It would be nice to send a snapshot or the short mp4 (as the ftp already does) via MQTT, not just the link, the file itself, this way we don't have to deal with firewall settings to send the image ou video to a monitoring app.

Using the latest version (0.1.0) with a fresh sonoff
Clicking the arrows does not do anything

I read the project files and found a prediction for the timezone parameter, but I saw that GMT0 is fixed, can you pass this parameter to the internal module?

Have anyone made this work with synology surveillance station onvif. Onvif works on my phone apps so it’s working, but synology say can’t read capabilities. Any suggestions?

Rtsp works in synology, but would need ptz

Hi all I extracted the firmware using 7zip directly to the SD card, rebooted the camera with the card inserted, ran a port scan on the camera's IP address and see it is listening only on port 23 and 8080. I can not ssh or access the web interface. Has anyone else had this issue?

Hi,

The IR leds are automatically enabled and It would be great if we could switch them off manually.
The cam is behind a window, and with these dark days the IR leds switch on which blinds the camera.

Thanks!

Using it as a babycamera, and when we have power outage etc the baby gets awakened by that female voice who is letting the baby know that the camera is connecting to internet. :)

no PTZ in HTTP config page or via ONVIF

Firmware Version | 0.1.1
Base Version | V0525.1.276build20201103
Model | GK-200MP2C

Hi,

I can access and change the webui password, however, I can't seem to get the camera to save the authentication credentials for the stream properly.

When I change the password it works for the webui but whenever I try to access the stream it just comes back with invalid user/password, no matter if I try on Mac or iOS.

Home Assistant will add the camera under the onvif integration and pull the snapshots correctly, but the live stream fails to start.

Initially I couldn't access SSH either but I formatted the sdcard and modified the system.conf before inserting it into the camera and that worked for SSH but still not for streaming.

I can see motion events in the ewelink app (through the local storage option) but there no such events listed in the webpage "Motion Events". I updated firmware from 0.0.7 to 0.0.9 but it has made no difference.

First of all, you did a great job, all of these features should be available from the factory.
Now to be perfect, do you think it is possible to implement IPV6 on this camera?

Hi, I set the hostname in configurations menu. It is however not possible to use the hostname to identify the camera on the network. I still need to use the IP address. Any solutions. Tnx for the great work.

Heya!

Would love to add a Wiki page regarding replacing audio files and how to enable/disable sounds right now. I'm sure you're working on an option for the last thing but I'd love to also add how to replace files :)

Thanks!

Hi,

When I try to add the camera using ONVIF I get an error. In one app I'm using it says "Error in retrieving media profiles. This could be due to an erroneous media service port." In Home Assistant I get Unknown error occurred and in the logs it says invalid URL with "http://:80".
I can provide more detailed logs if required.

Greetings,

I was unable to get the timestamps on my camera to display according to my timezone (I did a factory reset and did not use the eWeLink app to configure anything). I also wanted to have my cronjobs saved and not lost after each reboot.

Code stuff

Script

The code for all three these matters:

#!/bin/ash
## 
## set time, start syslog, the start crond

## start using syslog to see what is happening
SONOFF_HACK_PREFIX="/mnt/mmc/sonoff-hack"

SYSLOG_DIR="${SONOFF_HACK_PREFIX}/var/log"
SYSLOG_FILE="${SYSLOG_DIR}/syslog"

## where your crontabs are going to live
CRONDIR="${SONOFF_HACK_PREFIX}/var/spool/cron/crontabs"

## make a copy of your local zoneinfo file (generally /usr/share/zoneinfo),
## rename it and upload it to the location below
ZONEINFO_FILE="${SONOFF_HACK_PREFIX}/etc/localtime"
NTP_SERVER=192.168.13.1
## -----------------------------------------------------------------------------


##  ===== syslog stuff  =====
## use prep to use syslog
if [ ! -d "${SYSLOG_DIR}" ]; then 
  /bin/mkdir -p "${SYSLOG_DIR}"
fi

if [ ! -f "${SYSLOG_FILE}" ]; then 
  /bin/touch "${SYSLOG_FILE}"
fi

## kill any existing 
/usr/bin/killall syslogd &>/dev/null

## start syslog
/sbin/syslogd -O "${SYSLOG_FILE}" -D
## -----------------------------------------------------------------------------


##  ===== zone info stuff =====
## remove current zoneinfo details, replace with your zoneinfo details
if [[ -f "${ZONEINFO_FILE}" ]]; then
  /bin/rm /etc/localtime
  /bin/ln -s "${ZONEINFO_FILE}" /etc/
  /usr/sbin/ntpd -n -q -N -p "${NTP_SERVER}"
  hwclock --systz
fi
## -----------------------------------------------------------------------------


##  ===== cron stuff   =====
## 
if [ ! -d "${CRONDIR}" ]; then 
  /bin/mkdir -p "${CRONDIR}"
fi

## symlink 
## crond seems to ignore the -c flag, so, now it gets created and symlinked
/bin/mkdir -p /var/spool/cron/
ln -s "${CRONDIR}" /var/spool/cron/

## kill any existing 
/usr/bin/killall crond &>/dev/null

## start cron 
/usr/sbin/crond -b -S -l 8 

Installing

• create a new file /mnt/mmc/sonoff-hack/script/crond.sh with the contents shown above
• add /mnt/mmc/sonoff-hack/script/crond.sh to the bottom of /mnt/mmc/sonoff-hack/script/system.sh as a single line

...
## Added crontab 
/mnt/mmc/sonoff-hack/script/crond.sh 

Disable the ntpdate in the database file - /mnt/mtd/db/ipcsys.db (not sure if this really does anything)
UPDATE "main"."t_sys_param" SET "c_param_value"=0 WHERE c_param_name = "NTPEnable"
This was done via sqlitebrowser, copy the file locally, change it and then replace the running version on the camera

Notes

crontab

After various attempts it appears the crond does not honor the -c $work_path flag. For this work around a symlink is created with the actual saving of the crontabs to the /mnt/mmc/sonoff-hack/ path. Using this method also allows the crontabs to be saved to the SD card and they remain even after reboots.

syslog

By troubleshooting the initial crond issues, syslogd as later added to aid in understanding the strange behavior of crond (not honoring -c). It turned out to actually be a welcomed addition and decided to keep it. This is also save to the SD card which can serve as "off-line" logs.

zoneinfo

I ended up finding a copy of my zoneinfo on my local pc, so I uploaded it. During boot I remove the default /etc/localtime (Hong Kong) and do another symlink to the copy of my zoneinfo file. Followed by a timesync via ntpd and updating the hwclock to the (new) system zoneinfo.

Now once I have booted the device and logged in, my time is correct

[root@GK]# date
Fri Nov 27 16:03:45 SAST 2020

*nix paths

Here it is attempted to conform to the standard var/ etc/ paths. Similar to a *nix environment where stuff generally is found, it is now only prefixed with the SONOFF_HACK path,

• crons -> ${SONOFF_HACK_PREFIX}/var/spool/cron/crontabs
• syslog -> ${SONOFF_HACK_PREFIX}/var/log/syslog
• localtime -> ${SONOFF_HACK_PREFIX}/etc/localtime

Conclusion

These changes seem to keep after reboots and helps with fiddling with the device. I trust someone will find this useful or even better some of these ideas make it into the project.

Hi,
After trying to access the web interface several times I found out that the eWelink app says that my camera is the model GK-200MP2C (the box says GK-200MP2B...) is it possible that this is causing me the problem?.
The hack looks like is partially working as I've done a port scan on the device and says that 21,22,23,80,54,8080 ports are open. I am able to access the camera through SSH (user: root and with no password). RTSP Streams (av_stream/ch0 and av_stream/ch1) do also work (with huge delay). FTP is also working (user: root, no password needed).

Hack Version: 0.0.9
Camera model: GK-200MP2C

Many thanks!

When cloud is disabled the eWelink configuration is also disabled, so I'd like to be able to rotate the camera from hack configuration interface, what do you think ?

Hi
tried loads of different setting to get the sonoff to talk to hikvision but so far no luck, anybody had success?
rgds
chris

This would be awesome

I just loaded this on my sonoff camera and like it very much. Its the best of both worlds: cloud and LAN. I would like to make a feature request: can the camera move to a predefined preset on boot?
Thanks

Hello!

Love the firmware. Works great!
Question: I want to use the snapshot feature to grab a frame at a certain time and put together a timelapse video after the winter. I do it right now from a cron script on my computer. Is it possible to put cron on the camera and save the screengrabs directly to the sd-card instead?

Keep up the good work!

/David

When changing the ONVIF Network Interface via the web interface to Wireless, press save and refresh the page, it goes back to ethernet.

When booted from original firmware, the camera doesn't move after a power failure.
With sonoff-hack, even if I configured a start position, if there is a power failure, the camera will fully turn to one side and then will return to the start position.
Is it possible to remove this useless motion and have it stay put?

(Awesome hack, btw! I especially appreciate the boot silence and the snapshot feature.)

Unable to go to presets set. everything else works

Hi, great stuff here! Love it!
Is there a way to integrate the PTZ commands or presets via onfiv (into home assistant).
I can't seem to find a was to control the cam. Only via the webpage.
Or is it just me?
Maybe you could help me :)

Thank you for your work!
Greetings from Germany

First, I could not get RTSP working at all until I created "RTSP Link" via eWeLink.
I used a default password there.

Later, I used sonoff-hack web interface to disable the cloud.
I also changed password.
Now the http access requires the new password.
But RTSP still requires the old password created via eWeLink.
The new password results in 401 Unauthorized.

Sonoff-hack version is 0.1.0.
Base firmware on this camera is V2524.1.276build20201103.
It's the same as in issue #49 and I had to use the binary from that issue to get PTZ working.

So, I guess that there can be more incompatibilities between sonoff-hack and that version of the base firmware .

Has anyone got PTZ controls working through Zoneminder ?

I saw the readme said to use ONVIF camera for Blue Iris so I attempted using the same for Zoneminder but with no luck.

Hi

Thanks a lot for this hack.
I am however unable to use the FTP upload feature properly. The directories are created on the FTP server, but no files are copied.
On server side I can see that the connection is established (on port 21), but no ftp-data connection is initiated (port 20). I suspect that the problem might be that the busybox ftpput on the IP cam is not working in passive mode, but I don't know how to change this.
On server side, all is configured correctly for passive mode (I can copy files through FTP from another client).
Any ideas or help?

Thanks
Jimbo

Hi! Many thanks for your work! Unfortunately after several try, my camera does not upload any videos to FTP server. Server, username and ftp pass is correct (I try use it with Filezilla it's normal working). I see all records in Sonoff hack, but no in my FTP. Do you have any ideas to fix it?
Also, after sonoff hack was be installed i can not see image from camera in ewlink. Motion akert is normal working in ewlink app, but can not connecting to the camera. Is it possible to use sonoff hack and have normal view in ewlink app?
Million thanks for the answers!

The Sonoff cam support both a microphone and speaker.

Unsure how to send voice etc to the speaker.

Is it already posible, otherwise please support.

I've managed to setup two devices with versions 0.1.0 i 0.1.1 of this nice hack. Both cameras hasn't been used/paired in ewlink cloud due to broken sound pairing, but almost everything is working fine with HA and ONVIF integration.
But regardless of any settings in "Motion Events" part of the web config, it never recorder any video file.
How can I debug this problem, what process is responsible for motion events recording?

Hi!

I've never run the original firmware alone but directly copied https://github.com/roleoroleo/sonoff-hack/releases/tag/0.0.7 on SD and it appears that there is no video stream.

After login onto the camera I got:

[root@GK]# netstat -anp |grep 554
netstat: /proc/net/tcp6: No such file or directory
netstat: /proc/net/udp6: No such file or directory
netstat: /proc/net/raw6: No such file or directory

Is there any special way to activate the stream? Do I have to pass trough the original firmware for some configuration?

Regards!

P.S. Great work guys!

Hi, First of all thanks for your work, wonderful work and I really enjoy it.
Now, recently I see that the quality that the camera survives is really poor and as if colorless.
For example :

Any idea why ??

Heya!

Just noticed that playing around too much on the PTZ page seems to easily crash the camera now. I've tried setting up a starting position and it seems that RTSP streaming and the PTZ snapshot streaming is too much for the cam to handle and it hangs, then reboots once the watchdog kicks in at some point.

First of all: Thanks for this amazing work! I've installed version 0.0.7 without any issues, but then realized that the onvif_srvd daemon did not survive after startup. I then used the exact same settings as in the system.sh script to try and start the daemon with --no_fork and got a segmentation fault. After that tried various things removing some of the additional options, but no luck. Also re-installing did not solve the issue. The only thing that seems to be working is onvif_srvd -h:

=============== Help ===============
Daemon name: onvif_srvd
Daemon ver: 1.1.0
Build mode: release
Build date: Oct 23 2020
Build time: 11:43:15

I also downgraded to 0.0.6 and that worked fine. I then copied the 0.0.6 onvif_srvd binary into the 0.0.7 version and that also works. It also seems that all the other features, not relying on the onvif_srvd of 0.0.7 are working.

Some additional info:

1. I'm running the camera over WIFI
2. Firmware Version | 0.0.7
3. Base Version | V2524.1.245build20191030
4. Model | GK-200MP2B
5. Device ID | a62000169d

Since it took me quite long to even realize that the reason why I was not able to connect using my onvif client was the fact that the server simply was not running I would suggest to add a regular check into the web interface showing that the various daemons are working.

Can somebody help me what I dig wrong? I copied the files on the SD card and restart the camera. I think the card and the custom firmware is recognized because there was no built in voice during the startup and the camera did the initial repositioning. This indicates to me that the custom firmware is working.
However I cannot access the web interface on port 8080. I checked the IP address multiple times on my routers DHCP page and also in eWeLink app information page. I can access the camera via the eWeLink app (stream and PTZ is working). But nothing else seems to work for me.
Can anybody give me some advice to make this work? I am sure I miss something just can't figure it out. (I also check the firmware version and it is the same mentioned in the readme)

An MJPEG server could really help people that want to use this camera with Octoprint
Something like that:

https://github.com/eroji/rtsp2mjpg

It can replace the RTSP server if running together will consume too much resource

I have recently upgraded to version 0.0.6 and all the preset combo boxes in the PTZ page are blank.

Hello, I got a small proble with PTZ on Y axis.
When I set Y axis to "0", it is aiming to -10deg.
bin/ptz -a go -x 1850 -y 0 -d
Whne I set to 900, it is aiming 90deg (UP to the ceiling)
bin/ptz -a go -x 900 -y 0 -d

But I need to have a look more down (-50deg). Camera is capable to do so. After several down movements I am aiming fully down.
bin/ptz -a down -t 1000 -d

When I wanted to save this preset, it will read negative value from Y axis.
bin/ptz -a set_preset -n 1 -e obyvak -d -f etc/ptz_presets.conf
Current position: (1851, -804)

And issue now, if there is negative value saved in ptz_presets.conf, it will not do any movement.
I am testing this on version 0.0.9

Possible solutions:

1. Is it possible to extend range of Y axis? I would need something like 1700. When it moves fully up, it will set this value as 1700 and then there is a room to move fully down.
2. Reverse Y axis movement. Homing position will be down.

I turned onvif on and set hostname but when I try to connect from tinyCam(Android App) it says that there I must use hostname and it is unreacheable, even if I try to ping by name(Windows PC), there is something that I can do to solve this problem?

After configuring the cam to have cloud disabled I still receive motion detected notifications through the eWeLink app.
When I go into the app my cameras still say offline and can't be accessed otherwise.

Is there a way I can set a PTZ location preset via a curl command.

For example if one of my other cameras detects motion, front door for example I can set an automation to send a curl command to the sonoff to set it to a certain preset to watch the path down the side of the house.

I still receive push messages on motion detection from ewelink app even disabling the cloud support.

Is it a bug or am i doing something wrong?

Tnx for the great work so far. I plan to add object tracking with opencv and python onvif. I will keep you up to date on it. If some one else did already do it, please share. Python onviff works great with this camera. See and

The device is connected via ethernet, but I've fully blocked it from accessing the WAN through my router.
I've disabled cloud access and set the ntp server to my router.
Swap File is enabled.

After a few minutes (<10) of being turned on, the RSTP streams and the snapshot become unresponsive. I would watch them function normally on VLC and then lose connection and not be able to reconnect until I reboot the device.

I don't know how different this is from yi-hack-Allwinner but they seem to have a problem viewing RTSP when the internet is blocked.

I'm not sure how to debug or where logs are located but I can upload them if someone tells me where they are.

Thanks

Edit: After the failure I found that running "/mnt/mtd/ipc/app/avencode" again will bring the stream back up and it will stay back up indefinitely(so far). So if nobody can fix crash issue, could someone help me make a script to automatically restart avencode when it fails? I'm not used the the process management system under busybox.

The Online LWT message is sent to the specified topic but when the camera goes offline, the LWT message is sent to / (root)

Where can I find arm-sonoff-linux-uclibcgnueabi-gcc package (UBUNTU)?
I cannot build firmware otherwise, due to error:

/bin/sh: 1: arm-sonoff-linux-uclibcgnueabi-gcc: not found
or 
/sonoff-hack/src/busybox/busybox/scripts/gcc-version.sh: line 11: arm-sonoff-linux-uclibcgnueabi-gcc: command not found

google does not help much.

Greetings,

Thanks for the work you have done on this project. Your project opens up the hacking possibilities for these devices.

I prefer to keep my devices "cloud-free" (as far as possible). I was digging around in the os-innards of the camera and I have made some headway in how to configure the WiFi particulars without submitting it via the eWelink app (sound method).

The short

I have been able to identify a number of changes that allows you to change the wireless credentials without online/app submission.

Files involved

Using meld I was able to compare the /mnt/mtd files of a factory reset and wifi-enabled only deployment

• /mnt/mtd/db/ipcsys.db - sqlite database containing the WPA stuff
• /mnt/mtd/ipc/cfg/wpa_supplicant.conf - WPA stuff
• /mnt/mtd/ipc/cfg/DyVoiceRecog.bin - a blank file you need to make

Sources

/mnt/mtd/ipc/app/script/dhcp.sh one of the main files that switch between the Wireless (ra0) and Ethernet (eth0)
The command to run (modified) that calls for DHCP on ra0
udhcpc -v -a -b -i ra0 -x hostname:testing -p /var/dhcp.pid > /var/dhcp_debug.info

Challenge

I am able to make the changes to the database, the WPA file and add the DyVoiceRecog.bin which should start the WiFi, however this does not happen.
I can see the connection coming in on my router, the WPA passes and then the device gets in IP, then it stays unable to route to host. The DHCP lease does not renew once expired.
Once I connect the LAN cable then I get a DHCP and I can connect to the camera.
I have tried making a number of changes and adding wpa_cli commands and the udhcpc commands to the /mnt/mmc/boot.sh file at various places, but to no avail.

Almost there

It feels like I am missing something simple and I would like to know if you have any thoughts. I am very sure the config changes I have found and made are close to a victory.

After the WiFi connection has failed and I plug the LAN cable in, when I run the commands from terminal all works 100%, my WPA succeeds, the device gets an IP, I am able to ssh to my [email protected], it just fails to boot with WiFi as the only connection method.

Trail and (t)errors

Prep for WiFi

• extract sonoff-hack to sdcard (0.0.7)

• load factory defaults of camera if by pressing reset device button

• insert sd card with sonoff hack

• connect lan cable

• boot device

• get files from device

  • get the database file - /mnt/mtd/db/ipcsys.db
  • get the wpa_supplicant file - /mnt/mtd/ipc/cfg/wpa_supplicant.conf

• edit the sqlite file and add your wifi details in the

  • Table: t_sys_param
  • wf_status -> 1
  • wf_ssid ->
  • wf_key ->
  • wf_auth -> 3
  • wf_enc -> 1

• Edit wpa_supplicant file

ctrl_interface=/var/run/wpa_supplicant
update_config=1
network={
	ssid="<the-ssid>"
	scan_ssid=1
	key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE
	pairwise=TKIP CCMP
	group=CCMP TKIP WEP104 WEP40
	psk="<the-password>"
}

• upload the changed files and blank file
  • /mnt/mtd/db/ipcsys.db - sqlite database containing the WPA stuff
  • /mnt/mtd/ipc/cfg/wpa_supplicant.conf - WPA stuff
  • /mnt/mtd/ipc/cfg/DyVoiceRecog.bin - a blank file you need to make

Testing the WiFi changes

Reboot the device (LAN cable stays in)
ssh [email protected]

[root@GK]# wpa_cli -i ra0 status
wpa_state=DISCONNECTED
address=xx:xx:xx:xx:xx:xx

[root@GK]# wpa_cli -i ra0 disconnect
OK

[root@GK]# wpa_cli -i ra0 reconnect
OK

-- give a few seconds --

[root@GK]# wpa_cli -i ra0 status
bssid=xx:xx:xx:xx:xx:xx
freq=0
ssid=<your-ssid-will-show-here>
id=0
mode=station
pairwise_cipher=CCMP
group_cipher=CCMP
key_mgmt=WPA2-PSK
wpa_state=COMPLETED
address=xx:xx:xx:xx:xx:xx

The above indicates your WiFi is connected, but you will not have an IP address yet..

[root@GK]# udhcpc -a -b -i ra0 -x hostname:justtesting -p /var/dhcp.pid  > /var/dhcp.info
route: SIOCDELRT: No such process

[root@GK]# ip ad
..
3: ra0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 192.168.13.37/24 brd 192.168.13.255 scope global ra0
...

Connected!!

As you can see by now, the change in WiFi details are working and you can connect to your Access points

Sticky part

I just cant seem to get the WiFi to start correctly at boot. Not sure if it is config related, runlevel, or just pebkac

You inputs and expertise in the matter is highly appreciated and valued.

In closing

I trust feature like "Configure your WiFi from the web interface" would be a welcomed addition to the project.

Once you save an empty Preset name you can't change any of the other presets anymore until you manually set a name in the "etc/ptz_presets.conf" file.

Hi!
I can't get the PTZ go to preset function to work with my custom presets. I have tested to create presets with the name: test on position 0 and with the name Lower-Center on position 1. The creation of the presets seems to work fine but nothing happens when I select one of my own presets and press the go to preset button.

WiFi connected
Firmware Version: 0.1.0
Base Version: V2524.1.245build20191030

Keep up the good work!

/Erik