WiFi IP cameras on the Ingenic T10 processor (I21AG, HX-I2110T2, HW0036 and others)



Rep: (58)
WiFi IP cameras on the Ingenic T10 processor (I21AG, HX-I2110T2, HW0036, Digoo BB-M2 and others)
The camera has many clones from different "manufacturers": SANNCE I21AG; MixSight HX-I2110T2; Wan Scratch HW0036; Escam G02 and others.
In 2018, a new camera modification was released that works only through JoyLite. The happy owners of such cameras can not read the topic!
Joylite
1. The firmware can be merged, but there is no point in this - self-repair of the firmware from the memory card is provided.
2. The web interface is missing as a class.
3. No applications other than JoyLite work with the camera. JoyLite worksonlyvia the Internet, if the provider does not block the cloud.
4. The firmware is incompatible with old cameras - neither up nor down.
5. Discussion of all this is in the subject, if interested - the beginninghere, also see posts for fall 2018.


Attached Image


Important!
For the initial connection, you need an Android / iOS tablet. In the future, access is also possible from a computer / DVR.
Instructions for connecting in Russian
Access string in browser:http: // your_camera_ip: 81 /. In new firmware, the access port has been changed. Read the instructions or use Search-Production_Tools.
Full-size video 1280 * 1720 is available only in IE (after installing the plugin, link at the bottom of the page). In other browsers, the size is 640 * 360
You can watch the RTSP stream in the VLC player.
In my opinion, the most convenientOnvif device menager- he finds all the cameras in LAN, he can watch and record video in any available quality.

Some cameras can operate in access point mode, creating their own SSID. However, in those cameras that I visited, this functionality is cut.

Vulnerabilities are known in the camera software, therefore it is recommended to close the Internet for the camera on the router. If remote access is expected, open only the necessary ports.
In particular, there is a vulnerability that allows you to get a login / password in clear form, which gives full access to the camera.
And do not dismiss this under the pretext that anyone is interested in the view of mine .. insert the right one ..
Full access is used including for a botnet. In addition, it is believed that the scorching of cameras in some cases is connected with unauthorized access.

If your camera works, take ten minutes to createbackup firmware.This will save you a lot of time and nerves in the future.
And if you post (or send me) your backup, it will help other people. For my part, I promise to depersonalize the firmware (it will not have your data) and post it.

The firmware laid out below exactly works with such boards
Attached Image
Attached Image
Attached Image

Options
Specifications:
Processor: Ingenic T10
Image Sensor: 1/4 inch CMOS
Pixels: 1.0MP megapixels
Resolution: 1280 * 720
Frame Rate: 1-25fps
Record Mode: Scheduled / motion
Compression Format: H.264
Focus: 3.6mm fixed lens
LED: 6pcs IR LEDs, IR distance 10m
Low Lux: 0lux (IR LED on)
Digital Zoom: No; Remote Playback: Yes
Alarm Linkage: Snapshot, record, send email, APP message
Preset: 16 maximum; Online User: 4 maximum
Storage: support 64G TF Card
WiFi Protocol: 802.11b / g / n, one key set
Phone / pad APP: support Android / iOS OS
Browser: support IE, Firefox, Chrome, etc
APP Language: English, Chinese
Protocol: P2P, WiFi, HTTP, DHCP, SMTP, FTP, RTSP
Material: ABS plastic; Size: 9.6 * 9.1 * 12cm
MiniFAQ
Cameras do not know how to write video to the cloud / on ftp. Questions about this will be regarded as a flood.

Vlc player
rtsp: // your_camera_ip: 10554 / tcp / av0_0 first stream - HD
rtsp: // your_camera_ip: 10554 / tcp / av0_1 second stream (lower quality)
if it doesn’t start without a password, then this look:
rtsp: // your_camera_ip: 10554 / user = admin & password = & channel = 1 & stream = 0.sdp? real_stream

Ftp connection

Access via telnet.
1st method: install DIGMA, connect the camera in it, go to the settings, turn on telnet. DIGMA will tell us the username / password, by default it is root / hslwificam.

2nd method: reset telnet password.
1. Go Intenet Explorer (and only them) athttp: // your_camera_ip: 81 /
2. Select livestream mode (for Explorer) and go to the camera settings
3. Select Alarm Service Setting, then Ftp service settings.
4. In the field “FTP Server” enter: $ (killall telnetd)
5. In the field “FTP User” enter: $ (telnetd -l / bin / sh)
6. Click “set up”, then click “test”
7. A pop-up window will pop up with a test error message. This means that everything went fine and we have access to Telnet without a password.

Email alert settings:
As I understand it, the address for authorization should not exceed 7 characters + @ gmail.com, I could not configure the Yahoo address.
And forward 465 ports on the modem.
smtp gmail-a (SSL) works through port 465, and you need an open port for the camera to send a message
The name "User" must be complete, i.e. [email protected]
And secondly, SSL must be set to TLS

one more moment:
My account uses two-step authentication, and therefore there is no authorization.
Everything is solved quite easily,
1. go to the addresshttps: //security.googl...pppasswords&e=65716150
2. Log in
3. In the "Application" drop-down list, select "Other (enter a name)"
4. Name your application (I have wificam1)
5. Google will generate a password for this application, enter it in the camera settings !!!

if you are configuring not on gmail - read the instructions on the mail server.

Some mobile operators block Chinese clouds. You can get around setting up a VPN.
VPN setup example
If the camera is warming
In the normal state, the camera is a little warm, when you turn on the infrared light - it becomes noticeably warmer, this is normal.
Strong heating, and even more so - the appearance of a smell indicates a malfunction, you need to look for the cause.
One of the possible - increased supply voltage. There are several stabilizers on the board, their location and voltage are visible in the picture.
Attached Image


If you can’t find a reason, you can at least stick a radiator,how did itmih12345
Recovery
If the camera responds in the terminal and responds to keystrokes - there is hope to restore a little blood. Everything is quite simple (with straight hands)

1. disassemble the camera
2. Find on the main UART board. in our camera, these are three unsealed contacts near the flash drive slot. closest to the GND slot, then TX and RX. *
3. connect to the computer through the adapter. There are a lot of adapters on the network: home-made ones, from old phones, self-assembly kits, ready-made ones on the same Ali.
4. On the computer, run the terminal. On Windows "native" HyperTerminal, Linuxsoids usually recommend PuTTY. there is no difference - the whole thing is a habit. I personally liked Terminal by Bray ++ - all the settings in front of you are in the main window and you can change them on the fly
4.1 HyperTerminal from XP.Attached filehypertrm.rar(21.23 KB)

5. We expose for communication the port that our adapter has become, the speed is 115200, 8bit, none, 1, none. start a session
6. turn on the power to the camera and see what it writes to the terminal.
7. if at least the initial boot goes fine - we start working with it.

* For starters, we connect only to GND and TX. After making sure that the output is on, we also connect RX.
Explanation: With some adapters, the camera may not start with an RX connected. in this case, connect the RX through a 4.7k resistor.
Attached Image

about UART adapters
The simplest COM-TTL converter
example of probes for connection. the diameter of the sting should be no more than 0.5mm, otherwise they will not hold.
Attached Image


At the moment, at least three firmware options are known. Two of them are poorly compatible with each other, although they have the same U-boot. The third one (with kernel Jun 2 12:28:35 CST 2017) is not compatible with the U-boot from the previous ones and requires editing startup parameters. For this reason, the information previously published here has become irrelevant and may lead to a result opposite to what was expected.
Show the boot log and printenv in U-boot. Further actions depend on what you have and what you want to receive.
Outdated Information
Often the camera stops working due to a rally of settings.
we check, for this we enter env print in the terminal and check
The correct settings log
isvp # env print
baudrate = 115200
bootargs = console = ttyS1,115200n8 mem = 39M @ 0x0 ispmem = 5M @ 0x2700000 rmem = 20M @ 0x2C00000 init / linuxrc rootfstype = squashfs init = / linuxrc rootfstype = squashfs root = / dev / mtdblock2 rwztds boot) , 2176k (kernel), 3584k (rootfs), 2176k (system) quiet
bootcmd = sf probe; sf read 0x80600000 0x40000 0x280000; bootm 0x80600000
bootdelay = 1
ethact = Jz4775-9161
ethaddr = 00: 11: 22: 33: 44: 55
gatewayip = 193.169.4.1
ipaddr = 193.169.4.81
loads_echo = 1
netmask = 255.255.255.0
serverip = 193.169.4.2
stderr = serial
stdin = serial
stdout = serial

here we are interestedbootargs. the sizes of some areas may vary depending on the firmware. this is normal.ethaddr, gatewayip, ipaddr, serveripnot important.
If abootargsdifferent - restore:
setenv bootargs console = ttyS1,115200n8 mem = 39M @ 0x0 ispmem = 5M @ 0x2700000 rmem = 20M @ 0x2C00000 init / linuxrc rootfstype = squashfs init = / linuxrc rootfstype = squashfs root = / dev / mtdblocks rk mbbparts 256 = , 2176k (kernel), 3584k (rootfs), 2176k (system) quiet

you need to dial by hand and without errors: the camera does not understand the clipboard, it does not always respond adequately to backspace.
if you make a mistake, erase the entire line, press Enter and repeat the entry. after that we write printenv and make sure that the boot line is accepted and we haven’t messed up anywhere. if everything is OK -env saveandboot
must start.
Do not start? We enter such a line
setenv bootargs console = ttyS1,115200n8 mem = 39M @ 0x0 ispmem = 5M @ 0x2700000 rmem = 20M @ 0x2C00000 init / linuxrc rootfstype = squashfs init = / linuxrc rootfstype = squashfs root = / dev / mtdblocks rk mbbparts 256 = , 2176k (kernel), 3584k (rootfs), 2176k (system) init = / bin / sh

check, boot, wait a couple of minutes, distort the food. If it doesn’t help, go to the next spoiler.

If everything is OK - disconnect from the computer, collect the camera and enjoy life))

Recovery - 2. Firmware without evaporation
If restoring the settings did not help, lay out the download log in full, in each case, you can and should act differently.

Two firmware options are currently available: e10.7.1.17.59E and e10.9.1.17.5E Despite the large number of fill files, this is so. All blocks of these firmware are compatible with each other.
You can distinguish them by such a line
bootargs = console = ttyS1,115200n8 mem = 39M @ 0x0 ispmem = 5M @ 0x2700000 rmem = 20M @ 0x2C00000 init = / linuxrc rootfstype = squashfs root = / dev / mtdblock2 rw mtdparts = jz_sfc: 256k (boot), 2176 3584k (rootfs), 2176k (system) quiet

In June 2017, a new version of the firmware appeared - significantly redesigned. Only kernel is compatible with old firmware.
Initialization string
bootargs = console = ttyS1,115200n8 mem = 39M @ 0x0 ispmem = 5M @ 0x2700000 rmem = 20M @ 0x2C00000 init = / linuxrc rootfstype = squashfs root = / dev / mtdblock2 rw mtdparts = jz_sfc: 256k (boot), 2176 3328k (rootfs), 2304k (system), 64k (factory), 64k (param) quiet
features read above and below the post with firmware.

For those with a mustache:
Fill the camera with firmware. Download (old)Attached fileNOBOOT.rar(7.01 MB)
orfrom hereorfrom here
New from Sannce

unpack
We type in the terminal
isvp # sf probe
the manufacturer c2
SF: Detected MX25L64 ** E
isvp # sf erase 0x040000 0x7c0000
SF: 8126464 bytes @ 0x40000 Erased: OK
isvp # loadb
## Ready for binary (kermit) download to 0x82000000 at 115200 bps ...
and transfer the file using the terminal. If the transmission was successful, the camera answers
## Total Size = 0x007c0000 = 8126464 Bytes
## Start Addr = 0x82000000
pay attention to the file size - it must match. also see the parameterStart addrif it is different, then substitute the one that the camera issued (instead of 0x82000000)
isvp # sf write 0x82000000 0x040000 0x7c0000
SF: 8126464 bytes @ 0x40000 Written: OK
isvp # boot

after a reboot, the camera tries to connect to the "old" WiFi.
make an iron reset and initial connection setup.
If you got a cyclic SIGTERN - gohere

Recover DID and WiFi access
After the firmware, the camera receives "alien" parameters and is not visible through the cloud. Fix it.
We are connected by telnet
In the terminal, we enter in turn:
rm -rf /system/www/system.ini
rm -rf /system/param/factory.ini
rm -rf /system/www/network.ini

Making an iron reset.
After rebooting the camera, you should see your native camera ID everywhere and an invitation to connect.

Firmware
Firmware for the web interface Device Embeded Web UI Version - 12.9.7.5-savagemessiahzine.com
merged from the soldered flash drive of the new camera
Attached fileIPC.zip(7.1 MB)

it is also necessary to fill in the programmer. Some programmers allow you to record a USB flash drive without soldering. if you don’t have one, you will have to remove the USB flash drive and then solder it into place. however, one who has a programmer is unlikely to read this, he already knows))
ATTENTION! if you do not have a normal soldering station - do not pick your usual soldering iron. with a probability of 101% after that, the camera cannot be restored!
After flashing, be sure to restore the DID.
For fans to dig deeper))
Any actions with the camera files can lead to bricking. If you don’t know what you are doing, don’t do it better!
You do everything at your own peril and risk!
If you have not been stopped by warnings, let's get started.
1. Enter telnet.
1.1 You can use PuTTY: Enter the IP address of the camera, select telnet. Click Open.
1.2 Or native Windows. open cmd and enter telnet "IP_camera" (without quotes)
2. enter the username and password.
the camera answers: Processing / etc / profile ... Done
3. Run the ftp daemon with the command:
tcpsvd -vE 0.0.0.0 21 ftpd -w / &
(switch -w activates apload)
see the answer: ~ # tcpsvd: listening on 0.0.0.0:21, starting
this means that ftp access to the camera has been obtained.
4. We are connected by any ftp manager, for example Total Commander.
5. In cameras with Thx firmware, the ftp daemon is missing.adding busybox and enabling ftp.busybox is a sea of ​​opportunities, not just ftp
5.1 rootfs with integrated busybox for Thx firmware fromGosudar

Well, and then - you yourself know what to do. Another warning:If you do not know - do not do it better!

grade.sh - a script for rolling dumps from under Linux

some details

telnet enable bit

update structure

The camera log usually records:
videostream is run this is someone watching the web
p2p param opration camera data was requested through the cloud, the connection took place.
p2p livestream is run someone is looking through the cloud
p2p audiostream is run someone turned on the speaker through the cloud
These are the main statuses.

about audio and video streams - a continuation - and a little bit more)) - and in detail

Enhancing Security: Eliminating Vulnerabilities
If you opened the camera to the Internet - in addition to what is written in the "Important" section, you can do everything describedhere
Put your own password on telnet
improved web interface

Recommended software
For Android: DIGMA. Works with almost all cameras. It can work both locally and through Chinese P2P cloudsAttached fileDIGMA SmartCam_v1.13_apkpure.com.apk(7.61 MB)

Onvif device menagerfinds and shows all local cameras, displays useful information and shows the video stream (quality can be selected)
Chinese utility for searching and flashing cameras. It also finds all local cameras and displays basic information about them. The format of the firmware is unknown.Attached fileSearch - Production Tools 4.4.exe(1.85 MB)

A client with great functionality and capabilities. Connection:
Capture-Network - select Foscam (HTTP motion jpeg) - picture 640 * 360 FPS 3-4;
Capture-Network- rtsp: // IP: 10554 / tcp / av0_0 by checking the "For transport ..." checkbox - picture 1280 * 720 FPS 15
Attached fileContaCam-7.0.0-Setup-Rus.exe(16.41 MB)

A client that allows you to save video to your computer in avi format without removing the card from the camera.Attached fileDeviceClient.exe(12.5 MB)

Utility to reset cameras to factory settings. Application:
First, open Config.ini and change Type = 1 to Type = 0. we launch. check. if it doesn’t help, return Type = 1 and run it again, check. in the latter case, the camera fully returns to the factory settings, deeper than the Reset button.
There were no complaints about the bricking of the cameras after applying the program, but
You do everything at your own peril and risk!
Attached fileResetConfig.zip(291.32 KB)

Program for checking memory cards. Checks only free space, i.e. if you want to check the whole card, delete the files and format the card before checking.
Attached fileh2testw_1.4.zip(213.02 KB)
Official updates

Wanted camera firmwareEscam Elf QF200 . If you have such a camera - refer to Proshaaa or Gosudar
Wanted Wanscam HW0026-1 camera firmware

We are also looking for firmware for a camera that raises its own access point.


  • Before posting read the message Video section rules
  • Messages that are not related to the topic of discussion (offtopic) are deleted without warning.

K
There is no curator in the subject. For questions about filling the caps, please contact the section moderators via the buttonPictureunder the messages to which you want to add links.


Post has been editedmihadom - 12.02.19, 10:12
Reason for editing: new information added



Rep: (5)
Good day to everyone, there is a camerasannce i21ag, p2p, works remotely when connected to a dedicated Internet, and through the MTS router, only NOT A MEGAFON, and I only have 4G Megaphone at home, I tried it on a home router and on a mobile router and through a modem in a router, the remote with a megaphone does not work, if there are specialists give advice where to dig
Of the available ports, only 81 (web) and 23 telnet,

Post has been editedctich - 08.03.17, 23:11



Rep: (774)
M
Subject moved to subsectionIP cameras



Rep: (85)
Oh, terrible camera - I regret that I took it. The software is very raw.
And how to enter it on telnet?
Did anyone manage to transfer the photo via ftp outside the local network.
ftp client of the camera does not want to switch to passive mode on its own,
which means for NAT (on the Internet) it will not work to upload the photo.



Rep: (0)
Good day.
IP Camera Sannce I21AG
https: //ru.aliexpress....14.13010308.0.0.SuZscs
The camera refuses to show the video (image) on the PC. I tried different programs, including and official from the developer's site.
The most interesting thing is that in the program the camera appears in the list, the status is online, and the window with the image is black.
On the phone (Android) everything works fine.
The camera is connected via p2p with an indication of ID.
Maybe someone faced this problem and how they managed to solve it.
Thank.



Rep: (85)
Lelik_1977 @ 04.17.17, 10:53*
Camera refuses to show video (image) on PC

It turned out only from the browser on port 81.
rtsp works very poorly.

Post has been editededoroe - 17.04.17, 11:01



Rep: (5)
Through the browser it shows perfectly, through the program too (in the program, the camera needs to be redirected to the black square



Rep: (0)
There is a new problem. After setting the administrator password in the camera’s settings, third-party applications began to swear, when connected, they give out something like “invalid ID” (E-View7, p2pipc, etc.). The native program Sannce cam and Digma SmartCam camera see and connect to it. Previously, the camera worked with other applications on the smartphone, but the password for admin was not there. Could setting a password be related to this?



Rep: (0)
I connected it via FTP and throws pictures, but as soon as the camera turned off the ftp settings fly off with whatever tambourine I’ve danced, it’s better of course through Mail Service Settings it’s much more reliable, but it’s better to turn off the response by sound, the box clogged up for 3 hours from the slightest rustle. This camera has a panic with third-party software, normally only Security Monitor Pro 5 works, but I can’t find a pancake for patch 5, so the Chinese steer, of course it would be surprising that there would be no problems for that kind of money. Yes, the resolution of a freeze frame disgusting can only be known to friends.



Rep: (0)
Everything, after two weeks of operation, the camera burned out by itself. I am looking for a scheme who has it.



Rep: (1)
Vitalf25 @ 11.05.17, 15:20*
Everything, after two weeks of operation, the camera burned out by itself. I am looking for a scheme who has it.


The same garbage. the first chamber died in 1 day. The reason, as it turned out, was either fig-soldering of SMD components, or it somehow decayed from the heating of the wi-fi module (by the way, this reason was written somewhere in the internet). After the soldering, she earned and continues to work.

But the second camera, having worked for 1.5 months, also died for no apparent reason ... but, alas, the method as with the first camera did not work ... I still suffer ...



Rep: (0)
Genok84 @ 05.20.17, 17:12*
SANNCE I21AG IP

also after 2 weeks of work I refused to live, can you throw off the link to the SMD soldering?



Rep: (0)
Who set up ftp on this camera?
I only upload photos on ftp when a trip occurs.
Video on ftp does not merge, only on the camera card is written. Do you need the video to be uploaded to ftp?
Who does it work for?
what can be done so that the video is sent to the remote ftp. Otherwise, I see no reason.
The camera was stolen and the video was gone :)



Rep: (85)
Who set up ftp on this camera?

You are not very happy that at least the photo on ftp is uploaded.
My camera with ftp (as in other things and with video over http) works according to the principle: I want to work, I want to not.
A few days later I discovered that the ftp photo is the same size - I look, it turns out the photo
transmitted what was a few hours ago, and the events coming to the android application,
also contain a long-standing photo.

Need updated firmware like air, but where to get it?

Post has been editededoroe - 24.05.17, 09:23



Rep: (0)
Who set up the Ivideon online service for this camera? there is the possibility of recording online broadcasts.
I found instructions - to connect to the Ivideon server who uses the link ishttp: //"IP": "PORT" /videostream.cgi?loginuse= "login" & loginpas = "password" remove the brackets - they are indicated specifically so that you can understand what needs to be replaced. Naturally, the IP in the router should be in the DMZ and the ports for access are forwarded.

while I could in my LAN connect to port 81. Thanks Edoroe for the port! )
the broadcast has gone!
the quality is more or less acceptable. True, I can’t get a sound in broadcasting.

I see this as a solution maintained by the online archive. writes some files to a hard laptop. but I can’t open them with anything yet -https://yadi.sk/i/PL_Z9ZLZ3JU7Gp
please try this option!

let's solve the problem together! :)



Rep: (0)
put Basic K-Lite Codec Pack
the video opens, but rewinding the video is not possible. some strange codec.
no sound. It seems that the camera is not transmitted or ivideon server does not take it.



Rep: (85)
With external programs, my video also goes without sound (used mplayer) and the video (by default, without using the program options) is accelerated.



Rep: (11)
I took it with Ali, I used it for three days. It seems that everything worked, I decided to put another program on the phone and transfer it to another room. For the sake of fidelity, I decided to clean everything, I pressed the reset button, the girl in Aglitsky said that a full reset was made and after that the camera does not respond to anything ...
Is it possible to do something or is this a diagnosis?

Post has been editedsikorskij - 25.05.17, 09:45



Rep: (6)
Can someone tell me where to solder?

Attached images
Attached Image


Post has been editedWest44 - 25.05.17, 22:23



Rep: (1)
Within two months, two cameras have died the same! They die like flies, although the picture and functionality are good ...



Rep: (3)
made a cross. I came to another house, trying to connect, I can’t get it. Says connection file. I do not know what to do


Full version    

Help     rules

Now: 08/10/19, 1:49 p.m.