Yi Cloud Dome 1080p dump in progress :)

[BlueBlueBlob]

Hi all,
I'm connected.

But I mess with the home partition before, so I'm waiting my second camera.
I will send dump in the week :)

See you later all

[BlueBlueBlob]

Or I will compile a custom firmware.
@shadow-1 : are your sdk links still up ?

[shadow-1]

@BlueBlueBlob
Yes the SDK's I hosted should still be up (link on main page). I never removed them.

[mitchross]

Hi @BlueBlueBlob Any update?

[BlueBlueBlob]

I'm waiting delivery.
Today I will try to provide stock rootfs and home partitions for y19 (its code name).
So people will able to unbrick.

[phoxy84]

Sounds great, can't wait to use my camera. Now I only get the message that the camera does not work outside China :'(

[BlueBlueBlob]

Well... Next update in 1 week... I bought the Dome 1080p in white but it's not the Cloud 😂
I'm waiting the new one :/

[cautroi01]

This is stock firmware from YI Technical Support for Yi Cloud Dome 1080p
https://mega.nz/#!N0BHQAoY!XR5R-YI7NutOHSOr8ZL1sSPLeB7ipZP_pcPD5fAqQXg

[BlueBlueBlob]

This is stock firmware from YI Technical Support for Yi Cloud Dome 1080p
https://mega.nz/#!N0BHQAoY!XR5R-YI7NutOHSOr8ZL1sSPLeB7ipZP_pcPD5fAqQXg

Thx but renaming with home_y19 is not wworking. Did they say how to apply ?

[cautroi01]

The firmware working for me
They say:

1. the firmware file for you to update the camera (do not unzip or rename the firmware, just copy it to SD card root)

If the issue still exists after that, then please help us take the camera firmware logs:
I. insert a Micro SD card (8g-32g,FAT32,completely formatted) into the camera before power on
II. keeps the camera running until the pairing issue occurs once again
III. wait 5 minutes before removing the SD card from camera
IV. copy all the logs and the zbar.raw under SD card via card-reader or laptop and send the files for us to check
( for example, the files will come in such format:
log_SPM6EEMEL7N94JFM111A_tnp_init_finish.tar.gz
log_SPM6EEMEL7N94JFM111A_yi_login.tar.gz)

[BlueBlueBlob]

The firmware working for me
They say:

1. the firmware file for you to update the camera (do not unzip or rename the firmware, just copy it to SD card root)

If the issue still exists after that, then please help us take the camera firmware logs:
I. insert a Micro SD card (8g-32g,FAT32,completely formatted) into the camera before power on
II. keeps the camera running until the pairing issue occurs once again
III. wait 5 minutes before removing the SD card from camera
IV. copy all the logs and the zbar.raw under SD card via card-reader or laptop and send the files for us to check
( for example, the files will come in such format:
log_SPM6EEMEL7N94JFM111A_tnp_init_finish.tar.gz
log_SPM6EEMEL7N94JFM111A_yi_login.tar.gz)

Thx a lot :)

[BlueBlueBlob]

Ok I'm connected, but I can't enter command. I only see Yi process output even pressing enter.

[phoxy84]

Will this work for both the Chinese and International version? I have Chinese version, can you test with that version as well? If I can help, let me know, allthough I have limited knowledge ;)

[TheCrypt0]

The image linked by @cautroi01 isn't a firmware image. The suffix "m" means that it's an encrypted update, not a recovery image.

[BlueBlueBlob]

Yes but I was able to flash it.
@TheCrypt0 : Do I have to pair my camera before to have shell cmd on ttl ?

[BlueBlueBlob]

After inserting sdcard

himci: card connected!
himci: mmc1: valid phase shift [5, 3] Final Phase 0
mmc1: new ultra high speed SDR104 SDHC card at address aaaa
mmcblk0: mmc1:aaaa SC32G 29.7 GiB
mmcblk0: p1
stExposureAttr.stAuto.u8Compensation=60
killall: recbackup: no process killed
umount: can't forcibly umount /tmp/cifs: No such file or directory
stExposureAttr.stAuto.u8Compensation=60
p2p cur user(0) max_user_num(0) in_packet_loss(0) out_packet_loss(0)
umount: can't remount tmpfs read-only
umount: /dev/mtdblock5 busy - remounted read-only
umount: can't remount tmpfs read-only
stExposureAttr.stAuto.u8Compensation=58
can't run '/sbin/swapoff': No such file or directory
The system is going down NOW!
MMB LEAK(pid=1006): 0x83F46000, 12288 bytes, ''
mmz_userdev_release: mmb<0x83F46000> mapped to userspace 0xb6fca000 will be force unmaped!
Sent SIGTERM to all processes
MMB LEAK(pid=965): 0x835A5000, 4096 bytes, 'AENC(0)StrmBuf'
mmz_userdev_release: mmb<0x835A5000> mapped to userspace 0xb6f09000 will be force unmaped!
MMB LEAK(pid=965): 0x835A6000, 32768 bytes, 'AENC(0) CirBuf'
mmz_userdev_release: mmb<0x835A6000> mapped to userspace 0xb6d62000 will be force unmaped!
MMB LEAK(pid=965): 0x835B3000, 16384 bytes, 'AO(0,0) CirBuf'
mmz_userdev_release: mmb<0x835B3000> mapped to userspace 0xb6c5e000 will be force unmaped!
MMB LEAK(pid=1006): 0x83F49000, 4096 bytes, 'CIPHER_BufIn'
mmz_userdev_release: mmb<0x83F49000> mapped to userspace 0xb6fc9000 will be force unmaped!
MMB LEAK(pid=1006): 0x83F4A000, 4096 bytes, 'CIPHER_BufOut'
mmz_userdev_release: mmb<0x83F4A000> mapped to userspace 0xb6ece000 will be force unmaped!
unlink cmd rsp urb
Sent SIGKILL to all processes
Requesting system reboot

reboot by watchdog
Restarting system.

System startup
=========1
hello, open console

do_auto_sd_update: detect flash size: 0x1000000, gsdexist=1
Interface: MMC
Device 0: Vendor: Man 035344 Snr 4a7710f6 Rev: 8.0 Prod: SC32G
Type: Removable Hard Disk
Capacity: 30436.5 MB = 29.7 GB (62333952 x 512)
Partition 1: Filesystem: FAT32 "NO NAME "
245760 zbar.raw
36864 log_wifi_connected.tar.gz
40448 log_first_login.tar.gz
system volume information/
record/
log/
test/
1820774 home_y19m

4 file(s), 4 dir(s)

1: zbar.raw!
2: log_wifi_connected.tar.gz!
3: log_first_login.tar.gz!
4: home_y19m!
u-boot_y19 not found!

env_y19 not found!

conf_y19 not found!

kernel_y19 not found!

rootfs_y19 not found!

home_y19 not found!

do_auto_update: detect flash size: 0x1000000

UBOOT:test pin high!

Hit any key to stop autoboot: 0
16384 KiB hi_fmc at 0:0 is now current device

Booting kernel from Legacy Image at 82000000 ...

Image Name: 7518-hi3518c-kernel
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1397928 Bytes = 1.3 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0
Linux version 3.4.35 (zhangbao@ANTS-SH-SV02) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v300) ) #36 Tue Sep 26 09:54:23 CST 2017
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518ev200
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8636
Kernel command line: mem=34M console=ttyAMA0,115200 root=/dev/mtdblock4 rootfstype=jffs2 mtdparts=hi_sfc:256k(boot)ro,64k(env),64k(conf),1600k(os),1280k(rootfs),12992k(home),64k(vd1),64k(ver)!!!
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 34MB = 34MB total
Memory: 30616k/30616k available, 4200k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
vmalloc : 0xc2800000 - 0xff000000 ( 968 MB)
lowmem : 0xc0000000 - 0xc2200000 ( 34 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.text : 0xc0008000 - 0xc0348000 (3328 kB)
.init : 0xc0348000 - 0xc0364e2c ( 116 kB)
.data : 0xc0366000 - 0xc0387780 ( 134 kB)
.bss : 0xc03877a4 - 0xc03b9d30 ( 202 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32
VIC @fe0d0000: id 0x00641190, vendor 0x41
sched_clock: 32 bits at 49MHz, resolution 20ns, wraps every 86767ms
Console: colour dummy device 80x30
Calibrating delay loop... 269.10 BogoMIPS (lpj=1345536)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x80270d18 - 0x80270d70
dummy:
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 30) is a PL011 rev2
uart:2: ttyAMA2 at MMIO 0x200a0000 (irq = 25) is a PL011 rev2
bio: create slab at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource timer0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.18)
msgmni has been set to 59
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
Check Flash Memory Controller v100 ... Found.
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
SPI Nor total size: 16MB
mtd: bad character after partition (!)
8 cmdlinepart partitions found on MTD device hi_sfc
8 cmdlinepart partitions found on MTD device hi_sfc
Creating 8 MTD partitions on "hi_sfc":
0x000000000000-0x000000040000 : "boot"
0x000000040000-0x000000050000 : "env"
0x000000050000-0x000000060000 : "conf"
0x000000060000-0x0000001f0000 : "os"
0x0000001f0000-0x000000330000 : "rootfs"
0x000000330000-0x000000fe0000 : "home"
0x000000fe0000-0x000000ff0000 : "vd1"
0x000000ff0000-0x000001000000 : "ver"
himii: probed
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
i2c /dev entries driver
hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed!
hisi_i2c hisi_i2c.1: Hisilicon [i2c-1] probed!
hisi_i2c hisi_i2c.2: Hisilicon [i2c-2] probed!
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
Registering the dns_resolver key type
VFS: Mounted root (jffs2 filesystem) on device 31:4.
Freeing init memory: 112K
^Cusb 1-1: new high-speed USB device number 2 using hiusb-ehci
^C
_ _ _ _ _ _ _ _ _ _ _ _
\ _ _ _ _ _ ___
/ // \ |_/
/ __ / - _ ___
/ / / / / /
_ _ _ / / / _/ _ ______
_______

^C^C^Chimci: mmc1: valid phase shift [5, 3] Final Phase 0
mmc1: new ultra high speed SDR104 SDHC card at address aaaa
mmcblk0: mmc1:aaaa SC32G 29.7 GiB
Not recognise ACTION:change
Not recognise ACTION:change
mmcblk0: p1
^C^C^C^Crm: can't remove '/sbin/reboot': No such file or directory
exFAT: Version 1.2.9
^Cvm.dirty_background_ratio = 2
vm.dirty_ratio = 2
vm.dirty_writeback_centisecs = 100
vm.dirty_expire_centisecs = 500
fs.mqueue.msg_max = 256

[shadow-1]

@BlueBlueBlob
Boot log does not give much away. 😞

I might investigate the Yi Outdoor camera firmware which also seems to have disabled terminal access. I have more information on that camera.

[BlueBlueBlob]

@shadow-1 just a question, regarding boot log and kernel information. The y19 is more h20 or y20 ? Because I'm waiting a second one, so I can flash rootfs from other model but I'm not sure :)

[shadow-1]

@BlueBlueBlob
Not sure what you are asking.

Your camera is looking for a y18 firmware file to flash from microSD card.
I do not recommend renaming one of the other firmware files and flashing it. It can soft brick your camera with no way to recover (because we do not have a dump of the stock firmware to restore).

[TheCrypt0]

Discord Server

I've just created a Discord server with a couple of channels. Invite link.

---

I'm posting this here too, in case someone wants to join have a easier direct communication. The main informations/discoveries about the cam will be posted on the issue too.

[BlueBlueBlob]

@shadow-1 : y19 not y18.
rootfs is busy box and init.d script, do you think I can flash the rootfs from h20 ?
Like you suggest for Outdoor camera with another rootfs.
Sorry for my English :/

[shadow-1]

@BlueBlueBlob
I personally would not do it because it could brick your camera with no way of restoring it until we manage to get a backup of the stock firmware from another camera (using a different method).

[BlueBlueBlob]

Got it !

I have all partitions :)

I can start to play with rootfs :)
Thx @shadow-1 : You shared a lot of informations in issue threads
Just need some help to mount mtdblock :/

[BlueBlueBlob]

Well sorry I tried all the day, but I can not mount dumps :/
During this time I extracted last update from y19 : 1.9.3.0E_201812141519home_y19m

[BlueBlueBlob]

Dump complete

[mecaz]

Is there any progress?

[BlueBlueBlob]

@shadow-1 : do you want stock home_y19 and rootfs_y19 ?

[shadow-1]

@BlueBlueBlob
It would be helpful to have these files. I am sure an alternative firmware can be developed if it is similar to the other cameras in the series. 😄

[BlueBlueBlob]

@shadow-1 : sure. V4 is already working with it.
Sorry, I thought you didn't have time.
https://drive.google.com/folderview?id=18v0H6XF54KEcsUXGfRxgw3eWyk6hjIFG

[Nomis9]

@BlueBlueBlob
It would be helpful to have these files. I am sure an alternative firmware can be developed if it is similar to the other cameras in the series. 😄

Will you create modified firmware for Yi Cloud Dome 1080p?
Thanks for answer

[alienatedsec]

@shadow-1 @BlueBlueBlob are you still in possession of those stock home_y19 and rootfs_y19 files?