Exploring A9 Minicam Variation: XF16 PB380EA6341 MCU, T25S80 SPI Flash, XR872, Skylark SDK

divadiow 11460 233

#31 21522401 17 Apr 2025 18:20

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Helpful post? (0)

Post #31
21522401 17 Apr 2025 18:20

NOTE: My chip is directly on CH341 daughter board, no clip used. I desoldered it.

SREG in Neo Programmer:
Code: text Expand Select all Copy to clipboard
Old protection Register: 00000000(0x00), New protection Register: 00000000(0x00), Old protection Register: 00000000(0x00), New protection Register: 00000000(0x00), Old protection Register: 00000000(0x00), New protection Register: 00000000(0x00), Current programmer: CH341 Black Status register: 00000000(0x00)

When I try to flash back what I read outside circuit (before first write attempt):

Then, when I do reaD:

So it's a write problem.

Do you get the same? First 0x43 bytes written or so?

Added after 46 [seconds]:

Second attempt - it wrote up to 0x130 or so:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#32 21522405 17 Apr 2025 18:36

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #32
21522405 17 Apr 2025 18:36

Yes. Same behaviour so far. I've not yet had time to desolder chip to attack it off the camera PCB. Asprogrammer appears to have better SREG reader..

Added after 5 [minutes]:

p.kaczmarek2 wrote:
Do you get the same? First 0x43 bytes written or so?

Actually, my read back hasn't been obvious that it wrote some bytes. Maybe you're getting a clearer picture with chip on breakout board. I'll do that soon
#33 21522451 17 Apr 2025 20:03

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #33
21522451 17 Apr 2025 20:03

I'm trying with custom C code to write pages:

I have no idea, why so many errors? At random places? It's literally flash chip sitting on CH341 daughter board.

Added after 2 [minutes]:

Ok it stuck totally now:

Added after 7 [minutes]:

Wait, I think I may be onto something:

Added after 2 [minutes]:

Haha, I didn't expect it to actually work, but it works.

I

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#34 21522483 17 Apr 2025 20:10

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #34
21522483 17 Apr 2025 20:10

what did you do?
#35 21522488 17 Apr 2025 20:23

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #35
21522488 17 Apr 2025 20:23

I'm still testing because I would not like to fool myself, and it may be a fluke, but here is what I did directly before getting correct write/verify:

Added after 8 [minutes]:

It seems I managed to write back original flash:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#36 21522499 17 Apr 2025 20:23

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #36
21522499 17 Apr 2025 20:23

nice nice. 🥁 drum roll 🥁... does the xr872 demo image boot?

#37 21522502 17 Apr 2025 21:15

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Post #37

21522502 17 Apr 2025 21:15

I flashed back original image and it seem to boot. More tests to come. I hope the clip will work now... otherwise i will have to desolder with each try.

Added after 51 [minutes]:

I'm afraid I get no UART output on custom firmware.

On a bright side, I've flashed original dump to 2MB flash chip, and look:


[bl ERR] main():629, build:20:38:52
use default flash chip mJedec 0x0
[FD I]: mode: 0x4, freq: 48000000Hz, drv: 0
[0;32;31m-------------->unknow flash ID 0x1540C8[m

PasswoPMA: mode select:e

wlan information ===================================================
firmware:
    version : R-XR_C10.08.52.64_01.80 Jul  6 2019 20:05:10-P01.46-R
    buffer  : 12
driver:
    version : XR_V02.05
====================================================================

PMA: wlan mode:a

platform information ===============================================
XRADIO Skylark SDK 1.2.0 Oct 17 2024 10:39:50

sram heap space [0x21fc70, 0x25fc00), total size 262032 Bytes
cpu  clock 240000000 Hz
HF   clock  40000000 Hz

sdk option:
    XIP           : enable
    INT LF OSC    : enable

mac address:
    efuse         : 18:9e:2d:81:89:ce
    in use        : 38:0a:8d:47:2b:71
====================================================================

StartupState:0
[0;32;31m<-500119_192428 rt_res.c:111>[mres error filenum:-1 001E0000
wait id tools
gpio_grp=0,gpio_bit=21
led drv init
check vol
[mthread]Create task:vbat(stack:2048),prio:3,ret:0 
XXXX task:vbat
[ERR] __mci_irq_handler,575 raw_int:100 err!
[ERR] SDC err, cmd 8,  RTO
[ERR] sdc 402 abnormal status: RespErr
[ERR] int err 100
[ERR] __mci_irq_handler,575 raw_int:100 err!
[ERR] SDC err, cmd 55,  RTO
[ERR] sdc 402 abnormal status: RespErr
[ERR] int err 100
[ERR] __mci_irq_handler,575 raw_int:100 err!
[ERR] SDC err, cmd 55,  RTO
[ERR] sdc 402 abnormal status: RespErr
[ERR] int err 100
[ERR] __mci_irq_handler,575 raw_int:100 err!
[ERR] SDC err, cmd 55,  RTO
[ERR] sdc 402 abnormal status: RespErr
[ERR] int err 100
[ERR] __mci_irq_handler,575 raw_int:100 err!
[ERR] SDC err, cmd 55,  RTO
[ERR] sdc 402 abnormal status: RespErr
[ERR] int err 100
[FS ERR] fs_ctrl_mount():102, mmc scan fail
[0;32;31m<-500119_192433 rt_sd_dev.c:264>[mSD File System initialzation failed! errno
[mthread]Create task:sdcardth(stack:2048),prio:3,ret:0 
XXXX task:sdcardth
err cmd:use_fw_rate_policy
vif=0, rts_threshold = 3000
ssid is NULL. AP 
<wifi>lpdtim:10, lplis:10
[mthread]Create task:wifitask(stack:4096),prio:3,ret:0 
XXXX task:wifitask
[XRADIO_INTERNAL_CODEC] AMIC set volume Level-[7]
[XRADIO_INTERNAL_CODEC] AMIC set volume Gain-[39]
wifi task run
rtuid:BATA-825001-IRMCB1N,HQLBAA
en1: CTRL-EVENT-TERMINATING 
WAR join_status:0
mean_vol=4200

wlan information ===================================================
firmware:
    version : R-XR_C10.08.52.64_01.80 Jul  6 2019 20:05:10-P01.46-R
    buffer  : 12
driver:
    version : XR_V02.05
====================================================================

interface name: en1
Using interface en1 with hwaddr 38:0a:8d:47:2b:71 and ssid "AP-XRADIO"
[XRADIO_INTERNAL_CODEC] AMIC set volume Gain-[39]
[XRADIO_INTERNAL_CODEC] LINEIN set volume Level-[1]
[XRADIO_INTERNAL_CODEC] AUDIO_IN_DEV_ALL set volume Gain-[0]
[XRADIO_INTERNAL_CODEC] Route(cap): amic Enable
en1: interface state UNINITIALIZED->ENABLED
en1: AP-ENABLED 
en1: AP-DISABLED 
[net INF] msg <wlan connected>
[net INF] netif is link up
[net INF] bring up netif
[net INF] netif (IPv4) is up
[net INF] address: 192.168.238.1
[net INF] gateway: 192.168.238.1
[net INF] netmask: 255.255.255.0
WLAN CONNECTED
err cmd:use_fw_rate_policy
vif=0, rts_threshold = 3000
vif0, AP/GO mode THROTTLE=38
[net INF] msg <network up>
NETWORK UP
<L>Cmutex:0
<L>Cmutex:0x229e40
<L>lwip_socket(PF_INET, UDP, 17) = SKT_0
en1: interface state ENABLED->DISABLED
[net INF] msg <wlan disconnected>
[net INF] netif is link down
WLAN DISCONNECTED
<L>Cmutex:0
<L>Cmutex:0x226f78
<L>lwip_socket(PF_INET, UDP, 17) = SKT_1
Using interface en1 with hwaddr 38:0a:8d:47:2b:71 and ssid "BATA825001CKETR"
[0;32;31m<010701_000000 rtb_av_api.c:872>[mdetect sensor error
OV9660 get chip id wrong 0xff
OV9660  Init error!!
[CAMERA ERR] HAL_CAMERA_Init():373, sensor config fail
[0;32;31m<010701_000001 rtb_av_api.c:1284>[mHAL_CAMERA_Init error, -1
[0;32;31m<010701_000001 rtb_av_api.c:2024>[mmedia not init
[mthread]Create task:thdImage(stack:2048),prio:3,ret:0 
XXXX task:thdImage
[mthread]Create task:RT_REC(stack:2048),prio:3,ret:0 
XXXX task:RT_REC
[mthread]Create task:MD_TH(stack:2048),prio:3,ret:0 
XXXX task:MD_TH
[mthread]Create task:p2plis(stack:10240),prio:3,ret:0 
XXXX task:p2plis
[mthread]Create task:CameraTest(stack:2048),prio:3,ret:0 
XXXX task:CameraTest
[mthread]Create task:NetCheck(stack:2048),prio:3,ret:0 
XXXX task:NetCheck
set br:-1--1
set ircut color
{0xC8,0x06},
/camera_test.txt does not exist!
[mthread]vvvthread CameraTest, tid:2184488 EXIT
[mthread]vvvthread NetCheck, tid:2183528 EXIT
en1: interface state DISABLED->ENABLED
en1: AP-ENABLED 
[net INF] msg <wlan connected>
[mthread]vvvthread thdImage, tid:2184348 EXIT
lednum:0
--drvled_flash :(0,1,5,5,1,5,5)
vif0, AP/GO mode THROTTLE=38
[net INF] netif is link up
[net INF] netif is already up
WLAN CONNECTED
err cmd:use_fw_rate_policy
vif=0, rts_threshold = 3000
<RTW>WiFi ap start ok:BATA825001CKETR, 0, 11
wifi task exit
[mthread]vvvthread wifitask, tid:2184992 EXIT
[IpcP2pStart][  83]p2p starte,bP2pStarted=[0]

rtuid:BATA-825001-IRMCB1N
p2pID:BATA-825001-CKETR
DataRW_Init bufferSize=32
<L>lwip_close(0)
<L>lwip_close(0)
<L>mutex D:0x229e40
<L>lwip_close(SKT_0),tcp=0
Success[0]--IlnkModP2pStart
IpcSysInit:0
[mthread]vvvthread p2plis, tid:2186396 EXIT
[os E] OS_MutexLock():65, handle 0
semaphore not initialized at line 448 in src/api/tcpip.c
<L>Cmutex:0
<L>Cmutex:0x236680
netconn state error at line 1132 in src/api/api_msg.c
<L>Cmutex:0
<L>Cmutex:0x236540
<L>lwip_socket(PF_INET, UDP, 0) = SKT_0
<L>lwip_socket(PF_INET, UDP, 17) = SKT_2
<L>Cmutex:0
<L>Cmutex:0x2363f8
<L>lwip_socket(PF_INET, UDP, 0) = SKT_3
network interface: en (Default)
MTU: 1500
MAC: 38 0a 8d 47 2b 71 
FLAGS: UP LINK_UP ETHARP IGMP
ip address: 192.168.238.1
gw address: 192.168.238.1
net mask  : 255.255.255.0

network interface: lo
MTU: 0
MAC: 
FLAGS: UP LINK_UP
ip address: 127.0.0.1
gw address: 127.0.0.1
net mask  : 255.0.0.0

Camera works on 2MB flash chip with YSXLite App:


IpcP2pStart][  83]p2p starte,bP2pStarted=[0]

rtuid:BATA-825001-IRMCB1N
p2pID:BATA-825001-CKETR
DataRW_Init bufferSize=32
<L>lwip_close(0)
<L>lwip_close(0)
<L>mutex D:0x22a0e8
<L>lwip_close(SKT_0),tcp=0
Success[0]--IlnkModP2pStart
IpcSysInit:0
[mthread]vvvthread p2plis, tid:2186396 EXIT
[os E] OS_MutexLock():65, handle 0
semaphore not initialized at line 448 in src/api/tcpip.c
<L>Cmutex:0
<L>Cmutex:0x244268
netconn state error at line 1132 in src/api/api_msg.c
<L>Cmutex:0
<L>Cmutex:0x24a0e8
<L>lwip_socket(PF_INET, UDP, 0) = SKT_0
<L>lwip_socket(PF_INET, UDP, 17) = SKT_2
<L>Cmutex:0
<L>Cmutex:0x24a228
<L>lwip_socket(PF_INET, UDP, 0) = SKT_3
network interface: en (Default)
MTU: 1500
MAC: 38 0a 8d 47 2b 71 
FLAGS: UP LINK_UP ETHARP IGMP
ip address: 192.168.238.1
gw address: 192.168.238.1
net mask  : 255.255.255.0

network interface: lo
MTU: 0
MAC: 
FLAGS: UP LINK_UP
ip address: 127.0.0.1
gw address: 127.0.0.1
net mask  : 255.0.0.0

mean_vol=4100
xr_newassoc(): link_id:0 mac:fc:02:96:13:e2:2b
en1: STA fc:02:96:13:e2:2b IEEE 802.11: associated
en1: AP-STA-CONNECTED fc:02:96:13:e2:2b
<L>Cmutex:0
<L>Cmutex:0x2425c0
<L>lwip_socket(PF_INET, TCP, 1) = SKT_4
<L>lwip_close(4)
<L>mutex D:0x2425c0
<L>lwip_close(SKT_4),tcp=0
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbEvent.c cbEvenNoteFun 92[m
[cbEvenNoteFun][ 100]LibEvent->eType-------------->LIB_EVENT_SESSION_STATUS

p2pSession[privilege=0,status=1,peerAddr=]
-------------->SESSION_CONNECTED_BY_P2P
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_USRCHK

WAR Multicast delivery timeout.
firstRTT=22,srtt=176
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]

VIDEO_PARAM_TYPE_RESOLUTION
sp0828 not support update venc
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[7,210]

<TODO>VIDEO_PARAM_TYPE_BITRATE
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917113
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;40;32mDebug: VVV_FLASH_Set 325 new timezone=3600
[0msync time
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917113,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]

VIDEO_PARAM_TYPE_RESOLUTION
sp0828 not support update venc
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[7,210]

<TODO>VIDEO_PARAM_TYPE_BITRATE
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917113
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917114,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]

VIDEO_PARAM_TYPE_RESOLUTION
sp0828 not support update venc
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[7,210]

<TODO>VIDEO_PARAM_TYPE_BITRATE
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917113
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917114,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]

VIDEO_PARAM_TYPE_RESOLUTION
sp0828 not support update venc
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[7,210]

<TODO>VIDEO_PARAM_TYPE_BITRATE
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917113
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917114,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_INF_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917114,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WIRED_GET

<TODO>NET_CTRL_TYPE_WIRED_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WLAN_PARAM_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_INFEX_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_A_PARAM_GET

<TODO>AV_CTRL_TYPE_A_PARAM_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=12]
[content=
Pn]
[needFree?:yes]

<TODO>unknow cmd:0x506e
[cbPassThough][ 467]free the content used memory=12

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=24]
[content=
PI]
[needFree?:yes]

<TODO>ptz unknow cmd
[cbPassThough][ 467]free the content used memory=24

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_STOP

AV_CTRL_TYPE_VID_STOP
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_AI_SET

<TODO>AV_CTRL_TYPE_AI_SET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_INF_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917115,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WIRED_GET

<TODO>NET_CTRL_TYPE_WIRED_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WLAN_PARAM_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_INFEX_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_A_PARAM_GET

<TODO>AV_CTRL_TYPE_A_PARAM_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=12]
[content=
Pn]
[needFree?:yes]

<TODO>unknow cmd:0x506e
[cbPassThough][ 467]free the content used memory=12

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=24]
[content=
PI]
[needFree?:yes]

<TODO>ptz unknow cmd
[cbPassThough][ 467]free the content used memory=24

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbEvent.c cbEvenNoteFun 92[m
[cbEvenNoteFun][ 100]LibEvent->eType-------------->LIB_EVENT_SESSION_STATUS

p2pSession[privilege=255,status=3,peerAddr=noneed]
-------------->SESSION_DISCONNECTED_BY_TIMEOUT
<L>lwip_close(3)
<L>mutex D:0x24a228
<L>lwip_close(SKT_3),tcp=0
sp0828 not support update bitrate
sp0828 not support update venc
<L>Cmutex:0
<L>Cmutex:0x2408c0
<L>lwip_socket(PF_INET, UDP, 0) = SKT_3
network interface: en (Default)
MTU: 1500
MAC: 38 0a 8d 47 2b 71 
FLAGS: UP LINK_UP ETHARP IGMP
ip address: 192.168.238.1
gw address: 192.168.238.1
net mask  : 255.255.255.0

network interface: lo
MTU: 0
MAC: 
FLAGS: UP LINK_UP
ip address: 127.0.0.1
gw address: 127.0.0.1
net mask  : 255.0.0.0

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbEvent.c cbEvenNoteFun 92[m
[cbEvenNoteFun][ 100]LibEvent->eType-------------->LIB_EVENT_SESSION_STATUS

p2pSession[privilege=0,status=1,peerAddr=]
-------------->SESSION_CONNECTED_BY_P2P
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_USRCHK

firstRTT=9,srtt=72
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917121
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917121,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=548]
[content=
]
[needFree?:yes]

<TODO>CMD_PUSHPARAM_SET
[cbPassThough][ 467]free the content used memory=548

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_INF_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917121,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WIRED_GET

<TODO>NET_CTRL_TYPE_WIRED_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WLAN_PARAM_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_INFEX_GET

WAR Multicast delivery timeout.
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_SET

timeParam.now:1744917125
timeParam.tz.timeZoneId:-3600
timeParam.tz.ntpEnable:0
timeParam.tz.dayLight:0
timeParam.tz.ntpSvr:time.windows.com
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917126,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]

VIDEO_PARAM_TYPE_RESOLUTION
sp0828 not support update venc
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET

[_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[7,200]

<TODO>VIDEO_PARAM_TYPE_BITRATE
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_RECFILES_GET

hPageIndex:0 hPageSize:128
[0;32;31m<050417_201206 IpcCbSd.c:353>[msdcard not available
var record_name0=new Array();
var record_size0=new Array();
var record_num0=0;
var PageIndex=0;
var PageSize=0;
var RecordCount=0;
var PageCount=0;

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_PICFILES_GET

[_SdPicFilesGet][ 508]begin--get sdCard's photos files
searchCondition:pageIndex=0,pageSize=64

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_INF_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_TIME_GET

[_SysTimeGet][ 215]now=1744917126,en=0,ntpsvr=time.windows.com,tzone=-3600
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_GET

get ircut dayNight=2
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WIRED_GET

<TODO>NET_CTRL_TYPE_WIRED_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbNet.c cbNetCtrlFun 242[m
[cbNetCtrlFun][ 252]NetCtrl->ctrlType-------------->NET_CTRL_TYPE_WLAN_PARAM_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSd.c cbSdCtrlFun 729[m
[cbSdCtrlFun][ 737]SdCtrl->ctrlType-------------->SD_CTRL_TYPE_INFEX_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_A_PARAM_GET

<TODO>AV_CTRL_TYPE_A_PARAM_GET
[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475[m
[cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_OPR_GET

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=12]
[content=
Pn]
[needFree?:yes]

<TODO>unknow cmd:0x506e
[cbPassThough][ 467]free the content used memory=12

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbPassThrough.c cbPassThough 435[m
[cbPassThough][ 443]handle[0]type[0]
[len=24]
[content=
PI]
[needFree?:yes]

<TODO>ptz unknow cmd
[cbPassThough][ 467]free the content used memory=24

[0;32;31m ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302[m
[cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START

AV_CTRL_TYPE_VID_START
mean_vol=4000
mean_vol=4100
ret[-1][errno:12][retry:0]---XqSckSendto
ret[-1][errno:12][retry:0]---XqSckSendto
ret[-1][errno:12][retry:0]---XqSckSendto
WAR Multicast delivery timeout.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

#38 21522662 17 Apr 2025 23:11

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #38
21522662 17 Apr 2025 23:11

very interesting. good work.

I've soldered flash to breakout and I have not needed to add any capacitors. .img flashed and verified OK
#39 21522665 17 Apr 2025 23:19

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #39
21522665 17 Apr 2025 23:19

We need more testing with SDKs. It would be nice to have something booting.

Btw, there is an alternative. This project allows you to capture video stream without flashing: https://github.com/DavidVentura/cam-reverse
I will post a guide tomorrow. Still, I would like to flash this camera anyway.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#40 21522666 17 Apr 2025 23:22

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #40
21522666 17 Apr 2025 23:22

p.kaczmarek2 wrote:
This project allows you to capture video stream without flashing: https://github.com/DavidVentura/cam-reverse

indeed.

I too would rather see something from SDK working on this, even if no cam, just hello world.
#41 21522668 17 Apr 2025 23:24

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #41
21522668 17 Apr 2025 23:24

You can try building samples from this SDK as well. It's very simple with WSL. I'll help if you get stuck. Just install that extra stuff I mentioned earlier, or you will get misleading errors suggesting that SDK path is wrong.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#42 21522670 17 Apr 2025 23:27

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #42
21522670 17 Apr 2025 23:27

coolio. i need to repair a missing resistor first or switch to the other XF16 cam
ADVERTISEMENT
#43 21522674 17 Apr 2025 23:29

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #43
21522674 17 Apr 2025 23:29

Which resistor fell off?

On my side, I've already managed to connect Flash clip in reverse, but CH341 survived.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#44 21522679 17 Apr 2025 23:33

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #44
21522679 17 Apr 2025 23:33

this one
Helpful post

#45 21522680 17 Apr 2025 23:47

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Helpful post
Post #45
21522680 17 Apr 2025 23:47

I see, a pull up resistor for hold pin.

Added after 8 [minutes]:

@divadiow you can also try it here, maybe check if it works with multiple cameras? Just let's stay on topic. That topic is for cam-reverse https://www.elektroda.com/rtvforum/topic4117962.html
And this topic (here) is for flashing new firmware.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#46 21522829 18 Apr 2025 09:19

divadiow divadiow

Level 34
Topic author Helpful post? (0)

Post #46
21522829 18 Apr 2025 09:19

btw here's an updated import.xml for Neo based on the latest Asprogrammer chiplist.xml with an added entry for these what looks like GigaDevice clones in the A9.

GigaDevice = C8
A9 flash = C7

adds an additional 522 chips

NOR list before/after

and now our A9 detection

Attachments:

import.xml.zip Download (8.18 KB)
#47 21522869 18 Apr 2025 09:57

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #47
21522869 18 Apr 2025 09:57

Is it from somewhere or did you add it yourself?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#48 21522871 18 Apr 2025 10:16

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #48
21522871 18 Apr 2025 10:16

ChatGPT conversion from chiplist.xml

Added after 4 [minutes]:

Not from anywhere. I got ChatGPT to do it then I added Gigadevice_CLONE entry

Added after 8 [minutes]:

I forgot it could be from ChipSourceTek, referenced in first post https://www.elektroda.com/rtvforum/topic4074636.html#21219273. might rename it.

Added after 5 [minutes]:

>>21522680

im getting 0.2 ohms for that missing resistor on second, identical, A9. is that right? too low to be correct?
#49 21522911 18 Apr 2025 10:35

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #49
21522911 18 Apr 2025 10:35

Disconnect battery?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#50 21522922 18 Apr 2025 11:04

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #50
21522922 18 Apr 2025 11:04

yes. of course

Added after 24 [minutes]:

ha. was consistently 0.2. now seems to be ~60k. If yours is still accessible would you mind checking at some point please?
#51 21522958 18 Apr 2025 11:09

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #51
21522958 18 Apr 2025 11:09

I have 100k there (with battery Disconnected)

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#52 21522966 18 Apr 2025 11:21

divadiow divadiow

Level 34
Topic author Helpful post? (0)

Post #52
21522966 18 Apr 2025 11:21

ah ok ok. thanks.

Added after 8 [minutes]:

moving on. Here's boot log from my 2nd XF16 cam, which I'd actually never looked after at after delivery apart from to check MCU it came with.

Code: Text
Log in, to see the code

and straight to unsoldering to breakout board and Neo detection - not C74014 this time although flash chip is still labelled T25S80!

5E3214 / ZB25WD80 - dumped attached. (Detection is this with original Neo chip db and after import of additions from above chat)

Attachments:

neo_spi_5E3214_ZB25WD80.bin Download (1 MB)
#53 21522975 18 Apr 2025 12:10

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #53
21522975 18 Apr 2025 12:10

new XF16 flashdumps folder in PR

Added after 41 [minutes]:

with your XR72 SDK demo I get this on first boot
Code: Text
Log in, to see the code

but then nothing on any boot after that
#54 21523055 18 Apr 2025 12:21

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Helpful post? (0)

Post #54
21523055 18 Apr 2025 12:21

That's very good, now why didn't I get this?

By the way, do you teste with batteries on?

Because.... they might keep device alive so it does not reboot or something...

What could:
Code: text Expand Select all Copy to clipboard
[img E] image_init():157, the image max size is invalid

mean? Maybe image size in header is wrong? Can we somehow read back image from XR chip to detect partitions format?

xr872_sdk\project\image_cfg\readme.md

> 《XRADIO_MKimage_Tool_User_Guide-CN》
Can we use mkImage to read existing image and dump data?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#55 21523061 18 Apr 2025 12:28

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #55
21523061 18 Apr 2025 12:28

p.kaczmarek2 wrote:
That's very good, now why didn't I get this?

unsure. did you maybe do a single power-on or something by accident then subsequent boots while watching TX were nothing, like mine?

p.kaczmarek2 wrote:
By the way, do you teste with batteries on?

battery always removed first before I start anything
ADVERTISEMENT
#56 21523067 18 Apr 2025 12:58

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Helpful post? (0)

Post #56
21523067 18 Apr 2025 12:58

This "size is invalid" looks like a message from bootloader? But we've changed bootloader as well?

Added after 4 [minutes]:

xr872_sdk\project\image_cfg\image.cfg
Code: text Expand Select all Copy to clipboard
{ "magic" : "AWIH", "version" : "0.4", "OTA" : {"addr": "1024K", "size": "4K"}, #if (__CONFIG_OTA_POLICY == 0x01) "image" : {"max_size": "1020K", "xz_max_size": "600K"}, #else "image" : {"max_size": "1020K"}, #endif #if (defined(__CONFIG_WLAN)) #if (defined(__CONFIG_XIP) && defined(__CONFIG_PSRAM)) "count" : 7, #elif (defined(__CONFIG_XIP) || defined(__CONFIG_PSRAM)) "count" : 6, #else "count" : 5, #endif #else #if (defined(__CONFIG_XIP) && defined(__CONFIG_PSRAM)) "count" : 4, #elif (defined(__CONFIG_XIP) || defined(__CONFIG_PSRAM)) "count" : 3, #else "count" : 2, #endif #endif "section" :

max_size needs to be changed and then we recompile?

Added after 7 [minutes]:

Added after 2 [minutes]:

Here is 1020 in compiled binary:

In read:

Added after 10 [minutes]:

I changed here:

rebuild and

not perfect but change is seen... let me adjust other offsets to fit 880K

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#57 21523093 18 Apr 2025 13:01

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #57
21523093 18 Apr 2025 13:01

oh I get it. I see now where you got 880k from
#58 21523095 18 Apr 2025 13:03

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #58
21523095 18 Apr 2025 13:03

I moved stuff back:

almost

I wonder, will new binary now have 880 at ofs 48 decimal?

Added after 1 [minutes]:

Not yet, it's stuck with overlap:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#59 21523099 18 Apr 2025 13:09

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #59
21523099 18 Apr 2025 13:09

any help?

#60 21523102 18 Apr 2025 13:13

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Post #60

21523102 18 Apr 2025 13:13

I settled on:


cfg string:
{
    "magic": "AWIH",
    "version": "0.4",
    "OTA": { "addr": "1024K", "size": "4K" },
    "image": { "max_size": "880K" },
    "count": 6,
    "section": [
        { "id": "0xa5ff5a00", "bin": "boot_40M.bin", "cert": "null", "flash_offs": "0K", "sram_offs": "0x00268000", "ep": "0x00268101", "attr": "0x1" },
        { "id": "0xa5fe5a01", "bin": "app.bin", "cert": "null", "flash_offs": "32K", "sram_offs": "0x00201000", "ep": "0x00201101", "attr": "0x1" },
        { "id": "0xa5fd5a02", "bin": "app_xip.bin", "cert": "null", "flash_offs": "76K", "sram_offs": "0xffffffff", "ep": "0xffffffff", "attr": "0x2" },
        { "id": "0xa5fa5a05", "bin": "wlan_bl.bin", "cert": "null", "flash_offs": "822K", "sram_offs": "0xffffffff", "ep": "0xffffffff", "attr": "0x1" },
        { "id": "0xa5f95a06", "bin": "wlan_fw.bin", "cert": "null", "flash_offs": "838K", "sram_offs": "0xffffffff", "ep": "0xffffffff", "attr": "0x1" },
        { "id": "0xa5f85a07", "bin": "wlan_sdd_40M.bin", "cert": "null", "flash_offs": "872K", "sram_offs": "0xffffffff", "ep": "0xffffffff", "attr": "0x1" },
        {}
    ]
}


generate image: xr_system.img

Generated hello demo has 880 at 48 ofs decimal:

Screenshot of XVI32 hex editor showing a binary file and an open Data Inspector window.

Added after 1 [minutes]:

Wait, so you can open existing dumps with that tool? That could be helpful.

I attach hello_demo image with 880 size at 48 decimal offset, can you run it?

Attachments:

hello_demo_image.zip Download (780.06 KB)

Helpful post? Buy me a coffee.

Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Reply | New topic

Report a violation of the law

Topic summary

The discussion focuses on a variation of the A9 mini Wi-Fi camera featuring the XF16 PB380EA6341 MCU, an 8Mbit SPI flash chip labeled T25S80 (likely from ChipSourceTek), and the XR872 SoC running the Skylark SDK. Attempts to read and dump the flash firmware using tools like Flashrom, NeoProgrammer, and ASProgrammer faced challenges due to unrecognized SPI IDs and unreliable read/write operations, especially when the flash chip was in-circuit. Desoldering the flash chip improved read/write reliability. The firmware strings indicate the use of an RTOS and the iLnkP2P protocol for communication. The XR872 SDK (version 2.0 and later 1.2.x) was explored for building and flashing demo applications, including a "hello world" example, which successfully booted on the hardware after flashing via UART using PhoenixMC. Flashing custom firmware requires careful handling of flash erase and protection bits, with some users experiencing verification errors and random write failures. The flash layout includes an AWIH header and OTA partitions, with OTA updates compressed by XZ, raising concerns about fitting OTA images into the 1MB flash. Hardware details such as the presence of a pull-up resistor on the flash hold pin and UART pin configurations (PB02/PB03) were examined. The community also discussed the compatibility of different flash chip sizes (1MB vs 2MB) and the impact on firmware booting and flashing. Some users successfully transplanted firmware to larger flash chips (2MB) to run custom firmware like OpenXR872 (OBK). The discussion includes references to related projects for video stream capture without flashing (cam-reverse) and the challenges of flashing and booting custom firmware on these devices. Overall, the thread provides detailed technical insights into hardware probing, firmware extraction, SDK usage, flashing procedures, and troubleshooting for the XF16-based A9 mini camera variant with XR872 SoC.
Summary generated by the language model.

FAQ

TL;DR: Moving the OTA header to 1 020 KB restores boot on 1 MB chips and keeps UART flashing functional (100 % success in tests) [Elektroda, divadiow, post #21530564] “HTTP OTA worked for me.” [Elektroda, insmod, post #21590642]

Why it matters: these tweaks stop A9/XF16 cameras from bricking after custom firmware uploads.

Quick Facts

• Flash sizes seen: 1 MB, 2 MB, 8 MB GD25Q64 [Elektroda, divadiow, post #21590664]
• Valid image markers (LE): 005AFFA5 boot, 015AFE A5 app, 025AFD A5 XIP etc. [Elektroda, divadiow, post #21589985]
• Safe UART baud for PhoenixMC: 921 600 bps, HW-reset mode ticked [Elektroda, p.kaczmarek2, post #21531441]
• OTA reserved: 4 KB starting 1 020 KB (1 MB flash) or 880 KB on 2 MB+ [Elektroda, insmod, post #21587276]
• Typical XR872 boot heap free: 262 kB SRAM, 240 MHz CPU [Elektroda, divadiow, post #21587381]

Which A9 mini-cams contain the XR872/XF16 MCU?

Units labelled “XF16 PB380EA6341” on the PCB and reporting XRADIO Skylark SDK 1.2.x at boot use the XR872 core [Elektroda, divadiow, post #21219273]

Why did early OpenXR872 builds fail on 1 MB flashes?

Images stored the OTA header at 1 024 KB, overlapping memory; bootloader rejected them. Relocating the header to 1 020 KB or removing OTA lets the 1 MB device start normally [Elektroda, insmod, post #21587276]

How can I slice a stock firmware dump into its parts?

Search the file for little-endian IDs: 005AFFA5 (boot), 015AFE A5 (app), 025AFD A5 (app_xip), 055AFAA5 (wlan_bl), 065AF9A5 (wlan_fw), 075AF8A5 (wlan_sdd) and cut at these offsets [Elektroda, divadiow, post #21589985]

Best way to back-up or restore flash without soldering?

Clip the SOIC-8 with a CH341A programmer; PhoenixMC UART also works if the camera still boots. A full 1 MB read takes ≈25 s at 921 600 bps [Elektroda, p.kaczmarek2, post #21522287]

What UART command puts the XR872 in download mode?

PhoenixMC sends the plain ASCII string “upgrade” followed by 50 ‘U’ characters. A responsive build echoes “OKBROM” and resets into the boot ROM [Elektroda, divadiow, post #21534886]

Why does UART flashing stop after power-cycle?

Builds compiled with PRJCONF_CONSOLE_EN 0 ignore the “upgrade” command after reboot; enabling the flag restores indefinite UART flashing capability [Elektroda, divadiow, post #21536774]

Is HTTP OTA functional?

Yes. On a 2 MB board an OTA image of 430 KB uploaded in 6 s and auto-rebooted successfully [Elektroda, divadiow, post #21590664]

Which camera sensors are referenced in stock code?

Strings list at least 18 types, e.g., GC0328, GC0329, HI0704, SP0828, OV7740 and SC101 [Elektroda, divadiow, post #21547719]

How do I map GPIOs on the 68-pin XF16?

Refer to XR872 Port A/B/C counts (24+22+13). Then trace each pad: PA21 drives the blue LED, PB02/PB03 are boot-select, PA06/PA07 = UART, PC pins unused on A9 board [Elektroda, p.kaczmarek2, post #21575973]

Edge case: camera stuck with red LED only?

Disconnect the Li-ion pack; some samples boot only on USB 5 V without battery load, then broadcast AP normally [Elektroda, p.kaczmarek2, post #21528163]

Statistic: how much heap is left after Wi-Fi joins?

On 1 MB flash build _xradios_30beb8223658 heap free stabilises at 254 kB after MQTT connect [Elektroda, divadiow, post #21587381]

How to flash via SPI when UART is dead?

Desolder the flash or use a Pomona clip and program with CH341A; identify chips like C74014 (TJ25Q08M) or GD25Q64 and write the full .img [Elektroda, divadiow, post #21530504]

Procedure: enable PWM on PA21 for status LED

In Web UI set Pin to PWM and choose channel 1. 2. Issue pwm 21 50 to set 50 % duty. 3. Save config, LED brightness now tracks PWM [Elektroda, divadiow, post #21587381]

Failure fact: what bricks XR806 boards?

Flashing pre-1.2.1 SDK images with DC-DC mode enabled on USB-C 5 V can fry the regulator; XR872 uses LDO by default, avoiding this issue [Elektroda, insmod, post #21587386]