logo elektroda
logo elektroda
X
logo elektroda

Exploring A9 Minicam Variation: XF16 PB380EA6341 MCU, T25S80 SPI Flash, XR872, Skylark SDK

divadiow 10506 232
ADVERTISEMENT
  • #91 21524804
    p.kaczmarek2
    Moderator Smart Home
    Ah, I see. Maybe I misunderstood. I was under the impression that you are flashing incorrect factory image. Strange.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #92 21524807
    divadiow
    Level 34  
    yes very weird. need someone else with an A9 to have a go.
  • #93 21524831
    p.kaczmarek2
    Moderator Smart Home
    I think I still have those two pads near the MCU shorted. The ones we suspected may be needed for bootloader. But it shouldn't change anything. And "Hello world" ran for you, right?
    Helpful post? Buy me a coffee.
  • #94 21524835
    divadiow
    Level 34  
    nope. nothing but factory runs for me
  • #95 21525069
    p.kaczmarek2
    Moderator Smart Home
    I remember that some time ago you reported you got this "invalid size" message:
    divadiow wrote:
    second bin gives me this again

    Code: Text
    Log in, to see the code

    Do you get anything like that on OBK port?

    Do you have any other flash chip? Can you check if original firmware and OBK would run from other flash chip? It should not matter, but still....
    Helpful post? Buy me a coffee.
  • #96 21525075
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    Do you get anything like that on OBK port?

    no output ever on OBK port or demos. only ever factory boots.

    p.kaczmarek2 wrote:
    Do you have any other flash chip? Can you check if original firmware and OBK would run from other flash chip? It should not matter, but still....

    yes. I have tried both 1mb flash chips from 2x A9 cams and I have just this second flashed your factory dump to a Boya 2mb chip and it boots. I am about to try OBK port to 2mb over uart to see if it's any different.

    first boot of your dump:

    Code: Text
    Log in, to see the code


    Added after 6 [minutes]:

    did you ever capture OBK boot log on your A9? I am curious about any CPU clock or crystal differences.

    My physical oscillator is 40 Mhz and I note this in the factory boot log for me

    Code: Text
    Log in, to see the code


    Added after 15 [minutes]:

    maybe nevermind. I see yours is the same from Hello, World demo boot log https://www.elektroda.com/rtvforum/topic4074636-60.html#21523195

    Added after 2 [minutes]:

    oh ffs. 2mb flash chip is fine.

    Screenshot of the OpenXR872 interface showing buttons labeled “Config,” “Restart,” “Launch Web Application,” and “About.”
    and OBK boot to AP

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • #97 21525105
    p.kaczmarek2
    Moderator Smart Home
    divadiow wrote:
    oh ffs. 2mb flash is fine.

    Are you saying that you transplanted flash to 2MB chip (other chip) and then OBK works? Well, it's not good, we were hoping to be able to run OBK out of the box...

    I've found another A9 camera, an old model, in the basement:
    A hand holding a KSGER T12-BC2 soldering tip, a black electronic component, and a small electronic module.
    I will check it in a moment
    Helpful post? Buy me a coffee.
  • #98 21525111
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    Are you saying that you transplanted flash to 2MB chip (other chip) and then OBK works?

    correct. 2mb chip soldered to A9 right now boots OpenXR872

    Close-up of a green printed circuit board with a visible black integrated circuit and copper traces.

    Added after 1 [minutes]:

    p.kaczmarek2 wrote:
    I've found another A9 camera, an old model, in the basement:

    maybe you have BK7252 after all if it's old..
  • ADVERTISEMENT
  • #99 21525131
    p.kaczmarek2
    Moderator Smart Home
    Then the question is why it's not working with original flash chip?

    My second camera is BK. It does not work with camera-reverse exploit:
    
    C:\Users\mike\Downloads>node bin.cjs http_server --config_file c.yml
    2025-04-20T08:24:15.641Z [info] Starting HTTP server on port 5000
    2025-04-20T08:24:15.658Z [info] Searching for devices on 192.168.1.1
    2025-04-20T08:24:15.662Z [debug] Received a PunchPkt message
    2025-04-20T08:24:15.665Z [info] Discovered camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:15.669Z [debug] Sending Drw Packet with id 0
    2025-04-20T08:24:15.677Z [debug] Removing 0 from pending
    2025-04-20T08:24:15.724Z [info] Logging in to camera BAT180823IOZRC
    2025-04-20T08:24:15.725Z [debug] Sending Drw Packet with id 1
    2025-04-20T08:24:15.727Z [debug] Sending Drw Packet with id 2
    2025-04-20T08:24:15.728Z [info] Camera BAT180823IOZRC is now ready to stream
    2025-04-20T08:24:16.170Z [debug] Resending packet 1 as 3
    2025-04-20T08:24:16.170Z [debug] Sending Drw Packet with id 3
    2025-04-20T08:24:16.173Z [debug] Resending packet 2 as 4
    2025-04-20T08:24:16.173Z [debug] Sending Drw Packet with id 4
    2025-04-20T08:24:16.177Z [debug] Removing 3 from pending
    2025-04-20T08:24:16.675Z [debug] Resending packet 4 as 5
    2025-04-20T08:24:16.675Z [debug] Sending Drw Packet with id 5
    2025-04-20T08:24:16.679Z [debug] Removing 5 from pending
    2025-04-20T08:24:18.666Z [debug] Received a PunchPkt message
    2025-04-20T08:24:18.666Z [info] Camera BAT180823IOZRC at 192.168.1.1 already discovered, ignoring
    2025-04-20T08:24:21.674Z [debug] Received a PunchPkt message
    2025-04-20T08:24:21.675Z [info] Camera BAT180823IOZRC at 192.168.1.1 already discovered, ignoring
    2025-04-20T08:24:21.782Z [warning] Camera BAT180823IOZRC timed out
    2025-04-20T08:24:21.782Z [info] Disconnected from camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:21.785Z [info] Camera BAT180823IOZRC disconnected
    2025-04-20T08:24:24.674Z [debug] Received a PunchPkt message
    2025-04-20T08:24:24.676Z [info] Discovered camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:24.683Z [debug] Sending Drw Packet with id 0
    2025-04-20T08:24:25.190Z [debug] Resending packet 0 as 1
    2025-04-20T08:24:25.191Z [debug] Sending Drw Packet with id 1
    2025-04-20T08:24:25.197Z [debug] Removing 1 from pending
    2025-04-20T08:24:27.467Z [info] Video stream requested for camera BAT180823IOZRC
    2025-04-20T08:24:28.473Z [info] Video stream closed for camera BAT180823IOZRC
    2025-04-20T08:24:30.368Z [warning] Camera BAT180823IOZRC timed out
    2025-04-20T08:24:30.368Z [info] Disconnected from camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:30.370Z [info] Camera BAT180823IOZRC disconnected
    2025-04-20T08:24:30.697Z [debug] Received a PunchPkt message
    2025-04-20T08:24:30.698Z [info] Discovered camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:30.708Z [debug] Sending Drw Packet with id 0
    2025-04-20T08:24:31.209Z [debug] Resending packet 0 as 1
    2025-04-20T08:24:31.211Z [debug] Sending Drw Packet with id 1
    2025-04-20T08:24:31.223Z [debug] Removing 1 from pending
    2025-04-20T08:24:36.432Z [warning] Camera BAT180823IOZRC timed out
    2025-04-20T08:24:36.433Z [info] Disconnected from camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:36.435Z [info] Camera BAT180823IOZRC disconnected
    2025-04-20T08:24:36.721Z [debug] Received a PunchPkt message
    2025-04-20T08:24:36.721Z [info] Discovered camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:36.732Z [debug] Sending Drw Packet with id 0
    2025-04-20T08:24:36.735Z [debug] Removing 0 from pending
    2025-04-20T08:24:39.546Z [info] Logging in to camera BAT180823IOZRC
    2025-04-20T08:24:39.547Z [debug] Sending Drw Packet with id 1
    2025-04-20T08:24:39.549Z [debug] Sending Drw Packet with id 2
    2025-04-20T08:24:39.550Z [info] Camera BAT180823IOZRC is now ready to stream
    2025-04-20T08:24:39.774Z [debug] Resending packet 1 as 3
    2025-04-20T08:24:39.774Z [debug] Sending Drw Packet with id 3
    2025-04-20T08:24:39.777Z [debug] Resending packet 2 as 4
    2025-04-20T08:24:39.778Z [debug] Sending Drw Packet with id 4
    2025-04-20T08:24:39.790Z [debug] Removing 3 from pending
    2025-04-20T08:24:40.279Z [debug] Resending packet 4 as 5
    2025-04-20T08:24:40.280Z [debug] Sending Drw Packet with id 5
    2025-04-20T08:24:40.285Z [debug] Removing 5 from pending
    2025-04-20T08:24:42.735Z [debug] Received a PunchPkt message
    2025-04-20T08:24:42.735Z [info] Camera BAT180823IOZRC at 192.168.1.1 already discovered, ignoring
    2025-04-20T08:24:45.693Z [warning] Camera BAT180823IOZRC timed out
    2025-04-20T08:24:45.694Z [info] Disconnected from camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:45.696Z [info] Camera BAT180823IOZRC disconnected
    2025-04-20T08:24:45.744Z [debug] Received a PunchPkt message
    2025-04-20T08:24:45.744Z [info] Discovered camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:45.749Z [debug] Sending Drw Packet with id 0
    2025-04-20T08:24:45.754Z [debug] Removing 0 from pending
    2025-04-20T08:24:48.876Z [info] Logging in to camera BAT180823IOZRC
    2025-04-20T08:24:48.876Z [debug] Sending Drw Packet with id 1
    2025-04-20T08:24:48.878Z [debug] Sending Drw Packet with id 2
    2025-04-20T08:24:48.879Z [info] Camera BAT180823IOZRC is now ready to stream
    2025-04-20T08:24:49.301Z [debug] Resending packet 1 as 3
    2025-04-20T08:24:49.302Z [debug] Sending Drw Packet with id 3
    2025-04-20T08:24:49.304Z [debug] Resending packet 2 as 4
    2025-04-20T08:24:49.304Z [debug] Sending Drw Packet with id 4
    2025-04-20T08:24:49.307Z [debug] Removing 3 from pending
    2025-04-20T08:24:49.813Z [debug] Resending packet 4 as 5
    2025-04-20T08:24:49.814Z [debug] Sending Drw Packet with id 5
    2025-04-20T08:24:49.818Z [debug] Removing 5 from pending
    2025-04-20T08:24:51.751Z [debug] Received a PunchPkt message
    2025-04-20T08:24:51.752Z [info] Camera BAT180823IOZRC at 192.168.1.1 already discovered, ignoring
    2025-04-20T08:24:54.752Z [debug] Received a PunchPkt message
    2025-04-20T08:24:54.752Z [info] Camera BAT180823IOZRC at 192.168.1.1 already discovered, ignoring
    2025-04-20T08:24:55.207Z [warning] Camera BAT180823IOZRC timed out
    2025-04-20T08:24:55.208Z [info] Disconnected from camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:55.211Z [info] Camera BAT180823IOZRC disconnected
    2025-04-20T08:24:57.757Z [debug] Received a PunchPkt message
    2025-04-20T08:24:57.758Z [info] Discovered camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:24:57.763Z [debug] Sending Drw Packet with id 0
    2025-04-20T08:24:58.274Z [debug] Resending packet 0 as 1
    2025-04-20T08:24:58.275Z [debug] Sending Drw Packet with id 1
    2025-04-20T08:24:58.284Z [debug] Removing 1 from pending
    2025-04-20T08:25:03.487Z [warning] Camera BAT180823IOZRC timed out
    2025-04-20T08:25:03.487Z [info] Disconnected from camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:25:03.490Z [info] Camera BAT180823IOZRC disconnected
    2025-04-20T08:25:03.767Z [debug] Received a PunchPkt message
    2025-04-20T08:25:03.768Z [info] Discovered camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:25:03.773Z [debug] Sending Drw Packet with id 0
    2025-04-20T08:25:03.781Z [debug] Removing 0 from pending
    2025-04-20T08:25:06.583Z [info] Logging in to camera BAT180823IOZRC
    2025-04-20T08:25:06.583Z [debug] Sending Drw Packet with id 1
    2025-04-20T08:25:06.585Z [debug] Sending Drw Packet with id 2
    2025-04-20T08:25:06.586Z [info] Camera BAT180823IOZRC is now ready to stream
    2025-04-20T08:25:06.593Z [debug] Removing 2 from pending
    2025-04-20T08:25:06.832Z [debug] Resending packet 1 as 3
    2025-04-20T08:25:06.832Z [debug] Sending Drw Packet with id 3
    2025-04-20T08:25:06.837Z [debug] Removing 3 from pending
    2025-04-20T08:25:09.776Z [debug] Received a PunchPkt message
    2025-04-20T08:25:09.777Z [info] Camera BAT180823IOZRC at 192.168.1.1 already discovered, ignoring
    2025-04-20T08:25:11.858Z [warning] Camera BAT180823IOZRC timed out
    2025-04-20T08:25:11.858Z [info] Disconnected from camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:25:11.860Z [info] Camera BAT180823IOZRC disconnected
    2025-04-20T08:25:12.790Z [debug] Received a PunchPkt message
    2025-04-20T08:25:12.791Z [info] Discovered camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:25:12.796Z [debug] Sending Drw Packet with id 0
    2025-04-20T08:25:12.799Z [debug] Removing 0 from pending
    2025-04-20T08:25:14.988Z [info] Logging in to camera BAT180823IOZRC
    2025-04-20T08:25:14.988Z [debug] Sending Drw Packet with id 1
    2025-04-20T08:25:14.991Z [debug] Sending Drw Packet with id 2
    2025-04-20T08:25:14.992Z [info] Camera BAT180823IOZRC is now ready to stream
    2025-04-20T08:25:14.995Z [debug] Removing 2 from pending
    2025-04-20T08:25:15.340Z [debug] Resending packet 1 as 3
    2025-04-20T08:25:15.340Z [debug] Sending Drw Packet with id 3
    2025-04-20T08:25:15.344Z [debug] Removing 3 from pending
    2025-04-20T08:25:18.785Z [debug] Received a PunchPkt message
    2025-04-20T08:25:18.785Z [info] Camera BAT180823IOZRC at 192.168.1.1 already discovered, ignoring
    2025-04-20T08:25:20.510Z [warning] Camera BAT180823IOZRC timed out
    2025-04-20T08:25:20.510Z [info] Disconnected from camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:25:20.512Z [info] Camera BAT180823IOZRC disconnected
    2025-04-20T08:25:21.790Z [debug] Received a PunchPkt message
    2025-04-20T08:25:21.791Z [info] Discovered camera BAT180823IOZRC at 192.168.1.1
    2025-04-20T08:25:21.796Z [debug] Sending Drw Packet with id 0
    2025-04-20T08:25:21.803Z [debug] Removing 0 from pending
    2025-04-20T08:25:23.756Z [info] Logging in to camera BAT180823IOZRC
    2025-04-20T08:25:23.756Z [debug] Sending Drw Packet with id 1
    2025-04-20T08:25:23.758Z [debug] Sending Drw Packet with id 2
    2025-04-20T08:25:23.759Z [info] Camera BAT180823IOZRC is now ready to stream
    2025-04-20T08:25:24.336Z [debug] Resending packet 1 as 3
    2025-04-20T08:25:24.336Z [debug] Sending Drw Packet with id 3
    2025-04-20T08:25:24.339Z [debug] Resending packet 2 as 4
    2025-04-20T08:25:24.340Z [debug] Sending Drw Packet with id 4
    2025-04-20T08:25:24.343Z [debug] Removing 3 from pending
    2025-04-20T08:25:24.847Z [debug] Resending packet 4 as 5
    2025-04-20T08:25:24.850Z [debug] Sending Drw Packet with id 5
    2025-04-20T08:25:24.858Z [debug] Removing 5 from pending
    2025-04-20T08:25:27.819Z [debug] Received a PunchPkt message
    2025-04-20T08:25:27.819Z [info] Camera BAT180823IOZRC at 192.168.1.1 already discovered, ignoring
    2025-04-20T08:25:29.888Z [warning] Camera BAT180823IOZRC timed out
    

    It's BK7252, do you happen to know the pinout? I can't find log output, but again, maybe flash port is different than log...
    Close-up of a green printed circuit board with visible electronic components and a PCB antenna.
    Close-up of a circuit board with electronic components, micro USB connector, and microSD slot.
    Printed circuit board with micro USB port, connector, and Li-Po battery attached.

    Added after 4 [minutes]:

    Looks like I have: https://github.com/daniel-dona/beken7252-opencam/issues/7

    Added after 35 [seconds]:

    BK7252UQN68

    Added after 7 [minutes]:


    Screenshot of the BK7231 Easy UART Flasher software during flash reading of a BK7231T chip.

    Added after 28 [seconds]:

    ok i will create separate topic for a9 bk7252

    Added after 6 [minutes]:

    false alarm, it didnt actually read...

    Added after 1 [minutes]:

    boot log:
    
    
    
     \ | /
    - RT -     Thread Operating System
     / | \     3.1.0 build May 14 2022
     2006 - 2018 Copyright by rt-thread team
    
    OSK Rev: R-3.0.22
    SDK Rev: 3.0.33
    
    [FUNC]rwnxl_init
    
    IP Rev: W4-3.0.33-P0
    
    [bk]tx_txdesc_flush
    
    [FUNC]calibration_main
    
    
    
    rfcali_mode:0
    
    
    
    tssi:b-125, g-115
    
    xtal_cali:25
    
    [FUNC]ps_init
    
    [FUNC]func_init_extended OVER!!!
    
    
    
    start_type:0
    
    lwIP-2.0.2 initialized!
    igmp_mac_filter add 224.0.0.1 01:00:5E:00:00:01
    igmp_mac_filter add 224.0.0.1 01:00:5E:00:00:01
    beken wlan hw init
    
    drv_pm_init
    [I/FAL] RT-Thread Flash Abstraction Layer (V0.4.0) initialize success.
    msh />cmd 1:3 
    
    cmd 1:3 
    
    cmd 1:3 
    
    SD File System initialzation failed!
    [I/FAL] The FAL MTD NOR device (filesystem) created successfully
    LFS Filesystem initialized! filesystem ==> /flash0
    bk_misc_check_start_type=0,gDcOrBattery=1
    cVersion=1_1_2_36
    cVersion=1_1_2_36
    00000000: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
    00000010: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
    00000020: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
    00000030: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
    00000040: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
    00000050: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
    00000060: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
    00000070: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ................
    00000000: 7B 22 4D 41 43 5F 41 44 44 52 22 3A 22 63 30 30  {"MAC_ADDR":"c00
    00000010: 31 30 32 30 30 30 30 31 31 22 2C 22 50 52 4F 44  102000011","PROD
    00000020: 55 43 54 5F 4B 45 59 22 3A 22 42 41 54 31 38 30  UCT_KEY":"BAT180
    00000030: 38 32 33 49 4F 5A 52 43 22 2C 22 50 52 4F 44 55  823IOZRC","PRODU
    00000040: 43 54 5F 53 45 43 52 45 54 22 3A 22 38 39 79 65  CT_SECRET":"89ye
    00000050: 79 69 75 72 79 69 65 75 72 79 75 65 69 75 72 22  yiuryieuryueiur"
    00000060: 2C 22 44 45 56 49 43 45 5F 4E 41 4D 45 22 3A 22  ,"DEVICE_NAME":"
    00000070: 4E 55 47 5A 4C 41 22 2C 22 44 45 56 49 43 45 5F  NUGZLA","DEVICE_
    sysmode=0,t=998
    sending broadcast_deauth failed vif_entry == NULL
    
    sysmode=1,t=1001
    cmd 1:3 
    
    cmd 1:3 
    
    cmd 1:3 
    
    SD Card initialzation failed!-->ret=-1:0
    video_transfer_main entry
    
    video transfer send type:3, open type:1
    
    2----open I2C2
    
    chNmb=8,sensor=0,gUsedCam=abc09
    
    camera_intfer_init=0:abc09,a5a50003-a5a50005
    
    cmd 1:3 
    
    cmd 1:3 
    
    read frame time out
    
    cmd 1:3 
    
    SD Card initialzation failed!-->ret=-1:0
    Soft_AP_start
    
    [saap]MM_RESET_REQ
    
    [bk]tx_txdesc_flush
    
    [saap]ME_CONFIG_REQ
    
    [saap]ME_CHAN_CONFIG_REQ
    
    [saap]MM_START_REQ
    
    [csa]csa_in_progress[0:0]-clear
    
    mm_add_if_req_handler:0
    
    hapd_intf_add_vif,type:3, s:0, id:0
    
    apm start with vif:0
    
    ------beacon_int_set:100 TU
    
    set_active param 0
    [msg]APM_STOP_CFM
    update_ongoing_1_bcn_update
    
    vif_idx:0, ch_idx:0, bcmc_idx:2
    
    mm_set_vif_state_req_handler
    
    update_ongoing_1_bcn_update
    
    uap_ip_start
    
    
    
    configuring interface uap (with Static IP)
    using static ip...
    please use rtthread dncp start server
    [DHCP] dhcpd_start: ap
    
    [DHCP] ip_start: [192.168.1.100]
    
    [DHCP] ip_end: [192.168.1.254]
    
    [DHCP] dhcp_server_start(): starting new DHCP server
    [DHCP] dhcp_server_start(): starting DHCP server
    def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
    
    start watch dog
    rt_hw_wdg_start time=10000 threshold=500
    closesocket: invalid s=0
    closesocket: invalid s=0
    [E/NTP]: ERROR no such host
    cur_time is 0.
    gParam.bFlagServerHello==0
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    read frame time out
    
    Helpful post? Buy me a coffee.
  • #100 21525148
    insmod
    Level 25  
    It's possible that you have 4mb version, that may be the reason reading failed.
  • #101 21525151
    p.kaczmarek2
    Moderator Smart Home
    It worked just with hid_download_py now.
    
    
    W:\GIT\hid_download_py>python uartprogram -l 0x1FFFFF -b 115200 -r -d  COM3  firmware_dump.bin
    UartDownloader....
    Read Getting Bus...
    Gotten Bus...
    len: 1fffff
    startAddr: 11000
    
    2084864
    Reading 20e000
    ReadSector Success 20e000 len 1000
    2088960
    Reading 20f000
    ReadSector Success 20f000 len 1000
    2093056
    Reading 210000
    ReadSector Success 210000 len 1000
    2097152
    CRC should be a8dbbc0e
    CRC is a8dbbc0e
    Wrote 200000 bytes to firmware_dump.bin
    

    is easy flasher supposed to work here?
    Helpful post? Buy me a coffee.
  • #102 21525153
    insmod
    Level 25  
    >>21525151
    I didn't take the backup with easy flasher, but reading and writing config was working fine for me
  • #103 21525156
    divadiow
    Level 34  
    I note this in my BK7252 doorbell thread

    Code: Text
    Log in, to see the code


    Though I don't appear to have taken screenshots or log. Doorbell is 4mb. I've mostly done SPI with doorbell.
  • #104 21525159
    p.kaczmarek2
    Moderator Smart Home
    @insmod Since I have some time now, what is the state of BK7252 build? Could we integrate it today?

    @insmod And a XR872-related question - do you have any ideas why my samples built with XR872 SDK with 880K flash set in image (A9 XF16 checks for that) run only on A9 with flash chip transplanted to 2MB?
    Here's a quick rundown of related links:
    https://github.com/openshwprojects/OpenXR872
    Obk is in hello demo
    https://github.com/openshwprojects/OpenXR872/blob/main/project/demo/hello_demo/prj_config.h
    https://github.com/openshwprojects/OpenXR872/blob/main/project/image_cfg/image.cfg#L8

    Added after 1 [minutes]:

    This works for reading:
    https://github.com/OpenBekenIOT/hid_download_py/blob/master/uartprogram
    but our flasher does not, so we need to check what hid does differently.

    Added after 7 [minutes]:

    I think i know why read might fail:

    A fragment of source code in C#, with the line addr + FLASH_SIZE; highlighted.

    Added after 55 [seconds]:

    i've solved the case:

    Screenshot of Visual Studio environment with open C# code in debugging mode.
    Helpful post? Buy me a coffee.
  • #105 21525173
    insmod
    Level 25  
    >>21525159
    Current bk7252 build properly works only on non-tuya chips (unencrypted).
    And even then, OTA doesn't work.
    I will have to solve the 'bootloader problem', and then flashing via spi will have to be mandatory on both tuya and non-tuya.

    I'm surprised xr872 works at all. If app_xip.bin is main firmware, then it's max length is 512K - because next partition is wlan_bl at 645K flash offset.
  • #106 21525196
    p.kaczmarek2
    Moderator Smart Home
    @insmod here is comparison between our partitions and A9 firmware:
    Comparison of flash partition layouts in PhoenixMC tool for OpenXR872 and original A9 firmware.
    I have no idea what to do more, but I could try to 1:1 copy their layout.

    I've added support for BK7252:
    https://github.com/openshwprojects/BK7231GUIFlashTool
    I just had to skip the "wrap around" hack. Write not tested yet.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • Helpful post
    #107 21525205
    insmod
    Level 25  
    >>21525196
    I can successfully read my bk7252 flash in T mode, there are no errors.
    Backup name is set to 7252.
    Starting read!
    Read parms: start 0x00 (sector 0), len 0x200000 (0 sectors)
    Flasher mode: BK7231T
    Going to open port: COM6.
    Serial port open!
    Getting bus... (now, please do reboot by CEN or by power off/on)
    Getting bus success!
    Going to set baud rate setting (921600)!
    Going to start reading at offset 0x00...
    Reading 0x00... Ok! Reading 0x1000... Ok! Reading 0x2000... Ok! Reading 0x3000... Ok! Reading 0x4000... Ok! Reading 0x5000... Ok! Reading 0x6000... Ok! Reading 0x7000... Ok! Reading 0x8000... Ok! Reading 0x9000... Ok! Reading 0xA000... Ok! Reading 0xB000... Ok! Reading 0xC000... Ok! Reading 0xD000... Ok! Reading 0xE000... Ok! Reading 0xF000... Ok! Reading 0x10000... Ok! Reading 0x11000... Ok! Reading 0x12000... Ok! Reading 0x13000... Ok! Reading 0x14000... Ok! Reading 0x15000... Ok! Reading 0x16000... Ok! Reading 0x17000... Ok! Reading 0x18000... Ok! Reading 0x19000... Ok! Reading 0x1A000... Ok! Reading 0x1B000... Ok! Reading 0x1C000... Ok! Reading 0x1D000... Ok! Reading 0x1E000... Ok! Reading 0x1F000... Ok! Reading 0x20000... Ok! Reading 0x21000... Ok! Reading 0x22000... Ok! Reading 0x23000... Ok! Reading 0x24000... Ok! Reading 0x25000... Ok! Reading 0x26000... Ok! Reading 0x27000... Ok! Reading 0x28000... Ok! Reading 0x29000... Ok! Reading 0x2A000... Ok! Reading 0x2B000... Ok! Reading 0x2C000... Ok! Reading 0x2D000... Ok! Reading 0x2E000... Ok! Reading 0x2F000... Ok! Reading 0x30000... Ok! Reading 0x31000... Ok! Reading 0x32000... Ok! Reading 0x33000... Ok! Reading 0x34000... Ok! Reading 0x35000... Ok! Reading 0x36000... Ok! Reading 0x37000... Ok! Reading 0x38000... Ok! Reading 0x39000... Ok! Reading 0x3A000... Ok! Reading 0x3B000... Ok! Reading 0x3C000... Ok! Reading 0x3D000... Ok! Reading 0x3E000... Ok! Reading 0x3F000... Ok! Reading 0x40000... Ok! Reading 0x41000... Ok! Reading 0x42000... Ok! Reading 0x43000... Ok! Reading 0x44000... Ok! Reading 0x45000... Ok! Reading 0x46000... Ok! Reading 0x47000... Ok! Reading 0x48000... Ok! Reading 0x49000... Ok! Reading 0x4A000... Ok! Reading 0x4B000... Ok! Reading 0x4C000... Ok! Reading 0x4D000... Ok! Reading 0x4E000... Ok! Reading 0x4F000... Ok! Reading 0x50000... Ok! Reading 0x51000... Ok! Reading 0x52000... Ok! Reading 0x53000... Ok! Reading 0x54000... Ok! Reading 0x55000... Ok! Reading 0x56000... Ok! Reading 0x57000... Ok! Reading 0x58000... Ok! Reading 0x59000... Ok! Reading 0x5A000... Ok! Reading 0x5B000... Ok! Reading 0x5C000... Ok! Reading 0x5D000... Ok! Reading 0x5E000... Ok! Reading 0x5F000... Ok! Reading 0x60000... Ok! Reading 0x61000... Ok! Reading 0x62000... Ok! Reading 0x63000... Ok! Reading 0x64000... Ok! Reading 0x65000... Ok! Reading 0x66000... Ok! Reading 0x67000... Ok! Reading 0x68000... Ok! Reading 0x69000... Ok! Reading 0x6A000... Ok! Reading 0x6B000... Ok! Reading 0x6C000... Ok! Reading 0x6D000... Ok! Reading 0x6E000... Ok! Reading 0x6F000... Ok! Reading 0x70000... Ok! Reading 0x71000... Ok! Reading 0x72000... Ok! Reading 0x73000... Ok! Reading 0x74000... Ok! Reading 0x75000... Ok! Reading 0x76000... Ok! Reading 0x77000... Ok! Reading 0x78000... Ok! Reading 0x79000... Ok! Reading 0x7A000... Ok! Reading 0x7B000... Ok! Reading 0x7C000... Ok! Reading 0x7D000... Ok! Reading 0x7E000... Ok! Reading 0x7F000... Ok! Reading 0x80000... Ok! Reading 0x81000... Ok! Reading 0x82000... Ok! Reading 0x83000... Ok! Reading 0x84000... Ok! Reading 0x85000... Ok! Reading 0x86000... Ok! Reading 0x87000... Ok! Reading 0x88000... Ok! Reading 0x89000... Ok! Reading 0x8A000... Ok! Reading 0x8B000... Ok! Reading 0x8C000... Ok! Reading 0x8D000... Ok! Reading 0x8E000... Ok! Reading 0x8F000... Ok! Reading 0x90000... Ok! Reading 0x91000... Ok! Reading 0x92000... Ok! Reading 0x93000... Ok! Reading 0x94000... Ok! Reading 0x95000... Ok! Reading 0x96000... Ok! Reading 0x97000... Ok! Reading 0x98000... Ok! Reading 0x99000... Ok! Reading 0x9A000... Ok! Reading 0x9B000... Ok! Reading 0x9C000... Ok! Reading 0x9D000... Ok! Reading 0x9E000... Ok! Reading 0x9F000... Ok! Reading 0xA0000... Ok! Reading 0xA1000... Ok! Reading 0xA2000... Ok! Reading 0xA3000... Ok! Reading 0xA4000... Ok! Reading 0xA5000... Ok! Reading 0xA6000... Ok! Reading 0xA7000... Ok! Reading 0xA8000... Ok! Reading 0xA9000... Ok! Reading 0xAA000... Ok! Reading 0xAB000... Ok! Reading 0xAC000... Ok! Reading 0xAD000... Ok! Reading 0xAE000... Ok! Reading 0xAF000... Ok! Reading 0xB0000... Ok! Reading 0xB1000... Ok! Reading 0xB2000... Ok! Reading 0xB3000... Ok! Reading 0xB4000... Ok! Reading 0xB5000... Ok! Reading 0xB6000... Ok! Reading 0xB7000... Ok! Reading 0xB8000... Ok! Reading 0xB9000... Ok! Reading 0xBA000... Ok! Reading 0xBB000... Ok! Reading 0xBC000... Ok! Reading 0xBD000... Ok! Reading 0xBE000... Ok! Reading 0xBF000... Ok! Reading 0xC0000... Ok! Reading 0xC1000... Ok! Reading 0xC2000... Ok! Reading 0xC3000... Ok! Reading 0xC4000... Ok! Reading 0xC5000... Ok! Reading 0xC6000... Ok! Reading 0xC7000... Ok! Reading 0xC8000... Ok! Reading 0xC9000... Ok! Reading 0xCA000... Ok! Reading 0xCB000... Ok! Reading 0xCC000... Ok! Reading 0xCD000... Ok! Reading 0xCE000... Ok! Reading 0xCF000... Ok! Reading 0xD0000... Ok! Reading 0xD1000... Ok! Reading 0xD2000... Ok! Reading 0xD3000... Ok! Reading 0xD4000... Ok! Reading 0xD5000... Ok! Reading 0xD6000... Ok! Reading 0xD7000... Ok! Reading 0xD8000... Ok! Reading 0xD9000... Ok! Reading 0xDA000... Ok! Reading 0xDB000... Ok! Reading 0xDC000... Ok! Reading 0xDD000... Ok! Reading 0xDE000... Ok! Reading 0xDF000... Ok! Reading 0xE0000... Ok! Reading 0xE1000... Ok! Reading 0xE2000... Ok! Reading 0xE3000... Ok! Reading 0xE4000... Ok! Reading 0xE5000... Ok! Reading 0xE6000... Ok! Reading 0xE7000... Ok! Reading 0xE8000... Ok! Reading 0xE9000... Ok! Reading 0xEA000... Ok! Reading 0xEB000... Ok! Reading 0xEC000... Ok! Reading 0xED000... Ok! Reading 0xEE000... Ok! Reading 0xEF000... Ok! Reading 0xF0000... Ok! Reading 0xF1000... Ok! Reading 0xF2000... Ok! Reading 0xF3000... Ok! Reading 0xF4000... Ok! Reading 0xF5000... Ok! Reading 0xF6000... Ok! Reading 0xF7000... Ok! Reading 0xF8000... Ok! Reading 0xF9000... Ok! Reading 0xFA000... Ok! Reading 0xFB000... Ok! Reading 0xFC000... Ok! Reading 0xFD000... Ok! Reading 0xFE000... Ok! Reading 0xFF000... Ok! Reading 0x100000... Ok! Reading 0x101000... Ok! Reading 0x102000... Ok! Reading 0x103000... Ok! Reading 0x104000... Ok! Reading 0x105000... Ok! Reading 0x106000... Ok! Reading 0x107000... Ok! Reading 0x108000... Ok! Reading 0x109000... Ok! Reading 0x10A000... Ok! Reading 0x10B000... Ok! Reading 0x10C000... Ok! Reading 0x10D000... Ok! Reading 0x10E000... Ok! Reading 0x10F000... Ok! Reading 0x110000... Ok! Reading 0x111000... Ok! Reading 0x112000... Ok! Reading 0x113000... Ok! Reading 0x114000... Ok! Reading 0x115000... Ok! Reading 0x116000... Ok! Reading 0x117000... Ok! Reading 0x118000... Ok! Reading 0x119000... Ok! Reading 0x11A000... Ok! Reading 0x11B000... Ok! Reading 0x11C000... Ok! Reading 0x11D000... Ok! Reading 0x11E000... Ok! Reading 0x11F000... Ok! Reading 0x120000... Ok! Reading 0x121000... Ok! Reading 0x122000... Ok! Reading 0x123000... Ok! Reading 0x124000... Ok! Reading 0x125000... Ok! Reading 0x126000... Ok! Reading 0x127000... Ok! Reading 0x128000... Ok! Reading 0x129000... Ok! Reading 0x12A000... Ok! Reading 0x12B000... Ok! Reading 0x12C000... Ok! Reading 0x12D000... Ok! Reading 0x12E000... Ok! Reading 0x12F000... Ok! Reading 0x130000... Ok! Reading 0x131000... Ok! Reading 0x132000... Ok! Reading 0x133000... Ok! Reading 0x134000... Ok! Reading 0x135000... Ok! Reading 0x136000... Ok! Reading 0x137000... Ok! Reading 0x138000... Ok! Reading 0x139000... Ok! Reading 0x13A000... Ok! Reading 0x13B000... Ok! Reading 0x13C000... Ok! Reading 0x13D000... Ok! Reading 0x13E000... Ok! Reading 0x13F000... Ok! Reading 0x140000... Ok! Reading 0x141000... Ok! Reading 0x142000... Ok! Reading 0x143000... Ok! Reading 0x144000... Ok! Reading 0x145000... Ok! Reading 0x146000... Ok! Reading 0x147000... Ok! Reading 0x148000... Ok! Reading 0x149000... Ok! Reading 0x14A000... Ok! Reading 0x14B000... Ok! Reading 0x14C000... Ok! Reading 0x14D000... Ok! Reading 0x14E000... Ok! Reading 0x14F000... Ok! Reading 0x150000... Ok! Reading 0x151000... Ok! Reading 0x152000... Ok! Reading 0x153000... Ok! Reading 0x154000... Ok! Reading 0x155000... Ok! Reading 0x156000... Ok! Reading 0x157000... Ok! Reading 0x158000... Ok! Reading 0x159000... Ok! Reading 0x15A000... Ok! Reading 0x15B000... Ok! Reading 0x15C000... Ok! Reading 0x15D000... Ok! Reading 0x15E000... Ok! Reading 0x15F000... Ok! Reading 0x160000... Ok! Reading 0x161000... Ok! Reading 0x162000... Ok! Reading 0x163000... Ok! Reading 0x164000... Ok! Reading 0x165000... Ok! Reading 0x166000... Ok! Reading 0x167000... Ok! Reading 0x168000... Ok! Reading 0x169000... Ok! Reading 0x16A000... Ok! Reading 0x16B000... Ok! Reading 0x16C000... Ok! Reading 0x16D000... Ok! Reading 0x16E000... Ok! Reading 0x16F000... Ok! Reading 0x170000... Ok! Reading 0x171000... Ok! Reading 0x172000... Ok! Reading 0x173000... Ok! Reading 0x174000... Ok! Reading 0x175000... Ok! Reading 0x176000... Ok! Reading 0x177000... Ok! Reading 0x178000... Ok! Reading 0x179000... Ok! Reading 0x17A000... Ok! Reading 0x17B000... Ok! Reading 0x17C000... Ok! Reading 0x17D000... Ok! Reading 0x17E000... Ok! Reading 0x17F000... Ok! Reading 0x180000... Ok! Reading 0x181000... Ok! Reading 0x182000... Ok! Reading 0x183000... Ok! Reading 0x184000... Ok! Reading 0x185000... Ok! Reading 0x186000... Ok! Reading 0x187000... Ok! Reading 0x188000... Ok! Reading 0x189000... Ok! Reading 0x18A000... Ok! Reading 0x18B000... Ok! Reading 0x18C000... Ok! Reading 0x18D000... Ok! Reading 0x18E000... Ok! Reading 0x18F000... Ok! Reading 0x190000... Ok! Reading 0x191000... Ok! Reading 0x192000... Ok! Reading 0x193000... Ok! Reading 0x194000... Ok! Reading 0x195000... Ok! Reading 0x196000... Ok! Reading 0x197000... Ok! Reading 0x198000... Ok! Reading 0x199000... Ok! Reading 0x19A000... Ok! Reading 0x19B000... Ok! Reading 0x19C000... Ok! Reading 0x19D000... Ok! Reading 0x19E000... Ok! Reading 0x19F000... Ok! Reading 0x1A0000... Ok! Reading 0x1A1000... Ok! Reading 0x1A2000... Ok! Reading 0x1A3000... Ok! Reading 0x1A4000... Ok! Reading 0x1A5000... Ok! Reading 0x1A6000... Ok! Reading 0x1A7000... Ok! Reading 0x1A8000... Ok! Reading 0x1A9000... Ok! Reading 0x1AA000... Ok! Reading 0x1AB000... Ok! Reading 0x1AC000... Ok! Reading 0x1AD000... Ok! Reading 0x1AE000... Ok! Reading 0x1AF000... Ok! Reading 0x1B0000... Ok! Reading 0x1B1000... Ok! Reading 0x1B2000... Ok! Reading 0x1B3000... Ok! Reading 0x1B4000... Ok! Reading 0x1B5000... Ok! Reading 0x1B6000... Ok! Reading 0x1B7000... Ok! Reading 0x1B8000... Ok! Reading 0x1B9000... Ok! Reading 0x1BA000... Ok! Reading 0x1BB000... Ok! Reading 0x1BC000... Ok! Reading 0x1BD000... Ok! Reading 0x1BE000... Ok! Reading 0x1BF000... Ok! Reading 0x1C0000... Ok! Reading 0x1C1000... Ok! Reading 0x1C2000... Ok! Reading 0x1C3000... Ok! Reading 0x1C4000... Ok! Reading 0x1C5000... Ok! Reading 0x1C6000... Ok! Reading 0x1C7000... Ok! Reading 0x1C8000... Ok! Reading 0x1C9000... Ok! Reading 0x1CA000... Ok! Reading 0x1CB000... Ok! Reading 0x1CC000... Ok! Reading 0x1CD000... Ok! Reading 0x1CE000... Ok! Reading 0x1CF000... Ok! Reading 0x1D0000... Ok! Reading 0x1D1000... Ok! Reading 0x1D2000... Ok! Reading 0x1D3000... Ok! Reading 0x1D4000... Ok! Reading 0x1D5000... Ok! Reading 0x1D6000... Ok! Reading 0x1D7000... Ok! Reading 0x1D8000... Ok! Reading 0x1D9000... Ok! Reading 0x1DA000... Ok! Reading 0x1DB000... Ok! Reading 0x1DC000... Ok! Reading 0x1DD000... Ok! Reading 0x1DE000... Ok! Reading 0x1DF000... Ok! Reading 0x1E0000... Ok! Reading 0x1E1000... Ok! Reading 0x1E2000... Ok! Reading 0x1E3000... Ok! Reading 0x1E4000... Ok! Reading 0x1E5000... Ok! Reading 0x1E6000... Ok! Reading 0x1E7000... Ok! Reading 0x1E8000... Ok! Reading 0x1E9000... Ok! Reading 0x1EA000... Ok! Reading 0x1EB000... Ok! Reading 0x1EC000... Ok! Reading 0x1ED000... Ok! Reading 0x1EE000... Ok! Reading 0x1EF000... Ok! Reading 0x1F0000... Ok! Reading 0x1F1000... Ok! Reading 0x1F2000... Ok! Reading 0x1F3000... Ok! Reading 0x1F4000... Ok! Reading 0x1F5000... Ok! Reading 0x1F6000... Ok! Reading 0x1F7000... Ok! Reading 0x1F8000... Ok! Reading 0x1F9000... Ok! Reading 0x1FA000... Ok! Reading 0x1FB000... Ok! Reading 0x1FC000... Ok! Reading 0x1FD000... Ok! Reading 0x1FE000... Ok! Reading 0x1FF000... Ok! 
    Basic read operation finished, but now it's time to verify...
    Starting CRC check for 512 sectors, starting at offset 0x00
    CRC matches 0x43EE97A7!
    All read!
    Loaded total 0x200000 bytes 
    
  • #108 21525210
    p.kaczmarek2
    Moderator Smart Home
    Here is a comparison of first read and then write and read in BK7252 mode (check latest commits):
    Comparison of two binary files in ExamDiff Pro showing no differences.
    Read log:
    Screenshot of BK7231 Easy UART Flasher with a Reading success! message and memory read details.
    Here is read attempt in BK7231T mode - CRC fails:
    Screenshot of the BK7231 Easy UART Flasher program with a “CRC mismatch!” error message.
    If I enable ignore CRC Error and just check created file:
    Screenshot of BK7231 Easy UART Flasher software reading flash memory of a device via COM port.
    Created file has 0xFF bootloader:
    Screenshot from XVI32 showing a binary file filled with hexadecimal FF values.
    and it's full of 0xFF, even if I go futher than bootloader:
    Screenshot of the HxD editor showing a binary file filled with hexadecimal FF values in every cell.

    @insmod is your file correct, both bootloader and remaining data? So you're saying that in your case, this code fragment works?

    Screenshot of a code editor showing C++ code with comments and highlighted elements.

    Added after 6 [minutes]:

    Btw strange thing - it stuck in such boot loop after flash tests:
    A RealTerm window showing system boot logs and diagnostic messages in textual form.
    but once I disconnected UART wires, I got AP back:
    Wi-Fi icon and the text BAT180823IOZRC on a light gray background.
    and it works:
    RealTerm window with repeated “Bad frame time out” messages on a black background.
    My conclusions so far:
    - I can read and write BK7252 firmware with Easy flasher only in BK7252 mode, the "wrap around 2MB hack" used for BK7231T causes my BK7252 to lock itself and return 0xff on each read
    - written back BK7252 firmware may not fully boot if I dont disconnect uart
    - in our flasher, I don't need to do power on/off cycle to do flash operation, maybe this "uart reboot" send works
    A fragment of C# code with the word reboot highlighted.
    Backup:
    https://github.com/openshwprojects/FlashDumps/commit/b52dbd6579eec97b94533ce9b0094b130fa082be
    Any builds to try?
    Helpful post? Buy me a coffee.
  • #109 21525222
    insmod
    Level 25  
    >>21525210
    Yes, my dump contains both bootloader and app (obk). can also see obk config and factory firmware data.
    Is reading bootloader not allowed specifically on UQN68 or just forbidden to read (and write?) in efuse?
    Or perhaps it is in ROM?

    Added after 59 [seconds]:

    https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/14322039247

    Added after 57 [seconds]:

    Did you check that you have 2mb flash? Perhaps you have 4mb

    Added after 1 [minutes]:

    Though probably not, i can see TLV at 0x1cf000 (meaning 0x1e0000 if added 0x11000)
  • #110 21525230
    p.kaczmarek2
    Moderator Smart Home
    How to check flash? By flash ID read in Easy flasher?

    But I have tried to use "wrap around hack" with 4MB flash size (as seen on my screenshot) and it failed as well.

    Added after 11 [minutes]:

    I flashed UA. It again didn't want to boot with UART connected, but then I disconnected it and repowered.
    Wi-Fi connection window for OpenBK7252_8CFB3E8F with Connect automatically option and Connect button.
    Wait, it dies as soon as I connect UART? AP is gone. Let's try again without connecting UART.
    Strange, no AP now, and it's not battery - battery is disconnected.

    Ok I got it back:
    A window showing an attempt to connect to the Wi-Fi network OpenBK7252_8CFB3E8F on a Windows computer.
    It already has settings?
    Screenshot of OpenBK7252 control panel for LED management with brightness, RGB color, and temperature sliders.
    No flags are set, no pins, but it shows LED controller. Strange.

    Added after 2 [minutes]:

    @insmod is your code printing anything on flash UART? Or maybe it's like in OBK... so TX2.
    Helpful post? Buy me a coffee.
  • #111 21525247
    insmod
    Level 25  
    >>21525230
    Everything works ok for me, there were no settings and output on TX2 worked.
    Btw, you can try to read/write config with easy flasher.
  • #112 21525249
    p.kaczmarek2
    Moderator Smart Home
    Ok so I added a command:
    Web interface screen of OpenBK7252 with a startup command field and a Submit button.
    In BK7231T mode, obv:
    Screenshot of BK7231 Easy UART Flasher program with error message Only 0xff bytes read! in red.
    In BK7252 (I pushed a fix):
    Screenshot of OBKFlashLayout software showing a successful configuration read from a BK7252 device and OBK configuration window.
    Helpful post? Buy me a coffee.
  • #113 21525428
    divadiow
    Level 34  
    I was also wondering if it's worth adding an add entry for BK7231U (and S?) too to EF - I used T here on HLK-B30 https://www.elektroda.com/rtvforum/topic4092465-120.html#21509907

    Added after 54 [minutes]:

    our XF16 A9 variant - FCC submission - Shenzhen Shangjian Technology - https://fccid.io/2BC6D-A9/

    BK7252
    https://fcc.report/FCC-ID/2BD5K-A9
    https://fccid.io/2BEXJ-A9
  • #114 21525672
    p.kaczmarek2
    Moderator Smart Home
    This XR872/XF16 thread has drifted a bit from Xradio, so I created a BK7252 information dump there:
    https://www.elektroda.com/rtvforum/topic4118348.html
    Please submit your information on BK7252 there so far, but I will also create A9 camera teardown later. I had two A9 cameras with BK7252, I am still not able to find second one.
    If you can, please help me gather all BK7252 information in the topic I linked.


    And for now, for XF16/XRadio, we need to figure out why our built binaries do not boot on 1MB flash. How does it even tell.... my first idea is to try 1:1 same partition layout as in their firmware.
    Helpful post? Buy me a coffee.
  • #115 21528163
    p.kaczmarek2
    Moderator Smart Home
    @divadiow how brand new camera with battery attached and power via USB should behave? My new ones have red light on all the time and no reaction to buttons.

    Close-up of a printed circuit board with electronics and a camera, held between fingers.
    I managed to get flash read, will post in a moment

    Added after 4 [minutes]:

    Close-up of a printed circuit board with electronics and a camera module.
    Two printed circuit boards with mounted electronic components held by metal laboratory clamps.

    Added after 1 [minutes]:

    Firmware: https://github.com/openshwprojects/FlashDumps/commit/9519d4e6079f0a81cbe40ac50c774bc211a7a747
    PhoeniX MC can read via UART but no log output and no AP on stock firmware.

    Added after 3 [minutes]:

    I disconnected battery:
    Close-up of a circuit board with a connected micro USB cable and a mounted camera lens.
    Blue LED blinks. Log output is present. AP is on:
    Screenshot from RealTerm showing system logs and network interface information.
    Wi-Fi icon and text BATF087779AABAB.

    Added after 24 [seconds]:

    Voltage on battery was 4V, that is measured in circuit, before I disconnected.

    Added after 6 [minutes]:

    Exploit works.
    Blurry section of a page with text, seen through a webcam.
    Boot log (with WiFi connection):
    
    [bl ERR] main():629, build:20:38:52
    [FD I]: mode: 0x4, freq: 48000000Hz, drv: 0
    
    Password:PMA: mode select:e
    
    wlan information ===================================================
    firmware:
        version : R-XR_C10.08.52.64_01.80 Jul  6 2019 20:05:10-P01.46-R
        buffer  : 12
    driver:
        version : XR_V02.05
    ====================================================================
    
    PMA: wlan mode:a
    
    platform information ===============================================
    XRADIO Skylark SDK 1.2.0 Jun 20 2024 10:58:31
    
    sram heap space [0x21f37c, 0x25fc00), total size 264324 Bytes
    cpu  clock 240000000 Hz
    HF   clock  40000000 Hz
    
    sdk option:
        XIP           : enable
        INT LF OSC    : enable
    
    mac address:
        efuse         : a0:17:f1:fd:ac:4e
        in use        : 04:90:9f:c6:1e:19
    ====================================================================
    
    StartupState:0
    network_connected.g726
    language
    net_failed.g726
    qrcode.g726
    reset.g726
    wait.g726
    gpio_grp=0,gpio_bit=21
    led drv init
    check vol
    [mthread]Create task:vbat(stack:2048),prio:3,ret:0 
    XXXX task:vbat
    [ERR] __mci_irq_handler,575 raw_int:100 err!
    [ERR] SDC err, cmd 8,  RTO
    [ERR] sdc 402 abnormal status: RespErr
    [ERR] int err 100
    [ERR] __mci_irq_handler,575 raw_int:100 err!
    [ERR] SDC err, cmd 55,  RTO
    [ERR] sdc 402 abnormal status: RespErr
    [ERR] int err 100
    [ERR] __mci_irq_handler,575 raw_int:100 err!
    [ERR] SDC err, cmd 55,  RTO
    [ERR] sdc 402 abnormal status: RespErr
    [ERR] int err 100
    [ERR] __mci_irq_handler,575 raw_int:100 err!
    [ERR] SDC err, cmd 55,  RTO
    [ERR] sdc 402 abnormal status: RespErr
    [ERR] int err 100
    [ERR] __mci_irq_handler,575 raw_int:100 err!
    [ERR] SDC err, cmd 55,  RTO
    [ERR] sdc 402 abnormal status: RespErr
    [ERR] int err 100
    [FS ERR] fs_ctrl_mount():102, mmc scan fail
    <-500119_192428 rt_sd_dev.c:264>SD File System initialzation failed! errno
    [mthread]Create task:sdcardth(stack:2048),prio:3,ret:0 
    XXXX task:sdcardth
    err cmd:use_fw_rate_policy
    vif=0, rts_threshold = 3000
    ssid is NULL. AP 
    <wifi>lpdtim:10, lplis:10
    [mthread]Create task:wifitask(stack:4096),prio:3,ret:0 
    XXXX task:wifitask
    [XRADIO_INTERNAL_CODEC] AMIC set volume Level-[7]
    [XRADIO_INTERNAL_CODEC] AMIC set volume Gain-[39]
    wifi task run
    rtuid:BATF-087779-GHJJL1N,FGIIKI
    en1: CTRL-EVENT-TERMINATING 
    WAR join_status:0
    mean_vol=4200
    
    wlan information ===================================================
    firmware:
        version : R-XR_C10.08.52.64_01.80 Jul  6 2019 20:05:10-P01.46-R
        buffer  : 12
    driver:
        version : XR_V02.05
    ====================================================================
    
    interface name: en1
    Using interface en1 with hwaddr 04:90:9f:c6:1e:19 and ssid "AP-XRADIO"
    [XRADIO_INTERNAL_CODEC] AMIC set volume Gain-[39]
    [XRADIO_INTERNAL_CODEC] LINEIN set volume Level-[1]
    [XRADIO_INTERNAL_CODEC] AUDIO_IN_DEV_ALL set volume Gain-[0]
    [XRADIO_INTERNAL_CODEC] Route(cap): amic Enable
    en1: interface state UNINITIALIZED->ENABLED
    en1: AP-ENABLED 
    en1: AP-DISABLED 
    [net INF] msg <wlan connected>
    [net INF] netif is link up
    [net INF] bring up netif
    [net INF] netif (IPv4) is up
    [net INF] address: 192.168.238.1
    [net INF] gateway: 192.168.238.1
    [net INF] netmask: 255.255.255.0
    WLAN CONNECTED
    err cmd:use_fw_rate_policy
    vif=0, rts_threshold = 3000
    vif0, AP/GO mode THROTTLE=38
    [net INF] msg <network up>
    NETWORK UP
    <L>Cmutex:0
    <L>Cmutex:0x2295c8
    <L>lwip_socket(PF_INET, UDP, 17) = SKT_0
    en1: interface state ENABLED->DISABLED
    [net INF] msg <wlan disconnected>
    [net INF] netif is link down
    WLAN DISCONNECTED
    <L>Cmutex:0
    <L>Cmutex:0x226680
    <L>lwip_socket(PF_INET, UDP, 17) = SKT_1
    Using interface en1 with hwaddr 04:90:9f:c6:1e:19 and ssid "BATF087779AABAB"
    ---->detect sp0828 
    {0xfd, 0x00},
    {0x1c, 0x00},
    {0x30, 0x00},
    {0x0f, 0x2f},
    {0x10, 0x2f},
    {0x12, 0x7f},
    {0x13, 0x2f},
    {0x15, 0x7f},
    {0x16, 0x0f},
    {0x22, 0xe0},
    {0x26, 0x08},
    {0x27, 0xe8},
    {0x28, 0x0b},
    {0x32, 0x00},
    {0xfd, 0x00},
    {0x31, 0x00},
    {0xd8, 0x58},
    {0xd9, 0x58},
    {0xda, 0x58},
    {0xdb, 0x58},
    {0x36, 0x00},
    {0x5f, 0x11},
    {0xe0, 0x00},
    {0xe1, 0xdc},
    {0xe2, 0xb0},
    {0xe3, 0x00},
    {0xe4, 0x2e},
    {0xe5, 0x00},
    {0xe6, 0x2b},
    {0xb7, 0x3c},
    {0xb8, 0x50},
    {0xfd, 0x01},
    {0x25, 0x1a},
    {0x26, 0xfb},
    {0x28, 0x61},
    {0x29, 0x49},
    {0x31, 0x64},
    {0x32, 0x18},
    {0x4d, 0xdc},
    {0x4e, 0x53},
    {0x41, 0x8c},
    {0x42, 0x57},
    {0x55, 0xff},
    {0x56, 0x00},
    {0x59, 0x82},
    {0x5a, 0x00},
    {0x5d, 0xff},
    {0x5e, 0x6f},
    {0x57, 0xff},
    {0x58, 0x00},
    {0x5b, 0xff},
    {0x5c, 0xa8},
    {0x5f, 0x75},
    {0x60, 0x00},
    {0x2d, 0x00},
    {0x2e, 0x00},
    {0x2f, 0x00},
    {0x30, 0x00},
    {0x33, 0x00},
    {0x34, 0x00},
    {0x37, 0x00},
    {0x38, 0x00},
    {0x39, 0x01},
    {0x3a, 0x07},
    {0xfd, 0x00},
    {0x33, 0x0f},
    {0x51, 0x3f},
    {0x52, 0x09},
    {0x53, 0x00},
    {0x54, 0x00},
    {0x55, 0x10},
    {0x4f, 0x08},
    {0x50, 0x08},
    {0x56, 0x70},
    {0x57, 0x10},
    {0x58, 0x10},
    {0x59, 0x10},
    {0x5a, 0x02},
    {0x5b, 0x02},
    {0x5c, 0x20},
    {0x65, 0x03},
    {0x66, 0x01},
    {0x67, 0x03},
    {0x68, 0x46},
    {0x69, 0x7f},
    {0x6a, 0x01},
    {0x6b, 0x04},
    {0x6c, 0x01},
    {0x6d, 0x03},
    {0x6e, 0x46},
    {0x6f, 0x7f},
    {0x70, 0x01},
    {0x71, 0x05},
    {0x72, 0x01},
    {0x73, 0x03},
    {0x74, 0x46},
    {0x75, 0x7f},
    {0x76, 0x01},
    {0x7f, 0xa0},
    {0x80, 0x00},
    {0x81, 0xe0},
    {0x82, 0xed},
    {0x83, 0xa6},
    {0x84, 0xed},
    {0x85, 0xfa},
    {0x86, 0xba},
    {0x87, 0xcc},
    {0x88, 0x30},
    {0x89, 0x33},
    {0x8a, 0x0f},
    {0x8b, 0x00},
    {0x8c, 0x1a},
    {0x8d, 0x29},
    {0x8e, 0x41},
    {0x8f, 0x62},
    {0x90, 0x7c},
    {0x91, 0x90},
    {0x92, 0xa2},
    {0x93, 0xaf},
    {0x94, 0xba},
    {0x95, 0xc4},
    {0x96, 0xce},
    {0x97, 0xd6},
    {0x98, 0xdd},
    {0x99, 0xe4},
    {0x9a, 0xea},
    {0x9b, 0xf1},
    {0xfd, 0x01},
    {0x8d, 0xf8},
    {0x8e, 0xff},
    {0xfd, 0x00},
    {0xca, 0xcf},
    {0xcb, 0x07},
    {0xcc, 0x04},
    {0xce, 0xff},
    {0xcf, 0x10},
    {0xd0, 0x20},
    {0xd1, 0x00},
    {0xd2, 0x1c},
    {0xd3, 0x16},
    {0xd4, 0x00},
    {0xd6, 0x1c},
    {0xd7, 0x16},
    {0xdd, 0x6c},
    {0xde, 0xa0},
    {0xb9, 0x00},
    {0xba, 0x04},
    {0xbb, 0x08},
    {0xbc, 0x10},
    {0xbd, 0x20},
    {0xbe, 0x30},
    {0xbf, 0x40},
    {0xc0, 0x50},
    {0xc1, 0x60},
    {0xc2, 0x70},
    {0xc3, 0x80},
    {0xc4, 0x90},
    {0xc5, 0xa0},
    {0xc6, 0xb0},
    {0xc7, 0xc0},
    {0xc8, 0xd0},
    {0xc9, 0xe0},
    {0xfd, 0x01},
    {0x89, 0xf0},
    {0x8a, 0xff},
    {0xfd, 0x00},
    {0xe8, 0x30},
    {0xe9, 0x30},
    {0xea, 0x40},
    {0xf4, 0x1b},
    {0xf5, 0x97},
    {0xec, 0x53},
    {0xed, 0x78},
    {0xee, 0x47},
    {0xef, 0x6c},
    {0xf7, 0x70},
    {0xf8, 0x5b},
    {0xf9, 0x64},
    {0xfa, 0x4f},
    {0xfd, 0x01},
    {0x09, 0x31},
    {0x0a, 0x85},
    {0x0b, 0x0b},
    {0x14, 0x20},
    {0x15, 0x0f},
    {0xfd, 0x00},
    {0x05, 0x00},
    {0x06, 0xfe},
    {0x09, 0x02},
    {0x0a, 0x4d},
    {0xf0, 0x47},
    {0xf1, 0x00},
    {0xf2, 0x59},
    {0xf5, 0x72},
    {0xfd, 0x01},
    {0x00, 0xac},
    {0x0f, 0x5a},
    {0x16, 0x5a},
    {0x17, 0x9c},
    {0x18, 0xa4},
    {0x1b, 0x5a},
    {0x1c, 0xa4},
    {0xb4, 0x21},
    {0xb5, 0x3b},
    {0xb6, 0x43},
    {0xb9, 0x40},
    {0xba, 0x4f},
    {0xbb, 0x47},
    {0xbc, 0x45},
    {0xbd, 0x43},
    {0xbe, 0x42},
    {0xbf, 0x42},
    {0xc0, 0x42},
    {0xc1, 0x41},
    {0xc2, 0x41},
    {0xc3, 0x41},
    {0xc4, 0x41},
    {0xc5, 0x70},
    {0xc6, 0x41},
    {0xca, 0x70},
    {0xcb, 0x0c},
    {0xfd, 0x00},
    {0xfd, 0x00},
    {0x32, 0x15},
    {0x34, 0x66},
    {0x35, 0x40},
    {0x1b, 0x07},
    SP0828 Init Done 
    en1: interface state DISABLED->ENABLED
    en1: AP-ENABLED 
    [net INF] msg <wlan connected>
    lednum:0
    --drvled_flash :(0,1,5,5,1,5,5)
    [net INF] netif is link up
    WAR [WSM] Drop frame (0x0008).
    [net INF] netif is already up
    WLAN CONNECTED
    err cmd:use_fw_rate_policy
    vif=0, rts_threshold = 3000
    vif0, AP/GO mode THROTTLE=38
    [mthread]Create task:vtask(stack:3072),prio:3,ret:0 
    XXXX task:vtask
    [mthread]Create task:atask(stack:3072),prio:3,ret:0 
    XXXX task:atask
    [mthread]Create task:thdImage(stack:2048),prio:3,ret:0 
    XXXX task:thdImage
    [mthread]Create task:RT_REC(stack:2048),prio:3,ret:0 
    XXXX task:RT_REC
    [mthread]Create task:MD_TH(stack:2048),prio:3,ret:0 
    XXXX task:MD_TH
    [mthread]Create task:p2plis(stack:10240),prio:3,ret:0 
    XXXX task:p2plis
    [mthread]Create task:CameraTest(stack:2048),prio:3,ret:0 
    XXXX task:CameraTest
    [mthread]Create task:NetCheck(stack:2048),prio:3,ret:0 
    XXXX task:NetCheck
    sp0828 not support update bitrate
    sp0828 not support update venc
    task_aenc_stream runing
    set ircut color
    {0xfd, 0x00},
    [mthread]vvvthread NetCheck, tid:2181344 EXIT
    /camera_test.txt does not exist!
    [mthread]vvvthread CameraTest, tid:2182304 EXIT
    {0x62, 0x00},
    {0x63, 0x80},
    {0x64, 0x80},
    {0xff, 0xff},
    [mthread]vvvthread thdImage, tid:2182164 EXIT
    drop video frame:5
    drop video frame:4
    drop video frame:3
    drop video frame:2
    drop video frame:1
    <RTW>WiFi ap start ok:BATF087779AABAB, 0, 11
    wifi task exit
    [mthread]vvvthread wifitask, tid:2182804 EXIT
    [IpcP2pStart][  83]p2p starte,bP2pStarted=[0]
    
    rtuid:BATF-087779-GHJJL1N
    p2pID:BATF-087779-AABAB
    DataRW_Init bufferSize=32
    <L>lwip_close(0)
    <L>lwip_close(0)
    <L>mutex D:0x2295c8
    <L>lwip_close(SKT_0),tcp=0
    Success[0]--IlnkModP2pStart
    IpcSysInit:0
    [mthread]vvvthread p2plis, tid:2184208 EXIT
    [os E] OS_MutexLock():65, handle 0
    semaphore not initialized at line 448 in src/api/tcpip.c
    <L>Cmutex:0
    <L>Cmutex:0x248928
    netconn state error at line 1132 in src/api/api_msg.c
    <L>Cmutex:0
    <L>Cmutex:0x248a70
    <L>lwip_socket(PF_INET, UDP, 0) = SKT_0
    <L>lwip_socket(PF_INET, UDP, 17) = SKT_2
    <L>Cmutex:0
    <L>Cmutex:0x248bb0
    <L>lwip_socket(PF_INET, UDP, 0) = SKT_3
    network interface: en (Default)
    MTU: 1500
    MAC: 04 90 9f c6 1e 19 
    FLAGS: UP LINK_UP ETHARP IGMP
    ip address: 192.168.238.1
    gw address: 192.168.238.1
    net mask  : 255.255.255.0
    
    network interface: lo
    MTU: 0
    MAC: 
    FLAGS: UP LINK_UP
    ip address: 127.0.0.1
    gw address: 127.0.0.1
    net mask  : 255.0.0.0
    
    mean_vol=4100
    xr_newassoc(): link_id:0 mac:e4:b3:18:f6:91:cc
    en1: STA e4:b3:18:f6:91:cc IEEE 802.11: associated
    en1: AP-STA-CONNECTED e4:b3:18:f6:91:cc
    <L>Cmutex:0
    <L>Cmutex:0x241820
    <L>lwip_socket(PF_INET, TCP, 1) = SKT_4
    <L>lwip_close(4)
    <L>mutex D:0x241820
    <L>lwip_close(SKT_4),tcp=0
     ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbEvent.c cbEvenNoteFun 92
    [cbEvenNoteFun][ 100]LibEvent->eType-------------->LIB_EVENT_SESSION_STATUS
    
    p2pSession[privilege=0,status=1,peerAddr=]
    -------------->SESSION_CONNECTED_BY_P2P
     ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbSys.c cbSysCtrlFun 475
    [cbSysCtrlFun][ 509]SysCtrl->ctrlType-------------->SYS_CTRL_TYPE_USRCHK
    
    firstRTT=124,srtt=992
     ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302
    [cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_V_PARAM_SET
    
    [_VideoParamSet][ 142]cbVideoParamSet_t: channel 0 param:[1,2]
    
    VIDEO_PARAM_TYPE_RESOLUTION
    sp0828 not support update venc
     ../../../../project/demo/ilnk_demo_et_1mflash/ilnk_ipc/src/IpcCbAv.c cbAvCtrlFun 302
    [cbAvCtrlFun][ 305]AvCtrl->ctrlType-------------->AV_CTRL_TYPE_VID_START
    
    AV_CTRL_TYPE_VID_START
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    WAR Multicast delivery timeout.
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    WAR Multicast delivery timeout.
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    WAR Multicast delivery timeout.
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    ret[-1][errno:12][retry:0]---XqSckSendto
    
    

    hm ilnk_demo_et_1mflash

    Added after 28 [minutes]:

    I can read and write flash repeatedly via PhoenixMC. There is no need for opening the case, but @divadiow is right. OpenXR872 somehow fails to boot (no output?) on stock 1MB chip. I would never expect that.
    Helpful post? Buy me a coffee.
  • #116 21528571
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    UART access via USB;



    I made a version of this too for easy XF16 A9 cam backup/flash, even with cam unopened. I'll provide detail assuming some people may come direct to this message wanting to know how it can be done.

    I had a NodeMCU/ESP8266 with module removed. CH340 and LDO still work. I cut the USB-A end off a micro-USB cable, stripped the ends and soldered it up like so:

    NodeMCU/ESP8266 board with USB cable wires soldered to it; visible wires are red, black, white, and green. NodeMCU board connected to a camera PCB using a modified USB cable with exposed wires.

    Making use of the 5V from USB input on the AMS1117-33, GND and then RX/TX pads where the module was.
    Green USB D- ---> NodeMCU GPIO1 pad
    White USB D+ ---> NodeMCU GPIO3 pad
    Red USB VCC ---> AMS1117-33 5V leg
    Black USB GND ---> AMS1117-33 GND leg
    USB shielding not connected (potential for ground loop - is that correct?)

    visual aids:
    Photo of a USB cable with stripped wires: red, white, green, and black, labeled as power, data, and ground. Diagram of ESP8266 module pins with labeled functions and colored signal names.Diagram showing AMS1117 chip with labeled pins: ADJ/Ground, Input, Output.

    I'll tidy it up, insulate, secure etc for repeat use. The same could be made smaller I guess with USB-TTL adaptor with 5V header. Camera draw doesn't appear to be an issue, for me anyway.
    The actual backup and flash of XF16 is basically then this guide without needing to ground either PB02 or PB03 but go straight to backup steps: https://www.elektroda.com/rtvforum/topic4115856.html

    Probably worth adding that this is correct for A9s that appear to route their RX/TX through USB pins, as seen on the PCB here:
    Close-up view of a PCB with a micro USB port and labeled TX and RX pads.


  • #117 21528623
    p.kaczmarek2
    Moderator Smart Home
    @divadiow can you confirm - you can read and write flash via UART, if you flash OpenXR872 it does not boot, but you can still recover via UART, right? No CH341 needed? or at least it's that way for me.

    Btw, if you want, compare the binaries I added, are they the same? Or is there an unique section like device ID, etc?
    Helpful post? Buy me a coffee.
  • #118 21528638
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    an you confirm - you can read and write flash via UART, if you flash OpenXR872 it does not boot, but you can still recover via UART, right? No CH341 needed? or at least it's that way for me.


    this is still true for me. 1mb flash and OpenXR872 = no boot. 2mb flash soldered in + OpenXR872 = boots.

    I can recover factory firmware from flash backup over UART, yes. I have one in front of me now, with 1mb flash, that I have flashed back to factory and it is booting into A9 app and broadcasting AP

    Wi-Fi signal icon and the text BATD049321CKYWL on a gray bar.

    I'll do some firmware comparisons, first I will setup David Ventura's cam-reverse thing
  • #119 21528698
    p.kaczmarek2
    Moderator Smart Home
    divadiow wrote:

    this is still true for me. 1mb flash and OpenXR872 = no boot. 2mb flash soldered in + OpenXR872 = boots.

    Same. So we're on the same page. Hmm.

    That camera exploit has one issue. It seems you can't choose interface IP for pair operation due to the some mistake in code.
    Helpful post? Buy me a coffee.
  • #120 21528742
    divadiow
    Level 34  
    oh. I changed in bin.cjs

    A fragment of a TypeScript configuration file with IP addresses and server settings.

    but I have now paired to router AP and am using yaml from cam-reverse readme

    Blurry image with purple, yellow, and black areas, without clear details or recognizable objects.

    Added after 21 [minutes]:

    dump from another variant V380-E27_Bulb-Camera_T25S80.bin also boots, LED and button assignments are wrong, but AP broadcasts.

Topic summary

The discussion focuses on a variation of the A9 mini Wi-Fi camera featuring the XF16 PB380EA6341 MCU, an 8Mbit SPI flash chip labeled T25S80 (likely from ChipSourceTek), and the XR872 SoC running the Skylark SDK. Attempts to read and dump the flash firmware using tools like Flashrom, NeoProgrammer, and ASProgrammer faced challenges due to unrecognized SPI IDs and unreliable read/write operations, especially when the flash chip was in-circuit. Desoldering the flash chip improved read/write reliability. The firmware strings indicate the use of an RTOS and the iLnkP2P protocol for communication. The XR872 SDK (version 2.0 and later 1.2.x) was explored for building and flashing demo applications, including a "hello world" example, which successfully booted on the hardware after flashing via UART using PhoenixMC. Flashing custom firmware requires careful handling of flash erase and protection bits, with some users experiencing verification errors and random write failures. The flash layout includes an AWIH header and OTA partitions, with OTA updates compressed by XZ, raising concerns about fitting OTA images into the 1MB flash. Hardware details such as the presence of a pull-up resistor on the flash hold pin and UART pin configurations (PB02/PB03) were examined. The community also discussed the compatibility of different flash chip sizes (1MB vs 2MB) and the impact on firmware booting and flashing. Some users successfully transplanted firmware to larger flash chips (2MB) to run custom firmware like OpenXR872 (OBK). The discussion includes references to related projects for video stream capture without flashing (cam-reverse) and the challenges of flashing and booting custom firmware on these devices. Overall, the thread provides detailed technical insights into hardware probing, firmware extraction, SDK usage, flashing procedures, and troubleshooting for the XF16-based A9 mini camera variant with XR872 SoC.
Summary generated by the language model.
ADVERTISEMENT