Dump your backup firmware (serial cable)

Thanks to rogerb831 - https://github.com/roleoroleo/yi-hack-MStar/issues/91

To save a restorable backup of your cam you need only 1 file:

• home_xxx

where xxx is the suffix of your model (i.e. y20gam), beacuse this hack overwrite only the home and doesn't change other partitions. But if you want, you can backup the whole flash (except u-boot).

The home partition is a jffs2 images. To save this file without a previous hack, you need to extract it using a serial connection. So you need some manual skills because you have to solder 3 wires.

Physical connection

1. Open the cam removing screws.
2. Find the 3 uart pads (TX, RX and GND). Where are they? It depends on the model, on the y20gam model there are the labels. Example:
3. Connect the pads to a ttl-rs232/usb adapter (rx, tx and GND).
4. Open putty with settings 115200 N81 and logging enabled.
5. Switch on the cam. Now, if the connection is ok, you will see the uboot and kernel logs on the screen. Otherwise, restart from point 2.
6. Stop the boot at the U-Boot prompt (should be "=>") pressing "Enter".
7. Execute command fdt print
8. Stop the logging and save the boot log (eventually cleaned up from your data, if present).

Now you have a physical connection to the cam and you have a dump log (you could analyze it to get some info).

Analyze the log

In the log you will find the mtd partitions list. Example:

                partitions {
                        device_type = "partitions";
                        boot {
                                device_type = "boot";
                                offset = <0x00000020>;
                                size = <0x00001200>;
                        };
                        rootfs {
                                device_type = "rootfs";
                                offset = <0x00001220>;
                                size = <0x00000c00>;
                        };
                        home {
                                device_type = "home";
                                offset = <0x00001e20>;
                                size = <0x00005c00>;
                        };
                        env {
                                device_type = "env";
                                offset = <0x00007a20>;
                                size = <0x00000100>;
                        };
                        mfg {
                                device_type = "mfg";
                                offset = <0x00007b20>;
                                size = <0x00000080>;
                        };
                        conf {
                                device_type = "conf";
                                offset = <0x00007ba0>;
                                size = <0x00000080>;
                        };
                        UDISK {
                                device_type = "UDISK";
                                offset = <0x00007c20>;
                                size = <0x00000000>;
                        };
                };

The partition that interest us is obviously "HOME" and we must get its size.

The real size in bytes is the value above * 512:

0x5c00 * 0x200 = 0xb80000

Dump home_xxx (home partition):

1. Open putty with logging enabled.
2. Insert an SD card into the cam (the SD must be formatted with a normal FAT32 file system).
3. Switch on the cam.
4. Stop the boot at the U-Boot prompt (should be "=>") pressing "Enter".
5. Run the following command to copy the partition content to RAM. Copy from home partition, to RAM at address 0x45000000:

sunxi_flash read 45000000 home

6. Initialize SD card

sunxi_card0_probe

7. Check if the card is readable

fatls mmc 0

8. Save the file as home_xxx, where xxx is the suffix of your model (i.e. y20gam). Write the image from RAM address 0x45000000 to the SD card, length b80000 calculated above:

fatwrite mmc 0 45000000 home.bin b80000

Dump whole flash (except u-boot):

1. Open putty.
2. Insert an SD card into the cam (the SD must be formatted with a normal FAT32 file system).
3. Switch on the cam.
4. Stop the boot at the U-Boot prompt (should be "=>") pressing "Enter".
5. Run the following command to copy the partition content to RAM. Copy from boot partition to RAM at address 0x45000000, length f80000 (flash size - 0x80000):

sunxi_flash read 45000000 boot f80000

6. Initialize SD card

sunxi_card0_probe

7. Check if the card is readable

fatls mmc 0

8. Save the file as image_xxx, where xxx is the suffix of your model (i.e. y20gam). Write the image from RAM address 0x45000000 to the SD card, length f80000 (flash size - 0x80000):

fatwrite mmc 0 45000000 image.bin f80000