Digoo DG-M1Q (Goke GK7102 + SmartSens SC1135) 960P IP camera hacking.

[nutsey]

I wasn't keen on surveillance devices before. But I've bought a couple of these super-cheap WiFi IP cams in order to find out something new about IPCs and CCTV in its entirety.

At the first glance I'm very impressed with the level of modern technologies we can expect in this price range (they were $8.88 apiece @ BG).

Todo list:

1. Get rid of low-light mode - I don't need it as I already have working external PIR-activated lighting
2. Improve LED indication (should be visible from ~6-8m distance)
3. Implement indoor shock-proof installation
4. Switch the device into AP mode as I don't need the cam to be accessible from the Internet via any cloud services
5. Even more useful stuff

M1Q PCB layout (check this PDF for more useful info):

[nutsey]

Hardware modifications.



I disabled IR-function by shortening light sensor pins, removed IR PCB and replaced the indicator LED with bigger (5mm) and brighter one.

Here is the wiring of IR LED PCB connector:

Note that white and blue wires are not connected as they powered IR LEDs.

Then I replaced the default lens and its IR-CUT holder with $10 4.35mm no-distortion lens and a standard 22mm M12 lens holder. They both fitted nicely as well as the new LED which is now much more visible from various angles and distances. I also plan mounting another similar LED of different color to the opposide hole for Wifi connection indication.


I also prepared my wireless device for camera connecting - TP-Link Extender TL-WA750RE flashed with OpenWRT firmware. I'm planning to use it in wireless repeater mode if the cam will be successfully switched to AP mode, otherwise it will be used as an AP for the camera itself.

[nutsey]

How to open .AV files.

Digoo M1Q saves video files in .AV format and in most cases you'll need to open it with a proprietary player or to convert it to .MP4.

There is a simple way how to play .AV files with very powerful and free VLC player.

1. Go to "Tools - Preferences", select "All" under "Show options", click "Demuxers", and select "H264 video demuxer":


2. Right-click on any .AV file (you can create your own with notepad if you don't have any from your M1Q yet), click "Change.." in "Opens with:" and select "VLC media player".


Now you can open, play and rewind your .AV files with this player. Unfortunately VLC does not show timeline for this type of files and plays any videos in 30 fps, but it's not a big problem.

By the way, VLC player can also play RTSP stream - select "Open Network Stream" and use this address:

rtsp://login:password@<your-camera-ip>:554/onvif1

Where "login" = "admin" and "password" = "20160404" by default.
"onvif1" can be changed to "onvif2" for lower quality stream.

[petesimon]

maybe some users would want to get more detailed information (and metadata) about the .AV file.

use ffmpeg and/or ffprobe to accomplish that.

ffmpeg -i file.av -hide_banner

ffprobe -i file.av -show_streams -show_format -hide_banner

.
ffmpeg - http://www.bugcodemaster.com/article...e-using-ffmpeg

ffprobe - http://www.bugcodemaster.com/article...on-video-files

and get binaries for Windows from - https://ffmpeg.zeranoe.com/builds/

[nutsey]

Firmware updates.

22.00.00.10

22.00.00.14

22.00.00.15

22.00.00.16

22.00.00.17

22.00.00.18

22.00.00.19

22.00.00.21

22.00.00.22

Please note that telnet access was closed for firmwares newer than 22.00.00.16.

[nutsey]

Almost ready to be installed...

[nutsey]

Custom settings.

If you want to change anything in files mentioned below don't forget to backup the original files first!

There is one already known way to modify the M1Q settings which can be found at some forums and blogs.
It involves editting video_sc1135.xml file located at /npc/config/

<?xml version="1.0" encoding="UTF-8"?>
<Video>
        <Vin>
            <vi_mode>71</vi_mode>
            <vi_framerate>15</vi_framerate>
            <vi_mirror>3</vi_mirror>
            <vi_bayer>3</vi_bayer>
        </Vin>
        <Vout>
            <vout_mode>1</vout_mode>
            <vout_dev>1</vout_dev>
        </Vout>
        <StreamSetting Num="4">
            <Stream0>
                <id>0</id>
                <type>1</type>
                <width>1280</width>
                <height>960</height>
                <fps>15</fps>
                <rotate>0</rotate>
                <keep_aspect>1</keep_aspect>
                <h264_id>0</h264_id>
                <h264_gop_mode>0</h264_gop_mode>
                <h264_gop_M>1</h264_gop_M>
                    <h264_gop_N>50</h264_gop_N>
                <h264_idr_interval>1</h264_idr_interval>
                <h264_profile>0</h264_profile>
                <h264_bcr>1</h264_bcr>
                <h264_cbr_avg_bps>2000000</h264_cbr_avg_bps>
                <h264_vbr_min_bps>1000000</h264_vbr_min_bps>
                <h264_vbr_max_bps>2000000</h264_vbr_max_bps>
                <h264_quality>3</h264_quality>
                <h264_puality_con>1</h264_puality_con>
                                <h264_qp_min_I>14</h264_qp_min_I>
                                <h264_qp_min_P>17</h264_qp_min_P>
                                <h264_qp_reduce_I>3</h264_qp_reduce_I>
                                <h264_qp_reduce_P>5</h264_qp_reduce_P>
                <mjpeg_id>0</mjpeg_id>
                <mjpeg_quality>50</mjpeg_quality>
                <mjpeg_chromaformat>1</mjpeg_chromaformat>
            </Stream0>
            <Stream1>
                <id>1</id>
                <type>1</type>
                <width>640</width>
                <height>480</height>
                <fps>15</fps>
                <rotate>0</rotate>
                <keep_aspect>1</keep_aspect>
                <h264_id>1</h264_id>
                <h264_gop_mode>0</h264_gop_mode>
                <h264_gop_M>1</h264_gop_M>
                <h264_gop_N>50</h264_gop_N>
                <h264_idr_interval>1</h264_idr_interval>
                <h264_profile>0</h264_profile>
                <h264_bcr>1</h264_bcr>
                <h264_cbr_avg_bps>1000000</h264_cbr_avg_bps>
                <h264_vbr_min_bps>512000</h264_vbr_min_bps>
                <h264_vbr_max_bps>1000000</h264_vbr_max_bps>
                <h264_quality>3</h264_quality>
                <h264_puality_con>1</h264_puality_con>
                                <h264_qp_min_I>17</h264_qp_min_I>
                                <h264_qp_min_P>21</h264_qp_min_P>
                                <h264_qp_reduce_I>3</h264_qp_reduce_I>
                                <h264_qp_reduce_P>5</h264_qp_reduce_P>
                <mjpeg_id>1</mjpeg_id>
                <mjpeg_quality>50</mjpeg_quality>
                <mjpeg_chromaformat>1</mjpeg_chromaformat>
            </Stream1>
            <Stream2>
                <id>2</id>
                <type>1</type>
                <width>320</width>
                <height>240</height>
                <fps>15</fps>
                <rotate>0</rotate>
                <keep_aspect>1</keep_aspect>
                <h264_id>2</h264_id>
                <h264_gop_mode>0</h264_gop_mode>
                <h264_gop_M>1</h264_gop_M>
                <h264_gop_N>50</h264_gop_N>
                <h264_idr_interval>1</h264_idr_interval>
                <h264_profile>0</h264_profile>
                <h264_bcr>1</h264_bcr>
                <h264_cbr_avg_bps>50000</h264_cbr_avg_bps>
                <h264_vbr_min_bps>10000</h264_vbr_min_bps>
                <h264_vbr_max_bps>100000</h264_vbr_max_bps>
                <h264_quality>3</h264_quality>
                <h264_puality_con>1</h264_puality_con>
                                <h264_qp_min_I>21</h264_qp_min_I>
                                <h264_qp_min_P>24</h264_qp_min_P>
                                <h264_qp_reduce_I>3</h264_qp_reduce_I>
                                <h264_qp_reduce_P>5</h264_qp_reduce_P>
                                <mjpeg_id>2</mjpeg_id>
                <mjpeg_quality>5</mjpeg_quality>
                <mjpeg_chromaformat>0</mjpeg_chromaformat>
            </Stream2>
            <Stream3>
                <id>3</id>
                <type>2</type>
                <width>640</width>
                <height>480</height>
                <fps>3</fps>
                <rotate>0</rotate>
                <keep_aspect>1</keep_aspect>
                <h264_id>3</h264_id>
                <h264_gop_mode>0</h264_gop_mode>
                <h264_gop_M>1</h264_gop_M>
                <h264_gop_N>30</h264_gop_N>
                <h264_idr_interval>1</h264_idr_interval>
                <h264_profile>0</h264_profile>
                <h264_bcr>0</h264_bcr>
                <h264_cbr_avg_bps>500000</h264_cbr_avg_bps>
                <h264_vbr_min_bps>500000</h264_vbr_min_bps>
                <h264_vbr_max_bps>1000000</h264_vbr_max_bps>
                <h264_quality>3</h264_quality>
                <h264_puality_con>3</h264_puality_con>
                                <h264_qp_min_I>24</h264_qp_min_I>
                                <h264_qp_min_P>27</h264_qp_min_P>
                                <h264_qp_reduce_I>3</h264_qp_reduce_I>
                                <h264_qp_reduce_P>5</h264_qp_reduce_P>
                                <mjpeg_id>3</mjpeg_id>
                <mjpeg_quality>50</mjpeg_quality>
                <mjpeg_chromaformat>1</mjpeg_chromaformat>
            </Stream3>
        </StreamSetting>
</Video>

As we can see here we have some limited possibilities to modify settings for HQ, SQ and LQ video streams, such as frame size and rate, bitrate and other advanced H.264 encoder parameters.

But there is another file that enables more custom configuration options.
It is /rom/custom_setting_gk.ini

Here is the list of available strings to place into it (with my short notes where I discovered something interesting):

version
Default_Language
dwSetTheDefaultLanguage
RemotlySetPassword
RemotlySetNetwork
HttpPostSupport
Module868Support
ShareMemberSupport
AlarmModuleDisable
CustomSetPasswd = 20160404 // Here you can change the default password
KeySetMonitorPer
DefenseNotifySupport
gpio_ctrl_support
ClearDefStopForceAlarm
SricamConfig
AlertorConfig
customer
fang_chai_support
fang_chai_low_enable
Emergency_Call_Support
product_type
Pir_support
Pir_Alarm_Gap = 5 // Alarm duration?
md_level = 3 // Motion detection level
ext_line_alarm = 1
lound_speaker_support
net_time_sync = 1  //T821D
low_voltage
huansuo_doorbell_off
venc_use_vbr // Sets VBR or CBR
At_Home_Alarm_Support
Sos_Defence_Support
AlarmCauseVisitorLightsMode
CscAttr_Config_Support
Remote_Reboot_Support
Save_Log_Support
IR_Led_Ctrl_Support
Set_MD_Level_Support
Door_Bell_Support
Ap_Mode_Support // Adds a new option in mobile app, but does not seem to work
Reset_Ap_Mode_Start
Change_Wifi_Mode_Key_Disable
ballswitch_disable
ShuangJinGeGpio1_6
Force720P // doesn't work with M1Q
user_sel_clearOpt // 1 2 3 4
8MFlashDevice // 8 or 16Mb SPI flash chip
SensorType = 7 // 6 or 9 = sc2135, 5 or 7 = sc1135, 3 = h42
th_sensor_support
uart1_baudrate // not used??
motorsteps
NotSupportTcpHelper
misc_config0 = 1073742002 // <- v21 , v16 -> 3221225516
misc_config1
unit_motor_step
cmos_dir_reverse_support = 1
misc_config2
use_array_led
unsupport_motor
top_motor_dir_inverse
bottom_motor_dir_inverse
unsupport_433module
unsupport_ballswitch
use_bicolor_led
unsupport_ethernet
sensor_dir_inverse
report_defence_info
use_ext_audio_out
ircut_dir_inverse
support_unlock
bicolor_useas_defence
dayornight_detect_inverse
support_motor_preset
reset_pir_enble
reset_md_en
reset_alarm_time
reset_video_ntsc_mode
reset_defence_enble
reset_rec_type
reset_thalarm_enble
reset_timezone_set
reset_prerecord_disable
reset_alarm_rec_time
mic_disable // Controls mic ?
speakout_disable // Controls speaker ?
rec_led_disable // Controls front led ?
fm1188_old_config
fm1188_mic_reduce
support_bluetooth
support_alarm_led_flash10s
support_motor_run_to_assignpos
unsupport_night_view_mode // Controls low light detection ?
support_audio_amplifier_ctl
ir_led_gpio
net_led_gpio
alarm_led_gpio = 1016
defence_led_gpio = 1018
rec_led_gpio
pir_detect_gpio
exaudio_output_detect_gpio
doorbell_detect_gpio
uart1_to_gpio
AlarmSendToSerOpt
AlarmPicCaps = 1
AlarmVersion
AlarmReport
LumaVal = 50 // Brightness
ContrVal = 50 // Contrast
SatuVal = 50 // Saturation
LocalMaxEnc
UpdateParamValToSer
PreRecordSupport = 1
DevLinkAlarmCenter
IrcutCon
IrcutCon1
DefenceSettingSwitch
STOP_QR_WHEN_IR
IRCutSetPer // seems to set constant day or night mode
PressButtonToQRDecode
433_Open_Lock
supportMonitorLog
support_unify_motor
h_motor_steps
v_motor_steps
IRLedSetForDefState // Controls IR leds ?
IrLedSetTimer = 50 // IR led timer ?
8188_Support_Voicelink_In_Ap
motor_last_positon
RecFailAlarmPush
Mic_Mute_Level // any value sets to 1, no value = 0
FixedIpFromDhcp
SupportMotorPreset
Fm1188_Max_Vol
UartAlarmCenterLink
Super_Password = 2 // ??? also needs /rom/whitelist.txt file
AlarmInfoStoreInAT24C16
KelixinAlarmCodeSupport
LedHVolOn
TransNOVerify
dwMaxLinkCon
UserSetDefenseDelay
pushServerSupport
CustLedLVolOn
TestWireless
LampRecSupport
LampContrlRecLed // not enabled?
SoundPromptOpt = 1
AvTransUseOtherLed
PelcodPtzSupport
mic_gain // not enabled?
DevLedFunctionId
UserSetDevLedGpio0
UserSetDevLedGpio1
UserSetDevLedGpio2
UserSetDevLedGpio3
RollBallGpio
ForceCmosWorkNormal
AVTransNetLedDisable
adc_setting_val = 26214700
ircut_with_adc_support = 1
RtspAuthentication = 1
GmAudioReduce
KeyAoVolLeve
RtspVFrameRate
QRFunDisable
NotSupportDevRepeater
IRLedTurnOffSupport = 1

[nutsey]

Hardware revisions

T821-A0 and T821-B0 PCBs:


Hi-res


Hi-res

PCB design was slightly modified for revision B. As well as now SoC has a heatsink, speaker is not soldered, but has own connector and the sensor was rotated to 180 degrees.

Pics are from mysku.ru site reviews: RevA RevB.

[tinnerdxp]

Hello Nutsey,

New member here, I've noticed you have done some interesting upgrades on this cheap camera. I have the same one and recently lost ability to connect to WiFi - tried contacting 3 different places for support but none of them (all Chinese) could offer any help beyond the "Use YouSee app"... Anyway - I've noticed you've managed to upgrade the firmware somehow - would you mind sharing the steps on how to get it done please?
Thank you.
Chris.

[nutsey]

AV files recorded by this cam are in fact raw h264/AVC data streams. They can be converted to much more usable MKV files with MKVToolNix software tool.

Download portable version. Run 'mkvtoolnix-gui.exe'. Click 'Add source files' and select AV files to convert. Click 'Start multiplexing'.

[nutsey]

I've found the easiest and convenient way how to prepare AV files for further use.

1. Download and install VLC media player.
2. Download my av2mp4.zip batch script (the link works only for registered forum users).
3. Unpack it and edit replacing <path1> and <path2> with paths to your AV files and VLC player.
4. Put the script to the folder you set instead of <path1>.
5. Run the script and wait until all AV files converted to MP4 format by the VLC. Please note that the framerate of saved MP4 is 30 fps.

This short guide is for Windows users, but VLC player is cross-platform software so similar scripts can be used on Linux or MacOS platforms for converting AV files to MP4 format.

[Jmaa009]

Firmware updates.

22.00.00.10

22.00.00.14

22.00.00.15

22.00.00.16

22.00.00.17

22.00.00.18

22.00.00.19

22.00.00.21

22.00.00.22

Please note that telnet access was closed for firmwares newer than 22.00.00.16.

Hello. I'm interested in accessing the SD card recordings. Could be done by telnet? And if yes, could you tell me how to do it? A greeting

[MelS]

Hello. I'm interested in accessing the SD card recordings. Could be done by telnet? And if yes, could you tell me how to do it? A greeting

You could use tftp to send files to a tftp server on your PC.

Alternatively, I've uploaded a trivial hack to provide access to the recordings using an httpd server:- https://github.com/mjsage/DG-M1Q/raw...s%20DG-M1Q.zip


Download the zip file and unpack it to the root of the sd card.

It includes an httpd daemon (actually busybox for arm renamed), since Busybox on the camera doesn't include the httpd or fttpd daemons, and a crude cgi script to lists the files.

telnet the camera and enter the following:

sh /mnt/disc1/httpd.sh

Will remount the sd card with execute permissions and launch the http server on port 80.

from telnet:

killall httpd

will stop the server when you are done. My camera regularly reboots anyway.


https://github.com/mjsage/

[MelS]

Has anyone found a way of increasing the bitrate on the Onvif rtsp stream, the config files seem to only relate to the p2p app and no affect on the really low bitrate of the rtsp stream?

[MelS]

You could use tftp to send files to a tftp server on your PC.

Alternatively, I've uploaded a trivial hack to provide access to the recordings using an httpd server


Download the zip file and unpack it to the root of the sd card.

It includes an httpd daemon (actually busybox for arm renamed), since Busybox on the camera doesn't include the httpd or fttpd daemons, and a crude cgi script to lists the files.

telnet the camera and enter the following:

sh /mnt/disc1/httpd.sh

Will remount the sd card with execute permissions and launch the http server on port 80.

from telnet:

killall httpd

will stop the server when you are done. My camera regularly reboots anyway.

For what it is worth, I've updated this to omit empty capture files, added http basic authentication and it attempts to set the time from a timeserver (edit httpd.sh to change server's IP address - currently 192.168.1.1) - I have my camera's internet access blocked to stop cloud access, which would normally stops it getting the time.

File is now called sdcard.zip and can be downloaded from here:- https://github.com/mjsage/DG-M1Q

I've also modified my own camera's boot.sh to run my script from the card at boot.