Sonoff cam-b1p teardown

[mikerocklewitz]

Sonoff has a newish camera model b1p. It has a single motor for pan.

Its fairly easy to open without damage if ur careful. U gotta slide a thin metal between the ir lens and white silicone ring. It pops out then you can pull the ring. 4 screws pulls the led board. 4 more screws splits the shell.

Ingenic t23. White light ring is pretty bright. Ir is decent. Image is excellent. But this thing is not waterproof by any means. Theres no seal between the two halves

edit:
I had bought 3 of these on black friday price just on the fact they output rtsp. but its crap. there is no substream. So i figured i should carefully tear one down to see if all three are worth keeping. when i discovered the lack of any real waterproofing it sealed the fate for me and the other 2 were sent back. Ill hang on to one just to see what happens in the open communities. If anything comes of it, itd be decent for indoor use, id even buy another one or two again for indoor purposes. But i have no idea why or how they are selling it as outdoor.

[themactep]

I have ordered this camera from itead, should arrive in a couple weeks. Unless you want to beat me to it and port it yourself.

[mikerocklewitz]

Lol thats beyond me. I jus wanted to share what my findings were. I haven't done anything further than taking those pictures. Like I said, i kept one and i have all the pieces in the box.

I could shoot for a boot console dump tonight but I assume its pretty typical. No clue if theres secure boot or anything like that.

[mikerocklewitz]

[mikerocklewitz]

`
U-Boot SPL 2013.07 (Jul 21 2025 - 17:20:44)
Board info: T23N

apll_freq = 1188000000
mpll_freq = 1200000000
sdram init start
DDR clk rate 600000000
DDR_PAR of eFuse: 00000000 00000000
sdram init finished
image entry point: 0x80100000

U-Boot 2013.07 (Jul 21 2025 - 17:20:44)

Board: ISVP (Ingenic XBurst T23 SoC)
DRAM: 64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 398k for U-Boot at: 83f9c000
Reserving 32784k for malloc() at: 81f98000
Reserving 32 Bytes for Board Info at: 81f97fe0
Reserving 124 Bytes for Global Data at: 81f97f64
Reserving 128k for boot params() at: 81f77f64
Stack Pointer at: 81f77f48
Now running in RAM - U-Boot at: 83f9c000
MMC: msc: 0
the manufacturer 85
SF: Detected PY25Q128HA

*** Warning - bad CRC, using default environment

In: serial
Out: serial
Err: serial
info: [jy_mmc_upg] check..
device name mmc!
Card did not respond to voltage select!
error: [jy_mmc_check] Unknow device type!!!
Hit any key to stop autoboot: 0
the manufacturer 85
SF: Detected PY25Q128HA

--->probe spend 4 ms
SF: 2621440 bytes @ 0x40000 Read: OK
--->read spend 842 ms

Booting kernel from Legacy Image at 80600000 ...

Image Name: Linux-3.10.14__isvp_pike_1.0__
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1677930 Bytes = 1.6 MiB
Load Address: 80010000
Entry Point: 803951d0
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK

Starting kernel ...

[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 3.10.14__isvp_pike_1.0__ (@74b8c2127e3e) (gcc version 5.4.0 (Ingenic Ingenic r3.3.0-gcc540 Smaller Size 2023.05-22) ) #1 PREEMPT Mon Jul 21 17:21:29 CST 2025
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 RESET ERROR PC:E5A4320A
[ 0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)
[ 0.000000] FPU revision is: 00b70000
[ 0.000000] cgu_vpu clk should be opened!
[ 0.000000] CCLK:1188MHz L2CLK:594Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 004ab000 @ 00010000 (usable)
[ 0.000000] memory: 00035000 @ 004bb000 (usable after init)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 02f00000 @ 00000000 (usable)
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x02efffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x02efffff]
[ 0.000000] Primary instruction cache 16kB, 8-way, VIPT, linesize 32 bytes.
[ 0.000000] Primary data cache 16kB, 8-way, VIPT, no aliases, linesize 32 bytes
[ 0.000000] pls check processor_id[0x00d00100],sc_jz not support!
[ 0.000000] MIPS secondary cache 64kB, 8-way, linesize 32 bytes.
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping off. Total pages: 11938
[ 0.000000] Kernel command line: console=ttyS1,115200n8 mem=47M@0x0 rmem=17M@0x2F00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),1824k(kernel),4704k(root),32k(vendor),4608k(appfs),-(datafs)
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Memory: 42052k/48128k available (3636k kernel code, 6076k reserved, 1142k data, 212k init, 0k highmem)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] Preemptible hierarchical RCU implementation.
[ 0.000000] NR_IRQS:347
[ 0.000000] clockevents_config_and_register success.
[ 0.000020] Calibrating delay loop... 1185.38 BogoMIPS (lpj=5926912)
[ 0.087810] pid_max: default: 32768 minimum: 301
[ 0.092704] Mount-cache hash table entries: 512
[ 0.097740] Initializing cgroup subsys debug
[ 0.101998] Initializing cgroup subsys freezer
[ 0.108800] regulator-dummy: no parameters
[ 0.113040] NET: Registered protocol family 16
[ 0.129203] bio: create slab at 0
[ 0.135326] jz-dma jz-dma: JZ SoC DMA initialized
[ 0.140311] usbcore: registered new interface driver usbfs
[ 0.145917] usbcore: registered new interface driver hub
[ 0.151358] usbcore: registered new device driver usb
[ 0.156620] (null): set:249 hold:250 dev=100000000 h=500 l=500
[ 0.164483] Switching to clocksource jz_clocksource
[ 0.169435] cfg80211: Calling CRDA to update world regulatory domain
[ 0.176469] NET: Registered protocol family 2
[ 0.181332] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[ 0.188300] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[ 0.194687] TCP: Hash tables configured (established 512 bind 512)
[ 0.201028] TCP: reno registered
[ 0.204228] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.210190] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.216734] NET: Registered protocol family 1
[ 0.221385] RPC: Registered named UNIX socket transport module.
[ 0.227382] RPC: Registered udp transport module.
[ 0.232082] RPC: Registered tcp transport module.
[ 0.236867] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.243693] freq_udelay_jiffys[0].max_num = 10
[ 0.248164] cpufreq udelay loops_per_jiffy
[ 0.252535] 12000 59867 59867
[ 0.255801] 24000 119735 119735
[ 0.259258] 60000 299338 299338
[ 0.262688] 120000 598677 598677
[ 0.266266] 200000 997796 997796
[ 0.269752] 300000 1496694 1496694
[ 0.273460] 600000 2993389 2993389
[ 0.277189] 792000 3951274 3951274
[ 0.280876] 1008000 5028895 5028895
[ 0.284672] 1200000 5986779 5986779
[ 0.292994] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.299118] exFAT: Version 1.2.9
[ 0.303106] jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
[ 0.309033] msgmni has been set to 82
[ 0.314566] io scheduler noop registered
[ 0.318598] io scheduler cfq registered (default)
[ 0.323333] jz-pwm jz-pwm: period_ns:max=2730666,min=42
[ 0.328934] wait stable.[288][cgu_vpu]
[ 0.332656] cgu_vpu can not set to 450000000, will change!!!
[ 0.339876] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[ 0.347694] console [ttyS1] enabled, bootconsole disabled
[ 0.347694] console [ttyS1] enabled, bootconsole disabled
[ 0.362717] brd: module loaded
[ 0.368017] loop: module loaded
[ 0.371880] zram: Created 2 device(s) ...
[ 0.376184] logger: created 256K log 'log_main'
[ 0.381283] jz TCU driver register completed
[ 0.386256] the id code = 852018, the flash name is PY25Q128HA
[ 0.392304] jz-sfc jz-sfc: sfc use DMA mode
[ 0.396670] jz-sfc jz-sfc: nor flash now use standard mode!
[ 0.402436] JZ SFC Controller for SFC channel 0 driver register
[ 0.408593] 6 cmdlinepart partitions found on MTD device jz_sfc
[ 0.414720] Creating 6 MTD partitions on "jz_sfc":
[ 0.419708] 0x000000000000-0x000000040000 : "boot"
[ 0.425201] 0x000000040000-0x000000208000 : "kernel"
[ 0.430916] 0x000000208000-0x0000006a0000 : "root"
[ 0.436437] 0x0000006a0000-0x0000006a8000 : "vendor"
[ 0.442078] 0x0000006a8000-0x000000b28000 : "appfs"
[ 0.447712] 0x000000b28000-0x000001000000 : "datafs"
[ 0.453372] SPI NOR MTD LOAD OK
[ 0.456738] tun: Universal TUN/TAP device driver, 1.6
[ 0.461969] tun: (C) 1999-2004 Max Krasnyansky maxk@qualcomm.com
[ 0.468499] wait stable.[288][cgu_macphy]
[ 0.472664] Bus Mode Reg after reset: 0x00020101, cnt=0
[ 0.479111] Bus Mode Reg after reset: 0x00020101, cnt=1
[ 0.485491] Bus Mode Reg after reset: 0x00020101, cnt=2
[ 0.491885] Bus Mode Reg after reset: 0x00020101, cnt=3
[ 0.498276] Bus Mode Reg after reset: 0x00020101, cnt=4
[ 0.504655] Bus Mode Reg after reset: 0x00020101, cnt=5
[ 0.511046] Bus Mode Reg after reset: 0x00020101, cnt=6
[ 0.517436] Bus Mode Reg after reset: 0x00020101, cnt=7
[ 0.523816] Bus Mode Reg after reset: 0x00020101, cnt=8
[ 0.530206] Bus Mode Reg after reset: 0x00020101, cnt=9
[ 0.536596] func:jz_mii_bus_probe, synopGMAC_reset failed
[ 0.542167] jz_mii_bus: probe of jz_mii_bus.0 failed with error -1
[ 0.548654] =======>gmacdev = 0x821df780<================
[ 0.554244] =========>gmacdev->MacBase = 0xb34b0000 DmaBase = 0xb34b1000
[ 0.561216] Bus Mode Reg after reset: 0x00020101, cnt=0
[ 0.567638] Bus Mode Reg after reset: 0x00020101, cnt=1
[ 0.574017] Bus Mode Reg after reset: 0x00020101, cnt=2
[ 0.580408] Bus Mode Reg after reset: 0x00020101, cnt=3
[ 0.586800] Bus Mode Reg after reset: 0x00020101, cnt=4
[ 0.593178] Bus Mode Reg after reset: 0x00020101, cnt=5
[ 0.599569] Bus Mode Reg after reset: 0x00020101, cnt=6
[ 0.605964] Bus Mode Reg after reset: 0x00020101, cnt=7
[ 0.612343] Bus Mode Reg after reset: 0x00020101, cnt=8
[ 0.618736] Bus Mode Reg after reset: 0x00020101, cnt=9
[ 0.625115] func:jz_mac_probe, synopGMAC_reset failed
[ 0.630340] jz_mac: probe of jz_mac.0 failed with error -1
[ 0.636140] usbcore: registered new interface driver zd1201
[ 0.642013] DWC IN OTG MODE
[ 0.645541] dwc2 dwc2: Keep PHY ON
[ 0.649112] dwc2 dwc2: Using Buffer DMA mode
[ 0.653537] dwc2 dwc2: Core Release: 3.00a
[ 0.657826] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[ 0.664335] dwc2 dwc2: new USB bus registered, assigned bus number 1
[ 0.671684] hub 1-0:1.0: USB hub found
[ 0.675586] hub 1-0:1.0: 1 port detected
[ 0.679856] dwc2 dwc2: DWC2 Host Initialized
[ 0.684689] cgu_msc0 can not set to 24000000, will change!!!
[ 0.690625] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[ 0.696702] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[ 0.702310] TCP: cubic registered
[ 0.705749] NET: Registered protocol family 17
[ 0.710812] soc_vpu probe success,version:1.0.0-03203fd46d
[ 0.716758] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[ 0.728369] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[ 0.736104] Freeing unused kernel memory: 212K (804bb000 - 804f0000)
[ 0.757820] dwc2 dwc2: ID PIN CHANGED!
mdev is ok......
mount -t squashfs /dev/mtdblock4 /system
mount -t jffs2 /dev/mtdblock5 /system/data
ota_cfg file does not exist, no upgrade required.
All files passed the checksum check, no repair needed.
/
umount: can't forcibly umount /mnt/sdcard: Invalid argument
[ 2.334952] Example driver loaded. Major number: 252
[ 2.343957] Stepper Motor Driver Loaded

Ingenic-uc1_1 login: Failed to open connection to "system" message bus: Failed to connect to socket /var/run/dbus-1/system_bus_socket: No such file or directory
sdcard: umount...
[ 7.254953] h_step: 1024
insmod motor end
[ 8.373478] name : i2c0 nr : 0
[ 8.676412] sensor_read: addr=0x3107 value = 0x9b
[ 8.681896] sensor_read: addr=0x3108 value = 0x3a
[ 8.687400] sensor_read: addr=0x801e value = 0xf
[ 8.692274] info: success sensor find : sc2337p
sensor :sc2337p
sc2337p

isp_clk=125000000

--nrvbs 2
[ 8.949782] cgu_isp can not set to 153000000, will change!!!
[ 8.955662] cgu_vpu can not set to 416000000, will change!!!
[ 8.988464] @@@@ tx-isp-probe ok(version H20240204a), compiler date=Feb 4 2024 @@@@@
[ 9.038141] pipe_request_dma: paddr = 0x1d40000
[ 9.042875] dma dma0chan24: Channel 24 have been requested.(phy id 7,type 0x06 desc a1a47000)
[ 9.054245] pipe_request_dma: paddr = 0x1b80000
[ 9.059168] dma dma0chan25: Channel 25 have been requested.(phy id 6,type 0x06 desc a19fd000)
[ 9.068367] pipe_request_dma: paddr = 0x1b00000
[ 9.073102] dma dma0chan26: Channel 26 have been requested.(phy id 5,type 0x04 desc a18e3000)
[ 9.095930] @@@@@ inner codec power up@@@@@@
[ 9.505938] @@@@ audio driver ok(version H20230614a) @@@@@
[ 9.549509] /jenkins/workspace/T23N_CAMB1_01/project/opensource/drivers/button/button_driver.c gpio_drv_init line 122
[ 9.565512] button driver loading is complete
[ 9.912191] [atbm_log]:atbm_usb_module_init 0
[ 9.921700] [atbm_log]:platform_init(250)
[ 9.928133] [atbm_log]:SVN_VER=31152,DPLL_CLOCK=2,BUILD_TIME=2024-12-27_15:53:13
[ 9.936209] usbcore: registered new interface driver atbm_wlan
[ 9.985926] usb 1-1: new high-speed USB device number 2 using dwc2
[ 10.199744] [atbm_log]:atbm_usb_probe : idVendor[7a] idProduct[888b]
[ 10.208683] [atbm_log]:AsmLite probe!
[ 10.212478] [atbm_log]:Probe called -1 v1
[ 10.216710] [atbm_log]:not CONFIG_USE_DMA_ADDR_BUFFER
[ 10.222092] [atbm_log]:CONFIG_TX_NO_CONFIRM
[ 10.226559] [atbm_log]:ble_spin_lock init
[ 10.230805] [atbm_log]:Allocated hw_priv @ 81af0ec0
[ 10.236309] [atbm_log]: wait_event_interruptible from send_prbresp_wq
[ 10.243126] [atbm_log]:atbmwifi USB_USE_TASTLET_TXRX enable (81af0ec0)
[ 10.249952] [atbm_log]:atbmwifi USB_USE_TASTLET_TXRX enable (81af0ec0)
[ 10.257144] [atbm_log]:Get 6012B-X UID Success!!support BLE
[ 10.262919] [atbm_log]:atbm_get_chiptype, chipver=0x4a, g_wifi_chip_type[12]
[ 10.270253] [atbm_log]:atbm_before_load_firmware++
[ 10.275296] [atbm_log]:+++++++++++++++++1.1v++++++++++++++++++
[ 10.281362] [atbm_log]:===================_====================
[ 10.288217] [atbm_log]:atbm_start_load_firmware++
[ 10.293088] [atbm_log]:
[ 10.293088] ======>>> load WIFI BLE COMB firmware <<<======
[ 10.293088]
[ 10.302937] fwhdr->flags 34353678 sram_addr 9009000
[ 10.307999] [atbm_log]:START DOWNLOAD ICCM=========
[ 10.313049] [atbm_log]:atbm_load_firmware_generic: addr 10000: len 15000
[ 10.402677] [atbm_log]:START DOWNLOAD DCCM=========
[ 10.407764] [atbm_log]:atbm_load_firmware_generic: addr 800000: len a000
[ 10.454575] [atbm_log]:START DOWNLOAD SRAM=========
[ 10.459662] [atbm_log]:atbm_load_firmware_generic: addr 9009000: len d000
[ 10.518647] [atbm_log]:atbm_after_load_firmware++
[ 10.523520] [atbm_log]:ARES_A:after_load_firmware
[ 10.528625] [atbm_log]:0x1610102c=0x40a0e
[ 10.533161] [atbm_log]:0x1610102c=0x10a0f
[ 10.537428] [atbm_log]:0x16101000=0x8000e08
[ 10.542146] [atbm_log]:set_block_size=256
[ 10.546368] [atbm_log]:firmwareCap f189
[ 10.550340] [atbm_log]:firmwareCap2 1104
[ 10.554397] [atbm_log]:wsm_caps.firmwareCap 1104f189 4
[ 10.559568] [atbm_log]:apollo wifi WSM init done.
[ 10.559568] Input buffers: 6 x 1648 bytes
[ 10.559568] Hardware: 7.0
[ 10.559568] WSM firmware [=MODEM==USB=+BLE+Oct 23 2023 14:24:24], ver: 18378, build: 4228, api: 1060, cap: 0x1104F189 Config[8030408] expection 9002fdc, ep0 cmd addr 0 NumOfStations[8] NumOfInterfaces[3]
[ 10.591091] [atbm_log]:EFUSE(8) [0]
[ 10.594969] [atbm_log]:EFUSE(I) [0]
[ 10.598965] [atbm_log]:EFUSE(B) [0]
[ 10.602752] [atbm_log]:CAPABILITIES_ATBM_PRIVATE_IE [0]
[ 10.608625] [atbm_log]:CAPABILITIES_NVR_IPC [0]
[ 10.614483] [atbm_log]:CAPABILITIES_NO_CONFIRM [1]
[ 10.620351] [atbm_log]:CAPABILITIES_SDIO_PATCH [0]
[ 10.626221] [atbm_log]:CAPABILITIES_NO_BACKOFF [0]
[ 10.632077] [atbm_log]:CAPABILITIES_CFO [0]
[ 10.637945] [atbm_log]:CAPABILITIES_AGC [1]
[ 10.643801] [atbm_log]:CAPABILITIES_TXCAL [1]
[ 10.649668] [atbm_log]:CAPABILITIES_MONITOR [0]
[ 10.655525] [atbm_log]:CAPABILITIES_CUSTOM [0]
[ 10.661392] [atbm_log]:CAPABILITIES_SMARTCONFIG [0]
[ 10.667262] [atbm_log]:CAPABILITIES_ETF [1]
[ 10.673119] [atbm_log]:CAPABILITIES_LMAC_RATECTL [1]
[ 10.678988] [atbm_log]:CAPABILITIES_LMAC_TPC [1]
[ 10.684845] [atbm_log]:CAPABILITIES_LMAC_TEMPC [1]
[ 10.690711] [atbm_log]:CAPABILITIES_CTS_BUG [0]
[ 10.696581] [atbm_log]:CAPABILITIES_USB_RECOVERY_BUG [0]
[ 10.702437] [atbm_log]:CAPABILITIES_USE_IPC [0]
[ 10.708306] [atbm_log]:CAPABILITIES_OUTER_PA [0]
[ 10.714164] [atbm_log]:CAPABILITIES_POWER_CONSUMPTION [0]
[ 10.720031] [atbm_log]:CAPABILITIES_RSSI_DECIDE_TXPOWER [0]
[ 10.725899] [atbm_log]:CAPABILITIES_RTS_LONG_DURATION [0]
[ 10.731756] [atbm_log]:CAPABILITIES_TX_CFO_PPM_CORRECTION[1]
[ 10.737623] [atbm_log]:CAPABILITIES_SHARE_CRYSTAL [0]
[ 10.743389] [atbm_log]:CAPABILITIES_CFO_DCXO_CORRECTION [1]
[ 10.749167] [atbm_log]:CAPABILITIES_HW_CHECKSUM [0]
[ 10.755024] [atbm_log]:CAPABILITIES_SINGLE_CHANNEL_MULRX [0]
[ 10.760893] [atbm_log]:EX_CAPABILITIES_TWO_CHIP_ONE_SOC [0]
[ 10.766490] [atbm_log]:EX_CAPABILITIES_MANUAL_SET_AC [0][atbm_log]:EX_CAPABILITIES_LMAC_BW_CONTROL [1]
[ 10.776235] [atbm_log]:EX_CAPABILITIES_SUPPORT_TWO_ANTENNA [0][atbm_log]:EX_CAPABILITIES_ENABLE_STA_REMAIN_ON_CHANNEL [1]
[ 10.787599] [atbm_log]:EX_CAPABILITIES_ENABLE_PS [1][atbm_log]:EX_CAPABILITIES_TX_REQUEST_FIFO_LINK [0]
[ 10.798063] [atbm_log]:EX_CAPABILITIES_DRIVER_PHY_REG_INIT [0][atbm_log]:EX_CAPABILITIES_DRIVER_PROCESS_BA [1]
[ 10.809157] [atbm_log]:EX_CAPABILITIES_DRIVER_PHY_REG_INIT[0]
[ 10.815285] [atbm_log]:EX_CAPABILITIES_DRIVER_PROCESS_BA[1]
[ 10.821062] [atbm_log]:CONFIG_PRODUCT_TEST_USE_FEATURE_ID [1]
[ 10.827021] [atbm_log]:CONFIG_PRODUCT_TEST_USE_GOLDEN_LED [1]
[ 10.833071] [atbm_log]:mdelay wait wsm_startup_done !!
[ 10.838523] [atbm_log]:not need phy init in driver
[ 10.843894] [atbm_log]:wsm_generic_confirm:status(2)
[ 10.849109] [atbm_log]: wsm_write_mib fail !!! mibId=4132
[ 10.855748] [atbm_log]:efuse data is [0x1,0x3b,0x1c,0x1d,0x1c,0xb,0x0,0x0,0xe0:0x22:0xa1:0xa3:0x17:0xe1]
[ 10.865839] [atbm_log]:apollo wifi : can't open /data/.mac.info
[ 10.872019] [atbm_log]:chip is 6012B not support HT40!
[ 10.877849] [atbm_log]:cfg80211_regdomain is NULL
[ 10.882727] [atbm_log]:country code 00 country_support_chan = 14
[ 10.891369] [atbm_log]:enable sg
[ 10.894735] [atbm_log]:[wlan0] has been disabled
[ 10.910298] [atbm_log]:enable sg
[ 10.913664] [atbm_log]:[p2p0] has been disabled
[ 10.931207] [atbm_log]:is registered as 'ALTOBEAM'
[ 10.938479] [atbm_log]:ieee80211_ble_dev_register
[ 10.943726] [atbm_log]:ble start
[ 10.951960] [atbm_log]:atbm_setup_mac:addr(e022a1a317e1)
[ 10.957672] [atbm_log]:[ALTOBEAM-ble_recv] start
[ 10.962473] [atbm_log]:ble subscribe
[ 10.966304] [atbm_log]:[ALTOBEAM-ble_xmit] start
[ 10.971459] [atbm_log]:ble_platform_probe(81d99200)
[ 10.979030] [atbm_log]:3 !!! atbm_vif_setup_params: enabling priv
[ 10.985470] [atbm_log]:apollo wifi : can't open /tmp/atbm_txpwer_dcxo_cfg.txt
[ 10.992951] [atbm_log]:apollo wifi : can't open /tmp/set_rate_power.txt
[ 11.000392] [atbm_log]:get chip id [834][10][0]
[ 11.005176] [atbm_log]:current chiptype 6012B-X
[ 11.010056] [atbm_log]:[STA] Interface ID:0 of type:2 added
[ 11.015961] [atbm_log]:[atbm_wtd]:set wtd_probe = 1
[ 11.021105] [atbm_log]:atbm_set_uapsd_param:uapsdFlags(0)
[ 11.027536] [atbm_log]:br0_netdev_open()-1199: dev_get_by_name(br0)
[ 11.034438] [atbm_log]:atbm_set_uapsd_param:uapsdFlags(0)
[ 11.040682] [atbm_log]:atbm_set_uapsd_param:uapsdFlags(0)
[ 11.046908] [atbm_log]:atbm_set_uapsd_param:uapsdFlags(0)
[ 11.053098] [atbm_log]:atbm_set_uapsd_param:uapsdFlags(0)
[ 11.067934] /jenkins/workspace/T23N_CAMB1_01/project/opensource/drivers/led/led_driver.c gpio_drv_init line 125
[ 11.083342] LED driver loading is complete
ota_cfg file does not exist, no upgrade required.
Starting system message bus: done
hardware_control start status=0
network_control start status=0
ipc_colink start status=0
/data/init
ipc_manage start status=0
ipc_watchdog start status=0
[hardware]Cloud log register success.
/data/app/hardware_control/light_ir_brightness.sh
dbus connection no init, send data error
init_dbus success
start ipc_guard process 0
info: timeout = 10
[network]Cloud log register success.
semid already exist(0), prepare to init
semid already exist(32769), prepare to init
[colink]Cloud log register success.
init_dbus success
Copied 256 bytes from address 0x00000000 in flash to /tmp/license_colink
Copied 256 bytes from address 0x00000000 in flash to /tmp/license_network
set system time
Fri Dec 1 00:00:00 UTC 2023
log_level:2
init_dbus success
offline_reasons:device_info_get,device_offline:[device or process reboot!]
killall: wpa_supplicant: no process killed
SHA256 hash: ee48bfd58317a00bb88074c535e466e3ce12c95418ff79e819249778015270d5
Unable to open file /tmp/resolv.conf
Unable to open file /tmp/resolv.conf
Process(sonoff_dns.sh) is not running, start running the process(sonoff_dns.sh).
find region us
Unable to open file /tmp/resolv.conf
Unable to open file /tmp/resolv.conf
start parsing hostname:kinesisvideo.us-east-1.amazonaws.com
no need to update resolv.conf
enter colink lib init.
exit colink lib init.
[COLINK print:src/colink.c,253,colinkProcess] COLINK_PROCESS_START
[COLINK print:src/colink.c,284,colinkProcess] COLINK_PROCESS_DISTOR_START
[COLINK print:src/colink.c,301,colinkProcess] COLINK_PROCESS_DISTOR
[COLINK print:src/colink_distor.c,389,colinkDistorSubProcess] DISTOR_PROCESS_START
[COLINK print:src/colink_distor.c,407,colinkDistorSubProcess] DISTOR_PROCESS_DNS_START

=======colinkGethostbyname======
hostname: us-dispd-v1.coolkit.cc
getaddrinfo err: -2
[COLINK print:src/colink_distor.c,567,colinkDistorSubProcess] DISTOR_PROCESS_RECONNECT
[COLINK print:src/colink_distor.c,609,colinkDistorSubProcess] DISTOR_PROCESS_WAIT_RECONNECT
Successfully initialized wpa_supplicant
[manage]Cloud log register success.
dbus module init
rfkill: Cannot open RFKILL control device
nl80211: Could not re-add multicast membership for vendor events: -2 (No such file or directory)
[ 15.290837] cgu_isp can not set to 125000000, will change!!!
[ 15.302289] cgu_vpu can not set to 600000000, will change!!!
[ 15.352075] [atbm_log]:__ieee80211_start_scan:channels[14]
[ 15.386043] [atbm_log]:ieee80211_prep_hw_scan:n_chans(14),space(14),index(14),scaned(14)
[ 15.395688] [atbm_log]:atbm_hw_scan:if_id(0)
[ 15.400946] -----sc2337p_detect: 619 ret = 0, v = 0x9b
[ 15.406880] [atbm_log]:atbm_hw_scan:scan, delay suspend
[ 15.412850] [atbm_log]:scan start band(0),(14)
[ 15.417932] -----sc2337p_detect: 627 ret = 0, v = 0x3a
[ 15.423910] sc2337p chip found @ 0x30 (i2c0)
[ 15.428891] sensor driver version H20240926a
killall: udhcpc: no process killed
=============>connect wifi:wifi_start.sh 'CameraNet' 'campass431'
long link is not running, send fail:3
connect to WiFi ssid: CameraNet, Passwd: campass431
[ 15.630040] Ivdc init! direct_mode is 1
[ 15.661515] sc2337p stream on
[ 15.670248] Err [VIC_INT] : hor err ch2 !!!!!
[ 15.674763] Err [VIC_INT] : ver err ch2 !!!!!
[ 15.679269] error handler!!!
[ 15.682246] addr ctl is 0x0
[ 15.685210] vb is null, buf get:0x80000000 lastaddr = 0x00000000 idx=0 isp_index = -2142610704
[ 15.770400] vb is null, buf get:0x80000000 lastaddr = 0x80000000 idx=0 isp_index = 0
i264e[info]: profile High, level 5.0
i264e[info]: profile High, level 2.2
[ 15.845935] wait stop q->num_buffers=2 q->done_count=1
[ 15.885924] streamoff stop！！
[ 15.905931] wait stop q->num_buffers=3 q->done_count=1
[ 15.920397] vb is null, buf get:0x80000000 lastaddr = 0x80000000 idx=0 isp_index = 0
[ 15.970400] vb is null, buf get:0x80000000 lastaddr = 0x80000000 idx=0 isp_index = 15
[ 16.005921] streamoff stop！！
[ 16.079677] Opening horizontal motor device
long link is not running, send fail:0
Copied 256 bytes from address 0x00000000 in flash to /tmp/license_ipc_manage
long link is not running, send fail:0
long link is not running, send fail:0
long link is not running, send fail:0
long link is not running, send fail:0
long link is not running, send fail:0
long link is not running, send fail:0
long link is not running, send fail:0
warn: shm_init,53shm init already
long link is not running, send fail:0
long link is not running, send fail:0
long link is not running, send fail:0
close notify_handle_events
[Components/util/util.c:55] open /data/app/ipc_manage/coord file failed
long link is not running, send fail:0
long link is not running, send fail:0
Successfully initialized wpa_supplicant
timezone 255.000000
rfkill: Cannot open RFKILL control device
nl80211: Could not re-add multicast membership for vendor events: -2 (No such file or directory)
wpa_event_notifications start...
request event notification:OK

udhcpc (v1.22.1) started
sonoff_dns.sh work
[ 16.946209] [atbm_log]:hw_priv->scan.status 0
[ 16.956535] [atbm_log]:atbm_scan_work:end(0)
find region us
start parsing hostname:kinesisvideo.us-east-1.amazonaws.com
[ 16.976174] [atbm_log]:stop scan:policy empty
warn: shm_init,53shm init already
no need to update resolv.conf
Sending discover...
long link is not running, send fail:0
long link is not running, send fail:0
aec version: v2.1.201201 in webrtc_profile.ini and v2.1.201201 in aec lib.
long link is not running, send fail:0
can find the value of PATH:AEC_PATH,debug audio library
[ 17.907116] [atbm_log]:__ieee80211_start_scan:channels[14]
[ 17.935990] [atbm_log]:ieee80211_prep_hw_scan:n_chans(14),space(14),index(14),scaned(14)
[ 17.948368] [atbm_log]:atbm_hw_scan:if_id(0)
[ 17.964227] [atbm_log]:atbm_hw_scan:scan, delay suspend
[ 17.972869] [atbm_log]:scan start band(0),(14)
[ 19.514338] [atbm_log]:hw_priv->scan.status 0
[ 19.518997] [atbm_log]:atbm_scan_work:end(0)
[ 19.535981] [atbm_log]:stop scan:policy empty
event notify:<3>SME: Trying to authenticate with 9c:53:22:c4:d6:[ 19.557362] [atbm_log]:wlan0:free authen bss ++
6c (SSID='CameraNet' freq=2462 MHz)
[ 19.605968] [atbm_log]:authen:(9c:53:22:c4:d6:6c),ssid(CameraNet)
[ 19.613087] [atbm_log]:work suspend
[ 19.617134] [atbm_log]:authenticate[9c:53:22:c4:d6:6c]:[0][1]
[ 19.635392] [atbm_log]:wlan0: authenticate with 9c:53:22:c4:d6:6c (try 1) (1)(0)
[ 19.647604] [atbm_log]:[STA] Join DTIM: 1, interval: 100
[ 19.656820] [atbm_log]:atbm_set_pm:if_id(0) is not assco
[ 19.669842] [atbm_log]:cancle_work_done:[9c:53:22:c4:d6:6c][15][11]
[ 19.890754] [atbm_log]:ieee80211_rx_h_check:[wlan0]:sta[9c:53:22:c4:d6:6c] not assoc[2]
[ 19.899191] [atbm_log]:ieee80211_rx_h_check:[wlan0]:sta[9c:53:22:c4:d6:6c] not assoc[2]
Sending discover...
[ 20.165941] [atbm_log]:authenticate[9c:53:22:c4:d6:6c]:[0][2]
[ 20.172511] [atbm_log]:wlan0: authenticate with 9c:53:22:c4:d6:6c (try 2) (1)(0)
[ 20.180669] [atbm_log]:sta has been insert(0)
[ 20.192259] [atbm_log]:wlan0: authenticated
event notify:<3>Trying to associate with 9c:53:22:c4:d6:6c (SSID[ 20.206705] [atbm_log]:wlan0:free authen bss ++
='CameraNet' freq=2462 MHz)
[ 20.236017] [atbm_log]:wlan0:free authen bss --
[ 20.241176] [atbm_log]:sta has been insert(0)
[ 20.246218] [atbm_log]:work:flush sta[9c:53:22:c4:d6:6c]
[ 20.255455] [atbm_log]:cancle_work_done:[9c:53:22:c4:d6:6c][15][11]
[ 20.263379] [atbm_log]:wlan0: associated
[ 20.271757] [atbm_log]:wlan0:free authen bss ++
[ 20.283976] [atbm_log]:atbm_set_uapsd_param:uapsdFlags(0)
[ 20.291077] [atbm_log]:atbm_set_uapsd_param:uapsdFlags(0)
[ 20.297529] [atbm_log]:atbm_set_uapsd_param:uapsdFlags(0)
[ 20.308270] [atbm_log]:atbm_set_uapsd_param:uapsdFlags(0)
[ 20.314855] [atbm_log]:[9c:53:22:c4:d6:6c]:20M channel
[ 20.320369] [atbm_log]:atbm_bss_info_changed:chatype(1),channelNumber(11)
[ 20.330875] [atbm_log]:ieee80211_recalc_ps:work busy
[ 20.376067] [atbm_log]:[9c:53:22:c4:d6:6c]:assc sucess band[0]
event notify:<3>Associated with 9c:53:22:c4:d6:6c[ 20.383987] [atbm_log]:work:flush sta[9c:53:22:c4:d6:6c]

event notify:<3>CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
[ 20.399759] [atbm_log]:flush sta(0):
[ 20.409145] [atbm_log]:[wlan0]:[8e88] deliver slow
[ 20.415817] [atbm_log]:[wlan0]:down_eap_rate
[ 20.420301] [atbm_log]:wlan0:2/4 Pairwise
[ 20.425365] [atbm_log]:ieee80211_recalc_ps:work busy
[ 20.431181] [atbm_log]:[wlan0]:dtim changed [0]->[1]
[ 20.442785] [atbm_log]:[wlan0]:[8e88] deliver slow
[ 20.455481] NOHZ: local_softirq_pending 08
[ 20.478103] [atbm_log]:[wlan0]:down_eap_rate
[ 20.482620] [atbm_log]:wlan0:4/4 Pairwise
[ 20.491226] [atbm_log]:3SET_KEY:idx(0),if_id(0)
[ 20.505734] [atbm_log]:3SET_KEY:idx(1),if_id(0)
event notify:<3>WPA: Key negotiation completed with 9c:53:22:c4:[ 20.514060] [atbm_log]:ieee80211_recalc_ps:work busy
d6:6c [PTK=CCMP GTK=TKIP]
connect success.
wpa_event_notifications end.
[ 20.527900] [atbm_log]:KEK[7][178][60][145]
[ 20.541134] [atbm_log]:KCK[153][199][219][247]
dbus connection no init, send data error
long link is not running, send fail:0
long link is not running, send fail:0
dbus connection no init, send data error
Sending discover...
[ 23.176181] [atbm_log]:dhcp work(1)
[ 23.195047] [atbm_log]:ieee80211_process_addba_request:mac[9c:53:22:c4:d6:6c],tid[0]
[ 23.206796] [atbm_log]:AMPDU[wlan0]:action[0],tid[0],ssn[0],buff_size[0],token[0],ta[9c:53:22:c4:d6:6c]
[ 23.356793] [atbm_log]:[wlan0]:[8] deliver slow
[ 23.361983] [atbm_log]:dhcp done[ 23.365316] NOHZ: local_softirq_pending 08
Sending select for 192.168.2.31...

[ 23.386409] [atbm_log]:dhcp work(1)
[ 23.418251] [atbm_log]:[wlan0]:[8] deliver slow
[ 23.423742] [atbm_log]:dhcp done[ 23.427244] NOHZ: local_softirq_pending 08
Lease of 192.168.2.31 obtained, lease time 7200
[ 23.444160] [atbm_log]:connecting done
deleting routers
adding dns 192.168.2.1
sonoff_dns.sh work
find region us
start parsing hostname:kinesisvideo.us-east-1.amazonaws.com
[ 23.545402] [atbm_log]:start tx ba session fail[9c:53:22:c4:d6:6c][0]
[ 23.552351] [atbm_log]:start tx ba session fail[9c:53:22:c4:d6:6c][0]
[ 23.559062] [atbm_log]:start tx ba session fail[9c:53:22:c4:d6:6c][0]

[ 23.585996] [atbm_log]:AMPDU[wlan0]:action[2],tid[0],ssn[8],buff_size[0],token[0],ta[9c:53:22:c4:d6:6c]
[ 23.603939] [atbm_log]:AMPDU[wlan0]:action[4],tid[0],ssn[0],buff_size[64],token[0],ta[9c:53:22:c4:d6:6c]
[ 23.756742] rx ampdu ++
long link is not running, send fail:0
(0,0):294.193
(0,1):285.555
(0,2):295.085
(0,3):236.360
(0,4):298.415
dns_servers(8.8.8.8):281.922ms
long link is not running, send fail:0
(1,0):102.269
(1,1):30.459
(1,2):104.425
(1,3):32.437
(1,4):105.321
dns_servers(8.8.4.4):74.982ms

Fastest DNS server: 8.8.4.4 (30.459 ms)
colink no need to update resolv.conf
enter colink lib init.
exit colink lib init.
[COLINK print:src/colink.c,253,colinkProcess] COLINK_PROCESS_START
[COLINK print:src/colink.c,284,colinkProcess] COLINK_PROCESS_DISTOR_START
[COLINK print:src/colink.c,301,colinkProcess] COLINK_PROCESS_DISTOR
[COLINK print:src/colink_distor.c,389,colinkDistorSubProcess] DISTOR_PROCESS_START
[COLINK print:src/colink_distor.c,407,colinkDistorSubProcess] DISTOR_PROCESS_DNS_START

=======colinkGethostbyname======
hostname: us-dispd-v1.coolkit.cc
[IPv4]43.162.116.207 [port]443
[COLINK print:src/colink_distor.c,426,colinkDistorSubProcess] DISTOR_PROCESS_DNS_GET_IP

=======colinkGethostbynameState======
[COLINK print:src/colink_distor.c,452,colinkDistorSubProcess] DISTOR_PROCESS_CONNECT
1.0======> connect time stamp:1701388814185
1.1======> connect time difference:67
select success, continue SSL_connect.
SSL_connect success.
[COLINK print:src/colink_distor.c,473,colinkDistorSubProcess] DISTOR_PROCESS_CONNECTING
[COLINK print:src/colink_distor.c,493,colinkDistorSubProcess] DISTOR_PROCESS_WRITE
[COLINK print:src/colink_distor.c,513,colinkDistorSubProcess] DISTOR_PROCESS_READ
[COLINK print:src/colink_distor.c,523,colinkDistorSubProcess] read_tcp_buf=[177][HTTP/1.1 200 OK
Content-Length: 91
Content-Type: application/json; charset=utf-8

{"error":0,"reason":"ok","IP":"13.57.75.57","port":443,"domain":"conn-us-long5.coolkit.cc"}]
[COLINK print:src/colink_distor.c,544,colinkDistorSubProcess] DISTOR_PROCESS_STOP
[COLINK print:src/colink.c,375,colinkProcess] COLINK_PROCESS_SERVER_START
[COLINK print:src/colink.c,386,colinkProcess] COLINK_PROCESS_SERVER
[COLINK print:src/colink_server.c,3152,colinkServerSubProcess] SERVER_PROCESS_START
1.0======> connect time stamp:1701388816216
1.1======> connect time difference:93
select success, continue SSL_connect.
select success, continue SSL_connect.
SSL_connect success.
[COLINK print:src/colink_server.c,3185,colinkServerSubProcess] SERVER_PROCESS_CONNECT
[COLINK print:src/colink_server.c,3216,colinkServerSubProcess] SERVER_PROCESS_WS_CONNECT
[COLINK print:src/colink_server.c,3241,colinkServerSubProcess] SERVER_PROCESS_WS_READ
[COLINK print:src/colink_server.c,3283,colinkServerSubProcess] SERVER_PROCESS_LOGIN
[COLINK print:src/colink_server.c,3303,colinkServerSubProcess] SERVER_PROCESS_LOGIN_OK
Mon Dec 29 18:54:07 UTC 2025
timezone -6.000000
2025-12-29 18:54:08.063 PROFILE createRtcCertificate(): [Certificate creation time] Time taken: 510 ms
initKvsWebRtclib
init_lws_create_context
timezone -6.000000
`

[themactep]

I received mine today. https://discord.com/channels/1086012062649565286/1455275148549685330
I will add a config tomorrow after i find motors gpio.

[themactep]

done and done. the firmware image will be built tonight.

[tango38317]

Hi @themactep ,
i´ll receive my Sonoff cam-b1p today.
the way to install thingino is to flash the firmware to SD-Card and start kamera?
do you maybe have some instruction how to flash sonoff?
thx
chris

[themactep]

the installation image from slim2 should work with it, just replace the firmware bin with the correct one from b1p

[tango38317]

Hi,
thanks, works as expected.
Downloaded image file for slim2, write is to sd card, changed the .bin to correct one from b1p turned device on and after a few minutes the device was flashed with thingino.
thx

[tango38317]

Hi @themactep ,
one of my cameras was flashed successfully, but 2nd one stops responding.
i found https://unbricker.wltechblog.com/ and want to try to get it up and running with unbricker - but i think, this camera is not listed here.
do you have an idea how to unbrick the device?
thx
chris

[mikerocklewitz]

It might matter if you didnt remake the sd from scratch for the 2nd camera because it has some form of backup from the 1st camera on it.....

[tango38317]

HI,
i only deleted the backup folder and did it with same sd card.

[tango38317]

Ok, seems this was a good hint.
remake the sd card from scratch and flashed new, and reflashed camera. now its working
Many thanks @mikerocklewitz

[AdrianJBHughes]

Following up on the CAM-B1P thread — a couple of questions on current status:

1. Is the pan motor GPIO mapping actually finished at this point? I saw "done and done" mentioned along with "Stepper Motor Driver Loaded" in the boot log, but couldnt tell if that means PTZ control (manual or auto) is actually confirmed working, or just that the driver loads without full motor control wired up yet.

2. Has anyone confirmed stable RTSP output for NVR use (specifically Frigate)? Looking to replace stock firmware mainly to drop the cloud dependency (eWeLinks Camera Plan uploads motion-triggered footage to AWS Kinesis by default), and RTSP reliability into an NVR is the main thing that matters for my use case — motor control would be a nice bonus but isnt a blocker for me.

[mikerocklewitz]

Last I tested it everything was functional