A10 (Infotm Q3S + OV4689) camera hacking.

[nutsey]

I've bought this cam thinking it was based on Hisilicon Hi3556 chipset like it was stated in description on Aliexpress store.
Someone tried to make a hype here (I believe Hisilicon SoC cams will be very popular soon) and I was fooled by this offer.



That being said, I was surprised to find out that the 'fake' cam is based on new and undiscovered Q3S SoC by Infotm which is capable (claim) recording 1080p60 in H.265 LINK

[nutsey]

This A10 camera comes in two versions with different mount types: for baseball cap and for glasses. The first one has a clip on the bottom side and the sensor is not rotated, the second version has four little hooks and two sets of rubbers. So I got the version for mounting on glasses and its sensor is rotated to 90-degree angle to match camera working position.



Inspite of the fact that this cam is really tiny and light it still feels very bulky when mounted on glasses so I decided to transform it into something more useful. I rotated the sensor like in 'cap' version in order to use it mounted on a flat action cam mounting plate as a temporal solution.

There were even more dispiriting problems with this unlucky device - no IR filter (see this RAW footage sample), 47fps instead of 60fps, randomly dropped frames, overheating and Android app with no camera settings control...

[nutsey]

Here I must say some words about the bundle. It includes: A10 cam, a 1A USB charger with socket adapter, a microUSB cable and a cloth. That's it? Yep. Oh, I forgot about the manual - it was a folded piece of paper with inkjet printed guide in Chinese.

Scanned manual



A10 camera has three control buttons:
1. On/off (long press) - Rec start/stop (short press),
2. Wi-fi on/off,
3. Blue-red LEDs on/off (more on this later).

[nutsey]

The "manual" says that some settings can be set with 'settings.txt' file put to the memory card. We can change only resolution, date stamping, loop recording and image rotation. I was expecting more settings to be available and started discovering the full settings list.

The easiest way to hack something like this is to get firmware update file from the seller (or manufacturer), but this option was not available in this case.

So I decided to dump the firmware from the flash memory to search already known text strings in it. Luckily this camera uses one of common SPI flash chips - Winbond 25Q128FV.

But unfortunately I couldn't manage to dump it with my CH341A programmer and I was not ready to use my soldering iron yet as I was thinking about returning this cam to the seller.

I started to search other ways of hacking and I scanned open ports (cam IP is 10.42.0.100) with Nmap and didn't find anything useful exept that HTTP server is running on 5357 port and files can be accessed with 10.42.0.1 address.

The next step was to check if there are kernel messages at UART serial port. You can also see the IR filter I glued to the lens.


And it works!

I found out that it checks two files for settings:

update_config_from_file /mnt/mmc/settings.txt
dos2unix: can't open '/mnt/mmc/settings.txt': No such file or directory
[GUI](properties.c#update_config_from_file): open user config file error:-3 errno: 2
rm: can't remove '/mnt/mmc/settings.txt': No such file or directory
update_config_from_file /mnt/mmc/mp.txt

The first one is deleted after updating and 'mp.txt' is not and loads each time when the camera starts.

Here is the partitions sctructure:

Creating 5 MTD partitions on "spi0.0":
0x000000000000-0x000000380000 : "boot"
0x000000380000-0x000000900000 : "root"
0x000000900000-0x000000f00000 : "system"
0x000000f00000-0x000000f80000 : "id"
0x000000f80000-0x000001000000 : "config"

Then I found another interesting error message during wi-fi init:

sh: can't open '/mnt/mmc/efuse_set_mac.sh'

I like scripts and here is a good chance to write a new one
Let's find out what we've got inside:

#! /bin/sh
ls -l -R / > /mnt/mmc/filesystem.txt

Now we can dump our partitions:

mkdir /mnt/mmc/backup
dd if=/dev/mtdblock0 of=/mnt/mmc/backup/0-boot.img
dd if=/dev/mtdblock1 of=/mnt/mmc/backup/1-root.img
dd if=/dev/mtdblock2 of=/mnt/mmc/backup/2-system.img
dd if=/dev/mtdblock3 of=/mnt/mmc/backup/3-id.img
dd if=/dev/mtdblock4 of=/mnt/mmc/backup/4-config.img

And unpack our system partition:

dd if=/mnt/mmc/backup/2-system.img bs=128K count=48 | lzop -d| tar xf - -C /mnt/mmc/backup/system

Where we find this file /opt/spv_gui/config/spv_gui.config which contains all settings:

#current
current.mode=Video #Video Photo Playback Setup
current.reverseimage=Off #On Off

#video
video.resolution=VGA #1080FHD (720P 30FPS) WVGA VGA //(720P 60FPS)
video.looprecording=3 Minutes #Off (1 Minute) (3 Minutes) (5 Minutes) //(10 Minutes)
video.rearcamera=On #On Off
video.pip=On #On Off
video.frontbig=On #On Off
video.wdr=Off #On Off
video.ev=0 #+2.0 +1.5 +1.0 +0.5 0 -0.5 -1.0 -1.5 -2.0
video.recordaudio=On #On Off
video.datestamp=On #On Off
video.gsensor=Low #Off Low Medium High
video.adas=Off #Off On
video.platestamp=Off #On Off

#photo
photo.capturemode=Single #Single (2S Timer) (5S Timer) (10S Timer)
photo.resolution=2MHD #2MHD VGA 1.3M //12M 10M 8M 5M 3M
photo.sequence=Off #On Off
photo.quality=Fine #Fine Normal Economy
photo.sharpness=Normal #Strong Normal Soft
photo.whitebalance=Auto #Auto Daylight Cloudy Tungsten Fluorescent
photo.color=Color #Color Black&White Sepia
photo.isolimit=Auto #Auto 800 400 200 100
photo.ev=0 #+2.0 +1.5 +1.0 +0.5 0 -0.5 -1.0 -1.5 -2.0
photo.antishaking=Off #On Off
photo.datestamp=Off #On Off

#playback

#setup
setup.wifi=On #On Off
setup.wifi.ap.ssid=default
setup.wifi.ap.password=default
setup.wifi.ap.keymgmt=WPA-PSK
setup.wifi.sta.ssid=default
setup.wifi.sta.password=default
setup.wifi.sta.keymgmt=default
setup.video.loop=On #On Off
setup.gps=On #On Off
setup.time.syncgps=On #On Off
setup.autopoweroff=Off #Off (3 Minutes) (5 Minutes) (10 Minutes)
setup.beepsound=70% #10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
setup.keytone=On #On Off
setup.language=ZH #EN ZH TW FR ES IT PT DE RU -------- English 简体中文 繁體中文 Français Español Italiano Português Deutsch Русский
setup.delayedshutdown=10 Seconds #(10 Seconds) (20 Seconds) (30 Seconds) Off
setup.display.sleep=Off #(3 Minute) (5 Minutes) (10 Minutes) Never
setup.display.brightness=High #High Medium Low
setup.tvmode=PAL #NTSC PAL
setup.parkingguard=Off #On Off
setup.frequency=50Hz #50Hz 60Hz
setup.irled=Off #Auto On Off
setup.imagerotation=Off #On Off
setup.platenumber=京A00001 #Auto On Off

In my opinion the best settings for 1080FHD video mode should include:
video.ev=-0.5
video.wdr=On
It improves highlights and overall image quality.

For some reason there are no settings for framerate and H.265 encoding can't be enabled as well, but now it is much better in terms of the options available for adjusting.

My todo short list for more hacks:
- get rid of useless auto 'night mode' where IR-leds are on and the picture colors are shifted,
- discover how to change h.264 to h.265,
- discover how to fix 1080p60 and/or how to change it to 1080p30,
- discover how to take photos...