Hacking Q3H (allwinner v3 - Camdroid)

Finally! i recover and unbricked the camera! thanks i make with goprawn img a img from my old camera put on phoenix browse img firmware and i turn on with UP button and flash unbricking the camera :D now works like always b4 the brick thanks you and @Petesimon .
okay good! i'm glad. maybe try a newer firmware that is model 'fuxin' and supports 'imx179S', such as this "Fuxin (xon boot logo) 2016-08-12 (shows C20160817V2.3)" on goprawn.com forums. but careful...it may work, or it may not work. you may need to get "script.bin" data from your good firm and write it into the other firm. see this post on page 10. https://dashcamtalk.com/forum/threads/hacking-q3h-allwinner-v3-camdroid.20507/page-10#post-298713 and photo >> 2016-12-02 19_10_21-goprawn-firmwares-imx179S.jpg
 
heh, my camera is imx179s so all my images should work. caveat is that I run the system and data off of the SD card for the latest builds.
 
Finally! i recover and unbricked the camera! thanks i make with goprawn img a img from my old camera put on phoenix brownse img firmware and i turn on with UP button and flash unbricking the camera :D now works like always b4 the brick thanks you and @Petesimon .

I'm glad to hear that.


I found the 'UP' and 'DOWN' buttons, which allow you to navigate the menus, also have other functions when pressed for 2 seconds:
  • UP: launches Wi-Fi
  • DOWN: enables or disables the sound capture.
These tips were probably in the user manual. But, who reads the manual? :p
 
hello. ooh very interesting! you are quite handy with Python. Maybe you have seen my previous posts here. I captured raw tcp/ip traffic between a smartphone and the F60B camera with tcpdump when Wimius-XDV (or compatible app) was connected and displaying live video. Too bad the auth handshake on tcp 6666 is tricky to reverse engineer. the app and camera re-auths every few seconds? huh that's overkill I think. and video feed on udp 6669 also seems to be proprietary/non-standard. :eek: If you have done similar work on other cameras, I would like to read it.

Another thing I wonder is how the one app HotShot changes wifi ssid and password (in mtd2 system or mtd3 config)?
change-wifi-ssid-name-and-password-hotshot-app-f60b-camera2-jpg.27398

Thanks for your work. Cheers

Seems easy :
1 - send auth on 6666 port (a blabla with admin12345 inside):
in hex:
'abcd00810000011061646d696e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003132333435000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'

2 send change pwd/ssid cmd :
'abcd00c00000a031' + 64bytes zone starting with ssid + 64 bytes zone starting with old passwd + 64 bytes zone starting with new passwd.

In dirty python:
'abcd00c00000a031' + NEW_SSID.encode('hex').ljust(128, '0') + OLD_PSSWD.encode('hex').ljust(128, '0') + NEW_PSSWD.encode('hex').ljust(128, '0')

C.py file change ssid / pass depending on configured
NEW_SSID = 'MyNewSSID'
NEW_PSSWD = 'myNewPASSWD'
OLD_PSSWD = 'myOldPASSWD'

Sorry no time left to analyse the protocol of your cam/capture. But why would it be different ? If you can use XDV apk player, protocol must be the same.

I'm thinking cams video protocl is perhaps CedarX (http://linux-sunxi.org/CedarX). For the time don't found simple players (without building it from sources) supporting cedarX.
edit:
confirm with editing binary using most of cpu "/system/bin/mediaserver"
With a simple notepad++ and a look inside the bin file we can find "cedarx_hardware_init"...

Firware Excelvan Q8 20160621V03 (link)

Regards
 

Attachments

  • C.zip
    521 bytes · Views: 10
Last edited:
I finished a video today. It's for flashing newer, fully compatible firmware to your camera. Therefore, the video does not show you how to modify any firmware which may cause 'white-screen-of-death' (WSOD), or 'black-screen-of-death' (BSOD) or boot loop. In the future, I may make a video for that procedure. Anyway, I hope it will be helpful to visitors here. Links to drivers, tools and more are here in this text file of notes.
Code:
https://youtu.be/QrTxFjIiHvc

 
Howdy folks. I made a public "group" page on Facebook for Allwinner V3 action cameras. It will basically be a partial clone of files and information found on https://www.Goprawn.com and some from here. I got the idea from my find of two Eken H9/H8 camera groups already on Facebook. Feel free to browse there, click Join, comment and contribute. Firmware, tools, drivers and documents are under the "Files" section. https://www.facebook.com/groups/241278666305379/ | or shorter link https://facebook.com/241278666305379
Cheers
 
Last edited:
I got an idea to capture video as what the sensor "sees". i don't really know the right way to do this, so i tried to capture data the framebuffer device (fb0) as a video file by using ffmpeg 3.14 (or greater version) for ARM 32bit. i only got the menu screens, but not the live feed from the sensor and not videos played back on the camera. Also, the /dev/video0 device can not be used or opened because of error "resource busy".
If "-framerate" option does not work, then try " -r " option in place. also change framerate and/or bitrate numbers according to your needs. To quit ffmpeg process early, press 'q' key. Afterwards, copy the fb0-xvid.avi file to your computer via the command 'adb pull /mnt/extsd/fb0-xvid.avi' or by using a file manager. Note: /dev folder in the camera is in a temporary filesystem, so files copied to there will not stay after reboot/power-off.
Code:
adb shell mkdir /dev/bin
adb push ffmpeg /dev/bin/ffmpeg
adb shell
chmod 555 /dev/bin/ffmpeg
/dev/bin/ffmpeg -f fbdev -i /dev/graphics/fb0 -framerate 10 -vtag xvid -b:v 100k -bufsize 100k /mnt/extsd/fb0-xvid.avi
here is the captured video - https://yadi.sk/i/tlT1xJML35Ao4b - and click 'Download' button on page

Alternatively, the ffmpeg file can be in /mnt/extsd instead of /dev directory. The x264 (h264) codec can be used explicitly with ffmpeg. A micro sd card with empty space should be inserted to the camera.
Code:
adb push ffmpeg /mnt/extsd/ffmpeg
adb shell
/mnt/extsd/ffmpeg -f fbdev -i /dev/graphics/fb0 -framerate 10 -c:v libx264 -vtag avc1 -b:v 100k -bufsize 100k /mnt/extsd/fb0-x264.avi
Here is this captured video - https://yadi.sk/i/sQU6vCna35Pn6V - click 'Download' button.

also can capture the screen every 2 seconds to a picture file, total of 10 individual screenshots, and log output to a text file
fps=1/2 is every 2 seconds, so change fps=1/2 to fps=1/N for every N seconds
-frames 10 is total of ten screenshots, so change 10 to N for N total count of screenshots
Code:
mkdir /mnt/extsd/fb0screenshots
/mnt/extsd/ffmpeg -f fbdev -i /dev/graphics/fb0 -vf fps=1/2 -frames 10 /mnt/extsd/fb0screenshots/screenshot-%d.png 2> /mnt/extsd/ffmpeglog.txt
Here is this log text file - https://www.dropbox.com/s/0sd2xu206mix08v/ffmpeglog.txt?dl=0

Also... it's peculiar how a linux binary can be executed from a vfat (fat32) file-system from the sdcard...

The Big Question: How can I capture the live video feed from the sensor in the camera by using ffmpeg or any other tool directly, or over USB or via tcp/ip net?

references - https://ffmpeg.org/ffmpeg-devices.html#fbdev | and | https://trac.ffmpeg.org/wiki
ffmpeg static binary only, download - https://www.dropbox.com/s/g70fgvj6hqv93i9/ffmpeg-3.1.4-armel-bin-upx.zip?dl=0
original download of ffmpeg armel 32bit - https://johnvansickle.com/ffmpeg/
 
Last edited:
Hi NMD,

thanks for your amazing work so far.
i've been reading your posts here and on GoPraw and they are all very good.
I have a F60B (crane) and following your posts (and other contributions) I've managed to upgrade my firmware with F60R (which has motion detection built in) so far working all good.
My only question is, when I click the UP button, instead of switching ON the wifi, it zooms. and when I click the DOWN button it decreases the zoom, instead of switching off the sound.
would this be an easy thing to fix?
Thanks in advance and wishes of a great 2017!!

By the way, i'm portuguese, so if you find it easier to explain anything in PT, just send me a private message! ;)
 
  • Like
Reactions: NMD
My only question is, when I click the UP button, instead of switching ON the wifi, it zooms. and when I click the DOWN button it decreases the zoom, instead of switching off the sound.
have you done these? : hold UP for 3 to 4 seconds to switch on wifi (hold up 1 second to switch off wifi), and hold DOWN for 3 to 4 seconds to switch on/off sound recording.
otherwise, the fix may not be "an easy thing" ;) because i used android adb logcat facility to see that keypresses are likely written in C++ code which is compiled in the linux kernel.
* First! make a backup copy of your firmware! by using this backup script and this video guide.
well, you can try this procedure -- using these scripts from @nutsey. place 2-system.img in 'UNFEX' folder and unpack that using 'squashfs_unmake.bat', and edit 'sunxi-keyboard.kl' in 'squashfs-root\etc' folder, and change key code numbers based on information found in that sunxi-keyboard.kl file and this android data and by watching output from 'adb logcat -v process' at the same time you press the UP and DOWN button when the camera is connected to computer via USB cable. afterwards, pack a new 2-system.img file using 'squashfs_make.bat' and make a new full_img.fex file using 'refex.bat' and flash the firmware. it's an idea. but i have not tested it myself.
 
Last edited:
Thanks PeteSimon!
I'm kind of a newbie, only have the camera for two days! :) But I love messing around with firmwares and stuff like that.
I will have a look into the scripts you mentioned and will let you know how it worked.
Thanks once again and have a great 2017!
 
  • Like
Reactions: NMD
Thanks PeteSimon!
I'm kind of a newbie, only have the camera for two days! :) But I love messing around with firmwares and stuff like that.
I will have a look into the scripts you mentioned and will let you know how it worked.
Thanks once again and have a great 2017!
welcome. but first, be sure to make a backup copy of your factory/original firmware by by using this backup script and this video guide. by the way, other tutorial videos are in youtube.com/user/petesimon/videos and be sure to read messages in www.goprawn.com Allwinner cams forum. salud.
 
to all - i have different cameras with different cases. well, i recently got an Andoer, and its power/mode button is at bottom corner when most other cameras have that button at top corner. hm peculiar. These plastic cases aren't bulletproof, so I am looking for a 2nd waterproof case for the Andoer camera to use as a replacement later. I can't find only the right case and I can't find the the right case even along with a set of accessories. I know there are so so maany websites that have accessories and cases, but I'm exhausted looking. Anyone have any tips?

 
I got an idea to capture video as what the sensor "sees". i don't really know the right way to do this, so i tried to capture data the framebuffer device (fb0) as a video file by using ffmpeg 3.14 (or greater version) for ARM 32bit. i only got the menu screens, but not the live feed from the sensor and not videos played back on the camera. Also, the /dev/video0 device can not be used or opened because of error "resource busy".
If "-framerate" option does not work, then try " -r " option in place. also change framerate and/or bitrate numbers according to your needs. To quit ffmpeg process early, press 'q' key. Afterwards, copy the fb0-xvid.avi file to your computer via the command 'adb pull /mnt/extsd/fb0-xvid.avi' or by using a file manager. Note: /dev folder in the camera is in a temporary filesystem, so files copied to there will not stay after reboot/power-off.
Code:
adb shell mkdir /dev/bin
adb push ffmpeg /dev/bin/ffmpeg
adb shell
chmod 555 /dev/bin/ffmpeg
/dev/bin/ffmpeg -f fbdev -i /dev/graphics/fb0 -framerate 10 -vtag xvid -b:v 100k -bufsize 100k /mnt/extsd/fb0-xvid.avi
here is the captured video - https://yadi.sk/i/tlT1xJML35Ao4b - and click 'Download' button on page

Alternatively, the ffmpeg file can be in /mnt/extsd instead of /dev directory. The x264 (h264) codec can be used explicitly with ffmpeg. A micro sd card with empty space should be inserted to the camera.
Code:
adb push ffmpeg /mnt/extsd/ffmpeg
adb shell
/mnt/extsd/ffmpeg -f fbdev -i /dev/graphics/fb0 -framerate 10 -c:v libx264 -vtag avc1 -b:v 100k -bufsize 100k /mnt/extsd/fb0-x264.avi
Here is this captured video - https://yadi.sk/i/sQU6vCna35Pn6V - click 'Download' button.

also can capture the screen every 2 seconds to a picture file, total of 10 individual screenshots, and log output to a text file
fps=1/2 is every 2 seconds, so change fps=1/2 to fps=1/N for every N seconds
-frames 10 is total of ten screenshots, so change 10 to N for N total count of screenshots
Code:
mkdir /mnt/extsd/fb0screenshots
/mnt/extsd/ffmpeg -f fbdev -i /dev/graphics/fb0 -vf fps=1/2 -frames 10 /mnt/extsd/fb0screenshots/screenshot-%d.png 2> /mnt/extsd/ffmpeglog.txt
Here is this log text file - https://www.dropbox.com/s/0sd2xu206mix08v/ffmpeglog.txt?dl=0

Also... it's peculiar how a linux binary can be executed from a vfat (fat32) file-system from the sdcard...

The Big Question: How can I capture the live video feed from the sensor in the camera by using ffmpeg or any other tool directly, or over USB or via tcp/ip net?

references - https://ffmpeg.org/ffmpeg-devices.html#fbdev | and | https://trac.ffmpeg.org/wiki
ffmpeg static binary only, download - https://www.dropbox.com/s/g70fgvj6hqv93i9/ffmpeg-3.1.4-armel-bin-upx.zip?dl=0

Seems that /dev/video0 is used by the internal server.
If you stream to you phone app and at the same time make a top in adb shell you'll see the process using video0. When I kill the server, my cam reboot. Perhaps a watchdog is on the process...

Still searching a solution.
 
Hi guys! just one question... I've been using my F60B cam and I'm quite happy with the video results of it (1080P 30F). Not exactly the same as a GoPro but, cost\benefit is really worth it.
However I noticed that the photo resolution (I use 8MP), is wrong in my point of view. The photos I take seem always shrinked..... I mean, they are 3264x2448 pixels, but I think they would look MUCH better if they were with the 16:9 ratio, same of the movies... What do you guys think? Have you noticed that too? would it be possible to change the photo resolution? Thanks!! :D
 
  • Like
Reactions: NMD
I have never done any major tests of the picture quality of the photos. But it seems, this problem has also been reported in Banggood for Q3H-2 cameras by ottomani:

ottomani (Banggood) said:
Good quality for the price. Works well at 2.7K and 1080P30Fps while image quality becomes low at 1080P60Fps and lower at 4K 30Fps (true Fps is 25). Good also in slow motion at 720 90Fps. What is very crappy is when you decide to take photos because of BIG ERROR in firmware (fuxin4k30imx179_sdv - last update is 20160812V2.3). Photos are taken as 4:3 aspect rati but really them are 16:9 so images are stretched vertically to reach the 4:3 aspect. Ridicoulus effect so you cannot use that images. This also reflecs on the image quality because pixela are verically enlarged by a factor of 1.77 and photo cannot be crisp. Up to 8MPixel and recompessing images at 16:9 ratio via external software total quality becomes acceptable for normal prints. Attacched photos of same subiect taken in horizontal and vertical shots and the same recompressed to original size. Think programmers must correct rapidly this firmware so you can give us opportunity to update it quickly.
ottomani (Banggood) said:
 
Anyone know how to live view from the camera on PC wirelessly? I'm trying to use my camera as security camera & live view from my PC.
 
Last edited:
However I noticed that the photo resolution (I use 8MP), is wrong in my point of view. The photos I take seem always shrinked..... I mean, they are 3264x2448 pixels, but I think they would look MUCH better if they were with the 16:9 ratio, same of the movies... What do you guys think? Have you noticed that too? would it be possible to change the photo resolution? Thanks!! :D

@nunoqsm, Uma vez que ninguém pegou neste assunto, no próximo fim-de-semana eu irei trabalhar e fazer upload de alguns scripts que façam a conversão automática de 4:3 para 16:9.

---------------------------------

Since no one picked it up, next weekend I'll work on upload some scripts that do the automatic conversion from 4:3 to 16:9.


EDIT: (7Feb17)
Unfortunately I will not be able to implement this script since I can resize an image but I can't change its aspect radio. :(
 
Last edited:
Back
Top