LSC Indoor Camera 1080P (2025) decloud

Project description

This repository contains a de-cloud patch for the LSC Indoor Camera 1080P (Anyka AK3918AV130 based, Tuya/SmartLife firmware). It runs the camera fully locally: RTSP video/audio and ONVIF Profile S, with no cloud service and no phone app required.

Tested on the LSC Indoor Camera 1080P / HT-IPC280 / AK3918AV130L board (GalaxyCore GC20C3 sensor, 8 MiB XM25QH64D SPI-NOR, TuyaOS 6.2.8, kernel 4.4.302). Other AK3918AV130 boards are likely similar but verify your own partition map and GPIOs.

Screenshot

The hack in a nutshell

The de-cloud lives entirely in the APP partition (mtd7). We add /usr/local/decloud/ (a boot script + a small ONVIF server) and insert one guarded line into the stock service.sh:

[ -f /mnt/decloud.conf ] && sh /usr/local/decloud/decloud.sh

No decloud.conf on the SD card means that line does nothing and the camera boots 100% stock. With a config file present, decloud.sh applies your settings, blocks the cloud, and starts RTSP + ONVIF.

Local RTSP is obtained cloud-free by triggering the firmware's built-in factory-test mode, which starts its RTSP server on :554 with H.264 video and AAC audio.

Features

• Local RTSP (rtsp://<cam-ip>:554/main_ch and /sub_ch)
• ONVIF Profile S auto-discovery (NVRs, Blue Iris, Frigate, Synology, ...)
• Cloud connection blocked (DNS black-holed, Tuya hosts pinned to 127.0.0.1)
• Wi-Fi, timezone/NTP, ONVIF, root password, image flip/mirror/WDR, status LED and voice prompts all configured from one file on the SD card, no reflashing needed to change settings
• Fail-safe: remove decloud.conf from the SD card and the camera boots 100% stock

Prerequisites

• An LSC Indoor Camera 1080P / AK3918AV130-based camera
• UART serial console (for flashing and recovery)
• An SD card (FAT, up to 128GB)
• About 30 minutes

Quick start

Read docs/SAFETY.md first. Back up all of flash before you write anything.

1. Back up flash (all partitions). See docs/SAFETY.md.
2. Try it with no flashing first: copy sdcard/decloud.conf (edited) + tools/test_decloud.sh + the payload to the SD card, boot with init=/bin/sh, and run sh /mnt/test_decloud.sh. This brings up RTSP + ONVIF from the SD card without touching flash. See tools/README.
3. Build the flash image from your own stock APP dump:

   tools/build_app_image.sh  my_stock_app.sqsh  app_decloud.sqsh

   It prints the size and CRC32 you'll verify after flashing.
4. Flash it from U-Boot with sf update (not sf write, see docs/FLASHING.md for why).
5. Configure by editing decloud.conf on the SD card. Reboot. Done.

Repository layout

Path	What
decloud.conf	The one file you edit for all settings. Copy to the SD card root.
overlay/usr/local/decloud/	Payload baked into the APP image (boot script, ONVIF server, templates).
tools/build_app_image.sh	Overlays the payload onto your stock APP dump to produce a flashable image.
tools/test_decloud.sh	Validates the whole stack from the SD card without flashing.
tools/gpio_menu.sh, gpio_explore.sh	Interactive GPIO/LED/IR control and discovery.
src/onvif_server.c	The ONVIF Profile S server (single static C file).
src/aoplay.c	Minimal direct-to-DAC speaker player.
src/templates/	The ONVIF SOAP response templates.
prebuilt/	Statically linked onvif_server and aoplay, built from src/.
docs/	Flashing, hardware map, ONVIF notes, safety, and the research logbook.

Docs

• docs/FLASHING.md - U-Boot flashing, why sf update not sf write, verification, recovery
• docs/HARDWARE.md - SoC, flash/partition map, GPIO/LED/IR map, audio path
• docs/ONVIF.md - the ONVIF server design and how to extend it
• docs/SAFETY.md - backups, recovery, and how not to brick it
• docs/LOGBOOK.md - the full reverse-engineering history

Safety, legality, scope

This is for your own device. De-clouding a camera you own by changing its root password, blocking its cloud connection, and running it locally are all legitimate. This repo does not contain Anyka/Tuya proprietary firmware; you overlay the patch onto a dump of your own camera. There's no warranty, and you can brick a device while writing to flash, so back up flash first (see docs/SAFETY.md).

License

This software is released under the BOLA License.

Sources

AI assisted coding

• This project was made possible with the support of Claude Opus 4.8.

Toolchain (how the binaries were built)

• arm-anykav200 cross toolchain — Anyka gcc 4.8.5 + binutils 2.24 + uClibc 0.9.33.2. prebuilt/onvif_server and prebuilt/aoplay are static ARM binaries built with it. Redistributed at: https://github.com/ricardojlrufino/arm-anykav200-crosstool
• uClibc-ng 1.0.31 — built from source to match the device libc during the (abandoned) SDK path: https://github.com/wbx-github/uclibc-ng
• squashfs-tools (mksquashfs/unsquashfs, xz) — repacking the APP partition.
• busybox — the device's own mkpasswd, ntpd, wpa_supplicant, udhcpc are used by the boot script.

ONVIF

• onvif_simple_server by roleoroleo (GPLv3) — the reference for the ONVIF Profile S responses and behaviour. Our src/onvif_server.c is an independent self‑contained implementation; the SOAP templates follow the ONVIF spec and were modeled on this project. https://github.com/roleoroleo/onvif_simple_server
  • See also thingino-onvif (a maintained onvif_simple_server fork): https://github.com/themactep/thingino-onvif
  • NOTE: onvif_simple_server is GPLv3. If you treat the templates as derived from it, license the src/onvif_server.c + src/templates/ subtree GPLv3 (with attribution) rather than MIT. See LICENSE notes.

Anyka / AK3918 reverse engineering referenced

• KD0000001/ak3918av100 — AK3918AV100 SDK: source of the ak_pcm.h ioctl definitions used by aoplay.c, plus ISP/audio experiments and the venc ABI analysis. https://github.com/KD0000001/ak3918av100
• MuhammedKalkan/Anyka-Camera-Firmware — Anyka custom‑app / RTSP approach (AK3918v200); informed the pivot away from an SDK rebuild. https://github.com/MuhammedKalkan/Anyka-Camera-Firmware
• ricardojlrufino/anyka_v380ipcam_experiments — Anyka V380 / AK3918 hacking scripts and notes. https://github.com/ricardojlrufino/anyka_v380ipcam_experiments

OpenIPC ecosystem (context / future work)

• OpenIPC/firmware — open camera firmware; Anyka support is early (EV200/EV300/ EV330, none working yet). https://github.com/OpenIPC/firmware
• OpenIPC/ak3918ev200 — reverse‑engineering the AK3918 ISP/venc ioctls; the effort that would eventually unblock a from‑scratch encoder. https://github.com/OpenIPC/ak3918ev200
• fdragovic/openIPC-firmware — a community AK3918AV100 OpenIPC build. https://github.com/fdragovic/openIPC-firmware
• thingino — another open camera firmware; has an AK3918AV130 discussion. https://github.com/themactep/thingino-firmware

Standards

• ONVIF Profile S (Device + Media services, WS‑Discovery) — https://www.onvif.org/

License

• https://github.com/ErikMcClure/bad-licenses/blob/master/BOLA-License