diff --git a/README.md b/README.md index 2d29b14a..3172fe8d 100644 --- a/README.md +++ b/README.md @@ -5,9 +5,9 @@ The openfang is a bootloader, kernel and toolchain for devices using Ingenic T10 At the present time, this repository only contains kernel and rootfs for cameras using Inegnic T20 SOC. To ease identifying these cameras please use the pictures below. -![Xiaomi Mijia](doc/xiaomi_mijia.jpg) Xiaomi Mijia 2018 | ![Wyze Cam v2](doc/wyzecam_v2.jpg) Wyze Cam V2 +![Xiaomi Mijia](doc/SXJ02ZM/img/xiaomi_mijia_2018.jpg) Xiaomi Mijia 2018 | ![Wyze Cam v2](doc/wyzecam_v2/img/wyzecam_v2.jpg) Wyze Cam V2 :-- | --: -![Xiaomi Dafang](doc/xiaomi_dafang.jpg) Xiaomi Dafang | ![Wyze Cam Pan](doc/wyzecam_pan.jpg) Wyze Cam Pan +![Xiaomi Dafang](doc/xiaomi_dafang/img/xiaomi_dafang.jpg) Xiaomi Dafang | ![Wyze Cam Pan](doc/WYZECP1/img/wyzecam_pan.jpg) Wyze Cam Pan If you have a device with a Ingenic T10 SOC, consider using for now https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks diff --git a/doc/SXJ02ZM/SXJ02ZM_instructions.md b/doc/SXJ02ZM/SXJ02ZM_instructions.md new file mode 100644 index 00000000..8cfafa06 --- /dev/null +++ b/doc/SXJ02ZM/SXJ02ZM_instructions.md @@ -0,0 +1,196 @@ +# Introduction and requirements + + +The Xiaomi Mijia 1080p v3 model is the snow-white model that was released in 2018, and has a T20L SOC with 64MB of RAM. +Unfortunately there is no known firmware exploit that allows us to easily edit the firmware to get ssh access to the camera. +In order to install OpenFang on the camera, we need to program a custom bootloader for the camera using a ch341a programmer. + + + +### Requirements +You will need: +- USB CH341A programmer and Programmer Testing Clip SOP8 + + +- Soldering iron (any below 15w; you should avoid warming to much the SMD components) +- Solder Flux (any rosin flux) +- Torx Screwdrivers (sizes T03, T04, or T05) +- a piece of plastic foil (e.g. kapton tape) to isolate the vcc pin when programming the chip + + + +## 1. Case disassembly +- Remove the back of the camera, starting from the botton. + + + + +- After the back has been losen, carefully remove the speaker/mic connector before removing the back. + + + + +- Unscrew the 3 black screws to separate the board from the front cover. Leave the middle screws in there! + + + + +- After removing the screws, carefully remove the 2 frontpanel LED connectors. + + + + + +## 2. (De)soldering and preparing to flash +### Desoldering +- Desolder the VCC leg (Leg 8) of the SOP8 chip. + + + + + + +- Put a piece of plastic foil between the desoldered leg and the PCB. We do this to avoid powering-up the whole PCB through the chip+programmer, as the chip would net be flashable like this. + + + + +### Conecting the SOC to the programmer +- Put the programmer clip tight on the SOP8 package, having in mind that the red cable is always for PIN1. Make sure it sits tight on the SOP8 package. + + + + + + +- Connect the clip cable to the programmer as seen in here. + + + +- Plug in the programer to the computer and start the flashing process. + + + +## 3. Flashing the Ingenic T20L SOC (Windows / Mac / Linux) +### Downloading the needed files +- Download the latest release package from [OpenFang/releases](https://github.com/anmaped/openfang/releases) and extract it somewhere. +- Download the proper flashing software from the tools directory. It is recommended to flash the Ingenic T20L SOC under Linux / MacOS as I never had success in flashing it with windows! Feel free to report otherwise. +- You might have to recompile CH341aprog. Download the latest release at [setarcos/ch341prog](https://github.com/setarcos/ch341prog)and compile it. + + +#### Flashing under MacOS / Linux +- Use ch341prog to first erase the SOC: ``` ./ch341prog -e ``` +- Use ch341prog to write the custom bootloader to the SOC: ``` ./ch341prog -w u-boot-lzo-with-spl_t20_64M.bin ``` Caution: flash the 64M binary file! + + + +#### Flashing under Windows +- Download the [CH341A programmer v1.29](https://www.bios-mods.com/forum/Thread-CH341A-v1-29), extract it somewhere and run it. +- you will get an error message, which you can ignore: + + + +- After clicking on connect, you will be prompted to select your flash memory. Select any of the two. + + + +- Click on erase at the top icons and wait for the process to finish. + + + +- If the erasing has been completed, you will be prompted with a message. + + + +- Click on read at the top icons and make sure that everything is set to FF. + + + +- Click on File -> open and select the u-boot-lzo-with-spl_t20_64M.bin file. Do not select the 128m one. + + + +- After the flashing, click on read at the top icons and see is something was written to the flash. + + + + +## 4. Preparing the SD-Card (Windows / Mac / Linux) +### Flash rootfs using Windows +- Download and install any partitioning software. My favourite freeware for this is Active Partition Manager. +- On active partiton manager erase all partitions of the sd-card. +- Create one NTFS-Partition with about 4GB (4096 mbytes) +- Select edit params of the partition and make sure you assign a drive letter to it. +- Use the rest of the unallocated space to create one exFat partition. +- Select edit params of the partition and make sure you assign a drive letter to it. +- Open DiskImage 1.6 ([link](http://www.roadkil.net/program.php/P12/Disk%20Image)) and flash the rootfs.ext2 imagefile onto the 4GB NTFS partition you created. + + + +### Flash rootfs using linux +``` +fdisk /dev/sdb +``` +Use `p` to see the list of partitions and `n` to create a new one. + +After creating all the partitions we should see something like that + +``` +Command (m for help): p +Disk /dev/sdb: 58.4 GiB, 62730010624 bytes, 122519552 sectors +Units: sectors of 1 * 512 = 512 bytes +Sector size (logical/physical): 512 bytes / 512 bytes +I/O size (minimum/optimal): 512 bytes / 512 bytes +Disklabel type: dos +Disk identifier: 0x00000001 + +Device Boot Start End Sectors Size Id Type +/dev/sdb1 2048 10242047 10240000 4.9G 7 HPFS/NTFS/exFAT +/dev/sdb2 10242048 122517503 112275456 53.6G 7 HPFS/NTFS/exFAT +``` + +The first partition is the boot partition and is where we should store the rootfs. For that use the command + +``` +dd if=/path/to/image/rootfs.ext2 of=/dev/sdb1 +``` +to flash the rootfs image. + + + +### Flash rootfs using MacOS +Follow the same instructions for Linux. + + + +## 5. Configuring the cam +If everything went well so far, your cam's front LED should be flashing in different colors, and after 1-2 minutes stay orange. If this is the case, you can now connect your computer to the temporary created hotspot from the camera for the initial setup. +When you connect to the OpenFang access point, you can open a browser and call https://192.168.14.1 in the browser to access the panel. Use admin / admin in order to log on. If you get an error saying conection_refused, please proceed with this guide. Else please jump to "Resize the rootfs image". + + + + +### Create a certificate and boot the webserice in case of problems. +- Log on a SSH shell to 192.168.14.1 with username admin / admin. +- On the shell type ``` su ``` press return. +- Afterwards type ``` openssl req -new -x509 -keyout /etc/ssl/lighttpd.pem -out /etc/ssl/lighttpd.pem -days 365 -nodes -subj "/C=DE/ST=.../L=.../O=.../OU=.../CN=.../emailAddress=..." ``` press return. +- Type ``` cd /etc/init.d/ ``` press return. +- Finally type ``` ./lighttpd.sh start ``` press return. +- The webservice should now start and you should be able to log on. + + + +### Resize the rootfs image +The rootfs image is smaller than the available partition where we have written the rootfs directories. To be able to use all the available space we allocated for the partition, we have to resize the filesystem. + +- Log on a SSH shell to 192.168.14.1 with username admin / admin. +- On the shell type ``` su ``` press return. +- Type ``` resize2fs /dev/mmcblk0p1 ``` press return. +- It will take a short while. Note that the time it takes depends of the size of the partition you are resizing. + + + +### Confifg the cam on the WebUi +- Go to Settings and select the MOdel of the cam (in this case the Mijia 2018) +- Go to wireless in the settings, select the mode and insert your home router's network credentials. Don't chose the type AP, as it will create an AP and this is not what we want. + diff --git a/doc/SXJ02ZM/img/20181214_071923.jpg b/doc/SXJ02ZM/img/20181214_071923.jpg new file mode 100644 index 00000000..1dac243a Binary files /dev/null and b/doc/SXJ02ZM/img/20181214_071923.jpg differ diff --git a/doc/SXJ02ZM/img/W25Q128JVSQ.jpg b/doc/SXJ02ZM/img/W25Q128JVSQ.jpg new file mode 100644 index 00000000..5f842527 Binary files /dev/null and b/doc/SXJ02ZM/img/W25Q128JVSQ.jpg differ diff --git a/doc/SXJ02ZM/img/c341a_clamp.jpg b/doc/SXJ02ZM/img/c341a_clamp.jpg new file mode 100644 index 00000000..e3688eec Binary files /dev/null and b/doc/SXJ02ZM/img/c341a_clamp.jpg differ diff --git a/doc/SXJ02ZM/img/c341a_position.jpg b/doc/SXJ02ZM/img/c341a_position.jpg new file mode 100644 index 00000000..6f7d9b82 Binary files /dev/null and b/doc/SXJ02ZM/img/c341a_position.jpg differ diff --git a/doc/SXJ02ZM/img/clamponsop.jpg b/doc/SXJ02ZM/img/clamponsop.jpg new file mode 100644 index 00000000..637513d5 Binary files /dev/null and b/doc/SXJ02ZM/img/clamponsop.jpg differ diff --git a/doc/SXJ02ZM/img/clamponsop2.jpg b/doc/SXJ02ZM/img/clamponsop2.jpg new file mode 100644 index 00000000..d703af32 Binary files /dev/null and b/doc/SXJ02ZM/img/clamponsop2.jpg differ diff --git a/doc/SXJ02ZM/img/desolderedleg.jpg b/doc/SXJ02ZM/img/desolderedleg.jpg new file mode 100644 index 00000000..077b3ed3 Binary files /dev/null and b/doc/SXJ02ZM/img/desolderedleg.jpg differ diff --git a/doc/SXJ02ZM/img/foilundersop.jpg b/doc/SXJ02ZM/img/foilundersop.jpg new file mode 100644 index 00000000..05f02020 Binary files /dev/null and b/doc/SXJ02ZM/img/foilundersop.jpg differ diff --git a/doc/SXJ02ZM/img/frontpanelcables.jpg b/doc/SXJ02ZM/img/frontpanelcables.jpg new file mode 100644 index 00000000..6dcc03f6 Binary files /dev/null and b/doc/SXJ02ZM/img/frontpanelcables.jpg differ diff --git a/doc/SXJ02ZM/img/opencase.jpg b/doc/SXJ02ZM/img/opencase.jpg new file mode 100644 index 00000000..1d44b656 Binary files /dev/null and b/doc/SXJ02ZM/img/opencase.jpg differ diff --git a/doc/SXJ02ZM/img/screws.jpg b/doc/SXJ02ZM/img/screws.jpg new file mode 100644 index 00000000..14bec7b8 Binary files /dev/null and b/doc/SXJ02ZM/img/screws.jpg differ diff --git a/doc/SXJ02ZM/img/speakercable.jpg b/doc/SXJ02ZM/img/speakercable.jpg new file mode 100644 index 00000000..db5ba798 Binary files /dev/null and b/doc/SXJ02ZM/img/speakercable.jpg differ diff --git a/doc/SXJ02ZM/img/windows_flasher_1.png b/doc/SXJ02ZM/img/windows_flasher_1.png new file mode 100755 index 00000000..b8fad8b9 Binary files /dev/null and b/doc/SXJ02ZM/img/windows_flasher_1.png differ diff --git a/doc/SXJ02ZM/img/windows_flasher_2.png b/doc/SXJ02ZM/img/windows_flasher_2.png new file mode 100755 index 00000000..ad603576 Binary files /dev/null and b/doc/SXJ02ZM/img/windows_flasher_2.png differ diff --git a/doc/SXJ02ZM/img/windows_flasher_3.png b/doc/SXJ02ZM/img/windows_flasher_3.png new file mode 100755 index 00000000..0df3f714 Binary files /dev/null and b/doc/SXJ02ZM/img/windows_flasher_3.png differ diff --git a/doc/SXJ02ZM/img/windows_flasher_4.png b/doc/SXJ02ZM/img/windows_flasher_4.png new file mode 100755 index 00000000..ba41ca15 Binary files /dev/null and b/doc/SXJ02ZM/img/windows_flasher_4.png differ diff --git a/doc/SXJ02ZM/img/windows_flasher_5.png b/doc/SXJ02ZM/img/windows_flasher_5.png new file mode 100755 index 00000000..dfdb2292 Binary files /dev/null and b/doc/SXJ02ZM/img/windows_flasher_5.png differ diff --git a/doc/SXJ02ZM/img/windows_flasher_6.png b/doc/SXJ02ZM/img/windows_flasher_6.png new file mode 100755 index 00000000..d7e68cba Binary files /dev/null and b/doc/SXJ02ZM/img/windows_flasher_6.png differ diff --git a/doc/SXJ02ZM/img/windows_flasher_7.png b/doc/SXJ02ZM/img/windows_flasher_7.png new file mode 100755 index 00000000..e79d453a Binary files /dev/null and b/doc/SXJ02ZM/img/windows_flasher_7.png differ diff --git a/doc/xiaomi_mijia.jpg b/doc/SXJ02ZM/img/xiaomi_mijia_2018.jpg similarity index 100% rename from doc/xiaomi_mijia.jpg rename to doc/SXJ02ZM/img/xiaomi_mijia_2018.jpg diff --git a/doc/wyzecam_pan.jpg b/doc/WYZECP1/img/wyzecam_pan.jpg similarity index 100% rename from doc/wyzecam_pan.jpg rename to doc/WYZECP1/img/wyzecam_pan.jpg diff --git a/doc/wyzecp1_instructions.md b/doc/WYZECP1/wyzecp1_instructions.md similarity index 100% rename from doc/wyzecp1_instructions.md rename to doc/WYZECP1/wyzecp1_instructions.md diff --git a/doc/towrite.png b/doc/img/towrite.png similarity index 100% rename from doc/towrite.png rename to doc/img/towrite.png diff --git a/doc/use_diskpart.png b/doc/img/use_diskpart.png similarity index 100% rename from doc/use_diskpart.png rename to doc/img/use_diskpart.png diff --git a/doc/install.md b/doc/install.md index 9867c368..2e48bebb 100644 --- a/doc/install.md +++ b/doc/install.md @@ -7,8 +7,8 @@ The installation of openfang is mainly composed of three steps. The first one co - [Resize the written filesystem](#resize-the-rootfs-image) More specific install guides can be found in the following links -- [Wyze Pan Cam (WYZECP1)](wyzecp1_instructions.md) (thanks to M@ SWARTZ) - +- [Wyze Pan Cam (WYZECP1)](/doc/WYZECP1/wyzecp1_instructions.md) (thanks to M@ SWARTZ) +- [Xiaomi Mijia V3 2018 (SXJ02ZM)](/doc/SXJ02ZM/SXJ02ZM_instructions.md) (thanks to TheRoss) ## 1. Dowload bootloader @@ -47,11 +47,11 @@ dd if= of=/dev/mtd0 diskpart or disk management wizard can be used to make partitions. - + To flash the image in the first partition of the sd card use the tool DiskImage 1.6 ([link](http://www.roadkil.net/program.php/P12/Disk%20Image)). - + ### Flash rootfs using linux diff --git a/doc/sxj02ZM/pictures/20181214_071923.jpg b/doc/sxj02ZM/pictures/20181214_071923.jpg deleted file mode 100644 index f1cfe061..00000000 Binary files a/doc/sxj02ZM/pictures/20181214_071923.jpg and /dev/null differ diff --git a/doc/wyzecam_v2.jpg b/doc/wyzecam_v2/img/wyzecam_v2.jpg similarity index 100% rename from doc/wyzecam_v2.jpg rename to doc/wyzecam_v2/img/wyzecam_v2.jpg diff --git a/doc/xiaomi_dafang.jpg b/doc/xiaomi_dafang/img/xiaomi_dafang.jpg similarity index 100% rename from doc/xiaomi_dafang.jpg rename to doc/xiaomi_dafang/img/xiaomi_dafang.jpg