For some reason i cant downgrade i have copy the tf_recovery.img.bak to sdcard and rename it to tf_recovery.img after powering the camera up it just still doing a normal boot and nothing have change

Hi.

I'm creating new topic, where we can discuss creating hack for Xiaomi Mijia 1080P Smart IP Camera (not Fang, not 360)

Hi! I had installed patch. When I put in config CLOUD_DISABLED=0, CLOUD_STREAMING_DISABLED=0 and RTSP_ENABLED=1 I can't connect with RTSP.
Can streaming work from MiHome and RTSP simultaneously?

hello guys and many thanks for your work. I just tried to flash your hack (with the downgrade) and the situation of my cam is as follow:

• ssh and rtsp are working

• the camera is not recognized by the mi platform (the android app tells me that is offline)

• performing a reset I can still hear the chinese voice

For now it's enough for me, but I want to achieve the best result, if possible :-)

I can access the camera via ssh but at login I have this three error/warning messages:

[523] Nov 14 21:17:40 lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
[523] Nov 14 21:17:40 lastlog_openseek: /var/log/lastlog is not a file or directory!
[523] Nov 14 21:17:40 wtmp_write: problem writing /var/log/wtmp: No such file or directory

Rtsp is also working and with default settings (1080p) on local wlan I can see a smooth video with a delay of 4/5 secs. Is this normal/acceptable ?

I am wondering into the system to better understand how to configure it. Is there a logfile ? Can I modify the .ini configuration file directly from the camera ? What happens if I issue a "reboot" command ?

If possible I would like to contribute to your work..

Here is my latest log file

Configuration:
  CLOUD_DISABLED=0
  CLOUD_STREAMING_DISABLED=0
  RTSP_ENABLED=0
  CONFIG_LINE=-b4098 -f20 -w1920 -h1080 -m1
  SSH_ROOT_PASS=qwerty123456
  DISABLED_OTA=0
  HTTP_ENABLED=0
  SAMBA_ENABLED=0
os-version
NAME=Buildroot
VERSION=2016.02-git-00292-gca900c9-dirty
ID=buildroot
VERSION_ID=2016.02-git
PRETTY_NAME="Buildroot 2016.02-git"
XIAOMI_VERSION=3.3.6_0099
XIAOMI_BUILDNO=312  
 Staring SSH Server
 Getting root access 
Changing password for root
New password: 
Retype password: 
Password for root changed by root

...Starting dropbear...

...Changing Language to English...
[205] Jan 01 08:00:09 Running in background
...Adding Protecction to Change of Keys...

Script Ends. Ok
[881] Jan 07 20:40:27 Child connection from 192.168.1.116:57844
[881] Jan 07 20:40:33 Bad password attempt for 'root' from 192.168.1.116:57844
[881] Jan 07 20:40:39 Password auth succeeded for 'root' from 192.168.1.116:57844
[205] Jan 07 12:46:06 Early exit: Terminated by signal
[881] Jan 07 12:46:06 Exit (root): Terminated by signal
[881] Jan 07 12:46:07 Exit (root): login_init_entry: Cannot find user "root"
Aiee, segfault! You should probably report this as a bug to the developer

Hi,

Does this hack works with the Xiaomi Mijia 360?

Thanks

There is a new firmware update, 160. There are people who say that from that version they can not downgrade the 099 to apply the hack, just in case it's better not to try to update the camera directly.

The hack works with the new firmware 160 but to update it, it's convenient to first downgrade to 099 (renaming the file tf_recovery.img.bak to tf_recovery.img and restarting for the downgrade) and then from MiHome update to 160. Just in case the option I have previously deactivated RTSP

Hello

Thanks for releasing such hack. I have one small question. Is this hack ready for production usage? I need only two things.

• RTSP
• DHCP with reconnection ability

Thanks!

Hi,

UPDATE: the "new recovery image" was not for original mijia 1080p ... some other camera.

the new recovery image does not contain the "prikey.pem" any longer.

old image: http://www19.zippyshare.com/v/BmjL3z7c/file.html
new image: https://uploadfiles.io/t1e1t

can be easily extracted both with binwalk.

just to confirm, HTTP_ENABLED=1 and SAMBA_ENABLED=1 means thoes services are enabled right? i tried to enable both of these services but i cant SMB to them nor can i connect to them using http.

RTSP is working just fine.

`VERSION_ID=2016.02-git
PRETTY_NAME="Buildroot 2016.02-git"
XIAOMI_VERSION=3.4.2_0159
XIAOMI_BUILDNO=458
Forcing Mode 4
Staring SSH Server
Getting root access
Changing password for root
New password:
Retype password:
Password for root changed by root

...Starting dropbear...
[208] Dec 31 20:00:09 Running in background

...Changing Language to English...
...Adding Protection to Change of Keys...
...Enabling RTSP...
Web Server (8080)
Samba setup...
tdbsam_open: Converting version 0.0 database to version 4.0.
tdbsam_convert_backup: updated /tmp/sd/tools/tmp/samba/passdb.tdb file.
account_policy_get: tdb_fetch_uint32 failed for type 1 (min password length), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 2 (password history), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 3 (user must logon to change password), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 4 (maximum password age), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 5 (minimum password age), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 6 (lockout duration), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 7 (reset count minutes), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 8 (bad lockout attempt), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 9 (disconnect time), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 10 (refuse machine password change), returning 0
Failed to load upcase.dat, will use lame ASCII-only case sensitivity rules
Failed to load lowcase.dat, will use lame ASCII-only case sensitivity rules
Added user root.

Script Ends. Ok
[911] May 03 21:11:22 Child connection from 192.168.0.117:54591
[911] May 03 21:11:27 Password auth succeeded for 'root' from 192.168.0.117:54591
`

Hi guys!! Good hack, i use it to my synology surveillance station. I have two xiaomi cameras, but i cant configure both with de same 554 RTSP port. How can i change the default port???

Thanks!!

in reference to open items mentioned in #1

1. choose a suitable rtsp-server from the known implementations
   We have to figure out how the data is streamed right now. Would be a waste of ressources to do a double-capture.
   Also interesting would be dss and v4l2rtspserver ?

2. cross-compile chosen rtsp-server

How should we split this work?
I would look up the current streaming today in the evening.

I'm talking about this app: http://www.lavrsen.dk/foswiki/bin/view/Motion/WebHome
If I can get this running on the camera, I don't need anything else :)

As I initially saw in fs aside from disabling services those have to be removed from restartd.conf file.
If no-one take care of it soon, I'll in free time.

This is annoying. There is obviosly are more complex thing to downgrade and make the rtsp work than just "remove .bak" and put 0.7 or whatever obn your camera. There's gotta be a better tutorial than that? Is it depended on wich server? Why is it so hard to think that not everyone have the full on technological skill to figure this out so im sure theres at least 10 people here that have this working, how about one of you dedicate 4 minutes and just write down the correct prosedyre? Im here to help myself, but im stuck so how can i help others? We need to KICK the information around. Also post the tutorial on gearbest etc wich I am willing to do, but i need to get further than vagely questions if i even have the mijia wich of course i have and or "did you enable cloud?" I mean SHOULD I enable cloud? What does it do? Why do i need to diable rtsp? How do i upgrade after having the red/orange flash wich shows the tools are working? And why after that i canot acces my camera in mihome? Is it because im on US server? IS it because its on 5GHZ wifi? is it because my sdcard are to small? Do i need to downgrade, then install tools, then take out sdcard reset and repair on us server? then upgrade and so put back in the sdcard? I mean theres gotta be ONE person here that knows all these questions?

So far im at least downgraded but after sdcard with tools i cannot access the camera in Mi home.

I had issues upgrading and keeping the tool on the camera, so after many trial-errors this is the method that worked for me.

Preparations:
Download https://github.com/Filipowicz251/mijia-1080P-hacks/releases/download/0.3/release0.3_338.zip and copy tf_recovery.img.bak to empty FAT32 SD card. Rename the file to tf_recovery.img.
You will be flashing 3.3.6_0099 FW which really does work properly only with china-mainland server, I strongly suggest switching to this server for the time being.
Flash the firmware and use reset button to go through MiHome setup process.

3.3.6_0099 and Secure WiFi issue:
If during setup of the camera (after you scanned the QR code) there is a timeout (usually at around 80%-89% of progress), you are being victim of a bug in Mi's fw. Its pretty easy to solve:

• create WiFi access point on your phone or router without any authentication
• connect your phone to that network and reset-setup camera again using this network
• go through the firmware update process still connected to this open WiFi.
• reset the device to use your normal WiFi wile on newer firmware.
• repeat the flash tf_recovery.img of 0099 firmware again.

...this way your WiFi settings are saved in nvram and will stay there until next time you use the reset button, these setting prevail through FW upgrades and hack.

Installing the tool:
Download zip from https://github.com/Filipowicz251/mijia-1080P-hacks/releases/latest/ and extract all to SD card.
On SD card edit the midgard.ini file and set 0 for these:

	CLOUD_DISABLED=0
	CLOUD_STREAMING_DISABLED=0
	RTSP_ENABLED=0
	DISABLED_OTA=0

On the SD card make a copy of the ft folder, lets call it ft2.

Power on the camera and be patient, this is not i7. You should see orange light, first stable, later slowly flashing. At some point you should hear the click on night-vision mode when the device reboots. After that pay attention to quick flashes of blue-orange light (5 times). This means the tool/hack gets installed.

Try to connect via SSH, again be patient, if it doesnt work give it a minute. Once you get SSH access means the tool worked and now we just need to update it.

Keeping the hack:
On ssh list the content of the SD card to make sure we can safely reboot the camera .
From ls -la /tmp/sd/ you should see the ft folder still there. if the folder is gone lets restore it from the copy we made earlier

cp -R /tmp/sd/ft2 /tmp/sd/ft

Wait one more minute and reboot the camera.
After reboot (be patient) try the SSH first. If you have access then everything is good.

Upgrading:
MiHome app should see the camera and should show notification that there is a new FW update.
Dont update yet, we want to make sure ssh access/tool is still accesible after reboot. Reboot and connect ssh again.

I went through this process few times and each time the Mi behaves a bit different, but be patient.
When you start the upgrade process via MiHome app the camera will start flashing orange light. There will be prograss % on the MiHome app but even if it fails or times out on the app, let the camera finish its process. If the light is blinking do not touch it. Let it be.
This will take forever but will eventually complete the flash and reboot (you will hear the nightvision click again).

Now you can SSH to the camera again and change the settings in midgard.ini to fit your needs.

Good luck!

This is a work in progress..... Gathering information

Camera Memory chipset (SPI NOR Flash): GD25Q128c (data-sheet on link)
http://www.gigadevice.com/product/detail/5/260.html?locale=en_US

Assuming direct connection to the chip: USB SPI Programmer?
https://en.wikipedia.org/wiki/Bus_Pirate ???
http://www.ebay.co.uk/itm/NANO-BIOS-Programmer-for-PC-M-B-BIOS-repairing-/280388472031 (lists this memory chip, version B)
http://www.ebay.co.uk/itm/CH341A-24-25-Series-EEPROM-Flash-BIOS-USB-Programmer-SOIC8-Clip-On-Board-UK-/162557028178?epid=1390692406&hash=item25d9276752:g:vG8AAOSwCQZZCi3S
A possible memory replacement (for playing):

• http://www.ebay.co.uk/itm/W25Q-Winbond-Serial-Flash-Memory-Module-SPI-W25Q128B-BIOS-25Q64BVSIG-EEPROM-/181873964697?var=&hash=item2a58887699:m:myY3DImwzx8P87WoVXAYyiA
• http://www.ebay.co.uk/itm/1-St-Speicher-NOR-Flash-128Mbit-Quad-I-O-SPI-104MHz-2-7-3-6V-SOP8-/112464838446?hash=item1a2f6d3f2e:g:61sAAOSw7GRZL61E

JTAG not evaluated yet.... PIN? Board Support?

Hi,

Would it be possible to add audio support to the RTSP stream? Was that ever explored?

Hey Folks,

For whatever reason, the device I received was stuck at yellow/amber light when powered on. I opened up the hardware and decided to inspect whats going on underneath. I am not getting the boot logs (like in https://pastebin.com/raw/nt4GUAeF) and it now seems to me that the flash could be corrupt. Hence the processor is not able to loade the SPL which usually loads the u-boot and further on.

Does any of you know:
a) Where I can get the factory firmware
b) How to load the same into the flash?

There should be a way(because they would have done that during assembly) unless the SoC was preflashed by the supplier (which rarely happens) Any thoughts folks? I know this is very much different than the userspace hacks some of you do through the mmc card.

I want to test your firmware however, can one revert the mijia back to stock firmware? if so any steps

Users with Firmware .139 without the toolset already working, you will have to downgrade to a previous version

How do you proceed to downgrade firmware on this camera ? I couldn't find any relevant info to do this

Goal: provide optional ssh-access (by dropbear) so that UART-access is not required any more
in reference to #1

Support for cross-compiling required.
thanks.

i have issue with non working RTSP i think.
here what i doing -
i copied files and dirs from dir that inside zip release. also i copied there img file.

turned on device it was busy with yellow led blinking about minute. then it just shut off (at least led stop blinking). i waited for 1 minute more. then reconnected. its all like same except led was blinking with yellow and blue.
well after it i connected with phone like usual. all seems working -
(at least no Chinese talking, but no English either, and led flashing different), except what i need most - RTSP and HTTP stream!
im edit only midgard.ini file -
RTSP_ENABLED=1##
and
HTTP_ENABLED=1##
still nothing on camera ip 8080 port
and VLC cant see nothing either
in port scanner all ports closed
anything i forgot?
thanks

Hi there,
any chance to have this working on CHUANGMI 720P? This is using same chipset as mijia 720 I think: GM8135.

Thanks

Here is the midgard.ini file contents:

## Total Disconnection with Xioami Servers	(0,1)
CLOUD_DISABLED=1
## Streaming with Xioami Servers (0,1). Can be used with CLOUD_ENABLED to be able to manage the camera but not streaming outside your network.
CLOUD_STREAMING_DISABLED=1
## Local Streaming. (0,1)
RTSP_ENABLED=1
## Local Streaming config -bBITRATE -fFRAMERATE -wWIDTH -hHEIGHT -mBITRATEMODE
#### BITRATEMODE
#	 1  Constant Bitrate  
#        2  Variable Bitrate  
#        3  Enhanced Constant Bitrate  
#        4  Enhanced Variable Bitrate
CONFIG_LINE=-b4098 -f20 -w1920 -h1080 -m1
## Root password for SSH Server (at least length 8)
SSH_ROOT_PASS=xxxxxx
## DISABLED OTA  (0/1)
DISABLED_OTA=0
## lighttpd on port 8080
HTTP_ENABLED=1
## samba server
SAMBA_ENABLED=1

I can still use the MiHome app to view my camera
RTSP is working but artifacts appear when objects are moving.
Artifacts appear on local NAS server recordings and on MiHome app stream, this is 100% not a connectivity issue.
Another IP camera (Xiaomi Yi Ants) is working perfectly and recording with no artifacts to the same server over the same network.

Hi,

I have two issues with recording on microsd card with this camera.

1. RTSP
   I didn't test 0.6 version, but 0.4 version.
   Video is very slow and stuck on live preview, picture is very bad. Also problem is it is bad with RTSP and if I view on my MI Home app..
   If wifi signal is worse, recorded video on sd card is worse too.

Maybe it's not a case in this 0.6 version, but I had to say this because of second problem.

2. Stuck on video
   I downgrade to version .139 (after I tried RTSP 4.0) and use standard MI Home firmware update.
   I notice my video live and SD recorded have one issue. Video stuck like every 5 second for a second.
   I think this was not problem on this camera before downgrading to .139 version.
   So in this case, video just stuck a little every 5 second (but quality is good), not like my 1) RTSP problem above.

Hello,

This may be a newbie question but... can the Xiaomi Mijia 1080P Smart IP Camera be configured/firmware updated/hacked to work as Network Camera? The goal would be using it as a network camera (eg. http://192.168.1.5:80) that opensource software can have access to.

As of now with Xiaomi Mijia propietary latest firmware 3.3.10_0154 the camera can only be accessed via propietary Mi Home Android app.

Thank you in advance!

No phone assistance would be needed.
Simply check if there's change in wpa_supplicant.conf file on SD card (it's not yet there) if so just use this config and don't parse nvram things

I'll make it myself soon if no-one else pushes it.

like rtsp://CAMERA_IP/live/ch01_0 for 720p stream?
sometimes 1080p is too big, and currently basic_rtsp can't support 720p param

Hi, as we all know since the latest upgrade the whole hack is broken, so I am wondering if it possible to manually generate a new tf_recovery.img file somehow from the available upgrade files? Or is there a recent recovery file that is not 0.99? I recently received my second unit, but unluckily it has version .140 so I have no other choice but downgrade to 0.99.

This can be done by running two commands on ledctl tool (which is used by hack-script already), I think I would add it as an simple switch on PHP, it's here anyway so worth using.

As before, if no-one will take care of it I'll add it myself soon.

Hi,

Can anyone with UART access to get me a copy of the new firmware [3.3.9_0139]? It looks like they have changed something and my valhalla.sh scripts are not been loaded...

Thanks.

Tried several times and I'm always failing to update to latest version after the hack.

Always ending up on the recovery image, then installing the hack. Have access through SSH. Then I'm trying to update the fw via MiHome app and always end up with latest version but the hack is gone.

last info before update starts:

Oct 25 05:12:09 192.168.2.140 Oct 25 05:12:09 miio_avstreamer: [DEBUG] otd_recv_handler_block(), sockfd: 16, msg: {"method":"miIO.get_ota_progress","params":[],"id":3952098,"from":"4"}, length: 70 bytes
Oct 25 05:12:09 192.168.2.140 Oct 25 05:12:09 miio_avstreamer: [DEBUG] msg_dispatcher, msg: {"method":"miIO.get_ota_progress","params":[],"id":3952098,"from":"4"}, strlen: 70, len: 70
Oct 25 05:12:09 192.168.2.140 Oct 25 05:12:09 miio_avstreamer: [DEBUG] otd_recv_handler_block(), sockfd: 16, msg: {"method":"miIO.get_ota_progress","params":[],"id":3121220,"from":"4"}, length: 70 bytes
Oct 25 05:12:09 192.168.2.140 Oct 25 05:12:09 miio_avstreamer: [DEBUG] msg_dispatcher, msg: {"method":"miIO.get_ota_progress","params":[],"id":3121220,"from":"4"}, strlen: 70, len: 70
Oct 25 05:12:10 192.168.2.140 Oct 25 05:12:10 miio_avstreamer: [Motion], Region: 31, md_cnt:[32] 
Oct 25 05:12:10 192.168.2.140 Oct 25 05:12:10 miio_avstreamer: [DEBUG] SID[0], Handle CMD: [2FF] 
Oct 25 05:12:10 192.168.2.140 Oct 25 05:12:10 miio_avstreamer: [INFO] IOTYPE_USER_IPCAM_STOP, ch:0, avIndex:0
Oct 25 05:12:10 192.168.2.140 Oct 25 05:12:10 miio_avstreamer: [DEBUG] unregedit_client_from_video OK
Oct 25 05:12:10 192.168.2.140 Oct 25 05:12:10 miio_avstreamer: [DEBUG] SID[0], Handle CMD: [301] 
Oct 25 05:12:10 192.168.2.140 Oct 25 05:12:10 miio_avstreamer: [INFO] IOTYPE_USER_IPCAM_AUDIOSTOP, ch:0, avIndex:0
Oct 25 05:12:10 192.168.2.140 Oct 25 05:12:10 miio_avstreamer: [DEBUG] unregedit_client_from_audio OK
Oct 25 05:12:12 192.168.2.140 Oct 25 05:12:12 miio_avstreamer: [Motion], Region: 15, md_cnt:[20] 
Oct 25 05:12:12 192.168.2.140 Oct 25 05:12:12 miio_avstreamer: [Motion], Region: 15, md_cnt:[4] 
Oct 25 05:12:12 192.168.2.140 Oct 25 05:12:12 miio_avstreamer: [DEBUG] otd_recv_handler_block(), sockfd: 16, msg: {"method":"miIO.get_ota_progress","params":[],"id":3073289,"from":"4"}, length: 70 bytes
Oct 25 05:12:12 192.168.2.140 Oct 25 05:12:12 miio_avstreamer: [DEBUG] msg_dispatcher, msg: {"method":"miIO.get_ota_progress","params":[],"id":3073289,"from":"4"}, strlen: 70, len: 70
Oct 25 05:22:48 192.168.2.140 Oct 25 05:22:48 miio_bt: [DEBUG] [miio_client_sock_callback]
Oct 25 05:22:48 192.168.2.140 Oct 25 05:22:48 miio_bt: [DEBUG] rpc cmd len:70, msg: {"method":"miIO.get_ota_progress","params":[],"id":3440021,"from":"4"} 
Oct 25 05:22:48 192.168.2.140 Oct 25 05:22:48 miio_bt: [DEBUG] json verify ok.
Oct 25 05:22:59 192.168.2.140 Oct 25 05:22:59 miio_bt: [DEBUG] [miio_client_sock_callback]
Oct 25 05:22:59 192.168.2.140 Oct 25 05:22:59 miio_bt: [DEBUG] rpc cmd len:70, msg: {"method":"miIO.get_ota_progress","params":[],"id":3798094,"from":"4"} 
Oct 25 05:22:59 192.168.2.140 Oct 25 05:22:59 miio_bt: [DEBUG] json verify ok.
Oct 25 05:23:02 192.168.2.140 Oct 25 05:23:02 miio_bt: [DEBUG] [miio_client_sock_callback]
Oct 25 05:23:02 192.168.2.140 Oct 25 05:23:02 miio_bt: [DEBUG] rpc cmd len:70, msg: {"method":"miIO.get_ota_progress","params":[],"id":3798094,"from":"4"} 
Oct 25 05:23:02 192.168.2.140 Oct 25 05:23:02 miio_bt: [DEBUG] json verify ok.
Oct 25 05:23:05 192.168.2.140 Oct 25 05:23:05 miio_bt: [DEBUG] [miio_client_sock_callback]
Oct 25 05:23:05 192.168.2.140 Oct 25 05:23:05 miio_bt: [DEBUG] rpc cmd len:380, msg: {"method":"miIO.ota","params":{"app_url":"https://cdn.fds-ssl.api.xiaomi.com/miio_fw/5529fa82e3eb8659f17723922accb56b_upd_mijia.camera.v1.bin?GalaxyAccessKeyId=5721718224520&Expires=1516681385000&Signature=0f1XJVXo34Cw8FAfhDCtkBZMIw8=&uniqRequestId=17437973","file_md5":"5529fa82e3eb8659f17723922accb56b","install":"1","proc":"dnld install","mode":"normal"},"id":70544,"from":"4"} 
Oct 25 05:23:05 192.168.2.140 Oct 25 05:23:05 miio_bt: [DEBUG] json verify ok.
Oct 25 05:23:07 192.168.2.140 Oct 25 05:23:07 miio_ota: OTA: before we start, free out more memory...

then the application is downlaoded so camera is basically frozen, after few minutes even though the MiHome app does not indicate it, the upgrade is successful and device reboots:

Oct 25 05:23:07 192.168.2.140 Oct 25 05:23:07 miio_ota: OTA: before we start, free out more memory...
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:20 miio_ota: OTA: copy log to TF.
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: Valhalla Restoring Key
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: Calling Inject
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: ----------------------------------------------------
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota:  Inject /tmp/inject.sh exist
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: Injector
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: ----------------------------------------------------
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota:  /proc/mtd
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: ----------------------------------------------------
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: dev:    size   erasesize  name
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: mtd0: 00050000 00010000 "UBOOT"
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: mtd1: 002a0000 00010000 "KERNEL"
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: mtd2: 00a00000 00010000 "ROOTFS"
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: mtd3: 002e0000 00010000 "DATA"
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: mtd4: 00010000 00010000 "CONFIG"
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: mtd5: 00010000 00010000 "FACTORY"
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: mtd6: 01000000 00010000 "ALL"
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota:  mount
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: ----------------------------------------------------
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: rootfs on / type rootfs (rw)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: /dev/root on / type squashfs (ro,relatime)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: devtmpfs on /dev type devtmpfs (rw,relatime,size=62668k,nr_inodes=15667,mode=755)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: proc on /proc type proc (rw,relatime)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: tmpfs on /dev/shm type tmpfs (rw,relatime,mode=777)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: tmpfs on /tmp type tmpfs (rw,relatime)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: tmpfs on /run type tmpfs (rw,nosuid,nodev,relatime,mode=755)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: tmpfs on /var type tmpfs (rw,nosuid,nodev,relatime,mode=755)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: tmpfs on /mnt/media type tmpfs (rw,nosuid,nodev,relatime,mode=755)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: sysfs on /sys type sysfs (rw,relatime)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: /dev/mtdblock3 on /mnt/data type jffs2 (rw,relatime)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: /dev/mmcblk0p1 on /mnt/media/mmcblk0p1 type vfat (rw,relatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: /dev/mmcblk0p1 on /tmp/sd type vfat (rw,relatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: tmpfs on /etc type tmpfs (rw,relatime)
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota:  lsof /mnt/data
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: ----------------------------------------------------
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	/dev/console
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	/dev/console
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	/dev/console
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	/var/log/miio_client.log
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[949]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[950]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[951]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	anon_inode:[timerfd]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	anon_inode:[timerfd]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	anon_inode:[timerfd]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[1710]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[1101]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[1752]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	pipe:[1754]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	pipe:[1754]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[1755]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 516	/bin/busybox	/mnt/data/ot_wifi_tool/miio_client_helper_nomqtt.sh
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 530	/mnt/data/miio_ota/miio_ota	/dev/null
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 530	/mnt/data/miio_ota/miio_ota	pipe:[973]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 530	/mnt/data/miio_ota/miio_ota	/dev/console
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 530	/mnt/data/miio_ota/miio_ota	socket:[1100]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 530	/mnt/data/miio_ota/miio_ota	anon_inode:[timerfd]
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 973	/mnt/data/ot_wifi_tool/miio_recv_line	/dev/null
Oct 25 05:30:21 192.168.2.140 Oct 25 05:30:21 miio_ota: 973	/mnt/data/ot_wifi_tool/miio_recv_line	pipe:[1750]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 973	/mnt/data/ot_wifi_tool/miio_recv_line	/dev/console
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 973	/mnt/data/ot_wifi_tool/miio_recv_line	socket:[1751]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: lsof /tmp/ld-uClibc.so.0
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	/dev/console
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	/dev/console
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	/dev/console
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	/var/log/miio_client.log
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[949]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[950]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[951]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	anon_inode:[timerfd]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	anon_inode:[timerfd]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	anon_inode:[timerfd]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[1710]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 515	/mnt/data/ot_wifi_tool/miio_client	socket:[1755]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 516	/bin/busybox	/mnt/data/ot_wifi_tool/miio_client_helper_nomqtt.sh
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 530	/mnt/data/miio_ota/miio_ota	/dev/null
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 530	/mnt/data/miio_ota/miio_ota	pipe:[973]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 530	/mnt/data/miio_ota/miio_ota	/dev/console
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 530	/mnt/data/miio_ota/miio_ota	socket:[1100]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 530	/mnt/data/miio_ota/miio_ota	anon_inode:[timerfd]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 973	/mnt/data/ot_wifi_tool/miio_recv_line	/dev/null
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 973	/mnt/data/ot_wifi_tool/miio_recv_line	pipe:[1750]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 973	/mnt/data/ot_wifi_tool/miio_recv_line	/dev/console
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:21 miio_ota: 973	/mnt/data/ot_wifi_tool/miio_recv_line	socket:[1751]
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: Lsof only pid
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 515
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 530
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 530
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 530
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 530
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 530
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 973
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 973
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 973
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: 973
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: #KILL#
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: lsof
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: ----------------------------------------------------
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: #@@#
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota:  umount /dev/mtdblock3
Oct 25 05:30:22 192.168.2.140 Oct 25 05:30:22 miio_ota: ----------------------------------------------------
Oct 25 05:30:22 192.168.2.140 Oct 25 04:30:22 miio_ota:  mount /tmp/Key
Oct 25 05:30:22 192.168.2.140 Oct 25 04:30:22 miio_ota: ----------------------------------------------------
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: after mount...
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: mount
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: ----------------------------------------------------
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: rootfs on / type rootfs (rw)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: /dev/root on / type squashfs (ro,relatime)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: devtmpfs on /dev type devtmpfs (rw,relatime,size=62668k,nr_inodes=15667,mode=755)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: proc on /proc type proc (rw,relatime)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: tmpfs on /dev/shm type tmpfs (rw,relatime,mode=777)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: tmpfs on /tmp type tmpfs (rw,relatime)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: tmpfs on /run type tmpfs (rw,nosuid,nodev,relatime,mode=755)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: tmpfs on /var type tmpfs (rw,nosuid,nodev,relatime,mode=755)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: tmpfs on /mnt/media type tmpfs (rw,nosuid,nodev,relatime,mode=755)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: sysfs on /sys type sysfs (rw,relatime)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: /dev/mmcblk0p1 on /mnt/media/mmcblk0p1 type vfat (rw,relatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: /dev/mmcblk0p1 on /tmp/sd type vfat (rw,relatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: tmpfs on /etc type tmpfs (rw,relatime)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: /dev/mtdblock3 on /tmp/Key type jffs2 (rw,relatime)
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: Listing FT
Oct 25 05:30:23 192.168.2.140 Oct 25 04:30:23 miio_ota: ----------------------------------------------------
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: total 4294967296
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: drwxr-xr-x    2 root     root        707626 Sep 13 12:01 .
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: drwxr-xr-x   13 root     root        707626 Jan  1  1970 ..
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: -rwxr-xr-x    1 root     root     1168231812138 Sep 13 12:01 prikey.pem
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: -----BEGIN PUBLIC KEY-----
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqptSAi12ENcvDnSmnEsXeq9Zp
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: qq8uc3PwIcq6vuP7djavTHlhXPEgTOp8y965nQSbqt/R8IcxfCLFxnNGmFz5xNpP
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: 4jfccmNzHp9OqTD7xnhDtLZhAhnEWCA2nIvIdwaW6XxKmVhRJ8y56Mr8QEaIj4hk
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: snANL3CJnlW6JcUdmwIDAQAB
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: -----END PUBLIC KEY-----
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: cp /tmp/sd/tools/prikey.pem /tmp/Key/ft/prikey.pem 
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:23 miio_ota: ----------------------------------------------------
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: Before copying...done
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: -----BEGIN RSA PRIVATE KEY-----
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: MIICXAIBAAKBgQC2Og1+zeBxdNQsZ4Vd5lrWKkavrRcxord6KlxCAKpOPnYOvVc6
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: PVGASJMTZLT+ZTgNciCcfVu0WHFrisn0zRAxLimoNK/VELdQCE+T40ewouWBI/gJ
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: Uy56OXcqgKzVZPPJFCpGHl1bT+EYM83nBIX0SOdI23pysuchCpfil3PkDwIDAQAB
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: AoGAU2Eeua20C9XcG3FGqd90Ith3PXzixvhgIYruadjqFCEqXbYvClvyRdNvUIlc
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: 86YWzrgwycnmQw/Q3ddEbznBNSnIbmKa0kMPndZqKwQV5SSmai7mfIzavzXxmpYN
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: zyxmKZOX6qAiUKW6z2MkPL9yGoOaU8DgLds98F2dnFU1cJkCQQDhR9+kqMwJs0YJ
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: ikWbhRiwxnZHAL4sIbuYyejG/mmhMC0X7RNL7orSuUOLme7Jb8sSLMqNWfJEOYt4
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: IQEDhE/DAkEAzxM+3lX+05+2c5doMlML9ZuvPbOxiMVKA7DdBoCx1btPwG7UufUs
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: DoUw0JG9yfsOZsa5UejRIRqSRagqd/ZBxQJAFlADE5DwXImYBzvdtxCQqHmPn2qw
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: aziQFwrwdj0egyt9W+BMR/oBX+ufiAUgBG2BJHSxPxzIhP9aE/TY39tL9wJALMaR
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: kovvxRzE2+vCSRdx/5LBassfOV7HqVKmCFDtozSUgxyz/N3Jv/4G1yKccj9KFukj
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: i1WXWtwfAtbhD/18rQJBAMleTwLdcBypljiWT2a6w779GT+7Hh1Wf9YKi0FeX/HO
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: UREzEf+R3IvncRA1Jhu/ATcZ6ZZ7vBVcoHO0Y9Aqd4U=
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: -----END RSA PRIVATE KEY-----
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 init: starting pid 1092, tty '': '/etc/init.d/rcK'
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota:  Inject Success
Oct 25 05:30:24 192.168.2.140 Oct 25 04:30:24 miio_ota: OTA: about to reboot......
Oct 25 05:30:25 192.168.2.140 Oct 25 04:30:24 init: starting pid 1108, tty '': '/sbin/swapoff -a'
Oct 25 05:30:25 192.168.2.140 Oct 25 04:30:24 init: starting pid 1109, tty '': '/bin/umount -a -r'
Oct 25 05:30:25 192.168.2.140 Oct 25 04:30:25 init: The system is going down NOW!

from this point on there is no access to the SSH.
Scenario is always the same.

any ideas?

Is it only me or RSTP's image over 0,4 have some glitch ?

I have latest hack version with default settings (with HTTP_ENABLED=0) and this image quality:

Same lines/glitches with daylight conditions.
Mi Home has no live view and stuck on Preparing to connect...1%. I've tried on recovery FW version and with update to latest 159. On 159 RTSP doesn't work at all.

LOG:

Configuration:
  CLOUD_DISABLED=0
  CLOUD_STREAMING_DISABLED=0
  RTSP_ENABLED=1
  CONFIG_LINE=-b4096 -f20 -w1920 -h1080 -m4
  SSH_ROOT_PASS=qwerty123456
  DISABLED_OTA=0
  HTTP_ENABLED=0
  SAMBA_ENABLED=0
os-version
NAME=Buildroot
VERSION=2016.02-git-00292-gca900c9-dirty
ID=buildroot
VERSION_ID=2016.02-git
PRETTY_NAME="Buildroot 2016.02-git"
XIAOMI_VERSION=3.3.6_0099
XIAOMI_BUILDNO=312  
Forcing Mode 4
 Staring SSH Server
 Getting root access 
Changing password for root
New password: 
Retype password: 
Password for root changed by root

...Starting dropbear...
[205] Jan 01 08:00:09 Running in background

...Changing Language to English...
...Adding Protection to Change of Keys...
...Init GM Driver for 0099 version...
[581] Jan 01 08:00:28 Child connection from 192.168.1.7:63175
[581] Jul 15 11:16:00 Password auth succeeded for 'root' from 192.168.1.7:63175````

I recently installed the latest version of the hack successfully but once the cam is restarted to be placed in its final location and its subsequent reboot, the change seems to have disappeared.

starting from the latest official release:

After downloading all the files from 0.8.6 the camera starts blinking the orange light.
Waiting a couple of minutes and the the led goed to off.
I'm unable to use the RTSP feature supported by this branch.
is there any complete how-to document starting from scratch, how-to use RTSP on this device ?

Folks, wrt issue (#15) I finally managed to solder a Tx pad very close to the processor pin(because my provided Tx TP came out during soldering) I got the following console message. It looks like my kernel could be corrupt. I had attempted to boot the image from SD card before and not sure if it flashed a wrong image. Any thoughts how to get recovery image and boot it from SDCard?

SPI NOR ID code:0xc8 0x40 0x18
SPI jump setting is 3 bytes mode
Boot image offset: 0x10000. size: 0x50000. Booting Image .....

U-Boot 2013.01 (May 31 2017 - 18:07:51)

I2C: ready
DRAM: 64 MiB
ROM CODE has enable I cache
SPI mode
MMC: FTSDC021: 0
SF: Got idcodes
00000000: c8 40 18 c8 .@..
SF: Detected GD25Q128c with page size 64 KiB, total 16 MiB
flash is 3byte mode
*** Warning - bad CRC, using default environment

In: serial
Out: serial
Err: serial

ID: 8136150
AC: 200 HC: 200 P1: 860 P2: 600 P3: 540
C6: 860 DR:1146
J: 286 H1: 286

Net: GMAC set RMII mode
reset PHY
eth0
Warning: eth0 MAC addresses don't match:
Address in SROM is 65:6d:3d:31:32:38
Address in environment is 00:42:70:00:30:22

Card did not respond to voltage select!
** Bad device mmc 0 **
there's no sdcard, ignore dfu
Hit any key to stop autoboot: 0
SF: Got idcodes
00000000: c8 40 18 c8 .@..
SF: Detected GD25Q128c with page size 64 KiB, total 16 MiB
flash is 3byte mode
Wrong Image Format for bootm command
ERROR: can't get kernel image!

Hi @willthrom,
is this the correct camera https://www.gearbest.com/ip-cameras/pp_615275.html

Thanks
Alessandro

It happens pretty much constantly when objects are moving, impossible to ignore.
Maybe some kind of tuning is required for the RTSP lib?

Hi,
it's possible to add a web server returning a still image from the camera ?
Something like http://IP_OF_CAMERA/image.jpg

I would like to use this camera in homeassistant automation software. With a still image I can make an automation where I could send the image via Telegram, for example, in case motion is triggered.

Thanks
Alessandro

Hi,

it looks with FW 159 the stream is not working with SD card inserted with 0.8.7 version. Even local streaming says camera not detected. When removing SD all works again.

tail miio_client.log -n100

[19700101 01:00:24] [INFO] OT agent listen fd: 5
[19700101 01:00:24] [INFO] BT conn listen fd: 6
[19700101 01:00:24] [INFO] Timer fd: 7, interval: 5000 ms
[19700101 01:00:24] [INFO] Sync timer fd: 8, interval: 0 ms
[19700101 01:00:24] [INFO] ACK timer fd: 9, timeout: 0 ms
[19700101 01:00:24] [INFO] pollfds[0]: 4
[19700101 01:00:24] [INFO] pollfds[1]: 5
[19700101 01:00:24] [INFO] pollfds[2]: 6
[19700101 01:00:24] [INFO] pollfds[3]: 7
[19700101 01:00:24] [INFO] pollfds[4]: 8
[19700101 01:00:24] [INFO] pollfds[5]: 9
[19700101 01:00:24] [INFO] OT agent listen accept sockfd: 10
[19700101 01:00:24] [INFO] STATE: (0)
[19700101 01:00:24] [WARNING] OT agent internalfd closed: 10
[19700101 01:00:24] [INFO] OT agent listen accept sockfd: 10
[19700101 01:00:25] [INFO] OT agent listen accept sockfd: 11
[19700101 01:00:25] [INFO] STATE: (0) -> STATE_DIDKEY_DONE
[19700101 01:00:25] [INFO] OT agent listen accept sockfd: 11
[19700101 01:00:25] [INFO] STATE: (3)
[19700101 01:00:25] [WARNING] OT agent internalfd closed: 11
[19700101 01:00:26] [INFO] recv local cmd
[19700101 01:00:26] [INFO] local.query_status
[19700101 01:00:28] [INFO] OT agent listen accept sockfd: 11
[19700101 01:00:28] [INFO] OT agent listen accept sockfd: 11
[19700101 01:00:28] [INFO] STATE: (3) -> STATE_TOKEN_DONE
[19700101 01:00:28] [INFO] OT agent listen accept sockfd: 11
[19700101 01:00:28] [INFO] STATE: (4)
[19700101 01:00:28] [WARNING] OT agent internalfd closed: 11
[19700101 01:00:28] [INFO] OT agent listen accept sockfd: 11
[19700101 01:00:28] [INFO] STATE: (4) -> STATE_WIFI_STA_MODE
[19700101 01:00:28] [INFO] getaddrinfo (ot.io.mi.com:8053): Name or service not known
[19700101 01:00:29] [INFO] getaddrinfo (ott.io.mi.com:80): Name or service not known
[19700101 01:00:29] [WARNING] no server detected.
[19700101 01:00:29] [WARNING] internet connection failed
[19700101 01:00:29] [WARNING] POLLNVAL | POLLHUP | POLLERR fd: pollfds[7]: 11, revents: 0x00000019
[19700101 01:00:29] [INFO] OT agent listen accept sockfd: 11
[19700101 01:00:29] [INFO] STATE: (6)
[19700101 01:00:29] [INFO] getaddrinfo (ot.io.mi.com:8053): Name or service not known
[19700101 01:00:29] [INFO] getaddrinfo (ott.io.mi.com:80): Name or service not known
[19700101 01:00:29] [WARNING] no server detected.
[19700101 01:00:29] [WARNING] internet connection failed
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 42.62.48.114, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 120.92.96.246, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 120.92.96.247, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 120.92.96.248, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 120.92.96.249, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 124.251.57.10, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 124.251.57.11, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 124.251.57.12, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 42.62.48.225, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 42.62.48.2, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 120.92.96.241, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 120.92.96.242, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 42.62.48.115, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 120.92.96.244, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 42.62.48.223, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 42.62.48.224, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 42.62.48.112, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 42.62.48.111, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 120.92.96.245, port: 8053
[19700101 01:00:34] [INFO] Add UDP server into list, host ip: 42.62.48.113, port: 8053
[19700101 01:00:34] [INFO] Add TCP server into list, host ip: 42.62.94.185, port: 80
[19700101 01:00:35] [INFO] Add TCP server into list, host ip: 58.83.160.36, port: 80
[19700101 01:00:35] [INFO] Add TCP server into list, host ip: 58.83.160.14, port: 80
[19700101 01:00:35] [INFO] Add TCP server into list, host ip: 120.92.96.88, port: 80
[19700101 01:00:36] [INFO] Add TCP server into list, host ip: 120.92.96.87, port: 80
[19700101 01:00:36] [INFO] Add TCP server into list, host ip: 124.243.204.138, port: 80
[19700101 01:00:36] [INFO] Connect to server ip: 42.62.48.2, port: 8053
[19700101 01:00:36] [INFO] OT cloud sockfd: 12
[19700101 01:00:36] [INFO] STATE: (6) -> STATE_CLOUD_TRYING
[19700101 01:00:36] [INFO] report_synctime
[19700101 01:00:36] [INFO] internet connection succeed
[19700101 01:00:36] [INFO] BT conn listen accept sockfd: 13
[19700101 01:00:36] [INFO] sync time with server, server: 1526369092, local(mono): 36, diff: 1526369056
[19700101 01:00:36] [WARNING] OT agent internalfd closed: 11
[19700101 01:00:38] [INFO] OT agent listen accept sockfd: 11
[19700101 01:00:38] [INFO] cmd_internal_get_info_callback
[19700101 01:00:38] [INFO] fw_ver=3.4.2_0159
[19700101 01:00:38] [INFO] report_otcinfo_flag: 0
[19700101 01:00:38] [INFO] Current server type 0, ip: 42.62.48.2, port: 8053
[19700101 01:00:38] [INFO] OT agent listen accept sockfd: 11
[19700101 01:00:38] [INFO] STATE: (7)
[19700101 01:00:38] [INFO] S, id:59279131, len:412
[19700101 01:00:38] [INFO] _otc.info reported (flag: 59279131) and got response.
[19700101 01:00:38] [INFO] STATE: (7) -> STATE_CLOUD_CONNECTED
[19700101 01:00:38] [INFO] report_ota_state_idle
[19700101 01:00:39] [INFO] S, id:532500358, len:31
[19700101 01:00:39] [INFO] report_ota_state_idle_callback: {"id":532500358,"result":"ok"}
[19700101 01:00:48] [INFO] recv local cmd
[19700101 01:00:48] [INFO] local.query_time
[20180515 09:28:26] [INFO] OT protocol diagrams come...
[20180515 09:28:26] [INFO] Fill my DID
[20180515 09:28:26] [INFO] Fill my TIMESTAMP
[20180515 09:29:14] [WARNING] We're offline now, can't report msg, id: 0
[20180515 09:29:34] [INFO] Retry (1/-1), host ip: 120.92.96.248, port: 8053
[20180515 09:29:34] [INFO] OT client fd: 12
[20180515 09:29:34] [INFO] report_synctime
[20180515 09:29:39] [INFO] report_synctime
[20180515 09:29:44] [INFO] report_synctime
[20180515 09:29:49] [INFO] report_synctime

+++

cat log-197001010100.log
Running Customm Script v1.8

Configuration:
CLOUD_DISABLED=0
CLOUD_STREAMING_DISABLED=0
RTSP_ENABLED=1
CONFIG_LINE=-b4098 -f20 -w1920 -h1080 -m1
SSH_ROOT_PASS=pass
DISABLED_OTA=0
HTTP_ENABLED=1
SAMBA_ENABLED=1
os-version
NAME=Buildroot
VERSION=2016.02-git-00808-g0de1356-dirty
ID=buildroot
VERSION_ID=2016.02-git
PRETTY_NAME="Buildroot 2016.02-git"
XIAOMI_VERSION=3.4.2_0159
XIAOMI_BUILDNO=458
Forcing Mode 4
Staring SSH Server
Getting root access
Changing password for root
New password:
Bad password: too weak
Retype password:
Password for root changed by root

...Starting dropbear...
[198] Jan 01 01:00:08 Running in background

...Changing Language to English...
...Adding Protection to Change of Keys...
...Enabling RTSP...
Web Server (8080)
Samba setup...
Failed to load upcase.dat, will use lame ASCII-only case sensitivity rules
Failed to load lowcase.dat, will use lame ASCII-only case sensitivity rules

Script Ends. Ok

There is any way/hack to raise the length of the recorded motion detection clips?

Hi guys,
thanks for great job you've done!
I just managed to install the hack. I was just wondering.. is there a possibility to disable automatic recording when SD card is inserted? As long as camera would be used without xiaomi services with RTSP in local network, such recording does not make much sense and additionally the SD card might be worn out soon.. Is such feature even possible, or is it already implemented?
Thank you.

The app is so much better than MI Home.

Hi, I think it would be great to add a way to enable/disable motion detection, I want to link it to my alarm system and I just need a way to call a command (it would be great if supported by the internal web server).

Thanks!

The hack was worked with blink led (Blue & Orange) Although I already set Enabled RTSP but I am still not watching RTSP streaming from VLC. It's what I did for watching camera's IP is in MIWIFI application then I am using url like : rtsp://CAMERA_IP/live/ch00_0

I am able to SSH with new password
Log fie :

Running Customm Script v1.8

Configuration:
CLOUD_DISABLED=0
CLOUD_STREAMING_DISABLED=0## Local Streaming. (0,1)
RTSP_ENABLED=1## Local Streaming config -bBITRATE -fFRAMERATE -wWIDTH -hHEIGHT -mBITRATEMODE
CONFIG_LINE=-b4098 -f20 -w1920 -h1080 -m1
SSH_ROOT_PASS=159753korn
DISABLED_OTA=0
HTTP_ENABLED=0
SAMBA_ENABLED=0
os-version
NAME=Buildroot
VERSION=2016.02-git-00808-g0de1356-dirty
ID=buildroot
VERSION_ID=2016.02-git
PRETTY_NAME="Buildroot 2016.02-git"
XIAOMI_VERSION=3.4.2_0159
XIAOMI_BUILDNO=458
Forcing Mode 4
Staring SSH Server
Getting root access
Changing password for root
New password:
Retype password:
Password for root changed by root

...Starting dropbear...
[208] Jan 01 07:00:09 Running in background

...Changing Language to English...
...Adding Protection to Change of Keys...

Script Ends. Ok
[1222] May 16 21:30:53 Child connection from 192.168.1.75:49414
[1222] May 16 21:31:40 Exit before auth (user 'root', 0 fails): Exited normally
[1234] May 16 21:32:02 Child connection from 192.168.1.75:49419
[1234] May 16 21:32:06 Login attempt for nonexistent user from 192.168.1.75:49419
[1234] May 16 21:32:18 Exit before auth: Exited normally
[1266] May 16 21:34:12 Child connection from 192.168.1.75:49423
[1266] May 16 21:34:22 Password auth succeeded for 'root' from 192.168.1.75:49423

Please help, I tried to do this more than a week

Hello,

It appears that no matter what i try, upgrading to 0147 breaks the hack. No SSH, and no other services running either (using default midgard.ini);

The latest upgrade appears to be:

https://cdn.fds-ssl.api.xiaomi.com/miio_fw/356163bfddcfbf236804f90619553fdf_upd_mijia.camera.v1.bin?GalaxyAccessKeyId=5721718224520&Expires=1520091698000&Signature=CNQgzyUXhZN6TJwE3WAR9E4aKvQ=&uniqRequestId=67698601

Hi,
Is it possible to add CURL and inotifywait to /bin?
Having this will add a lot of value to this camera, because we can send the video to dropbox or telegram for example.
Right now i am doing it using the camera and a raspberry pi as network storage.
For every new file sent to samba share, the file is sent to my telegram number and uploaded to my dropbox account, and it would be awesome if there was no need for a separate device.
I believe this is suited only for storage on motion detection.
Thank you.