Hi, can you tell me where found patch file for:
softwareversion":"2.9.0","hardwareversion":"BE5S_H1_V10_433","firmwareversion":"ppstrong-c51-tuya2_life-2.9.0.20190727"
Thanks!!

Originally posted by @Lollo9191 in #1 (comment)

Hi,

Can you please patch my psapp ? Thanks
Smart Home Camera","model":"Mini7S"
"serialno":"058193465"
"softwareversion":"2.9.1"
"hardwareversion":"M7S_H1_V11_F23"
"firmwareversion":"ppstrong-c51-tuya2_shf2.9.1.20190907"
"authkey":"vn1tnO6JgBKh7ZuKICp7mHFSytLQcnVK"
"deviceid":"shft4c86cbdb8b89c85e"
"pid":"aaa","WiFi MAC":"c4:3a:35:21:5a:d7"}

Originally posted by @liberty4fr in #1 (comment)

I will leave this issue open so anyone can post RTSP patch files for their ppsapp -- NOT FOR DISCUSSION/REQUESTS.
The idea is to post patch files (created by users) which are small and are not property of any company which means there's no legal question on being able to share them.

NOTE: If you have a version that supports ONVIF you likely can use it without patching ppsapp -- For this simply change the line #/mnt/mmc01/set onvif_enable 1 to /mnt/mmc01/set onvif_enable 1 (just remove the # ) in custom.sh

4.0.x NOTE: It's been reported that firmware versions 4.0.x may allow you to use ONVIF without patching by following these steps: guino/Merkury1080P#9 (comment) -- it's worth a try if there's no patch for your firmware.

Here's how to patch ppsapp

• After the hack is installed: power off the device, remove the SD card and take it to a computer
• Go to https://www.marcrobledo.com/RomPatcher.js/ DO NOT CLICK ON CREATOR MODE
• Click ‘choose file’ in front of ‘ROM file’ and select the original ppsapp file under /home/app/ppsapp on the SD card (assuming you didn’t do anything to it since the hack was installed)
• VERIFY that the md5 value displayed matches the md5 from the list below (listed with the patch for your ppsapp)
• Click ‘choose file’ in front of ‘Patch file’ and select the zip file you downloaded from the list below
• Click ‘apply patch’ and save/download the file to the root of the SD card (the default file name will likely be ppsapp-rtsp)
• Rename the saved/downloaded file on the root of the SD card to ppsapp (make sure it has no .txt or any extension) — verify the size is exactly the same as the size of /home/app/ppsapp in the SD card (which should be a few megabytes)
• Properly eject/unmount the SD card from computer (i.e. windows using the tray icons, linux umount command, etc)
• Insert SD card to device and power it on
• Wait for it to boot - you likely will hear the startup sound 2 times. After the 2nd startup time you can try to view the rtsp feed under rtsp://ip:8554 (unless you're on 2.9.7 in which case you use the links provided with the patch).

This section is only is for users POSTING new patches:

The patch file format should be one supported in https://www.marcrobledo.com/RomPatcher.js/ which you can use (in creator mode) to generate the patch file by loading the original and patched ppsapp files. As a standard I recommend naming the patch ppsapp-rtsp.zip (with ppsapp-rtsp.ips inside of it).

At a minimum we need the MD5 and the patch file but it would be nice to include details like below (which is the information from my own device). You can get the information for the table with http://admin:056565099@IP/devices/deviceinfo and the md5 is also displayed on the ROM patcher site when creating the patch (but any md5 hash tool should work).

Bazz doorbell patch

ppsapp-rtsp.zip please use steps above to patch it.
snap.cgi and mjpeg.cgi address: 0x0042ac2c (already set in the files from https://github.com/guino/BazzDoorbell)
play.cgi address: 0x42d6e4 (already set in the files from https://github.com/guino/BazzDoorbell)

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.jpg and mjpeg.cgi address: 0x002d6648

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.jpg and mjpeg.jpg address: 0x00427b3c

(Original post by @russinnes -- Energizer Connect Doorbell)

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.jpg and mjpeg.jpg address: 0x0046f7f4

(Originl post by @adwiraguna)

ppsapp-rtsp-HD.zip please use this HOW TO PATCH GUIDE
ppsapp-rtsp-SD.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x00475b64

(Original post by @m11tch)
LSC Smart Connect Smart Doorbell

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0047494c
play.cgi request address: 0x0477404

NOTE: This version is reported have RTSP available without patching at rtsp://IP:8554//Streaming/Channels/101 and rtsp://IP:8554//Streaming/Channels/102 -- see: guino/BazzDoorbell#2 (comment)

NOTE2: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, and in that case you can try patching with one of the patches below (I recommend disabling ONVIF first):

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
ppsapp-rtsp-8555.zip same as above but on port 8555 (rtsp://IP:8555) as ONVIF may already be using port 8554, please use this HOW TO PATCH GUIDE

snap.cgi and mjpeg.cgi address: 0x00551634
play.cgi request address: 0x005540ec

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x00429c2c

(Original post by @lesleyvanrijn)

NOTE: Off-cloud patch only! No RTSP patching, since firmware 2.9.7 has ONVIF support by default.
ONVIF service: http://IP:8000/onvif/device_service with credentials admin:admin

To enable onvif you need to block internet access (and keep it blocked), might change this later:

Modify initrun.sh:
Add above the while loop

if [ ! -e /mnt/mmc01/tuya_config_original.json ]; then cp /home/cfg/tuya_config.json /mnt/mmc01/tuya_config_original.json; fi

Add inside the while loop below sleep 10:

if [ -e /mnt/mmc01/tuya_config.json ]; then
 cp /mnt/mmc01/tuya_config.json /home/cfg/tuya_config.json;
fi

Boot the doorbell once, it will create the tuya_config_original.json file, copy it and rename it to tuya_config.json, open it and set onvif_enable to 1.
ppsapp_patched.ips.zip please use this HOW TO PATCH GUIDE

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0042ac2c

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0044ed94

(Orion Grid Connect Pan & Tilt Camera Model SC009HA)

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x00481acc
play.cgi address: 0x004824e0

(Nedis camera model WIFICI20CGY)

ppsapp-rtsp.zip for normal/online, please use this HOW TO PATCH GUIDE
ppsapp-rtspoffline.zip for no internet usage, please use this HOW TO PATCH GUIDE -- time will be wrong unless you set it manually by adding the ntpd line like HERE

snap.cgi and mjpeg.cgi address: 0x002c8010

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x002ca428

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x002c8450

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0047721c

Author @exaultu

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x00427b3c
play.cgi address: 0x0042a5f4

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x002e2f30
play.cgi address: 0x002e3084

(Orion Grid Connect Pan & Tilt Camera Model SC009HA)

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE -- REQUIRES ADDITIONAL SETUP
snap.cgi and mjpeg.cgi address: 0x00481acc
play.cgi address: 0x004824e0

This firmware may have native onvif although reported non-functional: guino/BazzDoorbell#20 (comment)
Please note port 80 is disabled in this firmware.

ppsapp-rtsp.zip for RTSP on rtsp://IP:8555 (notice port 8555 instead of port 8554) please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x005b97e8
play.cgi address: 0x005bd0cc

ppsapp-rtsp.zip (HIGH DEFINITION RTSP) please use this HOW TO PATCH GUIDE
ppsapp-rtsp-sd.zip (LOW DEFINITION RTSP) please use this HOW TO PATCH GUIDE
ppsapp-offline.zip (OFFLINE PATCH - CAN BE COMBINED WITH RTSP PATCH) please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x02c8d60
play.cgi address: 0x02c8eb8

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0042ac2c
play.cgi address: 0x0042d6e4

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0424634
play.cgi address: 0x04270ec

After patching RTSP is available at rtsp://IP:8554/Streaming/Channels/101 and rtsp://IP:8554/Streaming/Channels/102 user admin and password admin. Onvif should be available on port 8000.

NOTE: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, there are also reports that the onvif profile has errors which prevent it from working on certain applications.

ppsapp-onvif.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0375b1c
play.cgi request address: 0x0376328

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x04ee69c
play.cgi request address: 0x04ef0b8

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0488d4c
play.cgi request address: 0x0489760

NOTE: This version is reported have RTSP available without patching at rtsp://IP:8554//Streaming/Channels/101 and rtsp://IP:8554//Streaming/Channels/102 -- see: guino/BazzDoorbell#2 (comment). Onvif should be available on port 8000 (user admin and password admin).

NOTE2: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, and in that case you can try patching with the patches below:

ppsapp-rtsp.zip use rtsp://IP:8555 (notice port is 8555 to not conflict with Onvif) please use this HOW TO PATCH GUIDE

snap.cgi and mjpeg.cgi address: 0x056e7d0
play.cgi request address: 0x05720b4

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x048d5e4
play.cgi request address: 0x048dff8

ppsapp-rtsp.zip Required hardware programmer as described in: https://github.com/guino/Geeni720P
snap.cgi and mjpeg.cgi address: 0x03cf358
play.cgi request address: 0x03d0504

After patching RTSP is available at rtsp://IP:8554//Streaming/Channels/101 and rtsp://IP:8554//Streaming/Channels/102 user admin and password admin. Onvif should be available on port 8000.

NOTE: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, there are also reports that the onvif profile has errors which prevent it from working on certain applications.

I also patched this one to have the old style RTSP available at rtsp://IP:8555 (notice port 8555, no user/password)

ppsapp-onvif.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x056b6f0
play.cgi request address: 0x056efd4

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.jpg and mjpeg.jpg address: 0x03a32c0
play.cgi request address: 0x042d6e4

After patching RTSP is available at rtsp://IP:8554//Streaming/Channels/101 and rtsp://IP:8554//Streaming/Channels/102 user admin and password admin. Onvif should be available on port 8000.

NOTE: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, there are also reports that the onvif profile has errors which prevent it from working on certain applications.

ppsapp-onvif.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x037b3ac
play.cgi request address: 0x037bb1c

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x048a4fc
play.cgi request address: 0x048af10

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
ppsapp-offline.zip (OFFLINE PATCH - CAN BE COMBINED WITH RTSP PATCH) please use this HOW TO PATCH GUIDE
snap.jpg and mjpeg.jpg address: 0x042ac34
play.cgi request address: 0x042d6ec

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x04e53bc
play.cgi address: 0x04e5dd8

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.jpg and mjpeg.jpg address: 0x046f7f4
play.cgi request address: 0x04722ac

(If you have this one you likely can update your device -- please check before doing the work)

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.jpg and mjpeg.jpg address: 0x0480a54
play.cgi request address: 0x0481468

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x04ee69c
play.cgi address: 0x04ef0b8

NOTE: This version should have RTSP available without patching at rtsp://IP:8554//Streaming/Channels/101 and rtsp://IP:8554//Streaming/Channels/102 -- see: guino/BazzDoorbell#2 (comment). Onvif should be available on port 8000 (user admin and password admin).

NOTE2: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, and in that case you can try patching with the patch below:

ppsapp-rtsp.zip use rtsp://IP:8555 (notice port is 8555 to not conflict with Onvif) please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x05504b4
play.cgi request address: 0x0552f6c

NOTE: This version should have RTSP available without patching at rtsp://IP:8554//Streaming/Channels/101 and rtsp://IP:8554//Streaming/Channels/102 -- see: guino/BazzDoorbell#2 (comment)

NOTE2: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, and in that case you can try patching with the patch below:

ppsapp-rtsp.zip use port 8555 (rtsp://IP:8555) as ONVIF may already be using port 8554, please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0551634
play.cgi request address: 0x05540ec

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x04e84ac
play.cgi address: 0x04e8ec8

(Orion Grid Connect Pan & Tilt Camera Model SC009HA)

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x00434a0c
play.cgi address: 0x004374c4

(Orion Grid Connect Pan & Tilt Camera Model SC009HA)

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0047e71c
play.cgi address: 0x004811d4

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x02c17b0
play.cgi request address: 0x02c1fbc

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x048d5ec
play.cgi request address: 0x048e000

ppsapp-onvif.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x037c2f4
play.cgi request address: 0x037cb00

Patch made by: @xinterix

After patching RTSP is available at rtsp://IP:8554/Streaming/Channels/101 and rtsp://IP:8554/Streaming/Channels/102 user admin and password admin. Onvif should be available on port 8000.

NOTE: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, there are also reports that the onvif profile has errors which prevent it from working on certain applications.

ppsapp-onvif.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x03821a4
play.cgi request address: 0x03829b0

After patching RTSP is available at rtsp://IP:8554/Streaming/Channels/101 and rtsp://IP:8554/Streaming/Channels/102 user admin and password admin. Onvif should be available on port 8000.

NOTE: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, there are also reports that the onvif profile has errors which prevent it from working on certain applications.

ppsapp-onvif.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x037c354
play.cgi request address: 0x037cb60

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x02c17b0
play.cgi request address: 0x02c1fbc

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.jpg and mjpeg.jpg address: 0x042ac2c
play.cgi request address: 0x0042d6e4

NOTE: This version should have RTSP available without patching at rtsp://IP:8554//Streaming/Channels/101 and rtsp://IP:8554//Streaming/Channels/102 -- see: guino/BazzDoorbell#2 (comment)

NOTE2: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, and in that case you can try patching with the patch below:

ppsapp-rtsp.zip use port 8555 (rtsp://IP:8555) as ONVIF may already be using port 8554, please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x05694b0
play.cgi address: 0x056cd94

NOTE: This version should have RTSP available without patching at rtsp://IP:8554//Streaming/Channels/101 and rtsp://IP:8554//Streaming/Channels/102 -- see: guino/BazzDoorbell#2 (comment)

NOTE2: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, and in that case you can try patching with the patch below:

ppsapp-rtsp.zip use port 8555 (rtsp://IP:8555) as ONVIF may already be using port 8554, please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x056e6b0
play.cgi address: 0x0571f94

After patching RTSP is available at rtsp://IP:8554/Streaming/Channels/101 and rtsp://IP:8554/Streaming/Channels/102 user admin and password admin. Onvif should be available on port 8000.

NOTE: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, there are also reports that the onvif profile has errors which prevent it from working on certain applications.

ppsapp-onvif.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x037795c
play.cgi request address: 0x037811c

NOTE: This version should have RTSP available without patching at rtsp://IP:8554//Streaming/Channels/101 and rtsp://IP:8554//Streaming/Channels/102 -- see: guino/BazzDoorbell#2 (comment)

NOTE2: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, and in that case you can try patching with the patch below:

ppsapp-rtsp.zip use port 8555 (rtsp://IP:8555) as ONVIF may already be using port 8554, please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x056e6b0
play.cgi address: 0x0571f94

NOTE: This version should have RTSP available without patching at rtsp://IP:8554//Streaming/Channels/101 and rtsp://IP:8554//Streaming/Channels/102 -- see: guino/BazzDoorbell#2 (comment)

NOTE2: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, and in that case you can try patching with the patch below:

ppsapp-rtsp.zip use port 8555 (rtsp://IP:8555) as ONVIF may already be using port 8554, please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x056b5c0
play.cgi address: 0x0056eea4

After patching RTSP is available at rtsp://IP:8554/Streaming/Channels/101 and rtsp://IP:8554/Streaming/Channels/102 user admin and password admin. Onvif should be available on port 8000.

NOTE: Some people reported issues with ffmpeg not being able to play RTSP at the above URLs, there are also reports that the onvif profile has errors which prevent it from working on certain applications.

ppsapp-onvif.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x0395918
play.cgi request address: 0x0396714

Patch created by @jilleb

OFFLINE PATCH ONLY: After patching the camera should enable ONVIF when it boots disconnected from the internet.
ppsapp-offline.zip please use this HOW TO PATCH GUIDE

ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x048d5e4
play.cgi request address: 0x048dff8

This firmware does NOT need patching to use ONVIF/RTSP -- just enable it as described here
OFFLINE PATCH ONLY: After patching the camera should enable ONVIF when it boots disconnected from the internet.
ppsapp-offline.zip please use this HOW TO PATCH GUIDE

This firmware does NOT need patching to use ONVIF/RTSP -- just enable it as described here
snap.cgi and mjpeg.cgi address: 0x0395cbc
play.cgi request address: 0x03964cc

This firmware does NOT need patching to use ONVIF/RTSP -- just enable it as described here
snap.cgi and mjpeg.cgi address: 0x0305ba4
play.cgi request address: 0x03069a8

ppsapp-rtsp.zip Please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x2c8000
play.cgi request address: 0x02c8158

ppsapp-rtsp.zip Please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x02c17b0
play.cgi request address: 0x02c1fbc

ppsapp-rtsp.zip Please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x056e6b0
play.cgi request address: 0x571f94

This firmware does NOT need patching to use ONVIF/RTSP -- just enable it as described here
snap.cgi and mjpeg.cgi address: 0x37c354
play.cgi request address: 0x37cb60

This firmware does NOT need patching to use ONVIF/RTSP -- just enable it as described here
snap.cgi and mjpeg.cgi address: 0x038c300
play.cgi request address: 0x38d100

ppsapp-rtsp.zip Please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x02c17a8
play.cgi request address: 0x02c1fb4

Hi! I hope you're still doing these, thank you very much.
I wasn't able to find an existing patch for it.

{"devname":"Smart Home Camera",
"model":"Bullet 4S",
"serialno":"103112647",
"softwareversion":"4.0.7",
"hardwareversion":"B4S_V10_A2_2063",
"firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.7.20210624",
"identity":"M5H0025C6Q01411685",
"authkey":"nUC49hnET0tqaNHK0zTADu6ZaFyG8DZN",
"deviceid":"pp014ff10e93bcfd21c8",
"pid":"aaa",
"WiFi MAC":"84:7a:b6:ed:fe:d6",
"ETH MAC":"00:00:00:00:00:00"
ppsapp-zipped.zip
}

hello, I managed to get the MD5 but there is no match with those you have
could you send me the last one please
MD5=17c017f5758cd99d8a81d49c4732525c
lsc smart camera ptz V2.10.28

Hi,

Just a quick question. I followed the rooting guide and have telnet.
I applied the patch to my ppsapp but i don't see extra open ports.
Upon investigation i don't see a /home/cfg/tuya_config.json
on my camera. From what i see in the custom.sh is that onvif_enable 1 will be set,
But without the tuya_config.json it cannot be changed.
Will this file only be created once connected to the cloud?
Is there a template config i can place on the device, without connecting it to the cloud?

ppsapp md5:
363543651299a6178a4ba77727cc39b5

Deviceinfo:
{"devname":"Smart Home Camera","model":"Mini 16S","serialno":"100584068","softwareversion":"4.0.6","hardwareversion":"M16S_A2_V10_F37","firmwareversion":"ppstrong-a3-tuya2_lsc-4.0.6.20210311","identity":"retracted","authkey":"retracted","deviceid":"retracted","pid":"aaa","WiFi MAC":"00:00:00:00:00:00","ETH MAC":"00:00:00:00:00:00"}

Hi Guino,
Please can you patch the attached firmware for my Orion Smart HD Pan and Tilt camera
Device info is:

{
"devname": "Smart Home Camera",
"model": "Speed 5X",
"softwareversion": "2.9.6",
"hardwareversion": "S5X_H1_V10_F23",
"firmwareversion": "ppstrong-c5-tuya2_arlec009-2.9.6.20200414",

--deleted--
}

MD5 is ebdf087b5cd384eadea3e921f0948f2e

Looking to get access to the jpeg snapshot and rtsp stream if possible. Thanks in advance.

Hi,can any one help me with the following.
I did my doorbell with the hack that works, when, I put the test url in it says done.
now want me to make mjpeg work, for this doorbell
ppstrong-c51-tuya2_lcs-2.9.7.20201020
BE8S_H1_V10_433
e8900ce76220279a6e33ef65fd1d407b Bell 8S

in the mjpeg.cdi place i this address: 00551634
when i open the mjpeg stream i get the 404 error.
I don't know if I am entering the correct address in the correct line.
There is no need to patch with version 2.9.7, is it?

i also don't need the rtsp stream just mjpeg.

Thanks

Hello!
I will be very grateful for a patch for my camera.

Info:
{"devname":"Smart Home Camera","model":"Mini 7S","serialno":"100373779","softwareversion":"4.0.6","hardwareversion":"M7S_A2_V10_F37","firmwareversion":"ppstrong-a3-tuya2_laxi-4.0.6.20210326","identity":"M1F0089H3H01702470","authkey":"ZDcvV6BdzhbDiABWGUh5bVJdJCq9F7oE","deviceid":"pp018c4343cb14f102cc","pid":"aaa","WiFi MAC":"b4:fb:e3:bb:59:a9","ETH MAC":"00:00:00:00:00:00"}
user/password - admin/admin
deleted ppsapp

And can you clarify, can I use this (modified) ppsapp for another such a camera (the second one has a different FW)

Hi

Tried to find the snapshot and mjpeg-address myself but couldn't find it.

deviceinfo:

devname | "Smart Home Camera"
model | "Bell 8S"
serialno | "101265497"
softwareversion | "4.0.7"
hardwareversion | "BE8S_A2_V10_433"
firmwareversion | "ppstrong-a3-tuya2_general-4.0.7.20210513"
identity | "M3L0044M5600902552"
authkey | "uY2WKyGMYMApALYnL6Kx5a3moPz8gKz1"
deviceid | "pp01a17fbe0acb907d84"
pid | "aaa"
WiFi MAC | "84:7a:b6:0e:dd:53"
ETH MAC | "00:00:00:00:00:00"

Thanks!
ppsapp.zip

Hi guino, please help patch following. Thank you so much:

{
"devname":"Smart Home Camera",
"model":"Bell 8S",
"serialno":"059836688",
"softwareversion":"2.9.6",
"hardwareversion":"BE8S_H1_V10_915",
"firmwareversion":"ppstrong-c51-tuya2_globe-2.9.6.20200415",
"authkey":"AnQN2q5Jw5NE1AqAt2kHW2TXSTLnUcvl",
"deviceid":"pp01475e755bac742e77",
"identity":"MR2004060101401522",
"pid":"aaa",
"WiFi MAC":"d4:d2:d6:12:52:cc"
}

--deleted--

there is a patch but the MD5 don't match up

--deleted--

{"devname":"Smart Home Camera","model":"Bell 8S","serialno":"060876946","softwareversion":"2.10.5","hardwareversion":"BE8S_H1_V10_433","firmwareversion":"ppstrong-c51-tuya2_lcs-2.10.5.20210806","authkey":"MkU6H6-------96W","deviceid":"pp013e----daed","identity":"MR2007120100112794","pid":"aaa","WiFi MAC":"d4:d2-----38"}

mem=37M console=ttyAMA0,115200n8 mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=0 ppsWatchInitEnd ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,ThankYouGuino,T mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppPart

#!/bin/sh

export PATH=/usr/bin:/sbin/:/usr/sbin:/bin

RED="�[1;31m"
NORMAL="�[0;39m"

echo "${GREEN} 2015 PPStrong Tech Cop.Ltd.${NORMAL}"

mkdir -p /opt/pps
MTDNUM=cat /proc/cmdline | sed 's/.*ppsAppParts=\([0-9]\).*/\1/'

debug

#MTDNUM=5

echo "------------->mtdnum:${MTDNUM}"

case $MTDNUM in
5)
mount -t cramfs /dev/mtdblock$MTDNUM /opt/pps
break
;;
7|8)
mount -t cramfs /dev/mtdblock$MTDNUM /opt/pps
break
;;
0)
sleep 10
mount -t vfat /dev/mmcblk0p1 /opt/pps
break
;;
*)
MTDNUM=5
mount -t cramfs /dev/mtdblock$MTDNUM /opt/pps
;;
esac

echo "/opt/pps/" > /tmp/PPStrong.runpath
[ -e /opt/pps/initrun.sh ] && cp /opt/pps/initrun.sh /tmp/PPStart && chmod +x /tmp/PPStart && /tmp/PPStart

Hi

Can you please patch my ppsapp file.
Here is the info from the deviceinfo
{
"devname": "Smart Home Camera",
"model": "Bullet 2S",
"serialno": "057634187",
"softwareversion": "2.9.2",
"hardwareversion": "B2S_V10_H1_2063",
"firmwareversion": "ppstrong-c51-tuya2_akaso-2.9.2.20191108",
"authkey": "PxnBwpJPShMeELyR3rVlAyqojZkHFtRR",
"deviceid": "pp0139e49fa68b2e5fb3",
"pid": "aaa",
"WiFi MAC": "ac:5d:5c:0b:9f:ad"
}

and attached the original ppsapp file

Thanks
--deleted--

Hi,
My Camera is the:
ppstrong-c51-tuya2_lcs-2.9.6.20200628 | BE8S_H1_V10_433 | 50ad9c96c65c0e446d8b3d5c8c828957 | Bell 8S
MD5 matches with my stock ppsapp

i have the following problem:
when i put the patched ppsapp file on my mmc root folder my camera doesn't boot and appears to be stuck in a bootloop.
I hear the startup sound probably every minute, the led is red all the time and the device isn't available in my network (aka no ping).
When i remove the ppsapp from my sdcard the cam is booting up normally.

I followed this Guide: guino/BazzDoorbell#2 and of cause: #1 (comment)

mjpeg and snip is working for my but i want to get rtsp to work

Here is the content of my SDcard:
sdcard.zip

Thank you for your time

Contents of http://IP:8090/proc/cmdline (after already applying the hack):
mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

Contents of http://IP:8090/devices/deviceinfo:

devname	"Smart Home Camera"
model	"Mini 8S"
serialno	"064257600"
softwareversion	"4.0.8"
hardwareversion	"M8S_A2_V10_F37"
firmwareversion	"ppstrong-a3-tuya2_feit-4.0.8.20210806"

identity	"MR2010090700913280"
authkey	"uo4CcxMbifDYN5KTXVkpCUAstbj1NSUD"
deviceid	"pp014b7b6e5067b7c4aa"
pid	"aaa"
WiFi MAC	"b4:fb:e3:16:5d:54"
ETH MAC	"00:00:00:00:00:00"

Original unpatched ppsapp is attached, MD5=ab4e7e6afdaca800e0124e106154a2a6
ppsapp.zip

I bought this Kogan camera since I'm in Australia and they are just Tuya vendors

Device info

{"devname":"Smart Home Camera","model":"Mini 8S","serialno":"100211700","softwareversion":"4.0.8","hardwareversion":"M8S_A2_V10_F37","firmwareversion":"ppstrong-a3-tuya2_kogan-4.0.8.20210909","identity":"MR2012101100929800","authkey":"uZS13qYuGtgT9x3vLj7AvCMQPaP00000","deviceid":"pp013f1af6a423080000","pid":"aaa","WiFi MAC":"b4:fb:e3:63:XX:XX","ETH MAC":"00:00:00:00:00:00"}

I followed all the steps until the patch step.
I also enabled ONVIF through found tuya config json, but after reboot, the port is open but there is no media stream from it
(i.e. empty profiles) so I could not find rtsp link.

So I proceeded to patch the file, and everything went well until I could not find the "init echoshow" line in the file.

Does that mean the device does not support RTSP?

The ports opening:

23/tcp   open  telnet
6668/tcp open  irc
8000/tcp open  http-alt
8080/tcp open  http-proxy
8090/tcp open  opsmessaging```

ppsapp what is that actually?
Sometimes I see firmware with naming like ppstrong_something is this about that?

Hi,

Can you please patch my psapp for me? Much appreciated!

{"devname":"Smart Home Camera",
"model":"Bell 5T",
"serialno":"xxx",
"softwareversion":"4.3.3",
"hardwareversion":"BE5T_H1_V10_433",
"firmwareversion":"ppstrong-c5-s_meco-4.3.3.20210122",
"identity":"MR2008150100103246",
"uuid":"",
"licence_id":"ppsc2c24404a0b184d7d",
"WiFi MAC":"7c:25:da:5c:db:fd"}

--deleted--

Hi Guino

Could you please help me patch the attached, device info is:
{
"devname":"Smart Home Camera",
"model":"Bullet 2S",
"serialno":"061404732",
"softwareversion":"2.10.0",
"hardwareversion":"B2S_V10_H1_2063",
"firmwareversion":"ppstrong-c51-tuya2_akaso-2.10.0.20210803",
"authkey":"kRAoGsHPigPA5eK29Okl4RKMx3iTwyzz",
"deviceid":"pp01ab17a0a3bcd2e086",
"identity":"MR2007200900100008",
"pid":"aaa",
"WiFi MAC":"d4:d2:d6:e9:5f:13"

--deleted--

Thanks!

Hi @guino, thank you for all of your work on this project.

I did not see an offline patch for this geeni LOOK 1080 cam, could you create an offline patch for it or point me to the correct one to use?

{
"devname":"Smart Home Camera",
"model":"Mini 7S",
"serialno":"059992525",
"softwareversion":"2.9.5",
"hardwareversion":"M7S_H1_V11_F23",
"firmwareversion":"ppstrong-c51-tuya2_geeni-2.9.5.20200324",
"authkey":"WCMCIyrITb5fpJuTnwBtmp2iPQkelVgJ",
"deviceid":"pp01f3aefad18647f2d8",
"identity":"MR2004300101401446",
"pid":"aaa",
}

Link to ppsapp: https://mega.nz/file/KIRmwb7Q#M5EW4TLZ2QXvf1IZ6D7Aokt1uGTrF0ZR28eLHkDH_qE

The original ppsapp md5 and firmware version match, but the Hardware version differs with the following on #1:

Is it safe to use this rtsp patch?

Bought some new cams today, out of the box the base root "half" works:

{"devname":"Smart Home Camera","model":"Mini 11S","serialno":"","softwareversion":"5.2.5","hardwareversion":"M11S_A5_V10_MIS1","firmwareversion":"ppstrong-a5-tuya2_general-5.2.5.20211201","identity":"","authkey":"","deviceid":"","pid":"aaa","WiFi MAC":"9c:1c:37:4c:a7:ae","ETH MAC":"9c:1c:37:4c:a7:ae"}

looking to get rtsp / onvif for these guys

EDIT

Just noticed by chance that the models i picked up today are actually MI-CW217-101WWs, not MI-CW017-101Ws

Thanks Guino!!

I went and opened up the geenie app today which I've been using for a while now without any problems with my patched cameras and, perhaps maybe it had an update automatically but when I opened it up the geenie app today I got a message saying that "jailbroken devices are not allowed" and it then disabled them through the application but it also had the server wasn't working anymore either but until you restarted the device.

Just wanted to see if a fix for this issue has been found.-
Above already exists a patch for "ppstrong-c51-tuya2_geeni-2.10.1.20210207"
Device info-{"devname":"Smart Home Camera","model":"Mini 11S","serialno":"060343649","softwareversion":"2.10.1","hardwareversion":"M11S_H1_V10_F23","firmwareversion":"ppstrong-c51-tuya2_geeni-2.10.1.20210207","authkey":"lozPNpSAnbJwVhz7GKp4iNV5l5UpW9I9","deviceid":"pp0132b1202c630af158","identity":"MR2005150400913973","pid":"aaa","WiFi MAC":"38:01:46:1e:4d:b3"}

ZIP file is provided above but like the post says Some are reporting rtsp and onvif still not available and this is my issue. (RTSP is needed)
I repatched my ppa with the Rom site and provided zip.
The hack reported "done" with no problem though so I was happy on this :)
I would appreciate any fix or info you could share.

Thank you for your hard work on this whole project it is very much appreciated and I have learned a lot.

Originally posted by @SoloAsh in #1 (comment)

I Tried patching but with no success... Perhaps someone who knows what they're doing can??

devname "Smart Home Camera"
model "Mini 11S"
serialno "100316294"
softwareversion "4.0.6"
hardwareversion "M11S_A2_V10_F37"
firmwareversion "ppstrong-a3-tuya2_merkury-4.0.6.20210310"

Hi

I cannot find an existing patch for my ppsapp, please could the attached be patched? This is from a Bell 5T doorbell running firmware 4.3.3.20210122

Thanks!
ppsapp.zip

Edit: This appears to be a very similar doorbell to #guino/BazzDoorbell#35

Hi,can any one help me with the following.
I did my doorbell with the hack that works, when, I put the test url in it says done.
now want me to make mjpeg work, for this doorbell
ppstrong-c51-tuya2_lcs-2.9.7.20201020
BE8S_H1_V10_433
e8900ce76220279a6e33ef65fd1d407b Bell 8S

in the mjpeg.cdi place i this address: 00551634
when i open the mjpeg stream i get the 404 error.
I don't know if I am entering the correct address in the correct line.
There is no need to patch with version 2.9.7, is it?

i also don't need the rtsp stream just mjpeg.

Thanks

Originally posted by @stack0423 in #1 (comment)

I'd like to inspect the traffic camera sends. Maybe you have tried that before? Is it possible?

[01-01 02:00:19-- TUYA Debug][mqtt_client.c:1139] select mqtt host:m2.tuyaeu.com
[01-01 02:00:19-- TUYA Notice][mqtt_client.c:1152] mqtt get serve ip success
[01-01 02:00:19-- TUYA Debug][mqtt_client.c:816] serverIP -1062731263 port:8883
[01-01 02:00:19-- TUYA Debug][mqtt_client.c:828] mqtt over TLS is enabled. Host:m2.tuyaeu.com Port:8883
 4704:0x8cb190: x509_verify_cert() returned -9984 (-0x2700)
[01-01 02:00:19-- TUYA Err][tuya_tls.c:941] mbedtls_ssl_handshake returned ffffd900 -9984
[01-01 02:00:19-- TUYA Debug][cloud_operation.c:422] replace CA for url m2.tuyaeu.com
[01-01 02:00:19-- TUYA Err][cloud_operation.c:434] can not find the replace CA
[01-01 02:00:19-- TUYA Err][mqtt_client.c:834] tuya_tls_connect error:-9984
[01-01 02:00:19-- TUYA Err][mqtt_client.c:1168] mqtt socket connect fail. retry_cnt:1 op_ret:-9984 errno:-100
[01-01 02:00:20-- TUYA Notice][mqtt_client.c:1320] MQ_EXIT_ERR : mqtt close
[01-01 02:00:20-- TUYA Debug][mqtt_client.c:695] close mqtt
[01-01 02:00:20-- TUYA Debug][mqtt_client.c:1339] mqtt fail_cnt:2 and sleeptime:5141 ms

[01-01 02:01:06:784 TUYA Err][http_inf.c:47] Open session failed: https://a2.tuyaeu.com/d.json?.... (-9984)
[01-01 02:01:06:815 TUYA Err][iot_httpc.c:926] Post Data Return Fail.-706
[01-01 02:01:06:824 TUYA Err][tuya_ipc_cloud_storage.c:175] httpc_ipc_cloud_storage_event_notify fail!
[01-01 02:01:06:842 TUYA Err][tuya_ipc_cloud_storage.c:587] fail to notify cloud start, ret -803
 4704:0x178f618: x509_verify_cert() returned -9984 (-0x2700)
[01-01 02:01:07:193 TUYA Err][tuya_tls.c:941] mbedtls_ssl_handshake returned ffffd900 -9984
[01-01 02:01:07:202 TUYA Err][cloud_operation.c:434] can not find the replace CA

Author @exaultu

Firmware Version Hardware Version Original ppsapp MD5 device
ppstrong-c51-tuya2_geeni-2.9.6.20200528 B4S_V10_H1_2063 a4a50713eaa055b0492d96a3022ba9b5 Bullet 4S
ppsapp-rtsp.zip please use this HOW TO PATCH GUIDE
snap.cgi and mjpeg.cgi address: 0x00427b3c
play.cgi address: 0x0042a5f4

Hey Guino,

I have the Mercury 1080p outdoor camera from Walmart, matching this bad boy entirely. The mjpeg / snap as well as the play addresses all matched and verified they're working, but I can't seem to get the ppsapp provided to work for me. I did verify the md5 matched the one your hack grabbed me in home/app/ppsapp, I downloaded the patch as a zip, and uploaded it (still zipped) along with my ppsapp

My original ppsapp: --deleted--
The patch file I used:
ppsapp-rtsp.zip
The ppsapp placed at the sd card's root:
--deleted--

http://admin:056565099@ip/proc/cmdline
mem=37M console=ttyAMA0,115200n8 mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=5 ppsWatchInitEnd

http://admin:056565099@ip/devices/deviceinfo
{
"devname": "Smart Home Camera",
"model": "Bullet 4S",
"serialno": "",
"softwareversion": "2.9.6",
"hardwareversion": "B4S_V10_H1_2063",
"firmwareversion": "ppstrong-c51-tuya2_geeni-2.9.6.20200528",
"authkey": "",
"deviceid": "",
"identity": "",
"pid": "aaa",
"WiFi MAC": "*"
}

I jumped in via telnet and ran:
(PPSID=$(ps | grep -v grep | grep ppsapp | awk '{print $1}') kill $PPSID /mnt/mmc01/ppsapp &> /mnt/mmc01/ppsapp.log &)

And watched for anything RTSP related. No mention of starting any RTSP server - I also noticed a couple of errors. I've attached what seems relevant but I really can't tell if the constant "DEBUG tuya_network_manager.c:329] driver_set_freq wifi_config_is_stoped" followed by switching to a new channel so frequently (few times a second in some cases).

ppsapp log: --deleted--

I have tried three separate SD cards (I've been known to get some cheapo cards), no bueno. Any I-clue what might be giving me heartburn on this one?

Originally posted by @JonSingleton in #1 (comment)

Hi @guino,

I am back with another camera. Can you maybe patch the ppsapp?

`{"devname":"Smart` Home Camera",
"model":"Bullet 2S",
"serialno":"058960514",
"softwareversion":"2.9.2",
"hardwareversion":"B2S_V10_H1_2063",
"firmwareversion":"ppstrong-c51-tuya2_teco-2.9.2.20191106",
"authkey":"L8eghnyzhgbxkDjWjY7o1jVtvInnmARi",
"deviceid":"pp0136a7872d0cf0d95c",
"identity":"MR1909090400900528",
`"pid":"aaa",`

--deleted--

Thanks in advance!

I have hacked version 2.9.7 got an mqtt logparser on it as well , Tuya app is giving me a quite annoying update notification, can i safely update it or do i need to hack all over again .. ?

Originally posted by @Tyrian81 in #1 (comment)

I have a Mini 7C with a slightly different firmware and MD5 of "bf3b28a8601b3efc80ab409e4d88e395"

{"devname":"Smart Home Camera"
"model":"Mini 7C"
"serialno":"102979047"
"softwareversion":"2.7.8"
"hardwareversion":"M7C_AK_V10_GC4"
"firmwareversion":"ppstrong-a2-tuya2_geeni-2.7.8.20210723"
"authkey":"lAqJaZUJ4rPjcENS3Qegkzzv8lQfAg1x"
"deviceid":"pp0139318595aa63d665"
"identity":"M5H0095V8A01616517"
"pid":"aaa","WiFi MAC":"84:ea:97:11:74:0c"}

ppsapp link

I tried following the instructions to patch myself, but Ghidra kept crashing on both my linux and win machines... please let me know if you need anything else. Just RTSP is needed, as I dont think Onvif is available, and I dont use the cgi scripts.

/devices/deviceinfo:

{"devname":"Smart Home Camera","model":"Mini 7C","serialno":"061512432","softwareversion":"2.7.12","hardwareversion":"M7C_AK_V10_1245","firmwareversion":"ppstrong-a2-tuya2_geeni-2.7.12.20220621","authkey":"","deviceid":"","identity":"","pid":"aaa","WiFi MAC":"dc:bd:7a:82:46:6b"}

/proc/cmdline:

mem=64M console=ttySAK0,115200n8 mtdparts=spi0.0:256k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,2496k(sys),4608k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

--deleted--

Hello,

I'm running a Mini 16S bought as a LSC Smart Connect.

It is a device running firmware 4.x on which there are some differences like no http port at startup and requires ppsFactoryTool.txt which enables 8090 port.

Here is the device info:

{"devname":"Smart Home Camera","model":"Mini 16S","serialno":"101***","softwareversion":"4.0.6","hardwareversion":"M16SA2V10F37","firmwareversion":"ppstrong-a3-tuya2lsc-4.0.6.20210311","identity":"M4L007CF5S00****","authkey":"****","deviceid":"***","pid":"aaa","WiFi MAC":"84:7a:b6****","ETH MAC":"00:00:00:00:00:00"}

At the moment of this ticket I've succeed in having telnet and httpd working (only snap.cgi and mjpeg.cgi).

I did the ppsapp patch using the recommended website with initial and path files. Initial md5sum file is corresponding to the one I get in /home/app

But and this the reason of this issue rstp and onvif are not working. There are no other ports opened than the tuya port, httpd, telnet and the 8090 port we activated at the first step.

confirmed by using netstat:

netstat -lt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 0.0.0.0:6668            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:webcache        0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:telnet          0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:8090            0.0.0.0:*               LISTEN  

using a tool like Onvif Viever my camera is detected on port 8000 but it doesn't work as expected because nothing listen on this port.

concerning rstp I tried the different url on port 8554 but same as onvif no port are listening.

my camera has internet connection and can contact the internet.

i tried to get the log of the patched pspapp but nothing relevant appears.

Do you have any idea on what I did wrong?

I'm wondering if the fact I associated the camera with LSC app one time is not doing a lock thing?

Could you please help me patch M16S_A2_V10_F37 / v 4.0.6 as well? :-)

{
"devname": "Smart Home Camera",
"model": "Mini 16S",
"serialno": "100134974",
"softwareversion": "4.0.6",
"hardwareversion": "M16S_A2_V10_F37",
"firmwareversion": "ppstrong-a3-tuya2_lsc-4.0.6.20210311",
"identity": "M1K006CF3B02018399",
"authkey": "RMQP8t2U4JCUlPAsR3awa4Q2lTyPMV8F",
"deviceid": "pp01efa84ca8a602ee9a",
"pid": "aaa",
"WiFi MAC": "b4:fb:e3:a4:e3:f7",
"ETH MAC": "00:00:00:00:00:00"
}

--deleted--

Hi,

Can you please patch my psapp ? Thanks!

{"devname":"Smart Home Camera",
"model":"Mini 14S",
"serialno":"100117202",
"softwareversion":"4.0.4",
"hardwareversion":"M14S_A2_V10_F37",
"firmwareversion":"ppstrong-a3-tuya2_shada-4.0.4.20210115",
"identity":"LCM0029W1L02000816",
"authkey":"x4jzanf8R0k53HAZKLvijtWyWv9mT3eg",
"deviceid":"pp016192b07873afb018",
"pid":"aaa",
"WiFi MAC":"b4:fb:e3:64:02:7a",
"ETH MAC":"00:00:00:00:00:00"}

--deleted--

Hello,
Please any help with patching this '-4.0.7. version.
There is a already an -4.0.6. version but with differend md5, of course. I did no try this. Should I?
Anyway, is better to hav the correct patch, i think.

This is the device info:

admin:[email protected]:8090/devices/deviceinfo
{"devname":"Smart Home Camera",
"model":"Bullet4S",
"serialno":"100382085",
"softwareversion":"4.0.7",
"hardwareversion":"B4S_V10_A2_2063",
"firmwareversion":"ppstrong-a3-tuya2_electro-4.0.7.20210624",
"identity":"M3J0109H3S02011459",
"authkey":"CteGXtDYl1wrA8lZ88oB5kXRl6IJa4a0",
"deviceid":"pp01f103bcd348bd29e4",
"pid":"aaa",
"WiFi MAC":"84:7a:b6:05:03:6e",
"ETH MAC":"00:00:00:00:00:00"}

And i try to add the 'hacked' ppsapp from the home sub.dir. But i am not shure that it is attached....
--deleted--

Hi Guino,

I have this doorbell from the Kruidvat and there is no patch availible yet.
Could you have a look at this?

{"devname":"Smart Home Camera",
"model":"Bell 5S",
"serialno":"061638300",
"softwareversion":"2.9.7",
"hardwareversion":"BE5S_H1_V10_433",
"firmwareversion":"ppstrong-c51-tuya2_istar-2.9.7.20200814",
"authkey":"D6lhAACmnhD3E9CgSPxgFsEpHOC3k7fT",
"deviceid":"pp011202d89fc2746456",
"identity":"MR2007180100100494",
"pid":"aaa",
"WiFi MAC":"changed"}

MD5 is
54c58b61771c65ed1f870385cd77c7d7

I do not know if you need anything else if you do please let me know.
Thanks in advance
--deleted--

I bought this camera from some onlinewebshop, could you take a look? onvif is available. Is there a patch?

model | "Speed 3S"
serialno | "--"
softwareversion | "2.9.7"
hardwareversion | "S3S_H1_V10_F23"
firmwareversion | "ppstrong-c51-tuya2_laxihub-2.9.7.20201028"
authkey | "--"
deviceid | "--"
identity | "--"
pid | "aaa"

Originally posted by @danielsan79 in #1 (comment)

hi, i followed all the instructions but i can't do the ppsapp patch, could you help me? root was successful but I can't move forward. Thank you
home360.zip

Wonderful work on this everyone. Confusing as heck for a github newbie though.
I've gotten to various stages including telnet and viewing the hack "done" but never could find or generate the json file that needed editing. I'm guessing that this technique requires the ppsapp to be patched first?

Thanks for your help and patience. Small donation sent.
Ross

Firmware 4.06 as updated from Geenie app today.

CRC32:
87a8ad87
MD5:
db7cda9a70bcb1e7c5343dce00544eba
SHA-1:
5b8d683e917f03726c875f80efaf43f2e108c47a

ppsapp-merkury-1080p-406.zip

Nice repos here very helpful and simple to understand. So far everything worked like a charm, except finding a patch for my firmware. Ive attempted twice now to figure the patch out my self but I am still learning. I never found onvif in the file, and the file seems to be different then everything else ive seen here. I tried to change the custom.sh to get it up, but no luck. If you could please take a look and help me I will buy you a cold one.

This is the 1080P outdoor cam from walmart. I think the firmware got updated when setup, but I'm not sure.
Also I only heard the second chime on boot the 1st time only. I can still telnet so I know its still working tho. Not sure if that has anything to do with it but i thought it would be worth mentioning.

devinfo:
ppsapp.zip

"devname":"Smart Home Camera","model":"Bullet 4S","serialno":","softwareversion":"4.0.0","hardwareversion":"B4S_V10_A2_2063","firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.0.20200903"

Hello,

Trying to get snap and mjpeg working on my 4.0.7 firmware version 1080p Mercury camera. Searching the code in Ghidra for "pps_media_md_get_pic" returns no results :( What do I do next??

I already have rtsp working.

   "devname":"Smart Home Camera",
   "model":"Mini 11S",
   "serialno":"102783758",
   "softwareversion":"4.0.7",
   "hardwareversion":"M11S_A2_V20_GC1",
   "firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.7.20210624",

Thanks!

Edit: I did find "talkTask" and the address for mjpeg.cgi, which is: "DAT_003940e4" so I guess that = 0x003940e4 ? Is the "e" supposed to be there? lol

I do not get the 2 beeps after adding the patched ppsapp to the root, also no rtsp stream is avaible on rtsp://192.168.1.x:8554
How can i figure out what is going wrong?

I have a ppstrong based camera with the hi3518ev300 SoC (board SPEED5S-H1MB_F23) where I have successfully flashed OpenIPC.
No longer on the cloud and I now can stream hls, rtsp, mjpeg, ...
Which SoC does your camera use?

Could you help me patch this ppsapp file?

{
"devname": "Smart Home Camera",
"model": "Bullet 4S",
"serialno": "--",
"softwareversion": "4.0.6",
"hardwareversion": "B4S_V10_A2_2063",
"firmwareversion": "ppstrong-a3-tuya2_electro-4.0.6.20210329",
"identity": "--",
"authkey": "--",
"deviceid": "--",
"pid": "aaa",
"WiFi MAC": "84:--:--:--:--:16",
"ETH MAC": "00:00:00:00:00:00"
}

Many thanks!
--deleted--

Hi,

I cant' find the patch for my camera.
Could you create one for me ?

MD5 c83e0ba3db47c1e54a11a915e19e8e08

{"devname":"Smart Home Camera","model":"Mini 16S","serialno":"100133758","softwareversion":"4.0.6","hardwareversion":"M16S_A2_V10_F37","firmwareversion":"ppstrong-a3-tuya2_lsc-4.0.6.20210311","identity":"M1K006CF3B02017120","authkey":"MzNjZ7DAIWjNWuM5bmpAh0nuEtT5kgEa","deviceid":"pp0102870bf5d6d9336c","pid":"aaa","WiFi MAC":"b4:fb:e3:a4:da:30","ETH MAC":"00:00:00:00:00:00"}
--deleted--

I patched my LSC Indoor camera and have everything working without patching pssapp but just enabling rtsp in the config.
{"devname":"Smart Home Camera","model":"Mini 16S","serialno":"103781031","softwareversion":"5.2.4","hardwareversion":"M16S_A2_V10_MIS","firmwareversion":"ppstrong-a3-tuya2_lsc-5.2.4.20211015","identity":"M960049J9R01208245","authkey":"b5xPJr7CXV6bS7A2u40JCXdemNkpgq02","deviceid":"pp01927a06f52ba9d7a9","pid":"aaa","WiFi MAC":"f4:b1:9c:16:66:74","ETH MAC":"00:00:00:00:00:00"}

I'm wondering how I can find the address I have to use for the cgi-bin files.
The firmware is not listed, is there anyway I can figure out the address?
The guide mentions ghidra but I'm not familiar with it. I will look more into it, but I have no idea what to look for.

There is an online patch and the camera keeps on working without internet once booted with internet.
But with a reboot whilst internet is blocked, the RTSP stream is gone as well.

What is the difference between online and offline patches?
Is it something I could do even though lacking most skills?

Firmware: ppstrong-a3-tuya2_electro-4.0.7.20210624
Smart Home Camera Bullet 4S
SW: 4.0.7
HW: B4S_V10_A2_2063

What do you require if it is even possible?

Thank you again!

EDIT, I found the offline patch guide but don't even know where to look for what.
This is not something I could do without extensive help.
guino/BazzDoorbell#4 (comment)

Hello there! I just root my cam which is

"model": "Mini 9S",
"serialno": "106100343",
"tp": "100000017",
"hardware_version": "M9S_A2_V10_F37",
"software_version": "4.0.6",
"firmware_version": "ppstrong-a3-s_arenti-4.0.6.20210304"

With onvif_enable activated.
I have access to the telnet server where I can get netstat:

/ # netstat -ln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 0.0.0.0:8000            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:8554            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:23              0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:8090            0.0.0.0:*               LISTEN      
netstat: /proc/net/tcp6: No such file or directory
udp        0      0 0.0.0.0:3702            0.0.0.0:*                           
udp        0      0 0.0.0.0:3703            0.0.0.0:*                           
netstat: /proc/net/udp6: No such file or directory
netstat: /proc/net/raw6: No such file or directory
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path
unix  2      [ ACC ]     STREAM     LISTENING        635 /var/systemCmd.socket

which is great! (8554 port listening)

DISCLAIMER: The --rtsp-tcp option in vlc don't exist for me
vlc: unknown option or missing mandatory argument `--rtsp-tcp'

But when I try to get the rtsp stream in vlc
(vlc rtsp://admin:[email protected]:8554/Streaming/Channels/101)

I get an error, not very explicit, so I tried to look at the packages with wireshark:

Where 192.168.1.50 is my PC and 192.168.1.193 is my camera.

The error is not that clear.
Maybe I have the wrong URL, so I saw this post to get the URLs but when I start the tool, I get those errors:

./ipconvif 192.168.1.193                                                                            
[2023-04-27 23:08:16] [main.cpp] [26] {error:28 faultstring:Connection refused faultcode:SOAP-ENV:Sender faultsubcode:(null) faultdetail:connect failed in tcp_connect()}
[2023-04-27 23:08:16] [main.cpp] [26] {error:28 faultstring:Connection refused faultcode:SOAP-ENV:Sender faultsubcode:(null) faultdetail:connect failed in tcp_connect()}
[2023-04-27 23:08:16] [main.cpp] [26] {error:28 faultstring:Connection refused faultcode:SOAP-ENV:Sender faultsubcode:(null) faultdetail:connect failed in tcp_connect()}
[2023-04-27 23:08:16] [main.cpp] [26] {error:28 faultstring:Connection refused faultcode:SOAP-ENV:Sender faultsubcode:(null) faultdetail:connect failed in tcp_connect()}

So I don't really know what to do, when I copy paste this error on google, it is not really relevant for me...
Any idea on your side?

EDIT: I just tried on RTSP Player and it worked! (but very slowly and in black and white, any optimization to do?) I don't really know why it is not working with vlc... and ipconvif don't works yet.

Hello,

I'm trying to patch my ppsapp file to support RTSP. But i'm unable to locate the "init echoshow" section.
Anyone willing to give it a try for me?

I've attacht the original ppsap file:
--deleted--

Camera details:
"devname":"Smart Home Camera",
"model":"Mini 16S",
"serialno":"100149735",
"softwareversion":"4.0.6",
"hardwareversion":"M16S_A2_V10_F37",
"firmwareversion":"ppstrong-a3-tuya2_lsc-4.0.6.20210311",
"identity":"M1N001CF3800909892",
"authkey":"SmlyhgEJbdAKRRL3MzDjDmkIFy7Pspxf",
"deviceid":"pp01f6e88b1f6049db43",
"pid":"aaa",
"WiFi MAC":"b4:fb:e3:f5:f6:bf",

Thanks,
Jos Vink