Author Topic: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300  (Read 36819 times)

0 Members and 1 Guest are viewing this topic.

Offline ManawyrmTopic starter

  • Contributor
  • Posts: 20
  • Country: de
    • tbspace.de
Hey,

after a recent video by Marco Reps, I grabbed one of those cheap InfiRay cameras.


They boot Linux on a Hisilicon SoC, which makes them a bit of an interesting target for tinkering.

I got the SC240N-variant, without the visible-light camera (and thus without video recording capability).
This camera also doesn't support USB/UVC webcam, although the seemingly identical TC004 does.

Marco has a teardown at the end of the video, so no real need for pictures here, I think.
First observations:
Serial port on the board, J16.
Actual RS232 levels, not a UART! With negative voltages, inverted signal level and everything!
Code: [Select]
1 gnd
2 tx
3 rx
4 ??? probably also gnd
5 ???
6 ???

Bootlog is attached.
U-Boot can be aborted and has a shell (pretty fully featured).

Parts of the env:
Code: [Select]
bootargs=mem=256M console=ttyAMA0,115200 root=/dev/mmcblk0p3 rw rootfstype=ext4 rootwait blkdevparts=mmcblk0:1M(boot),4M(kernel),150M(rootfs)
bootcmd=mmc read 0x0 0x81000000 0x800 0x2000;mmc read 0x0 0x82000000 0x680 0x80;mmc read 0 0xb8300000 0x700 0x80;mmc read 0 0x83000000 0x780 0x80;decjpg 0;startvo 0 2048 42;startvl 0 0xb8100000 256 0 0 240 320;bootm 0x81000000
soc=hi3516dv300
stderr=serial

Let's dump the firmware before we break anything. We sadly can't do the same trick with uboot as optotester did for his i.MX-based imagers, so let's boot into Linux and use dd:
Code: [Select]
setenv bootargs init=/bin/sh mem=256M console=ttyAMA0,115200 root=/dev/mmcblk0p3 rw rootfstype=ext4 rootwait blkdevparts=mmcblk0:1M(boot),4M(kernel),150M(rootfs)
boot
(same bootargs, just with init=/bin/sh)
this drops us into a shell.

I copied the firmware using
Code: [Select]
dd if=/dev/mmcblk0 of=/dev/mmcblk1 bs=8Mto the SD card (this wipes the SD card of course).

So, what can we learn for now?
- Linux 4.9.37
- Hisilicon HI3516DV300
- u-boot doesn't have SD support, only eMMC (or the device tree is misconfigured, etc. mmc list only shows the eMMC)
- 8 GiB eMMC, 256 MiB DRAM
- stock kernel has r8152, usb-storage and WiFi modules (8189fs.ko SDIO).
- lighttpd (webserver!) installed
- ext4 root FS is mounted read/write in operation. There's a good chance this device will kill itself over time with this.
- hostapd, etc. is also installed, maybe there's a chance to get this thing using network or even WiFi with USB-OTG.

So far I haven't seen a way "in" yet, without using a RS232 serial.

Cracked the root-Password:
Code: [Select]
0SV1EYeeHloi.:iraytek                                     

Used the u-boot/bootargs trick again to edit the /etc/inittab with vi and added:
Code: [Select]
::respawn:/sbin/getty 115200 ttyAMA0
and was then greeted by a root shell:

 8)

« Last Edit: May 17, 2023, 08:53:12 pm by Manawyrm »
 
The following users thanked this post: Fraser, Mortymore, jwet, DH7DN, Honusnap, nsa666

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 13382
  • Country: gb
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #1 on: May 17, 2023, 09:54:22 pm »
Interesting work. Thanks  :-+

Fraser
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Offline nsa666

  • Newbie
  • Posts: 4
  • Country: de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #2 on: May 18, 2023, 01:54:27 pm »
Adding Video-Recording and UVC would be great. Can you launch another control app from sd?
 

Offline ManawyrmTopic starter

  • Contributor
  • Posts: 20
  • Country: de
    • tbspace.de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #3 on: May 18, 2023, 02:13:06 pm »
Boot process
Some notes about the boot process, it starts with /etc/init.d, running all the scripts there.
The first really interesting one is /etc/init.d/S90start:

loads  /iray_app/huamian (seems to be some kind of JPEG decoder)
loads a bunch of kernel modules
optionally configures the USB UVC webcam mode

then runs /hisi_ko/load3516dv300 (bash script), which loads a bunch more kernel modules.
on my camera (without visible light camera), the commandline
Code: [Select]
./load3516dv300 -i -senor0 gc2145 -sensor1 rtd2121w -osmem 256 -yuv0 3 is used.
Notice the typo in "-senor0" at the visible light camera. Very strange.

It will then run /iray_app/iray-hisi-camera (in the background), which is the actual QT camera application.

UVC webcam mode
I have enabled
Code: [Select]
export uvc_sd=1 on my camera, which actually leads to a UVC device being enumerated.
Unfortunately, connecting to it using OBS, VLC, etc. will result in a single frame of video and then stops.

I have played around with the YUV, MJPEG and H264 settings, buffer sizes, etc. but nothing changes the behaviour.

Code: [Select]
/iray_app/uvc_app.conf also has a bunch of configuration parameters related to the webcam mode, but again, wasn't able to get a properly working config there.

Camera settings / video recording
The camera seems to store it's settings in
Code: [Select]
/iray_ko/iray_m.ini, which has a bunch of the user-defined configuration parameters (like the palettes, image auto-save, emissivity, etc.).
Sadly, I didn't yet find the flag responsible for allowing video recording.

Kernel hacking
I've also extracted the device-tree from /proc/device-tree (just to take a look at settings like the USB dwc3 mode, which is currently set to peripheral), so no easy way to connect USB devices (like a WiFi dongle or NIC) to the USB-C port.

I chroot'ed into a ArchLinux ARM userland on an SD card:



I found the repo https://github.com/cijliu/linux, which is the same 4.9.37 kernel used on the camera, with the fitting HiSilicon board support.
After fixing some -fcommon bugs (due to my modern host toolchain), I was able to compile that kernel using https://releases.linaro.org/components/toolchain/binaries/6.3-2017.05/arm-linux-gnueabi/ .
I wasn't able to boot my custom kernel (most likely due to differences in the device tree or configs), but I was able to load modules from my kernel, which is very nice:
Code: [Select]
insmod u_ether.ko
insmod u_serial.ko
insmod usb_f_acm.ko
insmod usb_f_ecm.ko
insmod usb_f_ecm_subset.ko
insmod usb_f_mass_storage.ko
insmod usb_f_obex.ko
insmod usb_f_rndis.ko
insmod usb_f_serial.ko
insmod usb_f_uvc.ko

mount -t configfs none /sys/kernel/config/

CONFIGFS_HOME=/sys/kernel/config

GADGET_NAME="l4t"
VID="0x0955"
PID="0x7020"
SERIAL="no-serial"
MANUF="RR"
PRODUCT="RR gadget"

mkdir -p "$CONFIGFS_HOME/usb_gadget/$GADGET_NAME"
cd "$CONFIGFS_HOME/usb_gadget/$GADGET_NAME"
echo "$VID" > idVendor
echo "$PID" > idProduct

mkdir strings/0x409
echo "$SERIAL" > strings/0x409/serialnumber
echo "$MANUF" > strings/0x409/manufacturer
echo "$PRODUCT" > strings/0x409/product
CFG="c.1"
CFG_STR="ECM"
mkdir -p "configs/$CFG"

FUNC_NAME="ecm"
INSTANCE_NAME="usb0"
FUNC="functions/$FUNC_NAME.$INSTANCE_NAME"
mkdir -p "$FUNC"
mac_ecm_h="7a:68:46:2f:bd:aa"
mac_ecm_d="7a:68:46:2f:bd:ab"
echo "$mac_ecm_h" > "$FUNC/host_addr"
echo "$mac_ecm_d" > "$FUNC/dev_addr"
ln -sf "$FUNC" "configs/$CFG"
mkdir -p "configs/$CFG/strings/0x409"
echo "$CFG_STR" > "configs/$CFG/strings/0x409/configuration"
UDC_DEV=`ls /sys/class/udc`
echo "$UDC_DEV" > UDC

ip link set usb0 up
ip addr add 172.16.0.2/24 dev usb0
ip route add 0.0.0.0/0 via 172.16.0.1
echo "nameserver 8.8.8.8" > /etc/resolv.conf

and then we expose a new usb0 network interface over to the computer and we have internet connectivity on the camera (provided that the attached computer does NAT/routing).

I was able to start the (already installed) lighttpd webserver, there's a start script for it in /iray_sh/http.sh, but it also tries to setup WiFi and stuff.
I ran
Code: [Select]
lighttpd -f   /lighthttp/config/lighttpd.conf:

(this exposes the partition with all the images on the SD card, pretty useful)

Modding the device tree and either adding an SDIO card with a WiFi chipset or switching the USB dwc3 controller mode to host would probably allow us to have network connectivity permanently, which would be very nice.

Framebuffer

Someone mentioned DOOM, so I've had a quick look, /dev/fb0 seems to be magically overlayed/mixed with the hardware video signal.
It contains RGBA8888 data and the alpha channel is actually used. I dumped /dev/fb0 into a file and opened it using GIMP:

So the fb0 just contains the overlay/GUI, no video data for us to extract sadly.

Modding without the serial port
I was actively looking for some backdoor / other method of getting into the device without soldering a RS232 serial to it.
Sadly, so far I didn't find anything super simple in any of the scripts.
One of the binaries (ELF/Linux/armv7) contains references to an update .zip file and has some paths related to that.
My binary reverse engineering skills aren't sufficient to try and understand how to give it a useful "update", I think, but there might be a way in.

« Last Edit: May 18, 2023, 02:14:53 pm by Manawyrm »
 
The following users thanked this post: Mortymore, zrq, jwet, nsa666

Offline ManawyrmTopic starter

  • Contributor
  • Posts: 20
  • Country: de
    • tbspace.de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #4 on: May 18, 2023, 02:19:07 pm »
Can you launch another control app from sd?

You can do pretty much anything, yes. Not sure how/where you'd find a compatible control app to run on this device, though.
Getting a firmware dump from a SC240M (with video recording, etc.) would probably be pretty interesting, but they're out of stock unfortunately.
 

Offline nsa666

  • Newbie
  • Posts: 4
  • Country: de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #5 on: May 18, 2023, 03:56:02 pm »
 

Offline IanJ

  • Supporter
  • ****
  • Posts: 1749
  • Country: scotland
  • Full time EE & Youtuber/Creator
    • IanJohnston.com
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #6 on: May 18, 2023, 04:11:22 pm »
I got the SC240N-variant, without the visible-light camera (and thus without video recording capability).
This camera also doesn't support USB/UVC webcam, although the seemingly identical TC004 does.

From the spec on the web:
Vevor SC240N = 240x180
Topdon TC004 = 256x192

Would be interesting to see a direct comparison if somebody has both.

Ian.
Ian Johnston - Original designer of the PDVS2mini || Author of WinGPIB
Website: www.ianjohnston.com
YouTube: www.youtube.com/user/IanScottJohnston, Odysee: https://odysee.com/@IanScottJohnston, Twitter(X): https://twitter.com/IanSJohnston, Github: https://github.com/Ian-Johnston?tab=repositories
 

Offline ManawyrmTopic starter

  • Contributor
  • Posts: 20
  • Country: de
    • tbspace.de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #7 on: May 18, 2023, 07:22:29 pm »
Would be interesting to see a direct comparison if somebody has both.
Ack.
But interestingly enough, everything on the SC240N's firmware also references 256x192:
Code: [Select]
[settings]
Camera=105
Picture_h=192
Picture_w=256

Not sure if 240x180 is the usable area of the chip or something like that (and Vevor being sold in the EU don't want to break advertising laws), but they really seem to have identical sensors & specs.
 

Offline ManawyrmTopic starter

  • Contributor
  • Posts: 20
  • Country: de
    • tbspace.de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #8 on: May 18, 2023, 08:33:36 pm »
Oh...

OK, well, that's a working UVC webcam ;D

Turns out: Their implementation seems to behave buggy against a Linux 6.3 host.
With Windows (both OBS and the native Windows 11 camera app) it works immediately.

macOS just kernel panic's the camera alltogether, which is very fun  :o

Seeing this, I've enabled UVC tracing on my Linux machine:
Code: [Select]
echo 0xffff > /sys/module/uvcvideo/parameters/trace
which results in the following log output (in YUV mode):

Code: [Select]
[26524.076642] usb 1-1: Dropping payload (out of sync)
[26524.076644] usb 1-1: Dropping payload (out of sync)
[26524.076646] usb 1-1: Dropping payload (out of sync)
[26524.076648] usb 1-1: Dropping payload (out of sync)
[26524.076650] usb 1-1: Dropping payload (out of sync)
[26524.076653] usb 1-1: Dropping payload (out of sync)
[26524.080584] usb 1-1: Dropping payload (out of sync)
[26524.080589] usb 1-1: Dropping payload (out of sync)
[26524.080591] usb 1-1: frame 2 stats: 0/451/451 packets, 0/0/0 pts (!early !initial), 0/0 scr, last pts/stc/sof 0/0/0
[26524.083365] usb 1-1: uvc_v4l2_poll
[26524.114524] usb 1-1: Device requested 3072 B/frame bandwidth
[26524.114528] usb 1-1: Selecting alternate setting 1 (3072 B/frame bandwidth)
[26524.467629] usb 1-1: Allocated 5 URB buffers of 32x3072 bytes each
[26524.467680] usb 1-1: uvc_v4l2_poll
[26524.471630] usb 1-1: Frame complete (EOF found)
[26524.471632] usb 1-1: frame 1 stats: 0/29/29 packets, 0/0/0 pts (!early !initial), 0/0 scr, last pts/stc/sof 0/0/0
[26524.499631] usb 1-1: Frame complete (overflow)
[26524.499637] usb 1-1: Dropping payload (out of sync)
[26524.499639] usb 1-1: Dropping payload (out of sync)
[26524.499643] usb 1-1: Dropping payload (out of sync)
[26524.499645] usb 1-1: Dropping payload (out of sync)
[26524.499647] usb 1-1: Dropping payload (out of sync)
[26524.499649] usb 1-1: Dropping payload (out of sync)
[26524.499652] usb 1-1: Dropping payload (out of sync)
[26524.499654] usb 1-1: Dropping payload (out of sync)
[26524.499656] usb 1-1: Dropping payload (out of sync)
[26524.499659] usb 1-1: Dropping payload (out of sync)
[26524.499661] usb 1-1: Dropping payload (out of sync)
[26524.499663] usb 1-1: Dropping payload (out of sync)
[26524.499665] usb 1-1: Dropping payload (out of sync)
[26524.499667] usb 1-1: Dropping payload (out of sync)
[26524.499669] usb 1-1: Dropping payload (out of sync)
[26524.499672] usb 1-1: Dropping payload (out of sync)
[26524.499674] usb 1-1: Dropping payload (out of sync)
[26524.499676] usb 1-1: Dropping payload (out of sync)
[26524.499679] usb 1-1: Dropping payload (out of sync)
[26524.499681] usb 1-1: Dropping payload (out of sync)
[26524.499683] usb 1-1: Dropping payload (out of sync)
[26524.499685] usb 1-1: Dropping payload (out of sync)
[26524.499687] usb 1-1: Dropping payload (out of sync)
[26524.499689] usb 1-1: Dropping payload (out of sync)
[26524.503629] usb 1-1: Dropping payload (out of sync)
[26524.503633] usb 1-1: Dropping payload (out of sync)
[26524.503636] usb 1-1: Dropping payload (out of sync)
[26524.503639] usb 1-1: Dropping payload (out of sync)
[26524.503642] usb 1-1: Dropping payload (out of sync)
[26524.503644] usb 1-1: Dropping payload (out of sync)
[26524.503646] usb 1-1: Dropping payload (out of sync)
[26524.503649] usb 1-1: Dropping payload (out of sync)
[26524.503651] usb 1-1: Dropping payload (out of sync)
[26524.503653] usb 1-1: Dropping payload (out of sync)
[26524.503655] usb 1-1: Dropping payload (out of sync)
[26524.503657] usb 1-1: Dropping payload (out of sync)
[26524.503660] usb 1-1: Dropping payload (out of sync)
[26524.503662] usb 1-1: Dropping payload (out of sync)
[26524.503664] usb 1-1: Dropping payload (out of sync)
[26524.503666] usb 1-1: Dropping payload (out of sync)
[26524.503668] usb 1-1: Dropping payload (out of sync)
[26524.503670] usb 1-1: Dropping payload (out of sync)
[26524.503672] usb 1-1: Dropping payload (out of sync)
[26524.503674] usb 1-1: Dropping payload (out of sync)
[26524.503677] usb 1-1: Dropping payload (out of sync)
[26524.503679] usb 1-1: Dropping payload (out of sync)
[26524.503681] usb 1-1: Dropping payload (out of sync)
[26524.503683] usb 1-1: Dropping payload (out of sync)
[26524.503685] usb 1-1: Dropping payload (out of sync)
[26524.503687] usb 1-1: Dropping payload (out of sync)
[26524.503690] usb 1-1: Dropping payload (out of sync)
[26524.503692] usb 1-1: Dropping payload (out of sync)
[26524.503694] usb 1-1: Dropping payload (out of sync)
[26524.503696] usb 1-1: Dropping payload (out of sync)
[26524.503698] usb 1-1: Dropping payload (out of sync)
[26524.503700] usb 1-1: Dropping payload (out of sync)
[26524.507631] usb 1-1: Dropping payload (out of sync)
[26524.507636] usb 1-1: Dropping payload (out of sync)
[26524.507638] usb 1-1: Dropping payload (out of sync)
[26524.507642] usb 1-1: Dropping payload (out of sync)
[26524.507644] usb 1-1: Dropping payload (out of sync)
[26524.507646] usb 1-1: Dropping payload (out of sync)
[26524.507649] usb 1-1: Dropping payload (out of sync)
[26524.507651] usb 1-1: Dropping payload (out of sync)
[26524.507653] usb 1-1: Dropping payload (out of sync)
[26524.507656] usb 1-1: Dropping payload (out of sync)
[26524.507658] usb 1-1: Dropping payload (out of sync)
[26524.507660] usb 1-1: Dropping payload (out of sync)
[26524.507663] usb 1-1: Dropping payload (out of sync)
[26524.507665] usb 1-1: Dropping payload (out of sync)
[26524.507667] usb 1-1: Dropping payload (out of sync)
[26524.507669] usb 1-1: Dropping payload (out of sync)
[26524.507672] usb 1-1: Dropping payload (out of sync)
[26524.507674] usb 1-1: Dropping payload (out of sync)
[26524.507676] usb 1-1: Dropping payload (out of sync)
[26524.507679] usb 1-1: Dropping payload (out of sync)
[26524.507681] usb 1-1: Dropping payload (out of sync)
[26524.507683] usb 1-1: Dropping payload (out of sync)
[26524.507685] usb 1-1: Dropping payload (out of sync)
[26524.507688] usb 1-1: Dropping payload (out of sync)
[26524.507690] usb 1-1: Dropping payload (out of sync)
[26524.507692] usb 1-1: Dropping payload (out of sync)
[26524.507694] usb 1-1: Dropping payload (out of sync)
[26524.507696] usb 1-1: Dropping payload (out of sync)
[26524.507699] usb 1-1: Dropping payload (out of sync)
[26524.507701] usb 1-1: Dropping payload (out of sync)
[26524.507703] usb 1-1: Dropping payload (out of sync)
[26524.507705] usb 1-1: Dropping payload (out of sync)
[26524.511632] usb 1-1: Dropping payload (out of sync)
[26524.511636] usb 1-1: Dropping payload (out of sync)
[26524.511638] usb 1-1: Dropping payload (out of sync)
[26524.511642] usb 1-1: Dropping payload (out of sync)
[26524.511644] usb 1-1: Dropping payload (out of sync)
[26524.511646] usb 1-1: Dropping payload (out of sync)
[26524.511649] usb 1-1: Dropping payload (out of sync)
[26524.511651] usb 1-1: Dropping payload (out of sync)
[26524.511653] usb 1-1: Dropping payload (out of sync)
[26524.511656] usb 1-1: Dropping payload (out of sync)
[26524.511658] usb 1-1: Dropping payload (out of sync)
[26524.511660] usb 1-1: Dropping payload (out of sync)
[26524.511662] usb 1-1: Dropping payload (out of sync)
[26524.511664] usb 1-1: Dropping payload (out of sync)
[26524.511667] usb 1-1: Dropping payload (out of sync)
[26524.511669] usb 1-1: Dropping payload (out of sync)
[26524.511671] usb 1-1: Dropping payload (out of sync)
[26524.511674] usb 1-1: Dropping payload (out of sync)
[26524.511676] usb 1-1: Dropping payload (out of sync)
[26524.511678] usb 1-1: Dropping payload (out of sync)
[26524.511680] usb 1-1: Dropping payload (out of sync)
[26524.511682] usb 1-1: Dropping payload (out of sync)
[26524.511684] usb 1-1: Dropping payload (out of sync)
[26524.511686] usb 1-1: Dropping payload (out of sync)
[26524.511689] usb 1-1: Dropping payload (out of sync)
[26524.511691] usb 1-1: Dropping payload (out of sync)
[26524.511693] usb 1-1: Dropping payload (out of sync)
[26524.511695] usb 1-1: Dropping payload (out of sync)
[26524.511697] usb 1-1: Dropping payload (out of sync)
[26524.511700] usb 1-1: Dropping payload (out of sync)
[26524.511702] usb 1-1: Dropping payload (out of sync)
[26524.511704] usb 1-1: Dropping payload (out of sync)
[26524.515630] usb 1-1: Dropping payload (out of sync)
[26524.515635] usb 1-1: Dropping payload (out of sync)
[26524.515637] usb 1-1: Dropping payload (out of sync)
[26524.515640] usb 1-1: Dropping payload (out of sync)
[26524.515643] usb 1-1: Dropping payload (out of sync)
[26524.515645] usb 1-1: Dropping payload (out of sync)
[26524.515647] usb 1-1: Dropping payload (out of sync)
[26524.515649] usb 1-1: Dropping payload (out of sync)
[26524.515651] usb 1-1: Dropping payload (out of sync)
[26524.515653] usb 1-1: Dropping payload (out of sync)
[26524.515656] usb 1-1: Dropping payload (out of sync)
[26524.515658] usb 1-1: Dropping payload (out of sync)
[26524.515660] usb 1-1: Dropping payload (out of sync)
[26524.515662] usb 1-1: Dropping payload (out of sync)
[26524.515664] usb 1-1: Dropping payload (out of sync)
[26524.515666] usb 1-1: Dropping payload (out of sync)
[26524.515668] usb 1-1: Dropping payload (out of sync)
[26524.515671] usb 1-1: Dropping payload (out of sync)
[26524.515673] usb 1-1: Dropping payload (out of sync)
[26524.515675] usb 1-1: Dropping payload (out of sync)
[26524.515677] usb 1-1: Dropping payload (out of sync)
[26524.515679] usb 1-1: Dropping payload (out of sync)
[26524.515681] usb 1-1: Dropping payload (out of sync)
[26524.515683] usb 1-1: Dropping payload (out of sync)
[26524.515685] usb 1-1: Dropping payload (out of sync)
[26524.515688] usb 1-1: Dropping payload (out of sync)
[26524.515690] usb 1-1: Dropping payload (out of sync)
[26524.515692] usb 1-1: Dropping payload (out of sync)
[26524.515694] usb 1-1: Dropping payload (out of sync)
[26524.515696] usb 1-1: Dropping payload (out of sync)
[26524.515698] usb 1-1: Dropping payload (out of sync)
[26524.515701] usb 1-1: Dropping payload (out of sync)
[26524.519633] usb 1-1: Dropping payload (out of sync)
[26524.519637] usb 1-1: Dropping payload (out of sync)
[26524.519640] usb 1-1: Dropping payload (out of sync)
[26524.519644] usb 1-1: Dropping payload (out of sync)
[26524.519646] usb 1-1: Dropping payload (out of sync)
[26524.519648] usb 1-1: Dropping payload (out of sync)
[26524.519650] usb 1-1: Dropping payload (out of sync)
[26524.519652] usb 1-1: Dropping payload (out of sync)
[26524.519654] usb 1-1: Dropping payload (out of sync)
[26524.519657] usb 1-1: Dropping payload (out of sync)
[26524.519659] usb 1-1: Dropping payload (out of sync)
[26524.519661] usb 1-1: Dropping payload (out of sync)
[26524.519663] usb 1-1: Dropping payload (out of sync)
[26524.519666] usb 1-1: Dropping payload (out of sync)
[26524.519668] usb 1-1: Dropping payload (out of sync)
[26524.519670] usb 1-1: Dropping payload (out of sync)
[26524.519672] usb 1-1: Dropping payload (out of sync)
[26524.519674] usb 1-1: Dropping payload (out of sync)
[26524.519676] usb 1-1: Dropping payload (out of sync)
[26524.519678] usb 1-1: Dropping payload (out of sync)
[26524.519680] usb 1-1: Dropping payload (out of sync)
[26524.519682] usb 1-1: Dropping payload (out of sync)
[26524.519685] usb 1-1: Dropping payload (out of sync)
[26524.519687] usb 1-1: Dropping payload (out of sync)
[26524.519689] usb 1-1: Dropping payload (out of sync)
[26524.519691] usb 1-1: Dropping payload (out of sync)
[26524.519693] usb 1-1: Dropping payload (out of sync)
[26524.519695] usb 1-1: Dropping payload (out of sync)
[26524.519697] usb 1-1: Dropping payload (out of sync)
[26524.519699] usb 1-1: Dropping payload (out of sync)
[26524.519701] usb 1-1: Dropping payload (out of sync)
[26524.519703] usb 1-1: Dropping payload (out of sync)
[26524.523634] usb 1-1: Dropping payload (out of sync)
[26524.523638] usb 1-1: Dropping payload (out of sync)
[26524.523640] usb 1-1: Dropping payload (out of sync)
[26524.523644] usb 1-1: Dropping payload (out of sync)
[26524.523646] usb 1-1: Dropping payload (out of sync)
[26524.523648] usb 1-1: Dropping payload (out of sync)
[26524.523651] usb 1-1: Dropping payload (out of sync)
[26524.523653] usb 1-1: Dropping payload (out of sync)
[26524.523655] usb 1-1: Dropping payload (out of sync)
[26524.523658] usb 1-1: Dropping payload (out of sync)
[26524.523660] usb 1-1: Dropping payload (out of sync)
[26524.523662] usb 1-1: Dropping payload (out of sync)
[26524.523665] usb 1-1: Dropping payload (out of sync)
[26524.523667] usb 1-1: Dropping payload (out of sync)
[26524.523669] usb 1-1: Dropping payload (out of sync)
[26524.523671] usb 1-1: Dropping payload (out of sync)
[26524.523673] usb 1-1: Dropping payload (out of sync)
[26524.523675] usb 1-1: Dropping payload (out of sync)
[26524.523678] usb 1-1: Dropping payload (out of sync)
[26524.523680] usb 1-1: Dropping payload (out of sync)
[26524.523682] usb 1-1: Dropping payload (out of sync)
[26524.523684] usb 1-1: Dropping payload (out of sync)
[26524.523687] usb 1-1: Dropping payload (out of sync)
[26524.523689] usb 1-1: Dropping payload (out of sync)
[26524.523691] usb 1-1: Dropping payload (out of sync)
[26524.523693] usb 1-1: Dropping payload (out of sync)
[26524.523695] usb 1-1: Dropping payload (out of sync)
[26524.523698] usb 1-1: Dropping payload (out of sync)
[26524.523700] usb 1-1: Dropping payload (out of sync)
[26524.523702] usb 1-1: Dropping payload (out of sync)
[26524.523704] usb 1-1: Dropping payload (out of sync)
[26524.523706] usb 1-1: Dropping payload (out of sync)
[26524.527632] usb 1-1: Dropping payload (out of sync)
[26524.527636] usb 1-1: Dropping payload (out of sync)
[26524.527638] usb 1-1: Dropping payload (out of sync)
[26524.527642] usb 1-1: Dropping payload (out of sync)
[26524.527645] usb 1-1: Dropping payload (out of sync)
[26524.527647] usb 1-1: Dropping payload (out of sync)
[26524.527649] usb 1-1: Dropping payload (out of sync)
[26524.527652] usb 1-1: Dropping payload (out of sync)
[26524.527654] usb 1-1: Dropping payload (out of sync)
[26524.527657] usb 1-1: Dropping payload (out of sync)
[26524.527659] usb 1-1: Dropping payload (out of sync)
[26524.527661] usb 1-1: Dropping payload (out of sync)
[26524.527663] usb 1-1: Dropping payload (out of sync)
[26524.527665] usb 1-1: Dropping payload (out of sync)
[26524.527668] usb 1-1: Dropping payload (out of sync)
[26524.527670] usb 1-1: Dropping payload (out of sync)
[26524.527672] usb 1-1: Dropping payload (out of sync)
[26524.527674] usb 1-1: Dropping payload (out of sync)
[26524.527676] usb 1-1: Dropping payload (out of sync)
[26524.527678] usb 1-1: Dropping payload (out of sync)
[26524.527681] usb 1-1: Dropping payload (out of sync)
[26524.527683] usb 1-1: Dropping payload (out of sync)
[26524.527685] usb 1-1: Dropping payload (out of sync)
[26524.527687] usb 1-1: Dropping payload (out of sync)
[26524.527689] usb 1-1: Dropping payload (out of sync)
[26524.527691] usb 1-1: Dropping payload (out of sync)
[26524.527694] usb 1-1: Dropping payload (out of sync)
[26524.527696] usb 1-1: Dropping payload (out of sync)
[26524.527698] usb 1-1: Dropping payload (out of sync)
[26524.527700] usb 1-1: Dropping payload (out of sync)
[26524.527702] usb 1-1: Dropping payload (out of sync)
[26524.527704] usb 1-1: Dropping payload (out of sync)
[26524.531634] usb 1-1: Dropping payload (out of sync)
[26524.531639] usb 1-1: Dropping payload (out of sync)
[26524.531641] usb 1-1: frame 2 stats: 0/451/451 packets, 0/0/0 pts (!early !initial), 0/0 scr, last pts/stc/sof 0/0/0
[26524.534416] usb 1-1: uvc_v4l2_poll
[26524.609581] usb 1-1: Device requested 3072 B/frame bandwidth
[26524.609584] usb 1-1: Selecting alternate setting 1 (3072 B/frame bandwidth)
[26524.906684] usb 1-1: Allocated 5 URB buffers of 32x3072 bytes each
[26524.916780] usb 1-1: uvc_v4l2_release
[26525.541452] usb 6-3.1: uvc_v4l2_open
[26525.541465] usb 6-3.1: uvc_v4l2_release
[26525.541479] usb 1-1: uvc_v4l2_open


So there is data being sent to the Linux box, but the kernel just doesn't like it. I'm neither a USB nor UVC expert, so I'll have to pass on further debugging, but I'll ping some friends. :-//
« Last Edit: May 18, 2023, 08:39:15 pm by Manawyrm »
 
The following users thanked this post: snik, bap2703, gamerpaddy, zrq, DH7DN

Offline RuneHansen

  • Contributor
  • Posts: 40
  • Country: dk
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #9 on: May 19, 2023, 03:12:40 pm »
I should be able to add these cameras to IRCAM Thermal Viewer :P
 

Offline tsys

  • Newbie
  • Posts: 2
  • Country: de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #10 on: May 20, 2023, 02:58:56 pm »
Hey all,

while hacking on this camera together with Manawyrm I've designed a new 3D-printable top USB/micro SD port panel to improve continous hackability while the camera is fully assembled:


In addition to all ports on the stock panel it adds a cutout for a 3 pin .1 inch female header. This allows permanently exposing the internal serial port and thus bootloader and root shell on the device exterior.

The printable 3D model is available on Thingiverse and GitHub.
« Last Edit: May 20, 2023, 03:03:17 pm by tsys »
 
The following users thanked this post: zrq, jwet, Honusnap

Offline jwet

  • Frequent Contributor
  • **
  • Posts: 534
  • Country: us
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #11 on: May 20, 2023, 04:28:47 pm »
I saw the same Marco Reps video and grabbed one of these last week- love it- hoping it will be useful for electronic troubleshooting but its a great toy either way.  I spent an extra hundred and got the Topdon TC005 which has the visible camera and video functtion but looks identical.  I'm not quite ready to bust it open but if someone can tell me how to get the code out on the card or the USB cable, I'd be happy to grab an image and post it for the use of science.  Is this possible?
 

Offline ManawyrmTopic starter

  • Contributor
  • Posts: 20
  • Country: de
    • tbspace.de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #12 on: May 20, 2023, 04:34:24 pm »
Is this possible?
Hm, well, yes, I think it might be possible, but I don't know how exactly the update mechanism works yet :(
For now, I think it still requires an RS232 connection to the pins.

If you'd be willing to do that, I'd be happy to assist.

If someone else here is familiar with ELF/Linux32 armv7 binaries/reverse engineering, I'd also be happy to post the binary with the updater code, maybe someone else can understand it.

Quote
I'm not quite ready to bust it open
Marco shows it pretty well in the video, the only 2 really sketchy parts are the clips in the middle of the handle (we've just snapped them off on our camera now on purpose :D) and the plastic screen cover (which you'll need to bend/lift without breaking it).
Generally, it's a pretty nice experience to open, don't worry.
« Last Edit: May 20, 2023, 04:40:15 pm by Manawyrm »
 
The following users thanked this post: jwet

Offline nsa666

  • Newbie
  • Posts: 4
  • Country: de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #13 on: May 20, 2023, 06:41:58 pm »


If someone else here is familiar with ELF/Linux32 armv7 binaries/reverse engineering, I'd also be happy to post the binary with the updater code, maybe someone else can understand it.


ghidra can't decompile it?
 

Offline ManawyrmTopic starter

  • Contributor
  • Posts: 20
  • Country: de
    • tbspace.de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #14 on: May 20, 2023, 07:33:07 pm »
ghidra can't decompile it?

Yes, it can, but that's not a one-stop-magical shop to readable C code :)
There's a bit more experience needed, I think :)
 

Offline jwet

  • Frequent Contributor
  • **
  • Posts: 534
  • Country: us
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #15 on: May 20, 2023, 08:11:46 pm »
If someone really wants the firmware, I may tackle it.  Its only a week old...

Thanks for digging in.  It answered a lot of questions for me- especially the slow boot.
 

Offline ManawyrmTopic starter

  • Contributor
  • Posts: 20
  • Country: de
    • tbspace.de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #16 on: May 20, 2023, 08:26:23 pm »
Its only a week old...

Mine didn't even last 4 hours before I took a look inside (and that was because I had to finish the workday  :-DD)

If you'd feel comfortable with the soldering required to connect to J16 (those small pins) or can manage to find a fitting connector (I'm not sure what type of connector it is, sorry), I would appreciate that very much...
I'd be really curious about the differences between your firmware and mine...

Another benefit would be having the backup for yourself. The camera never shuts itself down properly. Every shutdown is a hard power-off without unmounting the ext4 filesystem on the internal flash. I'm not too confident that this will actually last long, so chances are that you might actually need the backup to restore the filesystem at some point in the future after it bricked itself. (ext4's journalling is pretty good these days, it might not actually break that quickly. We'll see.)

tsys is currently working on a really cool magnetic swappable lens attachment for it, which is looking _super_ promising.
So you might want to get familiar with taking it apart anyway ;)
 

Offline nsa666

  • Newbie
  • Posts: 4
  • Country: de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #17 on: May 20, 2023, 09:25:01 pm »


If you'd feel comfortable with the soldering required to connect to J16 (those small pins) or can manage to find a fitting connector (I'm not sure what type of connector it is, sorry), I would appreciate that very much...



It looks like  M40-1100600 (1,00mm pitch) could fit. But i dont know for sure. :-//

Edit: or M30-1100600 if it is 1,25mm pitch.

« Last Edit: May 20, 2023, 09:28:24 pm by nsa666 »
 

Offline ManawyrmTopic starter

  • Contributor
  • Posts: 20
  • Country: de
    • tbspace.de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #18 on: May 29, 2023, 05:35:33 am »
This just had to be done:


 ;D

It was surprisingly hard to do. Both video output and control input gave a bunch of trouble.
The video output/framebuffer was not actually RGB or something like that, but rather YVU420SP, aka semi-planar YUV (with U/V flipped) and sub-divided colors.
I just used /dev/mem to get a memory mapping for the physical address space and wrote directly to it:
https://github.com/Manawyrm/fbDOOM/blob/3c011e8c87bea3f29a52947410e9e4d1be036239/fbdoom/i_video_fbdev.c#L166

Input was also unnecessarily cruel, the buttons are all just GPIOs, but some of them don't have pull-ups and are somehow magically pulled up from the main application.
I've spent a couple hours banging my head against a wall and trying to get all of the GPIOs into the same state, but it still wouldn't enable the required pull-ups on all of the buttons.  |O
In the end, just not loading the kernel modules and just starting the main application briefly (which then segfaults due to missing dependencies) will setup the buttons correctly. Evil hack, but who's counting... After that, it's just a matter of reading the GPIO port states (yes, this is both ugly and slow, but we have 2x 1GHz, I don't care):
https://github.com/Manawyrm/fbDOOM/blob/3c011e8c87bea3f29a52947410e9e4d1be036239/fbdoom/i_input_tty.c#L38
 
The following users thanked this post: Qw3rtzuiop, snik, Mortymore, eklein, DH7DN, nsa666

Offline tsys

  • Newbie
  • Posts: 2
  • Country: de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #19 on: May 29, 2023, 02:10:46 pm »
Using the Vevor SC240N for microelectronics we found that the rather large minimum focus distance makes it difficult to differentiate between individual components.
I've designed a magnetic lens attachment that allows adding cheap ZnSe lenses to the camera. With the lens attachment minimum focus distance goes down from ~20cm to below 5cm.

Working with small SMD components the reduction in minimum focus distance makes all the differece:

Without lens attachment


With lens attachment


With the lens attached small heat sources (in this case 0402 LEDs) are easy to spot and clearly defined.

To make removal and swapping between different lenses as easy as possible the attachment is held in place magnetically:


From the factory there is nothing sufficiently magnetic close to the front of the camera to allow the magnetic lens attachment to stick. A couple of small magnets need to be glued into the device front shell:


The lens mount is fully 3D-printable in two pieces. The pieces are then connected using M1 self-tappers. Design files can be found on Thingiverse and GitHub.
« Last Edit: May 29, 2023, 02:25:35 pm by tsys »
 
The following users thanked this post: Mortymore, DH7DN, nsa666

Offline DH7DN

  • Regular Contributor
  • *
  • Posts: 129
  • Country: de
    • DH7DN Blog
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #20 on: May 29, 2023, 02:19:31 pm »
Amazing hack, thanks for sharing  ;D
vy 73 de DH7DN, My Blog
 

Offline ragequit

  • Newbie
  • Posts: 2
  • Country: de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #21 on: June 02, 2023, 10:26:32 am »
Hello there,

I got one a week ago, but it is currently being borrowed by friends. If someone could sent me the firmware binaries, especially the update routine, I would be willing to take a look.

Best regards
 

Offline bebopdk

  • Contributor
  • Posts: 20
  • Country: dk
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #22 on: June 02, 2023, 01:21:54 pm »
On the C200, this is in the apps.sh file, there seem to be something related to the streaming/uvc_gadget which is remarked out:

#!/bin/sh
#app
#cd /opt/qt4.8.5/demos/embedded/fluidlauncher
#./fluidlauncher -qws &
#usb otg
cd /lib/modules/3.14.38-6UL_ga\+ge4944a5/kernel/fs/configfs/
insmod configfs.ko
cd /lib/modules/3.14.38-6UL_ga+ge4944a5/kernel/drivers/usb/gadget
insmod libcomposite.ko
insmod u_serial.ko
insmod usb_f_acm.ko
insmod usb_f_mass_storage.ko
#insmod g_mass_storage.ko file=/dev/mmcblk0p1
insmod g_acm_ms.ko file=/dev/mmcblk0p1 removable=1 stall=1
#insmod g_webcam.ko streaming_maxpacket=1024

#gc0308 camera
cd /lib/modules/3.14.38-6UL_ga+ge4944a5/kernel/drivers/media/platform/mxc/subdev/
insmod mx6s_capture.ko
insmod gc0308_camera.ko

sleep 2
#app
cd /root
./IRay_C200_Thermal -qws -nomouse &
#./led_ctrl_test &

# ftp server
adduser nobody
vsftpd &

sleep 5
#./uvc-gadget &
./led_ctrl_test &
#apps

I have not played around with my C200 yet since I am a bit reluctant to take it apart while it is still under warranty, but would love to have the web cam working :horse:
 

Offline actuallyjaseg

  • Contributor
  • Posts: 21
  • Country: de
    • jaseg.de
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #23 on: June 02, 2023, 02:39:36 pm »
Y'all might be interested to hear that I have an older Infiray-branded C200, which *did* work as a webcam on Windows out of the box. If I find the time, I will pull an image of its flash later this weekend.
 

Offline bebopdk

  • Contributor
  • Posts: 20
  • Country: dk
Re: Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300
« Reply #24 on: June 03, 2023, 11:38:32 am »
That firmware would be highly interesting to see, my C200(which when ordered should have been a C210), does not have that feature from the factory :-//
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf