IMOU IPC-S6DP-5M0WEB-E27 Wireless Bulb Cam 5MP (Dahua based)

[RepoLeved]

Hi everyone, I'm opening this thread to talk about this Imou IP camera, model IPC-S6DP-5M0WEB. It's a small light bulb-shaped camera with decent video resolution, night vision isn't bad either. It has a built-in microphone, speaker and car/ human detection.

Unfortunately, however, I didn't particularly prefer the fact that it sends the stream to the cloud and therefore necessarily has to go to the internet to use it, furthermore I noticed a frightening amount of requests in the LAN network so I decided to analyze it and try to enter the internal system (maybe I can modify it and use it freely as I like). For this purpose I disassembled the model and here is the information i found:










The processor seems to be an MSTAR SSC337 (Infinity 6c?) I found some info on this page linux-chenxing && infinity 6. the next step is to connect to the UART on the board and further analyze the software part. Anyone who can help please write

 

[RepoLeved]

OK I managed to access the serial...

IPL g3e8bb9d
D-00
HW Reset
miupll_200MHz
64MB
BIST0_0001-OK
RDQS cali
WDQS cali
SPI 54M

IPL_CUST g3e8bb9d

U-Boot 2010.06-git3d3a0bb (Aug 08 2023 - 10:13:25)
mount: mounting none on /proc/bus/usb failed: No such file or directory

keyboard = 1
/usr/etc/imod: line 1: #!/bin/sh: not found
default aewCfg:IPC-SC4336-MIPI
sensor Adaptive matching over
real SensorType:sc4336_MIPI
real aewCfg:IPC-SC4336-MIPI
CHMAP:4
mi_sensor
real intelli:PVD_5MB_SUPORT_NVR
mknod: /dev/mi_poll: File exists
16383+0 records in
16383+0 records out
country_code:DE
isNeedBle is 1
default fw mode is nimble
---------------- ota_update start --------------
open /dev/mmc0 failed!
---------------- ota_update end ----------------
motorDrv_no_tmi8150 36864 2 - Live 0xbfac1000 (O)
ssv6358 106496 0 - Live 0xbfaa6000 (O)
cfg80211 155648 1 ssv6358, Live 0xbfa7c000
ehci_hcd 28672 0 - Live 0xbfa71000
phy_sstar_u2phy 12288 2 - Live 0xbfa6a000
usbcore 98304 2 ssv6358,ehci_hcd, Live 0xbfa4e000
usb_common 12288 2 phy_sstar_u2phy,usbcore, Live 0xbfa47000
drv_ms_cus_sc4336_MIPI 12288 0 - Live 0xbfa40000 (PO)
mi_venc 196608 0 [permanent], Live 0xbfa0c000 (PO)
mi_vcodec 180224 1 mi_venc,[permanent], Live 0xbf9dc000 (PO)
mi_scl 163840 0 [permanent], Live 0xbf9b0000 (PO)
mi_ipu 32768 0 [permanent], Live 0xbf9a4000 (PO)
mi_isp 561152 0 [permanent], Live 0xbf917000 (PO)
mi_ai 49152 0 [permanent], Live 0xbf907000 (PO)
mi_ao 53248 0 [permanent], Live 0xbf8f6000 (PO)
mi_aio 40960 2 mi_ai,mi_ao,[permanent], Live 0xbf8e8000 (PO)
mi_rgn 77824 2 mi_venc,mi_scl,[permanent], Live 0xbf8d1000 (PO)
mi_sensor 114688 2 drv_ms_cus_sc4336_MIPI,mi_isp,[permanent], Live 0xbf8b0000 (PO)
drv_ms_cus_srcfg 12288 0 - Live 0xbf8a9000 (PO)
pdc 40960 1 motorDrv_no_tmi8150, Live 0xbf89b000 (O)
libarc4 12288 0 - Live 0xbf897000
firmware_class 12288 1 cfg80211, Live 0xbf890000
mi_vif 147456 3 mi_isp,mi_sensor,drv_ms_cus_srcfg,[permanent], Live 0xbf868000 (PO)
mi_sys 364544 10 mi_venc,mi_vcodec,mi_scl,mi_ipu,mi_isp,mi_ai,mi_ao,mi_rgn,mi_sensor,mi_vif,[permanent], Live 0xbf80b000 (PO)
mi_common 28672 10 mi_venc,mi_scl,mi_ipu,mi_isp,mi_ai,mi_ao,mi_rgn,mi_sensor,mi_vif,mi_sys,[permanent], Live 0xbf800000 (PO)
[: 4: unknown operand
BANK:0x1038 16bit-offset 0x01
0x0004
BANK:0x1038 16bit-offset 0x01
0x001C
BANK:0x1038 16bit-offset 0x01
0x003C
BANK:0x1302 16bit-offset 0x04
0xFEAB
BANK:0x1038 16bit-offset 0x50
0x0001
appauto=1
  738 root       0:00 /usr/bin/sonia
[libptz] PTZ: autotest finish

from the log the cmos sensor appears to be SC4336

https://smartsens.oss-cn-beijing.aliyuncs.com/web/products/SC4336_V2.0.pdf

.

 

[banv1194]

After updating the firmware, there are more false positives.
I want to return to the default firmware at the time of sale.
What is the default firmware version?
After the update, it is [2.800.000000.21.R.240330].

 

[RepoLeved]

Analyzing the traffic without updating i found this version, I don't know if it can be useful to you.

 

[banv1194]

Analyzing the traffic without updating i found this version, I don't know if it can be useful to you.

Thanks for the very interesting info.

 

[KasLou]

Hi, does anyone know the main stream url for this cam?

 

[Errrr]

So how would this camera function if you put it in a fitting with glass around. Specially when the light comes on at night? Would that glare on the glass from the inside and influence the camera view quality?

 

[RepoLeved]

I managed to find this information about it and it is a good basis for porting openipc

• SoC: SSC377
• RAM: 64MB
• Sensor: SC4336 MIPI
• Wi-Fi: SSV6358
• Flash: SPI 16MB
• Board: infinity6c-ssc027a-s01a

for wifi we can use the blobs extracted from the .zip ota package:

• ssv6358.ko
• firmware:
  • ssv6358-sw.bin
  • ssv6358-sw_nimble.bin
• config:
  • ssv6358-wifi.cfg

and there are also iq files:


/usr/data/2Acfg/IPC-SC4336-MIPI/
├── iqfile_day.bin
├── iqfile_night.bin
├── iqfile_wdr.bin


I extracted the ota firmware with binwalk and the OTA update uses the internal Sonia software which writes the file system, kernel etc,
see .zip file above 1703558448876_LC_IPC-Consumer-Zi-Kant_Eng_P_SSV6355_V2.800.0000000.15.R.231206


{
"Commands": [
"burn kernel.img kernel",
"burn partition-x.cramfs.img partition",
"burn romfs-x.squashfs.img rootfs",
"burn dhboot.bin.img bootloader"
]
}

the partition map is this

0x00000000–0x00030000 "U-Boot" (192 KB)
0x00030000–0x00040000 "hwid" (64 KB)
0x00040000–0x00050000 "partition" (64 KB)
0x00050000–0x00350000 "Kernel" (3 MB)
0x00350000–0x00e50000 "romfs" (11 MB)
0x00e50000–0x00f60000 "syslog" (704 KB)
0x00f60000–0x00fb0000 "config" (320 KB)
0x00fb0000–0x01000000 "backup" (320 KB)


I need a hand to compile openipc kernel and partition and load it with ota simulating an update, tell me your opinion about it, ideas etc. The main reason why I would like this is that camera uses too much traffic and saturates the network with scanning requests, also for the stream it uses an external server it is not direct so it is not usable without internet