AK3918AV130L - LSC 1080p Indoor Camera (GC20C3) - firmware dumps, hardware info & venc ABI notes

[berobloom]

Device

• Retail: LSC 1080p Smart Indoor Camera (Action house brand, EU)
• Board: EVB_CBD_AK3918AV130_V1.0.0 (kernel reports EVB_CBDM_AK3918av130_V1.0.0)
• Vendor firmware: HT_IPC280KS2_GNA_TUYA_AK3918AV130L, version 6.2802.61.133, TuyaOS 6.2.8

Main SoC

• Anyka AK3918AV130_B - chip ID 0x56573502
• ARM926EJ-S (ARMv5TE, soft-float), 960 MHz
• Kernel 4.4.302-cip94, built with gcc 5.5.0 (Buildroot 2018.02.7_V1.0.05)

Sensor

• GalaxyCore GC20C3, sensor id 0x20c3 (detected via ak_vi_get_sensor_id)

RAM

• 64 MiB DDR2 (mem=64M, DDR clock 480 MHz)

Wi-Fi

• USB Wi-Fi module atbm6x3x (driver atbm6x3x_wifi_usb.ko, wifi_bt_comb=1), 2.4 GHz
• wlan0, joined via wpa_supplicant -Dnl80211 + udhcpc

Flash

• XM25QH64D SPI-NOR, 8 MiB, JEDEC 0x204017, page 256 B, erase 4 KiB
• SFC driver "Anyka SFCv2", read clock 100 MHz

Flash layout (/proc/mtd)

Kernel cmdline mtdparts:

spi-nor:200K@0x0(UBOOT),4K@0x32000(ENV),4K@0x33000(ENVBK),64K@0x34000(DTB),
1536K@0x44000(KERNEL),1008K@0x1c4000(ROOTFS),256K@0x2c0000(CONFIG),13312K@0x300000(APP)

Resulting partitions (APP is truncated to the end of the 8 MiB chip):

0x000000000000-0x000000032000 : "UBOOT"
0x000000032000-0x000000033000 : "ENV"
0x000000033000-0x000000034000 : "ENVBK"
0x000000034000-0x000000044000 : "DTB"
0x000000044000-0x0000001c4000 : "KERNEL"
0x0000001c4000-0x0000002c0000 : "ROOTFS"   (squashfs, xz, root /)
0x0000002c0000-0x000000300000 : "CONFIG"   (jffs2, rw, /etc/config)
0x000000300000-0x000000800000 : "APP"      (squashfs, xz 128K, /usr)  -> 0x500000 = 5 MiB

• /etc/passwd and /etc/shadow are symlinks into the writable CONFIG (jffs2)
  partition. Root hash is md5crypt $1$kxUiQwgS$… (not in rockyou).
• Partitions are resolved by name from /proc/mtd at boot (rc.local), not by
  fixed offset.

Bootloader

• U-Boot 2019.10.0-V4.0.27 (built Nov 2025)
• sf (SPI flash), mmc/fatload, crc32, cmp available.
• Flashing note (important): a monolithic sf erase+sf write of the 5 MiB APP
  slot reports OK but writes corrupt data on this board (kernel then throws
  SQUASHFS error: xz decompression failed / unable to read id index table).
  sf update (per-sector, verifying) is reliable - run until "0 bytes written",
  and always sf read before crc32 (crc reads RAM, not flash). Reads are always
  reliable; only the big write is not.

Video config

• Main: 1920×1080 H.264, main_ch
• Sub: 640×360 H.264, sub_ch
• ~15 fps; audio track AAC 8 kHz mono (config also exposes PCM / G.711 for talk).
• Encoder userspace on the device: libmpi_venc V3.0.00, kernel venc driver
  adapter V2.0.13 (see ABI section below).

Audio

• Driver ak_pcm (NOT standard ALSA; /proc/asound empty). Playback node
  /dev/pcmC0D0p (char major 248), ioctl magic 'P'.
• Mic: ADC input (dev 0). Note: on this board the mic is on the front LED
  panel — if that ribbon is unplugged the analog input floats (digital silence).
• Speaker: direct PCM to DAC works if you set mixer routing
  IOC_SET_SOURCES = 6 (DAC+LINEIN) - plain DAC (4) is silent. Stereo s16le, amp on
  GPIO69. Minimal player: see aoplay.c in the repo.

GPIO map (sysfs)

GPIO	Function
48	Status LED (blue), /sys/class/leds/state_led, PWM; default blinks via mmc0 trigger
49	red LED (U-Boot inits red/blue/ir)
55	Wi-Fi reset (avoid)
65 / 66	IR-cut filter pair (DAY 65=0/66=1, NIGHT 65=1/66=0)
69	Speaker amp enable
70	IR illuminator LEDs

No PTZ fitted (ptz_support=0).

UART

• ttySAK0, 115200 8N1 (console=ttySAK0,115200n8), 3.3 V pads on the board.

Open ports (stock / factory-test mode)

• 554 RTSP (see note), 23 telnetd, 21 ftpd, 8090, 1234 (msgserver).
• Cloud-free RTSP: the built-in RTSP server is off in normal boot, but dropping
  /tmp/_ak39_factory.ini with a [wifi_station] (plaintext ssid/pass) +
  [aging_test] aging_value=1 section triggers factory-test mode, which starts
  create_rtsp_demo on 0.0.0.0:554 (/main_ch, /sub_ch) carrying H.264 +
  live AAC audio. Confirmed with ffprobe/VLC. ht_onvif_service_start only
  system()-launches an external mini_onvif_service.sh that this firmware does
  not ship, so ONVIF has to be supplied separately.

Firmware dumps available

Full per-partition dumps (mtd0–mtd7) captured, CRC32 (U-Boot crc32) recorded:

mtd0 UBOOT  0x96860af4   mtd4 KERNEL 0x217b6334
mtd1 ENV    0xf80001ac   mtd5 ROOTFS 0x1f322951
mtd2 ENVBK  0xf80001ac   mtd6 CONFIG 0x15a19132
mtd3 DTB    0x9a415927   mtd7 APP    0xe661a614

flash_backup.zip

---

⚠️ The blocker for a from-SDK / majestic port: venc ABI mismatch

I tried the public AK3918AV100 SDK ([KD0000001/ak3918av100]) route. Results on
this AV130:

• VI / ISP / sensor / aenc all matched the AV100 SDK libs - GC20C3 detected,
  ISP loaded, capture ran on both channels (1920×1080 + 640×360).
• The H.264 encoder does not open. ak_venc_open_ex loops
  get chn status failed → dev0 open venc failed. dmesg:

  [venc_adaper_ioctl:xxxx] error! cmd 1079793358 not found   (0x40506E4E = _IOW('n',78,80))

• Root cause is a userspace/driver ABI generation gap:
  • Public AV100 SDK ships libmpi_venc V2.0.46 (Buildroot 2018.02, gcc 5.5) -
    and it is a closed prebuilt .so; there is no source in the SDK, so you
    cannot rebuild it to another version.
  • This AV130 device runs libmpi_venc V3.0.00 (statically linked inside the
    stock anyka_ipc, not extractable) with kernel venc adapter V2.0.13.
  • The get-chn-status ioctl the 2.0.46 lib emits has no handler in the 2.0.13
    driver - a struct-level ABI break, not a renumber.
• The SDK's own venc .ko are yet another version (adapter ~V1.0.74, kernel
  4.4.282) with the wrong vermagic, so they can't be swapped in either.
  So a from-source SDK/OpenIPC build can't stream on AV130 today - not a build-config
  problem, but a missing closed binary: the AV130-matched libmpi_venc
  (~2.0.13 / 3.0.00) is not public. What would unblock majestic:

1. An official Anyka AV130 SDK carrying the matching libmpi_venc + venc .ko, or
2. Reverse-engineering the AV130 venc ioctl ABI to write a thin userspace shim
   against the on-device 2.0.13 driver (same category as the ISP RE in
   OpenIPC/ak3918ev200).
   Everything else needed for a port (ISP init, ak_pcm audio in/out, GPIO/LED/IR,
   the factory-RTSP path, partition/boot layout) is documented and working in my repo,
   and I'm glad to help test AV130-specific changes.

Repo (files, scripts, full logbook): https://github.com/berobloom/LSC-1080p-Anyka-Decloud

[flyrouter]

Good day
Thanks, we'll look into it soon.