Improving the Motorola Blink Baby Monitor/Camera (Part 5)
So I took the camera apart and took a high-res picture of the PCB. The wifi sub-board is soldered on so I won't remove it yet to expose the ARM CPU. That being said, maybe there's a clue on here for how to mount and write to the flash memory:
So, the board is the "Pandachip Cam Base V0.2" and there's some ID Number "103-040102001-155" and another "1M94V-0" and finally "5112N." I have no idea what to do with any of that, google turns up nothing. Nevertheless, the goldmine here I believe is this:
Winbond 25Q64FVSIG 1242. A bit of googling, and you find this. A 64MB flash chip, and with pads right next to it that seem to have contact divets. I bet there's a way to write to the chip...I'm just too dumb to know how to do it. However, this group seems to know things and I plan to leech their BRAINZ.
Looks like i'm buying a Bus Pirate...
Related Posts:
- Improving the Motorola Blink Baby Monitor/Camera
- Improving the Motorola Blink Baby Monitor/Camera (Part 2)
- Improving the Motorola Blink Baby Monitor/Camera (Part 3)
- Improving the Motorola Blink Baby Monitor/Camera (Part 4)
Great series of posts – I’m interested to see where you get to! Congratulations on the baby by the way
Hi, thank you for your informative research. I have been struggling on accessing our camera remotely. Our Motorola Router doesn’t have any major restrictions as we are able to view our Dropcam Pro footage remotely just fine. We can’t seem to get any help from motorola support on what else we can configure to allow the remote viewing. We would’t know what ports to open up as this camera apparently scans for open ports. However, what ever is allowing us to view the camera via our home network is not allowing us to do the same from outside of our network.
Any help and assistance you can provide would be appreciated. Thanks in advance.
Mine chatters out on ports 80 and 8080. I didn’t need to forward any ports on it, and the app connects from the WAN without issue; I didn’t do anything special or any port forwarding.
Are you using the app, or are you trying to access the web interface remotely? I haven’t made that work yet, but the app and the monitor everywhere website’s embedded viewer work fine for me.
I am using the monitor everywhere app. I have tried on numerous times to connect remotely with the app via 4G data, but it continues to show that it is not in local network. I would think that it understands that my 4G connection is not in the local area connection, but the IP address should be open to the outside world.
Other than my Dropcam pro that I am able to connect via 4G and I would assume is designed to auto-assign a port like the Blink, I have a Uniden security cam that I am also able to access via 4G mobile app.
I tried launching my cam using myip/blinkhome.html and it only works when connected to my WiFi, but as soon as I switch to 4G, it can’t find the page. Which tells me that the Cam IP is not broadcasting outside my network. Aren’t ports 80 and 8080 usually already open if I am able to access all these other devices on it or could there be a conflict possibly with these other devices?
For connections outside the network on things like port 80 you need to set up port forwarding, but you wouldn’t want to do that here, since then ANYONE would be able to peek in on your kids (as there’s no password or anything). Also they’d be able to type a url to do things like factory reset the device or stuff.
Do you have UPNP disabled on your router? I do, and it still worked.
I have UPNP enabled, which it is by default on our Motorola SBG8782-ACH router. We actually have two cameras and they are behaving the same way via remote connection. The app reads “Camera is not in local network” and when I click on View anyway, it then shows “Camera is disconnected due to network connectivity problem, Trying to reconnect”. This continues endlessly on a loop. We have tried connecting with three different handsets on separate operator 4G networks and we are able to duplicate the error.
As soon as we turn the WiFi back on on the phones, we are able to connect just fine. I believe our Dropcam Pro and Uniden cams are dependent on UPNP to be functioning correctly and those cams connect just fine on the same cell phones via their respective apps. At which point, I am perplexed why Monitor Everywhere is the only software having difficulty connecting on our equipment.
So.
Did you manage to rewrite the flash?
Actually I wanna thank you for your time and work 9research0 done as there are numbers of us interested in the more or less the same hardware.
Moto recently developed 720p camera… I can’t get resolution more than 240p and your guide might helm me.
Thanks againe and good luck!
Nope…it died 🙁 I actually had another one, but I was too chicken to actually try to rewrite it again. I made some code modifications that can be done to the active session over telnet, but once you reboot they’re lost and have to be done again since it loads from the static rom.
Youhhey! TELNET
How to connect? I actually am adopting iSpy for the cam and came across your post. Did you manage Moto for the source code of streaming server?
So far below is a working XML for iSpy, but main purpose is to show really working command. I found that X an Y arguments for the motor seems to be ignored but any way…
Motorola MBP85Connect
PTZ iSpy
/?action=command
80
command=move_left1.0
command=move_left1.1
command=move_right1.0
command=move_right1.1
command=move_backward0.1
command=move_forward0.1
command=move_left-1.1
command=move_right-1.1
command=set_resolution&value=720p
command=set_resolution&value=480p
command=set_resolution&value=360p
command=minus_brightness
command=plus_brightness
command=value_temperature
command=minus_contrast
command=plus_contrast
command=melody1
command=melody2
command=melody3
command=melody4
command=melody5
command=melodystop
command=beeper_en&setup=1000100000000000
command=beeper_dis
Sources
ok XML was cutted. ok.
Source for the stream 9video and sound
rtsp://user:pass@” Source=”FFMPEG” url=”/blinkhd” port=”6667″
rtsp://user:pass@IP:6667/blinkhd
Moto had provided the source code, but then pretty quickly took it down: http://web.monitoreverywhere.com/open-source-availability/
Could you shere it with us?
Here is a dump (first one) of what Android software is sending to 80 port of the server
%3faction=command&command=audio_out0
%3faction=command&command=audio_out1
%3faction=command&command=close_p2p_rtsp_stun&streamname=23701B8E1A82_51000
%3faction=command&command=close_p2p_rtsp_stun&streamname=23701B8E1A82_53000
%3faction=command&command=get_mac_address
%3faction=command&command=get_session_key&mode=local&port1=51000&ip=10.0.2(1).15&streamname=23701B8E1A82_51000
%3faction=command&command=get_wifi_strength
%3faction=command&command=lr_stop
=%3faction=command&command=move_left
%3faction=command&command=move_right
%3faction=command&command=recording_active_duration&setup=90
%3faction=command&command=recording_cooloff_duration&value=120
%3faction=command&command=set_brightness&value=5
%3faction=command&command=set_video_bitrate&value=200
%3faction=command&command=set_video_bitrate&value=600
%3faction=command&command=value_temperature
audio_out – sends voice to the camera
=close_p2p_rtsp_stun&streamname=XXX – session to Moto web cloud
get_mac_address – request of camera MAC
get_session_key – generates new session to Moto web cloud
get_wifi_strength – returnes 0-100 value needed to set %set_video_bitrate and is checked every time after move (%move_XXXX)
lr_stop – send every time after motion %MOVE command. Not really needed
recording_active_duration – unknown
recording_cooloff_duration – unknown
set_video_bitrate – every time after 5MOVE command takes 120 value and then to 200 and then to 600
value_temperature – retrive TEMP, returnes digit value in C.
I can’t use settings ans my current emulator lacks some functions, but I hope I’ll be able to outplay it.
Regarding audio strem to the camera – I do not know codec and how to path it correctly. Seems like it opens some stream from HTTP to HW of the cam…
close_p2p_rtsp_stun also may be just cam-android session ID, but I think it’s more to Moto web
Me again!
Found that ftp://118.91.0.153/Semiconductor_Div/NuvoTon/N3292x/BSP/2015_10_16/
seems it’s a OS source for main ARM!
Did not play with it yet but looks promising.
PS. IMHO the camera was assembled for Motorola, it’s not OEM or any kind of that. If one wants to rewrite the FW he\she should be ready to build all services by his own. It should not be to complicated but I do think there might be a problem with motor drivers. As we do not have SRC for the system and platform drivers there needs to be done additional research what Is controlling the rotation.
Hi, I bricked my focus 73 cam while updating custom firmware. Any idea how to bring it back on.
So, I did this, and rather than finish fixing it I bought a new one…that being said if you take it apart and find the storage chip, you can use this:
http://www.amazon.com/Seeedstudio-interface-measurement-1Hz-40MHz-frequency/dp/B017F47RB8?ie=UTF8&keywords=bus%20pirate&qid=1461552257&ref_=sr_1_3&sr=8-3
and this:
http://www.amazon.com/Signstek-SOIC8-Socket-Adpter-Programmer/dp/B00V9QNAC4?ie=UTF8&psc=1&redirect=true&ref_=oh_aui_detailpage_o03_s00
And then this:
https://www.flashrom.org/Flashrom
to try to write directly to the chip. This is pretty high up there in difficulty…over my head, I have just learned how to read chips with those tools, but writing is still over my head.
If anything, you can get some apps that are chip emulators…you may be able to simulate flashing the stock fimware to an emulator, then capture the contents of the chip as a dump and use that to flash the actual chip. I have NO idea how to do any of what I just suggested 🙁
Any chance to connect this over ethernet cable, or is this strictly on wifi?
Wifi only for sure; there is no mechanism for any type of wired connection over USB or ethernet.