Hi3520D FPV Dvr cam from china

[dswelch51964]

Ive been doing some reverse engineering on my cheap FPV DVR CAM

although the chip face has been ground off like most, I was able to easily get a SPI firmware dump to look at and save.

RT809F dump has some major function that arent usable on this board.

It uses the AIT CarDV sdk

for example:

AIT Multimedia Network Streaming Server
D:\AIT\8428\LTD126\AIT8428_CarDV_SDK_Ver1.0.0x50A_ 923_R1938_sonix_RearCam_remote\core\lib\net\common \net_daemon.c
D:\AIT\8428\LTD126\AIT8428_CarDV_SDK_Ver1.0.0x50A_ 923_R1938_sonix_RearCam_remote\core\src\dvr\net\li bupnp\upnp\inc\upnpdebug.h
AIT Multimedia Network Solution, UPnP/1.0 devices/1.6.19
WebServer by Alpha Imaging Technology Corp.
redsonic (really INTEL)
LivecastRTSP: frame=%p len=%d

SD:\DATA\wlanscan.txt
SM:\DCIM\X1.DB
SD:0:\www
SD:\AIT_EXIF.temp
SD:\SD_CarDV.bin
SD:\CALIBRAT.ENB
SD:\ADAS_Image.yuv
SD:\outputmimf.txt
SD:\ait.raw (sscanfl( szParam, "%d", &bySensorIndex )
SD:\\aflog.bin
SD:\\afFpsAcc.bin
SD:\\CaliAwbRefCamXY0.bin
SD:\\aitAfterCsRaw
SD:0:\\log_
SF:0:\
Shutter.wav

SD:\\aelog.txt
SD:\Video
SD:\Photo
SD:\LDWS_Calibration_Update.bin
SD:\LDWS_Calibration_Update.bak
SF:1:\FCWS_Calibration.bin
SD:\DATA\wlanscan.txt
SD:\ITCM_EXE_LINUX
SD:\zImage
SD1:\
SF:1:\
SF:2:\
SD:\Test\FACTORY.CAL

Network playback
uC/OS-II Idle

If anyone know how to attach UART or USB to this board please let me know.

P CAMERA (Fixed) AVM301-000E53E87CDA
MAC000E53E87CDA
192.168.11.8
192.168.11.255
168.95.1.1
139.175.55.244
192.168.11.8
255.255.255.0
00:0E:53:E8:7C1
wifi0
192.168.0.158
192.168.1.255
168.95.1.1
139.175.55.244
192.168.0.254
255.255.255.0
00:0E:53:E8:7C2
wifi2
172.92.1.1
172.92.1.1
168.95.1.1
139.175.55.244
172.92.1.1
255.255.255.0
00:0E:53:E8:7C3
wifi3
ENABLE
50000,60000
554, 80, 80
IP CAMERA (Fixed) AVM301-000E53E87CDA
http://www.avtech.com.tw/
00:0E:53:E8:7C:11
00:0E:53:E8:7C:22
00:0E:53:E8:7C:33
1234567890
AIT-Streaming-Demo-AP
00:0E:53:E8:7C:11
00:0E:53:E8:7C:22
00:0E:53:E8:7C:33

USB_DetectMode
Now is in USB_MSDC_AIT_DEBUG_MODE
mode:
keep original mode detect
start active mode detect
===USB Init OK
===USB D+D- OK
SYS_FLAG_USB_STOP_PREVIEW
<Fmt : Stop.MJPEG>
<Fmt : Stop.YUV>
<Fmt : Stop.H264>

aitupnp_init
15:13:24
Apr 05 2016
Welcome to AIT Multimedia Network Streaming Server, %s %s
aitstreamer_init
Sys.Log.AMN.Levels
VERBOSE
DEBUG
Sys.Log.UPNP.Levels
PACKET

client_port
client requested UDP port %d
rtsp_udp_setup
our port is %d, client port is %d
RTP/AVP;unicast;client_port=%d-%d;server_port=%d-%d

Dongles MAC address = %02X:%02X:%02X:%02X:%02X:%02X
WillTxBtest
00:90:4c:14:43:19
dhd_ifname2idx

PR85623WAR in place
Compare NVRAM dl & ul; varsize=%d

%s: download firmware %s
_dhdsdio_download_firmware

%s: bus module (through bcmsdh API) %s chaining
Function %d CIS:
%02x
dhdsdio_probe_attach

%s: venid 0x%04x devid 0x%04x
%s: unknown vendor: 0x%04x
%s: found 4325 Dongle
%s: found 4329 Dongle
%s: found 4315 Dongle
%s: found 4319 Dongle

wlm version: 10.02.1 (support 4330 and 43236)

Ad Hoc
multicast cipher:
WEP64
WEP128
AES-OCB
AES-CCMP
Unknown-%s(#%d)
Unknown-%02X:%02X:%02X(#%d)
unicast ciphers(%d):
NONE
WEP64
WEP128
TKIP
AES-OCB
AES-CCMP
WPA-Unknown-%s(#%d)
AKM Suites(%d):
None
WPA-PSK

Supported Rates:
802.11N Capable:
Chanspec: %sGHz channel %d %dMHz (0x%x)
Control channel: %d
802.11N Capabilities:
40Mhz
SGI20
SGI40
0x%x 5 GHz
0x%x 2.4 GHz
RSSI boost %ddb
Pref RSSI
AUDIO_Streaming_Task
reset UVC mode
Enable Endpoint interrupt
Reset MSDC start
MSDC reset end
UVC create USB sem failed
----USB HIGH_SPEED----
----USB FULL_SPEED----
WARNING: USB ERROR!
[USB] Error: class command Tx phase failed
ERR Ret
CLSFail
[USB]Error: unsupport class command
----USB RST----
----USB Suspend----
----USB Reume----
HIGHWork
3GPMERGR
AUDIORECORD
AUDIOPLAY
3GPPARSR
VIDDEC
VIDPLAY
DSCStream
JpegCtl
SENSOR
MP4VENC
USB_UVCH
UVCH_BulkIn
AUDIOSTREAMING
JOB_DISPATCH
AhcTask
[End of Video]
Video Pause Audio Fail!!! Please Check Audio Flow!!
MCI back
Change ISP/Scaler clock back
This PLL No. not support fractional setting
Error Parameter, must set HDMI TMDS clock first.
Error Parameter, Do not support this sample rate :
Warning, HDMI audio may error
Audio Predecode Fail
[End of Video in Step]

====== MP3 firmware ver.3.3 ======
====== release: 94/10/17 ======
Init MP3 decoder failed

Create UVC sem failed
Enable H264 mode 160x120
Enable H264 mode 960x720
Enable H264 mode 272x144
Enable H264 mode 368x208
Enable H264 mode 480x272
Enable H264 mode 624x352
Enable H264 mode 912x512
Enable H264 mode 1920x1080
Disable H264 mode
Enable H264 mode 1280x720
Enable H264 mode 640x480
Enable H264 mode 320x240
Enable H264 mode 848x480
160x120 SET
320x240 SET
640x360 SET
640x480 SET
1280x720 SET
1920x1080 SET
** gbEnableH264Mode =
** FormatIndex =
** FrameIndex =
DBG: Format index =
DBG: Frame index =
[YUY2 Order]
[Skype ModeB Order,H264]
[YUY2 Order]
** JPEG 1920x1080
** JPEG 1280x720
** JPEG 640x480
** YUY2 640x480
** YUY2 1920x1080
** YUY2 1280x720
** Still Format is JPEG
** Still Format is YUV422
** Still Resolution is 1920x1080
** Still Resolution is 640x480
** Still Resolution is 1280x720
start preview...

gbSkypeEncRes =
gbSkypeFrameRate =
gsSkypeBitRate =
gbSkypeEnforcrKey =
gbSkypeMinQP =
gbSkypeMaxQP =
gbCABAC =
gsSkypeFWDays =
gsSkypeProfile =
gbSkypeLevel =
gbSkypeMode =
isp cmd
** gbVideoEncQualityCustom =
** glCustomTargetSizePerFrame =
** USB Light Freq Set :
mmp cmd

audio/x-pn-realaudio
audio/x-pn-realaudio-encrypted
video/x-pn-realvideo
video/x-pn-realvideo-encrypted
application/x-pn-realevent
application/x-pn-realevent-encrypted
application/x-pn-imagemap
application/x-pn-imagemap-encrypted
image_map/x-pn-realvideo
image_map/x-pn-realvideo-encrypted
syncMM/x-pn-realvideo
syncMM/x-pn-realvideo-encrypted

D:\sourcecode0X50A\SourceCode\core\src\dvr\net\lib upnp\Camdms.c

MSDOS5.0
FAT16
FAT12
FAT32

====== AMR firmware ver.1.3 ======
====== release: 93/09/02 ======

2304x1296 30fps
2304x1296 25fps
2304x1296 24fps
1920x1080 60fps
1920x1080 30fps
1280x720 30fps
640x480 30fps
1280x720 60fps

TV System
Select TV system.
HDMI Output
1080P
1080i

Parking Monitora
Wifi CARCAM
General Settings
WIFI MODE

SF:0:\
SF:1:\
SF:2:\
SD:0:\
Camera.Record.
Camera.Capture.Remaining
Camera.Battery.Level
Camera.Preview.MJPEG.status.record
Camera.Preview.MJPEG.status.mode
Camera.Preview.MJPEG.TimeStamp.
Camera.Menu.VideoRes
Camera.Menu.ImageRes
Camera.Menu.UIMode
Camera.Menu.DefMode
Camera.Menu.MTD
Camera.Menu.AWB
Camera.Menu.Flicker
Camera.Menu.EV
Camera.Menu.PhotoBurst
Camera.Menu.Timelapse
Camera.Menu.UpsideDown
Camera.Menu.SpotMeter
Camera.Menu.LoopingVideo
Camera.Menu.VideoClipTime
Camera.Menu.HDR
Camera.Menu.Q-SHOT
Camera.Menu.StatusLights
Camera.Menu.SoundIndicator
Camera.Menu.PowerSaving
Camera.Menu.IsStreaming
Camera.Menu.FWversion
Camera.Menu.PowerOffDelay
Camera.Menu.TVSystem
Camera.Menu.TV
Camera.Menu.SD0
Camera.Preview.MJPEG.WarningMSG
Camera.File.Total
##WARN## %s:%d NULL malloc(%d)
D:\AIT\8428\LTD126\AIT8428_CarDV_SDK_Ver1.0.0x50A_ 923_R1938_sonix_RearCam_remote\core\lib\net\http\c gi_main.c

V4L:: VideoBuf dirty. vbuf:%p %d, PTR:%x %x CNT:%d %d, piggy:%d %d %x, magic:%x
VIDEO.0
AUDIO.0
VIDEO.1

sd_oobonly=1
sd_gpout=1
sd_gpval=0
edoffthd=-71
edonthd=-65
manfid=0x2d0
prodid=0x492
vendid=0x14e4
devid=0x4343
boardtype=0x0598
boardrev=0x1207
boardnum=777
xtalfreq=26000
boardflags=0xa00
sromrev=3
wl0id=0x431b
macaddr=00:22:f4:07:aa:cc
aa2g=1
ag0=2
maxp2ga0=74
cck2gpo=0x5555
ofdm2gpo=0xbbbbbbbb
mcs2gpo0=0xffff
mcs2gpo1=0xffff
pa0maxpwr=80
pa0b0=5447
pa0b1=-658
pa0b2=-175
pa0itssit=62
pa1itssit=62
cckPwrOffset=4
ccode=ALL
rssismf2g=0xa
rssismc2g=0x3
rssisav2g=0x7
triso2g=0
noise_cal_enable_2g=0
swctrlmap_2g=0x04040404,0x02020202,0x02020202,0x01 0101,0x1ff
temp_add=29767
temp_mult=425
temp_q=10
initxidx2g=45
tssitime=1
rfreg033=0x19
rfreg033_cck=0x1f
cckPwrIdxCorr=-8
spuravoid_enable2g=1

DEFSET TXT
StillSize=0
StillQuality=0
StillStabilize=0
StillFlash=2
StillFlashLevel=0
RedEyeReduce=0
SelfTimer=0
BurstShot=0
VideoSize=1
VideoQuality=0
VideoStabilize=0
SlowShutter=0
MicSensitivity=0
VideoPreRecord=1
VideoClipTime=4
VideoOffTime=1
RecordWithAudio=0
SCENE=0
Focus=0
FocusRange=0
METER=0
ISO=0
Color=0
Effect=0
FaceTouch=0
SmileDetect=0
SmileSensitivity=0
SlideShow=0
SlideShowFileType=0
SlideShowEffect=0
SlideShowMusic=0
PlaybackVolume=5
FileEdit=0
MediaSelect=0
DisplayInfo=0
Beep=0
LCDBrightness=0
AutoPowerOff=0
DateTime=0
DateTimeFormat=1
Language=5
TVSYS=0
TVType=0
HDMIOutput=0
Reset=0
BatteryVoltage=5
Flicker=0
USB=0
LCDRotate=1
LCDPowerSaving=0
LEDFash=1
GSensorSensitivity=0
TimeZone=26
TimeStamp=3
MotionSensitivity=0
MotionVideoTime=3
MotionShot=0
BootMode=0
TimeLapse=0
AutoRec=1
GPSStamp=0
SpeedStamp=0
GPSRecEn=0
IMGUpSideDown=0
WDR=0
StatusLight=0
BitRate=0
LoopRec=0
VideoTime=0
ResetTime=0
GSensorPowerOnSens=0
DriverID=---------
WiFi=0
TimeStampLogoTXT=CarDV-SDK
VideoTimelapseEn=0
LDWS_EN=1
FCWS_EN=1
SAG_EN=1
HDR=1
Contrast=0
Saturation=0
Sharpness=0
Gamma=0
SlowMotion=0
WNR=0
;;Version - 1-0-1290-923-0, AIT8428_CarDV_SDK
SlowMotion=0 ;
LDWS_EN=1
;0:On, 1:Off
FCWS_EN=1
;0:On, 1:Off
SAG_EN=1
;0:On, 1:Off
HDR_EN=1
;0:On, 1:Off
WNR_EN=0
;0:Off, 1:On