Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at

Recent Posts

Pages: 1 ... 8 9 [10]
Hacking & Modding / Re: In over my head/dumb questions
« Last post by admin on July 27, 2017, 06:24:45 am »
Post 5 messages, and the restriction is lifted,  its a spammer block, unfortunately if you don't make it difficult then the boards get inundated with spam.

I have removed some of the non relevant questions (the ones related to the older forum template).

Firmware / VACRON firmware format
« Last post by temp0727 on July 27, 2017, 05:12:16 am »

I have this IP camera from, I checked their firmware and couldn't find anything about it. I mean it either encypted or compressed.

Suppose it's possible to unpack/decrypt firmware. Would it be possible to modify the linux inside it and upload it back?
Firmware / Re: U-boot corrupted. Looking for recovery procedure
« Last post by miky_boy on July 24, 2017, 07:51:01 am »
Hi my friend,

You had success on booting from SD Card?

I have the same problem now.. :(

Thanks and regards
Firmware / Re: Firmware Recovery - method #2
« Last post by miky_boy on July 23, 2017, 07:40:07 pm »
Hi guys,

Trying to recover my IP Cam using the serial port i accidently deleted my bootloader.

Anybody cam help me to recever the  u-boot please?

Now when i connect the IP Cam nothing happens on Serial Port :(

Hacking & Modding / Re: In over my head/dumb questions
« Last post by salukikev on July 22, 2017, 04:19:41 pm »
Sorry I didn't get a notice of this reply until I happened back here to research!   That is a lot of info to process!  It certainly looks like there's a lot to learn!  Isn't there an option to use "pelco" protocol which addresses this directly (without having to "hack" anything?).  Also, I picked this camera board specifically due to it's diminutive size on a single board (32mm x 32mm).  If there are any more appropriate camera boards which are of this size or smaller I would be very interested in buying one of those instead!

ps.  It seems to be drastically difficult to post responses here as I have first a captcha, and then three additional questions, at least one of which is very difficult/ambiguous to answer.  For example:  "What number comes before Yan An Zhong lu in the address? (use numbers):"   What- the URL address?  The mailing address?   Nothing is listed here on this page or the home page of the site.  I have to repost this until I get a manageable question and this seems to happen each time even though I'm logged in!
Site Announcements / Forum, software updates
« Last post by admin on July 14, 2017, 03:20:24 am »
Updated forum software to 2.0.14, changed default template to the traditional default, as I need to work on the old template to make it compatible.

Added some boards for the XiaoMi camera range, as I have some, and will probably fiddle with them!

Xiaoyi Camera (小蚁) / Region lock fix
« Last post by admin on July 14, 2017, 03:08:48 am »
From my page here -

Essentially -

Enable telnet.
Kill the watchdog, and kill the camera app.
rename the api call to check the country.

Create a folder named test on an SD card.
Create a plain text file called in that folder, and add the following bash script:

Code: [Select]
# Telnet
if [ ! -f "/etc/init.d/S88telnet" ]; then
echo "#!/bin/sh" > /etc/init.d/S88telnet
echo "telnetd &" >> /etc/init.d/S88telnet
chmod 755 /etc/init.d/S88telnet
dr=`dirname $0`
# fix bootcycle
mv $dr/ $dr/

The script will enable telnet on the camera, and then rename the script so it doesn’t run again on the next boot.

Stick the prepared card into the camera, power on, and it should reboot (twice).
If you check the open ports on the camera ip you should now see port 23 (telnet) is open.

Login with the default user/pass (as below) via telnet

User: root
Password: 1234qwer

Once telnet’d in, enter the following, line by line –

Find and kill the watchdog process

killall watch_process

Find and kill /home/cloud process so we can edit it without the watchdog watch_process restarting it

killall cloud

Change the check within /home/cloud executable to query a fake domain so it never returns a failure, then reboot.

Code: [Select]
sed -i 's|||g' /home/cloud
Hacking & Modding / Re: In over my head/dumb questions
« Last post by admin on July 14, 2017, 02:13:09 am »
Really depends on the board you have, and what gpio's are available to use, and how much flash / ram (for user space software etc).

Do you have the Hi3518e SoC SDK?

You'll need the SDK to get started, and compile a rom with kernel, userfs etc
Maybe the supplier will give you a ready to use kernel/rom/userfs that you can start from.

You'll need to have a  uBoot on the board.  Hopefully will have one already, otherwise you'll also need an SPI flash programmer to program the uBoot.
You'll need to be able to setup a crosscompiler environment (suggest use Docker or similar virtualized system to setup, then you can migrate easily).
You'll need to unpack the SDK, then be able to compile kernel.
You'll need to learn how to setup rom in flash.

Suggest read the uCLinux posts from 2011 where I talk about similar things.  Its relevant, although not 100% relevant to your particular board.

Also suggest reading other peoples posts, e.g.

Good luck.

Might want to think about using something like an ESP8266 for your gimbal to control sensors, as that has wifi, and they're dirt cheap.
Firmware / Hi 3518E BLK18E-0012 50h10PE-WP Firmware
« Last post by winek0 on July 09, 2017, 04:00:13 am »
Hi I have a problem with my camera after the update does not start looking for a firmware for it.

U-Boot 2010.06-svn (Oct 14 2015 - 15:07:23)

DRAM:  256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17
Spi(cs1): Block:64KB Chip:8MB Name:"MX25L6406E"
envcrc 0xd2097268
ENV_SIZE = 0xfffc
In:    serial
Out:   serial
Err:   serial
Press Ctrl+C to stop autoboot
8192 KiB hi_sfc at 0:0 is now current device

### boot load complete: 1973968 bytes loaded to 0x82000000
### SAVE TO 80008000 !
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   linux
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1973904 Bytes = 1.9 MiB
   Load Address: 80008000
   Entry Point:  80008000

   Loading Kernel Image ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

Pages: 1 ... 8 9 [10]