Mini 1080p wifi camera from Aliexpress, how to use without app (FtyCamPro)?

Question

Hi there, I found this tiny 1080p wifi camera on Aliexpress for less than 3€ ( It comes with an integrated rechargeable battery, the USB port does not seem to do anything else than charging (no data connection). Unfortunately, they want you to download and install a fishy app called FtyCamPro. I...

p.kaczmarek2 · Accepted Answer

Sure, there is one firmware for this chip, it seems: But you need to identify the flashing pins and first do a firmware read (backup) and then write.

divadiow · Accepted Answer

TXW81x AT demo from IOT SDK - built with CDK

divadiow · Accepted Answer

>>20990159 TXProgrammer can be put into English by changing the language value in config.cfg under TXProgrammer\dll to 1

p.kaczmarek2 · Answer

We've managed to free one cam from the cloud with @DeDaMrAz , but it required opening the case. Is it possible to open the case of this camera without breaking it, and if yes, what kind of chip is inside?

Wuppiduppi · Answer

Yes, I managed to open it without destroying anything. The chip is labeled with Beken BK7252UQN48 AU3437XB.

Wuppiduppi · Answer

Perfect, thanks a lot for the link! I'll look into that.

divadiow · Answer

annoyingly some, including mine, are Taixin TXW817s - https://community.home-assistant.io/t/popular...mini-wi-fi-camera-the-ha-challenge/230108/336

just seen a reply to my post though https://community.home-assistant.io/t/popular...mini-wi-fi-camera-the-ha-challenge/230108/337

Added after 53 [minutes]:

uart boot. 921600 baud

[0]00 00 17 00 57 0a 12 a0
[0]28 6e 00 00 00 00 00 00
[0]00 00 00 00 00 00 00 00
[0]08 19 75 05 38 66 89 a6
[0]4a a5 88 77 8e 67 00 00
[0]80 00 b7 ca a2 96 00 00
[0]00 16 00 00 0b 0a 00 00
[0]00 00 00 00 01 60 07 00
[0]00 00 00 40 00 04 40 00
[0]04 40 00 04 40 40 04 f1
[0]00 4c a0 14 4a 51 3c 85
[0]53 3c c5 03 cf 03 00 01
[0]00 02 fe 03 0f ae 04 0a
[0]02 00 fc 04 00 1f 00 1d
[0]00 03 48 00 00 00 00 0a
[0]00 00 00 00 00 10 e4 00
[0]f0 3c 0f
[0]validity: 1678e00d

** hgSDK-v2.5.1.7-26745, app-0, build time:Jan 18 2024 21:55:13 **
**   libcore v2.5.1.7-26745, build time:Dec 18 2023 11:05:53
**   libnetutils v2.5.1.7-26745, build time:Dec 18 2023 11:06:10
**   libcommon v2.5.1.7-26745, build time:Dec 18 2023 11:05:58
**   libosal v2.5.1.7-26745, build time:Dec 18 2023 11:05:52
**   libatcmd v2.5.1.7-26745, build time:Dec 18 2023 11:05:59
**   liblmac v2.5.1.7-26745, build time:Dec 18 2023 11:06:29
**   libwifi v2.5.1.7-26745, build time:Dec 18 2023 11:06:42
------------------------------------------------------------------
[0] ------- system restart fault -----------
[0][soft_reset]
[0] ------- lvd fault -----------
[0] ---------------------------------------
[1]freemem:181032
[1]custom_mem_init:2000cdb0
[2]custom mem sram:53248
[2]skbpool init, total:27436 (0x2003d4d4~0x20044000), max per:80%
[initStaticParam][ 292]use serverseq=1,svr=d32983:43237`57:g6bb8b322:53

[4]syscfg_read OK!
[4]0[540] flashCfg params(103).ssid=FTYC535866GRDBZ,T a O V    ۙ p\e\   s ) O  d#12345678,2,1
[VerStr2Int][ 834]cVersion=62_1_2_15

[IpcCfgItemGet][1099]VerStr2Int=62_1_2_15:1040253455

[VerStr2Int][ 834]cVersion=62_1_2_15

get flash addr:fd000 size:4096,
[8]col_flag:1
[8]get_parse_cloud_id:204
[8]selfId:FTYC535866GRDBZ:15
[9]col_flag:1
[9]col_flag:2
[9]get_parse_cloud_id:204
[9]parId:LXKJIG:6
[IpcCfgInit][ 448]1:616-->get from  ezConfig FTYC535866GRDBZ:ZZZZZ:

[IpcCfgInit][ 462]0-->get from  ezConfig FTYC535866GRDBZ:ZZZZZ:

[parseEz2Sch][ 885]NULL==pVal || NULL==pSysSchext || strlen(0)<24

[12]IpcCfgInit:505  add w0 interface!  2  FTYC535866GRDBZ:12345678
[12]IpcCfgInit:507  add w0 interface!  2  FTYC535866GRDBZ:12345678
[IpcGpioInit][ 641]SDD_PIN_INPUT=1

[IpcGpioInit][ 650]PWR_PIN_INPUT=1

[IpcGpioInit][ 670]PIN_IN_KEY=1

[IpcGpioInit][ 687]PIN_IN_USB=0

[16]main:1007  add w0 interface!  2  FTYC535866GRDBZ:12345678
[18]lmac rx info size:36
[18]GAP0 : 200390d4
[18]GAP1 : 2003d4cc
[18]lmac rx buff:200390dc, size:17392, hw rx buff size:11256, ampdu:7, max subfrm:3
[19]lmac priv: 2001ba0c
[20]lmac tx  : 2001be18
[20]lmac rx  : 2001cfe4
[20]lmac ble rx: 00000000
[20]pack:10, bios_id:3
[21]use AMPM DPD!
[21]verf:0x6, ibpt:0xa, ibct:0xa, iref:0x9
[22]verfvco_trim:0x4, verfcp_trim:0x2, verfdiv_trim:0x5
[22]verfdsm_trim:0x4, verfvcc25_trim:0x1
[23]da cap:5, da gain:2
[25]txdcoc from:1, i:11, q:10
[26]tx imb from:1, pm:118, gm:1
[26]rx dcoc from:1
[26]g:0, ana:64, i:-3, q:1
[27]g:1, ana:64, i:-5, q:5
[27]g:2, ana:64, i:-5, q:5
[27]g:3, ana:64, i:-10, q:15
[28]g:4, ana:64, i:-10, q:14
[28]g:5, ana:64, i:-10, q:15
[28]g:6, ana:64, i:-10, q:15
[29]g:7, ana:68, i:-15, q:0
[29]rx imb from:1
[29]g:0, 8114, 4050
[29]g:1, 8120, 4047
[30]g:2, 8112, 4048
[30]g:3, 8110, 4047
[30]g:4, 8106, 4049
[30]g:5, 8114, 4045
[31]g:6, 8110, 4050
[31]g:7, 8110, 4047
[31]time offset:0, 29
[32]lmac test: 2001d78c
[33]set_bss_bw: 20M
[33]lmac_bgn_lo_freq_set: 2432
[34]set rts_threshold =2304
[35]lmac set mac0 addr:08:19:75:05:38:98
[35]ADKEY baud:239
[35]*** open ADC success!
[36]*** add success: ADC channel cnt = 1, name:257
[36]*** add success: ADC channel cnt = 2, name:258
[37]lmac_bgn_lo_freq_set: 2412
[39]lmac_bgn_lo_freq_set: 2412
[40]set rts_threshold =1600
[40]set ac= 0 aifs= 2 cw_min= 15 cwmax= 1023 txop= 79
[41]set ac= 1 aifs= 6 cw_min= 15 cwmax= 1023 txop= 79
[42]set ac= 2 aifs= 1 cw_min= 7 cwmax= 15 txop= 128
[42]set ac= 3 aifs= 1 cw_min= 3 cwmax= 7 txop= 65
[43]set ac= 0 aifs= 2 cw_min= 15 cwmax= 1023 txop= 79
[43]set ac= 1 aifs= 6 cw_min= 15 cwmax= 1023 txop= 79
[44]set ac= 2 aifs= 1 cw_min= 7 cwmax= 15 txop= 128
[45]set ac= 3 aifs= 1 cw_min= 3 cwmax= 7 txop= 65
[45]lmac set mac0 addr:ce:f7:82:c9:70:74
[46]lmac_bgn_lo_freq_set: 2447
[47]lmac set mac0 addr:ce:f7:82:c9:70:74
[48]lmac_bgn_lo_freq_set: 2447
[49]ieee80211_ap_ioctl:164::set channel 8
[50]set ac= 0 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
[50]set ac= 1 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
[51]set ac= 2 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
[51]set ac= 3 aifs= 1 cw_min= 1 cwmax= 3 txop= 0
[52]main:1009  add w0 interface!  2  FTYC535866GRDBZ:12345678
[53]sys_network_init:463  add w0 interface!  2  FTYC535866GRDBZ:12345678
[54]sys_network_init:465  add w0 interface!  2  FTYC535866GRDBZ:12345678
JPG start
[55]csi_test start,iic init
[55]iic init finish,sensor reset & set sensor clk into 6M
hgdvp_set_baudrate:clock:480000000
[59]set sensor finish ,Auto Check sensor id
1--rsn--->6
2--rsn--->6
[359]to check id =4 num:0 
[359]sensorCheckId:1050 preset :0
[360]SID: ff, 4, 78, 79,f0
1--rsn--->6
2--rsn--->6
[660]to check id =9b num:1 
[660]sensorCheckId:1050 preset :0
[661]SID: 1, 9b, 42, 43,0
1--rsn--->6
2--rsn--->6
[961]to check id =a0 num:2 
[961]sensorCheckId:1050 preset :0
[962]SID: 1, a0, 42, 43,0
1--rsn--->6
2--rsn--->6
[1262]to check id =a3 num:3 
[1262]sensorCheckId:1050 preset :0
[1263]SID: 96, a3, 42, 43,f0
1--rsn--->6
2--rsn--->6
[1563]to check id =bb num:4 
[1563]sensorCheckId:1050 preset :0
[1564]SID: ff, bb, 66, 67,f0
1--rsn--->6
2--rsn--->6
[1864]to check id =10 num:5 
[1864]sensorCheckId:1050 preset :0
[1865]SID: 0, 10, 42, 43,f1
1--rsn--->6
2--rsn--->6
[2165]to check id =9d num:6 
[2165]sensorCheckId:1050 preset :0
[2166]SID: 96, 9d, 42, 43,f0
1--rsn--->6
2--rsn--->6
[2466]to check id =c0 num:7 
[2466]sensorCheckId:1050 preset :403105600
[2467]preset table num:2
[2467]SID: ff, c0, 62, 63,0
1--rsn--->6
2--rsn--->6
[2768]to check id =21 num:8 
[2768]sensorCheckId:1050 preset :0
[2769]SID: ff, 21, 78, 79,f0
1--rsn--->6
2--rsn--->6
[3069]to check id =77 num:9 
[3069]sensorCheckId:1050 preset :0
[3070]SID: 20, 77, 42, 43,a
1--rsn--->6
2--rsn--->6
[3370]to check id =26 num:10 
[3370]sensorCheckId:1050 preset :0
[3371]SID: ff, 26, c0, c1,a
1--rsn--->6
2--rsn--->6
[3671]to check id =37 num:11 
[3671]sensorCheckId:1050 preset :0
[3672]SID: ff, 37, dc, dd,fc
1--rsn--->6
2--rsn--->6
[3972]to check id =3a num:12 
[3972]sensorCheckId:1050 preset :0
[3973]SID: ff, 3a, dc, dd,fc
1--rsn--->6
2--rsn--->6
[4273]to check id =36 num:13 
[4273]sensorCheckId:1050 preset :0
[4274]SID: ff, 36, dc, dd,fc
1--rsn--->6
2--rsn--->6
[4574]to check id =3 num:14 
[4574]sensorCheckId:1050 preset :0
[4575]SID: ff, 3, dc, dd,fd
1--rsn--->6
2--rsn--->6
[4875]to check id =20 num:15 
[4875]sensorCheckId:1050 preset :0
[4876]SID: ff, 20, dc, dd,fd
1--rsn--->6
2--rsn--->6
[5001]main_wkq run work 0x2000cd7c (func:0x1803a308) use 5000 ticks
--------------------
local:ce:f7:82:c9:70:74
    bios:3, pack:10 
    pwr idx: 0
    chip-temperature: 30
    freq:2447, bg_rssi:-85
    cca: -70, -60, -62
    tx: txq:0, ps:0, tx_stat_q:0,
        tx dma:0, total tx:0, retry:0, tx lost:0, tx err:0
    rx: frms:209, data:0
    throughput: tx: 0 bps, rx: 0 bps
    max gain:7
--------------------
[5176]to check id =96 num:16 
[5176]sensorCheckId:1050 preset :0
[5177]SID: ff, 96, 60, 61,4
1--rsn--->6
2--rsn--->6
[5477]to check id =71 num:17 
[5477]sensorCheckId:1050 preset :0
[5478]SID: a6, 71, 42, 43,2
1--rsn--->6
2--rsn--->6
[5778]to check id =a6 num:18 
[5778]sensorCheckId:1050 preset :0
[5779]SID: a6, a6, 42, 43,2
[5779]checked ok id =a6 num:18 
[5779]Auto Check sensor id finish
[5780]mclk:24000000MHz
hgdvp_set_baudrate:clock:480000000
[5780]init:1806ec60 u8Addrbytnum:1,u8Databytnum:1
[5781]SENSER....init
[5850]init table num:542
[5851]SENSR ident ok:640*480
[5851]csi init start  --
[5851]csi set size ====>640*480
[5851]csi dvp_size_set
[5852]csi IRQ init
[5852]dvpirq_register:1 18028d58  18028d58
[5853]dvpirq_register:0 18028d44  18028d44
[5853]vppirq_register:0 18028b40  18028b40
[5853]vppirq_register:1 18028b44  18028b44
[5854]vppirq_register:2 18028b3c  18028b3c
[5854]vppirq_register:3 18028d14  18028d14
[5855]vppirq_register:4 18028d28  18028d28
[5855]vppirq_register:5 18028b1c  18028b1c
[5856]vppirq_register:6 18028b0c  18028b0c
[5856]vppirq_register:7 18028afc  18028afc
[5857]csi IRQ init finish,start get data
[5857]enable sdio irq[5858]clk:400000 width:1 power:UP
[5868]clk:400000 width:1 power:ON
[5878]read timeout pending set or rsp err:1 0
[5879]open_stream_available name:adc_audio
[5883]auadc power on
[5883]is CONFIG_UMAC4 2:2  FTYC535866GRDBZ:12345678
[5884]is CONFIG_UMAC4 2:2  FTYC535866GRDBZ:12345678:8
[5884]lmac_bgn_lo_freq_set: 2447
[5886]ieee80211_ap_ioctl:164::set channel 8
[5887]vif2 state WPA_DISCONNECTED -> WPA_COMPLETED
@eloop_init:287::start
user_[6057]dns sock :2
port:7070	fd:3
[6058]set_video_track:364
[6058]set_video_track source->track[t]:0	rtp:20027ED4
[6059]live audio_ex:20027E84
[6059]set_video_track:364
[6060]set_video_track source->track[t]:0	rtp:20028554
[6060]add w0 interface!  2:2  FTYC535866GRDBZ:12345678
[IpcSysInit][2203]gStartType=0,gDcOrBattery=0,gSysUpTime=6061

[normalRun][2089]normalRun--->0,gFctChkOn=0
[normalRun][2092]sysmode=0,t=6062

mutex create 0
[IlnkConnInit][ 137]init max connection--->[]->2

[IpcSdInit][1592]chk mmc dev, and mount it to sd

[IpcSdInit][1598]chk mmc dev, and mount it to sd

[IpcSdInit][1606]get storage status

[GetStorageInfo][ 186]totalBytes=0 M,freeBytes=0 M,usedBytes=0 M

[IpcSdInit][1622]create dir for rec&pic 4

[IpcSdDirCreate][1497]create dir for rec&pic 4

[IpcSdDirCreate][1501]create dir for rec&pic 4

[IpcSdDirCreate][1503]create dir for rec&pic 4

[IpcSdDirCreate][1505]create dir for rec&pic 4

[IpcSdDirCreate][1507]create SPECIALCAP_FOLDER 12 

failed-create RECORD_FOLDER 12 
[IpcSdInit][1627]IpcIlnkIdxInit=0

[IpcIlnkIdxInit][1465]gIdxPicLock created[0]

[IpcIlnkIdxInit][1467]gIdxRecLock created[0]

[IpcIlnkIdxInit][1469]gIdxSplLock created[0]

[IpcSdInit][1629]IpcIlnkIdxInit=0

[IpcPicIdxChk][1485]TFcard not mounted[0]

[IpcRecIdxChk][1530]TFcard not mounted[0]

[IpcSplIdxChk][1508]TFcard not mounted[0]

[IpcSdInit][1638]ok[0]--IpcSdInit[gSdInitFlag=1]

[recInit][ 677]IpcSdInit=0

[recInit][ 685]IpcRecMgrInit=0

[IpcP2pStart][ 559]p2p starte,bP2pStarted=[0] 3;4d449b8b;5c722d77;9a3f3ea2

[IpcP2pStart][ 596]p=558c9c:4b633e66:8`2g2d`32:5e,len=28,ret=1,d32983:43237`57:g6bb8b322:53

ifPsram=0 		sNmb=1
 		cNmb=2
 		cBuf=12
		svr0=1122121874
 		svr1=1379035718
 		svr2=4157381667
[IpcP2pStart][ 640]Success[0]--IlnkModP2pStart

[IpcP2pStart][ 646]IpcP2pStart=0

[normalRun][2124]normalRun--->4,gFctChkOn=0
[6082]p_sensor_cmd->id=0:a6
[6082]spaFlip=0
[6082]setPtzRun 0,-1,-1
[6083]ble_ll: set adv data, len=28
[6083]ble_ll: set scan_resp data, len=31
[6084]ble_ll: set adv en:1
[6084]ble_ll: set coexist en:1, decrease duty cycle:0
t_socket=4 strerror: Success
network interface: pt (Default)
MTU: 8486
MAC: 07 18 40 06 ce f7 82 c9 70 74 06 3f 77 30 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 00 00 00 01 00 00 00 34 f1 01 20 00 00 00 00 00 00 00 00 b8 00 60 00 00 00 00 00 94 b2 00 20 ac 54 00 20 2c 00 1c 00 80 00 00 00 00 00 ff ff ff ff ff ff ce f7 82 c9 70 74 08 06 45 00 00 2c 00 00 00 00 ff 11 bd be 7f 00 00 01 7f 00 00 01 c0 36 c0 36 00 18 bb bf 0c 01 74 00 01 00 00 00 00 00 00 00 
FLAGS: UP LINK_DOWN ETHARP
ip address: 192.168.1.1
gw address: 192.168.1.1
net mask  : 255.255.255.0

network interface: $[framememt_video_thread][ 443]bOK=0,gfps=0,gBps=1719,tm=6

$[6379]enable sdio irq[6379]clk:400000 width:1 power:UP
[6389]clk:400000 width:1 power:ON
[6399]read timeout pending set or rsp err:1 0
$$$$$$$[_mon100chk][1653]!gBatteryValue 1--->(2827):3200----->IpcShutdown

[6691]erase flash, 1 sectors ...
[6693]write flash, 540 bytes ...
[6696]verify flash ... OK
[6697]switch syscfg partition ... OK
[6698]syscfg_write OK! (addr:ff000, crc=f84d, size:540, last_addr:fe000)
[IpcRecSwitch][ 809]bOnOff=0 && pParam==NULL

$$[_mon500chk][1707]1--Mode=1,wlan=0:1,IDR=0,sd=0,conn=0,keep=0:-1:0,[0:1]wlan=2,run=0,rec=0,t=6182

$$[6900]enable sdio irq[6900]clk:400000 width:1 power:UP
[6911]clk:400000 width:1 power:ON
[6921]read timeout pending set or rsp err:1 0
$

p.kaczmarek2 · Answer

hgSDK? That's something new. Still, please consider creating a separate topic for that, maybe we can find SDK for that one as well

divadiow · Answer

Not that I know what to do with it, but there is this SDK for download

p.kaczmarek2 · Answer

That's a good find! Is there a flash tool? Can you check whether it's possible to read and write the flash of this chip? That programmer tool looks like a flash tool.

divadiow · Answer

yes. I had a look, but could see no obvious uart flash options. none of the drop-downs in the app reveal any com port settings, Burner PDF in english attached Code: TextLog in, to see the code

p.kaczmarek2 · Answer

Can you find a pinout of that microcontroller? Maybe it has some UART or USB port.

divadiow · Answer

yes.

mickeymouse · Answer

A little more information about cameras with TXW817 chipset: After configuring with YsxLite app it can be blocked on firewall from the Internet access and accessible on LAN with the app from GitHub.

divadiow · Answer

TX81x documents, SDK and programmer for the library

divadiow · Answer

Regarding the TXW817-810 based A9, I have attempted to use these pads to connect using QSPI/SPI to the internal flash memory

CS (Pin 1 on CH341A) → PA7 (OSPI_NSS0)
CLK (Pin 5 on CH341A) → PA8 (QSPI_CLK)
MOSI (Pin 3 on CH341A) → PA10 (QSPI_IO1)
MISO (Pin 2 on CH341A) → PA9 (QSPI_IO2)

PA7 doesn't seem to be exposed to a test pad. I couldn't find where it traced to, so I very delicately soldered a twisted copper wire (taken from several strands of a de-soldering braid) to the PA7 pin on the IC.

Sadly no joy with NeoProgrammer. Looking through the Taixin docs there's only mention use of their TX-Link programmer device to write to these chips.

p.kaczmarek2 · Answer

My new guide: How to access cheap 1$ A9 camera video stream from LAN page (NodeJS)?

p.kaczmarek2 · Answer

That's good news, how did you compile it?

divadiow · Answer

CDK - C-SKY Development Kit can be downloaded from the same xrvm.cn XuanTie download pages as the CK804/W80x toolchain bits mentioned in the W806 thread starting here https://www.elektroda.com/rtvforum/topic4054074-30.html#21534187

https://www.xrvm.cn/community/download?id=4397799570420076544

Website download panel for Jianchi CDK tools, listing available files and download links.

Like the W806 zip file provided by YourCee, the Taixin TXW81x IoT SDK download contains a .cdkproj file for opening with CDK

Windows Explorer window showing project files in the TXW81x_IOT software folder.

Then it just builds through menu Project -> Build Active Project

Screenshot of an IDE showing a project tree, folder structure, and build log output.

divadiow · Answer

This arrived but was not needed for flash read/write in the end. CK-Link: Code: TextLog in, to see the code and a 2mb dump, perhaps the world's first from one these TXW-based cams. This is from the X5 'barrel' type of TXW817-810. I've not explored it much yet but I attach the dump We can already see the cam sensors this has drivers for

divadiow · Answer

>>21546674

and now that demo running on a TXW817-810

Log in, to see the code

UART changed to PC6/7 which are exposed as test pads on cam PCB. Previously PA1/PA2

Screenshot of the project_config.h configuration file with highlighted lines defining UART0 pins as PC_7 and PC_6.

Added after 3 [minutes]:

updated build filename and PC6/7 AT build addition https://github.com/divadiow/FlashDumps/commit/4ba2aba34dbed11194d75a76a4fbc012d9642fbe

Added after 30 [minutes]:

Does anyone else have Taixin cams? @p.kaczmarek2 @insmod

Mini 1080p wifi camera from Aliexpress, how to use without app (FtyCamPro)?

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Topic summary