Hacking Q3H (allwinner v3 - Camdroid)

hello. nice work. if you have not already done so...please open my user profile in this forum and see all my posts in this thread. you might find something useful there. cheers.

I went through all of your posts, I came across some useful information using wireshark, nping, nmap, jadx and apktool.

Using nmap (nmap -v -A -sV 192.168.100.1) I've found that

Port 55 is dnsmasq
Port 80 is your regular http running on jdbhttp/0.1.1
Port 6666 is using tcpwrapper so it could be nothing or it could be used during communication (unknown right now)

The protocols connection seems to always involve a library called libipcamera.so , I have yet to find the C source code for this to see how it works.
I see a couple of projects use it, but haven't found the source code yet
I tried using arm-linux-armeabi-objdump to see if I can get anything from it, but It's fairly hard to read out.
You can find the library in both XDV-360 and Wimius XDV in the libs folder of the android apk (use jadx to get readable java code, apktool to get everything else)

One of the first things that popped out of XDV-360 was a GET request , which using pcap2curl generated this
curl 'http://192.168.100.1/system/build.prop' -X GET \
-H 'X-Unity-Version: 5.3.5p4' \
-H 'User-Agent: Dalvik/2.1.0 (Linux; U; Android 6.0.1; SM-A520F Build/MMB29K)' \
-H 'Host: 192.168.100.1' \
-H 'Connection: Keep-Alive' \
-H 'Accept-Encoding: gzip'

the response being

HTTP/1.1 200 OK
Server: jdbhttpd/0.1.0
Content-Type: application/octet-stream
Content-Length: 1566
Connection: Keep-alive

# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=JDQ39
ro.build.display.id=fuxin360imx179s_sdv-eng 4.2.2 JDQ39 eng.fjj.20160921.190039 test-keys
ro.build.version.incremental=eng.fjj.20160921.190039
ro.build.version.sdk=17
ro.build.version.codename=REL
ro.build.version.release=4.2.2
ro.build.date=2016... 09... 21... ......... 19:01:00 CST
ro.build.date.utc=1474455660
ro.build.type=eng
ro.build.user=fjj
ro.build.host=sunchip-To-be-filled-by-O-E-M
ro.build.tags=test-keys
ro.product.model=SoftwinerEvb
ro.product.brand=softwinners
ro.product.name=fuxin360imx179s_sdv
ro.product.device=fuxin360imx179s-sdv
ro.product.board=pluto
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=unknown
ro.wifi.channels=
ro.board.platform=exDroid
# ro.build.product is obsolete; use ro.product.device
ro.build.product=fuxin360imx179s-sdv
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=fuxin360imx179s_sdv-eng 4.2.2 JDQ39 eng.fjj.20160921.190039 test-keys
ro.build.fingerprint=softwinners/fuxin360imx179s_sdv/fuxin360imx179s-sdv:4.2.2/JDQ39/eng.fjj.20160921.190039:eng/test-keys
ro.build.characteristics=sdv
# end build properties

#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.feature.http=1
sys.usb.config=mass_storage,adb
ro.font.scale=1.0
ro.hwa.force=true
rw.logger=0
ro.sys.bootfast=true
ro.cdr.debug=false
ro.aw.sensordiscard=8
ro.product.modelcx=v3-xdv360
ro.product.brandcx=sunchip
rw.chipidcx=8888
ro.kernel.android.checkjni=1
net.bt.name=CamLinux
dalvik.vm.stack-trace-file=/data/anr/traces.txt

If I find the libipcamera.so source code, connecting to the device will be much easier.
I found that the higher res cameras use p2p streaming (I'm also trying to reverse engineer the samsung 360 camera)

If anyone has any extra info, it would be great to get this working without the apks
 
Hi to all,
... Now, the issue is that I could not find any fully working firmware. I got image on the LCD only using the builds for ST9341. But on all I get only flipped images (on some reversed images: up/down or left/right), on others I got flickering images or portrait mode + flickering image. And on all I got inverted colors.
I tried many stock firmware or modded firmware. It is hard to believe that there is no compatible rom for my camera. so, do you have any directions to follow?

For, example, using this Yinuocheng (EIƎ boot logo) 2017-02-21 (shows 20170221V1.1) I got:
Full boot, working camera, but: lcd image is in mirror and colors are inverted. But the recordings are perfect: good image, correct colors, no mirror image. so the issue is the LCD.

Check the images below, camera, board, lcd ribbon code.
Update:
it seems that almost all FW's with Ilitek ILI9341 (besides the ST9341) also works. but I get the same flipped image and inverted colors.
Before updating the FW, the logo (where the camera remained stuck) it was the right orientation and the right colors. I'm the only one in the world with this LCD? Thanks.

hm, peculiar. please share a backup copy of the original factory firmware from the camera. thanks.
.
 
F60B new firmware...
(strange date -20170832)
https://mega.nz/#!RIlj3AhD!kHLpSDQN2z6u1zIIZJW6TD2qWv8J-RmIhPVxs1ilffU
rMwQGiX.jpg
 
Hey,
Is it possible for someone to help me and edit my FW so I can have

High bitrates ~50/60 megabits w/shorter GOP.
Real sizes for 60fps and 120fps (IMX179s)
Most ISP processing disabled (IMX179s).

FW-backup:
https://drive.google.com/open?id=1OadELas7GnprCmcTkOa7km0uyO09nGjI

Product:
hzfy175-sdv
Manufacturer:
lzm
Short id:
zhongxing
OEM id:
zhongxing
Camera type:
6182
FW orig. date:
20171027
FW mod. date:
20170919
Camera name:
D200
Version:
20171207V3.3
LCD model:
st7789vyncsthc
LCD resolution:
320x240
LCD count:
1
Sensor model:
imx179s

I'm not really comfortable or capable of doing it without professional help :}
 
I ordered another cam of the same as I'm hacking now for my trying 3D stereo recording...
BTW, although it is very cheap, its image quality is not bad in 2.7k mode, I think.
https://www.tomtop.com/p-d4876b.html Now the price is US$23.79 with free shipping.
Is there anyone who try to hack it with me?;)

P.S. The cam's cons is that its holizontal FOV is about only 90 degree in 2.7K mode...
I wait for the same (https://www.tomtop.com/p-d4876b.html ) another camera, (will be delivered in a few days), i have this mount: Double Mount Dual Bracket Adapter.
Open question for me:
1. use 2.7k30fps vs 1080p60fps for creating 3D stereo
2. Which software to use for the merging 2 videos (+codec settings)
3. Stereo sound? (camera records audio very crappy )

This firmware add FOV settings to this camera:

Beike (xdv boot logo) 2017-06-01 (shows RF 2017 / 20170612) Ⓧ: https://drive.google.com/file/d/0B4t...ew?usp=sharing

Source:
list of firmwares
 
Last edited:
Hi, relic242.

I use AVIUTL with x264guiEx to make stereo movies. Unfortunately it is Japanese software, but it may be able to be custamized for other languages.
I usualy make fast forward playback movies such as
. So I ignore the sound and fps. I almost always use 4k30p, which requires less bit rate than 2.7k30p in Q3H-2 and whose image quality is not bad. Of course that is just in my case.
 
Last edited:
Hi im new and never modified img of android/linux so im sorry for the retard-like things i will say.

I buyed a Vemico 4K V3 (imx179 by specifics) i did some basic tests and i found that in my model (max 4K 30FPS) the max bitrate is 31.6mb/s (30F use olver 23mb/s so i think 31.6mb/s is a limit and make the video worse) and seems to support well only 1080p 30F or 720p 60F, my video with 1080p 60F had some pixels loss and 4k 30F seems more laggy and not better (that is obvious because the hw is fake 4k)...better not say the result of 720p 90F the quality is very bad for high compression or processing power overlimit.
I would be interested to use the .ko modified file or modify mine for try to get a higher bitrate (and so less compression for 60F) and real sizes and disable ISP.
IF it was sure of one HowTo updated i would try it but by reading this topic i find many modification and improvements on the road so if isnt too much i would like if someone can explain me the easier way for edit the .ko or change it.
I readed the first post were its said that i should do DD backup but then i saw a video with a script for backup so i would prefer edit my original firmware-imx179s.ko but be sure to have a fully working backup.

Thanks a lot.
 
Last edited:
The hardware can encode with 60+ Mbps bitrate.
Yes but the firmware of mine has a limit of 31.6 that is limiting the max capacity of the hw, infact i would like to edit that, i was always speaking of my model firmware because the HW is the same of you all, but now that we have those devices we can only try to make the firmware better because usually the original is very sloppy.

If i dont edit anything i can only hope to use 1080p 30F or 720p 60F not more...it will be worse.
 
Last edited:
I would like if some one would be so gentle to help me with the updated and right instructions, so i dont mess all up or lose time uselessly. (because im not familiar with images and android so i will only go again a wall)
Instructions for be safe with backup (youtube video method i found online is enough?) adn which and where are the files i need to hex edit.
Re-Thanks a lot.
 
Hi, i have to re-read the full thread, but i have a few questions now (with original or modified firmware):
1- Is it possible to enable/configure client mode wifi? To connect the camera to my router.
2- Is it possible to avoid the question when you connect it with usb. I mean, i always need webcam mode, it's possible?
3- Sometimes i will need less lens angle, do you know any lens compatible with this model? I will need ~90º

Regards!!
 
Hi!
I need this firmware: crane1gddr4k30imx179s-sdv
Please, help me, because my camera does not work without it.
(ST7789, Xradio 819)
 
Hi!
I need this firmware: crane1gddr4k30imx179s-sdv
Please, help me, because my camera does not work without it.
(ST7789, Xradio 819)

(1) look here - https://www.goprawn.com/forum/allwi...v4689-and-gc2023-action-cameras?p=130#post130 - on page1 in post #8

(2) look there - https://www.goprawn.com/forum/allwi...179-s-ov4689-and-gc2023-action-cameras/page38 - and view pages in reverse order, page 37, 36, 35, etc.

(3) and look there - http://fb.com/groups/allwinner4kcamerasusergroup/

use the search ⚲ function of each page that you view.
 
Hi!
I need this firmware: crane1gddr4k30imx179s-sdv
Please, help me, because my camera does not work without it.
(ST7789, Xradio 819)

Hi!
I managed to use my camera but the LCD shows an inverse image, perfect on the phone, and recording is super. This firmware is the base I've modified because it was made for GC9305 LCD and mine was ST7789V so there was no picture at all: beike 1gddrimx179s-sdv
https://drive.google.com/file/d/1jfIZWqPdOPh2cCiglVaXZ0BkFEK0h7nT/view
In script.bin, I copied the ST7789V driver from another firmware so I received an inverse image on the LCD. Anything I modify in script.bin does not get a normal LCD image.
I think the "2-system.img" should be modified, this is the next problem with this firmware, if I want to pack it with the "squashfs_unmake.bat" command, this error message will appear: "Can not find SQUASHFS superblock is d: \ ....... \ UNFEX \ 2-system.img "and no" squashfs-root "directory is created.
What should I do?
In addition, I would like to improve the quality of the sound, and it would be good if someone described the steps in detail.
Thank you in advance for your help.
 
Hi!
I managed to use my camera but the LCD shows an inverse image, perfect on the phone, and recording is super. This firmware is the base I've modified because it was made for GC9305 LCD and mine was ST7789V so there was no picture at all: beike 1gddrimx179s-sdv
https://drive.google.com/file/d/1jfIZWqPdOPh2cCiglVaXZ0BkFEK0h7nT/view
In script.bin, I copied the ST7789V driver from another firmware so I received an inverse image on the LCD. Anything I modify in script.bin does not get a normal LCD image.
I suppose the "2-system.img" should be modified, this is the next problem with this firmware, if I want to pack it with the "squashfs_unmake.bat" command, this error message will appear: "Can not find SQUASHFS superblock is d: \ ....... \ UNFEX \ 2-system.img "and no" squashfs-root "directory is created.
What should I do?
In addition, I would like to improve the quality of the sound, and it would be good if someone described the steps in detail.
Thank you in advance for your help.
 
  • Like
Reactions: NMD
Hi!
I managed to use my camera but the LCD shows an inverse image, perfect on the phone, and recording is super. This firmware is the base I've modified because it was made for GC9305 LCD and mine was ST7789V so there was no picture at all: beike 1gddrimx179s-sdv
https://drive.google.com/file/d/1jfIZWqPdOPh2cCiglVaXZ0BkFEK0h7nT/view
In script.bin, I copied the ST7789V driver from another firmware so I received an inverse image on the LCD. Anything I modify in script.bin does not get a normal LCD image.
I suppose the "2-system.img" should be modified, this is the next problem with this firmware, if I want to pack it with the "squashfs_unmake.bat" command, this error message will appear: "Can not find SQUASHFS superblock is d: \ ....... \ UNFEX \ 2-system.img "and no" squashfs-root "directory is created.
What should I do?
In addition, I would like to improve the quality of the sound, and it would be good if someone described the steps in detail.
Thank you in advance for your help.
Old I know ... ST7789

 
Back
Top