Merkury 1080P (MIC-CW017-101W) - Firmware Version 4.0.7 - Patch Request

[xraive]

I have this rooted and Onvif and RTSP are working, thanks to your instructions. Unfortunately this device needs to be online for them to work. When you have time, I would appreciate it if you can patch the app. I'm attaching a zip file.

{
"devname": "Smart Home Camera",
"model": "Mini 11S",
"serialno": "",
"softwareversion": "4.0.7",
"hardwareversion": "M11S_A2_V20_GC1",
"firmwareversion": "ppstrong-a3-tuya2_merkury-4.0.7.20210624",
"identity": "",
"authkey": "",
"deviceid": "****",
"pid": "aaa",
"WiFi MAC": "75:9a:A8:FD:C4:3C",
"ETH MAC": "00:00:00:00:00:00"
}
--deleted--

[guino]

@xraive I'll work on it as soon as I have a chance.

[xraive]

No worries I appreciate your assistance.

[guino]

@xraive try this patch with the standard instructions (guino/ppsapp-rtsp#1 (comment)):
ppsapp-offline.zip

[xraive]

My apologies for the delay I was away. Thank you for your help on this. I will try it out tonight and let you know.

[xraive]

Just want to say thank you once again. Tested the patch and it works great. I was lucky enough to get a bunch of these for really cheap and I'm happy that they can run offline.

[guino]

@xraive thanks for reporting back!

[xraive]

@guino is it possible to run it without SD card? This device's rootfs is writable.

[guino]

@xraive most tuya devices I have seen the rootfs is writeable but once you reboot any changes you made are lost (like a ram drive) + there's usually not enough space to save the files we need (i.e. busybox, patched ppsapp, etc). If you make changes to the rootfs and they persist after a reboot then it could be possible to run it without the SD card, that is, assuming there's enough space available to save all you need (perhaps overwriting some files). I have a non-tuya camera that I modified and works without SD card, but my tuya devices need SD card to be rooted. It is definitely possible to make a rooted 'firmware' but that is very specific to each firmware, takes a lot more effort to do and would be lost on the first firmware update available, so I don't recommend it.

[xraive]

I've using this camera offline for quite some time now and it's been great. So far I've noticed one issue and would like to see if you might have encountered it. I'm unable to disable the watermark even if run the "/mnt/mmc01/set watermark_onoff 0" command. However if I use the app to disable the watermark it works, but only until the device reboots.

[guino]

@xraive by watermark do you mean the "date and time" ? cause that's the only thing I've ever seen displayed on these cameras. I never paid much attention to this feature but on a quick try I can also disable it on the app but it doesn't update tuya_config.json which makes me think the setting isn't implemented correctly.

There's likely a way to patch ppsapp to disable it but I'm not sure how much work that would be (like I said: I haven't looked much into this feature)

[tok1440]

@guino Hi, I got my Merkury CW017 rooted but noticed there is not patch for firmware 4.0.7.20210624 in the list. I tried the offline patch you posted further up this topic with no success. My device details below...

{
"devname":"Smart Home Camera",
"model":"Mini 11S",
"serialno":"",
"softwareversion":"4.0.7",
"hardwareversion":"M11S_A2_V20_GC1",
"firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.7.20210624",
"identity":"",
"authkey":"",
"deviceid":"",
"pid":"aaa",
"WiFi MAC":"",
"ETH MAC":"00:00:00:00:00:00"
}

command line output...
mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

attached file hashes...
CRC32:
13581e92
MD5:
64bacab529514ae5e1d10b17bbae69bf
SHA-1:
b372143ddf52a0572fc001820cd275403ecd3092
--deleted--

Thank you for liberating this cheap device. :)

[guino]

@tok1440 most 4.0.x firmware allow enabling onvif on the tuya_config.json file (without patching).

If you want onvif/rtsp you should try this first: #9 (comment)

If you want/need an offline patch (already have ONVIF/RTSP working), let me know and I can try to work something out (it will probably be a week before I can work on it).

[tok1440]

@guino I am unable to connect via Telnet. Are there any other files other than busybox that need to be placed in SD root to allow Telnet to connect?

[guino]

@tok1440 for telnet you need busybox (it should be over 1Mb in size), custom.sh, initrun.sh and have configured the device as described in step 9 of guino/BazzDoorbell#2

Do you get a login prompt when you execute telnet IP -- if so, your files are fine and you just need to create a passwd file as instructed above (step 9), if you don't get a login prompt you need to check busybox, initrun.sh and custom.sh

Feel free to post a list or zip of your SD card files (without the SDT folder) and I can review when I have a chance.

[tok1440]

@guino Ok, I was missing the custom.sh file. Now I can connect via Telnet. Trying to figure out login/password portion now.

Update: Ok, I am in. I will update.

[tok1440]

@guino Got it working by modifying the tuya_config.json file. Thank you for pointing me in the right direction. Now question, what is the benefit of offline mode? Does an offline mode patch severe the connection to its external server? Or is it mainly to allow the camera to function without phoning home?

[guino]

@tok1440 offline patch only allows the camera to boot up completely when/if you block internet access to it. To use it offline you still have to block the internet and setup a ntp server so you can set the date/time on the device (which is usually done using tuya servers).

[tok1440]

@tok1440 To use it offline you still have to block the internet and setup a ntp server so you can set the date/time on the device (which is usually done using tuya servers).

Now, will the offline patch support the other camera's in my possession? So far, the firmware and models match among all three.

[guino]

@tok1440 if they’re all the same model and firmware then the same offline patch should work on all.

[xraive]

@guino I don't know if I should open a new issue or not. But I've been using the patched version of the app and it's been working great but I'm having issues when I try to record the main rtsp stream with Frigate. The substream works great but the main streams always produces errors.

For now I'm using the substream to record but I would prefer the main stream. I noticed that in your other repo you were able to enable an old version of rtsp, is this something that would be available for this device's firmware?

Thank you once again.

[guino]

@xraive there are many reported compatibility issues between these cameras and different software/devices. I have also seen a lot of congestion myself (2.4Ghz wifi networks are always congested here) which could be affecting the connection (and probably not as much on lower resolution).

You could try streaming on a computer (i.e. VLC) to see if you have issues over time. You could also try using ffmpeg to 'receive' the camera's RTSP and serve it to frigate to see if it helps at all (maybe even re-encoding).

I don't have a device on 4.x firmware so I can't really test it.

[xraive]

@guino Thanks for getting back to me, do you think it would be possible to do what you did it here guino/BazzDoorbell#87 (comment)?

I"ve tried using ffmpeg to receive the RTSP streams but there are always issues when access the Main Stream.

[guino]

I can check your ppsapp for the old RSTP code but I don't think I have seen it on any 4.x firmware -- please confirm that you're still running version "ppstrong-a3-tuya2_merkury-4.0.7.20210624".

[xraive]

@guino yes that's is the correct version. It's the same version it came with. There hasn't been any upgrades.

[guino]

Just letting you know I haven’t had a chance to look at it but it’s on my todo list.

[xraive]

@guino no worries. I appreciate it.

[guino]

@xraive try this patch enable the old RTSP code in this device (original ppsapp md5sum is 64bacab529514ae5e1d10b17bbae69bf):
ppsapp-rtsp.zip

I expect it to be rtsp://ip:8554

[guino]

@xraive if there's already an onvif/rtsp server running on port 8554 you may want to disable it in the tuya_config.json before trying the patch above.

[lasergh]

Hi, I have a similar camera and i've managed to obtain the following information on boot. I followed all of the instructions for the rooting, but camera is starting normally when i turn it on, i dont get anything from the ipc url

U-Boot 2013.10.0-V3.1.28_bchV1.0.00 (Apr 13 2022 - 14:59:31)

DRAM: 64 MiB
efuse_read:0x00000002
8 MiB
sd detect gpio mode:47!
mmc_sd: 0
In: serial
Out: serial
Err: serial
Net: eth-0

Hit any key to stop autoboot: 1 0
K ERNEL: size:0x00184000, offset:0x0003f000

SF: 1589248 bytes @ 0x3f000 Read: OK

Booting kernel from Legacy Image at 80008000 ...

Image Name: Linux-4.4.192V2.1
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1518936 Bytes = 1.4 MiB
Load Address: 80008000
Entry Point: 80008040
Verifying Checksum ... OK
XIP Kernel Image ... OK
kernel loaded at 0x80008000, end = 0x8017ad58
using: FDT

Starting kernel ...

[guino]

@lasergh since you got the uart log above, are you able to press a key when it says 'Hit any key to stop autoboot' and go into the U-Boot prompt ? If so, send me an email (my email is on my github profile) and I can give you some instructions. You may want to confirm in the phone app that your firmware is also 4.0.7 and if so, post a zip of your SD card contents without the SDT folder for review.