Cannot get Bullet 4S to work with hack

[LucaNeel]

I've tried several of your guides and issue explanations to get me through it.
This is my camera information:

{
"devname": "Smart Home Camera",
"model": "Bullet 4S",
"softwareversion": "2.10.5",
"hardwareversion": "B4S_V10_H1_2063",
"firmwareversion": "ppstrong-c51-tuya2_lcs-2.10.5.20210806",
"pid": "aaa",
}

I've tried Merkury720 and Merkury1080p with the 3 overwritten files, all lead to the same issue, I can't get the ip=30 to show up, meaning it won't boot from the sd card.

I think I need to this your link for my hardware (but not sure): guino/BazzDoorbell#2
If this is the correct guide to follow for my firmware, you referenced to: 'edit the provided 'env' so it has the below contents.
I'm new to Github, but I can't find those referenced/attach files.

If I have those files, do I ONLY place those 3 on the sd-card? Or do I copy the files from Merkury-720/mmc first?

Sorry if I don't understand correctly, but I would really like a bit of help.

[LucaNeel]

Also, I have a # infront of MDNUM, and this is my cmdline return:
mem=37M console=ttyAMA0,115200n8 mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=5 ppsWatchInitEnd

[LucaNeel]

Sorry, I am new to Github, I keep closing the incident on accident.

By executing steps from guino/BazzDoorbell#13 by finding the files, I was able to boot and find the ip=30 after my proc/cmdine.

One thing to note is I could not get the /tmp/hack page to show up, gave me an error 500, I've heard you say it doesnt really matter as long as the hack folder is there in different issues, so I ignored it.

I then executed guino/BazzDoorbell#2 from step 8, got the same directory, for some reason I did have a few extra files, like: dropbearmulti, mqtt_pub, hosts, upload.html.

I edited custom.sh to this (i thought I should enable onvif aswell, i think I only need RSTP though):
#!/bin/sh
if [ ! -e /tmp/customrun ]; then
echo custom > /tmp/customrun
cp /mnt/mmc01/passwd /etc/passwd
/mnt/mmc01/busybox telnetd
/mnt/mmc01/busybox httpd -c /mnt/mmc01/httpd.conf -h /mnt/mmc01 -p 8080
if [ -e /mnt/mmc01/ppsapp ]; then
PPSID=$(ps | grep -v grep | grep ppsapp | awk '{print $1}')
kill $PPSID
#/mnt/mmc01/set record_enable 0
#/mnt/mmc01/set enable_event_record 1
/mnt/mmc01/set onvif_enable 1
/mnt/mmc01/ppsapp &
fi
#/mnt/mmc01/offline.sh &
fi
if [ ! -e /tmp/cleanupdate +%Y%m%d ]; then
rm -rf /tmp/cleanup*
touch /tmp/cleanupdate +%Y%m%d
/mnt/mmc01/cgi-bin/cleanup.cgi > /tmp/cleanup.log
fi

For my httpd.conf file I did this (not sure if the format is correct):
/:admin:admin

Upload ppsapp from home/app/ to RomPatcher.js, looked for a patch in guino/ppsapp-rtsp#1 matching my MD5 hash: fa879a12c0194222afb9d3d0e80dafea
For some reason I got a patch for the 'Bell 8S' not the 'Bell 4S', anyways, since you said the MD5 hash has to match, I went with it.

Device is not bricked, startsup fine, two startup beeps aswell, I can access it again, my proc/cmdline is now:
mem=37M console=ttyAMA0,115200n8 mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=5 ppsWatchInitEnd - ip=${T///$'\x20'}:::::;T="sleep_5;mkdir-p_/mnt/mmc01;mount_-t_vfat_/dev/mmcblk0p1_/mnt/mmc01;/mnt/mmc01/initrun.sh&";eval mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,3136k(sys),4352k(app),320k(cfg) ppsAppParts=5 ppsWatchInitEnd

However, I cannot seem to connect to the camera via RTSP in VLC. Ive changd the VLC RTS -> TCP just to be sure. Ive tried these links:
rtsp://192.168.178.158:8554
rtsp://admin:[email protected]:8554
rtsp://admin:[email protected]:8554//Streaming/Channels/101 (as stated in patch file under my md5 hash)
rtsp://admin:[email protected]:8554//Streaming/Channels/102 (as stated in patch file under my md5 hash)
rtsp://admin:[email protected]:8554/Streaming/Channels/101
rtsp://admin:[email protected]:8554/Streaming/Channels/102

And all above with port 8555 (as mentioned in patch overview)

Port scans shows port 8080 (TCP) is open voor BusyBox https, that's about it. I dont know if RTSP is working or not.

EDIT:
'(i thought I should enable aswell' to '(i thought I should enable onvif aswell'
Tested all RTSP links with 8555

[guino]

@LucaNeel post a zip of your SD card contents (without the SDT folder) and I will take a look.

[LucaNeel]

sdcopy.zip
I attached the folder, I cant seem to find an SDT folder by the way.

[guino]

@LucaNeel Your files seem fine (including the patched ppsapp).
What I'd like you to do/check is:
1-Remove or Rename ppsFactoryTool.txt from the SD Card -- some versions don't start up completely while that file is in the SD card (we only need it to root the device -- you already did that).
2-Make sure the device is enrolled on the phone app (tuya, smardlife, lcs, etc) -- most devices will not boot up completely if they're not enrolled in the phone app (it initializes the device information/files/etc). After it's enrolled you don't need to use the phone app for anything if you don't need it.
3-Make sure the device has internet access -- most devices will not boot up completely if they can't read the date/time from tuya servers.
4-OPTIONAL you can remove the # from #/mnt/mmc01/set onvif_enable 1 in custom .sh if you want it to try and enable onvif for you.
4-OPTIONAL to use snap/mjpeg - You haven't set the address in mjpeg/snap.cgi files -- it should be: 56e6b0 for your device
5-OPTIONAL to use play.cgi - You haven't set the address in play.cgi -- it should be: 571f94 for your device

[LucaNeel]

Alright, when I am home tomorrow morning I will apply your comments. I didnt know you had to/could link them, anyways, I used the Smartlife app for the cameras initially, then I connect them to home assistant via Tuya IoT platform.

When I remove the ppsFactoryTool.txt file the lamp stays red and doesnt come up when I check the deviceinfo page. How do I know if it boots properly when I remove the file? 2 beeps with about 10 seconds in between?

And sorry, but what is the purpose of mjpeg enabled? Dont know if im going to use it, if I enable it just to have it enabled for whenever, will other thongs behave differently? Im all new to IOT and stuff, sorry.

And final question, how do I know a device is rooted? Even if I dont have the sd card in it? So I can check and know for myself when I try my other (newer) cameras. When the deviceinfo shows the ip=30 thing or?

[guino]

@LucaNeel The process you followed to get your ppsapp file is what we call rooting -- that is, gives you full access to the device to make changes, etc. Your device is rooted otherwise you'd not have your ppsapp file.

You don't have to use snap/mjpeg/play if you don't want to -- configuring the files just gives you the ability to use these features if you want to. snap.cgi-gives you a quick snapshot/image of the camera, mjpeg-same as snap but refreshes automatically, play.cgi allows you to play wav files (on sd card/device) thru the device's speaker.

The best thing to do is verify the device is working with the phone app (whichever app you chose) -- if it works on the app it should not be in 'factory mode' and should work with RTSP/ONVIF/etc.

[LucaNeel]

@guino thanks I understand the things I'm doing now, I managed to get it working and get the RTSP stream up correctly in VLC and eventually my Home Assistant dashboard. Thanks a lot for taking the time to help me, the quick responses and the initial figuring out all of this, good luck with your future projects

[guino]

@LucaNeel Thanks for reporting back!