Help needed to patch 2.10.6

[derbaertigeFrytz]

Hello guino , thank you for your work.
I bought a nedis doorbell which uses a board labeled meari bell5s. Here are the relevant information from /devices/deviceinfo
model "Bell 5S"
softwareversion "2.10.6"
hardwareversion "BE5S_H1_V10_433"
firmwareversion "ppstrong-c51-tuya2_teco2-2.10.6.20210824"

I was able to apply the hack (No programmer, No UART, No problem!) and by reading ppsapp I was able to get cgi-bin/mjpeg.cgi, cgi-bin/snap.cgi and cgi-bin/play.cgi running. Busybox and Telnet works. Unfortunately rtsp is not running.
I patched ppsapp to enable RTSP, however after reboot no additional port (8554) is available. I checked with nmap (and with netstat in a telnet session). Please be so kind to have a look, what I did wrong.
Attached you will find a ppsapp (original file) and ppsapp.edit (patched)
Thanks a lot.
Frytz
ppsapp.tar.gz

[derbaertigeFrytz]

btw. did I understand right, that I do not have access to the audio stream without rtsp?
Regards, Frytz

[guino]

@derbaertigeFrytz Sorry I am traveling and haven´t had a chance to look at it just yet -- I will see what I can do as soon as I can.

You are correct, RTSP/ONVIF is the only way to listen to the audio from the device. Most devices on 2.10 and higher versions allow you to enable ONVIF (which includes RTSP) without patching -- just by enabling it in tuya_config.json (see guino/BazzDoorbell#2 (comment))

[derbaertigeFrytz]

Thank you for your advice. I already tried that without success. May be, I did something wrong.
My device does not have a tuya_config.json file, therefore, I added it to my SD containing
{"onviv":"1"}
which I expected to be correct. I changed custom.sh to copy the file to /home/cfg/ prior to start of ppsapp.
I also uncommented "/mnt/mmc01/set onvif_enable 1".
with telnet, I can see that this works, however no RTSP/ONVIF Ports are opened.

[guino]

@derbaertigeFrytz I checked your patch and it seems to be perfect (exactly what I did separately).

The only things I can suggest is to make sure the patched ppsapp is on the root of the SD card and named ppsapp (no .txt, .edit etc). You should hear 2 startup sounds during boot (one from the firmware ppsapp and another from the patched ppsapp).

If you do the above and still get no RTSP, please redirect the output of ppsapp to a log file and send my way so I can review it. I can provide specific instructions for this if needed.

[derbaertigeFrytz]

Thank you that you double checked my patch.
Yes, I can confirm: ppsapp is in the root of the sd card and is executed (two startup sounds). First, I tested with the patched app, then I tested the unpatched app with onvif settings.

redirect the output of ppsapp

I took a "> logfile 2>&1" using the unpatched ppsapp. You will find the output attached. After a while, messages just repeat. Here is a condensed look on "fail" and "error" keyword:
~ # cat /mnt/mmc01/ppsapp.log | grep -i fail
[02:00:37.348 INFO pps_button.c:245] failed to read axp228 status, ret=2!
[01-01 18:12:15-- TUYA Err][online_log_serv.c:317] log stats ufread fail.
1970-01-01 02:00:45 1008 [info] pps_encryption.c:192 open /mnt/mmc01/ppsEncrypt.txt failed!
1970-01-01 02:00:45 1008 [info] pps_encryption.c:304 get encrypt file head failed!flag = 1
[02:00:51.500 INFO third_party_base_fun.c:291] open file failed
~ # cat /mnt/mmc01/psapp.log | grep -i error
read i2c error ! :ffffffff -1
read i2c error ! :ffffffff -1
read i2c error ! :ffffffff -1
read i2c error ! :ffffffff -1
video h264 sub timestamp error: 45719, last: 38986

Let me give you additional information on changes I made, which may, or may not influence the result:

1. The device is not connected to a (i.e. tuya,nedis,..) app.
2. After the devices MAC showed up in my network for the first time, I blocked it from WAN/Internet in my firewall.
   There is no block within my LAN.
3. In my custom.sh, I added date/time settings with
   cp /mnt/mmc01/TZ /etc/TZ # CEST-2
   /mnt/mmc01/busybox ntpd -p

Thanks again, that you take the time to look at this.
Frytz

[derbaertigeFrytz]

ppsapp.log.tar.gz
While i made changes to this log, to mask some settings, I am willing to send you the original file via pm if needed.

[guino]

@derbaertigeFrytz I haven’t looked at your files yet but I can tell you these devices stay in ‘enrollment mode’ from factory until you register them in the phone app - only after that is that the rtsp/ONVIF function startup as far as I know. Additionally, if the device can’t access the tuya cloud it won’t update the time and fully startup (ie rtsp/onvif function won’t start) unless we make an offline patch.

With the information you provided I will go ahead and make an offline patch for you, then you can try it but it may still require you to enroll the device in the phone app (to initialize the device) — after it is initialized/working you can then disable internet access to it and it should work normally (even after power cycle - assuming we use the offline patch).