Hacking Q3H (allwinner v3 - Camdroid)

So I think I've automated the unpacking of 2-system.img within Cygwin terminal (mintty), using @kizwan 's unsquashfs.exe 32bit from page15 of this thread. There is a windows cmd script to call cygwin mintty and in turn call a bash script to run unsquashfs.exe . I'm still working on the mksquashfs script.
download - https://www.dropbox.com/s/xdnhk4rmzfps3jx/unsquash-cygwin-script-goprawn.zip?dl=1
and setup your folder like the photo, and run unsquash-cygwin.cmd script.
Could you please test it on your firmware?

unsquash_cygwin_script_2017_03_11_23_54_crop.jpg
 
Unsquash-cygwin.cmd worked for me unpacking the 2-system.img in cygwin.
Thats great!

EDIT: What about the refex script? :)
 
Last edited:
I modified the firmware backup script to do RAR (5) compression, and this will make a smaller file compared to zip compression. Answer "y" at the prompt when you run the 'backup.cmd' script.
https://www.dropbox.com/s/m9rmzo7azbjl3zs/backup-script-rarcompress.zip?dl=0

Also, here is a Mac OSX version of the firmware backup script, and it should do zip compression.
https://www.dropbox.com/s/kb1y0gxbohgqjxo/backup-script-MacOSX.zip?dl=0
Note: 'adb' executable is included, but you may need to get ADB executable and/or drivers files from another website.

Also see this post on Goprawn forums for more information about the backup script.
https://www.goprawn.com/forum/allwi...mnivision-ov4689-action-cameras?p=259#post259

cheers.:rolleyes:
 
Alright, so I'm new to this whole thing. I'm trying to use a similar camera for work purposes, and I'm having issues with the fact that when I unplug it, it turns off, and I'd also like to make it so it automatically uses USB Mode when plugged in, instead of asking. I'm not sure which files I'd find those things in, or even how to edit the files after unsquashing. I'd really appreciate any help you can provide.
 
Alright, so I'm new to this whole thing. I'm trying to use a similar camera for work purposes, and I'm having issues with the fact that when I unplug it, it turns off, and I'd also like to make it so it automatically uses USB Mode when plugged in, instead of asking. I'm not sure which files I'd find those things in, or even how to edit the files after unsquashing. I'd really appreciate any help you can provide.
hm. good question! I also dislike that my Andoer (fuxin) camera turns off when I unplug it either from a charger or from my computer. I'm not really sure how to change that behavior, but I suppose we can use unpack_bootimg.bat script and go into boot-root/initrd folder and peruse the default.prop and .rc text files there. Also after unsquashing the 2-system.img, go into squashfs-root/res/cfg and peruse the .cfg files. However, there is a possibility that usb behavior is 'hard-coded' in the kernel and/or in binary system files.

Well, I know that we can get system logs by using "busybox dmesg" or "adb logcat" to show us things happening in the camera. Disconnect usb from camera and have the camera powered on. Get adb.exe for Windows and get busybox binary for running on the camera itself, connect your camera by usb, open command-prompt (cmd.exe), change to the folder that has busybox binary, and run these commands (copy/paste) for dmesg log messages:
*EDIT* need "adb shell chmod 755 /dev/busybox" after the push command.
*EDIT* first do "adb kill-server" to close old instance of adb.exe and to decrease the chance of adb.exe version mismatch.
Code:
adb kill-server
adb root
adb remount
adb  push  busybox-armv7l.bin  /dev/busybox
adb  shell  chmod  755  /dev/busybox
adb  shell  /dev/busybox  dmesg  | more  >  dmesg.txt
start  dmesg.txt

Look at the last lines, about 10 lines in that dmesg text file.

*EDIT* Now UNplug, wait a few seconds, and replug in your camera from/to usb, and run some of those commands (copy/paste) again but change the output file name:
Code:
adb kill-server
adb root
adb remount
adb  shell  /dev/busybox  dmesg  | more  >  dmesg2.txt
start  dmesg2.txt

Again look at the last lines, about 10 lines in that second dmesg text file.

Next, using adb again, go back to command-prompt and run these commands (copy/paste) for adb logcat log messages. We want adb logcat be running while we connect and disconnect the camera to usb...if that's posslble:
Code:
adb kill-server
adb root
adb remount
adb  logcat  -v  long  >  logcat-linux.txt

Connect camera to usb, wait 10 seconds, and UNplug the camera from usb, and press CTRL C keys, and run the next command:
Code:
more  logcat-linux.txt  >  logcat-windows.txt
start  logcat-windows.txt

Look at the last lines, about 20 lines in that logcat text file.

here is scripts-pack from goprawn forums.
https://drive.google.com/file/d/0B4tyaJWIqCb_RTAzVlRBVUpETk0/view?usp=sharing

here is busybox binary for the camera (Linux 32-bit ARM-7/ARM-el devices)
https://www.dropbox.com/s/yl7v4shrz1rl8j5/busybox-armv7l.bin.zip?dl=0

here is ADB (adb.exe) installer, answer ' Y ' (yes) to everything.
https://www.dropbox.com/s/4cfpfh6qqg2azum/ADB_Installer_15_Second_v1.4.3.zip?dl=0
 
Last edited:
hm. good question! I also dislike that my Andoer (fuxin) camera turns off when I unplug it either from a charger or from my computer. I'm not really sure how to change that behavior, but I suppose we can use unpack_bootimg.bat script and go into boot-root/initrd folder and peruse the default.prop and .rc text files there. Also after unsquashing the 2-system.img, go into squashfs-root/res/cfg and peruse the .cfg files. However, there is a possibility that usb behavior is 'hard-coded' in the kernel and/or in binary system files.

Well, I know that we can get system logs by using "busybox dmesg" or "adb logcat" to show us things happening in the camera. Disconnect usb from camera and have the camera powered on. Get adb.exe for Windows and get busybox binary for running on the camera itself, connect your camera by usb, open command-prompt (cmd.exe), change to the folder that has busybox binary, and run these commands (copy/paste) for dmesg log messages:
Code:
adb root
adb remount
adb  push  busybox-armv7l.bin  /dev/busybox
adb  shell  /dev/busybox  dmesg  | more  >  dmesg.txt
start  dmesg.txt

Look at the last lines, about 10 lines in that dmesg text file.

Now UNplug your camera from usb, and run some of those commands (copy/paste) again but change the output file name:
Code:
adb root
adb remount
adb  shell  /dev/busybox  dmesg  | more  >  dmesg2.txt
start  dmesg2.txt

Again look at the last lines, about 10 lines in that second dmesg text file.

Next, using adb again, go back to command-prompt and run these commands (copy/paste) for adb logcat log messages. We want adb logcat be running while we connect and disconnect the camera to usb:
Code:
adb root
adb remount
adb  logcat  -v  long  >  logcat-linux.txt

Connect camera to usb, wait 10 seconds, and UNplug the camera from usb, and press CTRL C keys, and run the next command:
Code:
more  logcat-linux.txt  >  logcat-windows.txt
start  logcat-windows.txt

Look at the last lines, about 20 lines in that logcat text file.

here is scripts-pack from goprawn forums.
https://drive.google.com/file/d/0B4tyaJWIqCb_RTAzVlRBVUpETk0/view?usp=sharing

here is busybox binary for the camera (Linux 32-bit ARM-7/ARM-el devices)
https://www.dropbox.com/s/yl7v4shrz1rl8j5/busybox-armv7l.bin.zip?dl=0

here is ADB (adb.exe) installer, answer ' Y ' (yes) to everything.
https://www.dropbox.com/s/4cfpfh6qqg2azum/ADB_Installer_15_Second_v1.4.3.zip?dl=0
I'm having a couple issues in doing this. First, when I execute
Code:
adb  shell  /dev/busybox  dmesg  | more  >  dmesg.txt
I get
Code:
/system/bin/sh: /dev/busybox: can't execute: Permission denied
espite having made sure adb is running as root. The next bit, about unplugging the camera from usb and then running those commands again, won't work because with the camera unplugged, adb won't do anything. I suspect I may have misunderstood part of those instructions. I was able to get a logcat, but I'm not sure it actually captured the disconnect event. I'm attaching the logcat output to this post.

logcat:
https://drive.google.com/open?id=0Bw6pRYvIkMwcZVpXYnp2T1RPZTA
 
okay, my bad... :)
thanks for the logcat. I'll reply about that later...
you can re-order my instructions above to so that they may make more sense...
for kernel messages (logs), be sure to have a copy of the busybox file again, and try:
Code:
adb kill-server
adb root
adb remount
adb  push  busybox-armv7l.bin  /dev/busybox
adb  shell  chmod  755  /dev/busybox
adb  shell  /dev/busybox  dmesg  | more  >  dmesg.txt
start  dmesg.txt
 
Hello, i just join for this tropic :-D.

I have a elecam and it seem to be nearly the same.

To get access to video0 i used lsof | grep video and used kill to terminate the process.
Then i tried your ffmpeg to get a image or video.

./ffmpeg -f v4l2 -channel 0 -video_size 640x480 -i /dev/video0 -pix_fmt nv12 -r 30 -b:v 64k -c:v cedrus264 test.mp4 could be the way but it does not work :(

where did you get your ffmpeg? maybe we need a ffmpeg with cedrus to get any video.

i got the command line for ffmpeg from https://github.com/avafinger/ffmpeg_cedrus264_H3 maybe its also the repro which we need to build a work ffmpeg for arm

i hope i could help someone to get a video soon:-D
 
Last edited:
hello guys! can someone explain how get better video/photo quality on all winner cam? I would do this hack on my cam. I have ELE Explorer S. I read that is possible to "remove" noise and grainy from video and better quality of audio recordered. are there guide for this hack?
 
  • Like
Reactions: NMD
hello guys! can someone explain how get better video/photo quality on all winner cam? I would do this hack on my cam. I have ELE Explorer S. I read that is possible to "remove" noise and grainy from video and better quality of audio recordered. are there guide for this hack?

First make a backup of your firmware and get your product information. Then you can try other firmwares that contain the same product name, image sensor and same LCD of your original firmware. Please check www.goprawn.com for more info.

You can also try to focus you lens:
 
First make a backup of your firmware and get your product information. Then you can try other firmwares that contain the same product name, image sensor and same LCD of your original firmware. Please check www.goprawn.com for more info.

You can also try to focus you lens:
I've already done. I backupped It, found a fw where video quality is better than original but WiFi not works. I Need WiFi but i would bett
 
Better quality too. So if i can modify base fw i think i can have booth.
 
You may be able to replace some files on 2-system.img partition image from one firmware to another, like vendor/modules/*.ko or lib/*.so files. I'm not really into the subject right now. @Petesimon and @nutsey will be the right people.
 
First make a backup of your firmware and get your product information. Then you can try other firmwares that contain the same product name, image sensor and same LCD of your original firmware. Please check www.goprawn.com for more info.

You can also try to focus you lens:

Most of my cameras let remove lens cover - then you can change M12-lens.
Connecting camera via HDMI to tv you can set focus.
Lenses must have IRcut filters (or you can add one), otherwise you get pink colors :)

QZXqGTp.jpg


qFwUL4B.jpg


HVNuYfd.jpg


TiJTsBm.jpg


yvX8dv1.jpg


hZ3Cdbj.jpg


HRxxiLU.jpg


Eb3kRrU.jpg
 
Hi, I am new at this forum.

I already flash my Cam and everything ok.
But it's a problem, the sound is horrible whatever .fex I use. It's specially when you have the Cam fixed in the windshield of the car or bicycle.
There any way to increase the sound nitrate from 8.000 to 44.1? I just want better sound.
I tried the way in the forum but without success I don't know how to make it

Regards

Waiting for help
 
  • Like
Reactions: NMD
Dear guys, I am a newbie of hacking cams.

I bought a Q3H-2 with imx179s. It has imx179s.ko and imx179s_8.ko in rootfs of the original firmware.
I replaced the imx179s.ko with the one shared at the first post in this thread, but my cam stopped at the logo screen.
How should I do to use 1080/60p mode with native resolution?

Thank you for your helping me.
 
  • Like
Reactions: NMD
Back
Top