Weird Password Issue

[richaardvark]

Hello,

I've previously used your amazing method to root two 720 Merkury cameras and today I decided to go purchase and try rooting a 1080p version. I followed all instructions properly (made sure the files were properly replaced, ejected the SD card safely, etc.).

Using admin:admin I am able to successfully open the first URL (http://192.168.1.242:8090/proc/cmdline):
mem=64M console=ttySAK0,115200n8 loglevel=10 mtdparts=spi0.0:256k(bld),64k(env),64k(enc),64k(sysflg),3m(sys),4032k(app),640k(cfg) ppsAppParts=5 ip=0 - ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep

But when I try to open the second URL (http://admin:[email protected]:8090/proc/self/root/mnt/mmc01/hack) it won't accept the password. I've tried both admin:admin and also admin:056565099 but it won't accept either. It's weird that the first URL works but the second one does not. I have tried to access the RTSP stream and it is not working either. I think I'm rooted but I'm not certain. Do you have any other suggestions?

Thank you!

Edit: hmmm, I think it's something with Chrome and the way it stores URLs with passwords in cache or something. I manually changed the URL to http://admin:[email protected]:8090/proc/self/root/mnt/mmc01/hack and it worked just fine. Still unable to get RTSP to work using: vlc --fullscreen --rtsp-tcp rtsp://192.168.1.242:8554. Am I supposed to use port 8090 in the RTSP URL? I don't think you can specify both ports 8554 and 8090 simultaneously lol.

Edit again (lol): Sorry, I'm an idiot... I forgot about the whole ppsapp patching part... doing this now. Everything is working so fart as it should. Thanks again!

[guino]

@richaardvark I see you’re making progress.. the 1080p devices usually don’t need patching but you need to use the URL posted with the firmware information like /StreamingChannel/101 etc after enabling onvif on the config file

[richaardvark]

@guino Thanks! Had to work on something else for a bit but trying to wrap this up now. I'm having trouble though :(

I did enable onvif (I think? the "0" is now a "1" and remains so after a reboot) in the tuya_config.json file but I'm not seeing any URL listed when I look at the http://192.168.1.242:8090/devices/deviceinfo URL (some info redacted):

{"devname":"Smart Home Camera","model":"Mini 11S","serialno":"10278XXXX","softwareversion":"4.0.7","hardwareversion":"M11S_A2_V20_GC1","firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.7.20210624","identity":"M5H0116K7S020XXXXX","authkey":"xRhlLDDByOajAryjAyJVx6NqmXXXXXXX","deviceid":"pp01bb5270fd830aXXXX","pid":"aaa","WiFi MAC":"84:7a:b6:f4:XX:XX","ETH MAC":"00:00:00:00:00:00"}

Edit: I found what you were talking about here:

Once loaded we were able to confirm that the onvif server was started on port 8000 and that the RTSP server was running on port 8554 with the URLs: rtsp://IP:8554//Streaming/Channels/101 (HD) and rtsp://IP:8554//Streaming/Channels/102 (SD) as confirmed by @parkerlreed waving success:

So I then tried to load the HD and SD RTSP streams with the following commands:
vlc --rtsp-tcp rtsp://192.168.1.242:8554//Streaming/Channels/101
vlc --rtsp-tcp rtsp://192.168.1.242:8554//Streaming/Channels/102

But neither will load. Do I have to edit some hex file somewhere or something or do something different with the ppsapp file?

Or maybe mine does need patching :( ?

I installed this program as was also suggested and tried to find my RTSP stream address this way but simply entering "./ipconvif 192.168.1.242" is not enough as it does find the camera on my local network but it is not authorized and won't login. I couldn't find any helpful documentation anywhere on how to include the username and password with the ./ipconvif script :-(

Edit again: I looked through the available patches and mine seems to be newer and therefor there does not yet seem to be a patch available. :( And RTSP doesn't seem to be working even after setting the 0 to 1 in tuya_config.json and removing the # in front of " #/mnt/mmc01/set onvif_enable 1" in custom.sh.

Edit again again: :-D ! nvm - it works! I'm an idiot and didn't realize you had to also include the authentication in the URL:
vlc --rtsp-tcp rtsp://admin:[email protected]:8554/Streaming/Channels/101

Do you think perhaps you could update the documentation in the conclusion section here to also clearly state that the username and password parameters need to be included in the RTSP stream URL? Would have saved me a few hours :-P

Once loaded we were able to confirm that the onvif server was started on port 8000 and that the RTSP server was running on port 8554 with the URLs: rtsp://USERNAME:PASSWORD:IP:8554//Streaming/Channels/101 (HD) and rtsp://USERNAME:PASSWORD:IP:8554//Streaming/Channels/102 (SD) as confirmed by @parkerlreed waving success:

Now I just have to get SNAP working and I'm good to go...

[guino]

@richaardvark the vlc I have 'asks' for the username/password when required, but I will update the documentation -- glad you got it working.

To get 'snap' working I would need a zip of the ppsapp so I can find the address for you.

[richaardvark]

Hey there :) I'm sorry it's taken me so long to reply - have been dealing with a death in my family :(

I've tried to patch ppsapp myself and downloaded all the tools but I'm an idiot and have run into a problem and need your help lol. I already have my 720p camera working fine with snap and mjpeg working and so now of course I'm trying to have all of these same features on my 1080p camera. I've followed the directions here and as you know the 1080p directions more or less point you back to the 720p directions because the process is similar but with a few different files/adding the 8090 port to the URL. But I cannot for the life of me figure out where the ppsapp app file is/comes from? It's not in the main folder of my cam. I can't seem to find the step where we even get the original ppsapp file to begin with. Or, is the script supposed to create the ppsapp file once we run it on the SD card? If so mine did not :-/

Here are the details of my 1080p hardware:

   "devname":"Smart Home Camera",
   "model":"Mini 11S",
   "serialno":"102783758",
   "softwareversion":"4.0.7",
   "hardwareversion":"M11S_A2_V20_GC1",
   "firmwareversion":"ppstrong-a3-tuya2_merkury-4.0.7.20210624",

RTSP is working find by default without the ppsapp patch. If I patch ppsapp will RTSP change?

Another thing I found (which you may already know) but it seems that the reason the 1080p devices with 4.x and greater firmware have RTSP/onvif built-in by default is because Tuya/Merkury/Geeni have an RTSP web app/site which allows you to view the RTSP stream of your device on a PC. It's not something they really seem advertise anymore for some reason. at least I never knew about it until I stumbled upon it on reddit. There's no mention of it in the literature that came with the camera and the app doesn't talk about it. But I think that explains why some of these devices have built-in RTSP already. Also, apparently this same RTSP feature used to work on 720p devices as well at some point before a firmware update was pushed out and now for whatever reason they only allow the 1080p devices to use this feature. Maybe looking at the site's coding and reverse engineering it will give us even more hidden secrets about these devices? lol. The URL to view the built-in RTSP stream is https://camview.mygeeni.com/.

Here's what it looks like after you log in with a QR code from the app:

And as you can see when I try to access one of my 720p cameras it says "Not support WebRTC":

I'm guessing you already knew about all of this but just thought I'd share in case you didn't. If you could tell me where to find my ppsapp file for my 1080p camera and help me get snap and mjpeg working that would be awesome :) Thanks again!

Edit: And naturally, I'm an idiot and five seconds later found where to create/pull the ppsapp file from, lol. One sec...

Edit again: Oh wait nevermind... there is no patch file for my version available on that thread. What do I need to do now?

Edit again again: Ok I've been going down the Ghidra rabbit hole but yeah there is no init echoshow (which I now see is to be expected) so I guess I skip that part since I already have RTSP and keep going down the rabbit hole to get snap and mjpeg working?

[richaardvark]

Edit again again: Ok I've been going down the Ghidra rabbit hole but yeah there is no init echoshow (which I now see is to be expected) so I guess I skip that part since I already have RTSP and keep going down the rabbit hole to get snap and mjpeg working?

Hit a dead end: there is no pps_media_md_get_pic found in the code :(

[richaardvark]

@richaardvark the vlc I have 'asks' for the username/password when required, but I will update the documentation -- glad you got it working.

To get 'snap' working I would need a zip of the ppsapp so I can find the address for you.

I made a new issue here if that's a better place for it. I'll attach my ppsapp.zip file there.