Announcement

Collapse
No announcement yet.

Digoo DG-M1Q (Goke GK7102 + SmartSens SC1135) 960P IP camera hacking.

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Digoo DG-M1Q (Goke GK7102 + SmartSens SC1135) 960P IP camera hacking.

    I wasn't keen on surveillance devices before. But I've bought a couple of these super-cheap WiFi IP cams in order to find out something new about IPCs and CCTV in its entirety.

    At the first glance I'm very impressed with the level of modern technologies we can expect in this price range (they were $8.88 apiece @ BG).

    Todo list:
    1. Get rid of low-light mode - I don't need it as I already have working external PIR-activated lighting
    2. Improve LED indication (should be visible from ~6-8m distance)
    3. Implement indoor shock-proof installation
    4. Switch the device into AP mode as I don't need the cam to be accessible from the Internet via any cloud services
    5. Even more useful stuff

    M1Q PCB layout (check this PDF for more useful info):
    Click image for larger version  Name:	M1Q-PCB.png Views:	1 Size:	18.0 KB ID:	6875
    Last edited by nutsey; 10-07-2017, 09:01 AM.
    If you find this site useful and interesting please feel free to support it by clicking highlighted text links and the banner below.

  • #2
    Hardware modifications.

    Click image for larger version  Name:	 Views:	1 Size:	36.0 KB ID:	6826

    I disabled IR-function by shortening light sensor pins, removed IR PCB and replaced the indicator LED with bigger (5mm) and brighter one.

    Here is the wiring of IR LED PCB connector:
    Click image for larger version  Name:	wiring.png Views:	1 Size:	5.3 KB ID:	6827
    Note that white and blue wires are not connected as they powered IR LEDs.

    Then I replaced the default lens and its IR-CUT holder with $10 4.35mm no-distortion lens and a standard 22mm M12 lens holder. They both fitted nicely as well as the new LED which is now much more visible from various angles and distances. I also plan mounting another similar LED of different color to the opposide hole for Wifi connection indication.


    I also prepared my wireless device for camera connecting - TP-Link Extender TL-WA750RE flashed with OpenWRT firmware. I'm planning to use it in wireless repeater mode if the cam will be successfully switched to AP mode, otherwise it will be used as an AP for the camera itself.
    Attached Files
    Last edited by nutsey; 06-20-2018, 10:12 AM.
    If you find this site useful and interesting please feel free to support it by clicking highlighted text links and the banner below.

    Comment


    • #3
      How to open .AV files.

      Digoo M1Q saves video files in .AV format and in most cases you'll need to open it with a proprietary player or to convert it to .MP4.

      There is a simple way how to play .AV files with very powerful and free VLC player.

      1. Go to "Tools - Preferences", select "All" under "Show options", click "Demuxers", and select "H264 video demuxer":
      Click image for larger version  Name:	vlc-1.png Views:	1 Size:	12.6 KB ID:	6829

      2. Right-click on any .AV file (you can create your own with notepad if you don't have any from your M1Q yet), click "Change.." in "Opens with:" and select "VLC media player".
      Click image for larger version  Name:	vlc-2.png Views:	1 Size:	7.4 KB ID:	6830

      Now you can open, play and rewind your .AV files with this player. Unfortunately VLC does not show timeline for this type of files and plays any videos in 30 fps, but it's not a big problem.

      By the way, VLC player can also play RTSP stream - select "Open Network Stream" and use this address:
      Code:
      rtsp://login:password@<your-camera-ip>:554/onvif1
      Where "login" = "admin" and "password" = "20160404" by default.
      "onvif1" can be changed to "onvif2" for lower quality stream.
      Last edited by nutsey; 10-02-2017, 10:58 AM.
      If you find this site useful and interesting please feel free to support it by clicking highlighted text links and the banner below.

      Comment


    • #4
      Firmware updates.

      22.00.00.10

      22.00.00.14

      22.00.00.15

      22.00.00.16

      22.00.00.17

      22.00.00.18

      22.00.00.19

      22.00.00.21

      22.00.00.22

      Please note that telnet access was closed for firmwares newer than 22.00.00.16.
      Last edited by nutsey; 11-09-2017, 10:00 AM. Reason: +22.00.00.22
      If you find this site useful and interesting please feel free to support it by clicking highlighted text links and the banner below.

      Comment


      • #5
        Click image for larger version

Name:	
Views:	1
Size:	30.3 KB
ID:	6853
        Almost ready to be installed...
        If you find this site useful and interesting please feel free to support it by clicking highlighted text links and the banner below.

        Comment


        • #6
          Custom settings.

          If you want to change anything in files mentioned below don't forget to backup the original files first!

          There is one already known way to modify the M1Q settings which can be found at some forums and blogs.
          It involves editting video_sc1135.xml file located at /npc/config/

          Code:
          <?xml version="1.0" encoding="UTF-8"?>
          <Video>
                  <Vin>
                      <vi_mode>71</vi_mode>
                      <vi_framerate>15</vi_framerate>
                      <vi_mirror>3</vi_mirror>
                      <vi_bayer>3</vi_bayer>
                  </Vin>
                  <Vout>
                      <vout_mode>1</vout_mode>
                      <vout_dev>1</vout_dev>
                  </Vout>
                  <StreamSetting Num="4">
                      <Stream0>
                          <id>0</id>
                          <type>1</type>
                          <width>1280</width>
                          <height>960</height>
                          <fps>15</fps>
                          <rotate>0</rotate>
                          <keep_aspect>1</keep_aspect>
                          <h264_id>0</h264_id>
                          <h264_gop_mode>0</h264_gop_mode>
                          <h264_gop_M>1</h264_gop_M>
                              <h264_gop_N>50</h264_gop_N>
                          <h264_idr_interval>1</h264_idr_interval>
                          <h264_profile>0</h264_profile>
                          <h264_bcr>1</h264_bcr>
                          <h264_cbr_avg_bps>2000000</h264_cbr_avg_bps>
                          <h264_vbr_min_bps>1000000</h264_vbr_min_bps>
                          <h264_vbr_max_bps>2000000</h264_vbr_max_bps>
                          <h264_quality>3</h264_quality>
                          <h264_puality_con>1</h264_puality_con>
                                          <h264_qp_min_I>14</h264_qp_min_I>
                                          <h264_qp_min_P>17</h264_qp_min_P>
                                          <h264_qp_reduce_I>3</h264_qp_reduce_I>
                                          <h264_qp_reduce_P>5</h264_qp_reduce_P>
                          <mjpeg_id>0</mjpeg_id>
                          <mjpeg_quality>50</mjpeg_quality>
                          <mjpeg_chromaformat>1</mjpeg_chromaformat>
                      </Stream0>
                      <Stream1>
                          <id>1</id>
                          <type>1</type>
                          <width>640</width>
                          <height>480</height>
                          <fps>15</fps>
                          <rotate>0</rotate>
                          <keep_aspect>1</keep_aspect>
                          <h264_id>1</h264_id>
                          <h264_gop_mode>0</h264_gop_mode>
                          <h264_gop_M>1</h264_gop_M>
                          <h264_gop_N>50</h264_gop_N>
                          <h264_idr_interval>1</h264_idr_interval>
                          <h264_profile>0</h264_profile>
                          <h264_bcr>1</h264_bcr>
                          <h264_cbr_avg_bps>1000000</h264_cbr_avg_bps>
                          <h264_vbr_min_bps>512000</h264_vbr_min_bps>
                          <h264_vbr_max_bps>1000000</h264_vbr_max_bps>
                          <h264_quality>3</h264_quality>
                          <h264_puality_con>1</h264_puality_con>
                                          <h264_qp_min_I>17</h264_qp_min_I>
                                          <h264_qp_min_P>21</h264_qp_min_P>
                                          <h264_qp_reduce_I>3</h264_qp_reduce_I>
                                          <h264_qp_reduce_P>5</h264_qp_reduce_P>
                          <mjpeg_id>1</mjpeg_id>
                          <mjpeg_quality>50</mjpeg_quality>
                          <mjpeg_chromaformat>1</mjpeg_chromaformat>
                      </Stream1>
                      <Stream2>
                          <id>2</id>
                          <type>1</type>
                          <width>320</width>
                          <height>240</height>
                          <fps>15</fps>
                          <rotate>0</rotate>
                          <keep_aspect>1</keep_aspect>
                          <h264_id>2</h264_id>
                          <h264_gop_mode>0</h264_gop_mode>
                          <h264_gop_M>1</h264_gop_M>
                          <h264_gop_N>50</h264_gop_N>
                          <h264_idr_interval>1</h264_idr_interval>
                          <h264_profile>0</h264_profile>
                          <h264_bcr>1</h264_bcr>
                          <h264_cbr_avg_bps>50000</h264_cbr_avg_bps>
                          <h264_vbr_min_bps>10000</h264_vbr_min_bps>
                          <h264_vbr_max_bps>100000</h264_vbr_max_bps>
                          <h264_quality>3</h264_quality>
                          <h264_puality_con>1</h264_puality_con>
                                          <h264_qp_min_I>21</h264_qp_min_I>
                                          <h264_qp_min_P>24</h264_qp_min_P>
                                          <h264_qp_reduce_I>3</h264_qp_reduce_I>
                                          <h264_qp_reduce_P>5</h264_qp_reduce_P>
                                          <mjpeg_id>2</mjpeg_id>
                          <mjpeg_quality>5</mjpeg_quality>
                          <mjpeg_chromaformat>0</mjpeg_chromaformat>
                      </Stream2>
                      <Stream3>
                          <id>3</id>
                          <type>2</type>
                          <width>640</width>
                          <height>480</height>
                          <fps>3</fps>
                          <rotate>0</rotate>
                          <keep_aspect>1</keep_aspect>
                          <h264_id>3</h264_id>
                          <h264_gop_mode>0</h264_gop_mode>
                          <h264_gop_M>1</h264_gop_M>
                          <h264_gop_N>30</h264_gop_N>
                          <h264_idr_interval>1</h264_idr_interval>
                          <h264_profile>0</h264_profile>
                          <h264_bcr>0</h264_bcr>
                          <h264_cbr_avg_bps>500000</h264_cbr_avg_bps>
                          <h264_vbr_min_bps>500000</h264_vbr_min_bps>
                          <h264_vbr_max_bps>1000000</h264_vbr_max_bps>
                          <h264_quality>3</h264_quality>
                          <h264_puality_con>3</h264_puality_con>
                                          <h264_qp_min_I>24</h264_qp_min_I>
                                          <h264_qp_min_P>27</h264_qp_min_P>
                                          <h264_qp_reduce_I>3</h264_qp_reduce_I>
                                          <h264_qp_reduce_P>5</h264_qp_reduce_P>
                                          <mjpeg_id>3</mjpeg_id>
                          <mjpeg_quality>50</mjpeg_quality>
                          <mjpeg_chromaformat>1</mjpeg_chromaformat>
                      </Stream3>
                  </StreamSetting>
          </Video>
          As we can see here we have some limited possibilities to modify settings for HQ, SQ and LQ video streams, such as frame size and rate, bitrate and other advanced H.264 encoder parameters.

          But there is another file that enables more custom configuration options.
          It is /rom/custom_setting_gk.ini

          Here is the list of available strings to place into it (with my short notes where I discovered something interesting):

          Code:
          version
          Default_Language
          dwSetTheDefaultLanguage
          RemotlySetPassword
          RemotlySetNetwork
          HttpPostSupport
          Module868Support
          ShareMemberSupport
          AlarmModuleDisable
          CustomSetPasswd = 20160404 // Here you can change the default password
          KeySetMonitorPer
          DefenseNotifySupport
          gpio_ctrl_support
          ClearDefStopForceAlarm
          SricamConfig
          AlertorConfig
          customer
          fang_chai_support
          fang_chai_low_enable
          Emergency_Call_Support
          product_type
          Pir_support
          Pir_Alarm_Gap = 5 // Alarm duration?
          md_level = 3 // Motion detection level
          ext_line_alarm = 1
          lound_speaker_support
          net_time_sync = 1  //T821D
          low_voltage
          huansuo_doorbell_off
          venc_use_vbr // Sets VBR or CBR
          At_Home_Alarm_Support
          Sos_Defence_Support
          AlarmCauseVisitorLightsMode
          CscAttr_Config_Support
          Remote_Reboot_Support
          Save_Log_Support
          IR_Led_Ctrl_Support
          Set_MD_Level_Support
          Door_Bell_Support
          Ap_Mode_Support // Adds a new option in mobile app, but does not seem to work
          Reset_Ap_Mode_Start
          Change_Wifi_Mode_Key_Disable
          ballswitch_disable
          ShuangJinGeGpio1_6
          Force720P // doesn't work with M1Q
          user_sel_clearOpt // 1 2 3 4
          8MFlashDevice // 8 or 16Mb SPI flash chip
          SensorType = 7 // 6 or 9 = sc2135, 5 or 7 = sc1135, 3 = h42
          th_sensor_support
          uart1_baudrate // not used??
          motorsteps
          NotSupportTcpHelper
          misc_config0 = 1073742002 // <- v21 , v16 -> 3221225516
          misc_config1
          unit_motor_step
          cmos_dir_reverse_support = 1
          misc_config2
          use_array_led
          unsupport_motor
          top_motor_dir_inverse
          bottom_motor_dir_inverse
          unsupport_433module
          unsupport_ballswitch
          use_bicolor_led
          unsupport_ethernet
          sensor_dir_inverse
          report_defence_info
          use_ext_audio_out
          ircut_dir_inverse
          support_unlock
          bicolor_useas_defence
          dayornight_detect_inverse
          support_motor_preset
          reset_pir_enble
          reset_md_en
          reset_alarm_time
          reset_video_ntsc_mode
          reset_defence_enble
          reset_rec_type
          reset_thalarm_enble
          reset_timezone_set
          reset_prerecord_disable
          reset_alarm_rec_time
          mic_disable // Controls mic ?
          speakout_disable // Controls speaker ?
          rec_led_disable // Controls front led ?
          fm1188_old_config
          fm1188_mic_reduce
          support_bluetooth
          support_alarm_led_flash10s
          support_motor_run_to_assignpos
          unsupport_night_view_mode // Controls low light detection ?
          support_audio_amplifier_ctl
          ir_led_gpio
          net_led_gpio
          alarm_led_gpio = 1016
          defence_led_gpio = 1018
          rec_led_gpio
          pir_detect_gpio
          exaudio_output_detect_gpio
          doorbell_detect_gpio
          uart1_to_gpio
          AlarmSendToSerOpt
          AlarmPicCaps = 1
          AlarmVersion
          AlarmReport
          LumaVal = 50 // Brightness
          ContrVal = 50 // Contrast
          SatuVal = 50 // Saturation
          LocalMaxEnc
          UpdateParamValToSer
          PreRecordSupport = 1
          DevLinkAlarmCenter
          IrcutCon
          IrcutCon1
          DefenceSettingSwitch
          STOP_QR_WHEN_IR
          IRCutSetPer // seems to set constant day or night mode
          PressButtonToQRDecode
          433_Open_Lock
          supportMonitorLog
          support_unify_motor
          h_motor_steps
          v_motor_steps
          IRLedSetForDefState // Controls IR leds ?
          IrLedSetTimer = 50 // IR led timer ?
          8188_Support_Voicelink_In_Ap
          motor_last_positon
          RecFailAlarmPush
          Mic_Mute_Level // any value sets to 1, no value = 0
          FixedIpFromDhcp
          SupportMotorPreset
          Fm1188_Max_Vol
          UartAlarmCenterLink
          Super_Password = 2 // ??? also needs /rom/whitelist.txt file
          AlarmInfoStoreInAT24C16
          KelixinAlarmCodeSupport
          LedHVolOn
          TransNOVerify
          dwMaxLinkCon
          UserSetDefenseDelay
          pushServerSupport
          CustLedLVolOn
          TestWireless
          LampRecSupport
          LampContrlRecLed // not enabled?
          SoundPromptOpt = 1
          AvTransUseOtherLed
          PelcodPtzSupport
          mic_gain // not enabled?
          DevLedFunctionId
          UserSetDevLedGpio0
          UserSetDevLedGpio1
          UserSetDevLedGpio2
          UserSetDevLedGpio3
          RollBallGpio
          ForceCmosWorkNormal
          AVTransNetLedDisable
          adc_setting_val = 26214700
          ircut_with_adc_support = 1
          RtspAuthentication = 1
          GmAudioReduce
          KeyAoVolLeve
          RtspVFrameRate
          QRFunDisable
          NotSupportDevRepeater
          IRLedTurnOffSupport = 1
          Last edited by nutsey; 10-07-2017, 08:33 AM.
          If you find this site useful and interesting please feel free to support it by clicking highlighted text links and the banner below.

          Comment


          • #7
            Hardware revisions

            T821-A0 and T821-B0 PCBs:

            Click image for larger version  Name:	rev_a_vs_b_front.jpg Views:	1 Size:	34.7 KB ID:	7419
            Hi-res

            Click image for larger version  Name:	rev_a_vs_b_back.jpg Views:	1 Size:	53.7 KB ID:	7420
            Hi-res

            PCB design was slightly modified for revision B. As well as now SoC has a heatsink, speaker is not soldered, but has own connector and the sensor was rotated to 180 degrees.

            Pics are from mysku.ru site reviews: RevA RevB.
            Last edited by nutsey; 11-09-2017, 10:11 AM.
            If you find this site useful and interesting please feel free to support it by clicking highlighted text links and the banner below.

            Comment


            • #8
              Hello Nutsey,

              New member here, I've noticed you have done some interesting upgrades on this cheap camera. I have the same one and recently lost ability to connect to WiFi - tried contacting 3 different places for support but none of them (all Chinese) could offer any help beyond the "Use YouSee app"... Anyway - I've noticed you've managed to upgrade the firmware somehow - would you mind sharing the steps on how to get it done please?
              Thank you.
              Chris.

              Comment


              • #9
                AV files recorded by this cam are in fact raw h264/AVC data streams. They can be converted to much more usable MKV files with MKVToolNix software tool.

                Download portable version. Run 'mkvtoolnix-gui.exe'. Click 'Add source files' and select AV files to convert. Click 'Start multiplexing'.
                If you find this site useful and interesting please feel free to support it by clicking highlighted text links and the banner below.

                Comment


                • #10
                  I've found the easiest and convenient way how to prepare AV files for further use.

                  1. Download and install VLC media player.
                  2. Download my av2mp4.zip batch script (the link works only for registered forum users).
                  3. Unpack it and edit replacing <path1> and <path2> with paths to your AV files and VLC player.
                  4. Put the script to the folder you set instead of <path1>.
                  5. Run the script and wait until all AV files converted to MP4 format by the VLC. Please note that the framerate of saved MP4 is 30 fps.

                  This short guide is for Windows users, but VLC player is cross-platform software so similar scripts can be used on Linux or MacOS platforms for converting AV files to MP4 format.
                  If you find this site useful and interesting please feel free to support it by clicking highlighted text links and the banner below.

                  Comment


                  • #11
                    Originally posted by nutsey View Post
                    Firmware updates.

                    22.00.00.10

                    22.00.00.14

                    22.00.00.15

                    22.00.00.16

                    22.00.00.17

                    22.00.00.18

                    22.00.00.19

                    22.00.00.21

                    22.00.00.22

                    Please note that telnet access was closed for firmwares newer than 22.00.00.16.
                    Hello. I'm interested in accessing the SD card recordings. Could be done by telnet? And if yes, could you tell me how to do it? A greeting

                    Comment

                    Working...
                    X