News:

Re-organized the forum to more cleanly delineate the development section, as the end user support side appears to have taken a life of its own!

Author Topic: Aliviz 1080p Ip Camera bricked. Help finding the serial TTL port!!!  (Read 6383 times)

  • No avatar
  • *
June 24, 2014, 03:39:24 pm
Hi guys , first of all glad to find this awesome site, I've read the whole "firmware recovery method 2" topic started by admin and in hope for some solution and also in return sharing it to others(firmware pictures , steps ) i post my problem  :D.
So i have bought like 2 months ago this camera from Aliviz:http://www.aliviz.com/index.php?_m=mod_product&_a=view&p_id=446. The model is AS-H1012V/A. Having some problems to connect to a NVR i tried to change the onvif port in the setting after which the web interface stopped responding for like 20 sec and I decided it to unplug the power and plug it back. After that the camera stop responding at all , no web interface and even i couldn't get a ping reply from it. The only thing I could see is the camera connects successfully to the wireless router where i get only the mac address of the camera but no ip assignment get's done . Those from Aliviz told me they would send a new ip board module but as the camera was cheap i don't expect such support from them(they quite delaying it and went silent).

As a result I started taking apart the camera and making photos of the ip board and the sensor board. The take apart steps are quite obvious in this album :https://plus.google.com/photos/117235337908997901440/albums/6028570939245802081?authkey=CIjw2ciAmMzMcQ.

As I'm more of a software troubleshooting guy than hardware one , I need your help finding the serial TTL connection if there is one.
The pcb boards pictures are as follows (also available in he album posted above for greater zoom):


   - The first attached picture is IMX122 sensor board picture



   - Second attached picture is IP Camera main board. Could those two unused connectors be a potential candidate for serial TTL?



   - Third attached picture is IP Camera main board on the other side.
Near the right thumb i can see two copper circles  where is written TX and RX near them (i encircled them in the picture). Could that be the serial connection? If so where can i find the GND connection?



Any questions regarding the camera like for eg. the serials from chips or anything, feel free to ask.
Also more pictures taken are here in this another album:https://plus.google.com/photos/117235337908997901440/albums/6028572112507106225?authkey=CODym_6u_uiOdw

The USB->TTL adaptor is on the way (like 7-10 days) and the only tools i have are soldering iron and a multimeter. I do have a second exactly the same camera that works.
I hope someone with more knowledge in the hardware ip camera can help me get this camera unbricked(if i get it connected on serial ttl there is a good chance to get it done) and open sourced.

Regards, youdgin.

  • No avatar
  • *
July 01, 2014, 09:38:57 am
If I had to guess, I think your serial TTL access is that outlined square in the in the second pic. A square pad and 3 round pads seem to be pretty consistent from what I've seen. From what I've gathered, a multimeter should be able to help you determine the pins. Here's a couple of links that may help (I ran across them whilst trying to figure out my own situation).
http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/
http://wiki.openwrt.org/doc/hardware/port.serial#serial.port.pinouts

If you have a working cam that's exactly the same, you *should* be able to download the FW on it, then upload it to the bricked one.

Good luck and have fun!

  • No avatar
  • *
July 01, 2014, 04:07:14 pm
Hi jazzbassNick. Thank you for your response. Quite a good info I got from those 2 links :).
 
So firstly I used the multimeter to find the ground from those 4 pads and found it at the 3'rd pad (wich has no number near him). After that I went and measured the voltage of the other 3 pads (of course right before camera boots up) and this is what I found:
-Pad number 1 has a voltage at the beginning of 0V then like 20 seconds after power up it get's to 1.35V and remains constant.
-Pad number 2 has a voltage at power up of   1.92V and remains constant that way.
-Pad 3 is ground.
-Pad number 4 has a voltage at power up of       0V then like 20 seconds after power up it get's to 1.47V and remains constant.
I don't think these pads matches a serial connection.

Still I went and measured the voltage of those two copper circles from third image where I encircled them and here is what I found :)
-the copper circle labeled TX has a voltage at power up of 3.24V and varied for some good seconds between 3.24V and 1.5V after that remained constant at 3.24V. I also used a piezoelectric buzzer(witch had much better feedback than a multimeter for this purpose) and made a good pattern that matches a transmit signal. So what do yo think jazzbassNick, this could be the one ?
-the copper circle labeled RX has a voltage at power up of 3.24V and remains constant(if it's labeled RX there is a good chance is not a VCC connection).

Still quite weird that VCC 3.3V connection is missing but from what I read on devttys0 blog I don't think I need it and as ground i'll use the 3 pad(from those 4 outlined pads) witch is the nearest pad to the RX connector.

I'm still waiting for the USB->TTL adapter to arrive but I still don't know how to set it for 3.3V or 5 V serial connection. Maybe when I'll get it I'll figure it out.
The USB->TTL adapter that I purchased is this one (quite cheap but seems good :D): http://www.dx.com/p/pl2303hx-usb-to-ttl-converter-adapter-module-w-dubond-thread-blue-224704#.U7MO9vmkUz0

Thank again for the information jazzbassNick, it was helpful(the piezoelectric buzzer method hit the spot) .
Regards, Youdgin.
« Last Edit: July 01, 2014, 04:09:19 pm by youdgin »

  • No avatar
  • *
July 01, 2014, 04:37:10 pm
Cool! Glad those links helped ;)

I'm still quite a noob to all this, so I wouldn't want to speculate. My guess is that those 3.24v readings you got are the 3.3v.

I can tell you that I've been using an old Radio Shack usb-serial cable I found, but suspect it's 5v, as I haven't been able to transmit the ESC key to enter the bootloader. I'm just hoping I haven't done any permanent damage. I've got a USB TTL coming tomorrow that should help me get to the bottom of it.

Looking at the bottom of that adapter you're getting, it looks like the voltages are wired to pins, so if you do need 3.3, it's easy enough to get. One pin is 3.3 and the other is 5.

I'll keep an eye on this thread and see how it works out for you.  ;D

  • No avatar
  • *
July 01, 2014, 06:05:20 pm

I can tell you that I've been using an old Radio Shack usb-serial cable I found, but suspect it's 5v, as I haven't been able to transmit the ESC key to enter the bootloader. I'm just hoping I haven't done any permanent damage. I've got a USB TTL coming tomorrow that should help me get to the bottom of it.

Careful with those 5V , I read somewhere you could easily fry the chip. From your thread I guess you talking about a type of cable that integrates this kind of adapter DB9-USB-D5 (wich is TTL on DB9 end , interesting) taking from this datasheet on ftdi (these are adapters witch could be similar to cable adapters) :http://www.ftdichip.com/Support/Documents/DataSheets/Modules/DS_DB9-USB.pdf. As you been able to read from terminal I suspect this is NOT a DB9-USB-M or DB9-USB-F adapter in your cable wich is RS232 on DB9 end and that operates in positive and negatives ±5V and is not recommended to connect as a serial to your camera .

I'll keep an eye on your thread too :).
Take care, youdgin.
« Last Edit: July 01, 2014, 06:19:09 pm by youdgin »