If you are here is want to get rid of the old firmware and have fun :)

This guide is intended for educational purposes only. Use at your own risk.

1. Hardware
2. What you will need
3. BACKUP
   1. Telnet method
   2. UART method
4. Flash binary
5. Troubleshooting
6. Restore original firmware
7. Credits

2025-03-08 This is work in progress as the support for this camera is not merged to the master branch yet.

• SoC: Ingenic T10
• Image Sensor: JXH62
• Wi-Fi Module: MT7601
• Flash Chip: NOR 8MB
• Power: 5V USB MicroB

• Working Sannce 21AG camera
• 1x SD card +8MB capacity
• 1x FT232RL USB to serial adapter (example)
• 2x dupont cables (female-female) (example)
• 2x needles!
• PC with Windows + Putty or Linux (both is recommended) GUIDE

First things first, gain a root shell and create a backup. This can be done using telnet (A) or straight with the UART adapter (B). To flash the bin file you will have to use method B anyway. (maybe if the thingino bin file is renamed to demo.bin, the stock bootloader try to flash it during the boot up when SD is inserted but I have no tried this way and this will be a cause to brick the camera)

Let's assume you have the camera pristine, with the chinese firmware loaded as it came. Maybe firmware T10.7.1.17.9E or T11.68.1.17.6 You have to enable Telnet; years ago the app "Digma Smartcam" was working but not the recent one in Google Play, maybe you can install in your mobile phone an apk from apkmirror from 2018 and try to enable from the app (root/hslwificam default password for ancients firmwares). but it is easier to hack the firmware with these steps:

1. Open IPCAMERA:port for access to the webui of the camera
2. Go to Firefox mode / livestream (no IE) and open icon settings below
3. Go to Alarm Service Settings, you will have to choose between alarm or FTP and fill the important textboxes
4. Sender/recipient SMTP server and user with $(telnetd -l /bin/sh) or "FTP Server" with $(killall telnetd) and "FTP User" with $(telnetd -l /bin/sh)
5. Click setup and test, new browser window will open with error test message. If succeed try to open a telnet session from you S.O. and execute telnet and then open IPCAMERA
6. Check you are root user with whoami command in the terminal, if the output is root, 👍.
7. Format a SD card to FAT and insert it to the camera.

Example:

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00010000 "boot"
mtd1: 00220000 00010000 "kernel"
mtd2: 00340000 00010000 "root"
mtd3: 00240000 00010000 "system"
mtd4: 00010000 00010000 "factory"
mtd5: 00010000 00010000 "param"

Dump firmware from every mtd partition according to the layout of your camera:

cd /mnt/DCIM/
dd if=/dev/mtdblock0 of=uboot.bin 
dd if=/dev/mtdblock1 of=kernel.bin
dd if=/dev/mtdblock2 of=rootfs.bin 
dd if=/dev/mtdblock3 of=system.bin 
dd if=/dev/mtdblock4 of=factory.bin 
dd if=/dev/mtdblock5 of=param.bin 

Now remove the card and save a copy in a folder in your computer.

Disassemble the camera to access UART pins. Set up the FT232RL with the usb cable to the PC. Set the FT232RL pin header to use 3,3 volts. Insert 1 dupont cable to the RX pin out and other to TX pin out. Then grab 2 thin needles and insert them to the other side . UART pin holes of the camera are thinner than the normal diameter of the dupont pins (<0,5 mm). No need to use GND cable for me.

• FT232RL TX pin <===> RX camera board
• FT232RL RX pin <===> TX camera board

Then,

1. Open a 115200 baud rate serial session with Putty (windows) to the active COM port.
2. Power up the camera by plugging the usb cable and observe Putty:

U-Boot 2013.07 (Sep 26 2017 - 10:51:34)

Board: ISVP (Ingenic XBurst T10 SoC)
DRAM:  64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 435k for U-Boot at: 83f90000
Reserving 32784k for malloc() at: 81f8c000
Reserving 32 Bytes for Board Info at: 81f8bfe0
Reserving 124 Bytes for Global Data at: 81f8bf64
Reserving 128k for boot params() at: 81f6bf64
Stack Pointer at: 81f6bf48
Now running in RAM - U-Boot at: 83f90000
MMC:   msc: 0
the manufacturer c2
SF: Detected MX25L64**E

In:    serial
Out:   serial
Err:   serial
Net:   Jz4775-9161
Hit any key to stop autoboot:  0
the manufacturer c2
SF: Detected MX25L64**E

3. You will have to see the UBOOT loading in Putty. If no, repeat previous steps.
4. Restart the camera and cancel the boot up of uboot pressing any key or Ctrl+C when the message is displayed fast (1-2 seconds only) to gain access to the uboot shell. If not the camera will boot as usual:

U-Boot 2013.07 (Sep 26 2017 - 10:51:34)

Board: ISVP (Ingenic XBurst T10 SoC)
DRAM:  64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 435k for U-Boot at: 83f90000
Reserving 32784k for malloc() at: 81f8c000
Reserving 32 Bytes for Board Info at: 81f8bfe0
Reserving 124 Bytes for Global Data at: 81f8bf64
Reserving 128k for boot params() at: 81f6bf64
Stack Pointer at: 81f6bf48
Now running in RAM - U-Boot at: 83f90000
MMC:   msc: 0
the manufacturer c2
SF: Detected MX25L64**E

In:    serial
Out:   serial
Err:   serial
Net:   Jz4775-9161
Hit any key to stop autoboot:  0
the manufacturer c2
SF: Detected MX25L64**E

--->probe spend 4 ms
SF: 1507328 bytes @ 0x40000 Read: OK
--->read spend 220 ms
## Booting kernel from Legacy Image at 80600000 ...
   Image Name:   Linux-3.10.14
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1446926 Bytes = 1.4 MiB
   Load Address: 80010000
   Entry Point:  80382800
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

5. This will format you SD card and generate a dump of whole system.

# Just line by line, NOT at once!
setenv baseaddr 0x80600000; setenv flashsize 0x800000;
mw.b ${baseaddr} ff ${flashsize};
sf probe 0; sf read ${baseaddr} 0x0 ${flashsize};
mmc dev 0; mmc erase 0x10 0x4000;
mmc write ${baseaddr} 0x10 0x4000;

6. Restore the backup to a file on a PC running Linux with the SD connected (change YOURSDNAME accordingly using fdisk -l) and keep it in a safe folder.

cd $home
sudo dd bs=512 skip=16 count=16384 if=/dev/YOURSDNAME of=./fulldump.bin

Now, we can proceed to flash the binary file to the SD card.

This is when the process is risky business but not big deal. Format again the SD card to FAT with default values and copy there the binary file (thingino-sannce21.bin) and plug in the SD card to the camera, restart the camera by unplugging the USB power cable for a sec, then plug it back again and let it boot up and stop the uboot. You can verify the SD is detected executing mmc rescan; mmcinfo; fatls mmc 0

Example:

isvp# mmc rescan; mmcinfo; fatls mmc 0
Device: msc
Manufacturer ID: 0
OEM: 3000
Name: APPSD 
Tran Speed: 50000000
Rd Block Len: 512
SD version 2.0
High Capacity: No
Capacity: 60 MiB
Bus Width: 4-bit
isvp# fatls mmc 0
  8388608   thingino-sannce21.bin

1 file(s), 0 dir(s)

If mmc 0 is not detected try to change above commands to mmc 0:0 or mmc 0:1 until file is shown (to adapt the partition number from your SD card memory).

Ok, ready to flash. Execute now:

# Just line by line, NOT at once!
setenv flashsize 0x800000; setenv baseaddr 0x82000000;
mw.b ${baseaddr} 0xff ${flashsize};
fatload mmc 0:1 ${baseaddr} thingino-sannce21.bin;
sf probe 0; sf erase 0x0 ${flashsize};
sf write ${baseaddr} 0x0 ${filesize};

If all good then restart camera with reset. If errors appeared, goto Troubleshooting

Copy fulldump.bin to a FAT SD formated, start the camera with the FT232RL conected to gain boot shell and execute:

# Just line by line, NOT at once!
setenv flashsize 0x800000; setenv baseaddr 0x82000000;
mw.b ${baseaddr} 0xff ${flashsize};
fatload mmc 0:1 ${baseaddr} fulldump.bin
sf probe 0; sf lock 0; sf erase 0x0 ${flashsize};
sf write ${baseaddr} 0x0 ${filesize};

I bricked my camera this way because original bootloader (just restored) was unable to boot properly, I guess I did not cleared environment args from thingino build. Maybe this will work:

env default -a -f
env save
reset

I bricked my camera twice but I was able to recover it 😄. I will try to write what I did to recover it without a programmer.

• Camera is bricked
• Alternative SD boot

If after flashing the new firmware the camera is completely dumb and you are unable to read the boot loading process, you will have to force the camera to load the uboot from the SD card. Just locate the flash chip in the board as instructed here and have ready a SD card memory with a uboot installed Alternative SD boot

Flash chip is below black cushion sponge UART

FULL ARTICLE HERE https://github.com/themactep/thingino-firmware/wiki/Boot:-MMC-SD

Simple: download latest u-boot-isvp_t10_msc0.bin from repository and write it to a emtpy SD card using Linux.

1. Run wget https://github.com/gtxaspec/ingenic-u-boot-xburst1/releases/download/uboot-xb1-2025-03-07/u-boot-isvp_t10_msc0.bin
2. Run fdisk -l to identify the SD card. Example /dev/sdCHANGEME
3. Run sudo dd if=./u-boot-isvp_t10_msc0.bin of=/dev/sdCHANGEME bs=512 seek=34 replacing sdCHANGEME as instructed above.
4. Insert SD in Sannce and power up the camera and you would see u-boot loading. You now may swap SD card and insert other and flash thingino firmware, just follow the steps pic

• 4pda original topic of development
• Xiaomi-Dafang-Hacks first attempt to create alternative firmware
• thingino-firmware
• diadatp user to mix everything