alienatedsec / yi-hack-v5

Even newer Custom Firmware for Xiaomi Cameras based on Hi3518ev200 Chipset. It includes free RTSP, ONVIF and other improvements based on the work by roleoroleo

Why this YI-HACK-V5 firmware?

The answer is simple: missing updates, RTSP, and not based on the latest stock firmware (which features improvements and new cool stuff). Besides, there were no updates to yi-hack-v4, and I am against that RTSP licensing model. I have contributed enough and will continue my work separately.

I am slowly working on pre-release versions, and I can see lots of downloads, testing and contributions. A big thank you to the community.

Table of Contents

• Features
• Supported cameras and Firmware Files
• Getting started
• Unbrick your camera
• Acknowledgments
• Disclaimer
• Donations

Features

This firmware will add the following features:

• NEW FEATURES
  • RTSP server - which will allow an RTSP stream of the video while keeping the cloud features enabled (available to all and it is free).
  • MQTT - detect motion directly from your home server!
  • WebServer - user-friendly stats and configurations.
  • SSH server - Enabled by default.
  • Telnet server - Disabled by default.
  • FTP server - Enabled by default.
  • Web server - Enabled by default.
  • The possibility to change some camera settings (copied from the official app):
    • camera on/off
    • video saving mode
    • detection sensitivity
    • status led
    • ir led
    • rotate
  • PTZ support through a web page.
  • Snapshot feature
  • Proxychains-ng - Disabled by default. Useful if the camera is region-locked.
  • The possibility to disable all the cloud features while keeping the RTSP stream.

Supported cameras and firmware files

Currently, this project supports the following cameras:

Camera	rootfs partition	home partition	Base Firmware	Remarks
Yi Home	rootfs_y18	home_y18	1.8.7.0F_201809191400	Firmware files required for the Yi Home camera.
Yi 1080p Home	rootfs_y20	home_y20	2.1.0.0E_201809191630	Firmware files required for the Yi 1080p Home camera.
Yi Dome	rootfs_v201	home_v201	1.9.1.0J_201809191135	Firmware files required for the Yi Dome camera.
Yi 1080p Dome	rootfs_h20	home_h20	1.9.2.0I_201812141405	Firmware files required for the Yi 1080p Dome camera.
Yi 1080p Cloud Dome	rootfs_y19	home_y19	1.9.3.0E_201812141519	Firmware files required for the Yi 1080p Cloud Dome camera.
Yi Outdoor	rootfs_h30	home_h30	3.0.0.0D_201809111054	Firmware files required for the Yi Outdoor camera.

A higher base firmware number than listed above means this project does not support your camera.

Getting Started

1. Check that you have a correct Xiaomi Yi camera. (see the section above)

2. Get a microSD card, preferably of capacity 16 GB or less and format it by selecting File System as FAT32.

IMPORTANT: The microSD card must be formatted in FAT32. exFAT formatted microSD cards will not work. I have not formatted any of my 32GB cards to load the firmware. Just copy files directly and it should work.

(Click) How to format microSD cards > 32GB as FAT32 in Windows 10

For microSD cards larger than 32 GB, Windows 10 only gives you the option to format as NTFS or exFAT. You can create a small partition (e.g. 4 GB) on a large microSD card (e.g. 64 GB) to get the FAT32 formatting option.

• insert microSD card into PC card reader
• open Disk Management (e.g. Win+x, k)
  • Disk Management: delete all partitions on the microSD card
    • right click each partition > "Delete Volume..."
    • repeat until there are no partitions on the card
  • Disk Management: create a new FAT32 partition
    • Right-click on "Unallocated" > "New Simple Volume..."
    • Welcome to the New Simple Volume Wizard: click "Next"
    • Specify Volume Size: 4096 > "Next"
    • Assign Drive Letter or Path: (Any) > "Next"
    • Format Partition: Format this volume with the following settings:
      • File system: FAT32
      • Allocation unit size: Default
      • Volume label: Something
      • Perform a quick format: ☑

You should now have a FAT32 partition on your microSD card that will allow the camera to load the firmware files to update to yi-hack-v5.

Example: 4 GB FAT32 partition on 64 GB microSD card

Alternative way:

• open cmd with admin permissions
• run diskpart
• type "list disk"
• find your SD card (for example Disk 7)
• type "select disk 7"
• if it has one partition - type "select partition 1". If more - delete all the partitions and then create one
• type "format FS=FAT32 QUICK"
• done. 32GB partition in FAT32.

3. Get the correct firmware files for your camera from the latest baseline release link: https://github.com/alienatedsec/yi-hack-v5/releases/tag/0.4.1

4. Save both files rootfs_xx and home_xx, and the yi-hack-v5 folder on the root path of the microSD card.

IMPORTANT: Make sure that the filenames stored on the microSD card are correct and didn't get changed. e.g. The firmware filenames for the Yi 1080p Dome camera must be home_h20 and rootfs_h20.

5. Remove power to the camera, insert the microSD card, and turn the power back ON.

6. The yellow light will come ON and flash for roughly 30 seconds, which means the firmware is being flashed successfully. The camera will boot up.

7. The yellow light will come ON again for the final stage of flashing. This will take up to 2 minutes.

8. Blue light should come ON indicating that your WiFi connection has been successful.

9. Go into the browser and access the web interface of the camera as a website.

Depending upon your network setup, accessing the web interface with the hostname may not work. In this case, the IP address of the camera has to be found.

This can be done from the App. Please open the app, and go to the Camera Settings --> Network Info --> IP Address.

Access the web interface by entering the IP address of the camera in a web browser. e.g. http://192.168.1.5

IMPORTANT: If you have multiple cameras. It is important to configure each camera with a unique hostname. Otherwise, the web interface will only be accessible by IP address.

10. Done! You are now successfully running yi-hack-v5!

Unbrick your camera

TO DO - (It happened a few times and it's often possible to recover from it)

Troubleshooting

Wi-Fi is connected, and the camera responds to ping but I'm not able to connect to the web interface

Verify that you did not forget to upload the yi-hack-v5 folder to the SD card when uploading firmware. If you did, upload it and restart the camera.

Cannot complete the pairing/wifi settings lost after reboot

Ensure you are using the correct app (Yi Home) to set up the wifi connection. For example, the "Xiaomi Home" app will also generate the correct QR code that will work with your camera for the initial connection, but then after power is removed the settings will be lost.

Introducing pre-releases

Please follow this guide if you want to test new features and improvements

Acknowledgments

Special thanks to the following people and projects, without them yi-hack-v5 wouldn't be possible.

• @TheCrypt0 - https://github.com/TheCrypt0/yi-hack-v4
• @shadow-1 - https://github.com/shadow-1/yi-hack-v3
• @fritz-smh - https://github.com/fritz-smh/yi-hack
• @niclet - https://github.com/niclet/yi-hack-v2
• @xmflsct - https://github.com/xmflsct/yi-hack-1080p
• @dvv - Ideas for the RSTP stream
• @andy2301 - Ideas for the RSTP rtsp and rtsp2301
• @roleoroleo - PTZ Implementation

Acknowledgments #2

As much as TheCrypt0 has made it possible for the 'yi-hack-v4', the latest features are based on the work from:

• @roleoroleo - https://github.com/roleoroleo

---

DISCLAIMER

I AM NOT RESPONSIBLE FOR ANY USE OR DAMAGE THIS SOFTWARE MAY CAUSE. THIS IS INTENDED FOR EDUCATIONAL PURPOSES ONLY. USE AT YOUR OWN RISK.

DONATIONS

I HAVE BEEN ASKED FOR A LINK MULTIPLE TIMES; THEREFORE, PLEASE FOLLOW THE BELOW

yi-hack-v5's Issues

yi outdoor 1080p - recording to sd card doesn't work

hi!

I have tried fat32 64gb micro sd and video is not recorded onto sd card.

camera: yi outdoor 1080p, 9cus, FW: yi-hack-v5 - v0.3.1 - BETA

thank you

Watermark issue

Hi @roleoroleo

Would you be so kind to have a look at the watermark code as it seems to be corrupting the snapshot and the imggrabber binary.

I know it uses the watermark through this code

var APP = APP || {};

APP.snapshot = (function ($) {

    function init() {
        initPage();
    }

    function initPage() {
        jQuery.get('cgi-bin/snapshot.sh?res=high&base64=yes&watermark=yes', function(data) {
        image = document.getElementById('imgSnap');
        image.src = 'data:image/png;base64,' + data;
        image.style = 'width:100%;';
        })
    }

    return {
        init: init
    };

})(jQuery);

Also, the links functionality has the same logic and when removed, it works perfectly (highlighted):

FPS Configuration

Not a bug - feature request - it would be extremely useful to have an FPS control function.

E.g. instead of the default 30fps if I could reduce it to say 2 or 5 FPS it would be much easier to process on my NVR

password

On a Yi Outdoor, after installing yi-hack-v5 OVER yi-hack-v4, it is all working (so far) except I am unable to set the root password:

• Via the Config web page.
• Via running passwd root from the command line.
  From the command line, running (as root):

passwd
New Passwd: mypw
passwd: warning: can't create backup copy '/etc/passwd-': Invalid cross-device link
passwd: Device or resource busy
passwd: can't update password file /etc/passwd

From the Config web page, entering a password simply did not take. After saving and rebooting, the password remains null.

Please note, this only fails when installing yi-hack-v5 over an existing yi-hack-v4 install. When I installed it on a new camera with no existing hack, it worked.

Please advise if there are any work-arounds.

Thanks!

P.S. I notice that there is a passwd file in ~/etc/passwd on the Allwinner version of the hack for the Indoor cameras (which_ appears to be a clone of /etc/passwd). There is no ~/etc/passwd in the 0.3.0 yi-hack-v5 release. Maybe this is related to the problem.

Adding "s" to all mqtt attribute values starting with "s"

Strange one...

Each time the MQTT changes (from the web page) are saved, all attribute values which begin with "s" get an additional "s" prepended. For example: TOPIC_BIRTH_WILL=status becomes TOPIC_BIRTH_WILL=sstatus then TOPIC_BIRTH_WILL=ssstatus if changes is saved twice. Same for sound_detection and sound_detected.

[yi-outdoor] 64GB sd card does not updates from yi-hack-4

Just like it is mentioned in #39 and I think we should take care of it. Seems that big sd cards like 64 GB fail to boot and load y-hack-v5 although yi-hack-v4 was working and booting just fine.

Timezone not being set

I had an issue with the time zone not being set. I manually went in and edited /tmp/sd/yi-hack-v5/etc/TZ but that was ignored. I then edited /tmp/sd/yi-hack-v5/etc/system.conf and that worked.

Appears issue relates to the following lines setting TZ file rather than system.conf file?

yi-hack-v5/src/www/httpd/cgi-bin/set_configs.sh

Lines 49 to 50 in f150e4d

	elif [ "$KEY" == "TIMEZONE" ] ; then
	echo $VALUE > $YI_HACK_PREFIX/etc/TZ

This is on Yi Dome 1080p camera with v0.3.0

yi-hack-v5 - v0.3.1?

The Update page on the web interface says the "Remote Version" is at 0.3.1 and the "Local Version" is at 0.3.0. Yet there is no 0.3.1 on the "releases" link.

Is there really a 0.3.1 release? I am anxiously awaiting the mqtt motion event fix.

Thanks!

ONVIF Status

After turning on ONVIF in the configuration menu, I installed the ONVIF integration for Home Assistant. It found my Allwinner yi-hack-0.2.4 indoor camera, but not my yi-hack-v5 yi outdoor camera. Both cameras are configured the same.

Is the status of the ONVIF feature known? I.e., am I reporting a known issue, or is this feature expected to work?

Thanks!

yi dome 1080 seems to not read microsd

I've downloaded the hack to the root of a fat32 formatted card.
I poweroff the camera, install the micro sd card, and when i poweron, the camera does the startup cicle but doesn't seem to enter firmware uploading process.
Anyway to check if card problem? I used previously same card to install yi-hack-v4 in another camera, and everything worked.
Thanks.

edit: camera works with the yi app, and recognizes the microSD as "in good conditions" in the configuration part.

[yi dome 1080p] MQTT seems not to work

Hello,
I run Home Assistant with mosquitto. Seems that camrea tries to connect but then disconnects and motion detection is not working. This is part of mosquitto log:

[12:02:20] INFO: [INFO] found mqttUser on local database 1618135340: New client connected from 192.168.1.XXX as xxxDome1 (p2, c1, k120, u'mqttUser'). 1618135571: Socket error on client xxxDome1, disconnecting. 1618136267: New connection from 192.168.1.XXX on port 1883. [12:17:48] INFO: [INFO] found mqttUser on local database 1618136268: New client connected from 192.168.1.XXX as xxxDome1 (p2, c1, k120, u'mqttUser'). 1618136269: Socket error on client xxxDome1, disconnecting.

MQTT motion image causes freeze on motion

I have upgraded from v4 + rtsp to v5 0.3.1.
I get a nice reliable stream with MQTT off. Switching on MQTT the stream stutters and grinds to a halt a few seconds after waving my hand in front of the camera. The web UI also becomes unavailable.

My suspicion is it is caused by the resource usage of the motion snapshot feature which was not present in v4.
It is necessary to unplug the camera to get it responding again.
I have swapfile enabled.

I would appreciate some guidance in debugging this. Is there a change I can make to disable the motion snapshot feature with MQTT enabled to test my theory?

Wrong Hostname

Using 0.3.0

On the Home Page the 'Hostname' doesn't match what I have specified under Config 'Hostname'. The value that exists on the home page is a value configured with a different firmware

wifi disconnecting, wpa may crashed, now reset

Hello,

I have issue with constantly disconnecting WiFi from my Yi Outdoor camera -

[./rmm][5/13/22:52:26:887]: ai_get_aacstream: get aenc stream select time out
[./rmm][5/13/22:52:29:71]: ai_get_aacstream: get aenc stream select time out
[./dispatch][5/13/22:52:29:792]: wifi disconnected, now reconnect wifi
[./rmm][5/13/22:52:30:718]: motrk img is too old. storetm:1620946349-725901, diff:1009
[./mp4record][5/13/22:52:33:144]: msg snd success[./dispatch][5/13/22:52:33:145]: got rcd heartbeat
[./watch_process][5/13/22:52:34:512]: cloud crashed![./rmm][5/13/22:52:41:538]: got a new motion stop. send_motion_stop_msg
[./rmm][5/13/22:52:41:561]: msg snd success[./dispatch][5/13/22:52:42:632]: wpa may crashed, now reset
[./dispatch][5/13/22:52:42:766]: no usb dev

  Mode:Managed  Frequency=2.447 GHz  Access Point: 20:76:93:4E:A5:32
  Bit Rate=135 Mb/s
  RTS thr:off   Fragment thr:off
  Encryption key   Security mode:restricted   Security mode:open
  Link Quality=100/100  Signal level:-54 dBm  Noise level:-85 dBm
  Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
  Tx excessive retries:0  Invalid misc:0   Missed beacon:0

after reboot it works only for couple of hours..
anyone has similar issue and fixed that somehow?

47US cannot open web interface?

First of all, BIG THANK YOU for making a 100% free rtsp support firmware.
I actually don't mind paying usd5 for the yi-hack-v4, but my country banned to send
donation via paypal to the developer.

Anyways, after installed the firmware, all the LEDs are as described and finally a steady blue
light appeared. By scanning my local wifi, I could see the camera is connected to 192.168.0.3
But when i open in browser, it just not opening any web interface. Any idea why?

I could connect with the Yi Home app, and it works normally. And could also confirm IP from
the app it is 192.168.0.3. Any idea why?

Scroll search from app broken

In the app there's a red line at the bottom allowing you to scroll to different times of the day to see the events at that time. In version 3.0 this worked properly. After updating to 3.1, when you scroll to a previous time, it's snaps back to the present and does not show the saved video you scrolled to.

See attached image of red timeline I mean.

kami mini model YYS.2919

I have a kami mini model YYS.2919 (firmware version 9.0.20.06_202007061841), it looks exactly the same as the yi 1080p home, but that might just be the casing. I'm quite confused witht the different firmwares available if there is anything that migth be suitable for my camera.
Any hint would be highly appreciated.
Greetings
Marc

Excessive access to raw.githubusercontent.com

Hi,

First off, great work on this project and thank you.

I wanted to highlight that pi-hole shows my camera accessing raw.githubusercontent.com every 15 seconds.
I assume this is checking for updates? or is it reporting back other data?
If this is an update check then this seems excessive? Would there be any benefit slowing this down?

The camera is blocked from the internet by the firewall, is this just the camera retrying as it cannot get access or is it normal behaviour?

Safe to update over yi-hack-v4 (using their update home/rootfs menu)?

I am SO happy to see this release. I have so many problems with rtspv4/viewd. I have Allwinner on my Yi indoor cameras and it works flawlessly. Did you base the rtsp server on the Allwinner code?

Is it possible/safe to use the yi-hack-v4 web update (in the Update section) to upload and install the yi-hack-v5 home and rootfs files?

I hope so, because access to my installed outdoor cameras is difficult, i.e. to retrieve the SD card...

Thanks for this release! I am looking forward to using it with great anticipation!

Camera Settings -> Switch on/off the camera

When I turn the camera off using HTTP page:

Camera Settings -> Switch on/off the camera -> OFF

It does not turn the camera off. E.g., I can still stream via rtsp.
Allwinner v5 works.

P.S. ipc_cmd -t OFF works.

App not working

1080p Dome user here, latest fw firmware installed (v0.3.1 - BETA)

I can't get the app to load the camera stream or connect at all - I've tried a bunch of different proxy chains settings.
Has anyone had luck with app/cloud access? Any tips?

Where are the releases?

I went to download, but says no releases in the "release" link.
I am looking for:

Yi Outdoor	rootfs_h30	home_h30

No problem if it is "coming". I just can hardly wait! :)

yi outdoor 1080p firmware 9.0.26.05_202011201756

Hello,

I tried the V5 and it doesn't read the SD card I tried a 16g, 32g in class 10. Have you ever had a positive feedback on this firmware?

Performance issues YI Outdoor (high load average 9CUS)

Performance issues YI Outdoor
This issue related to TheCrypt0/yi-hack-v4#173
I have Yi outdoor camera with base version 3.0.0.0D_201809111054 and firmware hack-v5 0.3.1 installed
Settings:
swap enabled
SDcard: brand new 16Gb Sandisk Ultra 10+ class (80mb\s)
Enabled services: SSH, HTTPD
Other services are disabled: camera (ipc_cmd -t OFF), RTSP, Onvif, etc
Camera is really warm and sdcard when inserted is very hot, looks like a heavy I\O was performed

But I have load average : ~ 4.18 4.11 3.49
As result - poor web performance and recording issues.

Here some additional info

Mem: 28888K used, 1872K free, 1608K shrd, 1824K buff, 8996K cached
CPU: 30.3% usr 10.5% sys  0.0% nic 57.0% idle  0.0% io  0.0% irq  2.0% sirq
Load average: 3.98 4.09 2.55 1/79 4567
  PID  PPID USER     STAT   VSZ %VSZ CPU %CPU COMMAND
  973     1 root     S    23056 74.8   0 37.8 ./rmm
 4447  2391 root     R     1484  4.8   0  1.3 top
  783     2 root     SW       0  0.0   0  1.1 [RtmpTimerTask]
 2387  1657 root     S     1256  4.0   0  0.9 dropbear -R -B
  792     1 root     S     4236 13.7   0  0.6 ./dispatch
 1626     1 root     S     3996 12.9   0  0.6 ./mp4record
  784     2 root     SW       0  0.0   0  0.1 [RtmpMlmeTask]
  403     2 root     SW       0  0.0   0  0.1 [kworker/0:1]
 1174     1 root     S     1764  5.7   0  0.0 /home/base/tools/wpa_supplicant -c/tmp/wpa_supplicant.conf -g/var/run/wpa_supplicant-global -iwlan0 -B
 2391  2387 root     S     1500  4.8   0  0.0 -sh
 1348     1 root     S     1492  4.8   0  0.0 /sbin/udhcpc -i wlan0 -b -s /home/app/script/default.script -x hostname:testyi
    1     0 root     S     1480  4.8   0  0.0 init
 1642     1 root     S     1480  4.8   0  0.0 httpd -p 8080 -h /tmp/sd/yi-hack-v5/www/ -c /tmp/httpd.conf
 2014     1 root     S     1480  4.8   0  0.0 crond -c /tmp/sd/yi-hack-v5/etc/crontabs
 1696     1 root     S     1480  4.8   0  0.0 /usr/sbin/crond -c /var/spool/cron/crontabs/
 1657     1 root     S     1188  3.8   0  0.0 dropbear -R -B
  791     1 root     S     1044  3.3   0  0.0 ./log_server
  427     1 root     S<    1020  3.3   0  0.0 udevd --daemon
  475   427 root     S<    1020  3.3   0  0.0 udevd --daemon
  471   427 root     S<    1020  3.3   0  0.0 udevd --daemon
 1661     1 root     S     1004  3.2   0  0.0 ipc_multiplexer


/home/yi-hack-v5 # iostat
Linux 3.4.35 (testyi)   05/19/21        _armv5tejl_     (1 CPU)

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
          32.34    0.00   23.05    0.05    0.00   44.55

Device:            tps   Blk_read/s   Blk_wrtn/s   Blk_read   Blk_wrtn
mtdblock2         0.01         0.12         0.02         40          8
mtdblock6         0.00         0.39         0.00        128          0
mmcblk0           0.80        54.92         1.16      18132        382
mmcblk0p1         0.80        54.89         1.16      18124        382

/home/yi-hack-v5 # mount
rootfs on / type rootfs (rw)
/dev/root on / type jffs2 (rw,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/mtdblock5 on /home type jffs2 (rw,relatime)
none on /dev/mqueue type mqueue (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime,size=16384k)
/dev/mmcblk0p1 on /tmp/sd type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mmcblk0p1 on /tmp/sd/yi-hack-v5/www/record type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)

/home/yi-hack-v5 # df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 1.3M      1.2M     88.0K  93% /
tmpfs                    15.0M      4.0K     15.0M   0% /dev
/dev/mtdblock5           12.7M      8.8M      3.9M  70% /home
tmpfs                    16.0M      1.6M     14.4M  10% /tmp
/dev/mmcblk0p1           14.8G     82.8M     14.7G   1% /tmp/sd
/dev/mmcblk0p1           14.8G     82.8M     14.7G   1% /tmp/sd/yi-hack-v5/www/record
/home/yi-hack-v5 #

rmm process killed. LA reverted to normal values (above 1.00)
Started again:
LA backed to 4.0+, it's not depend enabled camera or not

/home/app # ./rmm
sensor_register_callback ok
linear mode
I2C_WRITE error!
addr = fd data =0
===ominivision ov2735 sensor new 1080P15fps(Parallel port) init success!=====
=========================================================
cmos_fps_set1 =20.000000
vi_start_devvi_start_dev =============

MMAP address=0xb5dbf000, size=1586752(0x183640), mode=0, try 1
cmos_fps_set1 =20.000000

***** SMART BABYCRYING - V20160905.1 - *****
  --- pmstat init_flt2ll[1] diff:1320684 us, totalTm: 1320684 us

***** SMART BABYCRYING - V20160412.2 - *****
ppmngr:0xe4fb28, len:320000

Than enabled camera (ipc_cmd -t ON) after 1 min.

stExposureAttr.stAuto.u8Compensation=40
===============u32DstStrength =======8
stExposureAttr.stAuto.u8Compensation=40
===============u32DstStrength =======8
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=50
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=47
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=45
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=47
===============u32DstStrength =======32
stExposureAttr.stAuto.u8Compensation=40
===============u32DstStrength =======8
stExposureAttr.stAuto.u8Compensation=40
===============u32DstStrength =======8
u32FullLines2 =2152
u32FullLines2 =1994
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=60
===============u32DstStrength =======128
stExposureAttr.stAuto.u8Compensation=50
===============u32DstStrength =======128

A BIG Thank You!

I just installed yi-hack-v5 - v0.3.0 - BETA on a Yi Outdoor 1080p (9CUS).
I am happy to report that (after following the instructions this time) it installed and booted perfectly!

• RTSP came right up and displays clearly.
• The web interface is up and all the screens display properly.
• Motion recording is working.
• ssh is working.

The load runs high (ie, in top): Load average: 7.03 7.82 6.82 1/99 9416
Is that expected?

That is all I have checked right now.

I made a 256M swapfile on the SD card as follows (as root):

dd if=/dev/zero of=/tmp/sd/swapfile bs=1k count=256k
chmod 600 /tmp/sd/swapfile
mkswap /tmp/sd/swapfile
swapon /tmp/sd/swapfile
cat /proc/swaps
echo '/tmp/sd/swapfile  swap  swap  defaults'  >> /etc/fstab

For some reason, fstab is not mounting the swap file after a reboot.
Can anyone suggest how to get swap mounted after a reboot?

I am very pleased and hopeful that after further use, this hack is as stable as Allwinner. I will continue testing...

BIG thanks to alienatedsec! You are a hero!

[Yi Outdoor 1080p] High resolution snapshot segmentation fault

Taking a high resolution snapshot does not working on a Yi Outdoor camera. Low resolution snapshot works.

Problem occurs with and without swap file.

/tmp/sd/yi-hack-v5 # imggrabber -m yi_outdoor -r high --debug
Debug on
Starting program
Resolution high
1618234144057 - mapping file /tmp/view, size 1586752, to b6d4d000
1618234144058 - closing the file /tmp/view
1618234144058 - found latest frame: id 143, frame_counter 13942
1618234144058 - processing frame 143
1618234144084 - processing frame 143
1618234144084 - writing frame: frame_offset 1022604, frame_ptr b6e500cc, frame_length 37
1618234144100 - processing frame 144
1618234144101 - writing frame: frame_offset 1022648, frame_ptr b6e500f8, frame_length 8
1618234144119 - processing frame 145
1618234144120 - writing frame: frame_offset 4, frame_ptr b6d56644, frame_length 59674
7400159931599476 - frame found, exit loop
Decoding h264 frame
Segmentation fault

Any chance for Yi Dome 1080p support?

@alienatedsec please consider building h20 image if possible, I will be happy to test. I tried using only home_y20 after renaming to home_h20, leaving original root_h20 from Keroi/yi-hack-v4 build - it did not work.

Can you possibly share some links to prepare own image - I am proficient with Linux, just going through the noise on Discord and having over 100 forks of v4 just overwhelms me to say at least.

Another question - should it be enough to just ssh contents of home partition to a running h20 image, replacing existing files? Maybe there is a way to mount home file using loop? I just need streaming support for home assistant with PTZ, ONVIF might do the trick.

Camera crashes when going from "off" state to "on" state

I had issues when camera goes from "off" to "on" state (via settings), causing camera to freeze. I found that numerous imggrabber processes were being created and hanging, caused by calls from Home Assistant trying to update the current snapshot.

I suspect issue is all those processes waiting for the next frame, and then them all trying at once to pull the frame when the camera is turned on again.

As a work around (or maybe an acceptable solution?), I've changed snapshot.sh to return error JSON when camera config is in off state:

diff --git a/src/www/httpd/cgi-bin/snapshot.sh b/src/www/httpd/cgi-bin/snapshot.sh
index d7499da..aff8b2c 100755
--- a/src/www/httpd/cgi-bin/snapshot.sh
+++ b/src/www/httpd/cgi-bin/snapshot.sh
@@ -10,6 +10,17 @@ validateFile()
     esac
 }
 
+YI_HACK_PREFIX="/tmp/sd/yi-hack-v5"
+CONF_FILE="$YI_HACK_PREFIX/etc/camera.conf"
+
+if grep -q SWITCH_ON=no "$CONF_FILE"; then
+    printf "Content-type: application/json\r\n\r\n"
+    printf "{\n"
+    printf "\"%s\":\"%s\"\\n" "error" "true"
+    printf "}"
+    exit 0
+fi
+
 MODEL_SUFFIX=$(cat /home/app/.camver)
 BASE64="no"
 RES="-r high"

WiFi strength incorrect

I don't think anything should be able to have over 100% WiFi strength.

WiFi strength

SSH output:

/home/yi-hack-v5 # cat /proc/net/wireless
Inter-| sta-|   Quality        |   Discarded packets               | Missed | WE
 face | tus | link level noise |  nwid  crypt   frag  retry   misc | beacon | 22
 wlan0: 0000   82.  -59   -83        0      0      0      0      0        0     

System details

How to find out if m.Lilliput-001 go, comma is compatible with one of the cameras in this project?

Hello,

I have a Lilliput-001 from go, comma.

Exist a way to find out which version could be compatible to this variant?

From optic point of you, it should be a "1080 Dome".

It has a different USB connector, round connector instead of microUSB.
Also an LAN connection too.

Many thanks,

Patrick

[Yi Outdoor 1080p] Booting without microSD card

The camera doesn't boot without the microSD card after flashing.
Just to confirm that this is a bug and not by design.

Because of this recording can't be activated from the official App as the card needs to be formatted.

How to set presets for 'Yi 1080p Dome'

Hello all,

how can I set presets?
I found only the possibility to call existing presets.

Many thanks,
Patrick

Can I upgrade OTA from yi-hack-v4?

Hi. First of all thanks for all your work. Great to hear that someone is improving v4 (already using it).
Would it be possible to upgrade from this version directly using the web interface?
Thanks

[yi dome 1080p] nothing displayed on Home page

Hello besides links to stream nothing is being displayed on Home page:

Can't get 0.3.0 to install

I have successfully installed two Yi Outdoor 1080p cameras with yi-hack-v5 v0.3.0. One was on a clean SD card (which was not yet provisioned), and the other was over an existing remote yi-hack-v4 v0.2.0. There were no problems encountered on either one.

I am now trying to install yi-hack-v5 on a third Yi Outdoor 1080p over an existing remote yi-hack-v4. I have done everything exactly the same as the first two, i.e., from my PC:

# cd yi-hack-v5/yi-outdoor
# ls -l
total 8601
-rw-r--r-- 1 rwk rwk 7792172 Apr 14 05:03 home_h30
-rw-r--r-- 1 rwk rwk 1014184 Apr 14 05:03 rootfs_h30
drwxr-xr-x 9 rwk rwk      10 Apr 14 05:04 yi-hack-v5
# scp -rp ./ root@frontdoor:/tmp/sd/
home_h30                              100% 7610KB 218.8KB/s   00:34    
rootfs_h30                            100%  990KB 216.4KB/s   00:04    
mqttv4.conf                           100% 1854    53.5KB/s   00:00    
...
# ssh root@frontdoor
# reboot && exit

But when the camera comes back online, yi-hack-v4 has booted. I rebooted again, but still it boots to yi-hack-v4.

Here is an ls -l of /tmp/sd on the camera in question, still running v4:

rwxr-xr-x    1 root     root       7792172 Apr 14 11:03 home_h30
-rwxr-xr-x    1 root     root             0 Apr 27 23:48 last-download
drwxr-xr-x    2 root     root        131072 Apr 28 12:04 log
drwxr-xr-x  479 root     root        131072 Apr 27 23:48 record
-rwxr-xr-x    1 root     root       1014184 Apr 14 11:03 rootfs_h30
drwxr-xr-x    3 root     root        131072 Apr 28 11:52 save
drwxr-xr-x    9 root     root        131072 Apr 14 11:04 yi-hack-v5

Is there some way to force it to install and boot yi-hack-v5?

Thanks!

P.S. The camera is in a difficult to access location, so I cannot readily retrieve the SD card. I would like to get it to work remotely.

Cannot disable record to SD card

I want to completely disable writing to the SD card, but I can't get it to work...

/tmp/sd/yi-hack-v5/etc # cat system.conf
HTTPD=yes
TELNETD=no
SSHD=yes
FTPD=no
BUSYBOX_FTPD=no
DISABLE_CLOUD=no
REC_WITHOUT_CLOUD=no
MQTT=no
RTSP=yes
RTSP_STREAM=high
RTSP_AUDIO=no
ONVIF=no
ONVIF_WSDD=no
ONVIF_PROFILE=high
ONVIF_NETIF=wlan0
ONVIF_WM_SNAPSHOT=no
NTPD=yes
NTP_SERVER=pool.ntp.org
PROXYCHAINSNG=yes
SWAP_FILE=yes
RTSP_PORT=554
ONVIF_PORT=80
HTTPD_PORT=8080
USERNAME=
PASSWORD=
TIMEZONE=HKT-8
FREE_SPACE=25
FTP_UPLOAD=no
FTP_HOST=
FTP_DIR=
FTP_DIR_TREE=no
FTP_USERNAME=
FTP_PASSWORD=
FTP_FILE_DELETE_AFTER_UPLOAD=yes
CHECK_UPDATES=no
SSH_PASSWORD=
CRONTAB=

Version

YI-HACK-V5
v0.3.1 - BETA

System

Firmware Version | 0.3.1
Base Version | 1.9.2.0I_201812141405
Model Suffix | yi_dome_1080p
Hardware ID | 15CN

Any idea?

[yi dome 1080p] ptz page freezes

Hello,
I have swap file enabled and still cant access PTZ page. It freezes like this:

HA integration

I pushed a beta support for this hack.
Could anyone test it?

https://github.com/roleoroleo/yi-hack_ha_integration

[ Yi Home 1080p ] No recording being made - v0.3.0 - v0.3.2

Same as issue: #2

• Updated to 0.3.0
• Formatted the SDcard with the Yi app.
• Recordings are being made while the cloud functionality was still on.
• After turning off the cloud functionality (and turning on recording without cloud), no recordings are being made.
• Enabling watch_process enabled recording.

Yi Dome U Pro 2K

I have an incoming camera Yi Dome U Pro 2K and i like the (Yi-Hack v5) features stated here.. May i ask if this camera is supported? I hope you could include a picture of the supported cameras. Thank You

Not publishing motion event to MQTT

I have an Yi indoor camera running Allwinner that has been working (with MQTT) for a year or so. I have setup MQTT on a Yi Outdoor exactly as it is on the Allwinner camera under V5. Ie, MQTT is Enabled, server IP is the same, same port, Topic Prefix is set, Top Suffix is set, Motion Start/Stop etc...

However, when I trigger motion on the V5 camera, I get no MQTT message received from my monitor:

mosquitto_sub -h my-mqtt-host -t '#'

It appears the v5 release is not publishing anything when a motion event is triggered.

I have tested both mosquitto_sub and mosquitto_pub on the V5 camera and they both work perfectly.

Looking forward to a patch...

[Yi Outdoor 1080p] Testing to Confirm Compatibility

I see I'm not the only one with an outdoor cam over here (thanks for doing this, by the way). I've installed it on a pair of cameras and it seems to be working.

What tests or information do you need from us to confirm compatibility?

Move to Yi-Hack-V5?

Hey @alienatedsec,

thanks for your work on this firmware for the Hi3518e chipset.
Would you perhaps consider creating a new repo called v5?
The reason for this is that I found your fork by mere chance and I think more people would be able to find
if it were its own repo because forks don't show up in the search.

I'm testing things out now and I'll let you know of the progress!

So far things works as intended, especially RTSP.

12CN

Great to see this work being progressed. Just an offer to say I've got some 12CN cameras still running the early fritz hack, happy to do some testing of the v5 hack on them if you feel there's any chance of it supporting that hardware.

No recording being made on 48US

Having disabled cloud and enabled recording without cloud, no recordings are saved in /tmp/sd/
The device in question is a 48US

This is the contents of system.conf

HTTPD=yes
TELNETD=no
SSHD=yes
FTPD=no
BUSYBOX_FTPD=no
PROXYCHAINSNG=no
CHECK_UPDATES=yes
DISABLE_CLOUD=yes
REC_WITHOUT_CLOUD=yes
MQTT=no
NTPD=yes
NTP_SERVER=pool.ntp.org
ONVIF=no
ONVIF_WSDD=no
RTSP=yes
RTSP_STREAM=high

Furthermore I can confirm SSH, FTP and HTTP to be working.

[yi dome 1080p] root password set via web but blank password correct on ftp and ssh

Hello,
even though I set password to root via web page, my ftp client and ssh does not require any password. Blank one is OK.

45CN - connect to wifi

I used yi-hack-v4 0.2.0 Crypto before installing this version and I needed to use the Chinese version app to generate QR to connect my camera to wifi. After installing this version of the hack, I need to use the global version application, because the QR from the Chinese version, turn the camera back and block it with the text that "this camera can only be used in the Chinese region."

Can't login to pure-ftpd on Yi Outdoor 1080p

I am trying to use ftp to download recorded files (On yi-hack-v5 0.3.1 Yi Outdoor 1080p). When I enter:

# lftp root:myrootpw@driveway
lftp root@driveway:~> cd /tmp/sd/record
cd: Login failed: 530 Login authentication failed

The same works on yi-hack 0.2.5 in my Yi Indoor camera.
(I am not using legacy ftpd on either camera).

On my Yi Indoor camera (yi-hack 0.2.5) I get the following:

# lftp root:myrootpw@garage
lftp root@garage:~> cd /tmp/sd/record
cd ok, cwd=/tmp/sd/record            
lftp root@garage:/tmp/sd/record> 

Have I forgotten something? What might I be doing wrong? Or is this a bug?

Thanks!

Wrong link in acknowledgments

Info "@TheCrypt0 - https://github.com/TheCrypt0/yi-hack-v4" has a link to https://github.com/TheCrypt0/yi-hack-v5

MQTT Topic/Message prefixed with s

Using v0.3.0

Setting up my MQTT Topics and Messages and the following had a lower case s prepended after save and reboot

Birth/Will Topic Suffix
Sound Detection Topic Suffix
Sound Detection Sound Detection Message