In this post, I’ll share how to set up ASUS TUF 2024 A14 to run Ubuntu 24.04 LTS. This machine is equipped with a Ryzen HX370 processor, an Nvidia 4060 GPU, and maxed-out specifications. It’s a good machine for the price, particularly in the Indian market, and I’ve been impressed with its performance.

Challenges with Linux on Modern Laptops

One of the main hurdles with installing Linux on modern laptops is driver compatibility. Popular Linux distributions often lag in supporting cutting-edge hardware, especially when it comes to GPUs, Wi-Fi, and power management features. This delay can lead to frustrating issues like poor battery life, missing functionality, or even an inability to boot properly. This often push people to opt old hardwares (laptop segment) to run linux.

Why this Post?

Before buying this laptop, I researched its Linux compatibility and how challenging it would be to set up and run a Linux distribution smoothly. I didn’t want a system that works inconsistently. The ASUS TUF 2024 A14 stood out to me for its excellent specifications. Its combination of Ryzen HX370 and Nvidia 4060 ensures top-notch performance for both productivity tasks and gaming. However, as expected, setting it up for Linux required some extra effort to ensure everything worked properly. While there are utilities like asusctl and supergfxctl for Linux support, there are still challenges to get them working seamlessly. This post serves as a quick referece for those interested to setup Ubuntu 24.04 on this machine.

Steps to Set Up Ubuntu 24.04 LTS

I have used Ubuntu 24.04 due to it’s LTS support. Follow these steps:

Ubuntu Installation Steps

1. Boot Ubuntu 24.04 using USB: Boot Ubuntu 24.04 using USB and add the following boot parameter by editing grub entry for failsafe graphics(press e and add the following on the line that start with linux ):

   nouveau.modeset=0
   

2. Install Ubuntu: During installation, avoid installing the Nvidia driver (if secureboot is enabled).

3. Reboot: Restart the system and select failsafe mode again with nouveau.modeset=0.

4. Enable networking and drop to root:

   sudo apt-get update
   sudo apt-get install linux-image-6.11.0-1010-oem
   sudo apt-get install linux-headers-6.11.0-1010-oem
   sudo reboot
   

5. Boot Normally: After reboot, install Nvidia drivers:

   sudo ubuntu-drivers list
   sudo ubuntu-drivers install
   

   Set a temporary password for MOC key installation. This step is required to sign and validate the new drivers with a Machine Owner Key (MOC), ensuring they work with Secure Boot enabled. There’s no need to disable Secure Boot during this process.

6. Virtualization Setup

   Install virtualization tools:

    sudo apt install -y qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virt-manager virtiofsd
   

   Add your user to the relevant groups:

    sudo addgrp $USER libvirt
    sudo addgrp $USER kvm
   

   Install dependencies:

    sudo apt-get install git
    sudo apt-get install curl
   

   Configure supergfxd to enable vfio:

   This configuration is required only if you plan to pass through the Nvidia GPU to KVM for virtualization purposes. Follow these steps to clone and install supergfxctl from GitLab:

    sudo apt-get install git build-essential cmake
    cd ~
    git clone https://gitlab.com/asus-linux/supergfxctl.git
    cd supergfxctl
    make
    sudo make install
   

   After installation, update the supergfxd configuration file with vfio_enable: true:

    sudo nano /etc/supergfxd.conf
   

    {
    "mode": "Integrated",
    "vfio_enable": true,
    "vfio_save": false,
    "always_reboot": false,
    "no_logind": false,
    "logout_timeout_s": 180,
    "hotplug_type": "None"
    }
   

7. Customization

    sudo apt install gnome-shell-extension-manager
   

   Gnome extensions

   • freon
   • gpu-supergfxctl-switch

   Install dependencies:

    sudo apt install lm-sensors
    sudo sensors-detect --auto
   

Results

To reduce battery usage, you can switch to integrated graphics using supergfxctl -m Integrated and reduce the monitor refresh rate to 60 Hz. A logout is required for GPU change. Able to get a power consumption of ~7W during light usage, such as browsing and video playback. While this is not a thorough benchmark, achieving 7W consumption on a 73Wh battery gives atleast 8–9 hours of battery life.

I managed to get KVM with Ubuntu running at ~8.3W of power consumption, which is impressive considering that the HX370 processor is designed to be power-efficient.

You can switch to Hybrid mode using supergfxctl -m Hybrid. However, there is a drawback: the default GPU in this mode is the dGPU (Nvidia 4060), and the display manager is rendered using the Nvidia GPU. Also when you switch to Hybrid, X11 will be your display manager instead of wayland. Unfortunately, I was unable to set the iGPU as the default and use the Nvidia GPU solely for offloading rendering tasks.

Additionally, asusctl had issues starting up and was unreliable in my setup (it do not support ubuntu officially). It worked randomly, so I am not using it at the moment. If someone manages to get it working consistently, it could enable features like adjusting fan curves and other performance settings.

Lastly, with supergfxctl -m Vfio, you can attach the Nvidia GPU to any of your VM machines, which is a useful feature for virtualization. You can use the gnome shell extension gpu-supergfxctl-switch to quickly change from the settings. For more detailed configurations follow Vfio guide.

You can follow up on this if you want to explore the VM options

Overview

The tricky part is to find a brand (in India) that works with home assistant. Finally bought one https://homemate.co.in/product/wi-fi-fan-touch-switch/ manufactured by HomeMate https://homemate.co.in/.

Turns out, these devices run a custom firmware build by Tuya platform (A chineese IoT/AI company) and there is a Home Assitant integration plugin called Tuya for integrating. You can configure those devices using this plugin and will work most of the times (:-)). But I do not want an IoT device in my network that send stats every now and then to a Chineese cloud vendor. So let’s teardown this and see what’s inside and may be we can flash our own custom firmware.

Teardown

There is a dedicated app which can be used to configure the device. Once configured you can switch the fan on/off set timer etc… Let’s tear down and see what’s inside first.

Turns out, it’s a CB3s module https://developer.tuya.com/en/docs/iot/cb3s?id=Kai94mec0s076. On further investigation, it turns out that the entire module is built up using tuya IoT Core which is a chineese IoT/AI company service. They offers a free to brand home solution which can be created solely using their Tuya web portal and to choose any predisigned products/wifi modules and as well as mobile apps. The initial devices were using esp8266 chips. Found this tuya-convert github link where it expains how to hack these chips and flash a custom firmware. Probably they changed the chips from esp8266 to cbxx chips. It would have been much easier to flash esp8266 chips.

Found this link tuya-cloud-cutter where it is possible to do the same but for the cb3s modules. Since the chip is not esp based, we cannot use ESPHome or Tasmota. There is a similar one called OpenBeken which supports the CB3s module.

Following tuya-convert steps will help in installing the OpenBeken build. Before that, you can find out the current installed firmware from the native android app. Then find a compaitable build from the release page. You can follow the Electroda forum for more information on the Openbeken and tuya devices.

Once you finished with the tuya-convert steps, you will end up with a openbeken firmware. Similar to tasmota, the device will create a Hotspot and you can navigate to a web interface at 192.168.4.1.

Now you need to configure the device. For this you need to know the pinout. It seems different vendors may change the pinout slightly. Also depending on the vendors, they may choose a slighty different chip within the circuit board (for example some may use BL0937 or BL0942 for power monitoring). There is also a tuya MCU chip which is connected via UART (I guess) to the main chip (CB3S).The CB3S chip will send custom commands to the tuyaMCU and it will execute those.

The openBeken firmware has support for all of these modules. You only need to figure out the pin layout and it’s configuration. A big kudos to those who worked on these projects and also for figuring out the commands tuyaMCU supports.

Go to http://192.168.4.1/app? and configure the pins (detailed configuration are mentioned below. Had to spend a lot of time figuring out the pinout/configurations). You may also need to add an autoexec.bat file which is executed on boot. This can be used to load drivers and tuyaMCU configurations. Also configure your wifi and home assistant server details.

My initial thought was to replace the CB3S module with my ESP12E module and flash ESPHome or custom firmware. That is not required anymore. Chances are that homemate use the same platform for other product variants as well. So I bought couple of their other products as well.

1. Homemate WiFi mini Smart Plug Socket 10 A

Pinout configuration

{
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "Full Device Name Here",
  "model": "enter short model name here",
  "chip": "BK7231N",
  "board": "TODO",
  "flags": "1024",
  "keywords": [
    "TODO",
    "TODO",
    "TODO"
  ],
  "pins": {
    "6": "BL0937CF1;1",
    "7": "BL0937CF;1",
    "8": "LED_n;1",
    "10": "Btn;1",
    "24": "BL0937SEL;1",
    "26": "Rel;1"
  },
  "command": "startDriver BL0937",
  "image": "https://obrazki.elektroda.pl/YOUR_IMAGE.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/topic_YOUR_TOPIC.html"
}

2. Homemate WiFi Smart Heavy Duty Plug Socket 16 A

Pinout configuration

{
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "Full Device Name Here",
  "model": "enter short model name here",
  "chip": "BK7231T",
  "board": "TODO",
  "flags": "1024",
  "keywords": [
    "TODO",
    "TODO",
    "TODO"
  ],
  "pins": {
    "7": "BL0937CF;1",
    "8": "BL0937CF1;1",
    "10": "Btn;1",
    "24": "BL0937SEL;1",
    "26": "Rel;1"
  },
  "command": "startDriver BL0937",
  "image": "https://obrazki.elektroda.pl/YOUR_IMAGE.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/topic_YOUR_TOPIC.html"
}

autoexec.bat

SetupEnergyStats
startDriver BL0937
startDriver NTP

3. Homemate WiFi 4 Gang Smart Touch Switch

autoexec.bat

startDriver TuyaMCU

setChannelType 1 toggle
setChannelType 2 toggle
setChannelType 3 toggle
setChannelType 4 toggle
setChannelType 13 toggle

setChannelType 7 TextField
setChannelType 8 TextField
setChannelType 9 TextField
setChannelType 10 TextField

linkTuyaMCUOutputToChannel 1 1 1
linkTuyaMCUOutputToChannel 2 1 2
linkTuyaMCUOutputToChannel 3 1 3
linkTuyaMCUOutputToChannel 4 1 4
linkTuyaMCUOutputToChannel 7 2 7
linkTuyaMCUOutputToChannel 8 2 8
linkTuyaMCUOutputToChannel 9 2 9
linkTuyaMCUOutputToChannel 10 2 10
linkTuyaMCUOutputToChannel 13 1 13

4. Homemate WiFi Smart Regulator Switch

autoexec.bat

AutoExec

// start MCU driver
startDriver TuyaMCU

// fan on/off channel
setChannelType 1 toggle

//fan speed channel
setChannelType 3 OffLowestLowMidHighHighest

// child Lock channel
setChannelType 14 toggle

// countdown channel
setChannelType 22 TextField

// remaining timer channel
setChannelType 23 TextField

// link output 1 to channel 1
linkTuyaMCUOutputToChannel 1 1 1

// link output 3 to channel 3
linkTuyaMCUOutputToChannel 3 2 3

// link output 14 to channel 14
linkTuyaMCUOutputToChannel 14 1 14

// link output 22 to channel 22
linkTuyaMCUOutputToChannel 22 2 22

// link output 23 to channel 23
linkTuyaMCUOutputToChannel 23 2 23

You can also look at my post in electroda.come here. For power plug you need to calibrate your devices once you flashed the openbeken firmwares.

For this, you need a traditional incandascent lamp. You could use an LED buld as well but it won’t be accurate as the power fluctuates. An incadescent lamp draws exactly the same power at almost constant current without any fluctuations. I managed to find a 100W incandescent bulb from a local shop to calibrate the sensors. The 10A power plug and 16A power plug both uses BL0937 chip but the pin layout is different. Once you caliberate the device then you are good to go. You do not need any custom integration plugin for homeassistant and everything works completly local.

It seems there are a lot of IoT Devices that uses the same tuya platform. I saw a post from Pallaw Agarwal https://pallavaggarwal.in/2022/12/07/wipro-smart-plug-16a-teardown who did a teardown of Wipro Smart Plug. The circuit board and the chip is very much identical and probably run the same tuya firmware. There is also one more brand called Kamonk which looks identical to that of HomeMate. It may also run on the same firmware.

These brands are labeled as #ProudlyMadeIndia initiatives and procalimed as completly designed, developed and made in india. But atleast the entire software stack is not made by an Indian firm.

HomeAssistant

Once all devices are setup properly, this will come in the homeassistant. Since the blog entry is not specific to home assistant, I am not going into the details. But once evrything is done, the dashboard looks pretty good.

Forward Propagation

For sigmoid,

Vectorized Form with m training set

Backward Propagation

Loss function is given by

where final cost,

For backward propagation, we need to calculate \(\frac{\partial L}{\partial W^{[2]}}\), \(\frac{\partial L}{\partial b^{[2]}}\), \(\frac{\partial L}{\partial W^{[1]}}\) and \(\frac{\partial L}{\partial b^{[1]}}\) where we update

on each iteration

From chain rule,

Let’s take each one and find it’s values.

where

To summarize all the equation,

where

Generalized Form

To generalize, for an n layer nerual network,

These are some of the variations which I have rendered using blender.

Idea

It’s always good to start with a rough sketch.

Once settled with the initial design, I have started modelling with blender.

Modelling

Removed the initial cube and then set the scales correctly.

Started with a basic mesh cyclinder and modelled to get a basic shape.

Once done, created a subdivision modifier and then a solidfy. Then added wireframe modifier to get the desired mesh look.

Added text and a solid cube to hold it firmly.

After some fine tuning and placing the text on the pen holder.

Once done, generated a final render to see how it’s look.

3D printing

Sliced the model using chitubox and printed using the Anycubic Mono 4k.

Final result

After cleaning, the print is healed under UV light. Painted the name with black and the final result looks awsome… :-)

3D printing, also known as additive manufacturing, is a method of creating a three dimensional object layer-by-layer using a computer created design. Whether you are a product designer or a DIY enthusiast, this is an invaluable tool to your tool arsenal.

I have been thinking for a long time to write a short blog about this. There are a ton of detailied blog/videos already exist, but still there is a lot of things you need to figure out through tial and error. This includes tuning your 3D printer for the best results, slicing softwares, custom addons for your printer, post processing tools (locally available products) & methods, 3D cad tools, paints etc… This blog try to cover what I have gone while tinkering with the 3D printing.

Fun things apart, this is a great tool if you are a product designer (even by profession or as a hobby). If you like to design things on your own then this saves you a lot of time in dealing with prototypes. I own a Creality Ender 3 Pro (Bought it 2 years back). It’s a pretty decent FDM (Fused Deposition Modeling) printer you can buy. I also own an AnyCubic resin printer which is a good addon if you are interested in minis or prints that require minute details. It’s a little messy to handle though and require proper care in handling.

Ready made models

I started printing free models that is publically avaialble. There is a huge colection of super cool 3d models at myminifactory.com and thingiverse.com. Your first print is destined to be ruined (if not, don’t worry you will have a lot waiting to be thrown out to trash).

Some super cool models…

Slicer

First thing you need is a slicer software. For FDM, you can use CURA. It is an open source 3D printer created for Ultimaker printers but supports a wide range of others as well. There are several softwares out there you could try like PrusaSlicer. But it is always a good idea to rely on an opensource alternative than a comercial/closed one. STL is a widely used format for sharing 3D models. A slicer software like CURA will slice this 3D model into several layers and create Gcodes More info here that the printer can understand.

For resin printing you can use Chitubox. Like FDM slicer there are not as many options available. You need to find somthing that is supported by yuor printer. I am using both Phtoton Workshop and Chitubox.

Post processing

There are several post processing techniques you could do to get a good finished product. This writeup covers a lot https://www.makerbot.com/professional/post-processing/.

• Sanding
  • If you are looking for a finished product then don’t skip this. :-)
  • Start sanding from a lower grit (400) and gradually increase upto 1500 or even 2000
  • You could use sanding tools like dremel to get this done fast
  • You could cheat a little bit using clear coat spray paint link if your print is already smooth.
• Gluing
  • You can break the whole print into multiple parts if build voulume is not enough.
  • Also useful if there are areas in your model which is steep and cannot print with a lot of support.
• Painting
  • Optionally you can use a primer as first coat. Primer filler is a high build spray filler that comes in aerosol form and can be purchased at most local hardware stores.
  • Filler used for wood works and automobiles also works fine. But don’t forget to sand it before painting.
  • Acrylic spary paint works just fine. You can find these in most of the local hardware shops. link
  • For smaller prints like mini, acrylic paints like these are just fine link or even this one link
  • I used to do a clear coat if it’s painted by acrylic colours.

3D CAD software

Printing free models and painting those are fun. But what’s more fun is to start designing 3D models for your prototypes. You have a big list of CAD softwares that are available here. One could start with tinkercad and move towards a good professional CAD software. I did start with SolidWorks and then moved to Fusion 360. Solidworks is an overkill for these kind of works. But Fusion360 was very good; atleast initially. They allow you to use this freely if you are a student. It is tightly coupled with their cloud platform and it had some one year free usage. Had faced lot of issues initially and it need an active internet connection (most of the time) to work. Also there was limitted support for sculpting and creating organic shapes. I finally settled with Blender which is a very good software and is completly open source. I won’t lie, it has a steep learning curve. But I would say it is worth the effort. Parametric designs may be somewhat less intuitive but blender is an all in one solution. You can do sculpting as well. Add some lights and create cool renders of your product animate little bit and may be rig your model and do some inverse IK :-).

• Tincker
• Fusion360
• Blender

The theme is created for Ubuntu 18.00. But this can be installed on previous versions with slight modification.

In the officail site, they have mentioned about Hi3516E. it is an SoC buid by HISILICON that runs on Linux-3.18 (probably running Huawei LiteOS Link). Looking into the datasheet Link, it supports following encodings,

• H.264 BP/MP/HP
• H.265 Main Profile
• MJPEG/JPEG baseline

But from the official site, it’s mentioned H.264. So most probably the stream will be in this format. This came handy later in the process.

Once powered, camera starts a WiFi AP. Client can connect to this using default password 1234567890 and use companion app to configure. Put your WiFi interface to monitor mode and start listening on the traffic.

I could see a lot of HTTP traffic between companion app and 193.168.0.1 which is the camera device. So they have some kind of REST API service running on port 80. Let’s look into the flow.

To get a sessionid they are calling POST /vcam/cmd.cgi?cmd=API_RequestSessionID. This set a Cookie and they are reusing it for further communication. Then they are synching the time. Why do they need imei number for that? Strange. let’s look the subsequent requests.

POST /vcam/cmd.cgi?cmd=API_GetBaseInfo HTTP/1.1
Accept-Encoding: gzip
sessionid: sjqPqaCL9GPT8WanzOn1THq4T1iSKLm
Cookie: SessionID=sjqPqaCL9GPT8WanzOn1THq4T1iSKLm
Content-Type: application/x-www-form-urlencoded
User-Agent: ****************************************
Host: 193.168.0.1
Connection: Keep-Alive
Content-Length: 0

HTTP/1.1 200 OK
Server: VYOU_HTTP_SERVER/2.1.3 CAM WEB 1.0
Content-Type: text/plain; charset=UTF-8
Date: Wed, 09 Oct 2019 21:54:41 GMT
Last-Modified: Wed, 09 Oct 2019 21:54:41 GMT
Connection: Keep-Alive
Cache-Control: no-cache,no-store
Content-Length: 651

{"errcode":0,"data":"{\"nickname\":\"vYou_DDPai_MINI\",\"password\":\"1234567890\",\"ordernum\":\"DDPaiMin\",\"model\":\"DDPai miniONE_LITE_Overseas\",\"version\":\"v4.7.0.22\",\"uuid\":\"*****-****-****-****-********\",\"sn\":\"\",\"macaddr\":\"**:**:**:**:**:**\",\"chipsn\":\"\",\"legalret\":1,\"btnver\":3,\"totalruntime\":7471,\"sdcapacity\":31158784,\"sdspare\":24202912,\"sdbrand\":\"\",\"hbbitrate\":10240,\"hsbitrate\":2048,\"mbbitrate\":10240,\"msbitrate\":2048,\"lbbitrate\":10240,\"lsbitrate\":2048,\"default_user\":\"A1000030EBAA94\",\"is_neeed_update\":0,\"edog_model\":\"\",\"edog_version\":\"\",\"edog_status\":2,\"cid\":\"\"}"}

GET /record.log HTTP/1.1
Accept-Encoding: 
User-Agent: ****************************************
Host: 193.168.0.1
Connection: Keep-Alive

HTTP/1.1 200 OK
Server: VYOU_HTTP_SERVER/2.1.3 CAM WEB 1.0
Content-Type: text/plain; charset=UTF-8
Date: Wed, 09 Oct 2019 21:54:41 GMT
Last-Modified: Wed, 09 Oct 2019 21:54:41 GMT
Connection: Keep-Alive
Cache-Control: no-cache,no-store
Content-Length: 4329

{"nickname":"vYou_DDPai_MINI","password":"1234567890","ordernum":"DDPaiMin","model":"","version":"v4.7.0.22","uuid":"***********************","sn":"","macaddr":"**:**:**:**:**:**","chipsn":"","legalret":1,"btnver":3,"totalruntime":7471,"sdcapacity":31158784,"sdspare":24202912,"sdbrand":"","hbbitrate":10240,"hsbitrate":2048,"mbbitrate":10240,"msbitrate":2048,"lbbitrate":10240,"lsbitrate":2048,"default_user":"A1000030EBAA94","is_neeed_update":0,"edog_model":"","edog_version":"","edog_status":2,"cid":""}
....

POST /vcam/cmd.cgi?cmd=APP_AvCapSet HTTP/1.1
Accept-Encoding: gzip
sessionid: sjqPqaCL9GPT8WanzOn1THq4T1iSKLm
Cookie: SessionID=sjqPqaCL9GPT8WanzOn1THq4T1iSKLm
Content-Type: application/x-www-form-urlencoded
User-Agent: ****************************************
Host: 193.168.0.1
Connection: Keep-Alive
Content-Length: 30

{"stream_type":0,"frmrate":30}

HTTP/1.1 200 OK
Server: VYOU_HTTP_SERVER/2.1.3 CAM WEB 1.0
Content-Type: text/plain; charset=UTF-8
Date: Wed, 09 Oct 2019 21:54:41 GMT
Last-Modified: Wed, 09 Oct 2019 21:54:41 GMT
Connection: Keep-Alive
Cache-Control: no-cache,no-store
Content-Length: 23

{"errcode":0,"data":""}

Some default user names, password, etc… It seems POST /vcam/cmd.cgi?cmd=APP_AvCapSet sets stream channel and fps.

POST /vcam/cmd.cgi?cmd=API_RequestCertificate HTTP/1.1
Accept-Encoding: gzip
sessionid: sjqPqaCL9GPT8WanzOn1THq4T1iSKLm
Cookie: SessionID=sjqPqaCL9GPT8WanzOn1THq4T1iSKLm
Content-Type: application/x-www-form-urlencoded
User-Agent: ****************************************
Host: 193.168.0.1
Connection: Keep-Alive
Content-Length: 70

{"user":"admin","password":"admin","level":0,"uid":"*************"}

HTTP/1.1 200 OK
Server: VYOU_HTTP_SERVER/2.1.3 CAM WEB 1.0
Content-Type: text/plain; charset=UTF-8
Date: Wed, 09 Oct 2019 21:54:41 GMT
Last-Modified: Wed, 09 Oct 2019 21:54:41 GMT
Connection: Keep-Alive
Cache-Control: no-cache,no-store
Content-Length: 23

{"errcode":0,"data":""}

POST /vcam/cmd.cgi?cmd=APP_AvCapReq HTTP/1.1
Accept-Encoding: gzip
sessionid: sjqPqaCL9GPT8WanzOn1THq4T1iSKLm
Cookie: SessionID=sjqPqaCL9GPT8WanzOn1THq4T1iSKLm
Content-Type: application/x-www-form-urlencoded
User-Agent: ****************************************
Host: 193.168.0.1
Connection: Keep-Alive
Content-Length: 0

HTTP/1.1 200 OK
Server: VYOU_HTTP_SERVER/2.1.3 CAM WEB 1.0
Content-Type: text/plain; charset=UTF-8
Date: Wed, 09 Oct 2019 21:54:41 GMT
Last-Modified: Wed, 09 Oct 2019 21:54:41 GMT
Connection: Keep-Alive
Cache-Control: no-cache,no-store
Content-Length: 173

{"errcode":0,"data":{"bs_pixel":"1920x1080","bs_bitrat":10240,"bs_frmrate":30,"ss_pixel":"854x480","ss_bitrat":1536,"ss_frmrate":30,"aud_samplerate":16000,"aud_pt":"AACLC"}}

POST /vcam/cmd.cgi?cmd=APP_AvCapReq This request put some light into the video stream details.

POST /vcam/cmd.cgi?cmd=APP_PlaybackLiveSwitch HTTP/1.1
Accept-Encoding: gzip
sessionid: sjqPqaCL9GPT8WanzOn1THq4T1iSKLm
Cookie: SessionID=sjqPqaCL9GPT8WanzOn1THq4T1iSKLm
Content-Type: application/x-www-form-urlencoded
User-Agent: ****************************************
Host: 193.168.0.1
Connection: Keep-Alive
Content-Length: 31

{"switch":"live","playtime":""}

This seems to be the one that triggers the live streams. Just after this request I could see a new TCP connection got established on port 6200.

This might be the port for streaming video. I could see a lot of traffic on this connection just after this.

Let’s see which all ports are opened in the cam. A quick scan using nmap shows following ports.

Port 443 is opened. But it is not a web/REST server like port 80. Sending curl http://193.168.0.1:443 doesn’t return anything. No respone from server. telnet 193.168.0.1 443 also had no luck. Might be running some other service. May be for flashing firmware.

Port 553 is running an rtsp service. This looks promising. Rtsp is for streaming video. Tried several common rtsp urls using VLC. All are returning BAD_REQUEST. No luck there. Port 6100 looks promissing. Let’s try opening this using VLC.

wget "http://193.168.0.1:6200" -qO- | cvlc -

Vlc is unable to show any streams. Let’s try to specify the stream details. May be Vlc was unable to figure out proper streaming details.

wget "http://193.168.0.1:6200" -qO- | cvlc - :demux=h264 --h264-fps=30 :clock-jitter=0

Finally!!! Vlc is able to get the stream with no issues. Smile… :-)

Now this is done let’s see whether I can access this from python & opencv.

import numpy as np
import cv2

cap = cv2.VideoCapture('tcp://193.168.0.1:6200/')
cap.set(5, 30)

while(True):
    # Capture frame-by-frame
    ret, frame = cap.read()

    # Our operations on the frame come here
    #gray = cv2.cvtColor(frame, cv2.COLOR_BGR2GRAY)

    # Display the resulting frame
    cv2.imshow('frame',frame)
    if cv2.waitKey(1) & 0xFF == ord('q'):
        break

# When everything done, release the capture
cap.release()
cv2.destroyAllWindows()

Perfect. I was able to get the stream from python. Mission accomplished. But let’s look further.

I ran nmap one more time covering all the ports. It’s extensive and took some time. It showed one more port 6100. Later found to be audio stream from the camera.

Let’s check whether we can have a look into the firmware. I could not find any links online to download firmware. When I first started the companion app, it asked for firmware update. So there should be some way to get it. Let’s look into the companion app traffic.

Download some packet capture software for Android like ‘Packet Capture’. It’s similar to wireshark, but for Android. It seems comapnion app is communicating with server in plain http. No SSL certificate for the server. That’s not good. They are sending some personal details back to the server which is not good. Let’s look into the firmware update details.

Clicking on check firmware option triggers this request.

It seems they are sending both version details of firmware and companion app. Server seems to only respond with companion app details. This might probably because I am having latest firmware. Lets modify this request so that server think I am having a previous version.

curl -v -H 'Content-Type: application/json' -X POST http://apphw.ddpai.com/d/api/v1/version/check --data '{
  "data": [
    {
      "model": "camera_app_android_overseas",
      "version": "v5.7.12.0926"
    },
    {
      "model": "DDPai miniONE_LITE_Overseas",
      "version": "v4.6.0.22"
    }
  ]
}'
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 47.89.133.142...
* TCP_NODELAY set
* Connected to apphw.ddpai.com (47.89.133.142) port 80 (#0)
> POST /d/api/v1/version/check HTTP/1.1
> Host: apphw.ddpai.com
> User-Agent: curl/7.58.0
> Accept: */*
> Content-Type: application/json
> Content-Length: 197
> 
* upload completely sent off: 197 out of 197 bytes
< HTTP/1.1 200 OK
< Date: Thu, 10 Oct 2019 17:33:54 GMT
< Content-Type: application/json;charset=UTF-8
< Content-Length: 1457
< Connection: keep-alive
< 
{
    "data": [
        {
            "bigMd5": "63D8900C41169ED76A107140F3119433",
            "bigPath": "http://httpsdatacdn.ddpai.com/update/camera_app_android_overseas/20180620/C05_ddpai_v5.7.9.0613_release_0613-1439_zip.apk",
            "bigSize": 42322062,
            "bigSmallSplit": "",
            "bigTime": 0,
            "commitDate": 1529486660540,
            "desc": "1、适配mix3机型；\n2、使用新的视觉风格；\n3、修复已知问题；",
            "descCn": "1、适配mix3机型；\n2、使用新的视觉风格；\n3、修复已知问题；",
            "descDe": "",
            "descEn": "1、Adopted to mix3;\n2、Adopted a new VI style；\n3、Fixed bugs;",
            "descEs": "",
            "descFr": "",
            "descIt": "",
            "descPt": "",
            "descRu": "",
            "descTw": "",
            "hasDel": false,
            "id": 64,
            "model": "camera_app_android_overseas",
            "name": "camera_app_android_overseas",
            "smallMd5": "",
            "smallPath": "",
            "smallSize": 0,
            "smallTime": 0,
            "smallVersion": "",
            "version": "v5.7.9.0613",
            "versionType": 1
        },
        {
            "bigMd5": "768A1E03AF163ACC53C0841AE5F5EF8B",
            "bigPath": "http://httpsdatacdn.ddpai.com/update/DDPaiminiONE_LITE_Overseas/20190614/update_nolog.tar.gz",
            "bigSize": 5365231,
            "bigSmallSplit": "",
            "bigTime": 60,
            "commitDate": 1560481333328,
            "desc": "修复已知问题；",
            "descCn": "修复已知问题；",
            "descDe": "",
            "descEn": "Fixed bugs;",
            "descEs": "",
            "descFr": "",
            "descIt": "",
            "descPt": "",
            "descRu": "",
            "descTw": "",
            "hasDel": false,
            "id": 74,
            "model": "DDPai miniONE_LITE_Overseas",
            "name": "DDPai miniONE_LITE_Overseas",
            "smallMd5": "",
            "smallPath": "",
            "smallSize": 0,
            "smallTime": 0,
            "smallVersion": "",
            "version": "v4.7.0.22",
            "versionType": 1
        }
    ],
    "error_code": 0
}
>

Ta daa!!! Our new firmware ready to be downloaded here http://httpsdatacdn.ddpai.com/update/DDPaiminiONE_LITE_Overseas/20190614/update_nolog.tar.gz. This is good. Let’s try to analyze the firmware.

Eventhough it’s ramed as .gz, it doesn’t look a gzip compression. Running binwalk reveals that they use zlib compression. Let’s try to extract each part.

Let’s see what each part is.

We have two JFFS2 file system. Let’s see what’s inside. To extract JFFS2 file system you need to install jefferson.

git clone https://github.com/sviehb/jefferson.git
Cloning into 'jefferson'...
remote: Enumerating objects: 74, done.
remote: Total 74 (delta 0), reused 0 (delta 0), pack-reused 74
Unpacking objects: 100% (74/74), done.
>ls
1CD  1CD.zlib  21458  21458.zlib  35DE85  35DE85.zlib  50AB7A  50AB7A.zlib  56  56.zlib  E3  E3.zlib  jefferson
>cd jefferson/
>ls
LICENSE  README.md  setup.py  src
>sudo python setup.py install
running install
running build
running build_py
creating build
creating build/lib.linux-x86_64-2.7
creating build/lib.linux-x86_64-2.7/jefferson
copying src/jefferson/rtime.py -> build/lib.linux-x86_64-2.7/jefferson
copying src/jefferson/jffs2_lzma.py -> build/lib.linux-x86_64-2.7/jefferson
copying src/jefferson/__init__.py -> build/lib.linux-x86_64-2.7/jefferson
running build_scripts
creating build/scripts-2.7
copying and adjusting src/scripts/jefferson -> build/scripts-2.7
changing mode of build/scripts-2.7/jefferson from 644 to 755
running install_lib
creating /usr/local/lib/python2.7/dist-packages/jefferson
copying build/lib.linux-x86_64-2.7/jefferson/rtime.py -> /usr/local/lib/python2.7/dist-packages/jefferson
copying build/lib.linux-x86_64-2.7/jefferson/jffs2_lzma.py -> /usr/local/lib/python2.7/dist-packages/jefferson
copying build/lib.linux-x86_64-2.7/jefferson/__init__.py -> /usr/local/lib/python2.7/dist-packages/jefferson
byte-compiling /usr/local/lib/python2.7/dist-packages/jefferson/rtime.py to rtime.pyc
byte-compiling /usr/local/lib/python2.7/dist-packages/jefferson/jffs2_lzma.py to jffs2_lzma.pyc
byte-compiling /usr/local/lib/python2.7/dist-packages/jefferson/__init__.py to __init__.pyc
running install_scripts
copying build/scripts-2.7/jefferson -> /usr/local/bin
changing mode of /usr/local/bin/jefferson to 755
running install_egg_info
Writing /usr/local/lib/python2.7/dist-packages/jefferson-0.2.egg-info
>cd ../
>ls
1CD  1CD.zlib  21458  21458.zlib  35DE85  35DE85.zlib  50AB7A  50AB7A.zlib  56  56.zlib  E3  E3.zlib  jefferson
>
>
>
>binwalk -e 35DE85

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JFFS2 filesystem, little endian

Let’s look into the file system.

Under aud_res there are several raw audio files are present. These are the notofication sounds, produced by the dashcam. Replacing these with custom sounds and reflashing the firmware will be cool.

There is some libaiengine-80-liteos-2.9.4-20180402220227.so file. The filename liteos confirms it is running Huawei LiteOS.

There is one bin file called paramdef.bin located in paramdef. Seems to be binary file. Let’s see the strings in it.

>strings paramdef.bin 
arap
12.0
720P30
1080P30
1080P60
1440P30
1520P30
/app/sd/DCIM
/usrcfg/lastfilename.txt
/app/sd
/dev/mmcblk0p0
3.18.y
v4.7.0.22
DDPai miniONE_LITE
vYou_DDPai_MINI
1234567890
000000000000000
000000000000000
admin
admin
yyyy-MM-dd HH:mm:ss
zh_CN
DDPaiMin
v4.5.0.0
DDPai miniONE
2018-01-01
mrap

You could see WiFi SSID and default password, Firmware version, etc

Let’s see the other file system.

This seems mostly configuration files. config_product_devmng.ini have details regarding WiFi SSID & passwords.

[devinfo]
system_version     = "3.18.y"
software_version   = "v4.7.0.22"
model              = "DDPai miniONE_LITE"

[wifi]
ssid               = "vYou_DDPai_MINI"
password           = "1234567890"
channel            = "11"
enable             = "1" 1:true 0:false
stawifissid        = "0"
stawifipwd         = "0"
stawifiauth        = "4"; 0:OPEN 1:WEP 2:WPAPSK 3:WPA2PSK 4:WPAPSK_WPA2PSK_MIX

[autooff]
enable             = "0"
time               = "300"; unit s

[dormant]
enable             = "0"
time               = "60"; unit s

[clock]
enable             = "0"

[onoff]
auto_poweron_en    = "0"; 0:disable, 1:enable
auto_poweron_time  = "600"; seconds
sd_card_cid        = "0000000000000000"
sd_card_csd        = "0000000000000000"
abnormal_poweroff  = "1"; 
onoff_key_press_time = "2000"; 200ms~2000ms

[sound]
keysound           = "1"
bootmusic          = "0"; 0: open bootmusic 1: close bootmusic

[gsensor]
gsensorrange       = "0"

[banma]
verification	   = "0"

There is some stawifissid params. May be enabling this will make Dashcam connect to a particular WiFi than creating an AP. Could see some reference for mounting at /app/sd/DCIM. Some of the config files have the details required for the live stream.

There is one more to extract.

This seems to be the main binary file resposible for the REST interface. Running strings list a lot of useful details. It seems to be written in c since I could see some reference here and there.

By just looking into strings, you will get a lot of information. I could able to extract the list of all APIs supported by the REST service.

• API_RequestSessionID
• API_RequestCertificate
• API_SyncDate
• API_GetBaseInfo
• APP_AvCapReq
• APP_AvCapSet
• APP_PlaybackLiveSwitch
• API_GetMailboxData
• API_Logout
• API_TestGsensor
• API_TestSerial
• API_TestIndicator
• APP_PlaybackListReq
• APP_PlaybackPageListReq
• API_GeneralSave
• API_GeneralQuery
• APP_DeleteEvent
• API_CameraCapture
• API_AuthModify
• API_GetStorageInfo
• API_MmcFormat
• API_GetModuleState
• API_SetTimeForUpdateOrderNum
• API_ClearModuleFlags
• APP_AvInit
• APP_EventListReq
• APP_TimeLapseVideoListReq
• API_PlayModeQuery
• API_AuthQuery
• API_Reboot
• API_RestartWifi
• API_UpdFileMd5
• API_SetLogonInfo
• API_GetLogonRecord
• APP_ParkingEventListReq
• APP_ParkingEventListClear
• API_SuperDownload
• API_ButtonMatch
• API_WpsConnect
• API_GetResolution
• API_SetLockFile
• APP_StopDownload
• API_SetRouterAuth
• API_GetRouterStatus
• API_UpdateCamera
• API_GetLegalInfo
• API_GetSdBadClus
• API_SetDefaultCfg
• API_SetUuid
• API_SetSn
• API_GetEachFileSize
• API_BanMaUnbind
• API_BanMaSync
• API_SetApMode
• APP_EquipTestReady
• API_HwinfoQuery
• API_EquipAudioLoop
• API_EquipGetTime
• API_EquipLED
• API_EquipButtonMatch
• API_SetTestResult
• API_EquipGSensor
• API_EquipSpeaker
• API_EquipResetBtn
• API_EquipPhotoBtn
• API_EquipMuteBtn
• API_EquipMuteBtn
• API_EquipResetCfg
• API_EquipLegalSet
• API_EquipGetSensorVer
• API_EquipOpenRtsp
• API_RecordOpt
• API_GetGsensorState
• API_EquipACCState
• API_EquipGetTempetureAndHumidity
• API_EquipGetWiFiStatus
• API_EquipDeleteFacUsbFile
• API_EquipODBTest
• API_SetGsensorValue
• API_SetAudioCapGain
• API_SetBitRate1
• API_SetBitRate2
• API_SetBitRate3
• API_SetBitRate4
• API_SetBitRate5
• API_SetBitRate6
• API_SetBitRate7
• API_SetBitRate8
• API_SetBitRate9
• API_SetBitRate10
• API_SetBitRate11
• API_SetBitRate12
• API_SetBitRate13
• API_SetBitRate14
• API_SetBitRate15
• API_SetBitRate16
• API_SetBitRate17
• API_SetBitRate18
• API_GetAispeechState
• API_SetSpeakRange
• API_SetEmmcMeasure
• API_GetEmmcMeasure
• API_Get_ConnectAccStatus
• API_Get_PageFileListStatus
• API_SetTarCamlog
• API_GetCarCustomVersion
• API_SetPowerOff

This is fun… !!!

Architecture

Hardware

It consists of

• Frame
  • Front panel
  • Back panel
  • Processing Unit Cover
  • Relay Cover
• Display (7 inch 800x480 resolution)
• Processing Unit - Raspberry Pi
• Relay circuit (4 channel)

Panel and display are snapped together. Processing Unit and display are secured using screws. Processing unit and relay cover are attached using 3 mm screws.

Software

Chromium-browser is used in a kiosk mode where it render the UI from a backend server. Python with the help of Flask to serve both static pages and a REST API service. JS will invoke REST APIs to control and view stats of appliances.

REST API Service

1. List room names

   GET /api/

        {
        "rooms":["room1","room2"]
        }
   

2. List all appliances in a given room

   GET /api/{room_name}

        {
          "Fan 1": {
            "power-control": {
              "enabled": true, 
              "level": 100
            }, 
            "status": true, 
            "timer": -1, 
            "type": "fan"
          }, 
          "Light 1": {
            "power-control": {
              "enabled": false, 
              "level": 100
            }, 
            "status": true, 
            "timer": -1, 
            "type": "light"
          }, 
          "Light 2": {
            "power-control": {
              "enabled": false, 
              "level": 100
            }, 
            "status": true, 
            "timer": -1, 
            "type": "light"
          }
        }
   

3. Change appliance properties

   POST /api/{room_name}/{appliance_name}

        {
        "status":true,
        "timer":10,
        "power-control":{
                "level":50
                }
        }
   

4. Scan wifi APs

   GET /api/wifi_scan

        {
          "result":["WiFi-1","WiFi-2"]
        }
   

5. Connect to an AP

   POST /wifi_connect

        {
          "ssid":"WiFi-1",
          "passkey":"password"
        }
   

6. Disconnect already established connection

   POST /api/wifi_disconnect

        {
        }
   

7. Get current ip

   GET /api/ip

        {
          "ip": "192.168.1.5"
        }
   

UI features

These shows the features that are supported.

CAD Design

I have used fusion 360 to model the parts.

3D printing

Thanks to Sumit Goyal for helping out with 3D printing and beautifully painting the parts.

Final preview

Enable ssh

create an empty file in /boot/ssh

Connect to WiFi on boot

sudo nano /etc/wpa_supplicant/wpa_supplicant.conf

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
country=GB



network={
        ssid="insert_your_hidden_SSID_here"
        scan_ssid=1
        psk="insert_your_wifi_password_here"
        key_mgmt=WPA-PSK
}

Disable rainbow screen

sudo nano /boot/config.txt

disable_splash=1

Disable boot logs

sudo nano /boot/cmdline.txt

Change the console from tty1 to

console=tty3 

Add this to the end of the line. 'loglevel=0' removes most of the messages from the boot. You can also use 'loglevel=3', but some boot messages may re-appear.

quiet splash loglevel=0 logo.nologo vt.global_cursor_default=0

If you are going to use Plymouth add this:

plymouth.ignore-serial-consoles 

Change boot animation

Change raspbian plymouth theme

cd /usr/share/plymouth/themes/

Clone this repository.

sudo git clone https://github.com/krishnan793/PlymouthTheme-TheRun.git

Install the theme.

sudo update-alternatives --install /usr/share/plymouth/themes/default.plymouth default.plymouth /usr/share/plymouth/themes/PlymouthTheme-TheRun/PlymouthTheme-TheRun.plymouth 100

Select the default theme.

sudo update-alternatives --config default.plymouth

Update the initramfs image.

sudo update-initramfs -u

sudo nano /etc/plymouth/plymouthd.conf

Theme=pix to

Theme=PlymouthTheme-TheRun

Waveshare 7 inch display

sudo nano /boot/config.txt

hdmi_force_hotplug=1
config_hdmi_boost=0
overscan_left=0
overscan_right=0
overscan_top=0
overscan_bottom=0
disable_overscan=0
hdmi_cvt=1024 600 60 6 ##
framebuffer_width=1024 ##
framebuffer_height=600 ##
hdmi_group=2
hdmi_mode=1
hdmi_mode=87

Rotate display

sudo nano /boot/config.txt

lcd_rotate=2 

or

display_rotate=0 

• display_rotate=0 Normal
• display_rotate=1 90 degrees
• display_rotate=2 180 degrees

Set display brightness

sudo echo 50 > /sys/class/backlight/rpi_backlight/brightness

To make it persistent add the above statement in /etc/rc.local (before exit 0)

Switch off display

sudo echo 1 > /sys/class/backlight/rpi_backlight/b1_power

Switch on display

sudo echo 0 > /sys/class/backlight/rpi_backlight/b1_power

To remove low power indication (lightning icon)

sudo nano /boot/config.txt

avoid_warnings=1

Hide cursor

sudo nano /etc/lightdm/lightdm.conf

[Seat:*]
xserver-command=X -nocursor 

Start app in fullscreen with desktop on boot

Make sure you enable auto login using sudo raspi-config

sudo nano /etc/xdg/autostart/smart_room.desktop

[Desktop Entry]
Type=Application
Name=smart_room
Comment=Kivy RPI Infoscreen
NoDisplay=false
Exec=chromium-browser http://192.168.1.5/src/home.html --start-fullscreen
NotShowIn=GNOME;KDE;XFCE;

Start app in fullscreen without desktop on boot

Make sure you enable auto login using sudo raspi-config

sudo nano /etc/lightdm/lightdm.conf

[Seat:*]
user-session=myxclient

sudo nano /usr/share/xsessions/myxclient.desktop

[Desktop Entry]
Type=Application
Name=smart_room
Comment=Kivy RPI Infoscreen
NoDisplay=false
Exec=/home/pi/start.sh
NotShowIn=GNOME;KDE;XFCE;

sudo nano /home/pi/start.sh

#!/bin/bash
/usr/bin/chromium-browser --kiosk --app=https://www.google.com --start-fullscreen --window-size=1024,600 --window-position=0,0

UART

The SoCs used on the Raspberry Pis have two built-in UARTs, a PL011 and a mini UART. both are 3.3V devices. By default, on Raspberry Pis equipped with the wireless/Bluetooth module (Raspberry Pi 3 and Raspberry Pi Zero W), the PL011 UART is connected to the Bluetooth module, while the mini UART is used as the primary UART and will have a Linux console on it. On all other models, the PL011 is used as the primary UART.

For pi3 & zero

• /dev/ttyS0 (mini UART) primary UART symlink to /dev/serial0
• /dev/ttyAMA0 (PL011) bluetooth module symlink to /dev/serial1

The baud rate of the mini UART is linked to the core frequency of the VPU (VideoCore processor) on the VC4 GPU.

Steps to enable mini UART

1. add enable_uart=1 in /boot/config.txt
2. remove console=serial0 from /boot/cmdline.txt

default baud rate is: 115200