Shenzhen Pinmei / Linklemo A9 Mini Camera with Beken BK7252NQN481 – Photos, Boot Log, Flash Backup

divadiow 12117 110

TL;DR

The post teardowns a Shenzhen Pinmei / Linklemo A9 Mini Wi‑Fi camera sold as a cheap “4K” surveillance device, baby monitor, spycam, or camcorder.
Inside, it uses a Beken BK7252NQN481 with an INO-IPC-A9-V2.4 PCB, and the pad layout exposes TDI, TDO, TCK, TMS, RX1, and TX1 for access.
Easy Flasher reads the chip in BK7252 and BK7252N modes, BKFIL accepts BK7252N, and the flash backup shows a 2 MB EB6015 SPI flash.
The camera is still under investigation for real pairing, app behavior, and captured images, but no FCC submission was found for the device or company.

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Topic author Helpful post? (+12)

Helpful post
Post #1
21526681 21 Apr 2025 23:10

The ubiquitous A9 Mini Wi-Fi Camera, in its seemingly many forms, is a compact, budget-friendly smart surveillance device, often seen for as low as $1USD as a Welcome Deal on sites like Ali Express. Positioned as a security camera, baby monitor, spycam, camcorder, it is often advertised by sellers as being 4K, having night-vision/infra-red, AI, motion detection. It can usually be said that one or more of these claims is false or at best, exaggerated. The device that is the subject of this post is listed with these "sellpoints" on Ali:

-Xiaomi Mini Camera4k Wireless Wifi Remote Camera4K Ultra Clear Image Quality:Capture every detail with 4K resolution, ensuring clear and vivid footage even in low light.
-WiFi/IP/AP Flexible Connection:Seamless connectivity with multiple modes: WiFi, IP, or AP, for uninterrupted monitoring.
-Intelligent Mobile Detection:High-precision motion sensors trigger alerts, reducing false alarms and enhancing security.
-Portable Design with Magnetic Base:Easily place the camera in any corner with its magnetic base, saving space and ensuring flexibility.
-Long Term Battery Life:Reliable performance with a large capacity battery, ensuring worry-free operation.

I am immediately sceptical about it being 4K and having anything to do with Xiaomi!

My device was sourced from Ali here https://www.aliexpress.com/item/1005008584918966.html

I'll now start by documenting the packaging and device before diving into the internals. Subsequent posts will detail the pairing/app user experience, as well as providing real images and videos created by the device.

The box for this came marked with reference to "Shenzhen Pinmei Technology Co., Ltd".

Inside we see a 2mb BK7252NQN481 - datasheet: https://www.elektroda.com/rtvforum/topic4118348.html#21526095

from TX1 @115200 baud

Code: Text
Log in, to see the code

On one side are pads labelled TDI and TDO (accessible with camera ribbon removed). TMS and TCK are not so obvious.

TCK and TMS are these two:

I will later attempt SPI dump using these 4 pads as well as UART backup.

PCB text: INO-IPC-A9-V2.4 - I have not found FCC submissions for this device or company

From RX1/TX1 Easy Flasher reads in BK7252 mode but this skips bootloader. It also reads in N mode which covers the whole 2MB. Maybe BK7252N is more like BK7231N, it also seems to have a romcode like N. Maybe EF needs to have separate BK7252U and BK7252N modes. Maybe EF could have chip detect and it select the right mode if known? BK7252N CHIP_ID = 0x7252a

BKFIL is also happy with BK7252N where it wasn't interested in the older BK7252U.

Code: Text
Log in, to see the code

Flash ID is familiar EB6015 and coeff in efuse is 00e46d00 00e46d00 00e46d00 00e46d00

Code: Text
Log in, to see the code

I propose a split of BK7252U and N folders in FlashDumps https://github.com/openshwprojects/FlashDumps/pull/28

If accepted my backups will land in https://github.com/openshwprojects/FlashDumps/tree/main/IoT/BK7252N

that's it for tonight with this cam

Sep 2025. Adding image for device list

Cool? Ranking DIY
About Author
divadiow divadiow

Level 38
Offline

Joined: 20 Nov 2023

Posts: 4676

Help: 409

Posts rating: 830

Points: 23332
divadiow wrote 4676 posts with rating 830, helped 409 times. Live in city Bristol. Been with us since 2023 year.

ADVERTISEMENT
#2 21526892 22 Apr 2025 10:07

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #2
21526892 22 Apr 2025 10:07

Are you sure that this device is encrypted? This encryption keys looks like the NiceMCU keys, which are invalid because readout is disabled. @insmod ?

Is your device working with this exploit (get video locally): https://www.elektroda.com/rtvforum/topic4117962.html

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#3 21526900 22 Apr 2025 10:17

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #3
21526900 22 Apr 2025 10:17

p.kaczmarek2 wrote:
Are you sure that this device is encrypted? This encryption keys looks like the NiceMCU keys, which are invalid because readout is disabled. @insmod ?

not yet analysed dump to see if encryption is used. that's just what was read from efuse.

if readout is disallowed isn't the read 00000s rather than an actual key?

p.kaczmarek2 wrote:
Is your device working with this exploit (get video locally): https://www.elektroda.com/rtvforum/topic4117962.html

not yet attempted
#4 21526914 22 Apr 2025 10:37

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Post #4
21526914 22 Apr 2025 10:37

There are string references, so I guess not encrypted.

I think we already saw the same "read key is incorrect" behaviour in this topic:
https://www.elektroda.com/rtvforum/topic4092465-60.html#21342226
Also here:
https://www.elektroda.com/rtvforum/topic4092465-30.html#21341811

So, is this chip like BK7231N, has it bootloader "stored outside in romcode", so it can't be bricked by writing garbage data to 0x0 - 0x11000 section? Or is it like BK7231T and old BK7252, where it can be bricked by overwriting bootloader in 0x0 - 0x11000 section (then it has to be recovered via SPI)?

It would be cool if this chip could boot on BK7231N binaries

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#5 21526936 22 Apr 2025 10:59

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #5
21526936 22 Apr 2025 10:59

p.kaczmarek2 wrote:
So, is this chip like BK7231N, has it bootloader "stored outside in romcode", so it can't be bricked by writing garbage data to 0x0 - 0x11000 section?

I assumed/hoped so. I'll get working SPI method then confirm by killing 0x0->

Added after 5 [minutes]:

I've not looked inside it, but the rom dump was also successful. In flashdumps.
#6 21526965 22 Apr 2025 11:20

insmod insmod

Level 31

Helpful post? (+1)

Post #6
21526965 22 Apr 2025 11:20

Rom mentions BK7238 at 0x18B8, so i guess you would have to try to boot 7238 binaries, and not N.
And keys readout is not disabled, since we can get at least something out of them, but addresses were probably just shifted,
#7 21526977 22 Apr 2025 11:26

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #7
21526977 22 Apr 2025 11:26

cool cool.

insmod wrote:
Rom mentions BK7238 at 0x18B8

ah yes. did notice this in main flash dump actually

#8 21527046 22 Apr 2025 12:38

insmod insmod

Level 31

Post #8

21527046 22 Apr 2025 12:38

Maybe you should also try to take a 4M backup?
FAL prints that flash length is 4M, even if partitions are configured to 2M


[D/FAL] (fal_flash_init:63) Flash device |             beken_onchip | addr: 0x00000000 | len: 0x00400000 | blk_size: 0x00001000 |initialized finish.
[D/FAL] (fal_flash_init:63) Flash device |         beken_onchip_crc | addr: 0x00000000 | len: 0x00400000 | blk_size: 0x00001000 |initialized finish.

#9 21527055 22 Apr 2025 12:49

divadiow divadiow

Level 38
Topic author Helpful post? (0)

Post #9
21527055 22 Apr 2025 12:49

interesting.
0x0-0x400000 result from BKFIL attached. shows repeat at 2mb though

Attachments:

x1_0_dump_20250422_114508_0x0_0x400000.bin (4 MB) You must be logged in to download this attachment.
ADVERTISEMENT

#10 21527091 22 Apr 2025 15:20

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

It's the address wrap around I've mentioned recently. This is the way we can read bootloader on BK7231T. BK7231T has read offset 0x0 to 0x11000 protected, but if we add 2MB, then we can both read.... and write there. That's how you can brick your BK7231T.

Added after 1 [hours] 49 [minutes]:

Tried flashing to BK7238, no luck:


BK7238_1.0.14                                       
REG:cpsr        spsr        r13         r14            
SVC:0x000000D3              0x00401C1C  0x000033A0       
IRQ:0x000000D2  0x00000010  0x00401E0C  0x27C9E5CB  
FIR:0x000000D1  0x00000010  0x00401FFC  0x8C30D003  
SYS:0x000000DF              0x0040192C  0x00000158     
ST:0x00010000                                     
[32;22m[I/FAL] Fal(V0.4.0)success[0m
                                       [36;22m[I/OTA] RT-Thread OTA package(V0.
2.8-beken-1133282d-20220604) initialize success.[0m
                          
[31;22m[E/OTA] (ota_main:178) App verify failed! Need to recovery factory firmw
are.[0m
                                                                       
                                             
go os_addr(0x10000)..........

and if I flash with bootloader overwrite:


BK7252N_1.0.14
                                                                
REG:cpsr        spsr        r13         r14                     
SVC:0x000000D3              0x00401C1C  0x000033A0              
IRQ:0x000000D2  0x00000010  0x00401E0C  0x0789E181         
FIR:0x000000D1  0x00000010  0x00401FFC  0x8430D003      
SYS:0x000000DF              0x0040192C  0x00000158                 
ST:0x00010000                                                    
[32;22m[I/FAL] Fal(V0.4.0)success[0m
                                         
                                       [36;22m[I/OTA] RT-Thread OTA package(V0.
2.8-beken-1133282d-20220604) initialize success.[0m
                          
[31;22m[E/OTA] (ota_main:178) App verify failed! Need to recovery factory firmw
are.[0m
                                                                                                                         
go os_addr(0x10000)..........

Interesting, it managed to print out stuff and identify itself as BK7252N:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

#11 21527586 22 Apr 2025 21:42

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #11
21527586 22 Apr 2025 21:42

xref: accidental post about this cam in other thread re SPI https://www.elektroda.com/rtvforum/topic4118348.html#21527527
#12 21527849 23 Apr 2025 09:07

austin007 austin007

Level 17

» | Helpful post? (0)

Post #12
21527849 23 Apr 2025 09:07

Thank you for sharing your work. Is it the same hardware as in the round A9 camera from the thread discussed earlier*? I looked at a picture of one customer on Aliexpress and it looks better than the ones from the round A9. If it's the same image sensor and lens, the difference is due to the firmware and would manage to upload it from yours to the round A9.

*https://www.elektroda.pl/rtvforum/topic4117962.html
AE photo:
.
ADVERTISEMENT
#13 21527997 23 Apr 2025 11:36

error105 error105

Level 14

» | Helpful post? (0)

Post #13
21527997 23 Apr 2025 11:36

And I'm interested in whether it outputs any stream? For 9£ a nice option to read my analogue water meter, I have an ESP32CAM there but this one so much more convenient because it has a case etc
#14 21528009 23 Apr 2025 11:50

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (0)

Post #14
21528009 23 Apr 2025 11:50

@austin007 we've already seen about four variants of these A9s and their batches are not interchangeable with each other (there is either BK7525, or BK7525N, or XF16, or some other chip). On the other hand we would still love to see the inside of your camera from @divadiow , what MCU do you have inside there? Will you rip the batch?

@error105 in this topic we are focusing on changing the firmware. Access to the video stream is available without changing the firmware. This was presented here: How to access the A9 camera video stream for $1 from the LAN (NodeJS) site? .

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#15 21528651 23 Apr 2025 21:44

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #15
21528651 23 Apr 2025 21:44

>>21527849

that sample pic looks too good to be an A9 cam though doesn't it? The aspect ratio and wide angle lens isn't something I've seen I don't think for a camera at this level, not my A9s anyway.

on the subject of cameras, this section in the boot log I think is the device trying to match i2c addresses for cameras the firmware supports so it knows which to initialise

Code: Text
Log in, to see the code

It finally settles on GC0329C.

Galaxy Core - GC0329 - 0.3M - 640*480@15fps
#16 21528719 23 Apr 2025 22:44

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #16
21528719 23 Apr 2025 22:44

salve_id is in BK code:

Btw maybe we should add a "camera" tag for Devices List?
https://openbekeniot.github.io/webapp/devicesList.html

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#17 21528729 23 Apr 2025 22:50

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #17
21528729 23 Apr 2025 22:50

sure. there are other platforms missing too though.
#18 21528956 24 Apr 2025 09:05

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Post #18
21528956 24 Apr 2025 09:05

This also needs to be fixed - there is just one result for "camera" on our site:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#19 21529763 24 Apr 2025 20:45

divadiow divadiow

Level 38
Topic author Helpful post? (+1)

Post #19
21529763 24 Apr 2025 20:45

On the subject of the Pinmei A9 BK7252 cam:

in pairing mode it broadcasts an AP - the SSID and key for which can be seen in the boot log

Code: Text
Log in, to see the code

client is assigned 192.168.9.100 from cam on 192.168.9.252

Nmap with scan command nmap -sS -sU -T4 -v -p T:0-65535,U:0-65535 192.168.9.252 sees these ports and states:

Code: Text
Log in, to see the code

mention of one such ports here https://community.home-assistant.io/t/popular...mini-wi-fi-camera-the-ha-challenge/230108/394

no signs of life with cam-reverse

And now pairing with the official "Linklemo" app https://play.google.com/store/apps/details?id=com.xcthings.fchan

video and image samples attached

Attachments:

PPH0A906615F0207B0_1745386441723.mp4 (811.44 KB) You must be logged in to download this attachment.

PPH0A906615F0207B0_1745386410883.jpg (19.18 KB) You must be logged in to download this attachment.
#20 21529911 24 Apr 2025 23:04

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #20
21529911 24 Apr 2025 23:04

Are you able to pair with this app without pairing with cloud? Via access point?

Can you provide here the APK file of this app? Maybe we could analyze it.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#21 21530062 25 Apr 2025 08:04

divadiow divadiow

Level 38
Topic author Helpful post? (0)

Post #21
21530062 25 Apr 2025 08:04

p.kaczmarek2 wrote:
Are you able to pair with this app without pairing with cloud? Via access point?

haven't tried, but app requires registration and login and there are at least these IPs it wants to access, so...

prod.glbs.xcthings.com - 47.240.1.244, 47.252.5.225, 8.209.77.49, 39.108.59.60

https://reports.exodus-privacy.eu.org/en/reports/596710/

Attachments:

apktool_decode_com.xcthings.fchan.apk.zip (146.31 MB) You must be logged in to download this attachment.

Report for com.xcthings.fchan 1.18.34.129_250418 - εxodus.zip (357.99 KB) You must be logged in to download this attachment.

com.xcthings.fchan.zip (47.81 MB) You must be logged in to download this attachment.
#22 21530553 25 Apr 2025 16:17

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #22
21530553 25 Apr 2025 16:17

There seems to be some packet parsing and writing in your disassembly, but I am not even sure if it's for communication with the camera or with the cloud. It seems to be using Google Protocol Buffers:
https://protobuf.dev/
More in-depth analysis is needed.

It would help to know whether it's possible at to interface those cameras without cloud.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#23 21532561 27 Apr 2025 17:28

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #23
21532561 27 Apr 2025 17:28

p.kaczmarek2 wrote:
It would help to know whether it's possible at to interface those cameras without cloud.

not having much luck. with phone on AP with no internet the device pairing process just times out and:

log out as it connects

Code: Text
Log in, to see the code
#24 21540472 06 May 2025 00:08

Testerrr Testerrr

Level 25

» | Helpful post? (0)

Post #24
21540472 06 May 2025 00:08

I noticed that you can have a preview in the Linklemo app when you are connected to the camera when it is AP mode. My phone has data off. Wifi connected to LLM_H0A9_07B75F. There is a preview. In Network info same zeros, only MAC address is given. Connection settings cannot be changed. Repairing does not work. Even disconnect does not work
(this function is not supported in local mode). On github they wrote that no connection settings can be changed in local mode.

I also failed to access stream:
node bin.cjs http_server --config_file config.yml
2025-05-05T21:40:45.023Z [info] Starting HTTP server on port 5000
2025-05-05T21:40:45.029Z [info] Searching for devices on 192.168.9.252

The port scanner detects the address 192.168.9.252, it appears as Beken Corporation.
Is there any way to connect to the stream from Windows? Is it necessary to change the firmware?
#25 21540483 06 May 2025 00:18

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (0)

Post #25
21540483 06 May 2025 00:18

The new firmware does not yet support the camera controller anyway, so it won't do much for now.

And which camera do you have exactly? The one in the topic, on the BK7252N?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#26 21540644 06 May 2025 08:27

Testerrr Testerrr

Level 25

» | Helpful post? (0)

Post #26
21540644 06 May 2025 08:27

I own the camera from this topic. BK7252N. Well nothing, it remains to wait. Maybe when the camera gains popularity and displaces these round A9s, then maybe something will move on the subject....

Regards.
#27 21564217 29 May 2025 20:54

austin007 austin007

Level 17

» | Helpful post? (0)

Post #27
21564217 29 May 2025 20:54

My A9 round is an early version. Quite poor with a sub-lens without coatings. BK7252 UQN68, not sure what the matrix is. Battery faded. Cost $1 at mayfriend a few over a year ago.
.
.
.
.
#28 21564294 29 May 2025 22:18

divadiow divadiow

Level 38

Topic author Helpful post? (+1)

Post #28
21564294 29 May 2025 22:18

interesting. thanks for posting! have you considered capturing the boot log from the TX pad and then maybe dumping firmware from RX/TX or, probably better, the unlabelled pads on the underside which are possibly usable with a CH341A? This approach was taken with this BK7252U https://www.elektroda.com/rtvforum/topic4123266.html
#29 21584055 19 Jun 2025 19:35

insmod insmod

Level 31

Helpful post? (+1)

Post #29
21584055 19 Jun 2025 19:35

BK7252N build, untested.
https://github.com/NonPIayerCharacter/OpenBK7...actions/runs/15763367928/artifacts/3364979193
#30 21584124 19 Jun 2025 20:44

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #30
21584124 19 Jun 2025 20:44

excellent. will test. just gotta finish a short post about another BK7252U cam
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Topic summary

✨ The discussion focuses on the Shenzhen Pinmei / Linklemo A9 Mini Wi-Fi Camera featuring the Beken BK7252NQN481 chipset. This budget smart camera, often sold for around $1 USD, is marketed with exaggerated claims such as 4K resolution and advanced AI features. Technical analysis reveals the device uses a BK7252N chip, with bootloader and firmware characteristics similar to BK7231 series but distinct in memory mapping and encryption behavior. The camera sensor identified is the GC0329C (GalaxyCore 0.3MP, 640x480@15fps). Firmware dumping and boot log extraction have been performed via serial pads and SPI interfaces, with attempts to flash BK7238 binaries unsuccessful. The device broadcasts an access point (SSID: LLM_H0A9_xxxxxx) with default key, assigning IP 192.168.9.252, exposing several open TCP/UDP ports. Local video stream access is possible without firmware modification, but pairing requires cloud interaction via the Linklemo app, which demands registration and communicates with external servers. Efforts to bypass cloud dependency have been limited by pairing timeouts and app restrictions. OpenBK7231T firmware support for BK7252N is in development, with recent successful OTA flashing and boot logs indicating stable operation. Memory management issues such as realloc instability on BK7252N are under investigation. The community is exploring creating development boards from these cameras and expanding device support tags for better cataloging. Overall, the device is a low-cost, partially hackable smart camera with limited local control and ongoing firmware development efforts.

FAQ

TL;DR: For hackers, repairers, and OpenBeken users, this FAQ shows how to back up a 2 MB BK7252N A9 camera safely and why “it shows repeat at 2mb though” explains the fake 4 MB readout. It also clarifies CRC, pad mapping, AP-mode networking, and today’s limits of alternative firmware on Linklemo/XCThings cameras. [#21527055]

Why it matters: These $1–$9 A9 variants look identical, but the chip, flash behavior, sensor, and cloud dependence change what you can dump, patch, or replace.

Platform	Flash/backup status	Local video extraction	Alternative firmware status
BK7252N A9	Full UART backup works; 2 MB image commonly repeats when read as 4 MB	Not yet reliably extracted on this family	Boots OpenBeken builds, but no camera support yet
BK7252U A9	Backup methods exist, but behavior differs from N	Limited; model-dependent	Earlier support focus than N
TXW817 A9	Different toolchain and reverse-engineering path	Better supported for stream access	Camera already works on that platform

Key insight: On these Linklemo BK7252N cameras, the hard part is no longer reading flash. The real blockers are per-block CRC, proprietary PPRPC messaging, and missing camera-driver support in OpenBeken.

Quick Facts

The main board is marked INO-IPC-A9-V2.4, uses a BK7252NQN481, and the successful full dump size reported by BKFIL was 0x200000 = 2,048 KB at 115200 baud. [#21526681]
The boot log exposes a FAL layout with bootloader at 0x00000000–0x00010000, app at 0x00010000–0x00120000, and download at 0x00132000–0x001E0000. [#21526681]
In AP pairing mode, the camera advertises LLM_H0A9_06615F with password 12345678, gives the client 192.168.9.100, and uses 192.168.9.252 for the camera itself. [#21529763]
Sensor probing in the boot log rejects several candidates, then initializes GC0329C, a 0.3 MP sensor rated in-thread at 640×480 @ 15 fps. [#21528651]
OpenBeken can now boot on BK7252N and OTA between builds, but the thread states camera control is still missing; today it mainly gives LEDs, buttons, battery voltage, Wi‑Fi, and web access. [#21584909]

How can I dump the full flash from a Shenzhen Pinmei / Linklemo A9 Mini Camera with a Beken BK7252N using BKFIL or Easy Flasher?

You can dump the full flash over UART, and BKFIL already proved it on this camera. 1. Solder to RX1/TX1 and GND, then power the board normally. 2. Start BKFIL bk_loader read before power-on or reset, using BK7252N mode and -f 0-200000 for a 2 MB read. 3. Reboot the camera at the prompt so the boot ROM catches. One successful read used 115200 baud and finished in 190.981 s for 0x200000 bytes. Easy Flasher also reads it, but BKFIL handled BK7252N more cleanly in-thread. [#21526681]

Why does BKFIL report 4 MB of flash on the BK7252N A9 camera when the backup appears to be a repeated 2 MB image?

Because the camera reports a 4 MB logical flash span, but reads wrap after 2 MB on this unit. The boot log shows FAL devices with length 0x00400000, yet a later 0x0–0x400000 backup “shows repeat at 2mb though.” A follow-up explains this as address wraparound, similar to other Beken parts where adding 2 MB can mirror protected regions rather than expose real extra storage. Treat the real useful image as 2 MB unless a dump proves otherwise. [#21527091]

What is the FAL partition table on BK7252N cameras, and what do the bootloader, app, and download partitions mean?

The FAL table is the firmware’s flash map, and on this camera it splits flash into boot, app, and OTA storage. "FAL" is a flash abstraction layer that maps named partitions to raw addresses, block sizes, and access rules, making bootloader, application, and upgrade regions easier for firmware to manage. The log shows bootloader 0x00000000–0x00010000, app 0x00010000–0x00120000, and download 0x00132000–0x001E0000. Here, bootloader starts execution, app holds the main firmware, and download stores OTA images before swap or recovery. [#21526681]

What is PPRPC in the Linklemo / XCThings firmware, and how is it used for camera communication?

PPRPC is the proprietary RPC transport used by the XCThings firmware for cloud and device commands. "PPRPC" is a remote-procedure-call protocol that packages commands and responses between the camera, app, and backend, using command IDs, sequence numbers, and encrypted payloads over local or cloud links. The thread’s reverse-engineering notes show a gzipped JSON config with protocol:"pprpc", TCP traffic on port 20190, and command 2610 = VideoPlay after packet decryption work. That makes PPRPC central to pairing, control, and stream negotiation. [#21635182]

Which image sensor does the INO-IPC-A9-V2.4 BK7252N camera actually use, and what does the boot log reveal about GC0329C detection?

It uses a GC0329C sensor, not the earlier candidates the firmware probes first. The boot log scans multiple I2C IDs for HI257, GC2145, OV7740, and others, then logs 0329 id_data:62, switches camera mode, and ends with GC0329C init finish. The thread identifies that sensor as GalaxyCore GC0329, 0.3 MP, 640×480 at 15 fps. That finding also explains why “4K” seller claims are not credible for this board revision. [#21528651]

How do I identify the UART, SPI, or JTAG pads on the INO-IPC-A9-V2.4 board, including TDI, TDO, TMS, and TCK?

The board exposes labeled and semi-hidden debug pads, and the thread maps most of them visually. RX1/TX1 are the usable UART pads for logs and BKFIL. One side has pads labeled TDI and TDO, reachable after removing the camera ribbon. The author later identifies the missing pair: “TCK and TMS are these two,” with annotated board photos showing their exact location. The same four pads were proposed for later SPI dump tests, so they are the main low-level access points on INO-IPC-A9-V2.4. [#21526681]

What is the difference between BK7252N and BK7252U for flashing, backup, and OpenBeken support?

BK7252N and BK7252U look similar, but the thread treats them as separate targets for tools and firmware. The BK7252N camera read correctly in BKFIL and in Easy Flasher’s N-like mode, while older BK7252U behavior differed enough that a split of BK7252U and BK7252N dump folders was proposed. Later testing showed OpenBeken could boot on BK7252N, including OTA between builds, but camera support still remained absent. In practice, use N-specific modes and backups for BK7252N instead of assuming BK7252U compatibility. [#21526681]

Why does bk_loader sometimes fail with "Getting Bus" or "LinkCheck Timeout" on BK7252N cameras, and what power setup works best?

It usually fails because timing is tight and weak power makes the boot handshake unreliable. A Linux user hit LinkCheck Timeout even though UART logs worked, then later succeeded after changing the setup. The strongest advice in-thread is to avoid powering the camera only from a USB-TTL adapter at 3.3 V. Instead, power the camera the normal way through 5 V USB, keep a common ground, and let UART carry only data. Wires under 10 cm were also mentioned, but stable supply mattered more than wire length. [#21627036]

At what exact moment after power-on or CEN reset should I start a BK7252N flash read so the bootloader catches correctly?

Start the read before power-on or CEN reset, then trigger power or reset so the tool catches the ROM immediately. The timing window is extremely early: the thread says it must catch “before any log output, within a split second after power on or CEN.” Do not wait for go os_addr(0x10000) or later boot messages. If you see normal boot logs first, you already missed the handoff and should restart the read attempt. [#21627044]

How does the BK7252N CRC scheme work on these Linklemo cameras, and why can changing a single byte break boot unless CRC16 is fixed?

The firmware stores CRC alongside the protected code regions, so single-byte edits break validation and stop a clean boot. The boot log maps both bootloader and app on beken_onchip_crc, and later experiments confirmed that changing one Wi‑Fi password byte made the camera fail until CRC was recalculated. The thread also notes that bootloader and app are CRC-protected, while some later config partitions are not. That is why naïve hex edits work in plain config areas but can brick bootable regions. [#21632638]

Which CRC16 variant is used by BK7252N camera firmware, and how can I recalculate it after editing the app partition?

These BK7252N camera images use CRC16 CMS. The thread identifies the exact parameters as poly 0x8005, init 0xFFFF, ref=False, and out=0x0000. After recalculating with that model and patching the stored CRC, one user changed the AP password successfully and the camera “worked like a charm.” That same post notes ltchiptool’s CRC16 class labels the Beken72xx model as CMS, which is the correct target after editing the app partition. [#21634096]

BK7252N vs TXW817 A9 cameras: which platform is currently better supported for extracting video or running alternative firmware?

TXW817 is better supported today if your goal is video. The thread states it directly: if the camera uses TXW817, “camera already works and can be used right away.” If it uses BK7252U or BK7252N, camera support is still “pretty far away.” That makes TXW817 the better platform for practical stream extraction now, while BK7252N is stronger for firmware dumping, reverse engineering, and early OpenBeken boot tests. [#21706777]

How does the Linklemo app pair with these cameras in AP mode, and why does pairing usually fail without cloud access?

The app first joins the camera’s AP, but successful setup still depends on cloud services. The camera broadcasts an AP like LLM_H0A9_06615F / 12345678, and the Linklemo app can connect locally. However, the thread shows the app requires registration and login, and the firmware repeatedly tries prod.glbs.xcthings.com with several IPs. When the phone stays on the AP with no Internet, pairing times out and the camera logs failed server lookups and No conn Platform!. Local preview may appear, but normal binding does not complete offline. [#21532561]

What local network ports and services does the BK7252N Linklemo camera expose in AP mode, and how can I probe them with nmap?

In AP mode, the camera exposes at least two TCP ports and several UDP endpoints. The thread used nmap -sS -sU -T4 -v -p T:0-65535,U:0-65535 192.168.9.252 and found 20023/tcp open, 20190/tcp open, 67/udp open|filtered, 20190/udp open|filtered, and 62562/udp open|filtered. The camera AP handed the client 192.168.9.100, while the device itself sat at 192.168.9.252 and identified as Beken by MAC prefix. That scan is the cleanest baseline for local service discovery on this model. [#21529763]

What can OpenBeken currently do on BK7252N A9 cameras, and what is still missing before camera streaming support becomes usable?

OpenBeken can boot and handle general MCU functions, but it still cannot run the camera pipeline. The thread confirms BK7252N builds boot, OTA works between test images, and at least P2 controls the blue LED. Another post states the practical limit clearly: right now you can control LEDs, buttons, and read battery voltage. What is still missing is camera-controller support, so video capture, sensor bring-up, and usable streaming are not ready yet on BK7252N A9 boards. [#21644729]