Senior Member

Rank: 2

Credits
84
Device
0
Online time
5 Hours
Send PM

[Tips & Tutorials] Easy way to enable unauthenticated RTSP streams on Yi Smart Cam IR in 1.8.5.1I

[ Promote]
88776 418 |
00:40, Jul-26-2015 | From PC
|
|
Go to reply no.
OK so I bought one of these recently (the 720p Yi Smart Camera with IR Night Vision) and as you all know found that although RTSP streams worked in firmware 1.8.5.1B was no good for controlling the IR sensor of the camera at night and it would just pulse and constantly trigger events.
1.8.5.1H was not so good stability wise for me and had the authenticated RTSP Server.

1.8.5.1I was great for me stability wise but didn't support RTSP.

So I hacked the firmwares and found out a really easy way to get unauthenticated RTSP streams working on 1.8.5.1I.

Just download this file:
https://mega.co.nz/#!QARChRCD!4slw-kvKJDGGuAfZr7M-iTr0rRBAoBPVExVbCUikEFs

Extract the test folder and it's contents to the top level of the memory card.

smartants.png

Now just go and insert the card into your Yi Smart Camera and turn it on if it's not already.

The camera will now boot up and after a minute or so you'll be able to access RTSP streams in software like VLC or Blue Iris using the following URL

rtsp://<your Yi IP address>/ch0_0.h264

So my Yi is on 192.168.0.226 so I use the following in VLC

smartants2.png

And the result is that with the latest firmware 1.8.5.1I you now have full RTSP access.

smartants3.png

You can delete the test folder once this is working as it only needs to be done once - when new firmware comes out it will kill this off unless Xiaomi include it by default.

Enjoy :)
Favorite16 Share

Rated by 9 people   Experience Prestige Reason  

Veggos + 2 Fantastic!
dev11295 + 10 + 1 Awesome!
ibakas + 1 Thanks!
Ajinkyajin + 2 Fantastic!
nIXver + 1 Great!
Lazuli22 + 1 Thanks!
Dasari5 + 1 Thanks!
byanou69 + 1 Great!
sepneela + 10 Thanks!

Experience +29  Prestige +1  View Rating Log

Senior Member

Rank: 2

Credits
41
Device
0
Online time
9 Hours
Send PM
21:06, Dec-01-2015 | From PC
|

1.8.5.1K_20151201-A_MP77V

This post was edited by ScorpAL at 21:36, Dec-01-2015

https://dl.dropboxusercontent.com/u/210043/1.8.5.1K_20151201-A_MP77V.zip

1.8.5.1K_20151201-A_MP77V.zip from 4pda.ru forum

Custom version 1.8.5.1K MP77V 4pda.ru 01.12.2015 (modification A)
home size:7554984md5:310612e78dc349bec8ba30dac6ed3a4e

This version should work on OLD and NEW cameras.

!!! Install it at your own risk !!!

Rated by 2 people   Experience Reason  

spencer82 + 1 Thanks!
yorkiebar + 1 Thanks!

Experience +2  View Rating Log

Senior Member

Rank: 2

Credits
70
Device
Mi2
Online time
21 Hours
Send PM

Pioneer of MIUI English Forum

18:54, Jan-10-2016 | From PC
|
I've got this up and running very nicely thanks to the hard work from all the people involved with hacking up this firmware.

For anyone who is struggling to get their head around how to do things, I've written a very clear guide on how to set up the Xiaoyi camera along with iSpy on Windows at http://twigstechtips.blogspot.com/2015/05/setting-up-xiaomi-yi-small-ants.html

I do have one question though which I haven't seen in this thread. Is there a way to disable the timestamp on the video?

Senior Member

Rank: 2

Credits
93
Device
Others
Online time
23 Hours
Send PM
22:29, Dec-01-2015 | From PC
|
This post was edited by yorkiebar at 22:30, Dec-01-2015
AWiles replied at 2015-12-1 22:22
Indeed.

I've decompiled and uploaded,

Ta,

He's rewritten the init.sh file, and has a bug in it    Won't affect anything though.
  1. if [ -f "/home/hd1/test/app_before.sh" ]; then
  2. . /home/hd1/test/app_before.sh
  3. fi

  4. start_app &>/tmp/hd1/service.log/init_sh.log

  5. tcpsvd -vE 0.0.0.0 21 ftpd -w / &

  6. ps w >/tmp/hd1/service.log/ps.log
  7. df >/tmp/hd1/service.log/df.log

  8. if [ -f "/home/hd1/test/app_before.sh" ]; then
  9. . /home/hd1/test/app_after.sh
  10. fi
Copy the Code

Senior Member

Rank: 2

Credits
34
Device
Others
Online time
12 Hours
Send PM
21:11, Dec-01-2015 | From PC
|
ScorpAL replied at 2015-12-1 21:06
https://dl.dropboxusercontent.com/u/210043/1.8.5.1K_20151201-A_MP77V.zip

1.8.5.1K_20151201-A_MP77V. ...

thanks guy!!

Junior Member

Rank: 1

Credits
24
Device
0
Online time
2 Hours
Send PM
03:48, Dec-01-2015 | From PC
|
yorkiebar replied at 2015-11-30 00:46
I have two of the cameras.  One v2.0 and one v2.1.

The v2.0 has firmware "I" on it and I can run r ...

I thought I had the "broken" version, since using I firmware resulted in a bootloop for me. (I did K => B => I). But I have 2.0 apparently, so I manage to break the enless bootloop by commenting out the init.sh executables...rmm/exnet/cloud etc. I had to use a serial connection in order to stop the boot loop.

When I had K firmware on v2.0, i could ping hosts but other computers couldnt init a connection to the camera. could not ping the camera, not reply. Perhaps all incoming conn. requests are blocked. It works with I fireware though...

Anyway, I will try the toolchain programs again with the I firmware, they didn't work with K.
Thanks to http://nemon.org/ipcam-ipr1631x/

I built the live555mediaserver rtsp using the toolchain:
http://s000.tinyupload.com/?file_id=75004323688947916923

but it doesnt support mp4/mpeg4. But perhaps it can be used with the "ch0.264" file in the home directory somehow. It works with 264 files. I don't have much time to investigate.

Anyway, its a little fun to tinker with this i suppose...



Senior Member

Rank: 2

Credits
93
Device
Others
Online time
23 Hours
Send PM
02:00, Nov-13-2015 | From PC
|
This post was edited by yorkiebar at 02:14, Nov-13-2015

key dmesg differences   (new firmware K on left rtspsvc not working, old firmware I on right)











Senior Member

Rank: 2

Credits
93
Device
Others
Online time
23 Hours
Send PM
01:43, Nov-13-2015 | From PC
|
OK.

"old" hardware variant running firmware 1.8.5.1I_201506291725.  rtspsrv works.
  1. # uname -a
  2. Linux (none) 3.0.8 #1 Wed Apr 30 16:56:49 CST 2014 armv5tejl GNU/Linux
  3. # cat /tmp/hwplatform
  4. hwplatform=2
  5. # cat /home/version
  6. [sys]
  7. version=1.8.5.1I_201506291725
  8. [kernel]
  9. version=3-0.8
  10. provider=18e
  11. devtype=18e
  12. #
  13. #
  14. #
  15. # df -h
  16. Filesystem                Size      Used Available Use% Mounted on
  17. /dev/root                 3.5M      2.7M    868.0K  76% /
  18. tmpfs                    17.2M      4.0K     17.2M   0% /dev
  19. /dev/mtdblock5            8.9M      7.9M      1.0M  89% /home
  20. tmpfs                    32.0M     44.0K     32.0M   0% /tmp
  21. tmpfs                   512.0K     16.0K    496.0K   3% /home/mmap_tmpfs
  22. tmpfs                    16.0M     24.0K     16.0M   0% /home/tmpfs
  23. tmpfs                    16.0M      3.0M     13.0M  18% /home/jrview
  24. # cat /proc/meminfo
  25. MemTotal:          35212 kB
  26. MemFree:            1772 kB
  27. Buffers:               0 kB
  28. Cached:            14152 kB
  29. SwapCached:            0 kB
  30. Active:             4440 kB
  31. Inactive:          12860 kB
  32. Active(anon):       3176 kB
  33. Inactive(anon):     3076 kB
  34. Active(file):       1264 kB
  35. Inactive(file):     9784 kB
  36. Unevictable:           0 kB
  37. Mlocked:               0 kB
  38. SwapTotal:             0 kB
  39. SwapFree:              0 kB
  40. Dirty:                 0 kB
  41. Writeback:             0 kB
  42. AnonPages:          3172 kB
  43. Mapped:             5844 kB
  44. Shmem:              3104 kB
  45. Slab:               7820 kB
  46. SReclaimable:       1092 kB
  47. SUnreclaim:         6728 kB
  48. KernelStack:         608 kB
  49. PageTables:          404 kB
  50. NFS_Unstable:          0 kB
  51. Bounce:                0 kB
  52. WritebackTmp:          0 kB
  53. CommitLimit:       17604 kB
  54. Committed_AS:     132628 kB
  55. VmallocTotal:     966656 kB
  56. VmallocUsed:       23708 kB
  57. VmallocChunk:     935280 kB
  58. #
Copy the Code
_______________________________________________


"new" hardware variant running firmware 1.8.5.1K_201508311131.  rtspsrv does not work
  1. # uname -a
  2. Linux (none) 3.0.8 #1 Wed Apr 30 16:56:49 CST 2014 armv5tejl GNU/Linux
  3. #  cat /tmp/hwplatform
  4. hwplatform=2
  5. # cat /home/version
  6. [sys]
  7. version=1.8.5.1K_201508311131
  8. [kernel]
  9. version=3-0.8
  10. provider=18e
  11. devtype=18e
  12. #  df -h
  13. Filesystem                Size      Used Available Use% Mounted on
  14. /dev/root                 3.5M      2.7M    860.0K  76% /
  15. tmpfs                    17.2M      4.0K     17.2M   0% /dev
  16. /dev/mtdblock5            8.9M      8.1M    768.0K  92% /home
  17. tmpfs                    32.0M     60.0K     31.9M   0% /tmp
  18. tmpfs                   512.0K     16.0K    496.0K   3% /home/mmap_tmpfs
  19. tmpfs                    16.0M      8.0K     16.0M   0% /home/tmpfs
  20. tmpfs                    16.0M      3.0M     13.0M  19% /home/jrview
  21. # cat /proc/meminfo
  22. MemTotal:          35212 kB
  23. MemFree:            2020 kB
  24. Buffers:               0 kB
  25. Cached:            13820 kB
  26. SwapCached:            0 kB
  27. Active:             4748 kB
  28. Inactive:          12220 kB
  29. Active(anon):       3176 kB
  30. Inactive(anon):     3080 kB
  31. Active(file):       1572 kB
  32. Inactive(file):     9140 kB
  33. Unevictable:           0 kB
  34. Mlocked:               0 kB
  35. SwapTotal:             0 kB
  36. SwapFree:              0 kB
  37. Dirty:                 0 kB
  38. Writeback:             0 kB
  39. AnonPages:          3172 kB
  40. Mapped:             6416 kB
  41. Shmem:              3108 kB
  42. Slab:               7800 kB
  43. SReclaimable:       1060 kB
  44. SUnreclaim:         6740 kB
  45. KernelStack:         632 kB
  46. PageTables:          448 kB
  47. NFS_Unstable:          0 kB
  48. Bounce:                0 kB
  49. WritebackTmp:          0 kB
  50. CommitLimit:       17604 kB
  51. Committed_AS:     149820 kB
  52. VmallocTotal:     966656 kB
  53. VmallocUsed:       23708 kB
  54. VmallocChunk:     935280 kB
  55. #
Copy the Code
.

Senior Member

Rank: 2

Credits
93
Device
Others
Online time
23 Hours
Send PM
01:57, Nov-10-2015 | From PC
|
ironematto replied at 2015-11-10 01:08
Hi all,
how to hack firmware version 1.8.5L with rtsp ?!?!

Not currently possible.

Senior Member

Rank: 2

Credits
93
Device
Others
Online time
23 Hours
Send PM
17:02, Nov-07-2015 | From PC
|
This post was edited by yorkiebar at 17:20, Nov-07-2015
AWiles replied at 2015-11-7 07:13
Perfect, thank you yorkiebar!
Tip for anyone else; I had to do it on my Linux box so that I could  ...

Excellent!

I'd forgotten about the need for  equip_test.sh to be executable !

Now you've got telnet access then life becomes easier :)

FTP access
=========
  1. tcpsvd -vE 0.0.0.0 21 ftpd -w / &
Copy the Code
UK Timezone
==========

Unzip and then copy the attached file to /etc/localtime
Edit /etc/TZ so it contains just the following
  1. GMT0BST,M3.5.0/1,M10.5.0/2
Copy the Code
You need to run   ntpd as follows
  1. ntpd -q -p 0.uk.pool.ntp.org    #    (may need to specify a path for ntpd)
Copy the Code
I run it at startup in a /etc/init.d script (sleep30s or so for the network to come up first)  and then every 10 mins via cron

Cron
===

Create the following directory on the camera
  1. /var/spool/cron/crontabs
Copy the Code
Add crond startup to the camera init.sh script in /home     (put it near to the end where the script starts up record_event, /mp4record etc. )

  1. crond &
Copy the Code
You could initially start it from the command line to negate the need to reboot











localtime.zip

1.82 KB, Downloads: 134, Download cost : Experience -1

UK /etc/localtime file (unzip first)

Senior Member

Rank: 2

Credits
93
Device
Others
Online time
23 Hours
Send PM
00:23, Nov-07-2015 | From PC
|
Same errors for me on the new variant h/w with K firmware when rtspsrv is running and a connection request is made.

Senior Member

Rank: 2

Credits
84
Device
0
Online time
5 Hours
Send PM
 Author| 00:42, Jul-26-2015 | From PC
|
Actually that's typical - just got a notification that firmware J is now available so I'll test this out with the latest version and report back.

Senior Member

Rank: 2

Credits
84
Device
0
Online time
5 Hours
Send PM
 Author| 00:54, Jul-26-2015 | From PC
|
OK it's not working on J currently - just working it backwards now to see if it's still possible.

Senior Member

Rank: 2

Credits
84
Device
0
Online time
5 Hours
Send PM
 Author| 01:26, Jul-26-2015 | From PC
|
Got telnet working on J but looks like there is a new watchdog process that kills off rtspsrv!

I'm off to the pub so will play around again tomorrow when I sober up :)

Senior Member

Rank: 2

Credits
84
Device
0
Online time
5 Hours
Send PM
 Author| 02:11, Jul-26-2015 | From PC
|
Looks like the RTSP server doesn't work on the latest firmware as it's bombing out with a memory allocation error so I'll go back to the patched I firmware for now as it suits my needs currently (other than being unable to turn IR off).

Senior Member

Rank: 2

Credits
52
Device
0
Online time
53 Hours
Send PM

Mi Band

09:44, Jul-26-2015 | From PC
|
This post was edited by notfourgo at 12:51, Jul-26-2015

Can you upload firmware 1.8.5.1I ?
Within fw 1.8.5.1I, can you access web SD card ?

Thx.

Senior Member

Rank: 2

Credits
84
Device
0
Online time
5 Hours
Send PM
 Author| 15:35, Jul-26-2015 | From PC
|
1.8.5.1I is here:
https://mega.co.nz/#!NZByRBQA!3t_AVtQr7eKg7nQq7eUBOng-IpYusAywilABUmDQUg8

I've not looked at the web server side - was that accessible in older versions?

Rated by 1 person   Experience Reason  

notfourgo + 1 Great!

Experience +1  View Rating Log

Senior Member

Rank: 2

Credits
52
Device
0
Online time
53 Hours
Send PM

Mi Band

16:54, Jul-26-2015 | From PC
|
@reverend-dct

in file init.sh, I see comment # on line: #mount -t vfat /dev/hd1 /home/web/sd. I think, uncomment # will active web SD.

Senior Member

Rank: 2

Credits
84
Device
0
Online time
5 Hours
Send PM
 Author| 17:11, Jul-26-2015 | From PC
|
I have already tried that and it mounts but doesn't seem to be accessible via the web browser via /web/sd etc - is there a specific URL that worked for that before?

Senior Member

Rank: 2

Credits
52
Device
0
Online time
53 Hours
Send PM

Mi Band

21:34, Jul-26-2015 | From PC
|
Can you try to copy file server on file server.zip to /home/web

and chmod +x /home/web/server


then restart camera, of course with mount sd like above.






server.zip

65.78 KB, Downloads: 157, Download cost : Experience -1

Credits Management

Quick Reply Top Return to the list