A camera off the cloud — custom firmware for the Conecto Bullet 6S

I bought a cheap security camera and immediately hit the problem: it only worked through the vendor's app. Video travelled to a Tuya cloud server abroad and back, latency was measured in seconds, and if the internet was down the camera was useless. I wanted an RTSP stream on my own network and a device that never reaches outside at all.

The result: it now runs entirely on my own firmware, offline, and switches to night vision by itself.

Hardware

1 — In through the serial port

It started on the board. There's a UART on it, which gives you the boot log and eventually the filesystem. U-Boot was password protected, and the password sat in plain sight in the bootloader's strings.

The first real step wasn't writing, it was reading: dump the whole flash before changing anything. That copy saved the device twice.

2 — My own RTSP server

No prebuilt binary works here. The AK3918 is ARMv5 and the OS leans on a uClibc from years ago. So I wrote an RTSP server in C for the video and audio streams and cross-compiled it with the right toolchain.

$ arm-anykav200-linux-uclibcgnueabi-gcc \
    -Os -ffunction-sections -Wl,--gc-sections \
    -o rtspd main.c rtsp.c audio.c
$ ls -l rtspd
-rwxr-xr-x  1  148K  rtspd

Eight megabytes of flash dictates everything: every library you don't need gets left out, and -Os plus --gc-sections are requirements rather than optimisations.

Audio followed as its own server, G.711 µ-law at 8 kHz. Without RTCP Sender Reports the audio and video drifted apart within minutes, so both had to be anchored to the wall clock.

3 — Night vision

The IR-cut filter and IR LEDs now switch automatically with the light level, read straight off the ISP's luminance value. The camera needs nothing external to decide.

4 — Bricking it, and getting back

The first flash didn't finish and the device stopped booting. Because the original dump was safe, I wrote a recovery firmware that brings the camera back over UART. It ships as part of the release now: nobody should start this without a return ticket.

What it ended up with

• RTSP video at rtsp://<ip>/ch0 (1080p) and /ch1 (360p)
• RTSP audio at rtsp://<ip>:8554/audio, TCP interleaved
• Automatic day/night switching
• No Tuya, no cloud, no outbound connections
• Recovery firmware for UART restore

The same SoC turns up in a lot of cheap PPStrong and Meari based cameras, so the approach isn't specific to this model.