Author Topic: Hacking the IPRobot3  (Read 65155 times)

Offline Robo

  • Wiki Editor
  • *
  • Posts: 10
    • View Profile
Hacking the IPRobot3
« on: April 19, 2013, 10:27:29 pm »
The IPRobot3 is an HD IP Camera based on the ARM9 GM8126 chip that uses H.264 video encoding.  Like most cameras in this class, it has limitation.  It has dependency on Microsoft IE  for all the features, however, it will work with other browsers with limitations. There is a TIFF SD slot that is only visible when using IE.  The recording alarm feature will continue to record to the SD when not connected to a browser. When connected to IE, it offloads the SD stored content to your local hard drive.  There are firmware updates for the camera, but they are experiential and found in the Tenvis forums.   Be very careful when you update the firmware. Be sure your connected to the LAN and not Wifi since if you run into any problems doing a firmware upgrade, you void the warranty.

Hacking:  If you open the camera case, you will find that J9 on the main board is the serial console and with a USB to 3.3v TTL converter, it works great. The baud rate is 38400 n81 no handshaking and the pin order is 3.3v, gnd, rx, tx on the pcb (do not connect 3.3v and swap TR/RX from the converter).  The silkscreen of J9 does not indicate pin 1, so use a ohm meter to find gnd and go from there.  J9 are just solder tabs that you have to solder to.

The IRobot3 is a linux based system. It is using U-Boot as the bootloader.  With hyperterminal you can watch the linux bootlog of the camera as it loads or hit ESC in the first 2 seconds to get into U-Boot. Uboot has a lot of commands.

Get involved and share your efforts and hacks here. Items for community involvement would be to unpacking the firmware (found here  http://forum.tenvis.com/forum-redirect-goto-findpost-ptid-485-pid-1834.html  version 1.1.2.6),  build a memory map of the hardware, access the flash memory of the camera, update the UI and recompile the firmware.
« Last Edit: April 28, 2013, 01:28:19 pm by Robo »

Offline Robo

  • Wiki Editor
  • *
  • Posts: 10
    • View Profile
Disabling the IR LEDs
« Reply #1 on: April 28, 2013, 04:24:47 am »
Disabling the IR LEDs

If you have an IPRobot3 from Tenvis and you are waiting for new firmware that will control the IR LEDs, but keep the Lens filter enabled (this is the clicking sound), then you are in for a long wait! Tenvis claims it is a hardware issue and can not be controlled with firmware.  I needed the camera to work behind glass at night, so I covered the IR LEDs with aluminum tape.  It did hide the red hue of the LEDs, but still behind glass, there was some IR reflection in the shape of a crescent moon that was escaping from camera lens area.  Next I opened the optics housing and took a closer look at the sensor PCB.  U501 is the MPU that controls the IR LEDs and the lens filter. Pin 1 of U501 is the input from the photo sensor.  Pin 3 is the output control.  So, there is a case to be made that a firmware update could be made that turns off the IR Cut mode, hence, the IR LEDs would be controllable, however, it would also turn off the lens filter (that famous clicking sound) that gives the IPRobot 3 night vision.  Well for those of you like me that want night vision mode without IR LEDs, you do to next best thing, you hack the PCB with minimal alteration.  Q501 is the driver control for the IR LEDs.  A small trace cut between between Q501 and the solder point of LED6, disables the IR LED and the lens filter of the IR cut still works.  See photos bellow.  As you can see, my cut went through the top of the "5" of the Q501 silkscreen text, 

(Note: You have to be logged in openipcam to see the images)





Word of caution.  This will void your warranty and, like in a Mission Imposable Assignment Mr. Phelps,  one slip of your cutting tool and the camera will self destruct in seconds.  So be sure your up for the challenge.     

If you have a fine point soldering iron, you could install a switch to have a manual IR LED enable.  In my case, I do not want the IR LEDs on, so until I do, I am holding off installing a switch. When the day comes that I need it, I plan on soldering to the middle pin of Q501 and the LED6 solder pad (the green dots in the photo).   
« Last Edit: April 28, 2013, 09:14:03 pm by Robo »

SpockieTech

  • Guest
Re: Hacking the IPRobot3
« Reply #2 on: June 17, 2013, 10:28:09 am »
Greetings Cam Hackers.

Im presently tinkering with the IPRobots from Tenvis as the next in a long line of IPCams Ive experimented with over the years.

The IPRobots dont appear too bad so far compared to most, although Im annoyed by the loss of the relay I/O pins that I like to use to activate interior and exterior lights from my phone (IPCamViewer).

Im tinkering around inside trying to find if there is an output I can tap into with a buffered relay driver to restore this functionality.  The WebGUI refers to alarm inputs and outputs, so Im hoping they are in there, but cant see anything yet.

This may be a "new version" of the IPRobot, since it has an SDCard Slot, and looking inside, the most likely candidate for the serial port seems to be J7 rather than J9 as Ive read here.

Im quite comfy with ucLinux and Microcontrollers, I was considering adding an I2C based I/O chip to the onboard I2C channels, but then Id likely have to hack up some code and custom webgui stuff to run it..  Id much rather find the existing I/O channels if they are in there.

I can see its the Grain ARM9 SOC and various other recognisable chips, but nothing that leaps out at me as an I/O driver chip.  If noone can suggest where to start looking, Ill have to wade into the 8126 datasheet.

Any Clues ?

Offline TheUberOverLord

  • Full Member
  • ***
  • Posts: 236
  • But I Thought?
    • View Profile
    • About Me
Re: Hacking the IPRobot3
« Reply #3 on: June 17, 2013, 11:53:14 am »
Greetings Cam Hackers.

Im presently tinkering with the IPRobots from Tenvis as the next in a long line of IPCams Ive experimented with over the years.

The IPRobots dont appear too bad so far compared to most, although Im annoyed by the loss of the relay I/O pins that I like to use to activate interior and exterior lights from my phone (IPCamViewer).

Im tinkering around inside trying to find if there is an output I can tap into with a buffered relay driver to restore this functionality.  The WebGUI refers to alarm inputs and outputs, so Im hoping they are in there, but cant see anything yet.

This may be a "new version" of the IPRobot, since it has an SDCard Slot, and looking inside, the most likely candidate for the serial port seems to be J7 rather than J9 as Ive read here.

Im quite comfy with ucLinux and Microcontrollers, I was considering adding an I2C based I/O chip to the onboard I2C channels, but then Id likely have to hack up some code and custom webgui stuff to run it..  Id much rather find the existing I/O channels if they are in there.

I can see its the Grain ARM9 SOC and various other recognisable chips, but nothing that leaps out at me as an I/O driver chip.  If noone can suggest where to start looking, Ill have to wade into the 8126 datasheet.

Any Clues ?

It seems that there is alarm in/out (GPIO)

http://www.openipcam.com/files/ARM9/GM8126/GM8126%20v1.1/Docs/EVB_User_Guide/GM8126_EVB_User_Guide_V1.1.pdf

More GM8126 files here:

http://www.openipcam.com/files/ARM9/GM8126/

Don

SpockieTech

  • Guest
Re: Hacking the IPRobot3
« Reply #4 on: June 21, 2013, 12:21:32 pm »
Thanks for the link to the GM816 files. Some Interesting reading. 

Unfortunately, even after reading them, there are no Pin-out details that I could find there or on GrainMedia's site which makes it hard to track down the GPIO pins.   Found the ULN darlington driver chips on the board, but they seem to be for driving the motors.

Does anyone know where I might find pin outs for the GM8126 ?

regards
Brett

Offline mrc333777

  • Newbie
  • *
  • Posts: 3
    • View Profile
Re: Hacking the IPRobot3
« Reply #5 on: June 21, 2013, 11:57:49 pm »
from the bottom, j9 with the mic facing you and ethernet away from you at 38400 8n1

left to right

+3.3v , ground , receive , transmit - J9

MP SPI-NOR Bootstrap v0.2
Boot image offset: 0x10000. Booting Image .....
0567Will set the following freq...
PLL1: 800 MHz, PLL2: 540 MHz, CPU freq: 540 MHz, AHB freq: 270 MHz, DDR freq: 800 MHz
go...

*********************************************
Please input Space to run Linux
Please input ESC to run UBOOT
Please input . to run burn-in
Otherwise, system will run Linux after 2 sec
*********************************************
Load image from SPI-NOR offset 0x80000 to sdram 0x4000000
Jump 0x4000000
Uncompressing Linux...
................................................... done, booting the kernel.
Linux version 2.6.28 (song@songzc) (gcc version 4.4.0 (Faraday C/C++ Compiler Release 20100325) ) #189 PREEMPT Thu Dec 13 18:43:33 CST 2012
CPU: FA626TE [66056261] revision 1 (ARMv5TE), cr=0000797f
CPU: VIPT aliasing data cache, VIPT aliasing instruction cache
Machine: Faraday GM8126
Warning: bad configuration page, trying to continue
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: mem=128M console=uart,shift,2,io,0xF9830000,38400
Early serial console at I/O port 0xf9830000 (options '38400', shift 2)
console [uart0] enabled
PID hash table entries: 512 (order: 9, 2048 bytes)
IC: GM8128 MP
GM Clock: CPU = 540 MHz, AHBCLK = 270 MHz, PLL1CLK = 800 MHz, PLL2CLK = 540 MHz
console handover: boot [uart0] -> real [ttyS0]
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 123064KB available (3398K code, 215K data, 3060K init)
Calibrating delay loop... 534.52 BogoMIPS (lpj=267264)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
net_namespace: 636 bytes
Fmem: node 0 is online, alloc pages = 20480(active pages = 32768)
high_memory:0xc8000000, VM Start:0xc8800000, End:0xe0000000
NET: Registered protocol family 16
PMU: Mapped at 0xf9900000
pmu_get_cpu_clk:221 <fclk_mode=2, pll2_out=540000000>
Attach GM AHB-DMA Driver
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
Video Timer(timer3) Max 31000ms in 0xf9720840 HZ.
# of pwm can be used = 8
MPFX:
Register PWM character driver success!

JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
msgmni has been set to 240
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
probe ftgpio010.0 OK!!, at c8814000
probe ftgpio010.1 OK!!, at c8818000
probe ftgpio010.2 OK!!, at c881c000
Serial: 8250/16550 driver 4 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xf9830000 (irq = 9) is a 16550A
serial8250: ttyS1 at I/O 0xf9840000 (irq = 10) is a 16550A
serial8250: ttyS2 at I/O 0xf9850000 (irq = 20) is a 16550A
serial8250: ttyS3 at I/O 0xf9880000 (irq = 21) is a 16550A
brd: module loaded
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Linux video capture interface: v2.00
Driver 'sd' needs updating - please use bus_type methods
Driver 'sr' needs updating - please use bus_type methods
Can't identify flash type, use default setting
Creating 6 MTD partitions on "wb_spi_flash":
0x00080000-0x0051f000 : "Linux Section"
0x00520000-0x00800000 : "User Section"
0x00001000-0x00010000 : "Loader Section"
0x00010000-0x00060000 : "BurnIn Section"
0x00060000-0x00080000 : "UBoot Section"
0x006e0000-0x00700000 : "CFG Section"
Probe FTSSP010 SPI Controller at 0x98200000 (irq 6)
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
AMBA bus_register ok
Enter Device A
temp = 340
Drive Vbus because of ID pin shows Device A
otg2xx device_register ok
AMBA_bus_match(...) Found Driver FOTG2XX_DRV
AMBA_bus_match(...) Found Driver FOTG2XX_DRV
FOTG2XX_DRV fotg2xx_dev: GM  USB2.0 Host Controller
FOTG2XX_DRV fotg2xx_dev: new USB bus registered, assigned bus number 1
FOTG2XX_DRV fotg2xx_dev: irq 4, io mem 0xf9220000
FOTG2XX_DRV fotg2xx_dev: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
FOTG200 Controller Initialization
fotg200 int enable = 1f30
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
ftiic010 ftiic010.0: irq 18, mapped at c887e000
Advanced Linux Sound Architecture Driver Version 1.0.18rc3.
ALSA device list:
  No soundcards found.
TCP cubic registered
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
GPIO-9 autorequested

IC Card Registered.
initlializing alert gpio ...
gm8126 alarm in/out device driver initialized.
Freeing init memory: 3060K
usb 1-1: new high speed USB device using FOTG2XX_DRV and address 2
port status 10009
2nd port status 10009
***************************************
Busybox starts to run
***************************************
Mounting root fs rw ...
Mounting other filesystems ...
Setting hostname ...
Mounting user's MTD partion
Has JFFS2 on mtdblock1
FTMAC with FARADAY Internal PHY support
FTMAC110 Driver (Linux 2.6) 01/10/11 - (C) 2011 GM Corp.
reset Faraday Internal PHY.
mmc0: SDHCI controller on <NULL> [ftsdc010] using DMA

Frammap: 1536 pages in DDR0 are freed.
Frammap: DDR0: memory base=0x1800000, memory size=0x4a00000, alignment=256K
Frammap: version 0.28.3, 1 DDR is managed.

VideoGraph v0.44 You may use
   #echo 11 > /proc/videograph/dbg
to enable debug mode (0xbf04a50c)
Debug message at 0xc88d2000 start pointer 0xbf06a5f0 size 0x124f80
Insert dvr_common driver done.
Platform GM812600
    enc_in0=(buf: 1843200,4,0)
    enc_in0_d=(buf: 1843200,4,1)
    enc_out0=(res: 1280,720)
    enc_out0=(buf: 783360,4,0)
    ssenc_out0=(buf: 261120,1,0)
    enc_in1=(buf: 1843200,4,0)
    enc_in1_d=(buf: 1843200,4,1)
    enc_out1=(res: 1280,720)
    enc_out1=(buf: 783360,4,0)
    scl0_out1=(res: 848,480)
    scl0_out1=(buf: 829940,4,0)
    ssenc_out1=(buf: 783360,1,0)
    enc_in2=(buf: 1555200,4,0)
    enc_in2_d=(buf: 1555200,4,1)
    enc_out2=(res: 1080,720)
    enc_out2=(buf: 660960,4,0)
    ssenc_out2=(buf: 65280,1,0)
    enc_in3=(buf: 35840,4,0)
    enc_in3_d=(buf: 35840,4,1)
    enc_out3=(res: 160,112)
    enc_out3=(buf: 20000,4,0)
    ssenc_out3=(buf: 15232,1,0)
    sub1_enc_out3=(res: 160,112)
    sub1_enc_out3=(buf: 20000,3,0)
    sub2_enc_out3=(res: 160,112)
    sub2_enc_out3=(buf: 20000,3,0)
ISP v2.05, built @ May  7 2012 15:48:47
set cmos clk out 24545454 Hz
i2c-adapter i2c-0: NAK!
i2c-adapter i2c-0: I2C TX data 0x12 timeout!
sensor_i2c_transfer fail: i2c_transfer not OK
sen_ov9710(init): OV9710 init fail!!
insmod: cannot insert '/lib/modules/fisp_ov9710.ko': No such device
fcap: V0.3.13
vcap_dev:
  • :bAlbum_bug=0, bCrop_bug=1, bCU_bug=0

                LL_BusDeadlock_bug=0, bSupportSplitOSDDispRamWritePort=1

fcap:
  • : Link List mode!

fcap: fosd00: minor=54
fcap: fosd02: minor=53
fcap: fosd01: minor=52
fcap: fosd03: minor=51
vcap_dev: [1]:bAlbum_bug=0, bCrop_bug=1, bCU_bug=0
                LL_BusDeadlock_bug=0, bSupportSplitOSDDispRamWritePort=1

fcap: [1]: Link List mode!
fcap: fosd10: minor=50
fcap: fosd12: minor=49
fcap: fosd11: minor=48
fcap: fosd13: minor=47
load CFG: /mnt/mtd/isp_ov9710.cfg
isp_dev(dev_init):
  • Input device does not exist!


isp_drv(isp_drv_init_dev):
  • : initial fail!

Unable to handle kernel NULL pointer dereference at virtual address 00000008
pgd = c6620000
[00000008] *pgd=06618031, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT
Modules linked in: fcap200_isp(+) fcap1 fcap0 fcap_common fisp_gm_awb fisp_gm_ae fisp0 fisp_common dvr_enc dvr_common videograph frammap ftsdc010 cpe_wdt ftmac100
CPU: 0    Not tainted  (2.6.28 #189)
PC is at isp_dev_set_sensor_size+0x20/0x88 [fisp_common]
LR is at Isp_Set_Size+0x70/0x9c [fisp_common]
pc : [<bf10bc4c>]    lr : [<bf1126b4>]    psr: a0000013
sp : c666fd78  ip : c666fda8  fp : c666fda4
r10: 40025000  r9 : c666e000  r8 : 000002d0
r7 : c6520000  r6 : 00000500  r5 : 00000500  r4 : c666fda8
r3 : 00000000  r2 : 00000500  r1 : c666fda8  r0 : c6520000
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 0000797f  Table: 06620000  DAC: 00000017
Process insmod (pid: 79, stack limit = 0xc666e268)
Stack: (0xc666fd78 to 0xc6670000)
fd60:                                                       c6520000 c666fd94
fd80: c666fdb4 c666fda0 000002d0 00000500 00000500 c6520000 c666fdd4 c666fda8
fda0: bf1126b4 bf10bc3c 00000500 000002d0 bf10f888 bf1864e0 00000000 bf186388
fdc0: 00000000 bf1863a0 c666fe14 c666fdd8 bf189384 bf112654 00000000 00000001
fde0: 00000000 00000000 c0448f38 c0448c60 c666fe54 bf1863a0 bf189000 00000000
fe00: 00000000 c0308104 c666ff7c c666fe18 c0306a44 bf189010 c666fe88 00000001
fe20: c666fe84 c666fe30 c03aa0c0 c0591608 c7008a00 c666fe40 c666fe6c c075bda0
fe40: c065ce24 40000013 c666fe7c c666fe58 c034f3b4 c034cc70 00000000 80000013
fe60: c666fe84 c666fe70 c03132dc c0313238 c065ce24 c068f000 c666fea4 c666fe88
fe80: c03654a4 c03132d8 00000002 c6589520 00000003 00000001 c666fec4 c666fea8
fea0: c0363058 c0365474 00000000 bf1863a0 c6549660 00000001 c666fed4 c666fec8
fec0: c0363088 c0362fe0 c666ff7c c666fed8 c0343654 c0363084 00000000 c666ff48
fee0: c065cbb0 c0341ae4 c8e286a4 c8e27000 c8e285cd 00000046 c8e286a4 c8e286a4
ff00: c666ff34 c8e28e9c 00000046 c65497a0 c8e28a14 00000015 bf1863a0 bf1863e8
ff20: bf185b38 00000017 00000000 00000000 00000000 00000000 00000000 00000000
ff40: 00000000 bf1863a0 00075008 00000000 000026ac c0308104 c666ff7c c666ff68
ff60: bf1863a0 00075008 00000000 000026ac c666ffa4 c666ff80 c0343920 c0306a00
ff80: 60000010 ffffffff 000026ac 00060850 bea99f4d 00000080 00000000 c666ffa8
ffa0: c0307f80 c0343898 000026ac 00060850 00075038 000026ac 00075008 bea99f4d
ffc0: 000026ac 00060850 bea99f4d 00000080 000000f0 00000000 40025000 00000000
ffe0: bea99cc0 bea99cb0 000128d4 400e9420 60000010 00075038 ffffffff ffffffff
Backtrace:
[<bf10bc2c>] (isp_dev_set_sensor_size+0x0/0x88 [fisp_common]) from [<bf1126b4>] (Isp_Set_Size+0x70/0x9c [fisp_common])
 r7:c6520000 r6:00000500 r5:00000500 r4:000002d0
[<bf112644>] (Isp_Set_Size+0x0/0x9c [fisp_common]) from [<bf189384>] (init_module+0x384/0x45c [fcap200_isp])
 r8:bf1863a0 r7:00000000 r6:bf186388 r5:00000000 r4:bf1864e0
[<bf189000>] (init_module+0x0/0x45c [fcap200_isp]) from [<c0306a44>] (__exception_text_end+0x54/0x17c)
 r8:c0308104 r7:00000000 r6:00000000 r5:bf189000 r4:bf1863a0
[<c03069f0>] (__exception_text_end+0x0/0x17c) from [<c0343920>] (sys_init_module+0x98/0x184)
 r7:000026ac r6:00000000 r5:00075008 r4:bf1863a0
[<c0343888>] (sys_init_module+0x0/0x184) from [<c0307f80>] (ret_fast_syscall+0x0/0x2c)
 r7:00000080 r6:bea99f4d r5:00060850 r4:000026ac
Code: e59f306c e5912000 e7903003 e1a04001 (e5937008)
---[ end trace 0aed37a78ebccb83 ]---
SCL: Version, v1.17
SegmentSCL: div:4
ation fault
FAVC Encoder IRQ mode(29)v4.2.1
FAVC codec Max Resolution is 1280x720, built @ May 15 2012 15:43:33
MCP100 driver with CPU for VG,
GM8126 MPEG4 with CPU for VG, decoder ver: 3.2.2, encoder ver: 3.2.8, built @ May 14 2012 15:30:49
GM8126 MJPEG with CPU for VG, encoder ver: 3.2.5, decoder ver: 3.1.4, built @ May 14 2012 15:30:35

FTDI210 registers 32 entities to video graph!
FTDI210 Driver v1.4 (1 engine(s))
ft-32ssp: common[ver:0.3.4] INIT OK!
card->cardno = 2
card->pbase = 98a00000
card->vbase = c8efc000
card->irq = 11
my_card->capture.dma_ch = 4
my_card->playback.dma_ch = 5
AHB DMA Interrupt Mode
AHB DMA Interrupt Mode
ft-32ssp: SoundCard(2) attached OK (c14239d0)
I2S probe ok in Slave mode.
ftrtc011_init()
ftrtc011 ftrtc011: rtc core: registered ftrtc011 as rtc0
rtusb init --->
usbcore: registered new interface driver rt2870
usb 1-1: configuration #1 chosen from 1 choice


=== pAd = c9202000, size = 502944 ===

<-- RTMPAllocAdapterBlock, Status=0
ADDR: 00:84:14:81:26:00
ftmac110_link_change:2113 <SPEED100>
ftmac110_link_change:2127 <FULL>
/mnt/mtd/boot.sh: line 51: can't create /proc/isp0/ae/ev_mode: nonexistent directory
mke2fs 1.41.12 (17-May-2010)
ext2fs_check_if_mount: Can't check if filesystem is mounted due to missing mtab file while determining whether /dev/ram0 is mounted.
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
Stride=0 blocks, Stripe width=0 blocks
1024 inodes, 4096 blocks
204 blocks (4.98%) reserved for the super user
First data block=1
Maximum filesystem blocks=4194304
1 block group
8192 blocks per group, 8192 fragments per group
1024 inodes per group

Writing inode tables: done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 35 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
WDT base virtual address = c8fd4000
*** TAS-Tech IPCAM/DVS
*** Version: 1.2.0.3
*** Release date: 2012-12-21 15:02:04
esam auth ok.
Unsupported stop bits
CTP Server Started at  9999
killall: udhcpc: no process killed
<-- RTMPAllocTxRxRingMemory, Status=0
-->RTUSBVenderReset
<--RTUSBVenderReset
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 5
2. Phy Mode = 5
NVM is Efuse and its size =2d[2d0-2fc]
phy mode> Error! The chip does not support 5G band 5!
RTMPSetPhyMode: channel is out of range, use first channel=1
3. Phy Mode = 9
MCS Set = ff 00 00 00 01
<==== rt28xx_init, Status=0
0x1300 = 00064300
ip of ra0= 6301A8C0
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 ra0
0.0.0.0         192.168.1.254   0.0.0.0         UG    0      0        0 ra0
IOTC version: 1070300, AVApi version: 1020800
All ervices started.
ntpclient: cann't resolve host time.nist.gov

SpockieTech

  • Guest
Re: Hacking the IPRobot3
« Reply #6 on: June 22, 2013, 02:25:11 am »
Yes, thanks for the dump, I figured out the serial port no problem.

Unfortunately, what Im looking for is the GPIO pins from the GM8126 chip so I can find out if any of them are triggered by the webgui "light" button, or from IPCamViewers Relay function.   

I want to add relay control functionality to the IPRobot to switch exterior lights on and off.  If I can find a pin that toggles, I can add a buffered relay driver to it.   An external input for a PIR trigger would be nice as well, since noise on the image makes the motion sensing function a bit sketchy.   

So, hopefully, the I/O pins are still in there, and just not used.

From this part of the dump, it looks like they might be, just need to know the physical pins so I can trace where they are going.

probe ftgpio010.0 OK!!, at c8814000
probe ftgpio010.1 OK!!, at c8818000
probe ftgpio010.2 OK!!, at c881c000

regards
Brett

Offline roller

  • Newbie
  • *
  • Posts: 2
    • View Profile
Re: Disabling the IR LEDs
« Reply #7 on: July 14, 2013, 08:03:44 pm »
Disabling the IR LEDs

If you have an IPRobot3 from Tenvis and you are waiting for new firmware that will control the IR LEDs, but keep the Lens filter enabled (this is the clicking sound), then you are in for a long wait! Tenvis claims it is a hardware issue and can not be controlled with firmware.  I needed the camera to work behind glass at night, so I covered the IR LEDs with aluminum tape.  It did hide the red hue of the LEDs, but still behind glass, there was some IR reflection in the shape of a crescent moon that was escaping from camera lens area.  Next I opened the optics housing and took a closer look at the sensor PCB.  U501 is the MPU that controls the IR LEDs and the lens filter. Pin 1 of U501 is the input from the photo sensor.  Pin 3 is the output control.  So, there is a case to be made that a firmware update could be made that turns off the IR Cut mode, hence, the IR LEDs would be controllable, however, it would also turn off the lens filter (that famous clicking sound) that gives the IPRobot 3 night vision.  Well for those of you like me that want night vision mode without IR LEDs, you do to next best thing, you hack the PCB with minimal alteration.  Q501 is the driver control for the IR LEDs.  A small trace cut between between Q501 and the solder point of LED6, disables the IR LED and the lens filter of the IR cut still works.  See photos bellow.  As you can see, my cut went through the top of the "5" of the Q501 silkscreen text, 

(Note: You have to be logged in openipcam to see the images)





Word of caution.  This will void your warranty and, like in a Mission Imposable Assignment Mr. Phelps,  one slip of your cutting tool and the camera will self destruct in seconds.  So be sure your up for the challenge.     

If you have a fine point soldering iron, you could install a switch to have a manual IR LED enable.  In my case, I do not want the IR LEDs on, so until I do, I am holding off installing a switch. When the day comes that I need it, I plan on soldering to the middle pin of Q501 and the LED6 solder pad (the green dots in the photo).   

Thanks for this post Robo
i have a question for you
I want to use the IpRobot 3 looking through the bedroom window at my driveway I don't need nightvision as there is a 500 watt pir floodlight outside, how do I disable ir led's and night vision (the clicking noise will keep me awake) plus power led.
When i say how do I disable them I should say it will  be done by a friend who repairs pc's and laptops as a business so is a wizard with the soldering iron.
TIA
roller

hatoscano

  • Guest
Re: Hacking the IPRobot3
« Reply #8 on: August 03, 2013, 04:39:29 am »
« Last Edit: August 03, 2013, 05:36:51 am by hatoscano »

hatoscano

  • Guest
Re: Hacking the IPRobot3
« Reply #9 on: August 03, 2013, 05:16:59 pm »
which is the red o blue, in the fhoto? you have the same camera, iprobot3 (GM8126)?

Offline mrc333777

  • Newbie
  • *
  • Posts: 3
    • View Profile
Re: Hacking the IPRobot3
« Reply #10 on: August 04, 2013, 06:59:29 am »
none of those two photos
the bottom of the board, not the top

from the bottom, j9 with the mic facing you and ethernet away from you at 38400 8n1

left to right

+3.3v , ground , receive , transmit - J9
make a photo of the bottom

Offline wiredcharlie

  • Newbie
  • *
  • Posts: 1
    • View Profile
Re: Hacking the IPRobot3
« Reply #11 on: August 06, 2013, 06:48:15 am »
Does anyone know the telnet user/password or have a suggestion as to how to get them, please?

Offline roller

  • Newbie
  • *
  • Posts: 2
    • View Profile
Re: Hacking the IPRobot3
« Reply #12 on: August 10, 2013, 02:00:28 pm »
Robo didnt reply so I'm posting my question again, if I can't get an answer soon the iprobot 3 will be going on Ebay and I'll buy a Foscam.
I want to use the IpRobot 3 looking through the bedroom window at my driveway I don't need nightvision as there is a 500 watt pir floodlight outside, how do I disable ir led's and night vision (the clicking noise will keep me awake) plus power led.
When i say how do I disable them I should say it will  be done by a friend who repairs pc's and laptops as a business so is a wizard with the soldering iron.
TIA
roller

Offline zaspany

  • Newbie
  • *
  • Posts: 1
    • View Profile
Re: Hacking the IPRobot3
« Reply #13 on: August 22, 2013, 01:12:01 pm »
I repeat the question if anyone has the password for telnet and can send them to me at PM.
The guys from Tenvis not write the amendment and I wanted to write a script to remove old films of sd

Offline Robo

  • Wiki Editor
  • *
  • Posts: 10
    • View Profile
Re: Hacking the IPRobot3
« Reply #14 on: September 16, 2013, 03:23:23 am »
To stop the IR Filter, open the camera case at the ir leds. There is a plug/cable red/black wires that runs from the filter relay to the camera pcb. You can unplug one of them to stop the relay.
Robo 
« Last Edit: October 29, 2013, 12:56:51 am by Robo »