Interesting.

There's a series here too that I wrote many years ago - https://www.computersolutions.cn/blog/category/ip-cam/
9 years ago! 

have had a quick look, but github loads terribly slowly in china., if you're referring to j3.jpg 左右 that means left right

gm8126 for bt mining? hah, woefully underpowered

wpa_supplicant version 2.4 and above is affected, so replace that.

That said I'm not actually sure that the version on the camera is vulnerable, it might actually be too old.

Suggest read the uBoot docs for what is (possibly) available.

http://www.denx.de/wiki/view/DULG/UBootCmdGroupInfo

a uboot is a preboot that loads the OS
You will need to see if you have an OS on your board to boot into.

I'd try some common commands like
help
ls
flinfo

and try see what partitions you have etc

I wish I could afford IDA, that was actually moderately useful.

You can't assume/guarantee that the update /upgrade mechanism will be the same for each camera though.

Looks like it loads the file via web interface into ram, writes to /tmp then does some compares to see if valid.
I'd check the .bin file you first gave to see if it passes their compare process.

Post 5 messages, and the restriction is lifted,  its a spammer block, unfortunately if you don't make it difficult then the boards get inundated with spam.

I have removed some of the non relevant questions (the ones related to the older forum template).

From my page here - http://www.computersolutions.cn/blog/2016/09/xiaomi-camera-bs-region-locking-fix/

Essentially -

Enable telnet.
Login.
Kill the watchdog, and kill the camera app.
rename the api call to check the country.

-----
Create a folder named test on an SD card.
Create a plain text file called equip_test.sh in that folder, and add the following bash script:

#!/bin/sh
# Telnet
if [ ! -f "/etc/init.d/S88telnet" ]; then
echo "#!/bin/sh" > /etc/init.d/S88telnet
echo "telnetd &" >> /etc/init.d/S88telnet
chmod 755 /etc/init.d/S88telnet
fi
dr=`dirname $0`
# fix bootcycle
mv $dr/equip_test.sh $dr/equip_test.sh.moved
reboot

The script will enable telnet on the camera, and then rename the script so it doesn’t run again on the next boot.

Stick the prepared card into the camera, power on, and it should reboot (twice).
If you check the open ports on the camera ip you should now see port 23 (telnet) is open.

Login with the default user/pass (as below) via telnet

User: root
Password: 1234qwer

Once telnet’d in, enter the following, line by line –

Find and kill the watchdog process

killall watch_process

Find and kill /home/cloud process so we can edit it without the watchdog watch_process restarting it

killall cloud

Change the check within /home/cloud executable to query a fake domain so it never returns a failure, then reboot.


sed -i 's|api.xiaoyi.com/v4/ipc/check_did|api.xiaoyi.foo/v4/ipc/check_did|g' /home/cloud
reboot


Really depends on the board you have, and what gpio's are available to use, and how much flash / ram (for user space software etc).

Do you have the Hi3518e SoC SDK?

You'll need the SDK to get started, and compile a rom with kernel, userfs etc
Maybe the supplier will give you a ready to use kernel/rom/userfs that you can start from.

You'll need to have a  uBoot on the board.  Hopefully will have one already, otherwise you'll also need an SPI flash programmer to program the uBoot.
You'll need to be able to setup a crosscompiler environment (suggest use Docker or similar virtualized system to setup, then you can migrate easily).
You'll need to unpack the SDK, then be able to compile kernel.
You'll need to learn how to setup rom in flash.

Suggest read the uCLinux posts from 2011 where I talk about similar things.  Its relevant, although not 100% relevant to your particular board.


Also suggest reading other peoples posts, e.g. https://felipe.astroza.cl/hacking-hi3518-based-ip-camera/

Good luck.

Might want to think about using something like an ESP8266 for your gimbal to control sensors, as that has wifi, and they're dirt cheap.