IP Video Door Bell - Atz-dbv01p

[riogrande75]

It's me once again: I managed to get pictures from the lower side of the PCB.
Here the pinout that works for me
I use a cheap chinese USB-UART converter with 3.3v levels, baudrate 115200.

[jgonzalez]

Thanks riogrande75, can you make a backup with all the files and upload it to some places? probably there is some hidden services for the functions that we are looking for.

Thanks

[riogrande75]

probably there is some hidden services for the functions that we are looking for

No, I am sure this is not the case. The files are just the already known 5 partitions:
mtdblock0: uboot (bootloader)
mtdblock1: boot (kernel,read-only)
mtdblock2: rootfs (/,linux,read-only)
mtdblock3: rom (/rom,some settigs, certificates,etc.)
mtdblock4: npc (/npc,the doorbell application itself)
I analyzed it and so far, I guess we get not arround the npc programm. Without it running, the camera,etc. is not responsible. Anyhow, if I kill the npc task the device reboots immediately (a watchdog supervises this program).

can you make a backup with all the files and upload it to some places

I could upload the files - but it will not show anything new to us. The rootfs is a simple linux for SoC, read-only, but there are some good usable functions like telnetd and tftp on it. They just need to be started.
/rom and /npc is actually just the 2 partitions that you get when you split the fw file (npcupg_13.00.01.10.bin). This partitions are writeable and cross-compiled programms (the link I posted works for me) can get installed there. I managed to write a program in c (I am not a programmer!) that sends a UDP message to a server already. As soon as I found a way to catch the doorbell button (either via filering stdout or directly polling gpio) I guess, a little program fulfils our wish
All we need is a guy with a little more programming abitilities than me

[jumble]

Thanks riogrande75 for figuring out the console. I have a slightly different version of the doorbell but was able to connect to the console as in the following image.

doorbell image.JPG (142.48 KiB) Viewed 7073 times

The console produces the following output on startup.

Code: Select all

U-Boot 2010.06 (Jun 02 2014 - 20:47:11)

Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128XX"
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0
16384 KiB hi_sfc at 0:0 is now current device

## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.0.8
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2916448 Bytes = 2.8 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 3.0.8 (user1@ubuntu) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #5 Mon May 19 23:21:54 PDT 2014
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518
Memory policy: ECC disabled, Data cache writeback
AXI bus clock 200000000.
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 9652
Kernel command line: mem=38M ramdisk_size=4096 console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=squashfs mtdparts=hi_sfc:512K(boot),3M(kernel),7680K(rootfs),1M(rom),4096K(app)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 38MB = 38MB total
Memory: 33000k/33000k available, 5912k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xc2800000 - 0xfe000000   ( 952 MB)
    lowmem  : 0xc0000000 - 0xc2600000   (  38 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0029000   ( 132 kB)
      .text : 0xc0029000 - 0xc051e000   (5076 kB)
      .data : 0xc051e000 - 0xc0542020   ( 145 kB)
       .bss : 0xc0542044 - 0xc055fac0   ( 119 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32 nr_irqs:32 32
sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms
Console: colour dummy device 80x30
Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.16)
msgmni has been set to 64
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
xz_dec_test: module loaded
xz_dec_test: Create a device node with 'mknod xz_dec_test c 252 0' and write .xz files to it.
brd: module loaded
loop: module loaded
Spi id table Version 1.22
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
SPI FLASH start_up_mode is 3 Bytes
Spi(cs1):
Block:64KB
Chip:16MB
Name:"MX25L128XX"
spi size: 16MB
chip num: 1
5 cmdlinepart partitions found on MTD device hi_sfc
Creating 5 MTD partitions on "hi_sfc":
0x000000000000-0x000000080000 : "boot"
0x000000080000-0x000000380000 : "kernel"
0x000000380000-0x000000b00000 : "rootfs"
0x000000b00000-0x000000c00000 : "rom"
0x000000c00000-0x000001000000 : "app"
Fixed MDIO Bus: probed
himii: probed
usbcore: registered new interface driver rt2500usb
usbcore: registered new interface driver rt73usb
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver cdc_wdm
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver ums-alauda
usbcore: registered new interface driver ums-datafab
usbcore: registered new interface driver ums-freecom
usbcore: registered new interface driver ums-isd200
usbcore: registered new interface driver ums-jumpshot
usbcore: registered new interface driver ums-sddr09
usbcore: registered new interface driver ums-sddr55
usbcore: registered new interface driver mdc800
mdc800: v0.7.5 (30/10/2000):USB Driver for Mustek MDC800 Digital Camera
mousedev: PS/2 mouse device common for all mice
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
Registering the dns_resolver key type
registered taskstats version 1
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
▒VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing init memory: 132K
usb 1-1: new high speed USB device number 2 using hiusb-ehci

##############################
#                            #
#     GWELL IPC SYSTEM       #
#                            #
##############################

[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01udev
udevd (523): /proc/523/oom_adj is deprecated, please use /proc/523/oom_score_adj instead.
[RCS]: /etc/init.d/S80network
mke2fs 1.41.11 (14-Mar-2010)
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
Stride=0 blocks, Stripe width=0 blocks
1024 inodes, 4096 blocks
204 blocks (4.98%) reserved for the super user
First data block=1
Maximum filesystem blocks=4194304
1 block group
8192 blocks per group, 8192 fragments per group
1024 inodes per group

Writing inode tables: done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 29 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
Password for root changed by root
HISI_IRDA-MF @Hi3518v100R001
hiir: init ok. ver=May 30 2014, 01:18:40.
rtusb init rt2870 --->


=== pAd = c2c77000, size = 1581152 ===

<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x8
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x4
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x5
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x6
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x7
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x9
==>WaitForAsicReady MAC_CSR0=0x76010500
==>WaitForAsicReady MAC_CSR0=0x76010500
NVM is EFUSE
Endpoint(8) is for In-band Command
Endpoint(4) is for WMM0 AC0
Endpoint(5) is for WMM0 AC1
Endpoint(6) is for WMM0 AC2
Endpoint(7) is for WMM0 AC3
Endpoint(9) is for WMM1 AC0
Endpoint(84) is for Data-In
Endpoint(85) is for Command Rsp
80211> RFICType = 3
NumOfChan ===> 58
80211> Number of channel = 44
80211> Number of rate = 12
80211> CurTxPower = 0 dBm
80211> TxStream = 0
crda> requlation requestion by core: 00
80211> CFG80211_Register
MSC msc_proc_create: c2c77000
usbcore: registered new interface driver rt2870
Hisilicon Media Memory Zone Manager
hi3518_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Hisilicon UMAP device driver interface: v3.00
pa:82600000, va:c2e80000
load sys.ko for Hi3518...OK!
load viu.ko for Hi3518...OK!
ISP Mod init!
load vpss.ko ....OK!
load vou.ko ....OK!
load venc.ko for Hi3518...OK!
load group.ko for Hi3518...OK!
load chnl.ko for Hi3518...OK!
load h264e.ko for Hi3518...OK!
load jpege.ko for Hi3518...OK!
load rc.ko for Hi3518...OK!
load region.ko ....OK!
load vda.ko ....OK!
Kernel: ssp initial ok!
acodec inited!
insert audio
==== Your input Sensor type is ov9712 ====
startup 0 0
no key detect
vStarNpc:
dwGetWatchDogLiveTime = 0
Auto login as root ...
Language=:
  0    1    5
default Language=0:
Jan  1 00:00:14 login[788]: root login on 'ttyS000'
Welcome to HiLinux.
# uart1 init ok. ver=Dec  8 2005, 02:22:40.
*************vCMOSPowerUp**************
################## CMOS TYPE = CMOS_TYPE_OV9712!
*************vCMOSPowerDown**************
Certificate: rom file ok, eeprom ok
info:  RTC has been used before, no need to init it
year 1970
month 1
date 1
hour 0
minute 0
second 0
weekday 4
<1>Sun Jan  1 01:01:01 2010
<3>Fri Jan  1 01:01:01 2010
cEmailAddr[0] is 0xff*************vNetMg_Init******************
**pCurrSetting->bNetSel** = 0,fgIPAuto = 1,bIPByADDRCONF(NETDEV_UP): eth0: link is not ready
te3 = 123,fgVersionFlag = 0
vRtspServderThreadStar star!
Disk init
vDiskProc begin
vHandSelectThreadStar star!
accept ******************
vNewIrCutHanldeFun to filter, day
PHY: himii:01 - Link is Up - 100/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Enter UISsInit
Exit UISsInit
*************vCMOSPowerDown**************
vFM1188Init
Start Init Fm1188,Count=0
================> UP : RTMP_SEM_EVENT_WAIT(STA)
1. LDO_CTR0(6c) = a64799, PMU_OCLEVEL c
2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
==>WaitForAsicReady MAC_CSR0=0x76010500
FW Version:0.1.00 Build:7640
Build Time:201301040941____
ILM Length = 44276(bytes)
DLM Length = 0(bytes)
Loading FW....
RTMP_TimerListAdd: add timer obj c2d9f75c!
RTMP_TimerListAdd: add timer obj c2d9f78c!
RTMP_TimerListAdd: add timer obj c2d9f7bc!
RTMP_TimerListAdd: add timer obj c2d9f72c!
RTMP_TimerListAdd: add timer obj c2d9f69c!
RTMP_TimerListAdd: add timer obj c2d9f6cc!
RTMP_TimerListAdd: add timer obj c2d33cd4!
RTMP_TimerListAdd: add timer obj c2d205d0!
RTMP_TimerListAdd: add timer obj c2d20604!
RTMP_TimerListAdd: add timer obj c2d33d74!
RTMP_TimerListAdd: add timer obj c2d22f80!
RTMP_TimerListAdd: add timer obj c2d227c0!
RTMP_TimerListAdd: add timer obj c2d22f4c!
RTMP_TimerListAdd: add timer obj c2d2329c!
RTMP_TimerListAdd: add timer obj c2d22fb4!
RTMP_TimerListAdd: add timer obj c2d22fe8!
RTMP_TimerListAdd: add timer obj c2d2301c!
RTMP_TimerListAdd: add timer obj c2c7b40c!
RTMP_TimerListAdd: add timer obj c2c7ac4c!
RTMP_TimerListAdd: add timer obj c2c7b3d8!
RTMP_TimerListAdd: add timer obj c2c7b728!
RTMP_TimerListAdd: add timer obj c2c7b65c!
RTMP_TimerListAdd: add timer obj c2cb2684!
RTMP_TimerListAdd: add timer obj c2cb1ec4!
RTMP_TimerListAdd: add timer obj c2cb2650!
RTMP_TimerListAdd: add timer obj c2cb29a0!
RTMP_TimerListAdd: add timer obj c2cb26b8!
RTMP_TimerListAdd: add timer obj c2cb26ec!
RTMP_TimerListAdd: add timer obj c2cb2720!
RTMP_TimerListAdd: add timer obj c2d33c74!
RTMP_TimerListAdd: add timer obj c2d33d44!
RTMP_TimerListAdd: add timer obj c2df6d10!
RTMP_TimerListAdd: add timer obj c2df6d40!
RTMP_TimerListAdd: add timer obj c2df6d70!
RTMP_TimerListAdd: add timer obj c2df6da0!
RTMP_TimerListAdd: add timer obj c2df6dd0!
RTMP_TimerListAdd: add timer obj c2df6e04!
RTMP_TimerListAdd: add timer obj c2d9f6fc!
RTMP_TimerListAdd: add timer obj c2d1f5ec!
RTMP_TimerListAdd: add timer obj c2d1f5bc!
RTMP_TimerListAdd: add timer obj c2d1f58c!
RTMP_TimerListAdd: add timer obj c2d33ca4!
P2pGroupTabInit .
P2pScanChannelDefault <=== count = 3, Channels are 1, 6,11 separately
P2pCfgInit::
==>WaitForAsicReady MAC_CSR0=0x76010500
vFM1188PowerDown
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
###### Force at HT20 (BW_20) mode !!! ########
1. Phy Mode = 14
2. Phy Mode = 14
NVM is Efuse and its size =1d[1e0-1fc]
ERROR!!! MT7601 E2PROM: WRONG VERSION 0xb, should be 9
3. Phy Mode = 14
AntCfgInit: primary/secondary ant 0/1
---> InitFrequencyCalibration
InitFrequencyCalibrationMode:Unknow mode = 3
InitFrequencyCalibration: frequency offset in the EEPROM = 105(0x69)
<--- InitFrequencyCalibration
RTMPSetPhyMode: channel is out of range, use first channel=1
MCS Set = ff 00 00 00 01
<==== STA : rt28xx_init, Status=0
80211> re-init bands...
80211> RFICType = 1
NumOfChan ===> 14
80211> Number of channel = 44
80211> Number of rate = 12
80211> CurTxPower = 0 dBm
80211> TxStream = 1
0x1300 = 00064300
RTMPDrvOpen(1):Check if PDMA is idle!
RTMPDrvOpen(2):Check if PDMA is idle!
<================ UP : RTMP_SEM_EVENT_UP(STA)
fgEth0Support = 1,fgRa0Support = 1
Support eth0!
ADDRCONF(NETDEV_UP): eth0: link is not ready
read phy addr: 0x1  reg: 0x0  value : 0x3100

write phy addr: 0x1  reg: 0x0  value : 0xb100

vFM1188PowerDown
udhcpc (v1.16.1) started
Sending discover...
Successfully initialized wpa_supplicant
rfkill: Cannot open RFKILL control device
udhcpc (v1.16.1) started
Sending discover...
PHY: himii:01 - Link is Up - 100/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
route: resolving dev
route: resolving dev
vFM1188PowerDown
Sending discover...
Got valid DHCP packetSending select for 192.168.8.105...
Sending discover...
vFM1188PowerDown
===>rt_ioctl_giwscan. 2(2) BSS returned, data->length = 367
vFM1188PowerDown
Sending select for 192.168.8.105...
Got valid DHCP packetLease of 192.168.8.105 obtained, lease time 86400
deleting routers
route: SIOCDELRT: No such process
adding dns 192.168.8.1
adding dns 192.168.8.1
Sending discover...
/rom/HostList.txt isn't exist
##cpUpgHostNameListStr:upg.cloudlinks.cn

=====  Now AT24CXX used 255 Bytes=====
dwGetWatchDogLiveTime1 = 0
vFM1188Init
*************vCMOSPowerUp**************
 oss ov9712 init
PAL
dwLuam = 50,dwContr = 50,dwSatuVal = 50
u32ContrVal:50,u32HueVal:50,u32LumaVal:50,u32SatuVal:50
smart_conn_thread_id 1219744976 start!
dwLuam = 50,dwContr = 50,dwSatuVal = 50
u32ContrVal:50,u32HueVal:50,u32LumaVal:50,u32SatuVal:50
********vSmartConnProc*************
fgUpdateLocalDnsFile:nameserver  192.168.8.1
iwpriv wlan0 elian stop
[MSC] msc_cmd_handler stop 5
wlan0     elian:ok
===>rt_ioctl_giwscan. 2(2) BSS returned, data->length = 367
Socket connection successful: master socket = 22
iwpriv wlan0 elian stop
[MSC] msc_cmd_handler stop 5
wlan0     elian:ok
iwpriv wlan0 elian start
[MSC] msc_cmd_handler start 6
[MSC] Driver v 1.0.0
[MSC] get local address c2c77000 : 48:2:2a:d3:bd:92
[MSC] version: 1.1.1
[MSC] reset 0-->0, reason:0
[MSC] enter monitor mode: filter:0x0, chan_id:1, width:2, chan_flags:0x0, monitor_priv=  (null), priv=c2c77000
[MSC] old iftype: 0x2
80211> cfg80211_scan_done ==> NULL
iwpriv wlan0 elian clear
[MSC] set chl, chan_id:1, width:2, chan_flags:0x0
Sending discover...
80211> cfg80211_scan_done ==> NULL
wlan0     elian:ok
[MSC] msc_cmd_handler clear 6
[MSC] reset 0-->0, reason:1
wlan0     elian:ok
*************vCMOSPowerDown**************
[MSC] set chl, chan_id:1, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:6, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:11, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:2, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:5, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:7, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
Sending discover...
 qrinfo : decoding failed

[MSC] set chl, chan_id:1, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:6, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:11, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:10, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:12, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:3, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
Sending discover...
[MSC] set chl, chan_id:1, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:6, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:11, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:8, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:13, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:4, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
Sending discover...
[MSC] set chl, chan_id:9, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:1, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:6, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:11, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:2, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:5, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:7, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
Sending discover...
[MSC] set chl, chan_id:1, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:6, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:11, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:10, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:12, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:3, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
Sending discover...
[MSC] set chl, chan_id:1, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:6, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:11, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:8, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:13, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL

When the button is pressed

Code: Select all

######in the vDoorBellEventProc######
vFM1188Init
*************vCMOSPowerUp**************
 oss ov9712 init
PAL
[MSC] set chl, chan_id:10, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
dwLuam = 50,dwContr = 50,dwSatuVal = 50
u32ContrVal:50,u32HueVal:50,u32LumaVal:50,u32SatuVal:50
[MSC] set chl, chan_id:12, width:8, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
 push : Some Body visit!
vCaptureProc start
[MSC] set chl, chan_id:3, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
[MSC] set chl, chan_id:1, width:2, chan_flags:0x0
80211> cfg80211_scan_done ==> NULL
vCaptureProc not send email!

It would seem if we wright a program/script to parse the console output looking for "push : Some Body visit!" we would have the trigger to send a UDP message. http://www.linux.it/~rubini/docs/sercons/sercons.htm has an example program that may be useful.

I am intending to set up a development environment when I get some spare time and see how we go!

[riogrande75]

Cool. The posted output is pretty identical to my ATZ-DBV03p. So sw seems to be the same.
I managed to write a program to send a simple UDP message already - tested on the doorbell. Works fine.
So far I could not grab the output on the console with a c prog. I tried different functions (fget,fopen,popen,...) on /dev/console and /dev/ttyAMA0 - but somehow it's a bit different to other linux systems I know so far.
Maybe we need to catch the output of the running npc task (this task produces the output). If this still does not work, someone needs to have a look at the gpio's. From the SDK from HiSilicon I got compiled "i2c_read" and "i2c_write" commands, but gpio's are polled somehow different to a RPi.

[riogrande75]

Finally i found some time to play again with the doorbell. And I made some progress: I have now a tiny c-program, that sends a udp message including "YOU HAVE A VISITOR WAITING!" to a defined server as soon as the doorbell button was pressed.
All you have to do is getting telnet access to the doorbell (see above: "telnetd" at the console / putty), copy my program (either via tftp or manully on your pc) to the sd-card run it.
Anyone who's interrested just pm me for the code or a specific binary for your environment.

[papoo]

you have a PM

[jumble]

Hey Riogrande75, if you could you post the c source code here or PM me with the code that would be great. Thx

[riogrande75]

Hi!
I just uploaded my code so far to github.com/riogrande75/doorbell/.
As mentioned, it's hardly "work-in-progress". Feel free to improve it.

[riogrande75]

I changed my idea of polling directories for alarm pictures, which gets by far to complex.
Now I just redirect the log output of PID 751 (npc) into a logfile, grep the doorbell event an send a UDP message to my server.

Code: Select all

#!/bin/sh
telnetd &
ifconfig wlan0 down
cd /mnt/disc1
./reredirect -m npc.log 791
LOGFILE=/mnt/disc1/npc.log
tail -f $LOGFILE| while read LINE; do
        echo $LINE| grep -q "vDoorBellEventProc" | ./sendudp
done
exit 0

All you need is "reredirect" https://github.com/jerome-pouiller/reredirect and sendudp https://github.com/riogrande75/doorbell ... /sendudp.c crosscompiled and this shell script.
Working binaries via PM.

[riogrande75]

I don't know if there are still interrested owners arround, but I wanted to let you know that I implemented a MQTT client (PUB/SUB) into the doorbell.
Also it's quite easy to run telnetd and so on at startup: just rename the main application "/npc/npc" to e.g. "/npc/npc-exe" and insert a shell script as "/npc/npc" (and change file-rights accordingly). Let the script start telnetd, npc-exe and the mqtt client and you're ready to install the bell.
Due the fact, the /npc partition is writeable, all the settings are rebootsafe and then UART cables can be removed then.

[xman71]

Salut riogrande75,
Bravo pour le boulot fait !
Pour installer ton petit client, il faut bidouiller l'uart en ouvrant le portier ?

Envoyé de mon SM-G935F en utilisant Tapatalk

[fuzero]

Hi riogrande75,
my compliments for your great work,
with your info now i can have acces to my atz-dbv03p.
Can you please send me the mqtt client.
Thanks, fulvio.

[riogrande75]

Pour installer ton petit client, il faut bidouiller l'uart en ouvrant le portier ?

oui!

[riogrande75]

Can you please send me the mqtt client.

You got PM!

[riogrande75]

Some new findings from my side:
Until now, I was not able to access gpio's directly to poll doorbell button or switch relay for dooropener.
Some googeling brought up the gpio memory addresses of Hi3518 chip.
So I tested it out and found the address of the doorbell button gpio pin:

Code: Select all

# devmem 0x200f011c
0x00000000
# devmem 0x200f011c w 1

First command shows register of doorbell button (usually 0x0). When you put (write) a 1 in there (2nd command), the npc app recognizes a doorbell press.
I did not find the dooropener register yet, but I will not give up.
Nevertheless, I found a way to open the dooropener relay remotely without using the could application:
With the mentioned IPC-TEST-TOOL you can localy (inside you LAN) test the doorbell functions. There is also a "unlock" button which let's the relay switch.

So I sniffered the UDP message from the PC running the tool to the doorbell. Then I sent the same UDP message with a "Packet Sender" to the doorbells IP and ... The relay switches!!! lol
It does not make sense to post my UDP packet here, due the fact, its encrypted and the ID and password is different to other bells. But it's quite easy to capture.
Feel free to ask me, if any help is needed.

[xman71]

Some new findings from my side:
Until now, I was not able to access gpio's directly to poll doorbell button or switch relay for dooropener.
Some googeling brought up the gpio memory addresses of Hi3518 chip.
So I tested it out and found the address of the doorbell button gpio pin:

Code: Select all

# devmem 0x200f011c
0x00000000
# devmem 0x200f011c w 1

First command shows register of doorbell button (usually 0x0). When you put (write) a 1 in there (2nd command), the npc app recognizes a doorbell press.
I did not find the dooropener register yet, but I will not give up.
Nevertheless, I found a way to open the dooropener relay remotely without using the could application:
With the mentioned IPC-TEST-TOOL you can localy (inside you LAN) test the doorbell functions. There is also a "unlock" button which let's the relay switch.

So I sniffered the UDP message from the PC running the tool to the doorbell. Then I sent the same UDP message with a "Packet Sender" to the doorbells IP and ... The relay switches!!! lol
It does not make sense to post my UDP packet here, due the fact, its encrypted and the ID and password is different to other bells. But it's quite easy to capture.
Feel free to ask me, if any help is needed.

Hi riogrande75,
Do you think it could be possible to monitore the button status via http commands ?
If so I would try to implement it into Jeedom domotic solution.


Envoyé de mon SM-G935F en utilisant Tapatalk

[riogrande75]

The only one feature that i need is open the door calling some HTTP service, or sending some TCP packet, etc ...

This can now be achived with a simple UDP packet to the doorbell.
I am sure this function is available in almost all programming languages.

[xman71]

The only one feature that i need is open the door calling some HTTP service, or sending some TCP packet, etc ...

This can now be achived with a simple UDP packet to the doorbell.
I am sure this function is available in almost all programming languages.

Hi riogrande75,
Could you send me by MP the UDP packet to use ?

Envoyé de mon SM-G935F en utilisant Tapatalk

[riogrande75]

Do you think it could be possible to monitore the button status via http commands ?

Monitoring the button with http is not a good idea. Anyhow it could be done, if you write a C-programm that answers the http requests.
My opinion is, it's better to send a specific HTTP POST from the device to a specified server. This can be done already when you read my last posts.

I am currently working on programm, that checks the doorbell button internaly (via monitoring the gpio memory) and sends a MQTT publish to a specified server. I am already close to the final solution - but my c programming abitilities are not very good and programms for this device need to be written in c (and crosscompiled). So any help is appreciated

If you want any programm to run on the doorbell, just sent me the c sourcecode - I will send you a running binary.