Home - pingumacpenguin/FH86XX_Cameras GitHub Wiki

Welcome to the FH86XX_Cameras wiki!

Luke... I am your camera father]

Is it me, or does that thing look strangely like a stormtrooper with rabbit ears. No? Just me then....

What I have so far. On my test set up I have an internal test Wifi network with subnet 192.168.7.0/24 GW 192.168.7.251 Camera gets DHCP address 192.168.7.4

I added an entry to my laptop /etc/hosts

192.168.7.4 ipcam1

I originally used the App from Google Apps store initially to set the camera up, but with a little work, we can completely eliminate the need for the clunky Advert driven app, and control the thing entirely locally.

Some basics..

RTSP on the FH8616 is

rtsp://admin:admin123456@[IP]:8554/profile0 # for full res (720p) and profile1 for lowres. No luck for ONVIF or PTZ for now.

..so on my test setup I use...

vlc rtsp://admin:admin123456@ipcam1:8554/profile0

Up pops VLC

vlc rtsp://admin:admin123456@ipcam1:8554/profile1

this uses less bandwidth and gives a more stable output.

So what do you do if you want to watch this stream on your phone, and you don't want to use the app that comes with your camera?

You could do worse than install RTSP Player by Damian Hoppe from the app store.

(https://play.google.com/store/apps)

https://play.google.com/store/apps/details?id=pl.huczeq.rtspplayer&hl=en-US

.. or search the apps for RTSP player, as there are a number of other options, including VLC for Android.

I am actually using these cameras with the Open Source CCTV monitoring suite called ZoneMinder.

Here be penguins Penguins

telnet IP_CAM_address

login: user

password: user123456

RTSP creds: User: admin Pass: admin123456 Port: 8554 (can depend based on device, try a port scan on yours) link: /profile0 (full 720p) or /profile1 (lowres)

We have root!!!

Some observations.

The RTSP utility appears to be called "noodles" The control utility is called "apollo"

More noodles and apollo goodness once I have them figured out.

When my camera calls the mother ship, which it does regularly it speaks to ...

[ObsCloud]
auth                     = "check-auth.hapseemate.cn:443"                                      
check                    = "check-auth.hapseemate.cn:443"[/app/userdata/mtd_qn/db/conf]# 

It does push notifications to

 https://devpush-hapseemate.dayunlinks.cn/icp/mesger.html?did=XXXX-YYYYY-ZZZZZ&dname=&dsname=IPCamera&etype=4&dsIndex=0

Yours may be different.

It is running an ARMv6

[user@ /etc/init.d]# cat /proc/cpuinfo
processor       : 0
model name      : ARMv6-compatible processor rev 7 (v6l)
BogoMIPS        : 2.00
Features        : half thumb fastmult vfp edsp java tls 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xb76
CPU revision    : 7

Hardware        : FH8616
Revision        : 0000
Serial          : 0000000000000000

It can support a number of image sensors.

sensor_support=gc1084_mipi@qnwifi
sensor_support=gc2053_mipi@qn*1280x720
sensor_support=gc030a_mipi
sensor_support=gc2375_mipi

It may support some, all or none of the following SOCs

FH8830,FH8630,FH8630D,FH8630M,FH8632,FH8632V2,FH8856,FH8852,FH8626V100,FH8616,FH8852V200,FH8856V200,FH8858V200,FH8852V210,FH8856V210,FH8858V210,FH8852V2X0,FH8856V2X0,FH8858V2X0,FH8652,FH8656,FH8658,FH8852V201,FH8852V202,FH8636,FH8626V200,FH8898,FH8896,FH8210,FH8862,FH8858V300,FH8856V300,FH8858V310,FH8856V310,FH8852V310,FH8810

The annoying startup sounds are played with a utility called playaudio.

Example:
/app/abin/playaudio /app/res/wav/en/welcome.aac

More sounds are stored in the subfolders of..

/app/res/wav/

There are quite a few annoying noises to choose from, or you could put your own, on VFAT formatted sd card and play from there.

[user@ /app/abin]# ls /app/res/wav/
alarm.aac         en                nm                zh
burn_success.aac  factesting.aac    vcall_on.aac
[user@ /app/abin]# ls /app/res/wav/en
bind_success.aac       nosim.aac              welcome_4g.aac
call_busy.aac          op0.aac                welcome_wifi.aac
call_on.aac            reset.aac              wifi_connect_fail.aac
connecting.aac         sigerr.aac             wifi_on.aac
di.aac                 upgrade.aac
hangup.aac             welcome.aac
[user@ /app/abin]# ls /app/res/wav/nm
bind_success.aac       nosim.aac              welcome_4g.aac
call_busy.aac          op0.aac                welcome_wifi.aac
call_on.aac            reset.aac              wifi_connect_fail.aac
connecting.aac         sigerr.aac             wifi_on.aac
di.aac                 upgrade.aac
hangup.aac             welcome.aac
[user@ /app/abin]# ls /app/res/wav/zh
bind_success.aac       nosim.aac              welcome.aac
call_busy.aac          op0.aac                welcome_4g.aac
call_on.aac            qrcode_error.aac       welcome_wifi.aac
connecting.aac         reset.aac              wifi_connect_fail.aac
di.aac                 sigerr.aac             wifi_on.aac
hangup.aac             upgrade.aac
[user@ /app/abin]# 

Main PCB

Main PCB

Note1: if your camera has a different layout but the same SOC, or some other related Fullhan SOC, the above tricks may work.

However if the board has some other SOC, you may be out of luck.

Note2: There is an unpopulated header with pins marked R T and G.

This is almost certainly a UART, however I haven't tried attaching anything to this, yet.

Note3: The WiFi PCB connects to a small stick on internal antenna. The two external antennae are fake.

PCB and Motors

The SOC controls two stepper motors, presumably with PWM.

PCB Side view

The image sensor is on the rear of the main PCB, with a separate PCB for the LEDs.