Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ppsapp patch requests #1

Open
guino opened this issue Jan 3, 2021 · 198 comments
Open

ppsapp patch requests #1

guino opened this issue Jan 3, 2021 · 198 comments

Comments

@guino
Copy link
Owner

guino commented Jan 3, 2021

IF your ppsapp is not listed HERE, feel free to post your ppsapp patch requests here along with the firmwareversion, hardwareversion information from http://admin:056565099@IP/devices/deviceinfo for your device along with the MODEL (ie merkury 720p or geeni 720p, etc).

I will look at it when I have a chance and post it in the list above (and will remove it from here).

@solidssss
Copy link

solidssss commented Jan 4, 2021

You're amazing man! I'm so happy you finally got it working, you genius :)
Here's my firmwareversion:"ppstrong-a2-tuya2_teco-2.7.4.20191111" hardwareversion: S4C_A1_V10_1245 , model : Nedis camera (WIFICI20CGY)

Could you please patch my ppsapp?

@guino
Copy link
Owner Author

guino commented Jan 4, 2021

@solidssss your ppsapp patch is posted here: guino/ppsapp-rtsp#1 (comment)

@solidssss
Copy link

solidssss commented Jan 5, 2021

@guino Hmm, it's not working properly. I can enter the adresses http://user:password@IP:8080/cgi-bin/snap.cgi and http://user:password@IP:8080/cgi-bin/mjpeg.cgi, but they do not display anything, it's just empty. I've tried to get the RTSP stream in VLC and other softwares, but it's not working either.
http://192.168.1.9/proc/self/root/mnt/mmc01/hack says done.

@guino
Copy link
Owner Author

guino commented Jan 5, 2021

@solidssss are you able to telnet into the device ?
I can double check the patch file -- I assume you used https://www.marcrobledo.com/RomPatcher.js/ to create the RTSP version of ppsapp and placed it in the root of SD card names as 'ppsapp' ?
Last, for mjpeg/snap.cgi these should work as long as busybox is working (even if you don't patch ppsapp) assuming you adjusted the addresses in the snap/mjpeg cgi files, did you do that ?

@solidssss
Copy link

solidssss commented Jan 5, 2021

Oh sorry, I didn't know about the rompatcher. I took my home\app\ppsapp & ppsapp-rtsp.ips and patched them, put them on the root of the SD card as 'ppsapp' without any file extension but I still cannot get RTSP to work. I'm still supposed to keep the old ppsapp in the home\app\ folder right?

I had missed the part about patching the adresses of mjpeg/snap.cgi. After I patched the adreses it works! But I really would want the RTSP to work too.
I can enter the camera with telnet.

@guino
Copy link
Owner Author

guino commented Jan 5, 2021

that's progress nonetheless. After you copied ppsapp (the one you got from rom patcher) to the root of the SD card (as ppsapp) -- did you reboot the device ? You should hear the startup sound 2 times when the device boots -- RTSP should work after the second startup sound at rtsp://IP:8554 - please confirm you heard the startup sound 2 times and confirm the rtsp URL. I checked the patch and everything looks good so I would expect the patch to work.

@solidssss
Copy link

solidssss commented Jan 5, 2021

Yes, I rebooted after I placed the patched ppsapp. I do hear two startup sounds, but I cannot get anything with VLC, Home Assistant or Perfect IP Camera app.
The url I use is: rtsp://192.168.1.9:8554.
I tried to start VLC with --rtsp-tcp rtsp://192.168.1.9:8554 too, but it did not work.
I have blocked internet access to the camera btw, if that has anything to do with it.

@guino
Copy link
Owner Author

guino commented Jan 5, 2021

Ok, you can't disable internet access to the device -- if you block it the device won't fully start (and won't start RTSP).

Please allow internet access to the device then try again. If that doesn't fix the issue we'll have to do some debugging, in which case: please do this:

  1. Modify your line 10 of custom.sh changing /mnt/mmc01/ppsapp & to /mnt/mmc01/ppsapp &> /mnt/mmc01/ppsapp.log &
  2. Reboot the device (verify it makes 2 startup sounds) and wait 2 minutes
  3. Try opening the RTSP stream with VLC
  4. Remove SD card, Copy the ppsapp.log from the SD card, ZIP and post it here so I can review it.

Without the log to review there's not much I can do.

@solidssss
Copy link

Oh my god, it's working now! Thank you so much for your hard work @guino
I gave the camera internet access and now it works flawlessly with RTSP. It took like 2 minutes extra for it to fully boot and show RTSP feed though, but that's ok.

@Dsm20001
Copy link

Dsm20001 commented Jan 5, 2021

softwareversion":"2.7.5","hardwareversion":"M7C_AK_V10_1245","firmwareversion":"ppstrong-a2-tuya2_geeni-2.7.5.20200520

--deleted--

If you would be so kind!

@guino
Copy link
Owner Author

guino commented Jan 5, 2021

@solidssss These devices are very slow so yeah it takes some time for it to boot up entirely and startup the application completely. I appreciate your feedback and donation!

@Dsm20001 I'll take a look soon and post a patch for it.

@guino
Copy link
Owner Author

guino commented Jan 5, 2021

@Dsm20001 should be done here: guino/ppsapp-rtsp#1 (comment)
Remember to use the https://www.marcrobledo.com/RomPatcher.js/ to patch your ppsapp into a rtsp enable version then copy it to the root of SD card as ppsapp and reboot.
If you want snap/mjpeg.cgi to work you also have to edit the files to set the address provided with the patch file.

@Mathurian
Copy link

Mathurian commented Jan 5, 2021

Hi guino! Thanks for all the work so far! I've searched the current patch list for both my firmware and ppsapp md5 and not seeing it there. Since I looked over what would be required to do the patch myself, and that's way outside my wheelhouse, here's the requested info for whenever you or someone else has the time:

"softwareversion":"2.7.5","hardwareversion":"M7C_AK_V10_1245","firmwareversion":"ppstrong-a2-tuya2_geeni-2.7.5.20200221"

--deleted--

Thanks!

@guino
Copy link
Owner Author

guino commented Jan 5, 2021

@Mathurian I'll patch it soon.

@guino
Copy link
Owner Author

guino commented Jan 5, 2021

@Mathurian this is done here: guino/ppsapp-rtsp#1 (comment)
Remember to use the https://www.marcrobledo.com/RomPatcher.js/ to patch your ppsapp into a rtsp enable version then copy it to the root of SD card as ppsapp and reboot.
If you want snap/mjpeg.cgi to work you also have to edit the files to set the address provided with the patch file.

@Mathurian
Copy link

Awesome! Thank you!

@Dsm20001
Copy link

Dsm20001 commented Jan 7, 2021

Thank you finally got it. I had to use a different Rom Patcher, but finally got it!!!! now if i can get my outdoor camera's the same way lol. Thank you so much!!!

@russinnes
Copy link

russinnes commented Jan 14, 2021

Here's another Merkury 720 ppsapp - same version/firmware as your initial posting on this camera, but a different MD5 hash.
Needs patching.

Smart Home Camera - Mini7C
software version 2.7.3
hardware verison: M7C_AK_V10_1245
firmware: ppstrong-a2-tuya2_geeni-2.7.3.20190720
MD5: 0dbd3d62584d4b57cdc0764efd1d3110
--deleted--

@guino
Copy link
Owner Author

guino commented Jan 14, 2021

@russinnes I will patch it soon.

@guino
Copy link
Owner Author

guino commented Jan 14, 2021

@russinnes I think you may have got a bad copy of ppsapp (the one you posted above). It is mostly the same file as guino/ppsapp-rtsp#1 (comment) but there's a 64Kb section in the file that is different and appears to be all 'garbage'. This could be an issue with the SD card or just a side-effect from powering off the camera too fast after applying the hack (to get the file).
Please do this:

  • Power off device + remove SD card
  • Insert SD card om computer, rename the "home" directory/folder to "home-old"
  • Properly Eject/unmount SD card from tray/explorer/icon/etc
  • Insert SD card on device while powered off
  • Power device on (normally)
  • Use http://admin:056565099@IP/devices/reboot to reboot the device after it's up and running
  • Power off device, copy ppsapp file again from /home/app/ and check the md5 -- I am taking a guess it will be the same as the one previously posted.

Please notice I am asking you to rename the home directory instead of deleting it so the new home directory is saved in a different area of the SD card (to rule out an issue with bad sectors).

Let me know the results.

@russinnes
Copy link

@russinnes I think you may have got a bad copy of ppsapp (the one you posted above). It is mostly the same file as guino/ppsapp-rtsp#1 (comment) but there's a 64Kb section in the file that is different and appears to be all 'garbage'. This could be an issue with the SD card or just a side-effect from powering off the camera too fast after applying the hack (to get the file).
Please do this:

  • Power off device + remove SD card
  • Insert SD card om computer, rename the "home" directory/folder to "home-old"
  • Properly Eject/unmount SD card from tray/explorer/icon/etc
  • Insert SD card on device while powered off
  • Power device on (normally)
  • Use http://admin:056565099@IP/devices/reboot to reboot the device after it's up and running
  • Power off device, copy ppsapp file again from /home/app/ and check the md5 -- I am taking a guess it will be the same as the one previously posted.

Please notice I am asking you to rename the home directory instead of deleting it so the new home directory is saved in a different area of the SD card (to rule out an issue with bad sectors).

Let me know the results.

Good catch - Was just about to open it to patch it manually.
New MD5: b796c6f02abe9e278fbe40bdd27e64cb. Let me run it against your earlier patch . Ill let you know.

@russinnes
Copy link

russinnes commented Jan 14, 2021

@russinnes I think you may have got a bad copy of ppsapp (the one you posted above). It is mostly the same file as guino/ppsapp-rtsp#1 (comment) but there's a 64Kb section in the file that is different and appears to be all 'garbage'. This could be an issue with the SD card or just a side-effect from powering off the camera too fast after applying the hack (to get the file).
Please do this:

  • Power off device + remove SD card
  • Insert SD card om computer, rename the "home" directory/folder to "home-old"
  • Properly Eject/unmount SD card from tray/explorer/icon/etc
  • Insert SD card on device while powered off
  • Power device on (normally)
  • Use http://admin:056565099@IP/devices/reboot to reboot the device after it's up and running
  • Power off device, copy ppsapp file again from /home/app/ and check the md5 -- I am taking a guess it will be the same as the one previously posted.

Please notice I am asking you to rename the home directory instead of deleting it so the new home directory is saved in a different area of the SD card (to rule out an issue with bad sectors).
Let me know the results.

Good catch - Was just about to open it to patch it manually.
New MD5: b796c6f02abe9e278fbe40bdd27e64cb. Let me run it against your earlier patch . Ill let you know.

No Go - Here's round 2 attached (unpatched)
--deleted--

@guino
Copy link
Owner Author

guino commented Jan 14, 2021

@russinnes This one has a different bad area, meaning: the part that was bad on the 1st one you posted is now ok, but there's a different section of the file that is bad. I am 100% sure now that the firmware is the same as the one I posted on guino/ppsapp-rtsp#1 (comment) -- You may want to repeat the process above but instead of using /devices/reboot to restart it, you can login by telnet and execute /mnt/mmc01/busybox sync then umount /mnt/mmc01 then remove the card and copy ppsapp and check the md5.

@russinnes
Copy link

3rd time finally got the same MD5 as your initial patch. Out of interest (and perhaps the issue), this camera is paired with the generic tuya app - there is no setting for record. Upon detection of SD, it is always recording, with no option to turn it off. It wouldnt unmount via any normal means as it was constantly being written to. I ended up killing the ./ppsapp PID via telnet to finally get it to stop writing. Hence the prior bad sectors/writes/etc. Try #4 coming up.

@russinnes
Copy link

3rd time finally got the same MD5 as your initial patch. Out of interest (and perhaps the issue), this camera is paired with the generic tuya app - there is no setting for record. Upon detection of SD, it is always recording, with no option to turn it off. It wouldnt unmount via any normal means as it was constantly being written to. I ended up killing the ./ppsapp PID via telnet to finally get it to stop writing. Hence the prior bad sectors/writes/etc. Try #4 coming up.

Like a charm - unbelievable. Good catch.

@guino
Copy link
Owner Author

guino commented Jan 14, 2021

@russinnes yes, it records 24/7 by default with no settings in the tuya app but you can modify it on the json file like I did in my write up so it only records motion (or disable it). You can also turn off the LED and/or disable/force night mode (I did it to try), but like you said no settings in the app for any of that.

@guino
Copy link
Owner Author

guino commented Jan 15, 2021

For anyone following the project I just uploaded some changes to snap.cgi/mjpeg.cgi along with a jpeg-arm file which should prevent the occasional image glitches that we had with the original version (which was very much a rig). The new version uses a custom written C application with a double buffer to verify the buffer/image wasn't changed by the device while reading it.

If you use snap.cgi/mjpeg.cgi and want to take advantage of the glitch free version you have to copy jpeg-arm to the SD card root and copy snap.cgi + mjpeg.cgi (to cgi-bin/) and make sure the address is set for your ppsapp.

@russinnes
Copy link

russinnes commented Jan 15, 2021

For anyone following the project I just uploaded some changes to snap.cgi/mjpeg.cgi along with a jpeg-arm file which should prevent the occasional image glitches that we had with the original version (which was very much a rig). The new version uses a custom written C application with a double buffer to verify the buffer/image wasn't changed by the device while reading it.

If you use snap.cgi/mjpeg.cgi and want to take advantage of the glitch free version you have to copy jpeg-arm to the SD card root and copy snap.cgi + mjpeg.cgi (to cgi-bin/) and make sure the address is set for your ppsapp.

Ran the native app, an RTSP stream, and an mjpeg stream all simultaneously and only capped at ~65% cpu. Much cleaner than using dd! I'm going to add some custom motion detection scriptability to what you have done, I've been digging around a little bit, just need to dig out a VM with the arm toolchain to test.

@guino
Copy link
Owner Author

guino commented Mar 7, 2022

@Stormtracker221 NO - it should NOT show as a text document - this likely means you have .txt in the filename and you need to enable ‘show extension’ in the settings to be able to remove the extension and make the filename just ‘ppsapp’.

Or just use a ‘good’ we browser that saves the file with the correct name and avoid dealing with the filename.

@Stormtracker221
Copy link

@guino Wow, that was easy!
And OMG it works. !!!
Thank you very much

@JerresonJ
Copy link

JerresonJ commented Mar 27, 2022

Removed

@pbethune98
Copy link

Hello Guino,

thank you for you work. I managed to make the hack work on my camera and enable Telnet.
I would like to enable RTSP. I tried to patch the ppsapp but i failed :(

Can you help me please ?

devname "Smart Home Camera"
model "Mini 7C"
serialno "059878433"
softwareversion "2.7.4"
hardwareversion "M7C_AK_V10_1245"
firmwareversion "ppstrong-a2-tuya2_teco2-2.7.4.20191108"

Thank you :)

@guino
Copy link
Owner Author

guino commented May 14, 2022

@pbethune98 I can patch it for you but I need you to post a zip with your ppsapp so I can do it.

@pbethune98
Copy link

Hi,
my bad ! Here it is.
Thank you very much.

ppsapp_pbethune98.zip

@guino
Copy link
Owner Author

guino commented May 16, 2022

@pbethune98 Please try this patch and let me know so I can post it in the main list (I expect it to work):

ppsapp-rtsp.zip Please follow this how to patch guide guino/ppsapp-rtsp#1 (comment)
snap/mjpeg.cgi address: 0x2c8000
play.cgi address: 0x02c8158

@pbethune98
Copy link

Hello @guino

I confirm you that it is working well :) Thank you very much !

@FluffyKittenMika
Copy link

Hi, do you have a patch for
{"model":"Mini 7C","softwareversion":"2.7.4","hardwareversion":"M7C_AK_V10_1245","firmwareversion":"ppstrong-a2-tuya2_teco2-2.7.4.20191108"}

ppsapp.7z

Would be a big help, I got like 8 of these cameras everywhere. :)
Tried searching known patches, but nothing matched 100% so rather safe than sorry

@guino
Copy link
Owner Author

guino commented May 27, 2022

@mikaelssen it is the one listed above: #1 (comment)

@illest23
Copy link

Hey I would appreciate some help with a patch for this Merkury 720p version:
Model: Mini 7C
Software version: 2.7.10
Hardware version: M7C_AK_V10_GC4
Firmware version: ppstrong-a2-tuya2_geeni-2.7.10.20220105

I was attempting to patch it myself but Ghidra does not show any functions in the decompiler so I've not been able to get very far with it. Thank you!

@guino
Copy link
Owner Author

guino commented Jun 26, 2022

@illest23 post a zip of the ppsapp file and I can take a look.

@illest23
Copy link

@guino ah sorry, here it is
ppsapp1.zip

@guino
Copy link
Owner Author

guino commented Jun 26, 2022

Try this patch ppsapp-rtsp.zip following this HOW TO PATCH GUIDE
snap/mjpeg.cgi address: 0x02c17b0
play.cgi address: 0x02c1fbc

I'd appreciate it if you let me know it works ok so I can post it in the main list of patches -- I don't expect any issues with it (should just work).

@illest23
Copy link

@guino So it seems the patch took and I am able to navigate to the snap and mjpeg links, however there are issues with them, and the RTSP stream is not working at all.

snap link
So for the snap link, the error reads "The image "snap url" cannot be displayed because it contains errors." I captured the packets in Wireshark to see what is going on and it shows an image called pic.jpg being transferred (length 57336), however saving this from the TCP stream just gives the same result, that the image is unviewable.

mjpeg link
The mjpeg link endlessly loads. Wireshark shows varying packets that are a length of either 1514 or 66 being sent back from the camera.

rtsp not streaming
Following the RTSP links, I cannot get them to load, just 404 errors. I ran nmap against the camera for both port 8554, and 554 just to see. Both show closed. The only open ports are 23, 80, and 8080 as expected. I've not tried to telnet into it.

Should this all go into a separate issue thread?

@guino
Copy link
Owner Author

guino commented Jun 26, 2022

@illest23 snap/mjpeg should work even without the patched ppsapp on the SD card, so just make sure the address is set in the snap/mjpeg cgi file and it should work even without patching ppsapp.

For RTSP the patched ppsapp should be in the root of the SD card and should be named exactly ppsapp and you need to restart the device after the file is in place.

feel free to post a zip of the patched ppsapp an/or the snap/mjpeg cgi file so I can review them — if everything is fine I can double check the patch and addresses.

@illest23
Copy link

@guino Alright so snap/mjpeg are fixed, had a typo in both somehow, haha. I double checked the ppsapp and even repatched and retried it, still no luck. I'll attach it here. Thank you so much for your help!
ppsapp.zip

@guino
Copy link
Owner Author

guino commented Jun 27, 2022

@illest23 your patched ppsapp looks fine, I'll double check the changes I made and let you know. Meanwhile the only thing I can recommend is that you double check the file is named ppsapp and it is in the root of the SD card (not on any directory like home/app). If you edited anything in initrun.sh or custom.sh you may also want to check that the editor you used didn't add any windows end-of-line characters which would break the scripts (I doubt that's the case since you say mjpeg/snap are working now).

Do you hear the startup sound 2 times when you power up the device ?

@illest23
Copy link

@guino yes it is placed in the root of the sd card and named only ppsapp with no extension. Yes it played two startup sounds. Those two .she files are fine as well.

@guino
Copy link
Owner Author

guino commented Jul 6, 2022

@illest23 sorry I've been traveling and have not had a chance to double check the patch for you but it is still in my list of things to do so I'll take a look at it when I have a chance (just providing an update).

@guino
Copy link
Owner Author

guino commented Jul 25, 2022

@illest23 sorry it took so long busy with travel/work/life. I had a chance to review the patch and would like you to try the following:
ppsapp-rtsp.zip
again, please use the guide here: guino/ppsapp-rtsp#1 (comment)

Place the patched ppsapp on the root of the SD card named as ppsapp (no .txt, etc on the name). You should likely hear 2 (TWO) startup sounds when the device boots up -- that would be indication that the patched ppsapp is running.

If for some reason it still doesn't work I'd like you to zip the contents of the SD card (without the SDT folder) and post it so I can review it.

@Randompersonthe
Copy link

@guino the 2.7.10 patch It is working for me able to get the rtsp working fine other then the stream being low fps and freezing is there a better way to view the live feed?

@guino
Copy link
Owner Author

guino commented Jul 27, 2022

@Randompersonthe thanks for the feedback. These devices are very low power and 2.4ghz wifi can be quite crowded and full of interference so that's likely the reason for low fps/lag/freezing (it is my experience at least). My devices always lag when they detect motion (and start a notification/recording), and other times I have slow stream (even from their phone app) when there's congestion on the 2.4ghz band from other routers, etc. Not much we can do other than try a different wifi channel.

@agentben96
Copy link

agentben96 commented Mar 11, 2023

Hey I would appreciate some help with a patch for this Merkury 720p version:
Model: Mini 7C
Software version: 2.7.12
Hardware version: M7C_AK_V10_1245
Firmware version: ppstrong-a2-tuya2_geeni-2.7.12.20220621
Original Hashes for ppsapp
CRC32: 63b89292
MD5: 745a93ff16b90d37522475845a1e4d27
SHA-1: 0673c5b3637cd0adb41597f16978e8382358eae7

Attached is the original rom.
--deleted--

@guino
Copy link
Owner Author

guino commented Mar 14, 2023

@agentben96 sorry I had not yet put it in the main list but there's a patch for that firmware already: guino/ppsapp-rtsp#44 (comment)

@sle118
Copy link

sle118 commented Apr 18, 2023

/@guino, wondering if you could create a patch for the following. Thank you!

I realize that this is probably not the right place to post this, as this is a Bazz doorbell.

Edit
I ended up patching my own file with the fantastic instructions provided. Here's the link in case anyone needs it:
guino/ppsapp-rtsp#1 (comment)

firmwareversion:ppstrong-c51-tuya2_bazz-2.10.0.20210801
hardwareversion:BE8S_H1_V10_915
model:Bell 8S
MD5: ad654f758e11da31a077130709c2a456

@guino
Copy link
Owner Author

guino commented Apr 21, 2023

@sle118 sorry I haven't had much time to work on this -- nice going on getting it patched yourself!

@dougalcampbell
Copy link

I've got the CW051 camera (See: https://github.com/guino/Merkury1080P and https://github.com/DouglasFreshHabian/MerkCamFirm). I tried following guino's instructions, but no ports opened up on my cam (nmap shows ports 80, 8090 and 8554 are still closed). Any ideas?

@guino
Copy link
Owner Author

guino commented Jan 5, 2024

Just for anyone looking at this in the future there was some info on the CW051 camera posted here: guino/Merkury1080P#52

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests