Shenzhen Pinmei / Linklemo A9 Mini Camera with Beken BK7252NQN481 – Photos, Boot Log, Flash Backup

divadiow 2562 34

Reply Cool? Ranking DIY | New topic

Notify about new articles

Helpful post? (+5)

Helpful post
Post #1
21526681 21 Apr 2025 23:10

The ubiquitous A9 Mini Wi-Fi Camera, in its seemingly many forms, is a compact, budget-friendly smart surveillance device, often seen for as low as $1USD as a Welcome Deal on sites like Ali Express. Positioned as a security camera, baby monitor, spycam, camcorder, it is often advertised by sellers as being 4K, having night-vision/infra-red, AI, motion detection. It can usually be said that one or more of these claims is false or at best, exaggerated. The device that is the subject of this post is listed with these "sellpoints" on Ali:

-Xiaomi Mini Camera4k Wireless Wifi Remote Camera4K Ultra Clear Image Quality:Capture every detail with 4K resolution, ensuring clear and vivid footage even in low light.
-WiFi/IP/AP Flexible Connection:Seamless connectivity with multiple modes: WiFi, IP, or AP, for uninterrupted monitoring.
-Intelligent Mobile Detection:High-precision motion sensors trigger alerts, reducing false alarms and enhancing security.
-Portable Design with Magnetic Base:Easily place the camera in any corner with its magnetic base, saving space and ensuring flexibility.
-Long Term Battery Life:Reliable performance with a large capacity battery, ensuring worry-free operation.

I am immediately sceptical about it being 4K and having anything to do with Xiaomi!

My device was sourced from Ali here https://www.aliexpress.com/item/1005008584918966.html

I'll now start by documenting the packaging and device before diving into the internals. Subsequent posts will detail the pairing/app user experience, as well as providing real images and videos created by the device.

The box for this came marked with reference to "Shenzhen Pinmei Technology Co., Ltd".

Inside we see a 2mb BK7252NQN481 - datasheet: https://www.elektroda.com/rtvforum/topic4118348.html#21526095

from TX1 @115200 baud

Code: Text
Log in, to see the code

On one side are pads labelled TDI and TDO (accessible with camera ribbon removed). TMS and TCK are not so obvious.

TCK and TMS are these two:

I will later attempt SPI dump using these 4 pads as well as UART backup.

PCB text: INO-IPC-A9-V2.4 - I have not found FCC submissions for this device or company

From RX1/TX1 Easy Flasher reads in BK7252 mode but this skips bootloader. It also reads in N mode which covers the whole 2MB. Maybe BK7252N is more like BK7231N, it also seems to have a romcode like N. Maybe EF needs to have separate BK7252U and BK7252N modes. Maybe EF could have chip detect and it select the right mode if known? BK7252N CHIP_ID = 0x7252a

BKFIL is also happy with BK7252N where it wasn't interested in the older BK7252U.

Code: Text
Log in, to see the code

Flash ID is familiar EB6015 and coeff in efuse is 00e46d00 00e46d00 00e46d00 00e46d00

Code: Text
Log in, to see the code

I propose a split of BK7252U and N folders in FlashDumps https://github.com/openshwprojects/FlashDumps/pull/28

If accepted my backups will land in https://github.com/openshwprojects/FlashDumps/tree/main/IoT/BK7252N

that's it for tonight with this cam

Cool? Ranking DIY
About Author
divadiow divadiow

Level 34
Offline

Joined: 20 Nov 2023

Posts: 2788

Help: 249

Posts rating: 482

Points: 14468
divadiow wrote 2788 posts with rating 482, helped 249 times. Live in city Bristol. Been with us since 2023 year.
ADVERTISEMENT
#2 21526892 22 Apr 2025 10:07

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #2
21526892 22 Apr 2025 10:07

Are you sure that this device is encrypted? This encryption keys looks like the NiceMCU keys, which are invalid because readout is disabled. @insmod ?

Is your device working with this exploit (get video locally): https://www.elektroda.com/rtvforum/topic4117962.html

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#3 21526900 22 Apr 2025 10:17

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #3
21526900 22 Apr 2025 10:17

p.kaczmarek2 wrote:
Are you sure that this device is encrypted? This encryption keys looks like the NiceMCU keys, which are invalid because readout is disabled. @insmod ?

not yet analysed dump to see if encryption is used. that's just what was read from efuse.

if readout is disallowed isn't the read 00000s rather than an actual key?

p.kaczmarek2 wrote:
Is your device working with this exploit (get video locally): https://www.elektroda.com/rtvforum/topic4117962.html

not yet attempted
#4 21526914 22 Apr 2025 10:37

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Post #4
21526914 22 Apr 2025 10:37

There are string references, so I guess not encrypted.

I think we already saw the same "read key is incorrect" behaviour in this topic:
https://www.elektroda.com/rtvforum/topic4092465-60.html#21342226
Also here:
https://www.elektroda.com/rtvforum/topic4092465-30.html#21341811

So, is this chip like BK7231N, has it bootloader "stored outside in romcode", so it can't be bricked by writing garbage data to 0x0 - 0x11000 section? Or is it like BK7231T and old BK7252, where it can be bricked by overwriting bootloader in 0x0 - 0x11000 section (then it has to be recovered via SPI)?

It would be cool if this chip could boot on BK7231N binaries

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#5 21526936 22 Apr 2025 10:59

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #5
21526936 22 Apr 2025 10:59

p.kaczmarek2 wrote:
So, is this chip like BK7231N, has it bootloader "stored outside in romcode", so it can't be bricked by writing garbage data to 0x0 - 0x11000 section?

I assumed/hoped so. I'll get working SPI method then confirm by killing 0x0->

Added after 5 [minutes]:

I've not looked inside it, but the rom dump was also successful. In flashdumps.
#6 21526965 22 Apr 2025 11:20

insmod insmod

Level 23

Helpful post? (+1)

Post #6
21526965 22 Apr 2025 11:20

Rom mentions BK7238 at 0x18B8, so i guess you would have to try to boot 7238 binaries, and not N.
And keys readout is not disabled, since we can get at least something out of them, but addresses were probably just shifted,
#7 21526977 22 Apr 2025 11:26

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #7
21526977 22 Apr 2025 11:26

cool cool.

insmod wrote:
Rom mentions BK7238 at 0x18B8

ah yes. did notice this in main flash dump actually

#8 21527046 22 Apr 2025 12:38

insmod insmod

Level 23

Post #8

21527046 22 Apr 2025 12:38

Maybe you should also try to take a 4M backup?
FAL prints that flash length is 4M, even if partitions are configured to 2M


[D/FAL] (fal_flash_init:63) Flash device |             beken_onchip | addr: 0x00000000 | len: 0x00400000 | blk_size: 0x00001000 |initialized finish.
[D/FAL] (fal_flash_init:63) Flash device |         beken_onchip_crc | addr: 0x00000000 | len: 0x00400000 | blk_size: 0x00001000 |initialized finish.

ADVERTISEMENT
#9 21527055 22 Apr 2025 12:49

divadiow divadiow

Level 34
Topic author Helpful post? (0)

Post #9
21527055 22 Apr 2025 12:49

interesting.
0x0-0x400000 result from BKFIL attached. shows repeat at 2mb though

Attachments:

x1_0_dump_20250422_114508_0x0_0x400000.bin Download (4 MB)

#10 21527091 22 Apr 2025 15:20

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

It's the address wrap around I've mentioned recently. This is the way we can read bootloader on BK7231T. BK7231T has read offset 0x0 to 0x11000 protected, but if we add 2MB, then we can both read.... and write there. That's how you can brick your BK7231T.

Added after 1 [hours] 49 [minutes]:

Tried flashing to BK7238, no luck:


BK7238_1.0.14                                       
REG:cpsr        spsr        r13         r14            
SVC:0x000000D3              0x00401C1C  0x000033A0       
IRQ:0x000000D2  0x00000010  0x00401E0C  0x27C9E5CB  
FIR:0x000000D1  0x00000010  0x00401FFC  0x8C30D003  
SYS:0x000000DF              0x0040192C  0x00000158     
ST:0x00010000                                     
[32;22m[I/FAL] Fal(V0.4.0)success[0m
                                       [36;22m[I/OTA] RT-Thread OTA package(V0.
2.8-beken-1133282d-20220604) initialize success.[0m
                          
[31;22m[E/OTA] (ota_main:178) App verify failed! Need to recovery factory firmw
are.[0m
                                                                       
                                             
go os_addr(0x10000)..........

and if I flash with bootloader overwrite:


BK7252N_1.0.14
                                                                
REG:cpsr        spsr        r13         r14                     
SVC:0x000000D3              0x00401C1C  0x000033A0              
IRQ:0x000000D2  0x00000010  0x00401E0C  0x0789E181         
FIR:0x000000D1  0x00000010  0x00401FFC  0x8430D003      
SYS:0x000000DF              0x0040192C  0x00000158                 
ST:0x00010000                                                    
[32;22m[I/FAL] Fal(V0.4.0)success[0m
                                         
                                       [36;22m[I/OTA] RT-Thread OTA package(V0.
2.8-beken-1133282d-20220604) initialize success.[0m
                          
[31;22m[E/OTA] (ota_main:178) App verify failed! Need to recovery factory firmw
are.[0m
                                                                                                                         
go os_addr(0x10000)..........

Interesting, it managed to print out stuff and identify itself as BK7252N:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

#11 21527586 22 Apr 2025 21:42

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #11
21527586 22 Apr 2025 21:42

xref: accidental post about this cam in other thread re SPI https://www.elektroda.com/rtvforum/topic4118348.html#21527527
ADVERTISEMENT
#12 21527849 23 Apr 2025 09:07

austin007 austin007

Level 17

» | Helpful post? (0)

Post #12
21527849 23 Apr 2025 09:07

Thank you for sharing your work. Is it the same hardware as in the round A9 camera from the thread discussed earlier*? I looked at a picture of one customer on Aliexpress and it looks better than the ones from the round A9. If it's the same image sensor and lens, the difference is due to the firmware and would manage to upload it from yours to the round A9.

*https://www.elektroda.pl/rtvforum/topic4117962.html
AE photo:
.
#13 21527997 23 Apr 2025 11:36

error105 error105

Level 14

» | Helpful post? (0)

Post #13
21527997 23 Apr 2025 11:36

And I'm interested in whether it outputs any stream? For 9£ a nice option to read my analogue water meter, I have an ESP32CAM there but this one so much more convenient because it has a case etc
#14 21528009 23 Apr 2025 11:50

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (0)

Post #14
21528009 23 Apr 2025 11:50

@austin007 we've already seen about four variants of these A9s and their batches are not interchangeable with each other (there is either BK7525, or BK7525N, or XF16, or some other chip). On the other hand we would still love to see the inside of your camera from @divadiow , what MCU do you have inside there? Will you rip the batch?

@error105 in this topic we are focusing on changing the firmware. Access to the video stream is available without changing the firmware. This was presented here: How to access the A9 camera video stream for $1 from the LAN (NodeJS) site? .

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#15 21528651 23 Apr 2025 21:44

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #15
21528651 23 Apr 2025 21:44

>>21527849

that sample pic looks too good to be an A9 cam though doesn't it? The aspect ratio and wide angle lens isn't something I've seen I don't think for a camera at this level, not my A9s anyway.

on the subject of cameras, this section in the boot log I think is the device trying to match i2c addresses for cameras the firmware supports so it knows which to initialise

Code: Text
Log in, to see the code

It finally settles on GC0329C.

Galaxy Core - GC0329 - 0.3M - 640*480@15fps
#16 21528719 23 Apr 2025 22:44

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #16
21528719 23 Apr 2025 22:44

salve_id is in BK code:

Btw maybe we should add a "camera" tag for Devices List?
https://openbekeniot.github.io/webapp/devicesList.html

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#17 21528729 23 Apr 2025 22:50

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #17
21528729 23 Apr 2025 22:50

sure. there are other platforms missing too though.
#18 21528956 24 Apr 2025 09:05

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Post #18
21528956 24 Apr 2025 09:05

This also needs to be fixed - there is just one result for "camera" on our site:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#19 21529763 24 Apr 2025 20:45

divadiow divadiow

Level 34
Topic author Helpful post? (+1)

Post #19
21529763 24 Apr 2025 20:45

On the subject of the Pinmei A9 BK7252 cam:

in pairing mode it broadcasts an AP - the SSID and key for which can be seen in the boot log

Code: Text
Log in, to see the code

client is assigned 192.168.9.100 from cam on 192.168.9.252

Nmap with scan command nmap -sS -sU -T4 -v -p T:0-65535,U:0-65535 192.168.9.252 sees these ports and states:

Code: Text
Log in, to see the code

mention of one such ports here https://community.home-assistant.io/t/popular...mini-wi-fi-camera-the-ha-challenge/230108/394

no signs of life with cam-reverse

And now pairing with the official "Linklemo" app https://play.google.com/store/apps/details?id=com.xcthings.fchan

video and image samples attached

Attachments:

PPH0A906615F0207B0_1745386410883.jpg Download (19.18 KB)

PPH0A906615F0207B0_1745386441723.mp4 Download (811.44 KB)
#20 21529911 24 Apr 2025 23:04

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #20
21529911 24 Apr 2025 23:04

Are you able to pair with this app without pairing with cloud? Via access point?

Can you provide here the APK file of this app? Maybe we could analyze it.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#21 21530062 25 Apr 2025 08:04

divadiow divadiow

Level 34
Topic author Helpful post? (0)

Post #21
21530062 25 Apr 2025 08:04

p.kaczmarek2 wrote:
Are you able to pair with this app without pairing with cloud? Via access point?

haven't tried, but app requires registration and login and there are at least these IPs it wants to access, so...

prod.glbs.xcthings.com - 47.240.1.244, 47.252.5.225, 8.209.77.49, 39.108.59.60

https://reports.exodus-privacy.eu.org/en/reports/596710/

Attachments:

apktool_decode_com.xcthings.fchan.apk.zip Download (146.31 MB)

Report for com.xcthings.fchan 1.18.34.129_250418 - εxodus.zip Download (357.99 KB)

com.xcthings.fchan.zip Download (47.81 MB)
#22 21530553 25 Apr 2025 16:17

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #22
21530553 25 Apr 2025 16:17

There seems to be some packet parsing and writing in your disassembly, but I am not even sure if it's for communication with the camera or with the cloud. It seems to be using Google Protocol Buffers:
https://protobuf.dev/
More in-depth analysis is needed.

It would help to know whether it's possible at to interface those cameras without cloud.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#23 21532561 27 Apr 2025 17:28

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #23
21532561 27 Apr 2025 17:28

p.kaczmarek2 wrote:
It would help to know whether it's possible at to interface those cameras without cloud.

not having much luck. with phone on AP with no internet the device pairing process just times out and:

log out as it connects

Code: Text
Log in, to see the code
#24 21540472 06 May 2025 00:08

Testerrr Testerrr

Level 25

» | Helpful post? (0)

Post #24
21540472 06 May 2025 00:08

I noticed that you can have a preview in the Linklemo app when you are connected to the camera when it is AP mode. My phone has data off. Wifi connected to LLM_H0A9_07B75F. There is a preview. In Network info same zeros, only MAC address is given. Connection settings cannot be changed. Repairing does not work. Even disconnect does not work
(this function is not supported in local mode). On github they wrote that no connection settings can be changed in local mode.

I also failed to access stream:
node bin.cjs http_server --config_file config.yml
2025-05-05T21:40:45.023Z [info] Starting HTTP server on port 5000
2025-05-05T21:40:45.029Z [info] Searching for devices on 192.168.9.252

The port scanner detects the address 192.168.9.252, it appears as Beken Corporation.
Is there any way to connect to the stream from Windows? Is it necessary to change the firmware?
#25 21540483 06 May 2025 00:18

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (0)

Post #25
21540483 06 May 2025 00:18

The new firmware does not yet support the camera controller anyway, so it won't do much for now.

And which camera do you have exactly? The one in the topic, on the BK7252N?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#26 21540644 06 May 2025 08:27

Testerrr Testerrr

Level 25

» | Helpful post? (0)

Post #26
21540644 06 May 2025 08:27

I own the camera from this topic. BK7252N. Well nothing, it remains to wait. Maybe when the camera gains popularity and displaces these round A9s, then maybe something will move on the subject....

Regards.
#27 21564217 29 May 2025 20:54

austin007 austin007

Level 17

» | Helpful post? (0)

Post #27
21564217 29 May 2025 20:54

My A9 round is an early version. Quite poor with a sub-lens without coatings. BK7252 UQN68, not sure what the matrix is. Battery faded. Cost $1 at mayfriend a few over a year ago.
.
.
.
.
#28 21564294 29 May 2025 22:18

divadiow divadiow

Level 34

Topic author Helpful post? (+1)

Post #28
21564294 29 May 2025 22:18

interesting. thanks for posting! have you considered capturing the boot log from the TX pad and then maybe dumping firmware from RX/TX or, probably better, the unlabelled pads on the underside which are possibly usable with a CH341A? This approach was taken with this BK7252U https://www.elektroda.com/rtvforum/topic4123266.html
#29 21584055 19 Jun 2025 19:35

insmod insmod

Level 23

Helpful post? (+1)

Post #29
21584055 19 Jun 2025 19:35

BK7252N build, untested.
https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/15763367928/artifacts/3364979193
#30 21584124 19 Jun 2025 20:44

divadiow divadiow

Level 34

Topic author Helpful post? (0)

Post #30
21584124 19 Jun 2025 20:44

excellent. will test. just gotta finish a short post about another BK7252U cam
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Reply Cool? Ranking DIY | New topic

Notify about new articles

Report a violation of the law

Topic summary

The Shenzhen Pinmei / Linklemo A9 Mini Camera featuring the Beken BK7252NQN481 SoC is a low-cost Wi-Fi surveillance device often marketed with exaggerated features such as 4K resolution and advanced AI capabilities. Analysis of the device's firmware and boot logs reveals it uses a GC0329C image sensor (0.3MP, 640x480@15fps) rather than a true 4K sensor. The device broadcasts an access point (SSID: LLM_H0A9_xxxxxx) with default credentials and assigns IP addresses in the 192.168.9.x subnet. Network scans show open TCP and UDP ports, but attempts to pair or access the video stream locally without cloud interaction are limited or time out. The firmware is based on Beken chips related to BK7231 and BK7238 families, with bootloader and flash memory characteristics discussed, including flash size (4MB with 2MB wrap-around) and encryption key readout issues. Attempts to flash BK7238 firmware were unsuccessful. The device requires cloud-based app registration for full functionality, and local mode restricts configuration changes. Current open-source firmware support is limited, and no stable method exists yet to access the video stream from Windows or replace the firmware to unlock full local control. The discussion highlights the diversity of A9 Mini camera variants with different chipsets (BK7525, BK7525N, XF16) and the need for further reverse engineering to enable local streaming and firmware modification.
Summary generated by the language model.