Announcement

Collapse
No announcement yet.

A10 (Infotm Q3S + OV4689) camera hacking.

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • A10 (Infotm Q3S + OV4689) camera hacking.

    Click image for larger version

Name:	fetch?id=6627&d=1505411543.jpg
Views:	81
Size:	48.0 KB
ID:	6713

    I've bought this cam thinking it was based on Hisilicon Hi3556 chipset like it was stated in description on Aliexpress store.
    Someone tried to make a hype here (I believe Hisilicon SoC cams will be very popular soon) and I was fooled by this offer.

    Click image for larger version

Name:	infotm_q3s_sm.jpg
Views:	129
Size:	50.1 KB
ID:	6712

    That being said, I was surprised to find out that the 'fake' cam is based on new and undiscovered Q3S SoC by Infotm which is capable (claim) recording 1080p60 in H.265 LINK
    Donate here if you want to support my efforts and this site.

    Email me if you have any offers, requests or ideas.

  • #2
    This A10 camera comes in two versions with different mount types: for baseball cap and for glasses. The first one has a clip on the bottom side and the sensor is not rotated, the second version has four little hooks and two sets of rubbers. So I got the version for mounting on glasses and its sensor is rotated to 90-degree angle to match camera working position.
    Click image for larger version  Name:	mounts.jpg Views:	1 Size:	12.1 KB ID:	6715


    Inspite of the fact that this cam is really tiny and light it still feels very bulky when mounted on glasses so I decided to transform it into something more useful. I rotated the sensor like in 'cap' version in order to use it mounted on a flat action cam mounting plate as a temporal solution.

    There were even more dispiriting problems with this unlucky device - no IR filter (see this RAW footage sample), 47fps instead of 60fps, randomly dropped frames, overheating and Android app with no camera settings control...
    Last edited by nutsey; 09-23-2017, 03:14 PM.
    Donate here if you want to support my efforts and this site.

    Email me if you have any offers, requests or ideas.

    Comment


    • #3
      Here I must say some words about the bundle. It includes: A10 cam, a 1A USB charger with socket adapter, a microUSB cable and a cloth. That's it? Yep. Oh, I forgot about the manual - it was a folded piece of paper with inkjet printed guide in Chinese.

      Scanned manual


      Click image for larger version

Name:	buttons.jpg
Views:	55
Size:	7.5 KB
ID:	6719
      A10 camera has three control buttons:
      1. On/off (long press) - Rec start/stop (short press),
      2. Wi-fi on/off,
      3. Blue-red LEDs on/off (more on this later).
      Last edited by nutsey; 09-23-2017, 11:01 AM.
      Donate here if you want to support my efforts and this site.

      Email me if you have any offers, requests or ideas.

      Comment


      • #4
        Click image for larger version  Name:	manual-settings.jpg Views:	1 Size:	38.9 KB ID:	6720
        The "manual" says that some settings can be set with 'settings.txt' file put to the memory card. We can change only resolution, date stamping, loop recording and image rotation. I was expecting more settings to be available and started discovering the full settings list.

        The easiest way to hack something like this is to get firmware update file from the seller (or manufacturer), but this option was not available in this case.

        So I decided to dump the firmware from the flash memory to search already known text strings in it. Luckily this camera uses one of common SPI flash chips - Winbond 25Q128FV.
        Click image for larger version  Name:	spi_flash.jpg Views:	1 Size:	27.2 KB ID:	6721
        But unfortunately I couldn't manage to dump it with my CH341A programmer and I was not ready to use my soldering iron yet as I was thinking about returning this cam to the seller.

        I started to search other ways of hacking and I scanned open ports (cam IP is 10.42.0.100) with Nmap and didn't find anything useful exept that HTTP server is running on 5357 port and files can be accessed with 10.42.0.1 address.

        The next step was to check if there are kernel messages at UART serial port. You can also see the IR filter I glued to the lens.

        Click image for larger version  Name:	UART.jpg Views:	1 Size:	62.9 KB ID:	6722
        And it works!

        I found out that it checks two files for settings:
        Code:
        update_config_from_file /mnt/mmc/settings.txt
        dos2unix: can't open '/mnt/mmc/settings.txt': No such file or directory
        [GUI](properties.c#update_config_from_file): open user config file error:-3 errno: 2
        rm: can't remove '/mnt/mmc/settings.txt': No such file or directory
        update_config_from_file /mnt/mmc/mp.txt
        The first one is deleted after updating and 'mp.txt' is not and loads each time when the camera starts.

        Here is the partitions sctructure:
        Code:
        Creating 5 MTD partitions on "spi0.0":
        0x000000000000-0x000000380000 : "boot"
        0x000000380000-0x000000900000 : "root"
        0x000000900000-0x000000f00000 : "system"
        0x000000f00000-0x000000f80000 : "id"
        0x000000f80000-0x000001000000 : "config"
        Then I found another interesting error message during wi-fi init:
        Code:
        sh: can't open '/mnt/mmc/efuse_set_mac.sh'
        I like scripts and here is a good chance to write a new one
        Let's find out what we've got inside:
        Code:
        #! /bin/sh
        ls -l -R / > /mnt/mmc/filesystem.txt
        Now we can dump our partitions:
        Code:
        mkdir /mnt/mmc/backup
        dd if=/dev/mtdblock0 of=/mnt/mmc/backup/0-boot.img
        dd if=/dev/mtdblock1 of=/mnt/mmc/backup/1-root.img
        dd if=/dev/mtdblock2 of=/mnt/mmc/backup/2-system.img
        dd if=/dev/mtdblock3 of=/mnt/mmc/backup/3-id.img
        dd if=/dev/mtdblock4 of=/mnt/mmc/backup/4-config.img
        And unpack our system partition:
        Code:
        dd if=/mnt/mmc/backup/2-system.img bs=128K count=48 | lzop -d| tar xf - -C /mnt/mmc/backup/system
        Where we find this file /opt/spv_gui/config/spv_gui.config which contains all settings:
        Code:
        #current
        current.mode=Video #Video Photo Playback Setup
        current.reverseimage=Off #On Off
        
        #video
        video.resolution=VGA #1080FHD (720P 30FPS) WVGA VGA //(720P 60FPS)
        video.looprecording=3 Minutes #Off (1 Minute) (3 Minutes) (5 Minutes) //(10 Minutes)
        video.rearcamera=On #On Off
        video.pip=On #On Off
        video.frontbig=On #On Off
        video.wdr=Off #On Off
        video.ev=0 #+2.0 +1.5 +1.0 +0.5 0 -0.5 -1.0 -1.5 -2.0
        video.recordaudio=On #On Off
        video.datestamp=On #On Off
        video.gsensor=Low #Off Low Medium High
        video.adas=Off #Off On
        video.platestamp=Off #On Off
        
        #photo
        photo.capturemode=Single #Single (2S Timer) (5S Timer) (10S Timer)
        photo.resolution=2MHD #2MHD VGA 1.3M //12M 10M 8M 5M 3M
        photo.sequence=Off #On Off
        photo.quality=Fine #Fine Normal Economy
        photo.sharpness=Normal #Strong Normal Soft
        photo.whitebalance=Auto #Auto Daylight Cloudy Tungsten Fluorescent
        photo.color=Color #Color Black&White Sepia
        photo.isolimit=Auto #Auto 800 400 200 100
        photo.ev=0 #+2.0 +1.5 +1.0 +0.5 0 -0.5 -1.0 -1.5 -2.0
        photo.antishaking=Off #On Off
        photo.datestamp=Off #On Off
        
        #playback
        
        #setup
        setup.wifi=On #On Off
        setup.wifi.ap.ssid=default
        setup.wifi.ap.password=default
        setup.wifi.ap.keymgmt=WPA-PSK
        setup.wifi.sta.ssid=default
        setup.wifi.sta.password=default
        setup.wifi.sta.keymgmt=default
        setup.video.loop=On #On Off
        setup.gps=On #On Off
        setup.time.syncgps=On #On Off
        setup.autopoweroff=Off #Off (3 Minutes) (5 Minutes) (10 Minutes)
        setup.beepsound=70% #10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
        setup.keytone=On #On Off
        setup.language=ZH #EN ZH TW FR ES IT PT DE RU -------- English 简体中文 繁體中文 Français Español Italiano Português Deutsch Русский
        setup.delayedshutdown=10 Seconds #(10 Seconds) (20 Seconds) (30 Seconds) Off
        setup.display.sleep=Off #(3 Minute) (5 Minutes) (10 Minutes) Never
        setup.display.brightness=High #High Medium Low
        setup.tvmode=PAL #NTSC PAL
        setup.parkingguard=Off #On Off
        setup.frequency=50Hz #50Hz 60Hz
        setup.irled=Off #Auto On Off
        setup.imagerotation=Off #On Off
        setup.platenumber=京A00001 #Auto On Off
        In my opinion the best settings for 1080FHD video mode should include:
        video.ev=-0.5
        video.wdr=On
        It improves highlights and overall image quality.

        For some reason there are no settings for framerate and H.265 encoding can't be enabled as well, but now it is much better in terms of the options available for adjusting.

        My todo short list for more hacks:
        - get rid of useless auto 'night mode' where IR-leds are on and the picture colors are shifted,
        - discover how to change h.264 to h.265,
        - discover how to fix 1080p60 and/or how to change it to 1080p30,
        - discover how to take photos...
        Last edited by nutsey; 09-23-2017, 07:58 PM.
        Donate here if you want to support my efforts and this site.

        Email me if you have any offers, requests or ideas.

        Comment

        Working...
        X