications between IE and the camera, it should be possible to determine what else might be possible. ;)

  • No avatar
  • *
September 06, 2015, 11:56:40 am
Best / most humorous string found inside the executable file /usr/bin/Sofia :

Sorry, there are legal restrictions on arithmetic coding



  • No avatar
  • *
September 11, 2015, 01:08:13 pm
There's all kinds of stuff in there. I liked:

NetWork.GodEye

my god after a frame is not aframe expectNextHead %x
old to new error!

cannot brake...
which must be about remote car hacking

Did you have success modifying then installing the modified firmware without IE, MS?

  • No avatar
  • *
March 11, 2016, 05:51:07 am
first post here, but I've made some steps towards snapshot capture on xmeye firmware that I'd like to share.

I've managed to connect to the camera without dismantling it, I just enabled telnetd via the Sofia interface "shell" option and then logged in via telnet with the root password.
Searching for alternate ways to get a snapshot, I've downloaded the SDK and grep'd for snapshot keyword. Then i found the sample_venc application that gets a JPEG snapshot and stores it on a file. I cross-compiled it, and ran it on the camera via NFS share, but I had no success:

# ./sample_venc 2
Aptina AR0130 sensor 720P30fps init success!
mmap error: Invalid argument
mmap proc mem failed!
SAMPLE_COMM_ISP_Init: HI_MPI_ISP_Init failed!
SAMPLE_COMM_ISP_Run: ISP init failed!
[SAMPLE_COMM_VI_StartIsp]-1135: SAMPLE_COMM_VI_StartIsp: ISP init failed!
[SAMPLE_VENC_720P_Snap]-607: start vi failed!

and on the debug console I got:

AVenc - JPEGCapStream(7721): HI_MPI_VENC_GetChnAttr 2 err 0xa0078005

I suspect that either the memory mapping is not the same on xmeye firmware and on sample SDK or the sample_venc app requests data from a channel that does not exists in the xmeye firmware (2)

Any ideas welcome...

  • ***
March 11, 2016, 07:24:32 pm
The manufacturer of these IP Camera boards does not support using a URL to pull snapshots from IP Cameras that use their hardware.

That said. There are many ways to still get a snapshot. Including pulling one from the IP Cameras that use this manufacturers hardware RTSP video streams. More details here:

http://www.openipcam.com/forum/index.php/topic,1183.msg4630.html#msg4630

Don

  • No avatar
  • *
April 22, 2016, 06:48:55 am
Link to file partitions dead. Can you upload again please. Thanks

  • No avatar
  • *
October 31, 2016, 07:51:34 am
Spi id table Version 1.22
Hisilicon Spi Flash Controller V350 Device Driver, Version 1.10
Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17
SPI FLASH start_up_mode is 3 Bytes
Spi(cs1):
Block:64KB
Chip:8MB
Name:"MX25L6406E"
spi size: 0x8388608
chip num: 1
6 cmdlinepart partitions found on MTD device hi_sfc
Creating 6 MTD partitions on "hi_sfc":
0x000000000000-0x000000040000 : "boot"
0x000000040000-0x0000003b0000 : "romfs"
0x0000003b0000-0x000000630000 : "user"
0x000000630000-0x000000770000 : "web"
0x000000770000-0x0000007b0000 : "custom"
0x0000007b0000-0x000000800000 : "mtd"


http://www.sendspace.com/filegroup/bHzj3Z9fWdh9tx3OWlnQ6g




Hello, please have someone file the first contribution.
I contacted the author, but unfortunately I was not successful.
Please, please, thank you very much.

Paul