Replies: 2 comments 3 replies
-
|
ATBM6031 SDIO module, looks like one of the modules is used in AP mode to comm. with the monitor. |
Beta Was this translation helpful? Give feedback.
-
|
@gtxaspec Sorry for bothering you. Could you please advise how realistic it would be to hook one of the functions in |
Beta Was this translation helpful? Give feedback.
-
|
try https://github.com/FiveLeavesLeft/WyzeCameraLiveStream for clues |
Beta Was this translation helpful? Give feedback.
-
|
Spot on! You pointed me exactly in the right direction! After making some changes and recompiling it, I finally get a working local stream. 🎉 Thank you <3 |
Beta Was this translation helpful? Give feedback.
-
|
make a repo and share your changes so others could enjoy =D |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Hello!
I don’t know where else I could share my experience digging into this type of device, so I’m posting here and asking for help.
Device
I have a Baby Monitor that allows viewing the video stream both on an external monitor (the so-called parent module) and in the Tuya app.
LINKS:
https://aliexpress.com/item/1005008114110129.html
https://aliexpress.com/item/1005008893570006.html
The external monitor (parent module) connects locally and directly to the camera (through a separate radio module), allowing you to view the stream, adjust camera settings, control PTZ, etc. The same functions are available in the app via the Tuya Cloud when the camera is connected to Wi-Fi. The app and the external parent module can operate simultaneously.
Goal
The goal is to get a local RTSP stream (or at least snapshots) while keeping full functionality of the parent module. Of course, it would be great to install Thingino, but it seems that doing so would break the functionality of the external parent module.
Where I Started
There are no settings related to RTSP/ONVIF in the app. The Tuya Local integration does not provide a video stream, only partial control over the camera settings. Using go2rtc, I was able to get a stream, but it’s not local — it goes through the SmartLife cloud.
None of the root methods I found online or in the guino repositories were successful.
Teardown
After opening the camera, I found the following (CLICKABLE):
The device uses an Ingenic T31 SoC. There are two AltoBeam radio modules. The first one is a 60321s on a separate board at the bottom of the enclosure; the second one is soldered onto the main board. I wasn’t able to reliably identify the second module, as the chip marking is partially worn off. There is also a BoyaMicro flash chip labeled 25Q128ESSIG.
After connecting a programmer, I dumped the flash memory, unpacked it, and started analyze.
Here is a unpacked dump (removed some user data): dump.tar.gz
Getting telnet & root
After exploring the script startup sequence, I noticed that the main script (
/usr/jsapp/app_init.sh) tries to launch the main application (baby_monitor) from the root of the SD card (/mnt/extsd/baby_monitor) if it exists; otherwise, it launches it from flash.I created a
baby_monitorin the root of the SD card with the following contents:After that, I was able to successfully access the device over telnet.
Some outputs
> cat /proc/cmdline console=ttyS1,115200n8 loglevel=0 mem=80M@0x0 rmem=48M@0x5000000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock3 r w mtdparts=jz_sfc:256k(boot),2048k(kernel),320k(jssn),11008k(root),2560k(jsapp),-(appfs)> ls -l /proc/jz/ dr-xr-xr-x 2 root root 0 Jan 1 00:32 audio dr-xr-xr-x 64 root root 0 Jan 1 00:32 clock dr-xr-xr-x 2 root root 0 Jan 1 00:32 ddr dr-xr-xr-x 2 root root 0 Jan 1 00:32 debug dr-xr-xr-x 2 root root 0 Jan 1 00:32 gpio dr-xr-xr-x 2 root root 0 Jan 1 00:32 isp dr-xr-xr-x 2 root root 0 Jan 1 00:32 mmc0 dr-xr-xr-x 2 root root 0 Jan 1 00:32 reset dr-xr-xr-x 2 root root 0 Jan 1 00:32 sinfo dr-xr-xr-x 2 root root 0 Jan 1 00:32 watchdogdmesg: dmesg.log
Attempt to run prudynt-t
Overall, I understood that running
prudynt-tandbaby_monitorapp at the same time would most likely be impossible, but I decided to at least try bringing up a local stream. Even then, I ran into issues.I downloaded
prudynt-T31-staticfrom releases page and tried to run it.The configuration I used:
Run:
logcat spam:
I tried building the latest version of prudynt from the repository using Docker with different toolchains, but almost every time I ended up with something like the following:
Conclusion
TBH, I have very little experience with systems like this - cross-compiling C++, working with different toolchains, ISP handling, etc. I would really appreciate it if someone with experience could point me in the right direction on how to get a local stream from this device while preserving the functionality of the parent module.
Thanks!
Beta Was this translation helpful? Give feedback.
All reactions