HwV380E31_WF6_PTZ_WIFI

[halinka1125]

Hello
I did some research about firmware that cannot be patched. My model is BLOW H-333 labeled on mainboard mvt3620w_xHR_E V10 HS-VERTO.
CPU: ANYKA AK3918EN080 V330L, WiFi AltoBeam 6012B, PHY JL1101. CMOS sensor mis2006 3Mpx.
model_id= MVT36306
[app_version]
name=AppV380E31_V1.1.8.0
date=20220818
[kernal_version]
name=KerV380E31_PTZ_WIFI_V3.1.1
date=20201218
[hardware_version]
name=HwV380E31_WF6_PTZ_WIFI
date=20201218
[base_version]
name=AppV380E31_V1.1.7.2
date=20220730

recorder app gave me some clues about not working patch, and also settings in ceshi.ini

^@rtsp^@^@^@^@rtsp_enable^@[ceshi.ini]This is 330 device dma size 0x%x, ignore rtsp setting
^@^@^@resolution^@^@[ceshi.ini]dma size is 0x%x,not support resolution
^@force_res_level^@[ceshi.ini]dma size is 0x%x,limit 200W res
^@vframe_encode_type^@^@standard_mode^@^@^@pcba_check_enable^@^@^@[PTZ_VER]^@^@

The device type is set using the ipc_type switch. But this cannot be changed using the ceshi.ini file. So I made a flash dump with the programmer, changed the entries ipc_type=1 to ipc_type=0 (two times occured) in the file and reprogrammed it.
ipc_type=0 - HW 331 it has RTSP capabilites, ipc_type=1 HW 330 has no RTSP capabilites.
After this procedure, setup.sh works correctly, but the camera was unstable (no web page and rebooting after few minutes of work)... So after some digging I've found that it is low memory issue. So I changed the way of patching, I've enabled only already integrated services.
I also noticed that when starting a camera that does not execute the setup.sh script and having the quick_check.ini file on SD, a dump with system variables is generated, where it is easy to check the hardware we are dealing with.

So to patch this type of camera we need edit /mnt/mtd/mvconf/record.ini and change [IPC_TYPE] section entry ipc_type=1 to ipc_type=0 (any way, dump? - this file is a bit protected, I can't find it in own location after camera launch, but dd dump reveal it is on partition).
Edit the /mnt/mtd/mvconf/factory_const.ini file with vi command and add the line rtsp_enable=1 at the end of the [CONST_PARAM] section
edit the file /mnt/mtd/nvipcstart.sh with vi command

after the /mvs/apps/log_upload & section, add lines of code

     echo "starting telnetd from /mnt/mtd/nvipcstart.sh ..."
     /usr/sbin/telnetd &

enter the sync command
turn off the camera and remove the card
Additionally, we can remove unnecessary camera modules from memory by editing the /mnt/mtd/vg_boot.sh file
adding # in front of unused modules (the lsmod command will display the modules and for unused camera modules it will be 0 and for used camera modules it will be 1).
This will add approximately 400kB of free memory.
After that tunning camera is stable with telnet RTSP and onvif...

So mystery of not patching some type of cameras is entry ipc_type in record.ini...
Thank you for your work, without it I wouldn't be able to patch this device.
Some files from dump...
record.ini.txt
vg_boot.sh.txt
nvipcstart.sh.txt

[Arkady23]

I don't understand why you had the wrong ipc_type. I have never had to delve so deeply. Maybe you have some kind of new camera. I didn't understand how you did the installation and what did you do? Only telnet? On the contrary, I disable telnet and use http-web instead. Next, I turn on ftp. And if I want to fix something somewhere, then I fix it via ftp, but only something that definitely won't ruin the camera. I don't have the [IPC_TYPE] section in the /mnt/mtd/mvconf/record.ini file, but there is a separate file isp_settings.ini. But I'm not sure if it's being used.

[halinka1125]

Yes this is quite new camera. If ipc_type=1 is set (on my camera), then is no way to activate telnet, onvif,rstp, or ftp.
In isp_settings.ini is only
[PARAM]
flipNmirror=1

[INTERFACE]
sensor_interface=mipi

I saw many peoples that say yours script is not working on this type camera. So this was challange, to try fix it.
To change ipc_type=1 to ipc_type=0 I has dump SW by programmer and rewrite binary to flash. After that Your setup.sh activated telnet, ftp, and http. But probably memory was to low and http show only icon (refresh), ftp was unstable and if I used it crashing camera. Only telnet was reliable . So after logging to camera by telnet I changed factory_const.ini and add rstp_enable=1. After reboot withot SD card telnet was gone so second my patch was enable telnet (my camera is in internal separated network). Then Onvif/rstp started working but from time to time I saw low memory warning (on onvifier android app). I was see firmware is loading many modules that not using so I disabled they.
From this time camera is working without issues with producer app, onvifier and telnet. That all story.
There was no risk for me - I has full dump of firmware.

PS> The software somehow protects this file, normally it is invisible in /mnt/mtd/mvconf/record.ini. Only the symlink to it /mnt/mtd/recorde.ini is visible, but it cannot be previewed. It is physically visible only in the dd dump if=/dev/mtd..9 of=/tmp/mtd..9.bin.

[halinka1125]

Dump of apps and configs - Warning it was "redacted" ;)
Kam.zip

[Arkady23]

I'm glad that everything worked out for you. I meant that telnet is needed to start the changes. I have developed an setup script for telnet. And then it's not really needed anymore, but you can turn it on via the web. If you would develop an setup script for your camera, it would be great.