support for this firmware V380^AK3918EV200W^EV2W_VA3^1.3.7.0

[archcloudy]

hi, i was wondering if this firmware could be patched? i managed to get v380techical@gmail.com send firmware to me
so sorry if im not following the usual rules or smth here

V380^AK3918EV200W^EV2W_VA3^1.3.7.0^2023-12-11.zip

[Arkady23]

All that's required with the update is to find out the camera code. Although they might send an incorrect match, not for your camera. I previously looked at the file inside the zip file in a text editor. It looks like your camera code is EV2W_VA3.
I'll have a look a little later. I'm not at home.

[archcloudy]

alright :) Sent from [Proton Mail](https://proton.me/mail/home) for Android.

…

-------- Original Message --------

On Wednesday, 02/25/26 at 11:01 Arkady ***@***.***> wrote: I'll have a look a little later. I'm not at home. — Reply to this email directly, [view it on GitHub](#86 (comment)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AUSD2DUVQAFBVOFUXUB64JD4NUNB7AVCNFSM6AAAAACV5XSNOSVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKOJRHA2TIOI). You are receiving this because you authored the thread.Message ID: ***@***.***>

[Arkady23]

Я вам приготовил патч, который должен сделать копию конфигурации на sd-карту. То что внутри zip поместите на sd и включите камеру. Патч должен отработать и на sd появится архив. Пришлите его на email a@kornienko.ru. Я проанализирую и дальше сделаю установочный патч.
Только у меня вопрос. А telnet у вас согласно инструкции появляется? или нет? Если появляется, то мои патчи вам не нужны.
English vs translate.google.com:
I've prepared a patch for you that should copy the configuration to an SD card. Place the contents of the zip file on the SD card and turn on the camera. The patch should work, and an archive will appear on the SD card. Send it to a@kornienko.ru. I'll analyze it and then create an installation patch.
I just have a question. Does Telnet work for you according to the instructions? Or not? If it does, you don't need my patches.

EV2W_VA3-backup.zip

[Arkady23]

EV2W_VA3_telnet15.zip

[archcloudy]

uhhh the uninstall link is broken?

[archcloudy]

ow yea i forgot to tell u
telnet still doesnt work

[Arkady23]

There's another telnet connection on port 4322. This was suggested in a related thread. This is the last thing we can try to get telnet on port 4322.
EV2W_VA3_telnet15new.zip

[archcloudy]

[archcloudy]

okay I'll try soon Sent from [Proton Mail](https://proton.me/mail/home) for Android.

…

-------- Original Message --------

On Friday, 02/27/26 at 03:42 Arkady ***@***.***> wrote: There's another telnet connection on port 4322. This was suggested in a related thread. This is the last thing we can try to get telnet on port 4322. [EV2W_VA3_telnet15new.zip](https://github.com/user-attachments/files/25587097/EV2W_VA3_telnet15new.zip) — Reply to this email directly, [view it on GitHub](#86 (reply in thread)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AUSD2DSG5X2XPFEKQPJF37T4N5LD7AVCNFSM6AAAAACV5XSNOSVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKOJTHA4TGMA). You are receiving this because you authored the thread.Message ID: ***@***.***>

[Arkady23]

I finally found the bug.

[archcloudy]

oh!

[Arkady23]

Install and check the ports, i.e., whether telnet, ftp, and http are working. If nothing works, then the second option will definitely work. In this case, I'll do it.
EV2W_VA3_setup1.zip

[archcloudy]

port 3737?

[archcloudy]

hi, just following up
i have a feeling that port 3737 never existed - probably false detect

but yeah, none of them are working (ftp/telnet/http)

[Arkady23]

Patch isn't a problem. Until I see your Linux distribution, it's undesirable to change any settings. If you do apply any settings, please try them one at a time, so you can see what works and what doesn't.
EV3L_V2-setup.zip
Once you apply the patch, immediately go to telnet and run the command:

tar -cvpf /mnt/sdcard/linux_mnt.tar  /mnt/

As practice has shown, this folder is sufficient for analysis. Everything you need is located in this folder. An archive will appear on your SD card. Send the resulting archive to a@kornienko.ru. If you break something later, you can use the downloaded data to restore the files and create a recovery patch.

[archcloudy]

hi, i apologize for late response - didn't have time to try it out
the patch you have attached doesn't seem to be working - it just reboots by itself and just go on operational mode
(no fw updating begin / completed sound)

the fw patch must match with the camera model fw otherwise it wouldn't work

[jimjamsan]

Hi @Arkady23 , I own a device similar to the OP (EV2W_VA3). I bought it from amazon (https://www.amazon.in/Conbre-UltraXR-Outdoor-Wireless-Security/dp/B0CNTGCGGV) and it's called Conbre UltraXR [Model:K802]. The patch files that you've shared in this thread all seem to trigger firmware update on my device as well. But as @archcloudy pointed out already, nothing changes after the 'update' and the camera continues to work as usual without any changes (no telnet/RTSP/ONVIF). For more information, I opened up the camera enclosure and found out that the SOC was Anyka "AK3918EN088" NOT the usual "AK3918EN080"

So, I decided to take a look inside the original firmware file posted here . I don't have much knowledge in reverse engineering but I followed the instructions posted here and managed to extract the patch file using both binwalk and patchv380. Binwalk listed the following files:

Whereas, patchv380 listed the files under these names:

In both cases, I did not see 'exshell_bfu.sh' file in the root of the file system. Is this normal? By the look of things, I wonder if the firmware's file system and structure has changed in the recent v380 models?

To extract the romfs, I tried using romfsck2. It listed the following output, but did not succeed in extracting the file contents.

Do you have any idea on how to extract aliosromfs files? Kindly let me know.

Just to check if the custom patching process worked, I tried manually creating a patch using the 'exshell_bfu.sh' file. The patch was recognized by the device, and the firmware upgrade audio played. But, as reported multiple times in this thread, the script do not seem to have worked. This was the content of the script (exshell_bfu.sh):

#!/bin/sh
echo "Test" > /mnt/sdcard/test.log
whoami >> /mnt/sdcard/test.log
ls / >> /mnt/sdcard/test.log
ls /mnt >> ls /mnt/

After the device rebooted, I tried checking the sdcard. But 'test.log' file was not there.

I also contacted the support requesting for a way to enable RTSP/ONVIF feature via ceshi.ini file and I was told that it's not possible to do that in this model.

I am sharing this information for future reference of both myself and others. Also, I am willing to help run tests using your scripts if you want. Please let me know if you need something tested. Appreciate what you are doing for this community. Thank you.

[Arkady23]

Just to check if the custom patching process worked, I tried manually creating a patch using the 'exshell_bfu.sh' file.

Perhaps you need to add this code to the beginning:

	if [ -b "/dev/mmcblk0p1" ] 
	then
		mount /dev/mmcblk0p1 /mnt/sdcard		
	elif [ -b "/dev/mmcblk0" ]
	then
		mount /dev/mmcblk0 /mnt/sdcard
	fi	

In the evening, when I'm home, I'll add these lines to the patch and post a new patch.

[Arkady23]

EV2W_VA3-ls.zip

[jimjamsan]

Thanks again for your time and efforts @Arkady23 . I tried using the latest patch that you posted today, but unfortunately, the result was still the same. No output files were created in the sdcard - which seems to indicate that the script in the patch file did not execute.

I did some digging of my own and came across some interesting stuff. I managed to mount the IMG_RFS_rfs.romfs file that was extracted using patchv380 tool. The directories were mostly empty though.

Also, I did some file analysis on IMG_APP_app file & IMG_KER_ker_200W files and your previous assumption that the telnet was using port 4322 was correct!

I will keep looking for more information and I will keep this thread updated. Meanwhile, as usual, let me know if you need to run any tests.

[archcloudy]

/mnt/mtd
what's that?

[Arkady23]

Can you extract all the scripts with the sh extension? They probably run commands that can be used.

[Arkady23]

that the telnet was using port 4322 was correct!

Try searching for the substring /mnt/sdcard

[Arkady23]

One more question. What folder are the videos saved to? What extension do the video files have? What is the directory structure for the video files? I have a feeling these aren't AVI files. Then it must be revolutionary new software.

[jimjamsan]

@archcloudy /mnt/mtd seems like a system mount point that contains a bunch of configs and stuff. Have a look at the attachment for the xxd output, it should give you a good idea.

One more question. What folder are the videos saved to? What extension do the video files have? What is the directory structure for the video files? I have a feeling these aren't AVI files. Then it must be revolutionary new software.

The recordings are being saved to RecFiles folder in the SD Card and they are indeed AVI files. I was able to play them using the default windows media player without any additional codecs.

Can you extract all the scripts with the sh extension? They probably run commands that can be used.

The only script with the .sh extension was something named patchrule.sh, but I couldn't find any ways to extract it. If there's a known method to extract these files, please let me know.

Other things I learned from snooping around the file system:
Operating system : AliOS Things 3.2
Kernel : Rhino kernel

I am looking to compare and test stuff between different firmwares. If you happen to have these below files, kindly post them here.

1. Anyka AK3918EN080 firmware (Without RTSP access)
2. Anyka AK3918EN080 firmware (With RTSP access)
3. Anyka AK3918EN088 firmware (With RTSP access)

@Arkady23 The attachments contain the xxd outputs targeting /mnt/sdcard that you asked for.
mnt_mtd.log
mnt_sdcard.log

P.S I am still a beginner trying to learn reverse engineering. Kindly bear with me if the information I post here is too trivial. If there's a standard workflow to analyzing firmware (extracting, decompiling, recompiling, building the image, etc) kindly let me know. It would be most helpful.

[archcloudy]

sorry for late response, i have tried it and nothing seemed to appear on the sdcard
the update works but no logs or anything new seemed to appear on the sdcard

[jimjamsan]

@Arkady23 Sorry for not responding. I messed up, while trying to tinker with the UART commands and I am very close to giving up. I think I may have bricked my device. This is what happened. I gained root access via uart and tried playing around with different commands in the ash shell. While doing so, I entered the 'massboot' command and immediately, without any warning, I was informed that the flash was wiped and now, while booting, instead of the usual UART boot messages, I only see SUNDANCEH240_Massboot># in the console. Nothing else. No matter what I type, nothing gets entered in the console. Do you have any idea regarding this? If possible, could you post UART firmware dump for Anyka 88 model camera? Any help is much appreciated. Thanks.

[archcloudy]

ahh shitttt

[archcloudy]

i would help but unfortunately I don't have any some sort of UART tools with me right now

[jimjamsan]

That's okay. This issue seems very niche and there's not a whole lot of information available online regarding this. I'll keep searching for a few more days.

[sova-source]

У меня такая же камера на чипе 88 очень жду новостей по этому поводу

[ciaoindonesia]

Hello @Arkady23,

Same platform EV2W_VA3, similar result as others in this thread.

Software: AppEV2W_VA3_V1.3.6.1_20231113
Firmware: Hw_AWT3710D_XHR_V1.0_WF_20231113
IP: 192.168.100.51

I applied diagnostic patch (update complete voice).
update_record:
[PATCH]
last_id=85023510

ls.txt was NOT created on SD.
Ports: only 8800 and 9800 open (554, 8899, 80, 23 closed).
No ONVIF in V380 app. ceshi.ini did not enable RTSP (SD read works - Mandarin voice).

Please advise which patch I should try next for AWT3710D.

Thank you.

[archcloudy]

hi, use this alternative for now: https://github.com/PyanSofyan/V380Decoder

Works really well, i even integrated it onto my Frigate NVR 💀
but the two-way speak, im not sure how to get those working