Flashing Open-Source Firmware on X5 Mini Camera (TXW817-810 SOC): UART & Logic Analyzer Help

I recently purchased the X5 mini camera from AliExpress, which uses the TXW817-810 SOC. The camera is connected to a proprietary app, and I'm concerned about potential privacy issues and Chinese spyware, as the video feed likely goes through servers in China.

I am looking for a way to flash this device with open-source firmware to eliminate these privacy risks. I am not an expert, and I need a step-by-step guide to accomplish this.

Here is what I've determined so far:

The SOC is a TXW817-810. I've been unable to find a datasheet or a verified working open-source firmware for this specific chip.

The PCB appears to have no external flash memory, suggesting the firmware is stored directly on the SOC itself.

I want to retain the ability to stream 1080p at 30fps with H.264 video encoding.

I have the following tools and need guidance on how to use them:

EZ-USB FX2LP CY7C68013A USB Core Board (USB Logic Analyzer): I want to use this to monitor the microSD card on boot-up. Could someone provide a diagram or instructions on which GPIO pins on the logic analyzer should connect to the corresponding pins on a microSD card sniffer to check for boot-up access?

USB to 4-way TTL serial port (FT4232HL chip): I need to connect this to the UART on the camera's PCB. Can you help me identify the correct UART pins on the board and provide instructions on how to connect the TTL serial port to them?

I've looked at similar forum posts, but haven't found a directly applicable guide for the TXW817-810 SOC. Any guidance or assistance in "baby steps" would be greatly appreciated.

Thank you in advance for your help!

>>21692368
Guide specifically for TXW817-810 cameras - https://www.elektroda.com/rtvforum/topic4123724.html
At minimum, you would need STM32F103 with 64kb flash (C8T6 or CBT6) and ST-Link to program it.

In current open source firmware, there is no support for SD, battery and sleep.
The chip uses MJPEG, not H.264. You would have to transcode via ffmpeg or something similar (in HA, go2rtc is an excellent choice).
And there is no 1080p, even stock firmware uses 4:3 480p resolution.

tsisaris wrote:

The SOC is a TXW817-810. I've been unable to find a datasheet or a verified working open-source firmware for this specific chip.

datasheets and SDKs can be had from https://www.taixin-semi.com/Product?prouctSubClass=58 and https://www.taixin-semi.com/Product?prouctSubClass=67

registration required to download.

some resources here too: https://github.com/divadiow/DataSheets/tree/main/Taixin

out of interest, what does your X5 PCB look like?

cool. looks familiar. don't think I've posted about mine anywhere yet. definitely not tried OpenTXW81X on it

backup was same process as other TXW817s

The camera was advertised as 1080p30fps h.264? It was also advertised as night vision but I can't find any IR LEDs on it. I guess that's just AliExpress propaganda? Should I just return them? I don't mind going through the work but 480p is junk... I want a long high quality video loop on the micro SD card MJPEG is much less memory efficient. What are the cheapest options that will fit my project and hopefully not require a difficult flash process? It would be nice to have AV1 hardware encoding and stream? I'm sure that's more than the $2 per camera that I paid. I wouldn't mind going through and doing the work if this will make it really easy for other people to network a bunch of $2 cameras, but at 480p without night vision. The cable on the camera says XLT-X5-0329-V1.0, I also can't find any hardware details on the camera itself.
Thank you in advance for your help.

>>21693159
Chip itself can't handle 1080p. There is simply not enough RAM. And there is no hardware H.264 encoder.
It's all fake of course, just like those "Xiaomi" mini 4K cameras, which are 480p MJPEG too.

Among open source i can only think of OpenIPC and ESP32-P4 cameras.

Or XMEye/ICsee cameras. I use one of those with 1080p24fps h.264 with IR and SD slot for $10. Mine is quite buggy though, IR turns on and off when rotating (PTZ) and off and on during the day. That is with latest firmware. On previous one there were no such things, but wifi was unstable instead.
Just block any cloud it tries to connect to on router.

tsisaris wrote:

XLT-X5-0329-V1.0

mine came labelled as X5-G29-2364V1 - see https://www.elektroda.com/rtvforum/topic4121965.html#21549325

standard GalaxyCore GC0329 640x480

I have rethought things and I think it would be better to go with the LuckFox Pico Mini B and the SC3336 camera. They are $9 each on the LuckFox website. The LuckFox Pico Mini B has h.265 hardware encoding. I will need to connect an ESP32S3 WROOM-1U with 8MB PSRAM and 16MB FLASH over QSPI to the LuckFox Pico Mini B to transmit over WiFi. I can connect a MEMS microphone like the INMP441 to the ESP32 S3 module with I2S and have the ESP32 S3 control tiny servo motors for tracking. Way more than $2 but I can run YOLOv8 large quantized to int4 on the LuckFox Pico Mini B and send hits to the central server for even better inference. Does this sound doable?

>>21693916
You will probably have to connect microphone and servos to luckfox, not esp.
AFAIK module with esp-hosted firmware is just a co-processor, so it's a no go for additional tasks. I could be wrong though.
And it's not necessary to use ESP32-S3, a cheaper C3 would work too. Or C6 for AX. C5 is not yet supported, so no 5ghz for now.
And not via QSPI, just regular SPI (and UART if BLE is needed).

I just want to make sure that I get the gist of all of this. The cameras I have for $2 from AliExpress are actually 480p 30fps with MJPEG compression which kind of sucks but they can be easily jail broken with a workflow exactly described in one of these project threads? I can have multiple devices look at the same stream and if I want use a more powerful computer on the network to take the video and compress it down with AV1 and store the video in a rolling loop. The micro sd cards in the cameras themselves will fill up and loop pretty quickly. I can have an esp32s3 wroom poll each camera at 3fps for a jpeg image so I get a total of 9 jpeg images every second streaming through the esp32 and it decompresses them and feeds them directly to the Maix Bit over gpio with qspi protocol. The Maix Bit takes the images and downscales them to 224x224 and feeds them into its kpu for inference with a very tiny int8 model for object recognition person or no person? If it gets a hit then it sends a signal to the esp32 and the esp32 sends an alarm through the network and any devices that have an app installed get a notification and a button to pop up the live feed at full resolution. Something like this?

>>21695041
I don't know, i'm not an expert at configuring such a system.
It's possible, i guess. Though like i said earlier, ESP would act just like a wifi adapter via SPI. So everything would have to be done on either separate server on directly on luckfox board.

My camera averages at 22 fps (ffprobe -v error -select_streams v -of default=noprint_wrappers=1:nokey=1 -show_entries stream=r_frame_rate rtsp://192.168.1.20:7070/webcam results in 265/12 -> ~22fps)

And it's not necessarily easily jailbroken. Some cameras can have sensors that are not supported (yet?). So there would be no video, only audio.
Plus if you're unlucky - you would have to trace i2c pins for camera to work.

divadiow wrote:

backup was same process as other TXW817s

If you allready made an backup, could you please add labels to the picture?
Which point is P10 (DebugCLK)?
I assume P9 (DebugIO) is the HCK point and P8 is HDA as on the other X6 device shown in this post?
Thanks!

sure. this is from November 2024, so I assume it's correct because I would have used it in May when I made the firmware backup. I recall the labelling was a little wrong on this, so it would make sense that the RST pad is indeed actually PA10

you can visually trace most

divadiow wrote:

RST pad is indeed actually PA10

Indeed, Thanks:

cool. are you finding that board has stuck to SDK defaults re cam/mic or maybe you're yet to get to that point. The TXW adventure does span several threads now.

I think I didn't understand the question (maybe I need to get to that point?)
I get an RTSP stream with some (distorted) audio - sounds like there's an engine running, but I can hear sounds ...

yet to get that point = at the stage where you know if the cam is using SDK default pin assignments. Sounds like you are

What cam did yours come with?

Added after 5 [minutes]:

max4elektroda wrote:

sounds like there's an engine running, but I can hear sounds

at least the mic is default I guess.

Mine sounds crap anyway but with grounds connected to usbttl and STM32 it's worse. Not *too* bad though

Cam is labelled X5-G29-2364V1 (it's allready mentioned in the "Identifying Mini Cam Modules"-thread.)

Soldered TX line, so I can also give the output from loading the driver:
[173551]sensor driver match: name=gc0329 id=0xc0 num=5 addr7=0x31 mclk=24000000 pix=640x480