Re-organized the forum to more cleanly delineate the development section, as the end user support side appears to have taken a life of its own!

Author Topic: Hacking the IPRobot3  (Read 110501 times)

  • No avatar
  • *
September 16, 2013, 03:30:58 am
Someone please confirm which plug is the IR Filter Relay.  If it is not J3, it is the other plug with red/black wires.  My camera's are in service and I do not have a camera open to confirm it.  I do recall that one plug is the IR Filter Relay and the other is for a IR led that could not be soldered to the PCB.

  • No avatar
  • *
September 16, 2013, 06:58:06 pm
I opened an IPRobot3 camera housing.   If you short the photo sensor, next to the Q506 silkscreen, it keeps the IR Night Mode off. 
As a follow up, the IR Filter relay is the red/black wire with the heat shrink on it next to J502 silkscreen. J3 is the IR LED that was not soldered.

October 06, 2013, 05:13:28 pm
To stop the IR Filter, open the camera case at the ir leds. There is a plug/cable red/black wires that runs from the filter relay to the camera pcb J3 that you can unplug to stop the relay.

I'm new to this forum - but have just bought an IPRobot3 and came across this discussion whilst looking for information regarding the poor IR picture quality.

The IR filter (or whatever it is) seems to degrade the picture quality significantly.  I have observed whilst viewing the camera output that immediately after turning the lights out - the IR LEDs come on and the picture quality is crystal clear (albeit without colour).  After a delay of a second or so - I hear the click (presumably as the filter moves across the sensor) and the picture quality degrades significantly.

I tried your suggestion about opening up the case and disconnecting the red/black cable plug at PCB J3 - but after doing so - I still get the clicking sound when I turn the lights off and the behaviour of camera seems identical to what I observed before disconnecting it.

  • No avatar
  • *
October 08, 2013, 03:30:05 am
Moony, The filter is the other plug, not the j3 one.  I now short the Photo Sensor when I need to turn off the night mode.  One other note, I have seen what seemed to be poor video where it was grainy and found it was not the camera. It was my web browser trying to size down the video to fit in a smaller area.   

October 10, 2013, 03:15:03 am

Recently i purchased a new IPRobot3.I am trying to connect my camera with my laptop with no success.SpockieTech seems to be right about the candidate serial port (J7) since this must a new
version of the camera.I would really need some help with the connection since i am new to this.I have attached two photos from left to right seems to be +5V ,transmit? ,receive? , ground.Is this going to work if i attached a usb cable?If anyone is kind enough please do pm me.

Thanks in advance.

  • No avatar
  • *
October 11, 2013, 10:15:00 am

I've also just bought an IProbot3 and just spent an hour poking around J7 using an oscilloscope ... and would NOT try to connect to it!  This connector just connects to a couple of pins on U9 (a SyncMOS SM59R02G1 8-bit microcontroller located on the back of the board underneath J7).  For the record the pins on J7 are arranged pin 1 = connects to U9 pin 26, pin 2 = +5V, pin 3 = connects to U9 pin 27, pin 4 = Ground.  Aside from a continuous 3.7MHz signal on pin 3, I couldn't see any activity on the J7 pins.

Anyway, I just noticed that my my board has J9 after all!  I'd completely overlooked it as it's tucked in amongst a tight cluster of surface-mount components.  Your board looks the same as mine; I suggest you double-check to see if it has J9.  I've attached a photo with J9 marked.


  • No avatar
  • *
October 11, 2013, 11:29:28 am
I just succeeded in establishing communication between my IProbot3 and PC via J9.  I used a cheap Chinese USB-to-TTL serial adapter cable - note that this is not just an ordinary USB cable!

The attached photo shows the interconnections.

October 11, 2013, 03:39:48 pm
This is awesome!!! Thank you.I will try this and tell you my results.Thanks again.

  • No avatar
  • *
October 12, 2013, 03:35:53 pm
A bit more info.  I used good old Windows HyperTerminal to connect to the USB/COM port (at 38400 baud as posted previously by mrc333777).  As the camera started up I could see all the Linux boot information.  Once this had finished pressing Ctrl-C brought up the login prompt ... and that's as far as I could get because I don't know the username/password :(

A couple of questions:

- Does anyone know the login username and password?  (Please PM me if necessary)

- Does anyone have a datasheet showing the pinout of the LQFP version of the GM8126 as used in the IProbot3?  The only datasheet I can find has only the pinout of the BGA package.

  • No avatar
  • *
October 26, 2013, 02:24:32 pm
Can anyone explain how to get the camera casing apart? I've tried removing the 2 small screws on the back of the casing but it still seems to be firmly held together (and I don't want to force it open!).


  • No avatar
  • *
December 01, 2013, 08:54:15 am
I am also struggeling with opening the (upper/camera part) casing of the TENVIS iprobot 3?

Could someone please explain,



  • No avatar
  • *
December 01, 2013, 10:04:02 pm
I do not cut all the LED's.  Just one leg of the green led is what I cut and then shorted the photo sensor.

To open the sensor area, remove the two screws behind the LED's and pull the half with the LED's out.  The other half stays with the base.  I did not need much force, just pull on the LED half.  Be careful of the wires still connected to the PCB. Just pull it out under about an inch to pivot it around.

At this point you can unscrew the PCB from the removed half.

Good Luck

  • No avatar
  • *
December 02, 2013, 12:55:12 pm
Telnet, root's password and other camera internals.

The telnet daemon on the IPRobot3 cannot be disabled and is open to anyone that knows root's password. This is not acceptable to me so I did something about it!

To fix this you need a TTL <-> USB (RS232) cable properly connected to the camera (see above for details).

Once you have that working boot the camera from a GM8126 SDK image on an sdcard (see above for details).

The camera will boot to a shell prompt and from here we can make the necessary changes.

The camera startup process is handled by /mnt/mtd/ which is writeable and survives reboots:

/dev/mtdblock1 on /mnt/mtd type jffs2 (rw)

The camera uses a shadow password file /etc/shadow containing the encrypted (and salted) hash of the password. It is highly unlikely anyone could reasonably decrypt it so we shall replace it instead.

At the shell prompt, change root's password - just type 'passwd' (without the quotes) and type in your new password when asked.
Now copy the shadow password file containing your new password to /mnt/mtd:

cp /etc/shadow /mnt/mtd/shadow

Next, make a copy of the script (just in case)

cp /mnt/mtd/ /mnt/mtd/

Next edit (vi is available) and at the top add:

if [ -f /mnt/mtd/shadow ]; then
  cp /mnt/mtd/shadow /etc/shadow

Save the modified and reboot the camera.

You should now be able to telnet into the camera using username root and the password you chose.

Now what?

I find the default auto exposure settings utterly inadequate for my night viewing requirements. Time to fix that...

At night, with the camera view live so you can see the difference enter the following commands (cut and paste if needed):

echo 1 > /proc/isp0/ae/ev_mode
echo w denoise 0 > /proc/isp0/command
echo w dpc 0 > /proc/isp0/command
echo w crosstalk 0 > /proc/isp0/command
echo w sharpness 0 > /proc/isp0/command

You can revert to fully auto mode (the default) with the following:

echo 0 > /proc/isp0/ae/ev_mode

You can put the camera into fully manual mode (user mode) with the following:

echo 2 > /proc/isp0/ae/ev_mode

There are a ton of other parameters you can play with see the bottom of this post for details.

Wireless just does not work on my camera using the (laughable) web interface and anyway I prefer to configure it manually.

For a typical wpa or wpa2 network all you need do is the following (substitute your ssid, passphrase and IP details)

ifconfig ra0 up
iwpriv ra0 set NetworkType=Infra
iwpriv ra0 set AuthMode=WPAPSK
iwpriv ra0 set EncrypType=AES
iwpriv ra0 set SSID="your SSID"
iwpriv ra0 set WPAPSK="your wpa-preshared key"

ifconfig ra0 netmask

Now, you have probably realised that we can put all of these changes into the script too, thus we can configure the camera settings and wireless / wired network and have those settings be re-applied at every boot. This post is already too long so I can post about that (and much more we can do) in another post if it would be useful.

Have fun!

Camera configuration parameters:

 r brightness            - Get current brightness
 w brightness VALUE      - Set brightness as VALUE, 0~100
 r contrast              - Get current contrast
 w contrast VALUE        - Set contrast as VALUE, 0~100
 r hue                   - Get current hue
 w hue VALUE             - Set hue as VALUE, 0~100
 r saturation            - Get current saturation
 w saturation VALUE      - Set saturation as VALUE, 0~100
 r gamma                 - Get current gamma setting
 w gamma VALUE           - Set gamma as VALUE
 r dpc                   - Get current defect pixel correction level
 w dpc VALUE             - Set defect pixel correction level as VALUE, 0~100
 r crosstalk             - Get current crosstalk reduction level
 w crosstalk VALUE       - Set defect crosstalk reduction level as VALUE, 0~100
 r denoise               - Get current noise reduction level
 w denoise VALUE         - Set noise reduction level as VALUE, 0~100
 r sharpness             - Get current sharpness level
 w sharpness VALUE       - Set sharpness level as VALUE, 0~100
 r auto_adj_en           - Get enable/disable status of auto adjustment function
 w auto_adj_en VALUE     - Enable or disable auto adjustment function VALUE
 r auto_cs_en            - Get enable/disable status of auto chroma suppression
 w auto_cs_en VALUE      - Enable or disable auto chroma suppression VALUE
 r auto_cs_th            - Get auto chroma suppression threshold
 w auto_cs_th VALUE      - Set auto chroma suppression threshold as VALUE
 r auto_cs_gain          - Get chroma suppression ratio
 w auto_cs_gain VALUE    - Set chroma suppression ratio as VALUE
 r sen_exp               - Get current sensor exposure time in us
 w sen_exp VALUE         - Set sensor exposure time as VALUE in us
 r sen_gain              - Get current sensor gain (2¡¦s complement fixed point Format:10)
 w sen_gain VALUE        - Set sensor gain as VALUE (2¡¦s complement fixed point Format:10)
 r mirror                - Get enable/disable status of sensor mirror function
 w mirror VALUE          - Enable or disable sensor mirror function VALUE
 r flip                  - Get enable/disable status of sensor flip function
 w flip VALUE            - Enable or disable sensor flip function VALUE
 r ae_en                 - Get enable/disable status of ISP AE
 w ae_en VALUE           - Enable or disable ISP AE function VALUE
 r awb_en                - Get enable/disable status of ISP AWB
 w awb_en VALUE          - Enable or disable ISP AWB function VALUE
 r af_en                 - Get enable/disable status of ISP AF
 w af_en VALUE           - Enable or disable ISP AF function VALUE
 r md_en                 - Get enable/disable status of ISP MD
 w md_en VALUE           - Enable or disable ISP MD function VALUE
 r knee_en               - Get enable/disable status of ISP Knee function
 w knee_en VALUE         - Enable or disable ISP Knee function VALUE
 r knee_point_x          - Get X value of knee poin
 w knee_point_x VALUE    - Set X value of knee point as VALUE, 0~4095
 r knee_point_y          - Get Y value of knee point
 w knee_point_y VALUE    - Set Y value of knee point as VALUE, 0~1023
 r shdc_ref              - Show SHDC informations
 w reload_cfg [PATHNAME] - Reload cfg file
 r reg ADDR [COUNT]      - Read ISP registers ADDR
 w reg ADDR VALUE        - Set ISP register ADDR as VALUE
 r sen_reg ADDR          - Read sensor register ADDR
 w sen_reg ADDR VALUE    - Set sensor register ADDR as VALUE
 w grab [PATHNAME]       - Grab one frame and save as PATHNAME

  • No avatar
  • *
January 01, 2014, 04:43:41 am
This post is already too long so I can post about that (and much more we can do) in another post if it would be useful.

  I have not tested any of your posted information, nor am I an *nix person, but it sure seems to me that the information is most useful / helpful.  I may be stepping out of line here being a newbie on this site, but if you have more you could post, by all means do so PLEASE!
Thank you for what you have done!

  • No avatar
  • *
January 04, 2014, 04:29:42 pm
Telnet, root's password and other camera internals.

To fix this you need a TTL <-> USB (RS232) cable properly connected to the camera (see above for details).

A big thanks to Robo pedrovski & mrc333777 and others for the progress.

I have done a foolish thing and bricked my IPROBOT 3 early version with even ending firmware .Is it possible to reload original firmware using a sd micro card or just copy files from a good copy from a donor camera  using the methods used in this thread .

Many thanks in advance  .

« Last Edit: February 09, 2014, 05:55:14 am by piecesmel »