Server:Server Status

Improving the Motorola Blink Baby Monitor/Camera (Part 5)

So I took the camera apart and took a high-res picture of the PCB. The wifi sub-board is soldered on so I won't remove it yet to expose the ARM CPU. That being said, maybe there's a clue on here for how to mount and write to the flash memory:

IMG_2312

So, the board is the "Pandachip Cam Base V0.2" and there's some ID Number "103-040102001-155" and another "1M94V-0" and finally "5112N." I have no idea what to do with any of that, google turns up nothing. Nevertheless, the goldmine here I believe is this:

IMG_2317

Winbond 25Q64FVSIG 1242. A bit of googling, and you find this. A 64MB flash chip, and with pads right next to it that seem to have contact divets. I bet there's a way to write to the chip...I'm just too dumb to know how to do it. However, this group seems to know things and I plan to leech their BRAINZ.

Looks like i'm buying a Bus Pirate...

Related Posts:


20 Responses to “Improving the Motorola Blink Baby Monitor/Camera (Part 5)”

  1. Peter Brown Says:
    avatar

    Great series of posts – I’m interested to see where you get to! Congratulations on the baby by the way

  2. Jeremy Altman Says:
    avatar

    Hi, thank you for your informative research. I have been struggling on accessing our camera remotely. Our Motorola Router doesn’t have any major restrictions as we are able to view our Dropcam Pro footage remotely just fine. We can’t seem to get any help from motorola support on what else we can configure to allow the remote viewing. We would’t know what ports to open up as this camera apparently scans for open ports. However, what ever is allowing us to view the camera via our home network is not allowing us to do the same from outside of our network.

    Any help and assistance you can provide would be appreciated. Thanks in advance.

  3. Surfrock66 Says:
    avatar

    Mine chatters out on ports 80 and 8080. I didn’t need to forward any ports on it, and the app connects from the WAN without issue; I didn’t do anything special or any port forwarding.

    Are you using the app, or are you trying to access the web interface remotely? I haven’t made that work yet, but the app and the monitor everywhere website’s embedded viewer work fine for me.

  4. Jeremy Altman Says:
    avatar

    I am using the monitor everywhere app. I have tried on numerous times to connect remotely with the app via 4G data, but it continues to show that it is not in local network. I would think that it understands that my 4G connection is not in the local area connection, but the IP address should be open to the outside world.

    Other than my Dropcam pro that I am able to connect via 4G and I would assume is designed to auto-assign a port like the Blink, I have a Uniden security cam that I am also able to access via 4G mobile app.

    I tried launching my cam using myip/blinkhome.html and it only works when connected to my WiFi, but as soon as I switch to 4G, it can’t find the page. Which tells me that the Cam IP is not broadcasting outside my network. Aren’t ports 80 and 8080 usually already open if I am able to access all these other devices on it or could there be a conflict possibly with these other devices?

  5. Surfrock66 Says:
    avatar

    For connections outside the network on things like port 80 you need to set up port forwarding, but you wouldn’t want to do that here, since then ANYONE would be able to peek in on your kids (as there’s no password or anything). Also they’d be able to type a url to do things like factory reset the device or stuff.

    Do you have UPNP disabled on your router? I do, and it still worked.

  6. Jeremy Altman Says:
    avatar

    I have UPNP enabled, which it is by default on our Motorola SBG8782-ACH router. We actually have two cameras and they are behaving the same way via remote connection. The app reads “Camera is not in local network” and when I click on View anyway, it then shows “Camera is disconnected due to network connectivity problem, Trying to reconnect”. This continues endlessly on a loop. We have tried connecting with three different handsets on separate operator 4G networks and we are able to duplicate the error.

    As soon as we turn the WiFi back on on the phones, we are able to connect just fine. I believe our Dropcam Pro and Uniden cams are dependent on UPNP to be functioning correctly and those cams connect just fine on the same cell phones via their respective apps. At which point, I am perplexed why Monitor Everywhere is the only software having difficulty connecting on our equipment.

  7. Kaim Says:
    avatar

    So.
    Did you manage to rewrite the flash?

    Actually I wanna thank you for your time and work 9research0 done as there are numbers of us interested in the more or less the same hardware.

    Moto recently developed 720p camera… I can’t get resolution more than 240p and your guide might helm me.

    Thanks againe and good luck!

  8. Surfrock66 Says:
    avatar

    Nope…it died 🙁 I actually had another one, but I was too chicken to actually try to rewrite it again. I made some code modifications that can be done to the active session over telnet, but once you reboot they’re lost and have to be done again since it loads from the static rom.

  9. Kaim Says:
    avatar

    Youhhey! TELNET

    How to connect? I actually am adopting iSpy for the cam and came across your post. Did you manage Moto for the source code of streaming server?

  10. Kaim Says:
    avatar

    So far below is a working XML for iSpy, but main purpose is to show really working command. I found that X an Y arguments for the motor seems to be ignored but any way…

    Motorola MBP85Connect
    PTZ iSpy

    /?action=command
    80

    command=move_left1.0
    command=move_left1.1
    command=move_right1.0
    command=move_right1.1
    command=move_backward0.1
    command=move_forward0.1
    command=move_left-1.1
    command=move_right-1.1

    command=set_resolution&value=720p
    command=set_resolution&value=480p
    command=set_resolution&value=360p
    command=minus_brightness
    command=plus_brightness
    command=value_temperature
    command=minus_contrast
    command=plus_contrast
    command=melody1
    command=melody2
    command=melody3
    command=melody4
    command=melody5
    command=melodystop
    command=beeper_en&setup=1000100000000000
    command=beeper_dis

    Sources

  11. Kaim Says:
    avatar

    ok XML was cutted. ok.
    Source for the stream 9video and sound
    rtsp://user:pass@” Source=”FFMPEG” url=”/blinkhd” port=”6667″

  12. Kaim Says:
    avatar

    rtsp://user:pass@IP:6667/blinkhd

  13. Surfrock66 Says:
    avatar

    Moto had provided the source code, but then pretty quickly took it down: http://web.monitoreverywhere.com/open-source-availability/

  14. kaim Says:
    avatar

    Could you shere it with us?

  15. kaim Says:
    avatar

    Here is a dump (first one) of what Android software is sending to 80 port of the server

    %3faction=command&command=audio_out0
    %3faction=command&command=audio_out1
    %3faction=command&command=close_p2p_rtsp_stun&streamname=23701B8E1A82_51000
    %3faction=command&command=close_p2p_rtsp_stun&streamname=23701B8E1A82_53000
    %3faction=command&command=get_mac_address
    %3faction=command&command=get_session_key&mode=local&port1=51000&ip=10.0.2(1).15&streamname=23701B8E1A82_51000
    %3faction=command&command=get_wifi_strength
    %3faction=command&command=lr_stop
    =%3faction=command&command=move_left
    %3faction=command&command=move_right
    %3faction=command&command=recording_active_duration&setup=90
    %3faction=command&command=recording_cooloff_duration&value=120
    %3faction=command&command=set_brightness&value=5
    %3faction=command&command=set_video_bitrate&value=200
    %3faction=command&command=set_video_bitrate&value=600
    %3faction=command&command=value_temperature

  16. kaim Says:
    avatar

    audio_out – sends voice to the camera
    =close_p2p_rtsp_stun&streamname=XXX – session to Moto web cloud
    get_mac_address – request of camera MAC
    get_session_key – generates new session to Moto web cloud
    get_wifi_strength – returnes 0-100 value needed to set %set_video_bitrate and is checked every time after move (%move_XXXX)
    lr_stop – send every time after motion %MOVE command. Not really needed
    recording_active_duration – unknown
    recording_cooloff_duration – unknown
    set_video_bitrate – every time after 5MOVE command takes 120 value and then to 200 and then to 600
    value_temperature – retrive TEMP, returnes digit value in C.

    I can’t use settings ans my current emulator lacks some functions, but I hope I’ll be able to outplay it.

    Regarding audio strem to the camera – I do not know codec and how to path it correctly. Seems like it opens some stream from HTTP to HW of the cam…

  17. kaim Says:
    avatar

    close_p2p_rtsp_stun also may be just cam-android session ID, but I think it’s more to Moto web

  18. kaim Says:
    avatar

    Me again!
    Found that ftp://118.91.0.153/Semiconductor_Div/NuvoTon/N3292x/BSP/2015_10_16/
    seems it’s a OS source for main ARM!

    Did not play with it yet but looks promising.

    PS. IMHO the camera was assembled for Motorola, it’s not OEM or any kind of that. If one wants to rewrite the FW he\she should be ready to build all services by his own. It should not be to complicated but I do think there might be a problem with motor drivers. As we do not have SRC for the system and platform drivers there needs to be done additional research what Is controlling the rotation.

  19. Kumar Vikramjeet Says:
    avatar

    Hi, I bricked my focus 73 cam while updating custom firmware. Any idea how to bring it back on.

  20. Surfrock66 Says:
    avatar

    So, I did this, and rather than finish fixing it I bought a new one…that being said if you take it apart and find the storage chip, you can use this:

    http://www.amazon.com/Seeedstudio-interface-measurement-1Hz-40MHz-frequency/dp/B017F47RB8?ie=UTF8&keywords=bus%20pirate&qid=1461552257&ref_=sr_1_3&sr=8-3

    and this:

    http://www.amazon.com/Signstek-SOIC8-Socket-Adpter-Programmer/dp/B00V9QNAC4?ie=UTF8&psc=1&redirect=true&ref_=oh_aui_detailpage_o03_s00

    And then this:

    https://www.flashrom.org/Flashrom

    to try to write directly to the chip. This is pretty high up there in difficulty…over my head, I have just learned how to read chips with those tools, but writing is still over my head.

    If anything, you can get some apps that are chip emulators…you may be able to simulate flashing the stock fimware to an emulator, then capture the contents of the chip as a dump and use that to flash the actual chip. I have NO idea how to do any of what I just suggested 🙁

Leave a Reply