├── SDcard ├── CRON │ ├── cron.log │ └── root ├── wget ├── busybox ├── MONITORING │ ├── curl │ ├── reredirect │ ├── mosquitto_pub │ ├── telegram-bot-info │ ├── send_bell_mqtt │ ├── parse_push │ └── send_pic_telegram ├── UTILITIES │ ├── nano │ └── terminfo │ │ ├── a │ │ └── ansi │ │ └── v │ │ ├── vt102 │ │ └── vt220 └── nano ├── LICENSE ├── dhcp.script └── README.md /SDcard/CRON/cron.log: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /SDcard/wget: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/phpcoder/doorbell-customize/HEAD/SDcard/wget -------------------------------------------------------------------------------- /SDcard/busybox: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/phpcoder/doorbell-customize/HEAD/SDcard/busybox -------------------------------------------------------------------------------- /SDcard/MONITORING/curl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/phpcoder/doorbell-customize/HEAD/SDcard/MONITORING/curl -------------------------------------------------------------------------------- /SDcard/UTILITIES/nano: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/phpcoder/doorbell-customize/HEAD/SDcard/UTILITIES/nano -------------------------------------------------------------------------------- /SDcard/nano: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | export TERMINFO=/mnt/disc1/UTILITIES/terminfo 3 | /mnt/disc1/UTILITIES/nano $1 4 | 5 | -------------------------------------------------------------------------------- /SDcard/MONITORING/reredirect: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/phpcoder/doorbell-customize/HEAD/SDcard/MONITORING/reredirect -------------------------------------------------------------------------------- /SDcard/MONITORING/mosquitto_pub: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/phpcoder/doorbell-customize/HEAD/SDcard/MONITORING/mosquitto_pub -------------------------------------------------------------------------------- /SDcard/UTILITIES/terminfo/a/ansi: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/phpcoder/doorbell-customize/HEAD/SDcard/UTILITIES/terminfo/a/ansi -------------------------------------------------------------------------------- /SDcard/UTILITIES/terminfo/v/vt102: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/phpcoder/doorbell-customize/HEAD/SDcard/UTILITIES/terminfo/v/vt102 -------------------------------------------------------------------------------- /SDcard/UTILITIES/terminfo/v/vt220: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/phpcoder/doorbell-customize/HEAD/SDcard/UTILITIES/terminfo/v/vt220 -------------------------------------------------------------------------------- /SDcard/MONITORING/telegram-bot-info: -------------------------------------------------------------------------------- 1 | For Telegram bot creation and generation self-signed certificate see instructions in 2 | https://core.telegram.org/bots/api 3 | https://core.telegram.org/bots/self-signed 4 | 5 | Your certificate keyfile should be copied into this directory as cacert.pem. 6 | -------------------------------------------------------------------------------- /SDcard/CRON/root: -------------------------------------------------------------------------------- 1 | # Example of job definition: 2 | # .---------------- minute (0 - 59) 3 | # | .------------- hour (0 - 23) OR 5,18 OR 8-17 4 | # | | .---------- day of month (1 - 31) 5 | # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... 6 | # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat 7 | # | | | | | 8 | # * * * * * 9 | 10 | # reboot every hour 11 | 15 * * * * reboot 12 | -------------------------------------------------------------------------------- /SDcard/MONITORING/send_bell_mqtt: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # This example publishes two MQTT messages for DOMOTICZ Home Automation system 4 | # Fill in your MQTT broker's IP/Port number and topic/message 5 | 6 | /mnt/disc1/MONITORING/mosquitto_pub -h 192.168.1.3 -p 1883 -t "domoticz/in" -m '{"command":"switchlight", 7 | "idx" : 79, "switchcmd": "On"}' 8 | /mnt/disc1/MONITORING/mosquitto_pub -h 192.168.1.3 -p 1883 -t "domoticz/in" -m '{"command":"switchlight", 9 | "idx" : 119, "switchcmd": "On"}' 10 | 11 | -------------------------------------------------------------------------------- /SDcard/MONITORING/parse_push: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | 4 | # Check if process is already running 5 | if /mnt/disc1/busybox pgrep -f keyup >/dev/null 6 | then 7 | echo "Process is running." 8 | else 9 | echo "Process is not running." 10 | 11 | 12 | # Read the PID of npc process 13 | PID=`/mnt/disc1/busybox pgrep /npc/npc` 14 | /mnt/disc1/MONITORING/reredirect -m /npc/myfifo $PID 15 | 16 | # Monitor the npc log for a push button message 17 | while true; 18 | do 19 | if /mnt/disc1/busybox grep -q "keyup" /npc/myfifo 20 | then 21 | echo "Button is pushed" 22 | /mnt/disc1/MONITORING/send_bell_mqtt 23 | /mnt/disc1/MONITORING/send_pic_telegram 24 | fi 25 | /mnt/disc1/busybox sleep 2 26 | done 27 | 28 | fi 29 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2021 phpcoder 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /SDcard/MONITORING/send_pic_telegram: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # Sends a message to a Telegram bot with an attached image. 4 | # Alarm with taking snapshot should be enabled in the doorbell 5 | 6 | # Today's date - such dir should be created for alarm pics 7 | DIR=`date +%Y-%m-%d` 8 | 9 | # Alarm picture storage 10 | PTH="/mnt/disc1/npc/push/alarm" 11 | 12 | # Wait until snapshot is taken 13 | #/mnt/disc1/busybox sleep 5 14 | 15 | # Find latest image in the current date folder 16 | LATEST=`ls -t ${PTH}/${DIR} | /mnt/disc1/busybox head -1` 17 | # Full filename with path 18 | FILE=${PTH}/${DIR}/${LATEST} 19 | 20 | # Timestamp of the file creation date 21 | TS=`/mnt/disc1/busybox stat -c %Y ${FILE}` 22 | 23 | # File creation date in readable format 24 | FDATE=`date -d @${TS} +'%Y-%m-%d %H:%M:%S'` 25 | 26 | # Send latest image 27 | # Fill in your Telegram bot info: : and 28 | /mnt/disc1/MONITORING/curl --cacert /mnt/disc1/MONITORING/cacert.pem \ 29 | -ks -X POST "https://api.telegram.org/:/sendPhoto?chat_id=" \ 30 | -F photo=@${FILE} \ 31 | -F caption="Doorbell ring !!! ${LATEST} - Created at ${FDATE}" > /dev/null 32 | -------------------------------------------------------------------------------- /dhcp.script: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # udhcpc script edited by Tim Riker 4 | 5 | [ -z "$1" ] && echo "Error: should be called from udhcpc" && exit 1 6 | 7 | RESOLV_CONF="/mnt/ramdisk/resolv.conf" 8 | [ -n "$broadcast" ] && BROADCAST="broadcast $broadcast" 9 | [ -n "$subnet" ] && NETMASK="netmask $subnet" 10 | 11 | case "$1" in 12 | deconfig) 13 | /sbin/ifconfig $interface 0.0.0.0 14 | killall telnetd 15 | ;; 16 | 17 | renew|bound) 18 | /sbin/ifconfig $interface $ip $BROADCAST $NETMASK 19 | 20 | if [ -n "$router" ] ; then 21 | echo "deleting routers" 22 | while route del default gw 0.0.0.0 dev $interface ; do 23 | : 24 | done 25 | 26 | metric=0 27 | for i in $router ; do 28 | route add default gw $i dev $interface metric $((metric++)) 29 | done 30 | fi 31 | 32 | echo -n > $RESOLV_CONF 33 | [ -n "$domain" ] && echo search $domain >> $RESOLV_CONF 34 | for i in $dns ; do 35 | echo adding dns $i 36 | echo nameserver $i >> $RESOLV_CONF 37 | done 38 | 39 | echo "** Start telnetd" 40 | /usr/sbin/telnetd 41 | # echo "** Disable WLAN" 42 | # /sbin/ifconfig wlan0 down 43 | # echo "** Start ftpd" 44 | # /mnt/disc1/busybox tcpsvd -vE 0.0.0.0 21 ftpd -w / 45 | echo "** Start monitoring" 46 | /mnt/disc1/MONITORING/parse_push & 47 | echo "** Start Cron" 48 | /mnt/disc1/busybox crond -L /mnt/disc1/CRON/cron.log -l 0 -c /mnt/disc1/CRON/ 49 | ;; 50 | esac 51 | 52 | exit 0 53 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Customize HiSilicon Linux based Video Doorbells 2 | This project describes some ideas on customizaiton of Smart Video Doorbells (HiSilicon hi3518ev200 SoC) compatible with Yoosee type of firmware. The method adds new functionality to stock devices: 3 | * sending messages to a MQTT broker, e.g. on ring button push 4 | * sending messages to a Telegram bot with attached images e.g. on ring button push 5 | * adds busybox with extended command set 6 | * adds cron jobs e.g. to reboot the device on schedule 7 | 8 | Additionally, for extra security it is possible 9 | * to disable Wifi daemon if the doorbell uses wired network connection, 10 | * to install a firewall to prevent "calling home" by the doorbell firmware, however it also disconnects compatible mobile apps. 11 | Such solution is not covered by the current version of the project. 12 | 13 | 14 | ## Compatible devices 15 | There are many video doorbell devices and IP cameras available from various makers with similar hardware. Many of them are designed to be compatible with firmware from a few major firmware makers, notably Gwelltimes or Yoosee. This project covers doorbell devices with firmware named as 13.xx.xx.xx with HiSilicon hi3518ev200 SoC onboard. Compatibility with other devices is not tested. 16 | 17 | 18 | ## Adding telnet and repacking stock firmware 19 | Customization described in this project requires an access to the divice Linux CLI. By default the device firmware disables external telnet access. To enable it, it is necessary to get to the doorbell's PCB and have an extra UART TTL device attached to proper pads which then connects to the device Linux console. PCBs from different makers may vary in UART pin location. However, it maybe possible to enable telnet without opening the case. It requires flashing a custom firmware with a telnet daemon running. 20 | 21 | It is easy to unpack the downloaded Yoosee firmware package and add a few lines of code into `/npc/dhcp.script` to start a telnet daemon at boot time: 22 | 23 | ```bash 24 | echo "** Start telnetd" 25 | /usr/sbin/telnetd 26 | ``` 27 | However, flashing of a modified firmware into your device will be impossible: the package needs to be signed. Fortunately the [Firmware packing tools](https://github.com/zzerrg/gmfwtools) by @zzerrg are here to help. The unpacking/packing process is described there in detail. The latest firmware version successfully repacked by the author with the described methods is 13.01.00.98. 28 | 29 | A repacked firmware shall be copied to the SD card root as `npcupg.bin`. The Yoosee mobile app will indicate the update available, and after updating the doorbell can be accessed via telnet using the doorbell's IP and user `root` without password. 30 | 31 | ``` 32 | $ telnet 192.168.1.2 33 | Trying 192.168.1.2... 34 | Connected to 192.168.1.2. 35 | Escape character is '^]'. 36 | 37 | (none) login: root 38 | Welcome to HiLinux. 39 | ``` 40 | 41 | 42 | ## CPU and device info 43 | After successful login the information on the SoC used in the device can be seen. The system customized in this project shows the following info: 44 | 45 | ```bash 46 | cat /proc/cpuinfo 47 | Processor : ARM926EJ-S rev 5 (v5l) 48 | BogoMIPS : 269.10 49 | Features : swp half fastmult edsp java 50 | CPU implementer : 0x41 51 | CPU architecture: 5TEJ 52 | CPU variant : 0x0 53 | CPU part : 0x926 54 | CPU revision : 5 55 | 56 | Hardware : hi3518ev200 57 | Revision : 0000 58 | Serial : 0000000000000000 59 | ``` 60 | 61 | The Linux version can be checked too, but to see it, you need a busybox binary with an extended command set. The space on a device's writable partition `/npc` is limited and almost full with the files supplied by the firmware: 62 | 63 | ```bash 64 | /mnt/disc1/busybox df -h 65 | Filesystem Size Used Available Use% Mounted on 66 | /dev/root 2.5M 2.5M 0 100% / 67 | tmpfs 11.9M 4.0K 11.9M 0% /dev 68 | /dev/ram0 62.0M 1.3M 57.4M 2% /mnt/ramdisk 69 | /dev/ram0 62.0M 1.3M 57.4M 2% /etc 70 | /dev/ram0 62.0M 1.3M 57.4M 2% /tmp 71 | /dev/mtdblock3 320.0K 208.0K 112.0K 65% /rom 72 | /dev/mtdblock4 2.8M 2.7M 80.0K 97% /npc 73 | /dev/mmcblk0p1 7.5G 52.0M 7.5G 1% /mnt/disc1 74 | ``` 75 | A remaining space is enough only for a few scripts, but for any binary it may not be enough. Therefore all necessary files should be placed on an SD card mounted at `/mnt/disc1`. For a convenience, this project repository contains some binaries cross-compiled for HiSilicon SoC. With the help of a provided [busybox binary](SDcard/busybox) placed to SD card root, the Linux version, as well as a mentioned partition list `df -h` shown above can be seen: 76 | 77 | ``` 78 | # /mnt/disc1/busybox uname -a 79 | Linux (none) 3.4.35 #61 Wed Aug 30 18:45:19 CST 2017 armv5tejl GNU/Linux 80 | ``` 81 | 82 | ## Customizing your doorbell 83 | Provided you succeeded with a repacking of a telnet enabled firmware, or found a compatible custom firmware pack elsewhere, you can start adding new functionality. In fact, no other firmware modification is necessary. Everything else is added to the existing writable partition and to the external SD card. 84 | 85 | 1. Add the following code into `/npc/dhcp.script` together with previously added telnet code: 86 | 87 | ```bash 88 | echo "** Start telnetd" 89 | /usr/sbin/telnetd 90 | # echo "** Disable WLAN" 91 | # /sbin/ifconfig wlan0 down 92 | # echo "** Start ftpd" 93 | # /mnt/disc1/busybox tcpsvd -vE 0.0.0.0 21 ftpd -w / 94 | echo "** Start monitoring" 95 | /mnt/disc1/MONITORING/parse_push & 96 | echo "** Start Cron" 97 | /mnt/disc1/busybox crond -L /mnt/disc1/CRON/cron.log -l 0 -c /mnt/disc1/CRON/ 98 | ``` 99 | Please note optional lines for starting FTP daemon and disabling wlan. Given example code can be run at any time e.g. via telnet to start ftpd and transfer files to/from SD card. A modified [dhcp.script](dhcp.script) is provided. 100 | 101 | 2. Copy files in [SDcard](SDcard/) to your SD card root. Add executable permission to scrpts and binaries. Following is a short description of the provided files. 102 | * [MONITORING](SDcard/MONITORING) Contains binaries and scripts for monitoring ring button keypress, MQTT message publishing and Telegram bot messaging. 103 | * [UTILITIES](SDcard/UTILITIES) Contains TERMINFO for terminal support and some useful binaries. 104 | * [CRON](SDcard/CRON) Contains files to support cron jobs. 105 | 106 | 3. Using the included busybox binary create a named pipe and modify file ownership and permission. This will complete writable partition modifications. 107 | 108 | ```bash 109 | /mnt/disc1/busybox chmod 744 /npc/dhcp.script 110 | /mnt/disc1/busybox chown 1011:1011 /npc/dhcp.script 111 | /mnt/disc1/busybox mkfifo /npc/myfifo 112 | /mnt/disc1/busybox chown 1011:1011 /npc/myfifo 113 | ``` 114 | 115 | 4. Modify the example scripts to include your own data: 116 | * `MONITORING/send_bell_mqtt` - fill in your MQTT broker's IP/Port number and modify topic/message 117 | * `MONITORING/send_pic_telegram` - fill in your Telegram bot info: `BOT ID:BOT TOKEN` and `CHAT ID`. To be able using image attachment it is necessary to allow taking snapshots by the alarm option in the doorbell's mobile app settings. 118 | 119 | 120 | ## How it works 121 | All stock functionality of compatible doorbell/IP cam devices is coded into a single binary `/npc/npc`. Reverse engineering of this undocumented code to incorporate new functions would be a tedious job. A simpler approach would be to augment the existing functionality with some extra features using standard Linux system means. 122 | 123 | To detect a push of a doorbell ring button a monitoring of `/npc/npc` log is added by `/mnt/disc1/MONITORING/parse_push` shell script. It is made possible using `reredirect` - a tool to dynamically redirect outputs of any running program. All "magic" is done by catching a string "keyup" from the log produced by `/npc/npc`. When it is found, further actions such as sending MQTT or Telegram messages are triggered. 124 | 125 | Log analyzing makes possible adding more functions, it is limited only by your imagination and verbosity of logging. Stock functions are not affected if new additions do not degrade the CPU performance. With a compatible doorbell mobile app it is still possible to monitor video streams, remotely unlock the door and use voice interaction with a visitor. Unfortunately, all these goodies are available with the help of app's cloud servers automatically connected by the doorbell firmware. If the app is not needed, cloud servers can be blocked, however all individual device settings are stored in the cloud. 126 | 127 | 128 | ## Cross-compile binaries for arm5l 129 | This project includes some binaries suitable for the use with a compatible hardware. In case you want to customize the devices with a different CPU type, you need to set up your own toolchain. 130 | 131 | To create binaries working on a target architecture such as `HiSilicon hi3518ev200 arm5l` you need to cross-compile those binaries using an appropriate toolchain and configuring [buildroot](http://nightly.buildroot.org/manual.html#_buildroot_quick_start). Detailed instructions can be found elsewhere. As a side note, for the target `HiSilicon hi3518ev200 arm5l` the compiler `arm-buildroot-linux-uclibcgnueabi-gcc` was used with the following compilation flags: 132 | 133 | ``` 134 | CFLAGS=-Wall --static -O2 135 | CFLAGS+=-march=armv5te -mcpu=arm926ej-s -mtune=arm926ej-s -msoft-float -mfloat-abi=soft 136 | ``` 137 | 138 | To create binaries, needed for this project, the following libraries should be cross-compiled first: 139 | * [OpenSSL](https://github.com/openssl/openssl) 140 | * [Zlib](https://www.zlib.net/) 141 | 142 | 143 | Finally, some instructions on the required binaries: 144 | * [busybox](https://www.busybox.net/) 145 | * [reredirect](https://github.com/jerome-pouiller/reredirect/) 146 | * [curl](http://www.matteomattei.com/how-to-cross-compile-curl-library-with-ssl-and-zlib-support/) 147 | * [mosquitto_pub](https://github.com/eclipse/mosquitto) 148 | 149 | 150 | ## Credits 151 | This project would not be possible without the work of other authors: 152 | 153 | * [@zzerrg](https://github.com/zzerrg/gmfwtools) Firmware packing tools. 154 | * [Jérôme Pouiller](https://github.com/jerome-pouiller/reredirect/) reredirect - a tool to dynamically redirect outputs of a running program. 155 | * [@riogrande75](https://github.com/riogrande75/doorbell/) - some ideas and useful contribution in forums by @riogrande75, who was the first to customize similar devices. 156 | 157 | ## Links 158 | Some useful links to the forums and other resources. 159 | * [Domoticz Forum](https://www.domoticz.com/forum/viewtopic.php?p=71267) - discussion of integration of the doorbells into a Smart Home system. 160 | * [IPCamtalk Forum](https://ipcamtalk.com/threads/yoosee-sd-m5-doorbell-1080p-poe-rtsp-onvif-only-66.40569/) - ideas of possible customization of YooSee SD-M5 doorbell. 161 | 162 | ## License 163 | Released under the [MIT License](http://www.opensource.org/licenses/mit-license.php) - see the [LICENSE](LICENSE) file for details. --------------------------------------------------------------------------------