Skip to content

Instantly share code, notes, and snippets.

@gitfvb

gitfvb/readme.md

Last active Aug 13, 2020
Embed
What would you like to do?
Notes on Quelima R3 WiFi Camera

First

  • Install the app "Sports DV" and change WiFi SSID and password

URLs

  • Wifi and Cam settings are seperated and have different port numbers.
  • Wifi-Settings (just login withoug username and password): http://192.168.25.1
  • Cam LiveStream: http://192.168.25.1:8080/?action=stream
  • Not sure how the configuration is made really... Would need a Man-In-The-Middle-Attack or send the initial ICMP package

Change AP (Cam is the access point) to Station (Cam is a normal WiFi Client)

  • Log into http://192.168.25.1 without entering user and password
  • Go to the second tab, there you can change the access mode vom "AP" to "Station", enter the SSID of your home WiFi, Encryption mode and password (works with Windows 10 mobile hotspot, too, just notice it only works with 2.4 GHz networks). The cam will guess the channel when you saved the settings.
  • Don't worry, if the connection fails, the camera will offer you the configured AP again
  • Better give it a fixed IP through your router (identified by MAC address)

Other Information

  • The connection between the app and the cam is made through an initial ICMP package with the payload "99 bottles of beer on the wall"
  • looks like "MJPG-Streamer" was used when googleing for the url structure

Button configuration

  • Reset: Press Mode first and then On/Off
@gitfvb

This comment has been minimized.

Copy link
Owner Author

@gitfvb gitfvb commented Jun 25, 2018

Pakete mithilfe von "Packet Manager" auf Android analysiert.

@medbedb-ru

This comment has been minimized.

Copy link

@medbedb-ru medbedb-ru commented Jul 12, 2018

Hello friend!
Do you have any more information about this Quelima R3 WiFi Camera ?
Which web interface commands to snapshot, to turn on IR backlight, etc?
Camera settings are reset after shutdown. How to save them?
Best regards!

@mjaspers2mtu

This comment has been minimized.

Copy link

@mjaspers2mtu mjaspers2mtu commented Jan 26, 2019

First off, thank you so much for posting your findings, it helped a lot to get me started.
To pay it forward, here are my findings, specifically for the sq23 camera. The firmware seems to be exactly the same though.

  1. On mobile device, the chrome browser supports the stream playback native. Vlc for android also, but with a 2-3 second delay.
    This is important because the normal apps for these cameras do not work with what I am about to explain.

  2. I found that the range was really bad, about 20 feet with a single wall indoors. So I decided to explore how to extend this.
    2.1) Using your suggestion by connecting the camera to an access point instead of directly connecting is useful for indoor applications. I have tested this and it works.
    2.2) Use an esp8266 as a repeater using this firmware: here I found that mesh mode works well for this application. This boost the range from 20 feet to 120 feet, probably much more when in line-of-sight. Also with more esp's, the rang can be doubled or tripled by chaining the extenders with one another, which meshing automatically does.

  3. the battery was also not great, I was getting only half an hour or so on wifi, and since my camera does not allow wifi and charging at the same time, I decided to fix this too.
    3.1) I removed the built in battery, and soldered a connector on to it to attach two 18650 batteries in parallel. This gives plenty of juice at the cost of size. this also powers the esp range extender. I used a power bank enclosure for the battery's, and for the convenience to charge. However I do not use the 5v output of the power bank, but rather directly from the battery which is 3-4v and what the camera is made to handle.
    img_20190125_205859_hht
    See the battery size difference
    The esp needs I believe a capacitor, as it does not power on correctly without, I use the usb serial programmer attached for the capacitor.

  4. My camera also has a webcam mode when connected through usb to the computer. It takes some patience, but pressing and holding different buttons, and pressing both buttons at the same will eventually give you a uvc camera and doing lsusb on linux shows: "Generalplus Technology Inc. 808 Camera #9 (web-cam mode)"
    The image quality says to be 720p, but it looks pretty bad.
    my_photo-1
    my_photo-2

I will be doing further research or the new battery life, range and some more packet sniffing (btw I like the text you found in the initial request :)). However I may not post my findings, but good luck to you all.

@Naoufalgnz

This comment has been minimized.

Copy link

@Naoufalgnz Naoufalgnz commented Mar 9, 2019

@mjaspers2mtu can you please help with resetting the sq23

@Zipkart

This comment has been minimized.

Copy link

@Zipkart Zipkart commented Mar 14, 2019

Hello. I just got a SQ23 and i wanted to take snapshot with a http command but http://IP:8081//?action=snapshot didn't work. Has anyone an Idea?

My second question belongs to the image quality. Is ist possible to get better quality than 640x360 within a normal browser?

@thiagogalvao

This comment has been minimized.

Copy link

@thiagogalvao thiagogalvao commented Jul 25, 2019

Great article guy!! I think that this is the first one I can found with a lot o important informations.
About the third topic with my SQ23 I can keeping charger with Wifi at the same time, BUT, if my hotspot is going down when it get back the wifi connection was not maintained. Anyone had this problema ? Sometimes I need reset it too.

About commands to take snapshots and turn on the night vision (Infrared lights) ?

Cheers.

@Tedgh

This comment has been minimized.

Copy link

@Tedgh Tedgh commented Oct 26, 2019

Can you get access to the SD card via telnet/ftp or URL?

@MIDORIINKO

This comment has been minimized.

Copy link

@MIDORIINKO MIDORIINKO commented Jan 23, 2020

Hello friend.
I uploading java source of "sports dv".
Hope this helps.
https://drive.google.com/open?id=16qa-aJky4BFWL3_l_WYGuDLblU2eKgmO

@goranmbre

This comment has been minimized.

Copy link

@goranmbre goranmbre commented Feb 1, 2020

Hello,
I bought a camera a few days ago and some things annoy me. I hope you can help me.

  1. Sound is not transmitted via WIFI, video only. (Can this be fixed?)
  2. Sound is very low even if it is recorded on an SD card. (Can this be fixed?)
  3. Is it possible to operate IR and Vifi transmission simultaneously?
  4. Video compression is very bad and can only fit 3h40m video (720p) on a 32GB sd card. (Can this be fixed?)

Thanks a lot

@kdevkdev

This comment has been minimized.

Copy link

@kdevkdev kdevkdev commented Mar 27, 2020

@mjaspers2mtu

  1. My camera also has a webcam mode when connected through usb to the computer. It takes some patience, but pressing and holding different buttons, and pressing both buttons at the same will eventually give you a uvc camera and doing lsusb on linux shows: "Generalplus Technology Inc. 808 Camera #9 (web-cam mode)"

Thx, tried it, when plugged-in per usb, pressing the power button about 2-3 second switches between sd card mode and camera mode.

@thiagogalvao

This comment has been minimized.

Copy link

@thiagogalvao thiagogalvao commented Apr 11, 2020

I would like that the "station" configuration still saved after reboot, anybody know how to did it ?

@TumeSai

This comment has been minimized.

Copy link

@TumeSai TumeSai commented Apr 14, 2020

I would like that the "station" configuration still saved after reboot, anybody know how to did it ?

Same here. I hate this camera and the app. I have three of these and they are quite useless without being able to save the wifi configuration.

Also, does anyone know where to find a newer firmware for this. Maybe hard coding the conf in the firmware would be the way to go with this.
Thanks

@kdevkdev

This comment has been minimized.

Copy link

@kdevkdev kdevkdev commented Apr 14, 2020

There is a thread on some Russian forum where somebody posted a config file that can be put on the sd card that can apparently reset the wifi configuration. Maybe modifying this file could make the camera to always connect in station mode.

However, I did not manage to download the file as one presumably needs to be logged in. The forum uses some Russian handwriting captchas that I cannot solve. If somebody speaks Russian, maybe they could post the file here.

The link to the forum thread (has some other info on the cam too):
https://4pda.ru/forum/index.php?s=&showtopic=928759&view=findpost&p=94748285

Here is a link to a Youtube video where somebody performs a firmware update (didn't try if this works for the SQ13):
https://www.youtube.com/watch?v=oDpBJmrp2FU

@TumeSai

This comment has been minimized.

Copy link

@TumeSai TumeSai commented Apr 14, 2020

There is a thread on some Russian forum where somebody posted a config file that can be put on the sd card that can apparently reset the wifi configuration. Maybe modifying this file could make the camera to always connect in station mode.

However, I did not manage to download the file as one presumably needs to be logged in. The forum uses some Russian handwriting captchas that I cannot solve. If somebody speaks Russian, maybe they could post the file here.

The link to the forum thread (has some other info on the cam too):
https://4pda.ru/forum/index.php?s=&showtopic=928759&view=findpost&p=94748285

Here is a link to a Youtube video where somebody performs a firmware update (didn't try if this works for the SQ13):
https://www.youtube.com/watch?v=oDpBJmrp2FU

Hi, I was able to download it. Didn't check yet, but here is a dropbox link to it.

https://www.dropbox.com/s/mp0z736uwp76bi7/SQ23_wifi.zip?dl=0

I renamed it to a bit nicer one :)

UPDATE: It seems to contain a file called DefSet.cfg, which is empty. So no help here. Or maybe that indicates we could put something in that file and get it to configure it when starting. Let's see, I'll try to figure it out.

@kdevkdev

This comment has been minimized.

Copy link

@kdevkdev kdevkdev commented Apr 14, 2020

Thanks. Sadly it appears to be empty, so just putting an empty DefSet.cfg file in the root sd card folder might reset the camera to factory settings (especially the password).

Maybe the trial and error method to look for configurable options using common config file syntax could discover something, or looking for them in the firmware binary.

@TumeSai

This comment has been minimized.

Copy link

@TumeSai TumeSai commented Apr 14, 2020

Yep, I would like to get a full firmware from somewhere, I could then try to concoct what happens in the bootup. If anyone has it, not just the ~2MB file, would really appreciate it. Or... I could desolder the memory chip and read it. I'll do that, if no one has a the full firmware.

Thanksies

@TumeSai

This comment has been minimized.

Copy link

@TumeSai TumeSai commented Apr 14, 2020

I took one of them apart and read the flash chip. It indeed is only 2megabytes in size and does not contain a file system. Which is kinda not nice. I have uploaded the file to dropbox, so if anyone wants to check it, its here: https://www.dropbox.com/s/f0ggml7w41j4ex0/sq23_1.bin?dl=0

Binwalking provides just the following

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
433623        0x69DD7         Copyright string: "CopyrightMSG.txt"
733352        0xB30A8         Neighborly text, "neighbor_ap_list_process_beaconation entry"
1006928       0xF5D50         JPEG image data, JFIF standard 1.01
1006958       0xF5D6E         TIFF image data, big-endian, offset of first image directory: 8
1014801       0xF7C11         JPEG image data, JFIF standard 1.01
1014831       0xF7C2F         TIFF image data, big-endian, offset of first image directory: 8
1016153       0xF8159         Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1016206       0xF818E         HTML document header
1018539       0xF8AAB         HTML document footer
1018803       0xF8BB3         Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1018856       0xF8BE8         HTML document header
1023568       0xF9E50         HTML document footer
1023830       0xF9F56         Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1023883       0xF9F8B         HTML document header
1026418       0xFA972         HTML document footer
1026684       0xFAA7C         Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1026737       0xFAAB1         HTML document header
1028581       0xFB1E5         HTML document footer
1028847       0xFB2EF         Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1028900       0xFB324         HTML document header
1041773       0xFE56D         HTML document footer
1436319       0x15EA9F        TIFF image data, little-endian offset of first image directory: 8
1782272       0x1B3200        JPEG image data, EXIF standard
1782284       0x1B320C        TIFF image data, big-endian, offset of first image directory: 8
1791190       0x1B54D6        Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:crs="http://ns.adobe.com/camera-raw-settings/1.0/" x
1806336       0x1B9000        JPEG image data, JFIF standard 1.01
1883139       0x1CBC03        XML document, version: "1.0"
1889280       0x1CD400        XML document, version: "1.0"

So not very useful itself. I found no mention of DefSet.cfg from the data, so I don't think that is what does the configuration.

Hope this helps someone, I guess I destroyed something from the camera, since it no longer powers on ☠️

@thiagogalvao

This comment has been minimized.

Copy link

@thiagogalvao thiagogalvao commented Apr 14, 2020

Woww great job.
Maybe the station configuration keep in memory, because of that it lost the configuration after the reboot.

@kdevkdev

This comment has been minimized.

Copy link

@kdevkdev kdevkdev commented Apr 14, 2020

@TumeSai: Great job indeed. Opening the file in a hexeditor i am able to locate .cfg mentions, for example offset 10496

@TumeSai

This comment has been minimized.

Copy link

@TumeSai TumeSai commented Apr 14, 2020

@TumeSai: Great job indeed. Opening the file in a hexeditor i am able to locate .cfg mentions, for example offset 10496

Hey, great, I somehow missed that. Let me know if you can figure out how to configure that file! Superb!

@oepi-loepi

This comment has been minimized.

Copy link

@oepi-loepi oepi-loepi commented Apr 19, 2020

just joining but allready puzzling on line 43830: 192.168.100.100�255.255.255.0���192.168.100.1���wlan0���172.16.10.1�wifi start

and line 3CF80

open
wep40
wep104
wpa2
AP configuration==>
SSID:"%s"
SEC Type:"%s"
PASSWD:"%s"
Command failed !!
ERROR: unkown security type: %s

Looks like the file DefSet.cfg should look like this (I don't have this camera so i cannot try):

SSID:"This isYourNetWorkSSID"
SEC Type:"wpa2"
PASSWD:"YourPassword"

@lumiaen

This comment has been minimized.

Copy link

@lumiaen lumiaen commented Apr 26, 2020

just joining but allready puzzling on line 43830: 192.168.100.100�255.255.255.0���192.168.100.1���wlan0���172.16.10.1�wifi start

and line 3CF80

open
wep40
wep104
wpa2
AP configuration==>
SSID:"%s"
SEC Type:"%s"
PASSWD:"%s"
Command failed !!
ERROR: unkown security type: %s

Looks like the file DefSet.cfg should look like this (I don't have this camera so i cannot try):

SSID:"This isYourNetWorkSSID"
SEC Type:"wpa2"
PASSWD:"YourPassword"

Hello,

First things first, thank you @gitfvb for all the effort on this documentation :)

I have tried the DefSet.cfg but it looks that is not recognized. Probably, if we can use a file to write
a configuration for the wifi, it will be something like the "time.txt" that the camera uses to set the time.
I don't know how to find out which, if any, file should be added to the SD card.

@oepi-loepi

This comment has been minimized.

Copy link

@oepi-loepi oepi-loepi commented Apr 26, 2020

I have tried the DefSet.cfg but it looks that is not recognized. Probably, if we can use a file to write
a configuration for the wifi, it will be something like the "time.txt" that the camera uses to set the time.
I don't know how to find out which, if any, file should be added to the SD card.

Thank you for trying. Since i do not have such a camera it is very hard for me to find out where an how the data should be stored. It was worth a try.

@vern0m

This comment has been minimized.

Copy link

@vern0m vern0m commented Apr 28, 2020

So, I found these paths in this file.

C:\time.txt
--> setting time
C:\DCIM
--> contains pictures, videos
C:\JH_*.bin
-->
C:\DefSet.cfg
-->
C:\CopyrightMSG.txt
--> Builder information?
C:\Version.txt
-->
C:\sensor.txt
-->
C:\index0.tmp
-->

maybe the bold paths will be interesting for this job. I don't know anything about this things, but I will help, if I can. I also want to use this camera onto my Octopi.

I don't know, if it's interesting, but there is so much information about JH...

E:\GP15_PRO\JH76XX\JH7668\Code\v005\program\host\init.c

Try to connecting CABRIO via %s...

==============================

Please Insert %S wifi device
@lumiaen

This comment has been minimized.

Copy link

@lumiaen lumiaen commented Apr 28, 2020

So, I found these paths in this file.

C:\time.txt
--> setting time
C:\DCIM
--> contains pictures, videos
C:\JH_*.bin
-->
C:\DefSet.cfg
-->
C:\CopyrightMSG.txt
--> Builder information?
C:\Version.txt
-->
C:\sensor.txt
-->
C:\index0.tmp
-->

maybe the bold paths will be interesting for this job. I don't know anything about this things, but I will help, if I can. I also want to use this camera onto my Octopi.

I don't know, if it's interesting, but there is so much information about JH...

E:\GP15_PRO\JH76XX\JH7668\Code\v005\program\host\init.c

Try to connecting CABRIO via %s...

==============================

Please Insert %S wifi device

Hello,
i haven't yet tried octopi, but at another ubuntu based distro that i use i am able to use it as usb camera.
I had some issues after installing some libraries that basically broke the UVC drivers ( broke is not the correct term to be exact ) so i could not use it as a usb camera for skype out of the box. I can share the workaround if you don't get video output, i didn't bother to fix the issue to tell you the truth.
But the thing is, manually, after connecting through USB to the camera and switching to camera mode from card reader mode, you can use it as web camera for Octopi.

As for the paths in bold, i came to the same conclusion after checking the provided dump from @TumeSai and it seems that if we can somehow find out where those files are decoded, we might be able to use DefSet.cfg to initialise the camera in the mode we need when it's connected to a power source, not a PC ( or "computer" in general ) USB.

Does anyone know what kind of MCU this camera uses so someone might try to "decode","disassemble" or whatever the process is called?

@buitre-buitaker

This comment has been minimized.

Copy link

@buitre-buitaker buitre-buitaker commented May 22, 2020

Here you have the firmware that is avaible now. Please, add it to the readme text.

https://gofile.io/d/GQ3UdD

I will try to find defset file info.

@tomaszmariandudziak

This comment has been minimized.

Copy link

@tomaszmariandudziak tomaszmariandudziak commented May 22, 2020

I just want to thanks for all the research. I will try to analyze firmware, java source (i'm not good at it) and sniff some transmition between app and camera. It looks like this is very promising hardware with some hack and tricks. One trick i found: If You want to enable IR during wifi mode turn on recording to SD card and then push mode button for 3 seconds :)

@tomaszmariandudziak

This comment has been minimized.

Copy link

@tomaszmariandudziak tomaszmariandudziak commented May 22, 2020

My results:
port :80 - just for trivial http interface, when You can switch from AP to Station, and do some IP configuration
port :8080 - only to serve /?action=stream - but when i tried to acces it in "Station" mode i get no packets - maybe some initialization is required (via :8081) or maybe some additional http headers - i'll try it later
port :8081 - it's where whole communication with Android app is located. It is some form of binary talk - but every message starst with "GPSOCKET" string. - first application asks about something like "Menu" - this is an XML data with all fields that app can display in settings. it looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<Menu version="1.0">
	<Categories>
		<Category>
			<Name>Record</Name>
			<Settings>
				<Setting>
					<Name>Resolution</Name>
					<ID>0x0000000</ID>
					<Type>0x00</Type>
					<Default>0x01</Default>
					<Values>
						<Value>
							<Name>1080FHD 1920x1080 30fps</Name>
							<ID>0x00</ID>
						</Value>
						<Value>
							<Name>1080P 1440x1080 30fps</Name>
							<ID>0x01</ID>
						</Value>
						<Value>
							<Name>720P 1280x720 30fps</Name>
							<ID>0x02</ID>
						</Value>
					</Values>
				</Setting>
				<Setting>
					<Name>Loop Recording</Name>
					<ID>0x0000003</ID>
					<Type>0x00</Type>
					<Default>0x02</Default>					
					<Values>
						<Value>
							<Name>Off</Name>
							<ID>0x00</ID>
						</Value>
						<Value>
							<Name>3 Minutes</Name>
							<ID>0x01</ID>
						</Value>
						<Value>
							<Name>5 Minutes</Name>
							<ID>0x02</ID>
						</Value>
						<Value>
							<Name>10 Minutes</Name>
							<ID>0x03</ID>
						</Value>
					</Values>
				</Setting>
				<Setting>
					<Name>Record Audio</Name>
					<ID>0x0000005</ID>
					<Type>0x00</Type>
					<Default>0x00</Default>					
					<Values>
						<Value>
							<Name>Off</Name>
							<ID>0x00</ID>
						</Value>
						<Value>
							<Name>On</Name>
							<ID>0x01</ID>
						</Value>
					</Values>
				</Setting>
				<Setting>
					<Name>Date Stamp</Name>
					<ID>0x0000006</ID>
					<Type>0x00</Type>
					<Default>0x00</Default>					
					<Values>
						<Value>
							<Name>Off</Name>
							<ID>0x00</ID>
						</Value>
						<Value>
							<Name>On</Name>
							<ID>0x01</ID>
						</Value>
					</Values>
				</Setting>
			</Settings>
		</Category>
		<Category>
			<Name>Capture</Name>
			<Settings>
				<Setting>
					<Name>Resolution</Name>
					<ID>0x00000100</ID>
					<Type>0x00</Type>
					<Default>0x01</Default>					
					<Values>
						<Value>
							<Name>12M (4032x3024)</Name>
							<ID>0x00</ID>
						</Value>
						<Value>
							<Name>10M (3648x2736)</Name>
							<ID>0x01</ID>
						</Value>
						<Value>
							<Name>8M (3264x2448)</Name>
							<ID>0x02</ID>
						</Value>
						<Value>
							<Name>5M (2592x1944)</Name>
							<ID>0x03</ID>
						</Value>
						<Value>
							<Name>3M (2048x1536)</Name>
							<ID>0x04</ID>
						</Value>
						<Value>
							<Name>2MHD (1920x1080)</Name>
							<ID>0x05</ID>
						</Value>
						<Value>
							<Name>1.3M (1280x960)</Name>
							<ID>0x06</ID>
						</Value>
						<Value>
							<Name>VGA (640x480)</Name>
							<ID>0x07</ID>
						</Value>
					</Values>
				</Setting>
				<Setting>
					<Name>Date/Time</Name>
					<ID>0x00000107</ID>
					<Type>0x00</Type>
					<Default>0x02</Default>					
					<Values>
						<Value>
							<Name>Off</Name>
							<ID>0x00</ID>
						</Value>
						<Value>
							<Name>Date</Name>
							<ID>0x01</ID>
						</Value>
						<Value>
							<Name>Date/Time</Name>
							<ID>0x02</ID>
						</Value>
					</Values>
				</Setting>
			</Settings>
		</Category>
		<Category>
			<Name>System</Name>
			<Settings>
				<Setting>
					<Name>Auto Power Off</Name>
					<ID>0x00000202</ID>
					<Type>0x00</Type>
					<Default>0x00</Default>					
					<Values>
						<Value>
							<Name>Off</Name>
							<ID>0x00</ID>
						</Value>
						<Value>
							<Name>1 Minute</Name>
							<ID>0x01</ID>
						</Value>
						<Value>
							<Name>2 Minutes</Name>
							<ID>0x02</ID>
						</Value>
						<Value>
							<Name>5 Minutes</Name>
							<ID>0x03</ID>
						</Value>
					</Values>
				</Setting>
				<Setting>
					<Name>Date/Time</Name>
					<ID>0x00000205</ID>
					<Type>0x00</Type>
					<Default>0x00</Default>
					<Values>
						<Value>
							<Name>YY/MM/DD</Name>
							<ID>0x00</ID>
						</Value>
						<Value>
							<Name>MM/DD/YY</Name>
							<ID>0x01</ID>
						</Value>
						<Value>
							<Name>DD/MM/YY</Name>
							<ID>0x02</ID>
						</Value>
					</Values>				
				</Setting>
				<Setting>
					<Name>Language</Name>
					<ID>0x00000FF</ID>
					<Type>0x00</Type>
					<Default>0x00</Default>					
					<Values>
						<Value>
							<Name>English</Name>
							<ID>0x00</ID>
						</Value>
						<Value>
							<Name>............</Name>
							<ID>0x01</ID>
						</Value>
					</Values>
				</Setting>
				<Setting>
					<Name>Format</Name>
					<ID>0x00000207</ID>
					<Type>0x01</Type>
					<Default>0x00</Default>
				</Setting>
				<Setting>
					<Name>Default Setting</Name>
					<ID>0x00000208</ID>
					<Type>0x01</Type>
                    <Reflash>0x01</Reflash>
					<Default>0x00</Default>
				</Setting>
				<Setting>
					<Name>Menu  Version</Name>
					<ID>0x00000209</ID>
					<Type>0x03</Type>
					<Default>0x00</Default>
					<Values>
						<Value>
							<Name>20170602 V1.1.2</Name>
							<ID>0x00</ID>
						</Value>
					</Values>				
				</Setting>
				<Setting>
					<Name>Firmware Version</Name>
					<ID>0x0000020B</ID>
					<Type>0x03</Type>
					<Default>0x00</Default>
					<Values>
						<Value>
							<Name>ver</Name>
							<ID>0x00</ID>
						</Value>
					</Values>				
				</Setting>
			</Settings>
			</Category>
		<Category>
			<Name>Wireless Network</Name>
			<Settings>
				<Setting>
					<Name>WifiName</Name>
					<ID>0x00000300</ID>
					<Type>0x02</Type>
					<Default>GoPlusCam</Default>					
				</Setting>
				<Setting>
					<Name>Password</Name>
					<ID>0x00000301</ID>
					<Type>0x02</Type>
				</Setting>
			</Settings>
		</Category>
	</Categories>
</Menu>

this looks like some memory mapping, or instructions mapping (maybe instructions because WifiName is 0x00000300 and Password is 0x00000301). then transmission goes more binary again. Downloading files, movies etc works this way.

Lots of work ahead :). I'll try to launch the stream in "Station" mode. Maybe look for some strings in firmware.

@mkgin

This comment has been minimized.

Copy link

@mkgin mkgin commented Jun 27, 2020

I just picked up a couple SQ23 from the post office yesterday... They were ordered them from Aliexpress about 2 months ago.... after looking at the manual,happy that I googled and found this!

Very interesting reading... It would be really nice be able to have a way to store a persistent configuration for the WIFI on the SD card.

Anyway, seems that a certain user has some interesting reps on github that could be helpful for reverse engineering the firmware.
Searching the other repos could also be interesting.

https://github.com/yilanjueding123/7801/blob/master/host/init.c#L146

  • "(C) Copyright 2014-2016 Shenzhen South Silicon Valley microelectronics co.,limited"

https://github.com/yilanjueding123/7801/blob/master/application/task_ameba/app/src/gp_socket_cmd.c#L31

  • "Copyright Generalplus Corp. ALL RIGHTS RESERVED."

And a circuit diagram too! Well it could be for any camera base on this chip.
https://github.com/yilanjueding123/mypdf/blob/master/pdf/JH_7612%20V1_SCH.pdf

@thiagogalvao

This comment has been minimized.

Copy link

@thiagogalvao thiagogalvao commented Jun 28, 2020

For now, to do a hardcoded is a good idea.
How to build a new firmware with a fixed configuration and upload that?

@wimex

This comment has been minimized.

Copy link

@wimex wimex commented Aug 12, 2020

https://github.com/yilanjueding123

This seems to be gold, this user has multiple repositories which seem to be almost the exact firmware that is running on my device and I have figured out some interesting and/or useful stuff by examining the source code. There seem to be project files (for Source Insight 4.0) and even some build tools, but not enough info to actually compile the projects.

Recovering a bricked device
Out of curiosity I have flashed a firmware from one of the repositories and my camera wasn't able to boot anymore. To recover from this, you have to put a firmware update file on the SD card and plug in the device to flash it (but this will probably not work if you flash complete garbage on your device). The filename has to follow this formula: JH_[product]_[checksum].bin (see ap_storage_service.c). The product is your camera type (e.g. 7668, but be aware that if you flash the firmware of a different camera, it will be the product number of that firmware), and the checksum can be calculated with the jh_sum_tools.exe utility (can be found in the tools directory).

Sending/receiving commands
It's a simple TCP based binary communication, nothing special. Every request starts with GPSOCKET and then it's followed by the command type and some parameters. It's pretty easy to understand (see socket_cmd.c and socket_cmd.h) but it seems to be missing some features of the camera (e.g. no clear way to enable the night vision mode).

DefSet.cfg
No matter what you put into this file, it's not going to read anything from it. It only checks if the file exists, and if it does, it restores the default configuration (see ap_storage_service.c and ap_state_config.c). However, there is an interesting line inside the ap_state_config_restore function: the ap_state_config_store function call is commented out, but it seems to be able to store every setting that the camera has somewhere (nvram maybe?). I think it can't be invoked without recompiling the firmware. However, investigating this might be a good direction.

Firmware structure
In the tools project, there is a ComBin,exe file with the corresponding INI that is able to combine parts of the firmware into the final binary file. Basically, it consists of a header and two separate ROM files. The software is based on uC/OS.

Fun but not very useful things
You can put different strings into the time.txt file and the camera will write some information to the SD card (see ap_storage_service.c):
(Yes, some strings are weird, but this is how it is. Also, exclude the quotation marks)
"COPYFIGHT MESSAGE? " writes "CopyrightMSG.txt" with some chinese copyright text
"VERSION_NUMBER??" writes "version.txt" with the firmware version
"SENSOR?" writes "sensor.txt" with the sensor type
"WIFI STATUS?" is also present in some versions of the source code but doesn't do anything on my camera

@nikossof

This comment has been minimized.

Copy link

@nikossof nikossof commented Aug 13, 2020

Good evening to all.
I also have a problem with the sq23 camera. when I register on the mobile (ios, iphone) photo or video, I can not find the files on the mobile. does anyone know where I find them?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.