Firmware Original (v9.0.05.32_202004101552): D.7z Firmware rstp yi-hack-Allwinner (v2 0.1.3):DRTSP.7z
Extract the contents of the archive to the root of your SD card. Insert the SD Card and reboot the camera Wait a minute for the camera to update. Check the hack opening the web interface http://IP-CAM:8080 Don't remove the microSD card (yes this hack requires a dedicated microSD card).
to remove the hack, use this package:unhack_r30gb.tar.7z faire une backup: Backup.7z
Open the cam removing screws.
Find the 3 uart pads (TX, RX and GND):
Connect the pads to a ttl-rs232/usb adapter (rx, tx and GND).
Open putty with logging enabled.
Switch on the cam. Now, if the connection is ok, you will see the uboot and kernel logs on the screen. Otherwise, restart from point 2.
Stop the boot at the U-Boot prompt (should be "=>") pressing "Enter".
Now you have a physical connection to the cam and you can use all the uboot commands.
Restore home partition Type the following commands and check the output response:
Enable the SD card: => sunxi_card0_probe [23.298]get mem for descripter OK !
card_caps:0x30000002 host_caps:0x3000003f List the content of the SD card: => fatls mmc 0 record/ 2502 lower_half_init.sh newbackup/ yi-hack/ 1245184 mtdblock4.bin Factory.done/ log/
2 file(s), 5 dir(s) Load the file mtdblock4.bin from SD to RAM memory (address 0x45000000): => fatload mmc 0 45000000 mtdblock4.bin 1245184 bytes read in 1002 ms (11.5 MiB/s) Enable SPI bus and detect flash chip: => sf probe sf: bus-0 cs-0 spedd-50000000Hz mode-3000 SF: Detected en25qh128 with page size 256 Bytes, erase size 64 KiB, total 16 MiB Get the parameters for erase and write commands To run the last command you need 3 parameters:
address: the RAM address used above (45000000) offset: is the offset in flash where mtdblock4 starts According to the table below it's 690000 = 60000 + 1d0000 + 120000 + 340000
root@xiaoyi:/# cat /proc/mtd dev: size erasesize name mtd0: 00060000 00001000 "uboot" mtd1: 001d0000 00001000 "boot" mtd2: 00120000 00001000 "rootfs" mtd3: 00340000 00001000 "home" mtd4: 00130000 00001000 "backup" mtd5: 00020000 00001000 "env" mtd6: 00010000 00001000 "mfg" mtd7: 00010000 00001000 "conf" mtd8: 00000000 00000000 "UDISK" len: len of the file mtd4block.bin copy it from the output of the fatload command and convert it to hexadecimal (1245184 => 130000)
Erase the flash memory using parameters above: => sf erase 690000 130000 SF: 1245184 bytes @ 0x690000 Erased: OK Write the file from RAM memory to SPI flash using parameters above: => sf write 45000000 690000 130000 device 0 offset 0x690000, size 0x130000 SF: 1245184 bytes @ 0x690000 time:14825 ms Written: OK Reset and cross your fingers. => reset
config: config.tar.7z