Just for fun - IMX307 starlight camera module - Hik compatible.

[alastairstevenson]

I'm always looking for Hikvision or Dahua 'spares and repairs' items on eBay, but they are uncommon here in the UK.
A few weeks back there was a DS-2CD4T42WD-I8 4MP black face bullet camera with a lost password.
I tried to advise the seller how to fix that - but he just wanted to sell, so I bought it. Cheaply.
A couple of minutes after powering it on, I'd extracted the password - 123456789a

So what to do with it now? I wasn't going to use it, too big, no need.
I found when I opened it that the system board and sensor board were the same mechanically as those in a DS-2CD2332-I turret, so I swapped them into one I'd had lying around for ages and now had a DS-2CD4T42WD-I8 in turret format. See post Reset button on DS-2CD2T42WD-I5 ??
But what to do with the body? Sell as a dummy?
Maybe, but just for fun, why not try to graft a 3rd-party starlight camera board into it?

So I bought an "IMX307 Sensor and HI3516EV100 with F1.2 4mm Lens" IP camera board for £21 from here : Starlight IP Camera 1080P H265 Module Board use SONY IMX307 Sensor and HI3516EV100 with F1.2 4mm Lens Free Shipping-in Surveillance Cameras from Security & Protection on Aliexpress.com | Alibaba Group
See the attachment for the suppliers specification.


This is just a few words and thoughts about the board - the Hik Hack Starlight Hybrid will be another post.

At £21 for an IMX307 IP camera board with a starlight lens it's not going to be very good, is it?
But actually, it is, I'm quite impressed with it. The f1.2 starlight lens is the same as one I bought for £8.
And it's not just that the module gives a good colour image with almost full darkness, the firmware isn't bad.
I'd have been happy to pay a bit more for a better-speced board - it doesn't have an IR-cut filter, or a PoE capability.
But that's easily added.



Some items of interest - not necessarily extensively tested or checked as bug-free:
The video codecs supported are : H.264/H265/H.264+/H.265+

I found this pretty surprising:
The board supports a subset of Hikvision's ISAPI commands and shows up in SADP as a DS-2CD3T10D-I3 and allows SADP to change network settings.
It was able to be added to a DS-7816N and DS-7616NI-K2 NVR as a normal Hikvision camera.
The NVR was able to configure video/audio, image and motion event settings as normal.

There is the usual camera-specific ActiveX control needed under Windows, for use in IE11 to provide Live Video.
But this was surprising too - using Firefox under Linux Mint, the camera used Flash Player as the plugin to view Live Video.
This is the first camera I've seen that works in Firefox under Linux without adding a camera-specific plug-in.

ONVIF Device Manager finds the board and shows a reported ONVIF 2.40 version.
The board generates ONVIF motion detection events. That's always a plus.

The user interface has the usual set of video, image and system configurable items - and maybe a few more.
The Record and Storage menus presumably depend on a USB/MicroSD connection, which this board does not have.

Now to the firmware.
The System Info shows version 2.2.6.57611134 of 2018/04/12 so pretty recent.
I don't have a copy of the original firmware, so I need to look at the running system to find out about it.
The board has pads for UART0 and 1 so easy to connect to the serial console - though the pad labelling is incorrect.

For those readers who'd be interested (possibly the minority) attached is a transcript of the bootloader command interface - well enough featured to do bad things.
Also a transcript of the serial console on a normal startup.
The firmware originates from JUAN at juanvision.com / juancctv.com
A bit like herospeed in that they supply firmware to other manufacturers.

There is no direct access to a shell - it's protected by a login and I don't know the password.
And I don't have firmware that can be unpacked and the password hash cracked.
But no problem - with serial console access you own the camera, and sure enough, changing the bootargs parameter init=/linuxrc to init=/bin/sh gets us to a command shell.
Then it's just a matter of completing the system initiallisation, mounting a NAS NFS share and pulling out the flash partitions and anything that looks useful.
Such as passwd and passwd-
root:ab8nBoH3mb8.g:0:0::/root:/bin/sh
root:ABgia2Z.lfFhA:0:0::/root:/bin/sh
from which the root password is cracked as helpme and j1/_7sxw
Which works OK.

So far, so good.
What about telnet or SSH?
There is a telnetd in Busybox, which when executed works OK.
How to make it permanent?
Looking at the mounted partitions, the passwd- file and the main startup scripts are in a squashfs (read-only) file system, so I can't just modify them.
The only flash partition holding a writable file system is mtdblock3 with jffs2 used to hold the configuration amongst other data.
Fortunately, there is a stub startup.sh script in /media/conf/shell/startup.sh which gets called, and which can have "/usr/sbin/telnetd &" added.
And that works OK, it's in a jffs2 read/write partition.

/ # mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
devtmpfs on /dev type devtmpfs (rw,relatime,size=15496k,nr_inodes=3874,mode=755)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /media type tmpfs (rw,relatime)
tmpfs on /usr/local type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/loop0 on /media/custom type squashfs (ro,relatime)
/dev/mtdblock3 on /media/conf type jffs2 (rw,relatime)


That's more than enough of the techy stuff to bore most readers.

So, in summary.
This is an interesting, low-cost, starlight camera module that seems to work pretty well. Amazingly it seems to be Hikvision compatible.
Just for fun I'm going to see if I can graft it in to a couple of Hikvision bodies that are doing nothing - a DS-2CD4T42WD-I8 which should be possible, and maybe a DS-2CD2612F-I dome that has a faulty sensor board as sent to me for analysis by a forum member.

 

[Aengus4h]

nice

The pre-built LWST micro cams I bought recently are also Hik compatible and I believe Dahua (XM?) compat as well as onvif, only change I made was to swap out the original 2.8mm F2+ lenses with starlight ones which gained me IR ability and around 1.5 F stops over the originals. These have SD, WiFi and audio, but if you spec the PoE version you lose the latter options IIRC. Only thing I found so far is audio isn't so great, very low level even with the microseven mic, will have to mess about with pre-amp gain at some point to see if I can improve things. Like yours, no IRcut mechanism, not looked close enough to see if there's output pads on the board but no options for that in the camera GUI. They do run very warm tho, so I stuck a heatsink on the back to aid cooling lol. I've found they play reasonably well with my Hik NVR and image/video is fine so long as you don't overdo the DNR etc, certainly more reliable on motion trigger than running the previous Onvif ones, maybe that's down to a better image sensor tho. Not uploaded anything to utube etc as I really don't plan on registering on services I won't use again.

I do have a couple of their larger eye-ball type ones coming which do have IR & IRcut, same IMX290 sensor so will be interesting to see if they've the same internal boards as the first batch.

 

[Q™]

Thank you your Geekness!

 

[eagerbob]

interesting indeed. I like the small camera board for $28,- including shipping. I have been planning to hide a small and low cost camera in the door of our appartment. I even bought a raspberry Pi board with camera module for that, but can't find it anymore. And that does not work in low light anyhow, at least not without some extra effort. This might work better. In the description it says the board size is 38x38 mm. How long is the lens barrel? Does the board run hot?

 

[alastairstevenson]

Does the board run hot?

No, the board only runs warm. It's the new Hisilicon Hi3516CV300 with the integrated Dram.

How long is the lens barrel?

It's a bit like a periscope at about 25mm.
But a regular M12 f2.0 could be used instead, with some loss of light-gathering, about 12mm long.

In the description it says the board size is 38x38 mm.

This seems to be an emerging standard.
I also have a single board IMX307 starlight module I'm playing with, even cheaper.
Different firmware - cracked already.
But they get it on a single board by having components on the sensor side of the board, where the IR cut mounts, which means you can't bolt the sensor side of the board to a mounting plate like the Hikvision way of doing this.

 

[eagerbob]

It's a bit like a periscope at about 25mm.

That's good. If it more or less matches the thickness of the doorpanel, I could have the board on the inside and the lens looking out through a nice hole. Maybe even remove the spaces between the two boards and fold the whole assembly flat so that it fits into a little flat box. I guess I'll have to order one and try it out.

Adding POE would that just be a connector?

 

[alastairstevenson]

No, PoE would be a separate board with cabling between it and the main board.

 

[Aengus4h]

if you are going to box it then a metal case is better, ensure there's enough air space and perhaps add heatsinks to the hot chips and add venting to let the heat escape. The issue with all of the mini IP setups is they run hot even in metal cases. I've tended to add a heatsink that presses to the inside edge of the case on those to help shunt the heat, or space the back out to allow some airflow. Same board in a dome/eyeball case doesn't seem to have the same issues - larger air volume inside the case perhaps.

As Alistair says, PoE is an extra board that connects to the HiSilicon board to provide the power stepped down to 12v. Might be just as easy to buy one of the mini-IP cams with starvis sensor and PoE and then strip it out of the case/change the lens to suit your needs. There's a few out there now with the IMX290 sensor and Hik+XM+Onvif compatibility. If you do this tho, check if the lens has IRcut filter on it, if you want to use IR assist you'll have to compromise on colour correction unfortunately. Not seen a comparison of 290 vs 307 so can't say which is better.

 

[framednlv]

alastairstevenson,
Does the module you bought support FTP or email for motion detection?
Under WDR is there options for day/night or auto?
Are you going to post night videos with some sort of motion, cars or people?

I did by one of the aliexpress IMX307 cameras, I gave it to my daughter because it didn't support FTP or Email. To me the night image was just a little better than the IMX291 cameras.

Chris

 

[alastairstevenson]

I'll need to check that out, I didn't test those settings. I'm away just now, but should be able to try later.

 

[GentlePumpkin]

After reading the review I decided to get a cheap and good low-light camera from AliExpress aswell and I decided to go for a 1080p@20fps module with the Sony IMX291 image sensor, price appr. 30USD. Many say that it is even better than the IMX307 because the IMX307 is kind of a cheaper descendant of the IMX291.

Anyways, I received it yesterday and the night performance is incredible for such a cheap device. The day image is good and sharp aswell, so aside from the ir cut which switched multiple times from black/white to color and back this morning, I can't complain. Excellent price for this device.

I liked the review @alastairstevenson made here and I'll do my best to make such a review aswell for the module I bought:

https://www.aliexpress.com/item/Sony-IMX291-3516E-H-265-StarLight-1080P-1920-1080-IP-Camera-Module-Board-Low-illumination-38/32862779514.html

 

[SporadicThought]

root:ab8nBoH3mb8.g:0:0::/root:/bin/sh
root:ABgia2Z.lfFhA:0:0::/root:/bin/sh
from which the root password is cracked as helpme and j1/_7sxw

It has been a week-long search, in earnest, for shell access credentials to my IPCAM. This, sir, is the end of that road.
Thank you for sharing!

 

[richardstallman]

Did you ever get a firmware dump of this board? I have a Seesoon-branded IP cam that I haven't opened up yet and its firmware appears very similar to this board you have. WebUI looks almost identical, yours just has an icon in the center of the PTZ dpad vs mine just has an "A" letter.

Model IPC
Hardware version 1.3.0
Software version: 2.1.52.57612235rts

It reboots for me every 2 minutes right on the dot (I'm not sure why) so it's not really super usable. Bought it in a thrift store for $5. I'll be opening it up but without any vendor firmware I'm kind of out of luck for any fixes, unless OpenIPC is by some miracle compatible with this cam.

Thank you

 

[alastairstevenson]

Did you ever get a firmware dump of this board?

Looking back at my notes - I never did get any stock firmware for the board.
But I did dump the flash partitions, and take a look around the filesystem, see the attachment.

A root shell can be had by connecting to the serial console, and interrupting the bootloader and modifying the bootargs variable, as follows :

Spoiler: Bootloader mod

Original.

hi3516cv300 System startup


U-Boot 2010.06 (Dec 11 2017 - 16:14:47)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0x20 0x70 0x17
Block:64KB Chip:8MB Name:"XM25QH64AHIG"
SPI Nor total size: 8MB
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0
hisilicon # *********************
Unknown command '*********************' - try 'help'
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon # printenv
bootdelay=0
baudrate=115200
ethaddr=00:9A:9B:9C:9D:9E
ipaddr=192.168.1.10
serverip=192.168.1.40
netmask=255.255.255.0
bootargs=mem=40M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:192K(uboot),64K(env),64K(user),512K(conf),2048K(kernel),4032K(rootfs),1280K(custom) ramdisk_size=4096
bootcmd=sf probe 0;sf read 0x82110000 0xD0000 0x200000;sf read 0x82310000 0x2D0000 0x3F0000;bootm 0x82110000 0x82310000;
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Dec 11 2017 - 16:14:47)

Environment size: 515/65532 bytes
hisilicon #




--------------------------------------------------------
setenv bootargs mem=40M console=ttyAMA0,115200 root=0100 init=/bin/sh mtdparts=hi_sfc:192K(uboot),64K(env),64K(user),512K(conf),2048K(kernel),4032K(rootfs),1280K(custom) ramdisk_size=4096

 

[richardstallman]

Looking back at my notes - I never did get any stock firmware for the board.
But I did dump the flash partitions, and take a look around the filesystem, see the attachment.

A root shell can be had by connecting to the serial console, and interrupting the bootloader and modifying the bootargs variable, as follows :

Spoiler: Bootloader mod

Original.

hi3516cv300 System startup


U-Boot 2010.06 (Dec 11 2017 - 16:14:47)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0x20 0x70 0x17
Block:64KB Chip:8MB Name:"XM25QH64AHIG"
SPI Nor total size: 8MB
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0
hisilicon # *********************
Unknown command '*********************' - try 'help'
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon #
hisilicon # printenv
bootdelay=0
baudrate=115200
ethaddr=00:9A:9B:9C:9D:9E
ipaddr=192.168.1.10
serverip=192.168.1.40
netmask=255.255.255.0
bootargs=mem=40M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:192K(uboot),64K(env),64K(user),512K(conf),2048K(kernel),4032K(rootfs),1280K(custom) ramdisk_size=4096
bootcmd=sf probe 0;sf read 0x82110000 0xD0000 0x200000;sf read 0x82310000 0x2D0000 0x3F0000;bootm 0x82110000 0x82310000;
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Dec 11 2017 - 16:14:47)

Environment size: 515/65532 bytes
hisilicon #




--------------------------------------------------------
setenv bootargs mem=40M console=ttyAMA0,115200 root=0100 init=/bin/sh mtdparts=hi_sfc:192K(uboot),64K(env),64K(user),512K(conf),2048K(kernel),4032K(rootfs),1280K(custom) ramdisk_size=4096

Darn, worth a shot. Thank you for this though. I will pop it open and take a look this week to see what I can do. Image on the cam is decent and having PTZ control is nice, just not understanding why it's rebooting every 2 minutes like clockwork. Maybe the root shell will help me figure out what's going on.

Cheers

 

[richardstallman]

Darn, worth a shot. Thank you for this though. I will pop it open and take a look this week to see what I can do. Image on the cam is decent and having PTZ control is nice, just not understanding why it's rebooting every 2 minutes like clockwork. Maybe the root shell will help me figure out what's going on.

Cheers

Success! I was able to get into u-boot and flash OpenIPC without any issues.



Thank you for your time! I didn't need the dump after all but it is fixed. The issue was that the WiFi driver was repeatedly crashing every 2 minutes, losing connection to the chipset, and the firmware is scripted to continuously reboot the network service each time it does this. After a certain number of restarts, it will then fallback to fully rebooting the camera. So this was the problem. Not sure what the actual issue was with the chipset, but I don't use WiFi anyways, I hard-wire it.

It's alive!