Is there any plan for Chinese version of YI Outdoor Camera?

[HuipengRen]

No description provided.

[HuipengRen]

Or is there any way to do it by myself based on this project? I bought one two weeks ago, but I just found that I can not use it in the US unfortunately.

[shadow-1]

@HuipengRen
This is a very interesting camera which I would like to support. However as I don't have this camera, I don't think I will be able to develop custom firmware for it yet.

I can guide you through a few basic steps to confirm whether the Yi Outdoor camera is similar to the other cameras I currently support. If it is very similar to the Yi Home or Yi Dome cameras, I should be able to support it without too many issues, even if I don't have the camera.

Unfortunately the only way to confirm this is to get access to the cameras serial interface which requires the camera to be opened up along with some soldering. If you are willing to do this, I may be able to help.

[javier26]

I am willing to help. I have the "YI Outdoor Security Camera, Cloud Cam Wireless IP" as described on amazon and sold to US customers.

[shadow-1]

@javier26
That is great. The first thing that you need to do is get access to the console of the camera. All the Xiaomi cameras I have seen have a serial port connection on the main board.

Older versions of the camera had a connector whilst newer ones only have pads which can be soldered.

Once you have the serial port connection soldered, you will need to use a USB-Serial converter to access the console.

You can use this YouTube video as a go by. It is for the original Yi Home and not the Yi Outdoor 1080p. Hopefully it isn't much different.
https://www.youtube.com/watch?v=3e8jXuxiRzY

When you manage to open your camera to get access to the main board. Can you post some high resolution photos of the internals here? I'm sure it will be helpful to others.

[javier26]

I have no idea how to open this thing. There are no visible screws apart from the ones that hold the microSD slot door closed.
I tried to pry open from the front with a little pressure but it wouldnt give. Ill keep trying

[HuipengRen]

I actually unlocked the region lock without opening the camera couple weeks ago.

[javier26]

Are you able to enable rtsp on it and remove the cloud recording, and all the good stuff?

[HuipengRen]

No, it only unlocked the region lock, so basically

1. Set up a dns server with dnsmasq in your laptop, and config "api.xiaoyi.com" mapping to your laptop ip.
2. Log in to your wifi router and change the dns server to your new dns server (your laptop ip).
3. Set up a customize transparent http proxy on your laptop, which will forward all "api.xiaoyi.com" traffic to another http proxy in the Mainland China. I can not config squid or other http proxy to do it correctly, so I just wrote a very simple one.
4. You will need to set up the above again when the camera restarts.

[HuipengRen]

To unlock the region lock, I think you can also simply do ssh port forwarding for port 80/443 to a instance in a cloud provider in China (like aliyun or mtyun) after redirecting your dns server.

[HuipengRen]

I can share the simple transparent http proxy if anyone needs it.

[shadow-1]

@HuipengRen
This is almost the same method my custom firmware uses to bypass the region lock. The main difference of course is that the firmware implements everything on the camera. No need for special routers or converting a spare computer into a transparent proxy server.

@javier26
Unfortunetly to develop a custom firmware, we need to find a way to open the camera. I guess it is much more difficult to open because it is dustproof and waterproof.

[chenkok]

@shadow-1
So, basically if you have physical access to the Yi Outdoor cam then you'll be able to make a custom firmware right? Then we'll be able to just flash the cam using a memory card?
I bought a few awhile ago for my dad without knowing it has region lock. So, i might be able to give you one for testing. Is that ok with you?

[shadow-1]

@chenkok
With physical access to the camera, we can do investigations within the embedded operating system and determine what needs to be done to hack the firmware.

This particular custom firmware (yi-hack-v3) is specific to Xiaomi cameras based on the HiSilicon Hi3518e chipset. If the Yi Outdoor is also based on a HiSilicon chipset, there is a good chance that this firmware can be adapted to provide Yi Outdoor 1080p support without a lot of modification. However if the Yi Outdoor camera is based on a different chipset, a completely different hack will need to be developed, potentially with a different way of applying firmware updates (if at all possible) and potentially a different method of hacking the firmware.

You never know with Xiaomi. For example, the Yi Home 2 camera, despite the similar product name, similar look and feel, it is a completely different camera to the original Yi Home series of cameras. The Yi Home is based on the HiSilicon Hi3518e chipset whilst the Yi Home 2 is based on the Ambarella S2LM chipset. A completely different firmware was developed to hack the Yi Home 2 camera because it is based on a different chip.

I am happy to have a look at the Yi Outdoor for testing purposes. However only after investigation and testing can we find out what needs to be done to hack the firmware. There is also a chance that it cannot be done easily.

[chenkok]

@shadow-1 Can you provide your address, will go get a quote from courier service.

[ykhandler]

Interesting...

[shadow-1]

@chenkok
Can you provide me with an email address or a way I can send you my address privately?

However you can get a quote from your courier company to send to Melbourne, Australia. It should be exactly the same cost to send a parcel anywhere within Melbourne.

[earth2004]

@shadow-1 Just received my Chinese version yi outdoor camera today and couldn't have it work because the region lock and I came across to this page. I live in Melbourne and am willing to send you one for testing. Kindly email me [email protected] and thank you in advance!

[earth2004]

@HuipengRen Can you share the transparent http proxy to [email protected] please?

[HuipengRen]

@earth2004 @mugennam I just put it here, https://github.com/HuipengRen/yihttptunnel

[shadow-1]

@earth2004
I just sent you an email. Let me know if you are willing to send me a Yi Outdoor 1080p for development purposes.

[milanzelenka]

I would like to contribute to discovery YI Outdoor via serial, but it looks like impossible to open (dismout) camera without loosing it's watter resistance... :-(

There are no screw (only for sdcard cover), no hidden screw (under back-side label). I tried to unfold the join on perimeter in front, but unsuccess. If you have any idea how to dismout, please share it...

These YI cameras without this custom (hacked) firmware is just a piece of toy...

[jasperpants]

I'd like to contribute as well. I took a look at the camera when I received it and I think you'd basically have to destroy the case to get in to it. Maybe if there is enough of us chipping in $10 each we can get a sacrificial one to shadow-1.

[Koenkk]

I'm also willing to donate a few $.

@shadow-1 maybe you can start some fund raising for this so you can buy one yourself? (I'm not familiar with this but something like: https://gogetfunding.com/). This will also save on shipping costs because you can get it directly from store.

[ultimacarlos]

I bought the cam without knowing the region block. Have been searching the net on how to open the case and this is the best info I found thus far. https://fccid.io/2AFIB-YHS3017/Internal-Photos/Int-Photos-3558245. Hope this will help to develop the hack for it. Thanks.

[deviant77]

Looking at those photos, it's obvious that the black cover first needs to be removed to take apart the camera.
It looks like the black cover is simply glued in place. You could try heating the edge of the black cover with a heat gun or hair dryer and try to pry and lift it off.
Once the black cover is off, the rest looks easy!

[ultimacarlos]

@JustinTrouble
You're right. The black cover is glued on the circumference. Can ply off easily by popping a thin object on the top hole. Be cautious not to push all the way in as there's a film behind the small hole for the light sensor, I guess. Just stick it in enough for plying. Next, you will need a slim and long screw driver to take off the 4 screws that hold the whole assembly.

[milanzelenka]

I successfully opened camera (thanks to @ultimacarlos for link). I used hair dryer and small screwdriver (in the sensor hole) to release front glass...

TTL connected, serial established on speed 115200 8N1. I've captured boot log of original firmware. here: https://pastebin.com/C9AcUJHi

What can I try? Is there any interactive shell to gathering some diagnostic data?

[milanzelenka]

Another bootlog with camera powered from original USB cable and adapter (not from UART): https://pastebin.com/DepPb3D8

At the end of bootlog camera was successfully connected to wifi.

[jasperpants]

@milanzelenka were you able to interrupt uboot at all? The youtube video @shadow-1 linked to on Dec-6th starts getting interesting around the 13 minute mark where he changes the boot args and eventually gets root on the camera.

[channdy]

@dylangerdaly You did an amazing progress. Any update on the freezing randomly problem on boot with home_h20 firmware?

[HuipengRen]

@channdy Yeah, the default http proxy in China is not working any more, I just changed it to another one, try again please.

[channdy]

@HuipengRen Yes, it is working now. Thanks very much! How can you identify which China proxy is working with your yihttptunnel? I have tried many different proxies but I couldn't get it working. Is this enough to just run this command "sudo java com.yihttptunnel.Server [proxyhost] [proxyport]" to change the default proxy?

[HuipengRen]

@channdy yes, the command is right, and regarding how to identify China proxy, I just try them one by one, to see if I can get 200 OK for the curl command curl https://api.xiaoyi.com from my laptop

[jamieshaw]

Has there been any more movement on getting RTSP working on the outdoor model at all?
Happy to help in anyway that doesn't mean me cracking the thing open 👍

[Lecl0ne]

Me too. Really waiting for something to connect this camera to Jeedom !!

[nameonweb]

Same for me... hoping for any solution on RTSP or http streaming solution...

[ccorderor]

I think nobody is working on the support of this camera...

[VTCop]

@HuipengRen is your dns sever working?

[HuipengRen]

@VTCop Yes, at least it's working very well for me.

[Lecl0ne]

What does it mean? So you can see your camera in Jeedom?

[dvbit]

Ehhhh. How do you interface it to jeedom?

[JoJ123]

@dylangerdaly
The SDK is uploaded by @shadow-1:
The HiSilicon SDK compatible with the HiSilicon Hi3518eV200 chipset needs to be downloaded. On my Box account, I have hosted a number of SDKs. The latest compatible SDK I have is Hi3518E V200R001C01SPC040. Please keep in mind that due to file size restrictions on my Box account, I had to split the SDK into 6 pieces. The SDK can be downloaded from:
https://app.box.com/s/cibs7n1mgvhqaqjlidtveegu1uajt5yr

Do this help you to go on with this camera? Would it be easier for the international version?

[nonick321]

Any news on rtsp? I have the intl. Version. There is a omnivision Sensor. Whivh one has the chinese Version?

[nonick321]

@j0rd

Simply copy the files rootfs_h30 and home_h30 to an empty sdcard.
Insert sd-card to cam. Wait till it stops blinking.
Remove SD card and add a wpa_supplicant.conf to it.
Reinsert into cam.
Telnet into it. Login is root/empty
(Router shows the IP)

[Lecl0ne]

I'm not sure I undrestood.. Does it mean it is possible to get something on Jeedom, or out of this Yi app ?

[aelg305]

look into: https://github.com/shadow-1/yi-hack-v3/issues/228

[channdy]

@HuipengRen It seems proxy of your yihttptunnel on 54.84.30.91 was stopped working again. Can you check please? Anyway I was trying to have my own http tunnel but was unable to get China proxy from http://spys.one/free-proxy-list/CN/ working with your yihttptunnel. I have tried a lot of different https proxies in the list but not success. Can you advise please?

[HuipengRen]

@channdy fixed, the China proxy I was using stopped working..., just restarted yihttptunnel with another one.

If you want to set up your own http tunnel, you can also try those proxies with "Proxy type = HTTP", cause those HTTP proxies usually also support "CONNECT" request to set up an end-to-end TLS tunnel.

[keywansanay]

@dylangerdaly
The SDK is uploaded by @shadow-1:
The HiSilicon SDK compatible with the HiSilicon Hi3518eV200 chipset needs to be downloaded. On my Box account, I have hosted a number of SDKs. The latest compatible SDK I have is Hi3518E V200R001C01SPC040. Please keep in mind that due to file size restrictions on my Box account, I had to split the SDK into 6 pieces. The SDK can be downloaded from:
https://app.box.com/s/cibs7n1mgvhqaqjlidtveegu1uajt5yr

Do this help you to go on with this camera? Would it be easier for the international version?

@JoJ123 : Could you please help me with the link in your comment. I have 2 yi outdoor camera and I can't use them. It's Chinese version and i live in Holland. How can I change the firmware to international with those file in your link?

[aelg305]

@keywansanay did you figure out what to do?
1- download your version from the release page
2-drop into formatted microsd (if using yi outdoor...I believe is home30 and roof..30) (I'm missing some letters but the important part is the last 2 digits/numbers)
3-put microsd into camera, wait to boot....yellow light sequence....
4-enjoy (access through ip, etc)

let me know.

[keywansanay]

Dear,Thank you for your email: I have some question: @keywansanay did youfigure out what to do? 1- download your version from the release page ( whichpage and which release number?) 2-drop into formatted microsd (if using yi outdoor...Ibelieve is home30 and roof..30) (I'm missing some letters but the importantpart is the last 2 digits/numbers) what you mean? 3-put microsd into camera, wait to boot....yellow lightsequence.... 4-enjoy (access through ip, etc) Kind regards,Kay On Monday, March 25, 2019, 11:05:46 PM GMT+1, Andres L <[email protected]> wrote: @keywansanay did you figure out what to do? 1- download your version from the release page 2-drop into formatted microsd (if using yi outdoor...I believe is home30 and roof..30) (I'm missing some letters but the important part is the last 2 digits/numbers) 3-put microsd into camera, wait to boot....yellow light sequence.... 4-enjoy (access through ip, etc) let me know. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[aelg305]

Dear,Thank you for your email: I have some question: @keywansanay did youfigure out what to do? 1- download your version from the release page ( whichpage and which release number?)
refer to: Getting Started - Step by Step Guide..step 3...the LINK there with "release" at the end.

2-drop into formatted microsd (if using yi outdoor...Ibelieve is home30 and roof..30) (I'm missing some letters but the importantpart is the last 2 digits/numbers) what you mean?
refer to: right below step3 there is a diagram that shows you which version depending on which camera....outdoor yi: "Yi Outdoor | rootfs_h30 | home_h30"

3-put microsd into camera, wait to boot....yellow lightsequence.... 4-enjoy (access through ip, etc) Kind regards,Kay On Monday, March 25, 2019, 11:05:46 PM GMT+1, Andres L [email protected] wrote: @keywansanay did you figure out what to do? 1- download your version from the release page 2-drop into formatted microsd (if using yi outdoor...I believe is home30 and roof..30) (I'm missing some letters but the important part is the last 2 digits/numbers) 3-put microsd into camera, wait to boot....yellow light sequence.... 4-enjoy (access through ip, etc) let me know. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

Comments within your question in bold
Let me know....

[channdy]

@keywansanay did you figure out what to do?
1- download your version from the release page
2-drop into formatted microsd (if using yi outdoor...I believe is home30 and roof..30) (I'm missing some letters but the important part is the last 2 digits/numbers)
3-put microsd into camera, wait to boot....yellow light sequence....
4-enjoy (access through ip, etc)

let me know.

Hi @aelg305, how to connect to the wifi following this steps? Because after power up Camera did not recognize the QR code on App at all.

[aelg305]

@keywansanay did you figure out what to do?
1- download your version from the release page
2-drop into formatted microsd (if using yi outdoor...I believe is home30 and roof..30) (I'm missing some letters but the important part is the last 2 digits/numbers)
3-put microsd into camera, wait to boot....yellow light sequence....
4-enjoy (access through ip, etc)
let me know.

Hi @aelg305, how to connect to the wifi following this steps? Because after power up Camera did not recognize the QR code on App at all.

I usually connect to the Yi first (with QR code, etc) unless you have the Chinese version.
I have the regular version, which allows me to connect first and hack after and remain connected to Yi servers.

Is that your case?

[channdy]

@keywansanay did you figure out what to do?
1- download your version from the release page
2-drop into formatted microsd (if using yi outdoor...I believe is home30 and roof..30) (I'm missing some letters but the important part is the last 2 digits/numbers)
3-put microsd into camera, wait to boot....yellow light sequence....
4-enjoy (access through ip, etc)
let me know.

Hi @aelg305, how to connect to the wifi following this steps? Because after power up Camera did not recognize the QR code on App at all.

I usually connect to the Yi first (with QR code, etc) unless you have the Chinese version.
I have the regular version, which allows me to connect first and hack after and remain connected to Yi servers.

Is that your case?

Mine is Chinese version and it could not detect QR code after flashing this firmware, it was end up with blue light blinking. Plse advise

[arunsmu]

I tried all the steps mentioned in YiHackV4 .
1, I copied the downloaded contents to the fat 32 formatted sd card, with the correct name and correct file for Yi outdoor camera.
2, All the steps worked flawlessly, like yellow light blinking and other stuff.
3, It's connected to WiFi , but it's not connecting to app. If I use international version of yi home app, camera says it can only be used in China in Chinese.
If I use Chinese version, the camera says, it can only be used in China in English.
So I'm kinda stuck at this level.

Anyone here faced such issue and successfully solved this ?
Or does anyone have idea where the mistake might have happened?
Since it's not connecting to the app, I can't do anything. It'll be of great help, if anyone can help me out with this