shadow-1 / yi-hack-v3

Alternative Firmware for Xiaomi Cameras based on Hi3518e Chipset

yi-hack-v3

This project is a collection of config files, Makefiles and scripts to allow custom firmware images to be created and deployed to extend the functionality of Xiaomi Cameras based on HiSilicon Hi3518e V200 chipset.

Currently this project supports:

• Yi Home 17CN / 27US / 47US
• Yi 1080p Home
• Yi Dome
• Yi 1080p Dome
• Yi Outdoor

Acknowledgments

Special thanks for GearBest for generously donating a Yi Dome camera so I could further develop this firmware. Without having a camera to develop on, it would not have been possible to develop past the initial firmware releases. Consider having a look at the following special GearBest links:

• Yi Home
• MiJia Smart Camera
• MiJia Smart 720p

I would like to also thank the following projects for their efforts on other Xiaomi cameras and giving inspiration for me to develop and publish my own custom firmware.

fritz-smh : https://github.com/fritz-smh/yi-hack

niclet : https://github.com/niclet/yi-hack-v2

xmflsct : https://github.com/xmflsct/yi-hack-1080p

Table of Contents

• Features
• Cameras that are Region Locked to Mainland China
• Getting Started - Step by Step Guide
• Which Smartphone App to use?
  • Chinese Version of the Camera
  • International Version of the Camera
• Using the Camera
  • Telnet Server
  • FTP Server
  • Startup Shell Script
  • External Programs and Libraries
  • Which Version is Installed?
• Going Back to Stock Firmware
• Development

Features

The supported cameras have the following features by default:

• Wifi
• Motion detection - a video file is generated if a motion have been detected in the last 60 seconds.
• Send video/audio data through a cloud service to allow people to view camera data from their smartphone wherever they are.
• Setup through smartphone app.
• Local video storage on microSD card.

This firmware includes:

• SSH server - Enabled by default.
• Telnet server - Disabled by default.
• FTP server - Enabled by default.
• Web server - Enabled by default.
• Proxychains-ng - Enabled by default. Useful if the camera is region locked.

Cameras that are Region Locked to Mainland China

This firmware includes Proxychains-ng. This allows communication between the camera and Xiaomi server to be routed through a proxy server. If Proxychains-ng is configured with a proxy server from Mainland China, the camera will no longer be region locked.

Performance is not degraded as the cameras video/audio feed is not routed through the proxy server.

Getting Started - Step by Step Guide

1. Check that you have a correct Xiaomi Yi camera. Currently four (4) series of cameras are supported:

• Yi Outdoor
• Yi Home 17CN / 27US / 47US Camera
• Yi 1080p Home Camera
• Yi Dome Camera
• Yi 1080p Dome Camera

2. Get an microSD card, preferably of capacity 16gb or less and format it by selecting File System as FAT32.

IMPORTANT: The microSD card must be formatted in FAT32. exFAT formatted microSD cards will not work.

3. Get the correct firmware files for your camera from this link: https://github.com/shadow-1/yi-hack-v3/releases

Camera	rootfs partition	home partition	Remarks
Yi Home	-	-	Not yet supported.
Yi Home 17CN / 27US / 47US	rootfs_y18	home_y18	Firmware files required for the Yi Home 17CN / 27US / 47US camera.
Yi 1080p Home	rootfs_y20	home_y20	Firmware files required for the Yi 1080p Home camera.
Yi Dome	rootfs_v201	home_v201	Firmware files required for the Yi Dome camera.
Yi 1080p Dome	rootfs_h20	home_h20	Firmware files required for the Yi 1080p Dome camera.
Yi Outdoor	rootfs_h30	home_h30	Firmware files required for the Yi Outdoor camera.

4. Save both files on root path of microSD card.

IMPORTANT: Make sure that the filename stored on microSD card are correct and didn't get changed. e.g. The firmware filenames for the Yi 1080p Dome camera must be home_h20 and rootfs_h20.

5. Remove power to the camera, insert the microSD card, turn the power back ON.

6. The yellow light will come ON and flash for roughly 30 seconds, which means the firmware is being flashed successfully. The camera will boot up.

7. Install the correct smartphone app onto your smartphone. Refer to Which Smartphone App to use? for guidance.

8. Configure the camera as normal by scanning the QR code on the smartphone. Ensure that your smartphone is connected to 2.4GHz wireless network.

9. Blue light should come ON indicating that your WiFi connection has been successful.

10. Although the WiFi connection on your camera has been successful but you won't be able to pair it with your phone yet until you perform the following steps.

11. Go in the browser and access the web interface of the camera as a website. By default, the hostname of the camera is yi-hack-v3. Access the web interface by entering the following in your web browser: http://yi-hack-v3

Depending upon your network setup, accessing the web interface with the hostname may not work. In this case, the IP address of the camera has to be found. This can be found on most routers. Alternatively you can install an app on your phone to scan your wifi network. Android users can install "Network Scanner" and run it to find the IP address of the camera. e.g. 192.168.1.5. The camera should be listed as . Access the web interface by entering the IP address of the came in a web browser. e.g. http://192.168.1.5

IMPORTANT: If you have multiple cameras. It is important to configure each camera with a unique hostname. Otherwise the web interface will only be accessible by IP address. The hostname can be configured from the web interface of the camera on the "System Config" page.

12. It will open a configuration page of the camera.

13. For those with the International Version of the Camera. ProxyChains-ng is not required. It can be disabled by going to "System Config", select "No" against Proxy-Chains-ng and clicking "Apply". No further configuration is required.

14. For those with the Chinese Version of the Camera. ProxyChains-ng is required to be configured. The quickest way to configure ProxyChains-ng is to utilise the Download Proxy List feature in the firmware.

15. Click "Download Proxy List".

16. Click "Download Proxies". By default, the firmware will download a list of proxy servers and choose 10 at random. Each proxy server is automatically tested to ensure that it is operational. Each operational proxy server located within Mainland China is selected to be saved automatically.

17. Once the proxy server list has been generated and tested. Click "Save Selected Proxies". Every proxy server which has the check box next to it checked will be saved.

18. Wait 30-40 seconds and try to connect from your smartphone.

Which Smartphone App to use?

Chinese Version of the Camera

The Chinese version of the camera will only work with the Chinese version of the app.

Android users, download the Chinese version of the Yi Home app. It is available from the Mi Store. Link: http://app.mi.com/details?id=com.ants360.yicamera

Alternatively, an APK file which can be installed manually is available from here under the directory 'Yi Home - Android': https://app.box.com/s/cibs7n1mgvhqaqjlidtveegu1uajt5yr

iPhone users will need to change their App Store to the Chinese App Store and install Chinese version of the Yi Home app. Link: https://itunes.apple.com/cn/app/xiao-yi-zhi-neng-she-xiang-ji/id931168730

International Version of the Camera

The International version of the camera will only work with the International version of the app.

Android users can download the International version of the Yi Home app from the Google Play Store. Link: https://play.google.com/store/apps/details?id=com.ants360.yicamera.international

iPhone users can download the International version of the Yi Home app from the App Store. Link: https://itunes.apple.com/au/app/yi-home/id1011626777?mt=8

Using the Camera

SSH Server

The SSH server is on port 22.

Default user is root. Password is blank.

Telnet Server

The telnet server is on port 23.

Default user is root. Password is blank.

FTP Server

The FTP server is on port 21.

Default user is root. Password is blank.

Startup Shell Script

On the microSD card. The following shell script is executed after the camera has booted up within a folder named yi-hack-v3:

startup.sh

External Programs and Libraries

Xiaomi cameras have very limited free space available for additional programs or libraries. However these can be stored on the microSD card where they can be utilised from there.

Place additional programs compiled for the camera in either of these folders on the microSD card:

yi-hack-v3\bin
yi-hack-v3\sbin

Place additional libraries compiled for the camera in the following folder on the microSD card:

yi-hack-v3\lib

Which Version is Installed?

The base firmware (Xiaomi firmware) version and y-hack-v3 firmware version is accessible through the webinterface on the About page.

Going Back to Stock Firmware

Recovery images have been created to go back to stock firmware. You can download the recovery images from here under the directory 'yi-hack-v3/Recovery': https://app.box.com/s/cibs7n1mgvhqaqjlidtveegu1uajt5yr

Camera	rootfs partition	home partition	Remarks
Yi Home	rootfs	home	Stock firmware is version 1.8.7.0D_201708091510.
Yi Home 17CN	rootfs_y18	home_y18	Stock firmware is version 1.8.7.0C_201705091058.
Yi Home 27US / 47US	rootfs_y18	home_y18	Stock firmware is version 1.8.7.0A_201702081101.
Yi 1080p Home	rootfs_y20	home_y20	Stock firmware is version 2.0.0.1A_201612051401.
Yi Dome	rootfs_v201	home_v201	Stock firmware is version 1.9.1.0F_201701041701.
Yi 1080p Dome	rootfs_h20	home_h20	Stock firmware is version 1.9.2.0C_201611011902.
Yi Outdoor	rootfs_h30	home_h30	Stock firmware is version 3.0.0.0A_201710131102.

Development

TODO

yi-hack-v3's Issues

I have a question

Hi~
thank you for your development.

I'm not fluent English.
I'm using Yi Dome camera. (china version)

1. When I connect my internal proxychains-ng setup page → and test proxy test page
   some error occured.

ERROR : ERROR (1524) : Child process 31 ended abruptly Status Code : 23827736

ERROR : ERROR (10) : Could not start external process.

2. Using yi home app(android) and then I connect my camera, sometimes can't connect
   (※ test config result is good)

Set Camera to Record to SD without wifi?

I have a "27US" 720p YI home camera that has the hi3518v200 chip and of all the hacks I've been able to find, yours is the only one that does something (0.1.4-beta2). Is there a way to set the camera to record to SD when there is no wifi in range? I can access the camera web interface and telnet, and it records and streams to the YI app when in range of my home wifi but I want to set it up in a remote location with no wifi access. Right now it looks for network connection (blue LED blinking) for a short time then reboots.

Can i do a firmware update?

Hi,

i am using the yi camera 1080p black dome camera....

I saw there is a update avail...can i update? will it break the whole thing?

Regards
Daniel

Hack for new Xiaomi yi Cloud Camera

I found the new Xiaomi Cloud camera is cheap, but I am not sure whether there will be a SD card slot to hack. Anyone tested this one. http://item.jd.com/4230953.html

Mijia 1080 support ?

will the new XIAOMI Mijia 1080 cam be supported in future or is it already ?

http://www.geekbuying.com/item/Xiaomi-Mijia-Smart-IP-Camera-1080P---White-376769.html

RTSP Server

Great job guys with these projects, very impressive.
I just bought a new Yi 1080 Dome thinking the V1 hack could get me into the RTSP server to leverage with my BlueIris software, then when I was installing the new new Hack (v3), I realized it's not available.

Before I return this camera, just want to check with you if there's any plan soon to get RTSP?

Thanks again

John.

Can use it in Yi Dome Camera?

Non the 1080p dome version.
Can I help to make this firmware compatible with Yi Dome Camera?

How can I apply it to the YI Home 1080p?

How can I apply it to my cam? I'm using the latest hack which provides RTSP stream but I like to use the official app and bypass the region ban.

How to send control commands to YI Dome 1080p and YI Dome cameras?

Hello!

Sorry for raining issues on your head ...
Is it possible to send control commands for the Dome camera:

• rotate left / right / up / down
• zoom (digital, right?)
• pan (if there is a digital zoom there should be pan available, right?).

Thank you for doing this great work!

Regional ban hack guide

Can provide step by step guide to configure proxychains-ng...no exprince on that

Faking camera region

Isn't it possible to fake camera's region instead of using a proxy? something like it's a US version.

How to fix bricked camera?

HI

Got my camera in a bootloop / bricked after installing the latest yi-hack-v3 home_y18 hack.
any ideas?

Best Regards
Mark

Прошивка home_h20m

Hey. Is it possible to add a solution for the firmware home_h20m?

The Camera Does Not Appear On My Apps

Hi,
THanks for the useful guide.
I have downloaded the firmware and the relevant apps for china version of YI CAM 1080P ( not the new one, is the one similar to the 720p design but 1080P ).
And successfully paired it with the apps, HOWEVER, the camera does not show in the apps.
What seems to be wrong here ? Is it something i misdone ? cos pairing is successful.

Location : Malaysia

Are there options for lowering the firmware Dome Camera?

What should I do if rootfs_v201 was not written to the SD card? How to put it if home_v201 was installed without it?
Are there options for lowering the firmware? That would repeat everything correctly

27US almost works, problems with WPA crashing

The latest beta https://github.com/shadow-1/yi-hack-v3/releases/tag/0.1.4-beta2 got me the furthest on my 27US model camera.

It scans the QR code properly, setting the right info into WPA_supplicant.conf but wpa crashes with a log file named log_no_wifi_dev.tar.gz which to my untrained eye sounds like it can't find the wifi device?

Its so close to working! Anybody have any ideas or tips?

can't pair with smarthphone

Hey there.
Thanks for your work on this cameras.
Can you give me advice? I can't pair with yi home app. It errors on timeout.
But webinterface and ftp are works
My camera is yi home 1080p

Trigger "only can be used in china""

hi, my yi dom sometimes triggered only can be used within china, but when i restart the camera it works perfectly again. I have check the proxy it is alive

How to identify Yi-Home 17CN camera?

I would like to use the latest v3 hack to my existing 2 720p cameras. How do I make sure those are Yi-Home 17CN cameras?. The cpuinfo is below

Processor       : ARM926EJ-S rev 5 (v5l)                                                                                                
BogoMIPS        : 218.72                                                                                                                
Features        : swp half thumb fastmult edsp java                                                                                     
CPU implementer : 0x41                                                                                                                  
CPU architecture: 5TEJ                                                                                                                  
CPU variant     : 0x0                                                                                                                   
CPU part        : 0x926                                                                                                                 
CPU revision    : 5                                                                                                                     
                                                                                                                                        
Hardware        : hi3518                                                                                                                
Revision        : 0000                                                                                                                  
Serial          : 0000000000000000

Can startup.sh be deleted after device connected successfully ?

Can startup.sh be deleted after device connected successfully ? or it should be in there forever ?

Time zone setting

Xiaomi Yi Dome 720 p

How to set your time zone?
For your country

Yi Home Camera 2 support

Hi,

I purchased the International version of Yi Home Camera 2 from https://yitechnology.com/yi-1080p-home-camera-2

Can I use your yi-hack-v3 y20 firmware for this?

Thank You.

Binding success but not camera added in main menu

Thx for the hack. But I have a problem that I can not add the camera.

ProxyChains-ng is configured and I sure that the binding has completed successfully, but after returning to main screen of App, there is not camera shown.

Is there any help on this?

Thx.

The ability to record video in the cloud

Good afternoon, tell me it will be possible in future versions of the firmware to record video for example in the cloud google or something else?
Are there any more ways to connect the camera region of China without using Proxychains?
p.s I apologize for my English translate Google translit )

How to compile my own firmware?

Is there is a way to compile my own firmware resulting only home_v201 for Yi Dome?

"403 Forbidden File is protected" couple hours after crack

I'm using Yi Dome, purchased from China and now is using in Australia.
It worked perfectly after strictly following instructions. However, when back after couple hours, i could not connect it any more

1. On Android App(Yi Home), it shows: Offline at xxxx
2. On PC, trying to open it's configure url (192.168.1.102), it comes no response. Instead, there's a new url(192.168.1.123) showing in network scanner app and if you open it in browser, it shows a page of 403 Forbidden
   File is protected.

To be noted, the original url, which is used to configure proxy list

Appreciate anyone could help me out.

How and where to put IP address

Dear Sir,
Thank you for good job is rooting my yi camera Chines V.
I had flash the toot and Home file on the camera. but I did not understand where and how to put the Ip address. and how to find IP that work.

Thank you

Not able to open the IP address in the browser

Hi there,

I found the IP address that's assigned to the camera, but when I entered it in the browsers (IE, Firefox, Google Chrome) I received the message "403 forbidden File is protected".

Not sure if the router setting needs to be changed. I did some searching and tried to change the settings in router and the network, but it's still not working. Just wonder if you know how to resolve it.

Thank you

1.9.1.0H_20170622 for Dome Camera

Hi. There is a new firmware for the Yi Dome Camera, 1.9.1.0H_20170622. Could you hack this new firmware so I can use it on my chinese camera? I already use the v3 hack and it works very nice, but I hope that this new firmware could be better and maybe add new features. Thanks.

connecting to android app

Dear Sir,
The camera connected to the Wifi successfully but I can't connect it to the android app.( I installed the android app from the link u gave). It gave me (Fail To load, Please reset the camera).
I tried to connect it with other phone but it didn't work.
any solution please!

Proxy Server Connection Failed. Ensure that ProxyChains-ng has been configured.

I can't seem to get it working, trying hundreds of different proxy from GatherProxy.com, either one at a time or two or three at a time, none of those is working at all.

I have flashed the firmware to the latest version (v 0.1.2) and everything seems to be working with WiFi connected sucessfully. The ProxyChains-ng just wont do it.

Files not being read

Dear Shadow,

Thanks for all your work, I am truly impressed.

However, I tried to follow your steps but, my Yi Dome didn't seem to read the files.

On your step 6. "The yellow light will come ON and flash for roughly 30 seconds, which means the firmware is being flashed successfully. The camera will boot up."

When I powered it on, it didn't have the symptom as you mentioned (30seconds). It get to the "Waiting for connect" state pretty quick. I have tried multiple times with countless of format to FAT32.

My device serial number is 13CNxxxxx
Mine is Yi Dome (1.9.1.0G_201701161401), I downloaded the firmware from http://www.xiaoyi.com/home/firmware/download/?version=3.

Hope to hear from you soon.

Cheers,
Sam

Is here any script or API for getting the current frame of the camera?

I want to use telnet to login the camera, then take a snapshot and use ftp to pull back to my home assistant.

Is there any way to do this?

Thanks.

Does this support the Yi Home 720p camera?

https://www.amazon.com/gp/product/B016F3M7OM/ref=oh_aui_search_detailpage?ie=UTF8&psc=1

EDIT:
Seems this does not work? I have the white version (YHS-113-IR) firmware (1.8.7.0A_201702081101).

I formatted the SD card (32GB, is that a problem? I noticed you said preferred 16GB) as FAT32. I copied both files (rootfs_y20 and home_y20) to the now blank card, in the home directory.

The camera boots orange light, does its clicking etc, andthe light goes out (as I configured) and nothing happens, same access via app.

Do I need to reset the camera first or is this just simply not supported? If not, what firmware had native RSTP access? I want to try to downgrade if this will not work. I want to used this with iSpy.

'startup.sh' does not start after boot.

I created startup.sh in root dir on sdcard, after reboot it did not run

/tmp/sd # ls -la startup.sh
-rwxr-xr-x    1 root     root            29 Apr 16 00:24 startup.sh

/tmp/sd # cat startup.sh
echo test > /tmp/sd/test.log

/tmp/sd # ls -la test.log
ls: test.log: No such file or directory

Camera Yi Dome
Base Firmware 1.9.1.0G_201701161401
yi-hack-v3 Firmware 0.1.2

Access Video Files Over FTP

How can you access video files over FTP?
SD Card does not appear to be mounted in the FTP server.
However, I can see the files when pulling the SD Card and looking in a card reader.

V3 Software dont seems to be able to work..

Save to SD card

Hello,

First off, thank you for taking the time to create the hack and to keep updating it. It's really appreciated.

I successfully hacked two 360 Dome Cameras (Black) and they work fine when viewing real-time. However, I noticed that the cameras are not saving anything to the SD card. Normally, with older model cameras as my reference, the cameras will keep a rolling recording on the SD card, so you can track back as needed.

Is there something I need to configure in regards to the hack to get this working?

Thanks.

Stick to blue LED

I've tried various proxies, checked them to make sure they are from China, and tried both YI Home and YI Smart (from Chinese App Store), but still cannot pair the cam. How can I troubleshoot the problem?

Does the proxy need to be alive for the entire time or only when initial conection ?

Hi,

Does the proxy need to be alive for the entire time or only when initial conection ?

What happen if the proxy is dead when we use the cam ?

Thanks

Auto turn on and off alerts of motion detection

Hello,
Is there any option to turn on and off alerts of motion detection when my mobile phone (android) is on particular wifi.
The time customization of alerts built in app isnt the best for me..

I have an idea, when my phone connects to my wifi, it will send command via telnet (or...?) to activate motion detection.. It is even possible? I tried connect to telnet:

Built-in commands:

    . : [ [[ alias bg break cd chdir command continue echo eval exec
    exit export false fg getopts hash help history jobs kill let
    local printf pwd read readonly return set shift source test times
    trap true type ulimit umask unalias unset wait

Not really wise of those :)

Thank You

can't pair with app because wifi password error

i set HTTPS on ProxyChains-ng and enable it, but i cannot pair camera with app. my camera say "wifi password error" (china language).I tried many times and was sure the password was correct. help me to to solved this issue. thank you

https://www.mx7.com/view2/zNsG8cVcovqOLrCG

What cause slow "Retrieving Pairing Status" ?

What cause slow "Retrieving Pairing Status" ? Even if we got nice working proxy, just for info I use beta-1 version.

Thanks!

Will this "hack" be available for YI Home camera (aka Ant)?

Hello!

Is it possible to use this hack for YI Home camera? The "/fritz-smh/yi-hack" project works with the very old firmware and, in fact, I had problems to make it work at all. If you can describe how to compile new fw for YI Home camera - as you did in another issue - I will try to follow and share the experience.

Thank you for providing the "hack"!

Is It possible to support the latest firmware 2.1.0.0A_201703071456home_y20m for Yi 1080p Home?

I work on the latest firmware of yi camera 1080p home recently and I'm not quite good at hardware hacking. Since the firmware is encrypted, I can't extract the filesystem from the firmware. If you have the extracted version of 2.1.0.0A_201703071456home_y20m, can you share it? Thanks a lot.

Proxy cant connect

Cant conncect camera

Settings:

/ # proxychains4 wget -O- -q http://ipinfo.io
[proxychains] config file found: /home/app/proxychains.conf
[proxychains] preloading /home/app/locallib/libproxychains4.so
[proxychains] DLL init: proxychains-ng 4.12
[proxychains] Random chain ... 123.56.199.203:5271 ... 34.202.90.94:80 ... OK
{
"ip": "47.88.79.0",
"hostname": "No Hostname",
"city": "Hong Kong",
"region": "HONG KONG",
"country": "HK",
"loc": "22.2833,114.1500",
"org": "AS45102 Alibaba (China) Technology Co., Ltd."
}/ #

but

help?

Does this hack work for my YI Home cameras?

Hi. I have two YI Home 720p cameras, with those serial numbers (they're pretty old, I bought them 1-2 years ago):

1. 12CNBJOX18
2. 2FAPHFLRD8

Will yi-hack work for those cameras? For the moment I keep the 1.8.6.1B official firmware on both of them because I think that both are Chinese versions and I'm afraid that if I update the firmware they will no longer work. Thanks.

When will this support YI Home Camera 2 1080p ?

This is the 2nd version of the camera. When will you support this? Thank You..

FTP server and password

Hello,

Is there any way to add password authentication to the ftp server?

thank you

rootfs_h20 and home_h20

I am very new to this. How do I hack my Yi Dome camera step by step. I cant figure out what the rootfs_h20 and home_h20 are.

Thank you,
Ed