I have bought a Genius Facecam 321 to use with mjpg-streamer on Linux.
The packaging mentioned MJPEG as supported format, but it is lying!
The camera only supports YUV both on Windows and Linux

I have not been able to find anything more detailed about the internals of the AI Thinker A6 GSM modem.

I bought one, fired up my heat air gun and:


We can see two major components:

A RDA8851MS controller and a RDA6625e frontend

At the same time I am looking for an SDK to it. So called CSDTK.

I have got a NewPos NEW6210 mPOS to do some application development.

I wanted to get the development env rolling on my Ubuntu 14.04
The manual suggests using 32 bit RedHat Enterprise Server 6 x86 32bit version, but you know no pain no gain.

The documentation and the overall quality of the support is something what you expect from a typical chinese company. You got an FTP access and figure out what you need.

So let's get a gcc to compile a hello world. The official toolchain is based on a 32 bit glibc-oabi-toolchain-arm-generic compiler.

To get this tool working you will need a 32 bit build of the mpfr-2.4.2 (the manual lists it as reqirement too -- Because this toolchain uses a high grade version of GCC toolchain, --).
You can grab it from here:
http://www.mpfr.org/mpfr-2.4.2/mpfr-2.4.2.tar.bz2

Some things are changed around the gmp so replace all occurrences of __gmp_const with a simple const. (Do it with sed or whatever you like).
./configure --prefix=/usr "CFLAGS=-m32" "CXXFLAGS=-m32" "LDFLAGS=-m32"
To compile it to 32 bit you will need to set the proper cflags.
./configure --prefix=/usr "CFLAGS=-m32" "CXXFLAGS=-m32" "LDFLAGS=-m32"

After installing it the cross compiler will claim about the missing libgmp.so.3.

Install the 32 bit version of the libgmp10 lib with:
sudo apt-get install libgmp10:i386

Then create a symlink:
sudo ln -s /usr/lib/i386-linux-gnu/libgmp.so /usr/lib/i386-linux-gnu/libgmp.so.3

Aaaannnd at this point we have a somewhat working crosscompiler.

ATM I cannot ssh to the target, as the manual says, so stay tuned!

I have a system bootlog from UART, which reveals some deeper details about the HW:

[secu] S-Boot: v1.0.6_C (2014-12-25 14:31:09)
[secu] DDR initialization...
[secu] Reset DDR Controller
[secu] Configuring DDR
[secu] mclk = 133, auto refresh = 0x3df
[secu] DDR DLL locked...!!!
[secu] Doing DDR data eye training sequence ....
[secu] DDR data eye training sequence passed...!!!
[secu] Tamper Status: None
[secu] Boot(3): 2016-08-30 12:34:08
[secu] NAND: ESMT NAND 128MiB 1,8V 16-bit, ID = 0xc8-0xb1
[secu] U-Boot loading from NAND 0x20000 ==> 0x41bfffc0 0x670e8 bytes
[secu] Switching to Open mode... Done
[open] Start U-Boot at 0x41c00000 ...
U-Boot 2011.12-svn499 (Jun 18 2015 - 09:16:15)
Copyright (C) 2012 by LiHua_338@163.com
U-Boot code: 41C00000 -> 41C60338 BSS: -> 41CA3338
CPU: BCM5892-0300
FCLK: 400 MHz
HCLK: 133 MHz
MCLK: 133 MHz
PCLK: 66 MHz
DRAM: 64 MiB
NAND: 128 MiB
*** Warning - bad CRC, using default environment
LCD Type: 320*240ch
hx8347_hw_init ID: 95
LCD Chip: 0x00008347
In: serial
Out: serial
Err: serial
Update by USB: None
Update by local: None
Hit any key to stop autoboot: 0

Search kernel...Creating 1 MTD partitions on "nand0":
0x000000600000-0x000004000000 : "mtd=2"
Loading kernel: 0%Loading file '/boot/uImage' to addr 0x40400000 with size 2153084 (0x0020da7c)...
Done
Booting kernel ... ## Booting kernel from Legacy Image at 40400000 ...
Image Name: Linux-2.6.32.65-bcm5892-secure
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2152564 Bytes = 2.1 MiB
Load Address: 40008000
Entry Point: 40008000
Loading Kernel Image ... OK
OK
Starting kernel ...
[ 0.460000] bootmemheap_init: Error - bootmemheap_setup() not called
INIT: version 2.88 booting

INIT: Entering runlevel: 3
$Install driver fusion: [ 4.050000] fusion: unable to register major 250. Registered 248 instead
[ OK ]
$Install driver bcm589x_otg: [ OK ]
$Install driver g_serial: [ OK ]
$Install driver bcm589x_spi: [ OK ]
$Install driver leds: [ OK ]
$Install driver beeper: [ OK ]
$Install driver matrix_keys: [ OK ]
$Install driver bcm5892_adc_driver: [ OK ]
$Install driver touch_screen: [ OK ]
$Install driver iso7816_uart: [ OK ]
$Install driver iccard: [ OK ]
$Install driver nfc: [ OK ]
$Install driver nfc_pn512: FATAL: Error inserting nfc_pn512 (/lib/modules/2.6.32.65-bcm5892-secure/kernel/drivers/char/nfc/nfc_pn512.ko): No such device
[FAILED]
$Install driver nfc_rc663: [ OK ]
$Install driver magstripe: [ OK ]
$Install driver idtechencmag: [ OK ]
$Install driver bcm589x_pm: [ OK ]
$Install driver dhd: [ OK ]
$Install driver pdriver: [ OK ]
$Install driver pdriver_file: [ OK ]
$Install driver pdriver_printer: [ OK ]
$Install driver pdriver_uart: [ OK ]
$Install driver modem: [ OK ]
$Install driver slnsp: [ OK ]
$Install driver cx930xx: [ OK ]
$Install driver bcm_new_udc_dwc: [ OK ]
$Starting mdev: [ OK ]
$Setting clock (localtime): Tue Aug 30 12:34:22 CEST 2016 [ OK ]
$Starting network: [ OK ]
$Starting system logger: [ OK ]
$Starting kernel logger: [ OK ]
$Starting system message bus: [ OK ]
$Starting system update:


Create a square label with fixed size, let's say 24*24px.

Use the following stylesheet:
"background-color: rgb(85, 255, 0); border-radius: 12px;"

Change/clear the stylesheet when the LED is off.

A while ago I have bought a Hi3518 based camera module from the Aliexpress.

It is called BLK18E-0712C-38X38_S (V1.01)

Some initial findings:

- No DHCP is set. Static IP at 192.168.1.10
- Default username for HTTP and RSTP is admin with blank password.
- HTTP interface lang is set to chinese atm. I have no idea where to change this.
- Streaming is done through RSTP on the following URL: rtsp://192.168.1.10:554/user=admin&password=&channel=1&stream=0.sdp?real_stream--rtp-caching=100
(Firefox did not have a plugin for this on Ubuntu, but VLC plays the stream well.)
- I have tried several telnet passwords which is out in the wild root+(juantech, klv123) but neither let me in.

NMAP log shows nothing more intresting (port 8899 IMHO for onvif):

PORT STATE SERVICE VERSION
23/tcp open telnet Busybox telnetd
80/tcp open tcpwrapped
|_http-favicon: Unknown favicon MD5: EC9D1C872C50DD7DA7D826D9C85FC158
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: NETSurveillance WEB
554/tcp open rtsp?
| rtsp-methods:
|_ OPTIONS, DESCRIBE, SETUP, TEARDOWN, GET_PARAMETER, PLAY, PAUSE
8899/tcp open soap gSOAP soap 2.7


Bonus:
I have managed to find the UART on the device:



Uboot output:

U-Boot 2010.06-svn (Jan 04 2015 - 13:37:41)

DRAM: 256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17
Spi(cs1): Block:64KB Chip:8MB Name:"MX25L6406E"
envcrc 0xc96922ac
ENV_SIZE = 0xfffc
In: serial
Out: serial
Err: serial
Press Ctrl+C to stop autoboot
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # help
? - alias for 'help'
base - print or set address offset
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
fload - fload - load binary file from a filesystem image for system boot

flwrite - SPI flash sub-system
getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
lip - lip - set local ip address but not save to flash

loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
mac - mac - set mac address and save to flash

md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
sip - sip - set server ip address but not save to flash

tftp - tftp - download or upload image via network using TFTP protocol
version - print monitor version