logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Exploring A9 Minicam Variation: XF16 PB380EA6341 MCU, T25S80 SPI Flash, XR872, Skylark SDK

divadiow 11496 233
ADVERTISEMENT
Reply | New topic
  • #181 21547719
    divadiow
    Level 34  
    it appears perhaps many more cam sensors are supported looking at strings on an XF16

    Code: Text
    Log in, to see the code


    Added after 5 [hours] 2 [minutes]:

    insmod wrote:
    >>21349910 There is this: https://portrait.gitee.com/Dozingfiretruck/xr872_sdk/blob/master/project/example/jpeg/main.c
    But it looks like only for GC0308 and GC0328C sensors

    are these of any use? https://github.com/adasngle/testmywatch/tree/master/custom/drv/YUV_sensor
  • ADVERTISEMENT
  • Helpful post
    #182 21548014
    insmod
    Level 25  
    >>21547719
    Possibly. The most important things are initialization arrays, which they have.
  • ADVERTISEMENT
  • Helpful post
    #184 21548497
    Apache02
    Level 2  
    >>21548081
    Hi, the initialization table for the hi704 that I uploaded to GitHub was working. I had a working build for the BK7252 with this sensor on my previous SSD.
  • Helpful post
    #185 21548518
    divadiow
    Level 34  
    >>21548497 cool. ive just this minute discovered I have a HI0704 at my disposal

    https://www.elektroda.com/rtvforum/topic4121456.html#21548509

    Added after 5 [minutes]:

    neat. GC0310 too. pretty nice way of finally knowing what the cams are (if ribbon print isnt clear or boot log doesn't help), assuming theyre covered by the list above.

    Added after 1 [hours] 15 [minutes]:

    https://github.com/yandi-six/bk7258-doorbell/...dk-v2.0.1.29/components/bk_peripheral/src/dvp
  • #186 21575396
    divadiow
    Level 34  
    @insmod @p.kaczmarek2

    I was thinking about tracing as many of the XF16 pins as possible against known components/functions, like RX/TX, LEDs. BUT, can what been seen in XR872 currently be relied on as a correct XR872 pin number to any extent? I'm thinking maybe not yet

    Screenshot of a configuration interface showing a list of pins and dropdown menus with editable value fields.
  • #188 21575973
    p.kaczmarek2
    Moderator Smart Home  
    I think you'd probably need to add more entries here:
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/hal/xr809/hal_pins_xr809.c
    Check respective SDKs for what may be present and then check each pin one by one:
    Code: C / C++
    Log in, to see the code

    Check here:
    https://github.com/openshwprojects/OpenXR872/...343b51ba9/include/driver/chip/hal_gpio.h#L657
    There may be also port C:
    Code: C / C++
    Log in, to see the code

    Code: text Expand Select all Copy to clipboard
    
ifeq ($(__CONFIG_CHIP_TYPE), xr872)
  __CONFIG_CHIP_ARCH_VER := 2
  __CONFIG_CHIP_XR872 := y
ifeq ($(__CONFIG_CHIP_TYPE), xr808)
  __CONFIG_CHIP_ARCH_VER := 2
  __CONFIG_CHIP_XR808 := y
CONFIG_SYMBOLS += -D__CONFIG_CHIP_ARCH_VER=$(__CONFIG_CHIP_ARCH_VER)
  ifndef __CONFIG_CHIP_ARCH_VER
    Helpful post? Buy me a coffee.
  • #189 21576922
    divadiow
    Level 34  
    gosh, thank you for taking the time to point these bits out. I'll try to get my head round what's required when I have a moment to focus
  • #190 21577064
    p.kaczmarek2
    Moderator Smart Home  
    This seems to mean that there are at most:
    Code: text Expand Select all Copy to clipboard
    
#define GPIOA_PIN_NUM    24
#define GPIOB_PIN_NUM    22
#define GPIOC_PIN_NUM    13

    24+22+13 pins to check, but usually not all are routed out on the case.
    Helpful post? Buy me a coffee.
  • #191 21580210
    p.kaczmarek2
    Moderator Smart Home  
    You're getting XR809 and XR806 build errors because port C seems to be present only on XR872.
    Screenshot of a GitHub panel showing status checks – some failed, others successful.
    Code: C / C++
    Log in, to see the code

    Probably just need to take PORTC pins into the #if PLATFORM_XR872 block
    Helpful post? Buy me a coffee.
  • #192 21580239
    divadiow
    Level 34  
    Ah ok. Thanks. It also looks like this in gui so I'm missing something else too. Need to get back to looking at it

    Screenshot of a device configuration interface with multiple error messages and device information at the bottom.
  • #193 21580264
    p.kaczmarek2
    Moderator Smart Home  
    There is also PLATFORM_GPIO_MAX in new_pins.h
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #195 21581384
    p.kaczmarek2
    Moderator Smart Home  
    Well, it compiles, and you managed to configure it, so it's a good start, but I don't think @insmod meant that you should separate all HAL for your XR, just separate pins. It's easier to maintain single HAL file between multiple platforms.
    Helpful post? Buy me a coffee.
  • #196 21581497
    insmod
    Level 25  
    >>21581384
    No, i really meant to just separate pin definitions between all XRs.
    Or make it like i done with realtek, all shared code in hal_*_realtek.c, and anything chip-specific in its own folder.
    rtl87x0c/hal_pins_rtl87x0c.c for example contains only g_pins, g_numPins and HAL_PIN_CanThisPinBePWM.
  • #197 21581680
    divadiow
    Level 34  
    :( ok ok. thanks. will come back to it probably. I need something more concrete to check pins against than the XF16 so have ordered this

    Exploring A9 Minicam Variation: XF16 PB380EA6341 MCU, T25S80 SPI Flash, XR872, Skylark SDK
    Exploring A9 Minicam Variation: XF16 PB380EA6341 MCU, T25S80 SPI Flash, XR872, Skylark SDK

    need to locate datasheet or trace though as it doesn't look like contacts are labelled. Alibaba/Tmall module

    Added after 7 [hours] 38 [minutes]:

    should this get merged first? https://github.com/openshwprojects/OpenXR872/pull/2

    I wonder if it would help with this size issue when more pins are set https://github.com/openshwprojects/OpenBK7231T_App/actions/runs/15688113310/job/44196324941

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • #198 21582145
    p.kaczmarek2
    Moderator Smart Home  
    I think I may need help on choosing which PR to merge. I remember we have @insmod PR pending but I wanted to try adding failsafe for BL602 OTA fail but failed to do so currently...

    Regarding this:
    https://github.com/openshwprojects/OpenBK7231T_App/pull/1676
    The cosmetic idea is nice, but this will break pin configs because they are saved as indexes.
    Helpful post? Buy me a coffee.
  • #199 21582148
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    The cosmetic idea is nice, but this will break pin configs because they are saved as indexes.

    arrgh
  • #200 21582151
    p.kaczmarek2
    Moderator Smart Home  
    The sort still could be done, but it would have to done in http_fns.c (as far as I remember), in the cfg_pins handler.
    Helpful post? Buy me a coffee.
  • Helpful post
    #201 21582544
    insmod
    Level 25  
    I would've agreed if OTA was implemented. But since any update must be done via uart, might as well sort them in HALs.
    Should i add easyflash support to all XRs?

    Added after 1 [hours] 45 [minutes]:

    And there are 23 GPIO available according to XR809_Datasheet_V1.1.pdf, but only 13 are available in OBK.
  • #203 21585440
    johndoudou
    Level 3  
    Hello everyone,

    This thread is awesome but I have some questions:
    - does someone know how to "slice cut" the flash dump into the different pieces that PhoenixMC is displaying? Is there an existing firmware parser? Binwalk does not get anything interesting.
    https://obrazki.elektroda.pl/7685058500_1744977818_bigthumb.jpg

    - did someone manage to start reverse-engineering the stock firmware? with Ghidra?
    I want to reverse engineer that cam in order to find all usable functions (for instance "store videos into SD card" etc.) that is not currently implemented by this project https://github.com/devbis/aiopppp

    - do you think you will soon be able to publish a toolchain that will allow coding a custom firmware and then flash it onto?

    By the way, attached, if it is useful, a dump from the flash: I have the A9 XF16 variation of that cam.

    Cheers!
    Attachments:
  • #204 21585750
    divadiow
    Level 34  
    johndoudou wrote:
    - does someone know how to "slice cut" the flash dump into the different pieces that PhoenixMC is displaying?

    you could probably work it out from the partition layout code here
    https://github.com/openshwprojects/OpenXR872/...emo/hello_demo/image/xr872/image_auto_cal.cfg

    johndoudou wrote:
    did someone manage to start reverse-engineering the stock firmware? with Ghidra?


    not me

    johndoudou wrote:
    - do you think you will soon be able to publish a toolchain that will allow coding a custom firmware and then flash it onto?


    OpenXR872 is available for XF16 but it still requires a lot of work and does not support camera sensors. Is this what you mean?
    https://github.com/openshwprojects/OpenBK7231T_App/releases/

    Added after 1 [minutes]:

    johndoudou wrote:
    By the way, attached, if it is useful, a dump from the flash: I have the A9 XF16 variation of that cam.

    thanks. I'll add to collection. What does your device look like? Is it one we've seen before or new? Do you have pics of PCB both sides and cam module?
  • #205 21585757
    p.kaczmarek2
    Moderator Smart Home  
    Partitions change dynamically with each build, so probably we would need to read the file. Maybe do few builds with different tables and check where the offsets are.
    Helpful post? Buy me a coffee.
  • #206 21586996
    johndoudou
    Level 3  
    >>21585750

    Thank you.

    My sample is the same as your post #121 in this current thread (https://www.elektroda.com/rtvforum/topic4074636-120.html#21530504)
    Bought here: https://aliexpress.com/item/1005006948283462.html


    Quote:
    Is this what you mean?

    And yes, it is what I meant.

    Added after 2 [minutes]:

    >>21585757

    Ah OK, do you know where could be, in the PhoenixMC SDK, the file/lib responsible for the format parser ?

    Does anyone has a clue on how to start reverse engineer the firmware in Ghidra ?
  • #208 21587062
    p.kaczmarek2
    Moderator Smart Home  
    Cedarx? Interesting, but no:
    https://linux-sunxi.org/CedarX
    Code: text Expand Select all Copy to clipboard
    
CedarX is a proprietary multimedia framework distributed by Allwinner and not supported by the linux-sunxi community.

It's the name of the proprietary software libraries responsible for hardware accelerated video and audio de-/encoding (CedarV + CedarA) in conjunction with with a hardware block. As for audio, the hardware ACE (Audio Codec Engine) appears to only exist in A10 and older SoCs. Allwinner refactored their proprietary userspace libraries and published them partly under GPLv2 naming them "media-codec" while some codecs are still only available as proprietary binary blobs linked in like plugins.
After some pressure caused by the controversies [1] [2] [3] [4] surrounding the license of this library, Allwinner released a new media-codec library called Sunxi-CedarX [5] , which is a rewrite that up to now only partial implements some codecs as open source, letting the rest of the codecs and features such an encoding dependents of a closed source plugin binary.


    @johndoudou what exactly do you want to find out with Ghidra?

    Added after 1 [minutes]:

    Do we even have Phoenix MC SDK? Source code of the flash tool?

    Added after 1 [minutes]:

    Image is created that way:
    Code: text Expand Select all Copy to clipboard
    
E:\project\IOT\tools\xr-mkimage\Release>mkimage.exe

    so you would want mkimage source
    Helpful post? Buy me a coffee.
  • #209 21587069
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    Do we even have Phoenix MC SDK? Source code of the flash tool?

    ah. I forgot about the previous question then read this to mean the actual XR872 SDK :)

    Added after 45 [seconds]:

    I don't think I've ever seen the source code for PhoenixMC anywhere..
  • Helpful post
    #210 21587268
    insmod
    Level 25  
    Xradios update test
    LFS for all, Easyflash for all, OTA for all (XR809 not working, XR872 no image generated yet), Pins for all, berry for XR806.
    Implemented PWM, ADC (including VBAT), UART, watchdog in APP, delay_us, RSSI and ip addresses, remaining heap size.
    Fixed MAC for XR806.

    https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/15826444795

    @divadiow need tests on XR806 (and if it even boots)
Reply | New topic
Report a violation of the law

Topic summary

The discussion focuses on a variation of the A9 mini Wi-Fi camera featuring the XF16 PB380EA6341 MCU, an 8Mbit SPI flash chip labeled T25S80 (likely from ChipSourceTek), and the XR872 SoC running the Skylark SDK. Attempts to read and dump the flash firmware using tools like Flashrom, NeoProgrammer, and ASProgrammer faced challenges due to unrecognized SPI IDs and unreliable read/write operations, especially when the flash chip was in-circuit. Desoldering the flash chip improved read/write reliability. The firmware strings indicate the use of an RTOS and the iLnkP2P protocol for communication. The XR872 SDK (version 2.0 and later 1.2.x) was explored for building and flashing demo applications, including a "hello world" example, which successfully booted on the hardware after flashing via UART using PhoenixMC. Flashing custom firmware requires careful handling of flash erase and protection bits, with some users experiencing verification errors and random write failures. The flash layout includes an AWIH header and OTA partitions, with OTA updates compressed by XZ, raising concerns about fitting OTA images into the 1MB flash. Hardware details such as the presence of a pull-up resistor on the flash hold pin and UART pin configurations (PB02/PB03) were examined. The community also discussed the compatibility of different flash chip sizes (1MB vs 2MB) and the impact on firmware booting and flashing. Some users successfully transplanted firmware to larger flash chips (2MB) to run custom firmware like OpenXR872 (OBK). The discussion includes references to related projects for video stream capture without flashing (cam-reverse) and the challenges of flashing and booting custom firmware on these devices. Overall, the thread provides detailed technical insights into hardware probing, firmware extraction, SDK usage, flashing procedures, and troubleshooting for the XF16-based A9 mini camera variant with XR872 SoC.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT