logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Flashing Chinese IP Camera

bartord1ys 2925 16
Best answers

How can I recover a Chinese IP camera stuck in recovery mode after flashing the wrong firmware and make it work with Home Assistant, ideally with RTSP?

You should first recover the original firmware dump from an identical camera and flash that back, because this camera is XF16 based on XR872 and the OpenBK7231T firmware can boot on it but does not yet have a camera driver, so it will not provide an image [#21543205] Use the working camera to read its flash with PhoenixMC over UART RX/TX at 115200 baud, then write that dump to the broken unit; if RX/TX are the correct pins and the original firmware has the console enabled, PhoenixMC should show an open COM port and let you dump to a file without grounding PB02/PB03 [#21554303] The flash backup should be 1 MB, and it is worth attaching the dump for analysis; there was also mention of a non-flashing video access method that may work for this model [#21543214][#21554303] There is no known third-party firmware that adds RTSP for this camera, and the most functional alternative mentioned is cam-reverse, which still does not provide RTSP [#21546390] If you just need Home Assistant integration, the thread suggests trying MJPEG support as a possible workaround [#21546390]
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21542380
    bartord1ys
    Level 3  
    Hello, I would like my camera to be compatible with the home assistant. It is a cheap camera from China, which has very weak software that does not allow it to transmit RTSP. I tried to upload some firmware from GitHub, which made the camera sit in recovery mode and wait for the next firmware. I didn't have a backup, so the old one was gone, but I have another device of the same kind, so if I needed it, I can try to recover the firmware from that one and upload it to this one. I performed all activities with a UART adapter and I would like to send the new software with it as well, and I used phoenixMC to send the software. I'm a beginner in this topic and I would like to ask for a detailed explanation of what I can do in this case.

    Close-up of a green printed circuit board with integrated circuits, connectors, and wires.
    PhoenixMC program window showing a Verify boot error! message during device bootloader verification on COM4.
    AI: Could you please provide the exact brand and model of your IP camera?
    idk
    AI: Which specific firmware from GitHub did you try to upload (a link or the name would be helpful)?
    some of these https://github.com/openshwprojects/OpenBK7231T_App/releases
  • ADVERTISEMENT
  • Helpful post
    #2 21543205
    p.kaczmarek2
    Moderator Smart Home  
    Do you have original 1MB flash backup?
    This is XF16, which is XR872. Our firmware can boot onto it, but don't have camera driver yet, so it won't provide image...
    Also calling - @divadiow
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 21543209
    bartord1ys
    Level 3  
    I don't have it, but if it's required, I have another identical camera and I can do it on it
  • #4 21543214
    p.kaczmarek2
    Moderator Smart Home  
    Try to read flash of second one, here is phoenixMC translation:
    https://www.elektroda.com/rtvforum/topic4115856.html
    And flash to the broken one, but I'm not sure about the MAC and AP name.

    Please also attach flash dump here - unless, it was paired with your account? Then maybe not...

    Here is video access method without flashing, maybe it will work: https://www.elektroda.com/rtvforum/topic4117962.html
    Helpful post? Buy me a coffee.
  • #5 21543223
    divadiow
    Level 38  
    p.kaczmarek2 wrote:
    Please also attach flash dump here - unless, it was paired with your account? Then maybe not...

    happy to receive privately so I can reset, join to test AP, reset, if this is the case

    Would be good to get another XF16 dump.

    p.kaczmarek2 wrote:
    This is XF16, which is XR872

    ah. I see you tried to flash XR809 file

    If you have any more pics of the outside of the cam, any labels, other side of PCB, that would be cool too. thank you
  • #6 21543343
    bartord1ys
    Level 3  
    >>21543214 I'll try to do it later

    Dodano po 2 [minuty]:

    >>21543223
    Close-up of a circuit board with wires inside a plastic casing.
    Close-up of a camera module with a lens, PCB board, and a connector with colored wires.
    Electronic camera module with a visible lens and connected wires.
    Open casing of an electronic device showing a circuit board and a small motor.
    White surveillance camera on a rectangular mount, placed on a light surface.
    A white surveillance camera with two antennas stands on a light-colored surface.
  • #7 21546343
    bartord1ys
    Level 3  
    @divadiow
    Do you have any firmware for this camera that will allow me to connect via rtsp?
  • ADVERTISEMENT
  • #9 21546393
    bartord1ys
    Level 3  
    Thx, I will try it
  • ADVERTISEMENT
  • #11 21547328
    divadiow
    Level 38  
    did you manage to take a backup of the flash?
  • #13 21552521
    bartord1ys
    Level 3  
    >>21547328I will do it tomorrow
  • #14 21553840
    bartord1ys
    Level 3  
    how can I do it via UART?
  • #15 21553929
    divadiow
    Level 38  
    well it looks like these two are RX/TX. Do you get text log output from TX at 115200 baud from one of them?

    Part of a PCB with a connector and a marked area for a jumper or component.
  • #16 21554242
    bartord1ys
    Level 3  
    I have access to the UART, I also got the password but half of the commands of this system and there are not many of them are deleted. I will send logs and command list tomorrow
  • #17 21554303
    divadiow
    Level 38  
    well if those two are definitely RX/TX and assuming the original firmware has the console stuff enabled then you should just be able to dump with PhoenixMC without grounding any PB02/PB03 type pins.

    See here for backup process, it also applies to XF16 https://www.elektroda.com/rtvforum/topic4115856.html

    Simply ignore the instructions to ground PB02/PB03 and connect up RX/TX to USB-TTL. Then run PhoenixMC and see if you get open comm port! message and are able to dump to file.
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on flashing firmware to a low-cost Chinese IP camera lacking native RTSP support, aiming for Home Assistant compatibility. The camera uses an XF16 board with an XR872 chip. The original firmware backup is missing, but a second identical camera is available for flash dumping via UART using a USB-TTL adapter and PhoenixMC software. Users recommend reading the flash from the working unit and writing it to the bricked one, noting concerns about MAC address and access point name preservation. Attempts to flash incompatible XR809 firmware caused recovery mode activation. No known RTSP-enabled firmware exists; the closest alternative is the third-party cam-reverse project, which supports MJPEG streaming but not RTSP. UART access provides console output at 115200 baud, facilitating firmware dumping without grounding specific pins. Detailed guides and community resources on flashing and recovery processes are referenced, including Elektroda forum threads and GitHub repositories. The user is advised to capture flash dumps, share logs, and provide additional camera images for further assistance.
Generated by the language model.

FAQ

TL;DR: Bricked a cheap IP cam? On XF16/XR872 with 1 MB flash, community firmware boots but lacks camera drivers. "Our firmware can boot onto it"—no image/RTSP yet. This FAQ is for beginners seeking Home Assistant compatibility and safe recovery steps. [Elektroda, p.kaczmarek2, post #21543205]

Why it matters: You’ll avoid wrong firmware, recover functionality, and choose a workable HA integration path.

Quick Facts

How do I identify my chipset if the PCB says XF16?

Board code XF16 indicates an XR872 SoC. Community firmware can boot on XR872, but the camera driver is missing. That means no image and no RTSP today. “Our firmware can boot onto it, but don’t have camera driver yet.” Back up the original 1 MB flash before any changes. This identification prevents flashing the wrong build and bricking the device. [Elektroda, p.kaczmarek2, post #21543205]

What’s the safest way to back up the flash over UART?

Use PhoenixMC with a USB‑TTL adapter. 1) Wire GND, RX, TX to the camera and power it normally. 2) Start PhoenixMC, choose UART, open the detected COM port, and verify it connects. 3) Dump the flash to a file and store the 1 MB image safely. This path avoids special boot pin tricks on XR872. [Elektroda, divadiow, post #21554303]

Do I need to short PB02/PB03 pads to back up on XR872/XF16?

No. For XR872/XF16 you can ignore PB02/PB03 when backing up with PhoenixMC. If the console is enabled, connect RX/TX and dump directly. This reduces risk and speeds up recovery. [Elektroda, divadiow, post #21554303]

I flashed the wrong firmware and the cam is in recovery. How do I unbrick it?

If you have a second identical camera, read its flash with PhoenixMC. Then write that dump to the bricked unit. Expect MAC address and AP name quirks after cloning. Avoid sharing paired dumps publicly to protect your account. [Elektroda, p.kaczmarek2, post #21543214]

Will XR809 firmware or OpenBK builds for XR809 work on XR872/XF16?

Do not flash XR809 files to XR872 hardware. An expert spotted XR809 was attempted on an XF16 board, which is XR872. Mixing targets risks soft‑brick or recovery loops. Match firmware strictly to the SoC. [Elektroda, divadiow, post #21543223]

Can I get RTSP from this camera in Home Assistant?

There’s no known RTSP‑capable firmware for this XR872 model right now. The most functional third‑party effort is cam‑reverse. Pair it with Home Assistant’s MJPEG integration to view the stream without RTSP. [Elektroda, divadiow, post #21546390]

What baud rate should I use, and how do I spot RX/TX?

Use 115200 baud for the console. Watch for readable boot logs on TX to confirm wiring. The two exposed pads discussed are the likely RX/TX points. Swap RX/TX if you see no output, keeping GND common. [Elektroda, divadiow, post #21553929]

Is it safe to share my flash dump publicly?

Avoid posting dumps publicly if the device was paired to a cloud account. Share privately with a maintainer if you need a reset and AP tests. This protects your account and network identity. [Elektroda, divadiow, post #21543223]

I have UART login but few commands. Can I still do a backup?

Yes. PhoenixMC speaks to the boot console and does not need a rich shell. Connect RX/TX, open the COM port, and dump the flash. Ignore PB02/PB03 on XR872 for this operation. [Elektroda, divadiow, post #21554303]

Are there alternatives to flashing if I only need video access?

Yes. Follow the shared guide for video access without flashing. It may work on this platform and avoid firmware risks. Test before attempting any write operations. [Elektroda, p.kaczmarek2, post #21543214]

Will restoring another unit’s dump clone my MAC and AP name?

It can. After restoring, the camera may carry the donor’s MAC and AP SSID. This edge case can cause network conflicts or bind to another account. Plan to adjust identities post‑restore. [Elektroda, p.kaczmarek2, post #21543214]

What should I share to get better help diagnosing my camera?

Provide clear photos of the PCB, labels, and the other side of the board. Share the flash dump privately if the unit was paired. Maintainers can reset, join the test AP, and reset again for analysis. [Elektroda, divadiow, post #21543223]
Generated by the language model.
ADVERTISEMENT