Hacking Q3H (allwinner v3 - Camdroid)

JoseR

New Member
Joined
Oct 8, 2016
Messages
2
Reaction score
2
Country
United Kingdom
Hello,

I made a horrible mistake and flashed (via cam settings) a new firmware that I thought was compatible with my camera , Excelvan Q8
Now the camera is stuck at the logo screen.

I have tried all the firmware posted here, and I flashed using phoenixsuite, firmware tab, select img and flash succefully, however all images gave same result.
boot sound then they stay at boot logo.

Please help.
 

Petesimon

Member
Joined
Oct 5, 2016
Messages
67
Reaction score
57
Country
United States
Dash Cam
F60B
Hello. This one amzn.com/B01J0U6EIW | or another ? The camera does have an allwinner v3 chip, yes? But you've concluded on an important point -- never flash firmware (hex or fex) files of another camera onto your specific but different camera. Imagine flashing a firmware of Android of one Samsung phone to another Samsung phone or even to another brand-name phone. It won't work! Well anyway, try to contact the manufacturer of the camera or the website from which you got the camera. Maybe even the staff of another website such as Gearbest, Banggood, Tomtop, Geekbuying, Everbuying could help you. I'm awaiting the arrival of my F60B Allwinner V3 4k camera and will post some messages about hacking (but not flashing) that camera when I get it plugged into my computer. By the way, I'm trying to get a device thread started on XDA Developers for these cameras (because they run Android). http://forum.xda-developers.com/showpost.php?p=68987038&postcount=36569
Good luck and cheers.
 
Last edited:
OP
thegamut

thegamut

Active Member
Joined
Jul 22, 2016
Messages
118
Reaction score
68
Country
Barbados
Dash Cam
Q3H aparently.
you can cross flash all you want if you have the right sensor module and script.bin. if you blindly do it without backups and understanding what you're doing you will get bricks, its pretty simple. "manufacturers" are giving out the wrong firmware at times, we had several people who's cameras had to be fixed already.

Remember, once your original correct script.bin is gone... ITS GONE. You can only guess and hope. Its the only piece you REALLY REALLY need to be unbrickable since we have ov4689/imx179/imx179s firmware and the kernels are 95% the same.
 

JoseR

New Member
Joined
Oct 8, 2016
Messages
2
Reaction score
2
Country
United Kingdom
Hello. This one amzn.com/B01J0U6EIW | or another ? The camera does have an allwinner v3 chip, yes? But you've concluded on an important point -- never flash firmware (hex or fex) files of another camera onto your specific but different camera. Imagine flashing a firmware of Android of one Samsung phone to another Samsung phone or even to another brand-name phone. It won't work! Well anyway, try to contact the manufacturer of the camera or the website from which you got the camera. Maybe even the staff of another website such as Gearbest, Banggood, Tomtop, Geekbuying, Everbuying could help you. I'm awaiting the arrival of my F60B Allwinner V3 4k camera and will post some messages about hacking (but not flashing) that camera when I get it plugged into my computer. By the way, I'm trying to get a device thread started on XDA Developers for these cameras (because they run Android). http://forum.xda-developers.com/showpost.php?p=68987038&postcount=36569
Good luck and cheers.
Yes, that is the camera, however I purchased on ebay, I doubt the seller will have firmware available.

you can cross flash all you want if you have the right sensor module and script.bin. if you blindly do it without backups and understanding what you're doing you will get bricks, its pretty simple. "manufacturers" are giving out the wrong firmware at times, we had several people who's cameras had to be fixed already.

Remember, once your original correct script.bin is gone... ITS GONE. You can only guess and hope. Its the only piece you REALLY REALLY need to be unbrickable since we have ov4689/imx179/imx179s firmware and the kernels are 95% the same.
Good news, after flashing all the firmwares that I was able to found, finally I found this one that worked:
From this post: https://www.goprawn.com/forum/allwinner-cams/25-allwinner-v3-sony-imx179-action-cameras?p=130#post130
Fuxin (campark boot logo) 2016-05-09 - https://drive.google.com/file/d/0B4tyaJWIqCb_RU14LU1HYnZvZHc/view?usp=sharing

The only difference its the boot logo, everything else is the same, the camera now works just fine.

Just in case I purchase another cam from same ebay seller, hopefully will share the same internals, so I can make a backup.
 
OP
thegamut

thegamut

Active Member
Joined
Jul 22, 2016
Messages
118
Reaction score
68
Country
Barbados
Dash Cam
Q3H aparently.
I have a "Q8" image that uses IMX179s, its a crap shoot. They can screen print anything on the front cover and make up a model.
 

sam300

New Member
Joined
Oct 12, 2016
Messages
1
Reaction score
1
Country
India
Hi there,

I see you have done quite deep work on the camera system, most of which is beyond me ;)
What I am working on is getting the WiFi video feed without using the app XDV say on my browser.
I assume the video stream is RTSP but the thing is I cannot find how to activate the stream nor the stream URL.
So would appreciate any help.

Thanks.
 

NMD

Member
Joined
Oct 5, 2016
Messages
30
Reaction score
30
Location
PORTUGAL
Country
Portugal
Dash Cam
Q3H-2
Hi all,
I have a Q3H-2 Action Camera acquired from Banggood and I would like to get some better results in video capture.
According to the specifications, it is equipped with Sony IMX179 image sensor and Allwinner V3S processor.
Can I upgrade my camera with your Q3H or F60B flash images firmware (.fex file)?

Meanwhile, I make a firmware backup. It is available for download at:
EDIT:
New download link:
 
Last edited:

Petesimon

Member
Joined
Oct 5, 2016
Messages
67
Reaction score
57
Country
United States
Dash Cam
F60B
Hello. I received my F60B allwinner v3 camera from gearbest. It's Huangle Crane SL603 with surfer boot logo. Shows 'V3' model and "20160515V4.0" at firmware info.
*EDIT* Here is build.prop. Normal operation works alright as expected. 1080p videos are good enough. 720p is okay. 2.7k is very pixelated about every 3 to 6 seconds. 4k is only 3.2k and low quality / fuzzy. Most still pictures are horrible. The cam connects wifi to my smartphone and windows computer with password 12345678 fine but recommended "XDV" app for android does not do anything, just error message. I tried netstat command in adb shell and TCP ports 6666, 80, and 53 are listening. Data passes on UDP port 6669 often... but for what? The IP seems always 192.168.100.1 on wlan0 interface. I'm trying different methods to discover how the video stream works (maybe via rtsp/http/raw udp)... such as looking around the linux filesystem on the cam, and using onvifdm, nmap and wireshark, tcpdump, among others in windows/android.
*EDIT*
Here is a backup of the firmware (used your backup.cmd script):
https://www.dropbox.com/s/v8w4zl0yn107eu7/f60b_firmware_20160515V4.0_backup.zip?dl=1
You can unpack some of that using SquashFS tools.
*EDIT*
here is the same backup data but in a single IMG ~22.7MB file for flashing in PhoenixSuit by USB.
https://www.dropbox.com/s/x87nje3sfdpf93j/F60B_original_firmware_20160515V4.0_crane_sl603tsfx-IMG.zip?dl=1
*EDIT*
and photo of firmware screen

and raw videos samples:
https://www.dropbox.com/sh/kej1utqb7pwgtnu/AADYs65pZ5tDP1ybnEHJp5Pja?dl=0

Which other android app or video streaming program for windows may work?
*EDIT*
Answer: "WIMIUS XDV" here and "WIMIUS CAM" here from Google Play work okay.

How to use http or rtsp url stream from the camera (if there is one)?
*EDIT* maybe proprietary raw tcp and/or udp stream are used, and wifi connection is encrypted. :(
and what / where is the "script.bin" data in this f60b camera?

Thanks for your work everybody!
 

Attachments

Last edited:

jokiin

Well-Known Member
Manufacturer
Joined
Jan 27, 2013
Messages
45,625
Reaction score
24,427
Location
Shenzhen, China - Sydney, Australia
Country
China
Dash Cam
Too many ¯\_(ツ)_/¯
try putting your Android phone into airplane mode and just switch wifi on and see if you can access then, make sure any other wifi access points that your phone is associated with are not within range or remove the association while you test
 

Petesimon

Member
Joined
Oct 5, 2016
Messages
67
Reaction score
57
Country
United States
Dash Cam
F60B
try putting your Android phone into airplane mode and just switch wifi on and see if you can access then, make sure any other wifi access points that your phone is associated with are not within range or remove the association while you test
well, i tried 5 or 6 wifi stream apps before I found one that works: "WIMIUS XDV" by WeTopU Techonology for android. please confirm.
 
OP
thegamut

thegamut

Active Member
Joined
Jul 22, 2016
Messages
118
Reaction score
68
Country
Barbados
Dash Cam
Q3H aparently.
and what / where is the "script.bin" data in this f60b camera?
Inside the first partition.. starts with "product". You have to encode/decode it with uberizer. It lists the hardware configuration of the camera so the uboot can pass that to the kernel. I haven't looked at where the RSTP stream is yet. It is probably set up by the SDV binary. On my cam the XDV application works fine.
 

Petesimon

Member
Joined
Oct 5, 2016
Messages
67
Reaction score
57
Country
United States
Dash Cam
F60B
You have to encode/decode it with uberizer.
This? http://forum.xda-developers.com/showthread.php?t=2124367

Inspired by this video
also just for the 'why not' factor and benefit of users who like to do remote viewing of an 'IP camera', i was hoping to find the method of streaming without too much poking around and decoding of any sort, so as to use VLC. But I'm not so good at deep tech stuff or hexadecimal. Here are two tcpdump pcap files of wlan0 showing verbose two way traffic, on my phone (1), and the other on the camera itself (2). Used tcpdump-arm binary on fs of phone and cam. Wireshark or similar program can open these files. Can someone please analyze these files and tell us what TCP 6666 and UDP 6669 are for? and how the android xdv actioncam app (on phone) does its magic? Camera IP is 192.168.100.1 Thanks.
1. https://www.dropbox.com/s/4yr4xnbt67wsphx/f60b-wimiusxdv-wifi-tcpdump-on-phone-to-camera.pcap.gz?dl=1
2. https://www.dropbox.com/s/3feyxx06dzs2o91/f60b-wimiusxdv-wifi-tcpdump-on-camera.pcap.gz?dl=1
 
Last edited:
OP
thegamut

thegamut

Active Member
Joined
Jul 22, 2016
Messages
118
Reaction score
68
Country
Barbados
Dash Cam
Q3H aparently.
Yep, that is uberizer. Heh, officially those ports are IRC. The app talks to the HTTP server in the phone and sends post commands. That is at least all I was able to see from the firmware as I found no static HTML pages.

btw, no RSTP in that camera side stream at all. just reads the videos/jpegs you have and then goes to UDP sending video.
 
Last edited:

NMD

Member
Joined
Oct 5, 2016
Messages
30
Reaction score
30
Location
PORTUGAL
Country
Portugal
Dash Cam
Q3H-2
Hi all,

I found some scripts to convert bin files to fex files and vice-versa. You can find it on:
http://www.mediafire.com/file/yu9d4agsuv3kspg/fex2bin_converter.rar

I am also making some corrections on Portuguese translation and I working on new icons. You can check my work on:
https://www.mediafire.com/folder/upm2r7ap6w5q6/Edit
As my work is progressing, I'm going to update this folder.

PS: Since a lot of people start to be interested in this subject, it would be good to clarify the firmware upgrade process.


 

Petesimon

Member
Joined
Oct 5, 2016
Messages
67
Reaction score
57
Country
United States
Dash Cam
F60B
but isn't that for using VLC as a server to put out a video stream? hm, maybe i'm missing something about that article and it could help to decipher the vid stream from the camera... well, to clarify, i would like to use VLC or another media player as a client to view the camera's stream.
in addition to what we posted before, i think i see "admin" as user and "12345" as password for some kinda authentication. to dig deeper, i plan to try Wireshark or similar program to decrypt the wifi WPA2 connection.
cheers.
 
Last edited:
Top