Accfly 1080P DVR with wifi

[Retroplayer]

So, I love this form factor and decided to pick one up. I am installing a computer in the car, so I especially liked the WIFI capability.

https://www.amazon.com/gp/B01D8K1U5C
Well, it turns out that the camera appears as an access point and to access the stream, you must disconnect from your existing router and connect to the camera. I will have a 4G router in the car providing internet, so what I would have preferred is for the camera to connect to the router through DHCP and just stream rtsp.

Assuming that it likely had linux or something similar running the camera, I disassembled it and found a found a serial port.

It's unfortunately not linux (running eCos), but it did have a console and I was able to get it to dump the firmware to an SD card for analysis.

I attempted to use the built in commands to modify the wifi config, but didn't manage to get it to actually connect. I did confirm that my changes were taken and written to the flash memory.

Unfortunately, now, it isn't showing up as an access point either, even after trying to revert the settings. Grr... (I must have missed something!)

I did discover through the dumped firmware that the wifi can be configured via a file on the root directory of the SD card called "setwifi.txt." While I was able to determine a little about the structure of that text file (confirmed it changed some settings) I still haven't managed to crack it entirely.

So I am here. Hoping that others might have some experience with the NT96658 based cameras and firmware. I'll post the firmware and the console output in this thread. I guess at the least, it might help others customize their cameras by getting things started.

Oh, I forgot to mention that the firmware also alludes to the capability of updating the firmware by placing a file on the root directory named FW96655A.BIN

The first thing I did when I got into the camera was to dump the firmware, so I thought I could restore it back to factory settings using the above file. While it "appears" to be loading the file, the wifi settings didn't change. Hmm...

 

[Retroplayer]

First up is the console output including a display of the help menus and some of the commands available.

 

[jokiin]

Oh, I forgot to mention that the firmware also alludes to the capability of updating the firmware by placing a file on the root directory named FW96655A.BIN

that's the standard format that is used

 

[Retroplayer]

And what little I have managed to figure out about the setwifi.txt format.

 

[Retroplayer]

that's the standard format that is used

Thanks. I just extracted the strings from the firmware dump and it does not appear to be only code. I am finding strings referring to the SSID scans I did (routers nearby.)

Your avatar says manufacturer. Are you a rep from accfly? I have contacted them several times about the format of the setwifi.txt file or at least a factory firmware image so I can get my camera working again.

 

[jokiin]

Thanks. I just extracted the strings from the firmware dump and it does not appear to be only code. I am finding strings referring to the SSID scans I did (routers nearby.)

Your avatar says manufacturer. Are you a rep from accfly? I have contacted them several times about the format of the setwifi.txt file or at least a factory firmware image so I can get my camera working again.

I don't know who accfly is, these are based on a public model PCB that many assemblers use to put products together, don't know who actually makes it

 

[Retroplayer]

Extracted strings from the memory dump. Looking closer, it appears this is a total memory dump (the generated file was 16MB) and not just a firmware dump. The firmware is likely a portion of the dump, but to be usable, one would need to figure out where the FW ends and it might be missing the proper headers to act as a firmware update.

I will have to host the memory dump somewhere else as it is too big to upload here.

 

[Retroplayer]

I realized I never took pictures of how to connect the serial port. I'll get some posted up. I need to get back in there anyway to get to the serial port again.

I also added a speaker inside the case. This camera does not have a built in LCD, but it does have a connector for one and it supports playback (it has a composite video output.)

It also has a spot for a USB mini A style connector, which is not soldered and also needs a couple resistors. I will be adding that. Might be a few other hacks coming for the camera as well.

In the meantime, I further extracted some strings to show what files it looks for or dumps to the SD card and also extracted a section of the firmware that provides some hints for the format of the setwifi.txt file

If there is anyone here that has worked with these cameras and can provide any hints on the setwifi.txt, has firmware I can try, or has some tips on working with the console, I would really like to hear from you.

 

[jokiin]

The firmware is likely a portion of the dump, but to be usable, one would need to figure out where the FW ends and it might be missing the proper headers to act as a firmware update.
.

the firmware file by itself are generally around 2mb in size, they have a separate bootloader that loads the firmware file, I haven't seen anyone modify a Novatek firmware and get it to run before, not sure what efforts have been made to try though

 

[Retroplayer]

the firmware file by itself are generally around 2mb in size, they have a separate bootloader that loads the firmware file, I haven't seen anyone modify a Novatek firmware and get it to run before, not sure what efforts have been made to try though

Thank you for the hint!

Not sure that I necessarily need to modify the firmware. Just hoping to end up with a factory dump to restore the wifi function. My only purposes for dumping in the first place were to see if I could change it from AP mode to station mode so it would connect to a router and just show up like a normal IP camera.

I have it disassembled again already and will posting up some pictures later.

 

[Retroplayer]

Lots to report!

1st, I feel a bit dumb. I had never hooked up the video. When you do, you get a menu where I could restore the factory defaults.
I also found that my wifi settings were originally set as my router (remember I was trying to get it to connect to my router) and the reason I couldn't see it show up is because of the competing SSIDs. I verified this by chaing my router SSID and then I was able to connect with a tablet. So, changing the settings via the console did work, but getting it out of AP mode didn't quite work.

So, anyway... the web interface only gives you a browser where you can download the files off the SD card. It also has two little dialogs for uploading files. Through some experimentation, it appears that the webserver is connected directly to the SD card. I still need to test it, but it appears that I can put html files on the card directly and build a custom browser interface. I'll experiment with that later.

Notice the file location in the address bar.

If you click Upload Custom Files with nothing chosen, you will get this screen:

If you hit refresh on that screen, you get this. This is a string found in the memory dump as well as a few XML files, etc...

By placing a zero length file on the SD card called engmode (just create a blank text file with no extension) it brings up a menu called CALIBRATION when you power it on. The entries are unhelpful - just labeled A1, A2, A3, etc... But unfortunately the up/down buttons don't seem to navigate the menus so I have no idea how to use it yet.

In conclusion, I am back to factory settings now and am learning some interesting things about it. In the firmware, there is lots of mention of an rtsp stream. I have not tried it yet, but it should be located at the mostly default port 554. It most likely needs a username and password. I don't see any option to configure that in the menus. I'll dig into the memory dump and see if I can find any hints.

 

[Retroplayer]

I also promised to show where to connect the serial port for the console:

Two VERY tiny pads. TX is marked on the board in small letters. RX is right next to it. You also need to connect the ground wire. You can find that on a test point (TP3) on the ground plane by the wifi antenna.

Empty spot for a USB port. Note, it needs two resistors as well. Most likely 120 ohm.

And just some disassembly pictures:

Where the screws are located (purple circles)

The speaker connection (no speaker installed from the factory and there is no audio out on the composite, either.) Here, I just soldered on a small laptop speaker I had lying around.

The A30E IC is the G-Sensor

You can see that there is a spot marked for the USB port, but it is not punched out

And lastly, the flash memory

I'll need to find a location to upload the memory dump. But this as far as I am going to get for tonight.

 

[Retroplayer]

Bitrate > 20 does not miss, video mode is excellent with bitrate 36

Retroplayer!!
Tell me, what is it, red?
Burned so that can not see.
That's a pit!

It is unfortunately all packed up at the moment because I am moving this weekend (and never installed it). When I get to my final location, I will check for you.

 

[vvs49]

Everyone who wanted to change the firmware

Here is the firmware from the respected user DEX.
In it, when you turn on the DVR immediately goes into the av mode, there is no wifi.
Enter the wifi by clicking the on / off button Wifi.
That is, the algorithm is changed.
This is original
https://yadi.sk/d/RILs1p3d3NFz8f
And this is my work, taking into account the disconnection of the wifi
1080Рх30_36 - bitrate and 720Рх60_20
https://yadi.sk/d/C8PTYkMv3NG3RG

 

[Suchy_PL_]

Everyone who wanted to change the firmware
http://ali.onl/IAH
Here is the firmware from the respected user DEX.
In it, when you turn on the DVR immediately goes into the av mode, there is no wifi.
Enter the wifi by clicking the on / off button Wifi.
That is, the algorithm is changed.
This is original
https://yadi.sk/d/RILs1p3d3NFz8f
And this is my work, taking into account the disconnection of the wifi
1080Рх30_36 - bitrate and 720Рх60_20
https://yadi.sk/d/C8PTYkMv3NG3RG

Can You edit my firmware dump to 36Mbps bitrate ? I have one file with 36Mbps from other user but DVR is working and the buttons not in 100% I have USB programmer and my original dump so I can flash without a fear

 

[vvs49]

Can You edit my firmware dump to 36Mbps bitrate ? I have one file with............

I do not quite understand, the interpreter translates so.
You give a link to your DVR and a link to the file.
Then we'll figure it out.

 

[Suchy_PL_]

OK, Novatek 96658, imx323 this is this DVR and this is my firmware modded to 20Mbps Firmware 20Mbps bitrate but when I flash firmware like yours (the same DVR modded to 36Mbps) my switches on DVR dont work in 100%....and I cant change anything by wifi....wifi is only to setup time and date .

 

[vvs49]

Novatek 96658, imx323

Your DVR is not like my hardware.
My + monitor = a full DVR with its own menu, does not require additional programs.
In your bitrate only 20, Wifi does not miss more.
And my firmware you can not fully use, ROM you have the wrong one.

That you were here and we discussed, nickname anikocio?
https://videoregforum.ru/threads/jooy-a1-registrator-iz-podnebnesnoj-s-wi-fi.1891/page-113

 

[Suchy_PL_]

Yes, it's me.