IMOU IPC-S6DP-5M0WEB-E27 Wireless Bulb Cam 5MP (Dahua based)

[RepoLeved]

Hi everyone, I'm opening this thread to talk about this Imou IP camera, model IPC-S6DP-5M0WEB. It's a small light bulb-shaped camera with decent video resolution, night vision isn't bad either. It has a built-in microphone, speaker and car/ human detection.

Unfortunately, however, I didn't particularly prefer the fact that it sends the stream to the cloud and therefore necessarily has to go to the internet to use it, furthermore I noticed a frightening amount of requests in the LAN network so I decided to analyze it and try to enter the internal system (maybe I can modify it and use it freely as I like). For this purpose I disassembled the model and here is the information i found:










The processor seems to be an MSTAR SSC337 (Infinity 6c?) I found some info on this page linux-chenxing && infinity 6. the next step is to connect to the UART on the board and further analyze the software part. Anyone who can help please write

 

[RepoLeved]

OK I managed to access the serial...

IPL g3e8bb9d
D-00
HW Reset
miupll_200MHz
64MB
BIST0_0001-OK
RDQS cali
WDQS cali
SPI 54M

IPL_CUST g3e8bb9d

U-Boot 2010.06-git3d3a0bb (Aug 08 2023 - 10:13:25)
mount: mounting none on /proc/bus/usb failed: No such file or directory

keyboard = 1
/usr/etc/imod: line 1: #!/bin/sh: not found
default aewCfg:IPC-SC4336-MIPI
sensor Adaptive matching over
real SensorType:sc4336_MIPI
real aewCfg:IPC-SC4336-MIPI
CHMAP:4
mi_sensor
real intelli:PVD_5MB_SUPORT_NVR
mknod: /dev/mi_poll: File exists
16383+0 records in
16383+0 records out
country_code:DE
isNeedBle is 1
default fw mode is nimble
---------------- ota_update start --------------
open /dev/mmc0 failed!
---------------- ota_update end ----------------
motorDrv_no_tmi8150 36864 2 - Live 0xbfac1000 (O)
ssv6358 106496 0 - Live 0xbfaa6000 (O)
cfg80211 155648 1 ssv6358, Live 0xbfa7c000
ehci_hcd 28672 0 - Live 0xbfa71000
phy_sstar_u2phy 12288 2 - Live 0xbfa6a000
usbcore 98304 2 ssv6358,ehci_hcd, Live 0xbfa4e000
usb_common 12288 2 phy_sstar_u2phy,usbcore, Live 0xbfa47000
drv_ms_cus_sc4336_MIPI 12288 0 - Live 0xbfa40000 (PO)
mi_venc 196608 0 [permanent], Live 0xbfa0c000 (PO)
mi_vcodec 180224 1 mi_venc,[permanent], Live 0xbf9dc000 (PO)
mi_scl 163840 0 [permanent], Live 0xbf9b0000 (PO)
mi_ipu 32768 0 [permanent], Live 0xbf9a4000 (PO)
mi_isp 561152 0 [permanent], Live 0xbf917000 (PO)
mi_ai 49152 0 [permanent], Live 0xbf907000 (PO)
mi_ao 53248 0 [permanent], Live 0xbf8f6000 (PO)
mi_aio 40960 2 mi_ai,mi_ao,[permanent], Live 0xbf8e8000 (PO)
mi_rgn 77824 2 mi_venc,mi_scl,[permanent], Live 0xbf8d1000 (PO)
mi_sensor 114688 2 drv_ms_cus_sc4336_MIPI,mi_isp,[permanent], Live 0xbf8b0000 (PO)
drv_ms_cus_srcfg 12288 0 - Live 0xbf8a9000 (PO)
pdc 40960 1 motorDrv_no_tmi8150, Live 0xbf89b000 (O)
libarc4 12288 0 - Live 0xbf897000
firmware_class 12288 1 cfg80211, Live 0xbf890000
mi_vif 147456 3 mi_isp,mi_sensor,drv_ms_cus_srcfg,[permanent], Live 0xbf868000 (PO)
mi_sys 364544 10 mi_venc,mi_vcodec,mi_scl,mi_ipu,mi_isp,mi_ai,mi_ao,mi_rgn,mi_sensor,mi_vif,[permanent], Live 0xbf80b000 (PO)
mi_common 28672 10 mi_venc,mi_scl,mi_ipu,mi_isp,mi_ai,mi_ao,mi_rgn,mi_sensor,mi_vif,mi_sys,[permanent], Live 0xbf800000 (PO)
[: 4: unknown operand
BANK:0x1038 16bit-offset 0x01
0x0004
BANK:0x1038 16bit-offset 0x01
0x001C
BANK:0x1038 16bit-offset 0x01
0x003C
BANK:0x1302 16bit-offset 0x04
0xFEAB
BANK:0x1038 16bit-offset 0x50
0x0001
appauto=1
  738 root       0:00 /usr/bin/sonia
[libptz] PTZ: autotest finish

from the log the cmos sensor appears to be SC4336

https://smartsens.oss-cn-beijing.aliyuncs.com/web/products/SC4336_V2.0.pdf

.