Exploring A9 Minicam Variation: XF16 PB380EA6341 MCU, T25S80 SPI Flash, XR872, Skylark SDK

divadiow 33606 298

Report a violation of the law

Reply | New topic

#31 21522401 17 Apr 2025 18:20

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #31
21522401 17 Apr 2025 18:20

NOTE: My chip is directly on CH341 daughter board, no clip used. I desoldered it.

SREG in Neo Programmer:
Code: text Expand Select all Copy to clipboard
Old protection Register: 00000000(0x00), New protection Register: 00000000(0x00), Old protection Register: 00000000(0x00), New protection Register: 00000000(0x00), Old protection Register: 00000000(0x00), New protection Register: 00000000(0x00), Current programmer: CH341 Black Status register: 00000000(0x00)

When I try to flash back what I read outside circuit (before first write attempt):

Then, when I do reaD:

So it's a write problem.

Do you get the same? First 0x43 bytes written or so?

Added after 46 [seconds]:

Second attempt - it wrote up to 0x130 or so:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#32 21522405 17 Apr 2025 18:36

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #32
21522405 17 Apr 2025 18:36

Yes. Same behaviour so far. I've not yet had time to desolder chip to attack it off the camera PCB. Asprogrammer appears to have better SREG reader..

Added after 5 [minutes]:

p.kaczmarek2 wrote:
Do you get the same? First 0x43 bytes written or so?

Actually, my read back hasn't been obvious that it wrote some bytes. Maybe you're getting a clearer picture with chip on breakout board. I'll do that soon
#33 21522451 17 Apr 2025 20:03

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #33
21522451 17 Apr 2025 20:03

I'm trying with custom C code to write pages:

I have no idea, why so many errors? At random places? It's literally flash chip sitting on CH341 daughter board.

Added after 2 [minutes]:

Ok it stuck totally now:

Added after 7 [minutes]:

Wait, I think I may be onto something:

Added after 2 [minutes]:

Haha, I didn't expect it to actually work, but it works.

I

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#34 21522483 17 Apr 2025 20:10

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #34
21522483 17 Apr 2025 20:10

what did you do?
ADVERTISEMENT
#35 21522488 17 Apr 2025 20:23

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #35
21522488 17 Apr 2025 20:23

I'm still testing because I would not like to fool myself, and it may be a fluke, but here is what I did directly before getting correct write/verify:

Added after 8 [minutes]:

It seems I managed to write back original flash:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#36 21522499 17 Apr 2025 20:23

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #36
21522499 17 Apr 2025 20:23

nice nice. 🥁 drum roll 🥁... does the xr872 demo image boot?

#37 21522502 17 Apr 2025 21:15

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316

Post #37

21522502 17 Apr 2025 21:15

I flashed back original image and it seem to boot. More tests to come. I hope the clip will work now... otherwise i will have to desolder with each try.

Added after 51 [minutes]:

I'm afraid I get no UART output on custom firmware.

On a bright side, I've flashed original dump to 2MB flash chip, and look:


[bl ERR] main():629, build:20:38:52
use default flash chip mJedec 0x0
[FD I]: mode: 0x4, freq: 48000000Hz, drv: 0
[0;32;31m-------------->unknow flash ID 0x1540C8[m

PasswoPMA: mode select:e

wlan information ===================================================
firmware:
    version : R-XR_C10.08.52.64_01.80 Jul  6 2019 20:05:10-P01.46-R
    buffer  : 12
driver:
    version : XR_V02.05
====================================================================

PMA: wlan mode:a

platform information ===============================================
XRADIO Skylark SDK 1.2.0 Oct 17 2024 10:39:50

sram heap space [0x21fc70, 0x25fc00), total size 262032 Bytes
cpu  clock 240000000 Hz
HF   clock  40000000 Hz

sdk option:
    XIP           : enable
    INT LF OSC    : enable

mac address:
    efuse         : 18:9e:2d:81:89:ce
    in use        : 38:0a:8d:47:2b:71
====================================================================

StartupState:0
[0;32;31m<-500119_192428 rt_res.c:111>[mres error filenum:-1 001E0000
wait id tools
gpio_grp=0,gpio_bit=21
led drv init
check vol
[mthread]Create task:vbat(stack:2048),prio:3,ret:0 
XXXX task:vbat
[ERR] __mci_irq_handler,575 raw_int:100 err!
[ERR] SDC err, cmd 8,  RTO
[ERR] sdc 402 abnormal status: RespErr
[ERR] int err 100
[ERR] __mci_irq_handler,575 raw_int:100 err!
[ERR] SDC err, cmd 55,  RTO
[ERR] sdc 402 abnormal status: RespErr
[ERR] int err 100
[ERR] __mci_irq_handler,575 raw_int:100 err!
[ERR] SDC err, cmd 55,  RTO
[ERR] sdc 402 abnormal status: RespErr
[ERR] int err 100
[ERR] __mci_irq_handler,575 raw_int:100 err!
[ERR] SDC err, cmd 55,  RTO
[ERR] sdc 402 abnormal status: RespErr
[ERR] int err 100
[ERR] __mci_irq_handler,575 raw_int:100 err!
[ERR] SDC err, cmd 55,  RTO
[ERR] sdc 402 abnormal status: RespErr
[ERR] int err 100
[FS ERR] fs_ctrl_mount():102, mmc scan fail
[0;32;31m<-500119_192433 rt_sd_dev.c:264>[mSD File System initialzation failed! errno
[mthread]Create task:sdcardth(stack:2048),prio:3,ret:0 
XXXX task:sdcardth
err cmd:use_fw_rate_policy
vif=0, rts_threshold = 3000
ssid is NULL. AP 
<wifi>lpdtim:10, lplis:10
[mthread]Create task:wifitask(stack:4096),prio:3,ret:0 
XXXX task:wifitask
[XRADIO_INTERNAL_CODEC] AMIC set volume Level-[7]
[XRADIO_INTERNAL_CODEC] AMIC set volume Gain-[39]
wifi task run
rtuid:BATA-825001-IRMCB1N,HQLBAA
en1: CTRL-EVENT-TERMINATING 
WAR join_status:0
mean_vol=4200

wlan information ===================================================
firmware:
    version : R-XR_C10.08.52.64_01.80 Jul  6 2019 20:05:10-P01.46-R
    buffer  : 12
driver:
    version : XR_V02.05
====================================================================

interface name: en1
Using interface en1 with hwaddr 38:0a:8d:47:2b:71 and ssid "AP-XRADIO"
[XRADIO_INTERNAL_CODEC] AMIC set volume Gain-[39]
[XRADIO_INTERNAL_CODEC] LINEIN set volume Level-[1]
[XRADIO_INTERNAL_CODEC] AUDIO_IN_DEV_ALL set volume Gain-[0]
[XRADIO_INTERNAL_CODEC] Route(cap): amic Enable
en1: interface state UNINITIALIZED->ENABLED
en1: AP-ENABLED 
en1: AP-DISABLED 
[net INF] msg <wlan connected>
[net INF] netif is link up
[net INF] bring up netif
[net INF] netif (IPv4) is up
[net INF] address: 192.168.238.1
[net INF] gateway: 192.168.238.1
[net INF] netmask: 255.255.255.0
WLAN CONNECTED
err cmd:use_fw_rate_policy
vif=0, rts_threshold = 3000
vif0, AP/GO mode THROTTLE=38
[net INF] msg <network up>
NETWORK UP
<L>Cmutex:0
<L>Cmutex:0x229e40
<L>lwip_socket(PF_INET, UDP, 17) = SKT_0
en1: interface state ENABLED->DISABLED
[net INF] msg <wlan disconnected>
[net INF] netif is link down
WLAN DISCONNECTED
<L>Cmutex:0
<L>Cmutex:0x226f78
<L>lwip_socket(PF_INET, UDP, 17) = SKT_1
Using interface en1 with hwaddr 38:0a:8d:47:2b:71 and ssid "BATA825001CKETR"
[0;32;31m<010701_000000 rtb_av_api.c:872>[mdetect sensor error
OV9660 get chip id wrong 0xff
OV9660  Init error!!
[CAMERA ERR] HAL_CAMERA_Init():373, sensor config fail
[0;32;31m<010701_000001 rtb_av_api.c:1284>[mHAL_CAMERA_Init error, -1
[0;32;31m<010701_000001 rtb_av_api.c:2024>[mmedia not init
[mthread]Create task:thdImage(stack:2048),prio:3,ret:0 
XXXX task:thdImage
[mthread]Create task:RT_REC(stack:2048),prio:3,ret:0 
XXXX task:RT_REC
[mthread]Create task:MD_TH(stack:2048),prio:3,ret:0 
XXXX task:MD_TH
[mthread]Create task:p2plis(stack:10240),prio:3,ret:0 
XXXX task:p2plis
[mthread]Create task:CameraTest(stack:2048),prio:3,ret:0 
XXXX task:CameraTest
[mthread]Create task:NetCheck(stack:2048),prio:3,ret:0 
XXXX task:NetCheck
set br:-1--1
set ircut color
{0xC8,0x06},
/camera_test.txt does not exist!
[mthread]vvvthread CameraTest, tid:2184488 EXIT
[mthread]vvvthread NetCheck, tid:2183528 EXIT
en1: interface state DISABLED->ENABLED
en1: AP-ENABLED 
[net INF] msg <wlan connected>
[mthread]vvvthread thdImage, tid:2184348 EXIT
lednum:0
--drvled_flash :(0,1,5,5,1,5,5)
vif0, AP/GO mode THROTTLE=38
[net INF] netif is link up
[net INF] netif is already up
WLAN CONNECTED
err cmd:use_fw_rate_policy
vif=0, rts_threshold = 3000
<RTW>WiFi ap start ok:BATA825001CKETR, 0, 11
wifi task exit
[mthread]vvvthread wifitask, tid:2184992 EXIT
[IpcP2pStart][  83]p2p starte,bP2pStarted=[0]

rtuid:BATA-825001-IRMCB1N
p2pID:BATA-825001-CKETR
DataRW_Init bufferSize=32
<L>lwip_close(0)
<L>lwip_close(0)
<L>mutex D:0x229e40
<L>lwip_close(SKT_0),tcp=0
Success[0]--IlnkModP2pStart
IpcSysInit:0
[mthread]vvvthread p2plis, tid:2186396 EXIT
[os E] OS_MutexLock():65, handle 0
semaphore not initialized at line 448 in src/api/tcpip.c
<L>Cmutex:0
<L>Cmutex:0x236680
netconn state error at line 1132 in src/api/api_msg.c
<L>Cmutex:0
<L>Cmutex:0x236540
<L>lwip_socket(PF_INET, UDP, 0) = SKT_0
<L>lwip_socket(PF_INET, UDP, 17) = SKT_2
<L>Cmutex:0
<L>Cmutex:0x2363f8
<L>lwip_socket(PF_INET, UDP, 0) = SKT_3
network interface: en (Default)
MTU: 1500
MAC: 38 0a 8d 47 2b 71 
FLAGS: UP LINK_UP ETHARP IGMP
ip address: 192.168.238.1
gw address: 192.168.238.1
net mask  : 255.255.255.0

network interface: lo
MTU: 0
MAC: 
FLAGS: UP LINK_UP
ip address: 127.0.0.1
gw address: 127.0.0.1
net mask  : 255.0.0.0

Camera works on 2MB flash chip with YSXLite App:


IpcP2pStart][  83]p2p starte,bP2pStarted=[0]

rtuid:BATA-825001-IRMCB1N
p2pID:BATA-825001-CKETR
DataRW_Init bufferSize=32
<L>lwip_close(0)
<L>lwip_close(0)
<L>mutex D:0x22a0e8
<L>lwip_close(SKT_0),tcp=0
Success[0]--IlnkModP2pStart
IpcSysInit:0
[mthread]vvvthread p2plis, tid:2186396 EXIT
[os E] OS_MutexLock():65, handle 0
semaphore not initialized at line 448 in src/api/tcpip.c
<L>Cmutex:0
<L>Cmutex:0x244268
netconn state error at line 1132 in src/api/api_msg.c
<L>Cmutex:0
<L>Cmutex:0x24a0e8
<L>lwip_socket(PF_INET, UDP, 0) = SKT_0
<L>lwip_socket(PF_INET, UDP, 17) = SKT_2
<L>Cmutex:0
<L>Cmutex:0x24a228
<L>lwip_socket(PF_INET, UDP, 0) = SKT_3
network interface: en (Default)
MTU: 1500
MAC: 38 0a 8d 47 2b 71 
FLAGS: UP LINK_UP ETHARP IGMP
ip address: 192.168.238.1
gw address: 192.168.238.1
net mask  : 255.255.255.0

network interface: lo
MTU: 0
MAC: 
FLAGS: UP LINK_UP
ip address: 127.0.0.1
gw address: 127.0.0.1
net mask  : 255.0.0.0

mean_vol=4100
xr_newassoc(): link_id:0 mac:fc:02:96:13:e2:2b
en1: STA fc:02:96:13:e2:2b IEEE 802.11: associated
en1: AP-STA-CONNECTED fc:02:96:13:e2:2b
<L>Cmutex:0
<L>Cmutex:0x2425c0
<L>lwip_socket(PF_INET, TCP, 1) = SKT_4
<L>lwip_close(4)
<L>mutex D:0x2425c0
<L>lwip_close(SKT_4),tcp=0
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbEvent.c cbEvenNoteFun 92[m
[cbEvenNoteFun][ 100]LibEvent->eType-------------->LIB_EVENT_SESSION_STATUS

p2pSession[privilege=0,status=1,peerAddr=]
-------------->SESSION_CONNECTED_BY_P2P
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_USRCHK

WAR Multicast delivery timeout.
firstRTT=22,srtt=176
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]

VIDEO_PARAM_TYPE_RESOLUTION
sp0828 not support update venc
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[7,210]

<TODO>VIDEO_PARAM_TYPE_BITRATE
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917113
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;40;32mDebug: VVV_FLASH_Set 325 new timezone=3600
[0msync time
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917113,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]

VIDEO_PARAM_TYPE_RESOLUTION
sp0828 not support update venc
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[7,210]

<TODO>VIDEO_PARAM_TYPE_BITRATE
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917113
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917114,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]

VIDEO_PARAM_TYPE_RESOLUTION
sp0828 not support update venc
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[7,210]

<TODO>VIDEO_PARAM_TYPE_BITRATE
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917113
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917114,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]

VIDEO_PARAM_TYPE_RESOLUTION
sp0828 not support update venc
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[7,210]

<TODO>VIDEO_PARAM_TYPE_BITRATE
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917113
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917114,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_INF_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917114,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WIRED_GET

<TODO>NET_CTRL_TYPE_WIRED_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WLAN_PARAM_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_INFEX_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_A_PARAM_GET

<TODO>AV_CTRL_TYPE_A_PARAM_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=12]
[content=
Pn]
[needFree?:yes]

<TODO>unknow cmd:0x506e
[cbPassThough][ 467]free the content used memory=12

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=24]
[content=
PI]
[needFree?:yes]

<TODO>ptz unknow cmd
[cbPassThough][ 467]free the content used memory=24

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_STOP

AV_CTRL_TYPE_VID_STOP
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_AI_SET

<TODO>AV_CTRL_TYPE_AI_SET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_INF_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917115,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WIRED_GET

<TODO>NET_CTRL_TYPE_WIRED_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WLAN_PARAM_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_INFEX_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_A_PARAM_GET

<TODO>AV_CTRL_TYPE_A_PARAM_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=12]
[content=
Pn]
[needFree?:yes]

<TODO>unknow cmd:0x506e
[cbPassThough][ 467]free the content used memory=12

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=24]
[content=
PI]
[needFree?:yes]

<TODO>ptz unknow cmd
[cbPassThough][ 467]free the content used memory=24

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbEvent.c cbEvenNoteFun 92[m
[cbEvenNoteFun][ 100]LibEvent->eType-------------->LIB_EVENT_SESSION_STATUS

p2pSession[privilege=255,status=3,peerAddr=noneed]
-------------->SESSION_DISCONNECTED_BY_TIMEOUT
<L>lwip_close(3)
<L>mutex D:0x24a228
<L>lwip_close(SKT_3),tcp=0
sp0828 not support update bitrate
sp0828 not support update venc
<L>Cmutex:0
<L>Cmutex:0x2408c0
<L>lwip_socket(PF_INET, UDP, 0) = SKT_3
network interface: en (Default)
MTU: 1500
MAC: 38 0a 8d 47 2b 71 
FLAGS: UP LINK_UP ETHARP IGMP
ip address: 192.168.238.1
gw address: 192.168.238.1
net mask  : 255.255.255.0

network interface: lo
MTU: 0
MAC: 
FLAGS: UP LINK_UP
ip address: 127.0.0.1
gw address: 127.0.0.1
net mask  : 255.0.0.0

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbEvent.c cbEvenNoteFun 92[m
[cbEvenNoteFun][ 100]LibEvent->eType-------------->LIB_EVENT_SESSION_STATUS

p2pSession[privilege=0,status=1,peerAddr=]
-------------->SESSION_CONNECTED_BY_P2P
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_USRCHK

firstRTT=9,srtt=72
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917121
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917121,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=548]
[content=
]
[needFree?:yes]

<TODO>CMD_PUSHPARAM_SET
[cbPassThough][ 467]free the content used memory=548

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_INF_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917121,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WIRED_GET

<TODO>NET_CTRL_TYPE_WIRED_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WLAN_PARAM_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_INFEX_GET

WAR Multicast delivery timeout.
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917125
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917126,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]

VIDEO_PARAM_TYPE_RESOLUTION
sp0828 not support update venc
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[7,200]

<TODO>VIDEO_PARAM_TYPE_BITRATE
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_RECFILES_GET

hPageIndex:0 hPageSize:128
[0;32;31m<050417_201206 IpcCbSd.c:353>[msdcard not available
var record_name0=new Array();
var record_size0=new Array();
var record_num0=0;
var PageIndex=0;
var PageSize=0;
var RecordCount=0;
var PageCount=0;

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_PICFILES_GET

[_SdPicFilesGet][ 508]begin--get sdCard's photos files
searchCondition:pageIndex=0,pageSize=64

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_INF_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917126,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WIRED_GET

<TODO>NET_CTRL_TYPE_WIRED_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WLAN_PARAM_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_INFEX_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_A_PARAM_GET

<TODO>AV_CTRL_TYPE_A_PARAM_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=12]
[content=
Pn]
[needFree?:yes]

<TODO>unknow cmd:0x506e
[cbPassThough][ 467]free the content used memory=12

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=24]
[content=
PI]
[needFree?:yes]

<TODO>ptz unknow cmd
[cbPassThough][ 467]free the content used memory=24

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
mean_vol=4000
mean_vol=4100
ret[-1][errno:12][retry:0]---XqSckSendto
ret[-1][errno:12][retry:0]---XqSckSendto
ret[-1][errno:12][retry:0]---XqSckSendto
WAR Multicast delivery timeout.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

#38 21522662 17 Apr 2025 23:11

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #38
21522662 17 Apr 2025 23:11

very interesting. good work.

I've soldered flash to breakout and I have not needed to add any capacitors. .img flashed and verified OK
ADVERTISEMENT
#39 21522665 17 Apr 2025 23:19

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #39
21522665 17 Apr 2025 23:19

We need more testing with SDKs. It would be nice to have something booting.

Btw, there is an alternative. This project allows you to capture video stream without flashing: https://github.com/DavidVentura/cam-reverse
I will post a guide tomorrow. Still, I would like to flash this camera anyway.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#40 21522666 17 Apr 2025 23:22

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #40
21522666 17 Apr 2025 23:22

p.kaczmarek2 wrote:
This project allows you to capture video stream without flashing: https://github.com/DavidVentura/cam-reverse

indeed.

I too would rather see something from SDK working on this, even if no cam, just hello world.
#41 21522668 17 Apr 2025 23:24

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #41
21522668 17 Apr 2025 23:24

You can try building samples from this SDK as well. It's very simple with WSL. I'll help if you get stuck. Just install that extra stuff I mentioned earlier, or you will get misleading errors suggesting that SDK path is wrong.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#42 21522670 17 Apr 2025 23:27

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #42
21522670 17 Apr 2025 23:27

coolio. i need to repair a missing resistor first or switch to the other XF16 cam
ADVERTISEMENT
#43 21522674 17 Apr 2025 23:29

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #43
21522674 17 Apr 2025 23:29

Which resistor fell off?

On my side, I've already managed to connect Flash clip in reverse, but CH341 survived.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#44 21522679 17 Apr 2025 23:33

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #44
21522679 17 Apr 2025 23:33

this one
Helpful post

#45 21522680 17 Apr 2025 23:47

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (+1)

Helpful post
Post #45
21522680 17 Apr 2025 23:47

I see, a pull up resistor for hold pin.

Added after 8 [minutes]:

@divadiow you can also try it here, maybe check if it works with multiple cameras? Just let's stay on topic. That topic is for cam-reverse https://www.elektroda.com/rtvforum/topic4117962.html
And this topic (here) is for flashing new firmware.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#46 21522829 18 Apr 2025 09:19

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #46
21522829 18 Apr 2025 09:19

btw here's an updated import.xml for Neo based on the latest Asprogrammer chiplist.xml with an added entry for these what looks like GigaDevice clones in the A9.

GigaDevice = C8
A9 flash = C7

adds an additional 522 chips

NOR list before/after

and now our A9 detection

Attachments:

import.xml.zip (8.18 KB) You must be logged in to download this attachment.
#47 21522869 18 Apr 2025 09:57

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #47
21522869 18 Apr 2025 09:57

Is it from somewhere or did you add it yourself?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#48 21522871 18 Apr 2025 10:16

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #48
21522871 18 Apr 2025 10:16

ChatGPT conversion from chiplist.xml

Added after 4 [minutes]:

Not from anywhere. I got ChatGPT to do it then I added Gigadevice_CLONE entry

Added after 8 [minutes]:

I forgot it could be from ChipSourceTek, referenced in first post https://www.elektroda.com/rtvforum/topic4074636.html#21219273. might rename it.

Added after 5 [minutes]:

>>21522680

im getting 0.2 ohms for that missing resistor on second, identical, A9. is that right? too low to be correct?
#49 21522911 18 Apr 2025 10:35

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #49
21522911 18 Apr 2025 10:35

Disconnect battery?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#50 21522922 18 Apr 2025 11:04

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #50
21522922 18 Apr 2025 11:04

yes. of course

Added after 24 [minutes]:

ha. was consistently 0.2. now seems to be ~60k. If yours is still accessible would you mind checking at some point please?
#51 21522958 18 Apr 2025 11:09

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #51
21522958 18 Apr 2025 11:09

I have 100k there (with battery Disconnected)

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#52 21522966 18 Apr 2025 11:21

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #52
21522966 18 Apr 2025 11:21

ah ok ok. thanks.

Added after 8 [minutes]:

moving on. Here's boot log from my 2nd XF16 cam, which I'd actually never looked after at after delivery apart from to check MCU it came with.

Code: Text
Log in, to see the code

and straight to unsoldering to breakout board and Neo detection - not C74014 this time although flash chip is still labelled T25S80!

5E3214 / ZB25WD80 - dumped attached. (Detection is this with original Neo chip db and after import of additions from above chat)

Attachments:

neo_spi_5E3214_ZB25WD80.bin (1 MB) You must be logged in to download this attachment.
#53 21522975 18 Apr 2025 12:10

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #53
21522975 18 Apr 2025 12:10

new XF16 flashdumps folder in PR

Added after 41 [minutes]:

with your XR72 SDK demo I get this on first boot
Code: Text
Log in, to see the code

but then nothing on any boot after that
#54 21523055 18 Apr 2025 12:21

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #54
21523055 18 Apr 2025 12:21

That's very good, now why didn't I get this?

By the way, do you teste with batteries on?

Because.... they might keep device alive so it does not reboot or something...

What could:
Code: text Expand Select all Copy to clipboard
[img E] image_init():157, the image max size is invalid

mean? Maybe image size in header is wrong? Can we somehow read back image from XR chip to detect partitions format?

xr872_sdk\project\image_cfg\readme.md

> 《XRADIO_MKimage_Tool_User_Guide-CN》
Can we use mkImage to read existing image and dump data?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#55 21523061 18 Apr 2025 12:28

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #55
21523061 18 Apr 2025 12:28

p.kaczmarek2 wrote:
That's very good, now why didn't I get this?

unsure. did you maybe do a single power-on or something by accident then subsequent boots while watching TX were nothing, like mine?

p.kaczmarek2 wrote:
By the way, do you teste with batteries on?

battery always removed first before I start anything
#56 21523067 18 Apr 2025 12:58

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #56
21523067 18 Apr 2025 12:58

This "size is invalid" looks like a message from bootloader? But we've changed bootloader as well?

Added after 4 [minutes]:

xr872_sdk\project\image_cfg\image.cfg
Code: text Expand Select all Copy to clipboard
{ "magic" : "AWIH", "version" : "0.4", "OTA" : {"addr": "1024K", "size": "4K"}, #if (__CONFIG_OTA_POLICY == 0x01) "image" : {"max_size": "1020K", "xz_max_size": "600K"}, #else "image" : {"max_size": "1020K"}, #endif #if (defined(__CONFIG_WLAN)) #if (defined(__CONFIG_XIP) && defined(__CONFIG_PSRAM)) "count" : 7, #elif (defined(__CONFIG_XIP) || defined(__CONFIG_PSRAM)) "count" : 6, #else "count" : 5, #endif #else #if (defined(__CONFIG_XIP) && defined(__CONFIG_PSRAM)) "count" : 4, #elif (defined(__CONFIG_XIP) || defined(__CONFIG_PSRAM)) "count" : 3, #else "count" : 2, #endif #endif "section" :

max_size needs to be changed and then we recompile?

Added after 7 [minutes]:

Added after 2 [minutes]:

Here is 1020 in compiled binary:

In read:

Added after 10 [minutes]:

I changed here:

rebuild and

not perfect but change is seen... let me adjust other offsets to fit 880K

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#57 21523093 18 Apr 2025 13:01

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #57
21523093 18 Apr 2025 13:01

oh I get it. I see now where you got 880k from
#58 21523095 18 Apr 2025 13:03

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316
Helpful post? (0)

Post #58
21523095 18 Apr 2025 13:03

I moved stuff back:

almost

I wonder, will new binary now have 880 at ofs 48 decimal?

Added after 1 [minutes]:

Not yet, it's stuck with overlap:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#59 21523099 18 Apr 2025 13:09

divadiow divadiow

Level 38

Posts: 4839

Help: 420

Rate: 852
Topic author Helpful post? (0)

Post #59
21523099 18 Apr 2025 13:09

any help?

#60 21523102 18 Apr 2025 13:13

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14394

Help: 650

Rate: 12316

Post #60

21523102 18 Apr 2025 13:13

I settled on:


cfg string:
{
    "magic": "AWIH",
    "version": "0.4",
    "OTA": { "addr": "1024K", "size": "4K" },
    "image": { "max_size": "880K" },
    "count": 6,
    "section": [
        { "id": "0xa5ff5a00", "bin": "boot_40M.bin", "cert": "null", "flash_offs": "0K", "sram_offs": "0x00268000", "ep": "0x00268101", "attr": "0x1" },
        { "id": "0xa5fe5a01", "bin": "app.bin", "cert": "null", "flash_offs": "32K", "sram_offs": "0x00201000", "ep": "0x00201101", "attr": "0x1" },
        { "id": "0xa5fd5a02", "bin": "app_xip.bin", "cert": "null", "flash_offs": "76K", "sram_offs": "0xffffffff", "ep": "0xffffffff", "attr": "0x2" },
        { "id": "0xa5fa5a05", "bin": "wlan_bl.bin", "cert": "null", "flash_offs": "822K", "sram_offs": "0xffffffff", "ep": "0xffffffff", "attr": "0x1" },
        { "id": "0xa5f95a06", "bin": "wlan_fw.bin", "cert": "null", "flash_offs": "838K", "sram_offs": "0xffffffff", "ep": "0xffffffff", "attr": "0x1" },
        { "id": "0xa5f85a07", "bin": "wlan_sdd_40M.bin", "cert": "null", "flash_offs": "872K", "sram_offs": "0xffffffff", "ep": "0xffffffff", "attr": "0x1" },
        {}
    ]
}


generate image: xr_system.img

Generated hello demo has 880 at 48 ofs decimal:

Screenshot of XVI32 hex editor showing a binary file and an open Data Inspector window.

Added after 1 [minutes]:

Wait, so you can open existing dumps with that tool? That could be helpful.

I attach hello_demo image with 880 size at 48 decimal offset, can you run it?

Attachments:

hello_demo_image.zip (780.06 KB) You must be logged in to download this attachment.

Helpful post? Buy me a coffee.

Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Reply | New topic

Report a violation of the law

Topic summary

✨ The discussion focuses on a variation of the A9 mini Wi-Fi camera featuring the XF16 PB380EA6341 MCU, an 8Mbit SPI flash chip labeled T25S80 (likely from ChipSourceTek), and the XR872 SoC running the Skylark SDK. Attempts to read and dump the flash firmware using tools like Flashrom, NeoProgrammer, and ASProgrammer faced challenges due to unrecognized SPI IDs and unreliable read/write operations, especially when the flash chip was in-circuit. Desoldering the flash chip improved read/write reliability. The firmware strings indicate the use of an RTOS and the iLnkP2P protocol for communication. The XR872 SDK (version 2.0 and later 1.2.x) was explored for building and flashing demo applications, including a "hello world" example, which successfully booted on the hardware after flashing via UART using PhoenixMC. Flashing custom firmware requires careful handling of flash erase and protection bits, with some users experiencing verification errors and random write failures. The flash layout includes an AWIH header and OTA partitions, with OTA updates compressed by XZ, raising concerns about fitting OTA images into the 1MB flash. Hardware details such as the presence of a pull-up resistor on the flash hold pin and UART pin configurations (PB02/PB03) were examined. The community also discussed the compatibility of different flash chip sizes (1MB vs 2MB) and the impact on firmware booting and flashing. Some users successfully transplanted firmware to larger flash chips (2MB) to run custom firmware like OpenXR872 (OBK). The discussion includes references to related projects for video stream capture without flashing (cam-reverse) and the challenges of flashing and booting custom firmware on these devices. Overall, the thread provides detailed technical insights into hardware probing, firmware extraction, SDK usage, flashing procedures, and troubleshooting for the XF16-based A9 mini camera variant with XR872 SoC.
Generated by the language model.

FAQ

TL;DR: With 1MB stock flash, many XF16 A9 cameras can be dumped and restored over UART, and one contributor confirmed "OpenXR872 ... boots on 1mb flash" only after fixing the image layout. This FAQ helps XR872/XF16 camera owners back up firmware, understand AWIH partitions, fix PhoenixMC/UART issues, and avoid bad SPI-flash writes. [#21530564]

Why it matters: XF16 A9 cameras look identical externally, but small changes in flash size, OTA layout, console settings, and sensor wiring decide whether firmware boots, flashes, or bricks.

Method	What works best	Main strengths	Main failure mode
PhoenixMC over UART	Read/write on XF16/XR872 without opening some A9 units	No desoldering; can restore stock dumps	Custom builds may lose UART flashing after power cycle if console support is wrong
CH341A + SOIC8 clip	Quick first dump attempts	Cheap; widely available	In-circuit reads often return bad IDs like `1313` or `8E8029`
CH341A with desoldered flash	Most reliable SPI backup/restore	Stable verification; works with replacement chips	Some flash chips still fail erase/write unless decoupling is added
Bus Pirate	Usually poor choice here	Can talk SPI/UART	Backfeeds power and often fails chip detection

Key insight: The hardest XF16 problems were not caused by the XR872 core. They came from image layout, OTA header placement, console enablement, and fragile SPI flash behavior on specific 1MB chips.

Quick Facts

XF16 boot logs repeatedly report 240000000 Hz CPU, 40000000 Hz HF clock, and XRADIO Skylark SDK builds such as 1.2.0 Jun 20 2024 10:58:31 or 1.2.2 test builds, which makes the platform easy to fingerprint from UART alone. [#21219273]
The stock A9 XF16 camera flash is commonly 8 Mbit / 1 MB with IDs such as C74014 or 5E3214, while test replacements that booted OpenXR872 included 2 MB and even 64 Mbit chips. [#21522966]
UART flashing can work through the camera’s USB path on some XF16 A9 boards because RX/TX are routed through the USB connector traces; contributors built simple USB-TTL adapters from NodeMCU or CH340 hardware to exploit that. [#21528571]
The stock firmware exposes a local AP at 192.168.238.1/24, while OpenXR872 test builds used 192.168.51.1/24 or 192.168.4.1/24, so IP range alone can reveal whether you are in factory or custom firmware. [#21219273]
Confirmed XF16 camera-connector tracing mapped SDA/SCL to PA18/PA17, PCLK to PA08, MCLK to PA09, HSYNC to PA10, VSYNC to PA11, and DVP data lines across PA00–PA07. [#21732686]

How can I dump and restore firmware on an XF16 A9 minicam with a T25S80 or C74014 SPI flash chip using a CH341A, clip, or PhoenixMC over UART?

You can dump and restore XF16 firmware either over SPI or over UART. 1. For SPI, clip or desolder the 8-pin flash, then read it with a CH341A in NeoProgrammer, ASProgrammer, or EasyFlasher. 2. For UART, connect through the XF16 USB-routed RX/TX path and use PhoenixMC to read or flash without opening some cameras. 3. Always verify the dump and keep at least one known-good stock backup before testing OpenXR872. One contributor confirmed they clipped directly onto the flash and did not need reset mode first. [#21278253]

Why do some XF16 A9 cameras report strange SPI flash IDs like 1313, 8E8029, C74014, or 5E3214 when reading the flash in-circuit?

Those odd IDs usually mean the in-circuit SPI read is unstable, not that the chip is truly changing identity. The thread showed 1313, 8E8029, and then stable C74014 on the same 1MB camera, while a desoldered read later became consistent and verified correctly. Shared power rails, leakage from the rest of the board, bad clip contact, and marginal CH341A supply decoupling all caused false IDs. A clean off-board read or UART dump was much more trustworthy than an in-circuit first pass. [#21522287]

What is the AWIH header in XR872/XF16 firmware dumps, and how can it help identify image sections like boot, app, app_xip, and wlan_fw?

"AWIH is a firmware image header that marks XR/XF system images, stores image metadata, and helps separate boot, app, XIP, and WLAN sections." In this thread, contributors matched AWIH-tagged section IDs such as 0xa5ff5a00, 0xa5fe5a01, 0xa5fd5a02, 0xa5fa5a05, and 0xa5f95a06 to boot_40M.bin, app.bin, app_xip.bin, wlan_bl.bin, and wlan_fw.bin. Searching a dump for those little-endian markers was enough to start slicing it for Ghidra or manual comparison. [#21589985]

What is iLnkP2P on these A9 and PTZ cameras, and how is it related to the YSX/YSXLite apps and cam-reverse tools?

"iLnkP2P is a peer-to-peer camera transport protocol that carries control and media traffic, identifies devices with UIDs, and lets mobile apps reach cameras through local AP mode or relay servers." These XF16 and PTZ cameras logged IpcP2pStart, device rtuid, and p2pID, then worked with YSX or YSXLite. The same protocol is what cam-reverse and related reversing notes target, including video extraction and CGI-style control. Multiple posts linked the protocol directly to the apps and to the reverse-engineering workflow. [#21353025]

Why did OpenXR872 boot on a 2MB flash chip but initially fail on the stock 1MB flash chip in the XF16 A9 camera?

It failed because the early image layout still assumed space beyond the stock 1MB boundary. The same OpenXR872 image booted when the original dump was transplanted to a 2MB flash chip, but not on the original 1MB flash. That exposed a layout problem rather than a CPU or sensor problem. The boot logs showed image max size is invalid and missing XIP section errors on the 1MB setup, while the 2MB chip could tolerate the oversized placement. [#21525075]

How was the 1MB XF16 boot issue solved by changing the OpenXR872 image configuration and OTA header placement?

The fix was to shrink the effective image layout for 1MB flash and move the OTA header out of the failing location. First, contributors rebuilt with max_size around 880K. Later they proved that a no-OTA image booted on 1MB stock flash, then refined the layout so the OTA header sat at 1020K with 4K size instead of the breaking 1024K arrangement. After that, 1MB XF16 boards booted OpenXR872 normally. As one post put it, “ota was the problem.” [#21530564]

Why does UART flashing through PhoenixMC stop working on some OpenXR872 builds after a power cycle, and how was PRJCONF_CONSOLE_EN involved in fixing it?

UART flashing stopped because the custom build no longer exposed the console command path that PhoenixMC uses after reboot. The breakthrough was enabling #define PRJCONF_CONSOLE_EN 1, which restored the upgrade command path and made Open comm OK ! survive fresh power cycles on 1MB XF16 boards. Before that fix, some builds could still be reflashed only until RAM state was lost, which made the problem look random. After the console option was re-enabled, PhoenixMC download-mode entry became reliable again. [#21536774]

CH341A vs Bus Pirate vs PhoenixMC over UART — which works best for reading and flashing XF16/XR872 camera firmware, and what problems should I expect with each?

PhoenixMC over UART is the best day-to-day method on XF16 once stock firmware or a console-enabled OpenXR872 build is present. CH341A is best for first-rescue backups, off-board writes, and recovery when UART entry is gone. Bus Pirate was the worst performer here: users reported non-detection, backfeeding power, and brief LED power-up when clipped in. CH341A also had pitfalls, especially with sensitive 1MB chips, but it still worked reliably after desoldering or after adding extra capacitance. [#21352083]

How do I enter XR872/XF16 download mode over UART without grounding PB02 or PB03, and what commands does PhoenixMC actually send?

You do it by speaking the stock console protocol, not by forcing strap pins low. PhoenixMC sends the text command upgrade, then repeated U sync bytes; a receptive firmware answers with OK and a BROM response. Later reversing tied that behavior to the XR command handler where cmd_upgrade_exec() reboots with PRCM_CPUA_BOOT_FROM_SYS_UPDATE. That is why stock firmware and console-enabled OpenXR872 can enter download mode over UART without grounding PB02 or PB03 at all. [#21534886]

What does the XRADIO Skylark SDK boot log tell me about an XF16 camera, including CPU clock, flash mode, sensor detection, and network behavior?

The boot log gives you the board fingerprint in one place. It exposes flash mode like [FD I]: mode: 0x4, CPU at 240000000 Hz, HF clock at 40000000 Hz, SDK build date, MAC addresses, sensor probe results such as detect sp0828, and AP behavior such as 192.168.238.1 on stock firmware. It also shows whether the camera starts in AP mode, tries STA mode, fails SD mount, or enters iLnkP2P. For XF16 debugging, the UART log is the fastest way to identify variant, sensor, and failure stage. [#21219273]

How can I build XR872 SDK demos under WSL, and which toolchain and 32-bit libraries are needed to compile hello_demo or jpeg examples successfully?

Builds under WSL worked after installing the older ARM GCC toolchain plus missing 32-bit runtime libraries. The thread used gcc-arm-embedded 4.9-2015-q2-update, then fixed execution errors by installing libc6-i386, lib32z1, and lib32stdc++6. Without those, WSL reported missing loader errors even when the path was correct. Once the 32-bit compatibility packages were installed, make lib and example builds such as hello_demo started compiling normally. [#21522159]

Why do some SPI flash chips like TJ25Q08M, T25S80, or 25QH32CHIG fail erase/write verification in NeoProgrammer or EasyFlasher unless extra capacitance or special handling is used?

These chips appear unusually sensitive to supply stability during SPI writes. The thread documented random verify errors, partial writes, and false erases on desoldered chips until extra capacitance was added directly on the CH341A setup; after that, the same chip verified cleanly. One test with a 25QH32CHIG failed repeatedly, then passed once a capacitor was added across the supply. Some users also had to experiment with protection-register handling, but the strongest repeated fix was better decoupling on the programmer side. [#21709832]

How can I trace the 18-pin FFC camera connector on an XF16 A9 board to map SDA, SCL, DVP data pins, MCLK, HSYNC, VSYNC, and PCLK to XR872 GPIOs?

The cleanest method is continuity tracing plus a pin-toggle test firmware. On the confirmed XF16 A9 mapping, pin 2 is SDA on PA18, pin 3 is SCL on PA17, pin 13 is MCLK on PA09, pin 12 is HSYNC on PA10, pin 11 is VSYNC on PA11, pin 15 is PCLK on PA08, and DVP data runs from PA00–PA07. Contributors validated the map with an 18-pin FFC walker that pulsed each GPIO while a multimeter watched the connector. [#21732686]

Which camera sensors seem to be supported or referenced in XF16/XR872 firmware strings, and how can I start adapting drivers for parts like SP0828, GC0328C, GC0329, or HI0704?

The firmware strings reference many sensors, including ov9660, ov7740, sp2518, gc0310, gc0328, gc0329, hi0704, hi0708, and sp0828. Start by reusing initialization tables and SCCB/I2C setup from the closest supported driver, then confirm the actual sensor with ribbon markings or UART detection logs. For XF16 A9 specifically, sp0828 was repeatedly detected in stock logs, while separate posts confirmed useful initialization arrays existed for hi704-class parts. That makes driver adaptation a sensor-data problem more than a core XR872 problem. [#21547719]

How can I split or parse a stock XF16 firmware dump into PhoenixMC-style partitions for reverse engineering in Ghidra, and where does mkimage fit into that process?

Use the AWIH section markers and the XR image config as your map, then reverse from there. Search the dump for little-endian IDs like 005affa5, 015afea5, 025afda5, 055afaa5, and 065af9a5 to locate boot, app, app_xip, wlan_bl, and wlan_fw boundaries. The SDK’s mkimage.exe is the packer that assembles those partitions into one AWIH image, so it is the right binary to study if you want PhoenixMC-style slicing for Ghidra. The thread specifically identified mkimage.exe as the image-creation step. [#21587062]

Generated by the language model.