I noticed there is a cgi-bin directory and a reference to a still image and motion jpeg. I have been able to get the device rooted and were able to telnet in and enable ONVIF but I have not had any success in getting this to work with MJPEG or similar. Is this still and issue and if so, how can I get this to write out an mp4 or something I can use with port forwarding to a private cloud service?

Hi,
Here are the files of my IPCAM it's a Mini 8S, I follow the steps to have onvif (port 8000) or rstp (port 8554) working including ghidra but ppsapp file is different and I can't get neither one nor other working.
You'll find the asked files as an attachment, if it could be possible I would like to have the ppsapp patched for my camera.
Many thanks.

IPCAM_FI02_Chacon.txt
--deleted--

I tried the instructions to find pps_media_md_get_pic in the ppsapp, however, there IS NO REFERENCE.

the closest I can find is this:
000ff918 00 70 8d e5 str r7=>s_httpc_get_pic_00275b00,[sp,#0x0]=>local_40 = "httpc_get_pic"

The funtion associated with it is as follows:

int FUN_000ff858(int param_1,undefined4 param_2)

{
int iVar1;
int iVar2;
int iVar3;
undefined4 local_2c [2];

local_2c[0] = param_2;
if (param_1 == 0) {
FUN_000d42a8(0,0,
"/var/lib/jenkins/workspace/Release_IPC_SDK/src/tuya_iot_sdk/tuya_cloud/iot_httpc.c"
,0x64d,"httpc_get_pic","invalid param");
iVar1 = -2;
}
else {
FUN_000d42a8(0,4,
"/var/lib/jenkins/workspace/Release_IPC_SDK/src/tuya_iot_sdk/tuya_cloud/iot_httpc.c"
,0x651,"httpc_get_pic","begin to download file. url:%s",param_1);
iVar2 = 0;
do {
iVar3 = iVar2;
FUN_000d42a8(0,4,
"/var/lib/jenkins/workspace/Release_IPC_SDK/src/tuya_iot_sdk/tuya_cloud/iot_httpc.c"
,0x659,"httpc_get_pic","try:%d",iVar2);
iVar1 = FUN_000f82e0(param_1,&LAB_000fbc50,local_2c);
iVar2 = iVar2 + 1;
if (iVar1 == 0) {
FUN_000d42a8(0,4,
"/var/lib/jenkins/workspace/Release_IPC_SDK/src/tuya_iot_sdk/tuya_cloud/iot_httpc.c"
,0x65e,"httpc_get_pic","download file finish",iVar3);
return 0;
}
FUN_000d62b4(5000);
} while (iVar2 != 2);
}
return iVar1;
}

Is this a new firmware?

As stated in issue #9, all I had to do was enable onvif in the tuya_config.json and it seemed to just work.

I've confirmed I've got the right SD cards, I have 3 different cameras to try from and none of them work. Using the directions from the 720p and the 1080p, i copied files from 720 to root of card, replaced with files from 1080, downloaded busybox to root, and downloaded ppsFactoryTool and modified with SSID and password. I did all of this in windows, and then again in ubuntu desktop.

When booting the camera, I'm still able to view the camera in the geeni app, when navigating to http://admin:056565099@ip:8090/proc/cmdline, i get no result, but when navigating to http://admin:056565099@ip/proc/cmdline, I'm presented with this info:

mem=37M console=ttyAMA0,115200n8 mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4224k(app),448k(cfg) ppsAppParts=5 ppsWatchInitEnd
I notice that I don't have the ip= section, and I haven't been able to get that far.

Navigating to any other page provided does not work, except for http://admin:admin@ip/devices/deviceinfo, which i receive the following info:

{"devname":"Smart Home Camera","model":"Mini 11S","serialno":"059344886","softwareversion":"2.10.6","hardwareversion":"M11S_H1_V10_F23","firmwareversion":"ppstrong-c51-tuya2_geeni-2.10.6.20210819","authkey":"vRkPUaX----FzZy8KQ","deviceid":"pp019a-37a","identity":"MR2002---8477","pid":"aaa","WiFi MAC":"7c:a--:13"}

When plugging the SD back into my computer, i don't see the /home/ directory, or a "hack" file. the only thing i see added is the SDT folder, which i'm assuming contains info placed by default by the camera.

I understand that there's a formatting issue with windows vs linux, I used parted to format the drive, mkfs vfat to create the fat32 partition, loaded and modified all files in linux and ejected using gui.

I understand that there's also a patch for specific hardware versions, but i believe that requires having a little more progress in the hack, unless I'm misunderstanding that.

I'm not sure what other options I can try, I've tried other cheap-o sd cards i've got lying around, the cards I bought for this are 32GB.

Thanks in advance! ♥

Hello, I hacked my camera: (hardwareversion ":" M16S_A2_V10_F37 "," firmwareversion ":" ppstrong-a3-tuya2_lsc-4.0.6.20210311 ")

The rtsp stream is working fine thanks.
I wanted to test telnet and live access to snap.cgi but it doesn't work: I have access denied for snapshot and telnet ..
I modified the http.conf file (without the hash) and passwd (with the hash).
I even added the line not to ask for a password but impossible (custom.sh) and the hardware is ok :

What can I do to make it work ? Thank you

my http.conf :

my passwd :

I have a Mini 11S camera hardware version M11S_A2_V10_F37 with ppstrong-a3-tuya2_merkury-4.0.6.20210207 firmware that I have successfully rooted and then patched ppsapp using the appropriate file from https://www.marcrobledo.com/RomPatcher.js/
The camera apparently connects up to my network but I can;'t get a picture off of it using any of the URL's provided, nor will the app find the camera anymore. So am I out a camera or is there any way to either make this work or put it back the way it was?

HELP !

So the story goes like this. I have a tuya " Mini 7s" camera from CALEX, with the details below:

"devname":"Smart Home Camera","model":"Mini 7S", "serialno":"074934231","softwareversion":"2.9.6"," hardwareversion":"M7S_H1_V11_F23","firmwareversion":"ppstrong-c51-tuya2_calex-2.9.6.20200522",...

I followed guino/BazzDoorbell#13 and all went well, or partially well I might say. I got telnet access, I could play "snap.cgi" and "mjpeg.cgi" (after changing the address), but RTSP would not work for the life of me. I patched for the version of my firmware, following the instructions, made sure the patched ppsapp was on the root of the SD card, heard the double start-up sound (so the patched ppsapp was loaded), but RTSP would just not work. Everything else was fine though. One interesting bug I noticed was that if a custom password was set for telnet access, login would not work after the loading of the patched ppsapp. I tried and retried the hashed password that I set up, but it would not log me into telnet. However login would work if I had removed/renamed the ppsapp from the SD card's root so that it doesn't get loaded. To avoid this I configured for a passwordless login and telnet worked after loading the root ppsapp.

Seeing that RTSP still didn't work, I thought I should perhaps learn to patch it myself before asking for help. But even before that, I thought what if I re-root my camera with the instructions from guino/BazzDoorbell#2, since it is mentioned that both versions work, just to see if that will make ppsapp work and give me an RTSP feed (I am no linux guru, I am trial-ing and error-ing without much clue as to what I am doing), or affect the behavior of the camera in any way. And affect it, it did! The camera was rooted, all the folder structure appeared on the SD card, the same as with the #13 method, but "snap.cgi" and "mjpeg.cgi" would not work, despite making sure the address was changed with the one specific to my firmware. RTSP didn't work either as the 2nd start-up sound was not heard even with the ppsapp file on the root of the SD card. So for some reason ppsapp wasn't loading.

Then I decided what if I replace the "initrun.sh" from "2" with the "initrun.sh" from "13". This is when I had a feeling that things might go south, but I nevertheless pushed ahead. Attempting this to see what may happen seemed a lot easier than learning to patch my ppsapp (or admit defeat and ask for help) and deal with memory addresses and things I don't quite understand well yet. Difficult endeavors are always dealt with last. Tackle the easy stuff first, my inner inspiration told me. And it was damn easy to replace the "initrun.sh" file.

BUT, upon reboot, the camera showed me an ugly solid red LED similar to that of HALL 9000 from 2001: A Space Odyssey, and it stays like that forever, red and menacing, it doesn't even blink at me to appear friendlier :P No matter if I remove the SD card or not, the red led light remains present. So my camera is currently unresponsive or bricked just because I messed with the "initrun.sh" files from different root approaches.

Now, dear reader, could you please help me get out of this rut? Is there any way to restore my camera to normal functionality, and then hopefully repatch/re-root it again with the right files so that the RSTP stream works? I am ready to embark on a difficult endeavour and learn what I must, as I've exhausted my "easy-to-go" options.

I had some notes from when I broke Merkury 720p cameras a couple years ago.

One thing I saw in the firmware that never worked was entering factory mode from a QR code. Turns out, it was just my cameras.

Make a qr code that says:

{"p":"Your Wifi password here","s":"Your SSID","t":"_MEARI56565099"}

and show it to the camera when it's in pairing mode, and it should switch to factory mode and enable HTTP on 8090. Tested on a Geeni Doorpeek / Bell 12S

{"devname":"Smart Home Camera","model":"Bell 12S","serialno":"000000000","softwareversion":"4.0.7","hardwareversion":"BE12S_A2GC1_915","firmwareversion":"ppstrong-a3-tuya2_general-4.0.7.20210513","identity":"11111111111111111","authkey":"aaaaaaaaaaaaaaa","deviceid":"aaaaaaaaaa","pid":"aaa","WiFi MAC":"sssssss","ETH MAC":"dddddddddd"}

About Device

Summary

So, after successfully rooting my camera I am able to log (telnet) into the device and use vi to edit tuya_config.json. I have set onvif_enable to 1 and have set the onvif_pwd. Attempting to access the rtsp stream using a variety of methods has not yielded any success to include:

/* using web browser */
rtsp://( admin | user ):password@ip:8554
rtsp://( admin | user ):password@ip:8554//Streaming/Channels/10[1|2]
rtsp://ip:8554
rtsp://ip:8554//Streaming/Channels/10[1|2]

/* using vlc */
vlc --rtsp-tcp rtsp://ip:8554

My thought is that onvif is not actually serving up rtsp. When using netstat to check for active connections, I don't see the onvif server on 8000 or the rtsp server on 8554. All that is present are the web servers on 8080 and 8090, the tuya service on 6668, and the telnet connection on 23.

tuya_config.json

{
    "version"                  : 0,
    "sleep_mode"               : 0,
    "alarm_fun_onoff"          : 0,
    "alarm_fun_sensitivity"    : 1,
    "alarm_fun_mode_switch"    : 0,
    "alarm_fun_time_start"     : 0,
    "alarm_fun_time_end"       : 0,
    "flip_onoff"               : 0,
    "light_onoff"              : 1,
    "night_mode"               : 0,
    "sound_detect_onoff"       : 0,
    "sound_detect_sensitivity" : 0,
    "watermark_onoff"          : 1,
    "event_record_time"        : 60,
    "enable_event_record"      : 2,
    "record_enable"            : 1,
    "motion_trace"             : 1,
    "motion_area_switch"       : 0,
    "motion_area"              : "",
    "motion_tracking"          : 0,
    "cry_detection_switch"     : 0,
    "humanoid_filter"          : 0,
    "loudspeaker_vol_pct"      : 100,
    "onvif_enable"             : 1,
    "onvif_pwd"                : "mini11s"
}

I read in #18 that there is a ppsapp.log somewhere. I am currently not aware of its dump location, or else I would be digging through that as well. I don't know why this procedure isn't working since most 4.0.x devices don't need a patch. In any case I looked at the requirements for patching and began the process but stopped when I found out about the config json, here is my findings thus far:

/* ONVIF PATCHING */

starting address: 0x8000

onvif_enable vairable: DAT_002b4ee8

addresses setting onvif_enable variable

0000f3a8 - 8000 = 73a8 -> 01 20 a0 e3
0000fba0 - 8000 = 7ba0 -> 01 00 a0 e3
00013b14 - 8000 = bb14 -> 01 20 a0 e3


/* SNAP.CGI AND MJPEG.CGI PATCHING */

cannot find pps_media_md_get_pic in binary

/* PLAY.CGI */

cannot find "talkTask" in binary

My camera is connected to a network that does not have internet, does that have an impact on either onvif or rtsp servers?
Thanks in advance for any help.

Currently gathering the necessary tools to patch this myself with your guide (https://github.com/guino/ppsapp-rtsp)

On the off-chance someone is able to patch it while I'm learning to do it and has it done before I'm finished (unlikely, but I mean you never know, right?) I wanted to post the files here.

:8090/devices/deviceinfo output:
{
"devname": "Smart Home Camera",
"model": "Mini 11S",
"serialno": "062356602",
"softwareversion": "4.0.2",
"hardwareversion": "M11S_A2_V10_F37",
"firmwareversion": "ppstrong-a3-tuya2_merkury-4.0.2.20200929",
"identity": "MR2008102100915420",
"authkey": "2krLEm9VmKr2edKEneGY8PY6patIsrB6",
"deviceid": "pp019296dcab2e021383",
"pid": "aaa",
"WiFi MAC": "dc:29:19:93:84:ff",
"ETH MAC": "00:00:00:00:00:00"
}

And just in case:
mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

I tried to utilize the ppsapp from ppstrong-a3-tuya2_merkury-4.0.6.20210207 but as expected it did not work. I did receive two boot chimes, but RTSP doesn't work using the two URLs and after a few minutes the device reboots itself, prompting the two chimes again.

--deleted--

I've tried several of your guides and issue explanations to get me through it.
This is my camera information:

{
"devname": "Smart Home Camera",
"model": "Bullet 4S",
"softwareversion": "2.10.5",
"hardwareversion": "B4S_V10_H1_2063",
"firmwareversion": "ppstrong-c51-tuya2_lcs-2.10.5.20210806",
"pid": "aaa",
}

I've tried Merkury720 and Merkury1080p with the 3 overwritten files, all lead to the same issue, I can't get the ip=30 to show up, meaning it won't boot from the sd card.

I think I need to this your link for my hardware (but not sure): guino/BazzDoorbell#2
If this is the correct guide to follow for my firmware, you referenced to: 'edit the provided 'env' so it has the below contents.
I'm new to Github, but I can't find those referenced/attach files.

If I have those files, do I ONLY place those 3 on the sd-card? Or do I copy the files from Merkury-720/mmc first?

Sorry if I don't understand correctly, but I would really like a bit of help.

 Hi, I've used your superb method to hack both the 720p and 1080p Merkury/Geeni cameras with great success. I can now access them through my Blue Iris and iSpy Agent DVR installations.  However, I find that I cannot get faster than 6 FPS from these hacked cams.  If I revert back to the Geeni / Tuya native Android apps and register with those, the speed is much faster but not accessible to my DVR solutions.
 Has anyone had similar issues?  And if so, is there a fix?

Regards,
NerdTool

Background

I recently applied the hack to a Mini 11S and two Mini 7Cs I bought a few months ago. Based on the success of those, I picked up another Mini 11S. This new one won't hack and it's not clear why.

A few notes:

• I've attempted this with 4 different SD cards, including the SD card I used to hack the first Mini 11S
• I have no trouble getting port 8090 open and doing /proc/cmdline and /devices/deviceinfo
• The firmware version (4.0.7) is the same as the working camera
• I confirmed the reset button does work
• I saw #28 which doesn't help because those issues began after a successful hack
• I saw #29 which led me to guino/BazzDoorbell#13 , which didn't solve this.
  • I confirmed the env file has the correct format in HxD
  • I tried env two different ways:
    • bootargs=mem=64M ...
    • setenv bootargs mem=64M ...
  • I also tried ppsMmcTool.txt two different ways:
    • ... env import 81C08000 ... (from ppshack2)
    • ... env import 42000000 ... (from this repo)

Outputs

I'm posting the both twice, once in code blocks (to clarify formatting) and quotes (to be readable and not so wide)

/proc/cmdline

setenv bootargs mem=64M console=ttySAK0,115200n8 loglevel=10   mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=192.168.1.99:::255.255.255.0 eth=00:55:7b:b5:7d:f7 usb_other

setenv bootargs mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=192.168.1.99:::255.255.255.0 eth=00:55:7b:b5:7d:f7 usb_other

/devices/deviceinfo

{"devname":"Smart Home Camera","model":"Mini 11S","serialno":"101934489","softwareversion":"4.0.7","hardwareversion":"M11S_A2_V20_GC1","firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.7.20210624","identity":"M6H0096K6V00901104","authkey":"APvLAil8K5zXxiRDkFmY21awjKzDCcCt","deviceid":"pp0102312aa2284cc972","pid":"aaa","WiFi MAC":"84:7a:b6:55:1d:57","ETH MAC":"00:00:00:00:00:00"}

{"devname":"Smart Home Camera","model":"Mini 11S","serialno":"101934489","softwareversion":"4.0.7","hardwareversion":"M11S_A2_V20_GC1","firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.7.20210624","identity":"M6H0096K6V00901104","authkey":"APvLAil8K5zXxiRDkFmY21awjKzDCcCt","deviceid":"pp0102312aa2284cc972","pid":"aaa","WiFi MAC":"84:7a:b6:55:1d:57","ETH MAC":"00:00:00:00:00:00"}

Final Notes

• Implicit with the hack not working, but making it explicit: I can't get telnetd running to do any further onboard investigation
• Please let me know anything else you need to see / want me to try
• Edited to add more detail around the work I did with ppshack2

Great work, thanks to you I got myself another device 😄

I got the LSC Smart Home Camera "Mini 16S", and got your hack working. But.... I've noticed that ONVIF isn't available when the unit isn't connected to Tuya. This is the same behavior we saw on the Bazz doorbell.

I took a dive into ppsapp with Ghidra, but couldn't really find why it doesn't start ONVIF.. can you point me in the right direction? Thanks!

ppsapp.zip

Got ONVIF working on a Merkury1080-ish device with firmware 4.0.6 followed by the instructions on https://github.com/guino/Merkury1080P (modified the 3 instructions) allthough I didn't got the RTSP port getting visible but I'm already happy with ONVIF.

{
"devname": "Smart Home Camera",
"model": "Mini 16S",
"serialno": "100361201",
"softwareversion": "4.0.6",
"hardwareversion": "M16S_A2_V10_F37",
"firmwareversion": "ppstrong-a3-tuya2_lsc-4.0.6.20210311",
"pid": "aaa",
}

Original MD5: 363543651299a6178a4ba77727cc39b5

Perhaps @guino sees why the RTSP ports are not working. Original binary is included in the ZIP as well.

Patch may be added to to the guino/ppsapp-rtsp#1 list
ppsapp_Mini16S.zip

Please help @guino, I'm having trouble getting my camera rooted. Here are the step I've done.

1. Using GParted on Ubuntu, format the card to FAT32 and place files onto the root of the card
2. Insert the card into the camera, while powered off.
3. Hold down the reset button (which works because I have tried just resetting it), and power on for 5+/- seconds.
4. Test by http://admin:056565099@IP/proc/cmdline or http://admin:056565099@IP/proc/self/root/mnt/mmc01/hac
5. Nothing, btw the camera is using Port 80 for http, not 8090 if that helps? Not sure if it because of the software version.

Here is my device info: Model (MI-CW017)
devname | "Smart Home Camera"
model | "Mini 11S"
serialno | "057781048"
softwareversion | "2.10.1"
hardwareversion | "M11S_H1_V10_F23"
firmwareversion | "ppstrong-c51-tuya2_geeni-2.10.1.20210207"
authkey | "3dhOfl9TAmLKEwogOXoAn4dZgE2f2Tp9"
deviceid | "pp01c25394b19618018e"
identity | "MR1906040100930166"
pid | "aaa"
WiFi MAC | "ac:5d:5c:9e:e8:9f"

Fat32_Card.zip

6-12 Pack of Beer for a Patch :-D

Need RTSP ASAP for a hybrid Solar / PoE / USB Battery bank powered Raspberry Pi 4 b rev 1.1 Mobile OBS Studio streaming machine.

Raspberry pi 4 model b rev 1.1 with 2 of these Merkury 1080P's already rooted:

mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

{"devname":"Smart Home Camera","model":"Mini 11S","serialno":"","softwareversion":"4.0.0","hardwareversion":"M11S_A2_V10_F37","firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.0.20200911","identity":"MR2008250201450521","authkey":"","deviceid":"pp01cccb6aa97251fa7d","pid":"aaa","WiFi MAC":"*","ETH MAC":"00:00:00:00:00:00"}

user 1256 S /mnt/mmc01/busybox telnetd -l /bin/sh
user 1252 S /mnt/mmc01/busybox httpd -c /mnt/mmc01/httpd.conf -h

tcp 0 0 0.0.0.0:6668 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:23 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:8090 0.0.0.0:* LISTEN

-kernel_build_svn 20190403 -kernel_version 197667 -flash 8 -total 64 -hw_id 0 -sensor soif23mipi -osmem 37 -mmz:27 -pcbname M11S_A2_V10_F37 -factoryname PPSTRONG -platform A3 -btnup 0 -btndown 0 -btnpresstime 0 -pcbversion SB2S_A2_V10 -viewmirror vertical_horizontal -inputvolumn none -ouputvolumn none -micphonemode none -distortion none -modename Mini^11S -lensinfo f3.6A -halinfo 3619ev200/

ppsapp.txt

ppsapp2.txt

If you want you can teamview where I already have everything connected and Ghidra open.

I picked up 2 of the 1080P Merkury cameras and haven't been able to get this hack setup. Both Tuya and Geeni apps do not show the current firmware. It only asks me to update to version 2.10.1 when I open the stream.

Tried 2 different SD cards with the same results. 8GB SD card is formatted FAT32 and here are the files in the root directory:

busybox
env
initrun.sh
ppsFactoryTool
ppsMmcTool

This is just a general summary of the steps I took to create it on the Card:

1: Copied the 3 files over to the root of the SD card / Downloaded and saved BusyBox to the Root
2: Saved ppsFactoryTool.txt to Root of the SD card / manually added my wifi and password as mentioned(Saved file)
3: Ejected SD card/put it in the camera while off, and held down reset button for 5 seconds

After that, I tried all the URL links and still nothing. It just doesn't wont connect / or give me any information. The 1 camera is connected to my home network so, I don't know what's going on. What app tells you the firmware of the camera? Am I missing a file or did I miss a step? I was just confused cause part of the steps refer back to the 720p camera so, I'm not sure if I missing something.

Did you ever get a chance to work on this model?
I was hoping to get two of these rooted to add to my system.
Mini 11-S
softwareversion":"5.2.5","hardwareversion":"M11S_A5_V10_MIS1","firmwareversion":"ppstrong-a5-tuya2_general-5.2.5.20211201"

I'm not sure of the possibility, but is there a busybox binary build for this device (or link to a howto) to run curl so I can trip a home assistant webhook on motion?

{
"devname":"Smart Home Bell",
"model":"Bell 7S",
"serialno":"061294585",
"softwareversion":"3.2.1",
"hardwareversion":"",
"firmwareversion":"ppstrong-b5-tuya2_eltra-3.2.1.20200710",
"licence_id":"pp01f262ce82xxxxxxxx",
"licence_key":"LeuVlqKaduzF36BJRxxxxxxxxxxxx",
"identity":"MR2007071300900103",
"authkey":"LeuVlqKaduzF36BJRMExxxxxxxx",
"deviceid":"pp01f262ce82xxxxxx",
"pid":"vFHpaEFwu8xxxxx",
"WiFi MAC":"7c:25:da:0c:xx:xx",
"ETH MAC":"08:88:12:7c:xx:xx",
"mcuversion":"4.2.3.20200615"
}

not sure if its v4 or v3 ? and script doesn't seem to work for me i tried /proc/cmdline but /devices/deviceinfo i get this json from here so something must be same

Dear Guino:

A few days ago i bought another SLC PTZ indoor camera in an Action store 3007325. Unfortunately all attempts to open a port 80, 8090 or 8090 for access through ppsfactory Tool.txt in the SD-card's rootailed completely. Only result with Nmap is that port 6668 is open, Onvif Device Manager yields no result. Have tried with several SD-cards. Do you have any reports or solutions about ppsfactory Tool.txt. not working anymore?

Thanks in advance for any suggestion
Martin J.

I tried patching manually, and I tried a patch available on https://github.com/guino/ppsapp-rtsp for my device (firmware: ppstrong-a3-tuya2_lsc-4.0.6.20210311). When configured correctly I can use the cgi-bin scripts to get mjpeg and snap to work, but for some reason RTSP doesn't get started and I can't connect to port 8554 at all.

I have attached a log of my latest attempt of manually patching the ppsapp, if it would be better to include a log of the patch I found on ppsapp-rtsp, please let me know.

Could you tell me what I'm doing wrong here?
ppsapp.log

Hello

I don't know if its possible to get a v5.0 firmware patched.
Asking for any help that could point me in the right direction or can offer a patched version.

{
"devname":"Smart Home Camera",
"model":"Bullet 4S",
"serialno":"100202591",
"softwareversion":"5.0.5",
"hardwareversion":"B4S_V10_S1_GC1",
"firmwareversion":"ppstrong-c71-tuya2_lsc-5.0.5.20210301",
"identity":"M16003AA3B02007118",
"authkey":"uFkvjT134tFxXP10yodJNb1yzPSS9XlP",
"deviceid":"pp011dce3f6f7f617add",
"pid":"aaa",
"WiFi MAC":"b4:fb:e3:e0:7b:1a",
"ETH MAC":"b4:fb:e3:e0:7b:1a"
}

I have this rooted and Onvif and RTSP are working, thanks to your instructions. Unfortunately this device needs to be online for them to work. When you have time, I would appreciate it if you can patch the app. I'm attaching a zip file.

{
"devname": "Smart Home Camera",
"model": "Mini 11S",
"serialno": "",
"softwareversion": "4.0.7",
"hardwareversion": "M11S_A2_V20_GC1",
"firmwareversion": "ppstrong-a3-tuya2_merkury-4.0.7.20210624",
"identity": "",
"authkey": "",
"deviceid": "****",
"pid": "aaa",
"WiFi MAC": "75:9a:A8:FD:C4:3C",
"ETH MAC": "00:00:00:00:00:00"
}
--deleted--

Working on getting 4 of these cameras setup. and I'm getting confirmation of root:

mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

However I can't telnet into the device on port 23

telnet 192.168.86.134 Connecting To 192.168.86.134...Could not open connection to the host, on port 23: Connect failed

When I try to patch my ppsapp I get in a bootloop, so was trying what's suggested in the last reply in this post: https://www.reddit.com/r/videosurveillance/comments/kko49q/merkury_geeni_camera_rtsphome_assistant/hhg92v2/

However it requires telnet.

Here's my device info:

{"devname":"Smart Home Camera","model":"Mini 11S","serialno":"101542740","softwareversion":"4.0.6","hardwareversion":"M11S_A2_V10_F37","firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.6.20210310","identity":"M3R0049H5601418034","authkey":"wUxefaP5KHgSU6kqoWyq6gYWzhVvC7gS","deviceid":"pp0179c2d664b2843e65","pid":"aaa","WiFi MAC":"84:7a:b6:32:e2:4e","ETH MAC":"00:00:00:00:00:00"}

Anything else, let me know.

Heya!

Bought a LSC Smart Outdoor (IP) Camera yesterday and tried this hack, but sadly it didn't seem to work. I added the camera to Tuya and had to update it before being able to use it (which probably was a mistake in hindsight).

The Firmware version on it right now is 2.10.36, and the only open ports I see are 53 and 6668.

If you need anything, I'm willing to open the camera up and do have soldering skills, I've also helped to dump the Sonoff cam a few years back and then figuring some things out :)

Thanks already for your help!

I was afraid it wouldn't take long for my next question :)
Previous issues were about the Outdoor camera (bullet).

This is about the indoor mini 16S camera (1080).
I have been able to telnet into the camera and enable RTSP in the tuya_config.json file, the RTSP stream works.

I now want to apply the hosts file hack via custom.sh but the camera stays online.
Below is the file I'm using now and the host file is in the root of the SD.

Is the custom.sh edited correctly and can I try something else?

#!/bin/sh
if [ ! -e /tmp/customrun ]; then
 echo custom > /tmp/customrun
 cp /mnt/mmc01/passwd /etc/passwd
 /mnt/mmc01/busybox telnetd
 /mnt/mmc01/busybox httpd -c /mnt/mmc01/httpd.conf -h /mnt/mmc01 -p 8080
 if [ -e /mnt/mmc01/ppsapp ]; then
  PPSID=$(ps | grep -v grep | grep ppsapp | awk '{print $1}')
  kill $PPSID
  /mnt/mmc01/set record_enable 0
  #/mnt/mmc01/set enable_event_record 1
  /mnt/mmc01/ppsapp &
  if [ -e /mnt/mmc01/hosts ]; then
   sleep 180
   cp /mnt/mmc01/hosts /etc
   ifconfig wlan0 down
   sleep 120
   ifconfig wlan0 up
  fi
 fi
fi

I got this camera from Walmart. The link is: https://www.walmart.ca/en/ip/merkury-smart-wi-fi-outdoor-security-camera-2-pack-black/PRD3CMY8UL9W0QE
The hack doesn't work for it. The results from different urls of its web server are:
proc/cmdline
console=/dev/null mtdparts=spi0.0:256K@0x0(BOOT),3072K@0x40000(sys),4288K@0x340000(app),448K@0x770000(cfg),64K@0x7E0000(enc),64K@0x7F0000(sysflg) mem=64M memsize=64M pcbversion=S2S_A5_V10 sensor=gc2063mipi model_name=Bullet-4S

devices/deviceinfo

devname	"Smart Home Camera"
model	"Bullet 4S"
serialno	"106055558"
softwareversion	"5.2.8"
hardwareversion	"B4S_A6_V10_GC1"
firmwareversion	"ppstrong-a5-tuya2_general-5.2.8.20220310"
identity	"N340021H3N02001994"
authkey	"LaXypACcZZq4utpYdf5dwiReAPvdWAnr"
deviceid	"akwd2e638247320a81e0"
pid	"aaa"
WiFi MAC	"d4:a6:51:ef:28:20"
ETH MAC	"d4:a6:51:ef:28:20"

cfg/tuya_config.json
{"version":1,"sleep_mode":0,"alarm_fun_onoff":0,"alarm_fun_sensitivity":1,"alarm_fun_mode_switch":0,"alarm_fun_time_start":0,"alarm_fun_time_end":0,"flip_onoff":0,"light_onoff":1,"night_mode":0,"sound_detect_onoff":0,"sound_detect_sensitivity":0,"watermark_onoff":1,"event_record_time":60,"enable_event_record":2,"record_enable":1,"motion_trace":1,"motion_area_switch":0,"motion_area":"","motion_tracking":0,"cry_detection_switch":0,"humanoid_filter":0,"loudspeaker_vol_pct":100,"flight_main_mode":0,"static_ip_enable":0,"onvif_enable":0,"onvif_pwd":"admin","pan_default":-1,"tilt_default":-1,"sound_light_switch":0}

Not sure what to say about this one. I had it rooted for 24h or so only to find it was no longer associated with the AP. Upon more research, I find all of the data on the flash media gone and replaced with a single folder called sdrec, which lots of short clips of the reef tank. Any thoughts as to what is occurring?

I'm going to restore the root this evening and on some other similar designs and see if something in the Geenie app might have resulted in this. Hoping to keep the vendor app functional for the spouse and such. Would welcome any comments or thoughts...

Hello,
I just purchased the Merkury 1080P Camera (MI-CW017-101WW) from Walmart, hoping to use this firmware for a local RTSP stream in Home Assistant. After trying several unsuccessful attempts, I noticed that the 5.x firmware version is not mentioned here and wanted to see if any has been successful in re-flashing a 5.2.8 firmware version to get a local RTSP stream?

I did succeed in getting the video stream into HA using the Tuya Integration, but it is slow and I'm sure it is being broadcasted across the Internet as you read this.

$ curl http://admin:[email protected]:8090/devices/deviceinfo -s | jq
{
"devname": "Smart Home Camera",
"model": "Mini 11S",
"serialno": " ********* ",
"softwareversion": "5.2.8",
"hardwareversion": "M11S_A5_V10_MIS1",
"firmwareversion": "ppstrong-a5-tuya2_general-5.2.8.20220222",
"identity": "",
"authkey": " ********* ",
"deviceid": " ********* ",
"pid": "aaa",
"WiFi MAC": "9c:1c:37:53:50:6f",
"ETH MAC": "9c:1c:37:53:50:6f"
}

$ curl http://admin:[email protected]:8090/proc/cmdline -s
console=/dev/null mtdparts=spi0.0:256K@0x0(BOOT),3072K@0x40000(sys),4288K@0x340000(app),448K@0x770000(cfg),64K@0x7E0000(enc),64K@0x7F0000(sysflg) mem=64M memsize=64M pcbversion=S2S_A5_V10 sensor=mis2006mipi model_name=Mini-11S

hi i have also one of the LSC cams.

Some things are different.
Password is admin.
The and the result of http://192.168.6.143:8090/proc/self/root/mnt/mmc01/hack hack is
done
Telnet is working.

RTSP server is not running rtsp://192.168.x.x:8554//Streaming/Channels/101

MD5 of then SD:\home\app\ppsapp file is MD5: c83e0ba3db47c1e54a11a915e19e8e08
So it doesn't match with the List of patched ppsapp's i have found under: guino/ppsapp-rtsp#1

:8090/devices/deviceinfo
{"devname":"Smart Home Camera","model":"Mini 16S","serialno":"100154576","softwareversion":"4.0.6","hardwareversion":"M16S_A2_V10_F37","firmwareversion":"ppstrong-a3-tuya2_lsc-4.0.6.20210311","identity":"M1N001CF3800921160","authkey":"JO5Jn2YGdmhuujGqMlPOLuBp8cgvWmwB","deviceid":"pp019c30a2ad61d07665","pid":"aaa","WiFi MAC":"b4:fb:e3:f5:f2:1a","ETH MAC":"00:00:00:00:00:00"}

:8090/proc/cmdline
mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

8090/proc/self/root/etc/init.d/S90PPStrong
#!/bin/sh


export PATH=/usr/bin:/sbin/:/usr/sbin:/bin

RED="�[1;31m"
NORMAL="�[0;39m"

echo "${GREEN} 2015 PPStrong Tech Cop.Ltd.${NORMAL}"

mkdir -p /opt/pps
MTDNUM=`cat /proc/cmdline | sed 's/.*ppsAppParts=\([0-9]\).*/\1/'`

# debug
MTDNUM=5

case $MTDNUM in
         5)
			mount -t cramfs /dev/mtdblock$MTDNUM /opt/pps
			break
			;;
		 7)
			mount -t cramfs /dev/mtdblock$MTDNUM /opt/pps
		 	break
		 	;;
		 0)     
			sleep 10
			mount -t vfat /dev/mmcblk0p1 /opt/pps
			break
			;;
		 *)
			MTDNUM=5
			mount -t cramfs /dev/mtdblock$MTDNUM /opt/pps
		 	;;
esac

echo "/opt/pps/" > /tmp/PPStrong.runpath
[ -e /opt/pps/initrun.sh ] && cp /opt/pps/initrun.sh /tmp/PPStart && chmod +x /tmp/PPStart && /tmp/PPStart

Hey there!

I have bought this LSC Indoor IP Camera on the 30th of August 2022 and tried this method (combined with the Merkury720P method) with no success.

I have literally tried everything that was stated in the documentation. Also switching between SD cards. I also ready some other issues but nothing seems to help. I even tried the custom QR code that somebody in the issues stated but no lucky. I think they have patched out some things in this firmware version as this one is pretty high compared to all the other versions I saw wondering on Github.

The only ports that are open are:

• 80 (DoorBird video doorbell rtspd)
• 835
• 6668
• 8554 (DoorBird video doorbell rtspd)

Port 80 and 8554 showed "version" DoorBird video doorbell rtspd in nmap. I have no idea why it is also saying that on port 80 as that should be an HTTP server.

I also get no positive response from the HTTP requests I'm doing. I tried the admin:admin but also admin:056565099. They all returned ERR_CONNECTION_REFUSED. I checked the SD card but no new folders or files have been created.

It's a cheap camera with a pretty decent lens on it and would love to see this work in my setup. I do NOT want to build one my own (for cheap) or buy an expensive set.

If you have any idea what I can do, let me know! :)

from your conclusion: "I may still look into disabling the 'online' requirement for the device"
please do so! i am living in an area with pretty unstable inet and i want to use my doorbell even if inet is down.

model "Bell 8S"
softwareversion "4.0.7"
hardwareversion "BE8S_A2_V10_433"
firmwareversion "ppstrong-a3-tuya2_general-4.0.7.20210513"
rooted: no

i can swith rtsp within the app to "on"
and with the "magic" file on sd-card i get the stream (as long the device is online)

btw:
had the sd-card problem like some guys here, but when i used the smartlife app to format the sd-card
and put the file onto it (linux worked, m$ didn't find the card) - it worked on all sd-cards i could find here.

Here's the output of deviceinfo:

{
"devname":"Smart Home Camera",
"model":"Bullet 4S",
"serialno":"101088550",
"softwareversion":"4.0.6",
"hardwareversion":"B4S_V10_A2_2063",
"firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.6.20210310",
"identity":"M3R0019H5701608572",
"authkey":"LB7x0ANcVo7AEwEA1JqPr8KzUP44V2sv",
"deviceid":"pp0196ff4a66aeecd128",
"pid":"aaa",
"WiFi MAC":"84:7a:b6:87:67:35",
"ETH MAC":"00:00:00:00:00:00"
}

Attached is my ppsapp (zip)

I've been banging my head on the wall trying to patch it and it just keeps rebooting over and over on me.

There does seem to be a match that I've tried, but it just does not work...

Thank you!!!
--deleted--

Hey, I will start a thread here with all my findings about a similar device

MINI7S-A5MB_F37 REV 1_0 2021-06-11

UART boot log:

U-Boot 2013.10.0-V3.1.27 (Jul 30 2021 - 13:36:36)

DRAM:  64 MiB
efuse_read:0x00000000
8 MiB
sd detect gpio mode:8!
mmc_sd: 0

total partitions: 6
In:    serial
Out:   serial
Err:   serial
enable watchdog

Hit any key to stop autoboot:  2 
..... 1 
..... 0 
sys: size:0x00300000, offset:0x00040000

SF: 3145728 bytes @ 0x40000 Read: OK
## Booting kernel from Legacy Image at 80008000 ...
   Image Name:   Linux-4.4.192V2.1
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2644504 Bytes = 2.5 MiB
   Load Address: 80008000
   Entry Point:  80008040
   Verifying Checksum ... OK
   XIP Kernel Image ... OK
   kernel loaded at 0x80008000, end = 0x8028da18
using: FDT

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

Hello!

I rooted my camera (Laxihub M3-TY(Mini 7s)) and rtsp stream works perfectly. Thanks a lot, but I have one question.
When I turn on the camera with internet, the stream works, but
when I turn on the camera without internet, the stream doesn't work.

Can it be fixed with root?

{"devname":"Smart Home Camera","model":"Mini 7S","serialno":"100372114","softwareversion":"4.0.6","hardwareversion":"M7S_A2_V10_F37","firmwareversion":"ppstrong-a3-tuya2_laxi-4.0.6.20210326","identity":"XXX","authkey":"XXX","deviceid":"XXX","pid":"aaa","WiFi MAC":"b4:fb:e3:bb:1f:7e","ETH MAC":"00:00:00:00:00:00"}

Hi @guino, I'd like to thank you for your great job doing this project to root Merkury cams.
I have a Merkury 1080 cam I tried to root following your instructions but it looks like I'm missing something.
I took the files from this post and then replaced the 3 files as described here before copying them all over to my sd card.
Then I turned my cam on while holding the reset button. At this point everything looked good to me, I was able to hit cmdline and deviceinfo URLs with the expected responses in my browser.
The problem came when I tried to hit the hack one, I got no response. I read that some users do not get any response at all but still the root worked, so I extracted the sd card from the cam and I found no hack file nor home folder.
I tried reformatting the sd card using Windows default formatter as well as AOMEI software with no luck (I didn't try using Linux yet).
I even tried changing the value 30 in the env file to 60 as described here, I saw the cmdline with the updated value but it didn't help.

What could I be missing?

Please find below some outputs that may help you to figure out what is happening.

http://admin:[email protected]:8090/proc/cmdline

mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

http://admin:[email protected]:8090/devices/deviceinfo

{
    "devname": "Smart Home Camera",
    "model": "Mini 11S",
    "serialno": "062843070",
    "softwareversion": "4.0.6",
    "hardwareversion": "M11S_A2_V10_F37",
    "firmwareversion": "ppstrong-a3-tuya2_merkury-4.0.6.20210207",
    "identity": "MR2009160301203856",
    "authkey": "xqF...",
    "deviceid": "pp01...",
    "pid": "aaa",
    "WiFi MAC": "XX:XX:XX:XX:XX:XX",
    "ETH MAC": "00:00:00:00:00:00"
}

http://admin:[email protected]:8090/proc/self/root/mnt/mmc01/hack

[HTTP/1.1 500 Internal Server]

http://admin:[email protected]:8090/proc/mounts

rootfs / rootfs rw 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /dev tmpfs rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,mode=600,ptmxmode=000 0 0
/dev/mtdblock6 /home/cfg jffs2 rw,relatime 0 0
/dev/mmcblk0p1 /mnt/mmc01 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,usefree,errors=continue 0 0

http://admin:[email protected]:8090/proc/self/root/mnt/mmc01/initrun.sh

#!/bin/sh

# Copy app partition if not already done
if [ ! -e /mnt/mmc01/home ]; then 
 MTDNUM=`cat /proc/cmdline | sed 's/.*ppsAppParts=\([0-9]\).*/\1/'`
 mount -t cramfs /dev/mtdblock$MTDNUM /opt/pps
 tar xf /opt/pps/app.* -C /mnt/mmc01/
fi

# Now flag the hack is done
echo done > /mnt/mmc01/hack

# Try to run custom.sh
while true; do
 if [ -e /mnt/mmc01/custom.sh ]; then
  /mnt/mmc01/custom.sh
 fi
 sleep 10
done

http://admin:[email protected]:8090/proc/self/root/etc/init.d/S80network

#!/bin/sh

ipaddr=
bootp=
gateway=
netmask=
hostname=
netdev=
autoconf=

for ipinfo in `cat /proc/cmdline`
do
	case "$ipinfo" in
	ip=*)
		for var in  ipaddr bootp gateway netmask hostname netdev autoconf
		do
			eval read $var
		done << EOF
		`echo "$ipinfo" | sed "s/:/\n/g" | sed "s/^[ 	]*$/-/g"`
EOF
		ipaddr=`echo "$ipaddr" | cut -d = -f 2`
		[ x$ipaddr == x ] && ipaddr=x
		;;
	esac
done

[ -z "$ipaddr" ] && exit 0

echo "      IP: $ipaddr"
echo "   BOOTP: $bootp"
echo " GATEWAY: $gateway"
echo " NETMASK: $netmask"
echo "HOSTNAME: $hostname"
echo "  NETDEV: $netdev"
echo "AUTOCONF: $autoconf"

if [ x$ipaddr == x- ] ; then
	# use DHCP
	:
else
	cmd="ifconfig $netdev $ipaddr"
	[ x$netmask != x- ] && cmd="$cmd netmask $netmask"
	eval $cmd
	[ x$gateway != x- ] && route add default gw $gateway
fi

ifconfig lo 127.0.0.1

Hello, first thank you for this awesome work ! I followed the guide and installed hack

I noticed on my sdcard there is no SDT folder but "sdrec" and date time pattern for the cleanup.cgi file is also wrong (ex: mine is "..mmc\sdrec\T-101691610\mp4rec\20220202-AM"
Also I don't know what the issue is but I can' access files through http / index.html but upload.html is ok

I have a Tuya mini7s camera with ppstrong-a3-tuya2_electro-4.0.7.20210624 fw

after my system crashed and my sd card got wiped I tried to do the hack all over again without any luck.
The problem I notices is my ppsapp MD5 checksum changed, does this mean I have a different ppsapp file?

device info
{"devname":"Smart Home Camera", "model":"Mini16S", "serialno":"100142661", "softwareversion":"4.0.6", "hardwareversion":"M16S_A2_V10_F37", "firmwareversion":"ppstrong-a3-tuya2_lsc-4.0.6.20210311", "identity":"M1K006CF3B02016906", "authkey":"diBYYPK2YHTXS4xEp46u3CVh9UJqtbds", "deviceid":"pp01663ec68134948693", "pid":"aaa", "WiFi MAC":"b4:fb:e3:a5:74:ec", "ETH MAC":"00:00:00:00:00:00"}

cmdline info
mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

and attached the new ppsapp file.

ppsapp.zip
can anyone help me with this one?

Got the same camera as this one. It looks as though the tuya_config.json file is missing from the app.tar.gz that's untarred from /dev/mtdblock5. I checked this via telnet btw.. Patched ppsapp is running on the camera, but no ONVIF/RTSP.

Two questions;

1. Is this expected behaviour in this (and/or other) rebranded cameras?
2. can someone give me a default tuya_config.json so I can test the rest?

If true, then initrun.sh should be patched to copy a default config file?

Thanks in advance!

Hi
wanted to ask if you could help me read my flash?
Your guide didnt work for the 1080p variant which I currently have.
Mine is the LSC Doorbell (Or just 8S) with firmware version 4.0.7
I got it rooted but I need help extracting the binary.
I wanted to avoid disassembling another one because I already broke one in my first try with a programmer.

Hello,

I have been reading the guides and I can't seem to get past the first few steps.

I have a GNC-CW020 camera which the Geeni app says it has the firmware V4.40.5. I tried formatting (multiple ways) 2 SD Cards a bunch of times and copying the files, but I could never get them to have any sort of effect (Not even the ppsFactoryTool.txt). Ports always are the same (80,8090,23 closed and 6668 open). The device seems to boot as usual and if it had Wifi already set up, connects to it and starts recording in the DCIM folder (which contains .info and .media files)

Looks like this is a bad sign on the compatibility of this device, although from what I read this should be a 4.X firmware and it should somewhat work.

Do you have any insight on what could be wrong or if this particular device/firmware is even compatible?

Thank you for the work on these repos!

Is it possible to control the snapshot quality?

I have 1080p camera, but snapshots (via snap.cgi) are 640*360 pixels (96 DPI).

Hello. I have been reading thru this repository along with the one for the 720 version for the past few days now, trying to read all the different posts and comments about rooting my camera. There is so much info that is linked from one post to another to another, my head is spinning trying to figure out where to start. I was wondering if you could summarize all this info from the last two years into an easy to follow instruction list on how to root and enable these cameras. I’m sure it’s not as bad as it seems, but with so much info out there, it’s an intimidating challenge. I have a MI-CW-217 with the newest firmware. Thank you for everything and have a great day!

Good day,

I cannot seem to find a compatible patched ppsapp and would like to know if you could patch it for me.

:8090/devices/deviceinfo output:

{
"devname":"Smart Home Camera",
"model":"Mini 11S",
"serialno":"062426290",
"softwareversion":"4.0.0",
"hardwareversion":"M11S_A2_V10_F37",
"firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.0.20200911",
"identity":"MR2008250201433237",
"authkey":"SKmqcp0v29vjCPHp4lDyul8OAvbkGmVL",
"deviceid":"pp01fc0d938ca03d0f92",
"pid":"aaa",
"WiFi MAC":"dc:29:19:55:fb:0d",
"ETH MAC":"00:00:00:00:00:00"
}

ppsapp.zip

Hello,

I've previously used your amazing method to root two 720 Merkury cameras and today I decided to go purchase and try rooting a 1080p version. I followed all instructions properly (made sure the files were properly replaced, ejected the SD card safely, etc.).

Using admin:admin I am able to successfully open the first URL (http://192.168.1.242:8090/proc/cmdline):
mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

But when I try to open the second URL (http://admin:[email protected]:8090/proc/self/root/mnt/mmc01/hack) it won't accept the password. I've tried both admin:admin and also admin:056565099 but it won't accept either. It's weird that the first URL works but the second one does not. I have tried to access the RTSP stream and it is not working either. I think I'm rooted but I'm not certain. Do you have any other suggestions?

Thank you!

Edit: hmmm, I think it's something with Chrome and the way it stores URLs with passwords in cache or something. I manually changed the URL to http://admin:[email protected]:8090/proc/self/root/mnt/mmc01/hack and it worked just fine. Still unable to get RTSP to work using: vlc --fullscreen --rtsp-tcp rtsp://192.168.1.242:8554. Am I supposed to use port 8090 in the RTSP URL? I don't think you can specify both ports 8554 and 8090 simultaneously lol.

Edit again (lol): Sorry, I'm an idiot... I forgot about the whole ppsapp patching part... doing this now. Everything is working so fart as it should. Thanks again!

I have tried this 20 times. I have the 1080p version and I have followed the instructions. The one thing that keeps happening is the part that is supposed to say ip=30 I get an address from my octoptint server, even if it's off.

Results from /proc/cmdline
setenv bootargs mem=64M console=ttySAK0,115200n8 loglevel=10
mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=192.168.1.99:::255.255.255.0 eth=00:55:7b:b5:7d:f7

Here is the device info.
{"devname":"Smart Home Camera",
"model":"Mini 11S",
"serialno":"064024936",
"softwareversion":"4.0.6",
"hardwareversion":"M11S_A2_V10_F37",
"firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.6.20210207",
"identity":"MR2010162501419890",
"authkey":"5lj3hUKLMxi0gshH0fx2qTgSfbWVtTJA",
"deviceid":"pp019c6fcfe07f2e7863",
"pid":"aaa",
"WiFi MAC":"b4:fb:e3:29:83:cd",
"ETH MAC":"00:00:00:00:00:00"}

I recently purchased this camera and I would like to know if there is a chance to root this device. Anybody have experience with a similar version I tried the solution posted here https://github.com/guino/Merkury1080P#conclusion but wasn't successful. The load address might be different for this device. Any suggestion would be greatly appreciated

curl http://admin:[email protected]:8090/devices/deviceinfo -s | jq
{
"devname": "Smart Home Camera",
"model": "Bullet 4S",
"serialno": "",
"softwareversion": "5.2.7",
"hardwareversion": "B4S_A6_V10_GC1",
"firmwareversion": "ppstrong-a5-tuya2_general-5.2.7.20220112",
"identity": "",
"authkey": "",
"deviceid": "******************",
"pid": "aaa",
"WiFi MAC": "45:1f:4g:f7:c7:9d",
"ETH MAC": "45:1f:4g:f7:c7:9d"
}

curl http://admin:[email protected]:8090/proc/cmdline -s
console=/dev/null mtdparts=spi0.0:256K@0x0(BOOT),3072K@0x40000(sys),4288K@0x340000(app),448K@0x770000(cfg),64K@0x7E0000(enc),64K@0x7F0000(sysflg) mem=64M memsize=64M pcbversion=S2S_A5_V10 sensor=gc2063mipi model_name=Bullet-4S