1. Make, How To, and DIY
2. HOME
3. IT DIY
4. AQUARIUM DIY
5. [SOLVED] Xiaomi Xiao Yi Ant HOME – This camera can only be used in China (1.8.6.1)
6.  
7. May 3, 2016   IT DIY   28 Comments
8. (please link to this page, but do not copy the content to other sites)
9. Xiaomi Xiao Yi Ant HOME
10.  
11. Recently I bought a Xiaomi Xiao Yi (IP) camera (also known as Yi Home), Chinese version. The camera looks nice, picture quality is ok, and worked fine on my local Wifi.
12.  
13. However I was unfortunate enough to receive and test the camera when Xiaomi decided to deny access from the iOS app to the camera outside of China (error 5400). I was hoping a firmware upgrade would solve this issue so I have upgraded from 1.8.5.1L to 1.8.6.1B. Now my camera was useless. The camera would say “This camera can only be used in China” and would shut down.
14.  
15. This was the tipping point when I have decided I will investigate what’s happening with this camera and what can be done to make it functional again. At the time of writing the remote access (error 5400) has been solved by the provider so no additional action is required. (I tried to convert a CN camera to international one by changing the serial of the device, but couldn’t test from a European or US IP and probably I would have needed access to the system files  of a functional international camera to compare)
16.  
17. So the remaining issue was the camera shutdown with the latest firmware (tested with 1.8.6.1A and 1.8.6.1B).
18.  
19. If you do a search there are heaps of websites describing how you can gain access to the camera and ultimately enable remote access via telnet. I won’t get into those details, you can check some of websites I listed below.
20.  
21. Once you logged into the camera via telnet the fun part begins.  The camera is running a Linux version.
22.  
23. # uname -a
24. Linux (none) 3.0.8 #1 Wed Apr 30 16:56:49 CST 2014 armv5tejl GNU/Linux
25. This is familiar territory, we can check what processes are running, log files, the /home directory and we can mess around with the system. I have to mention this is for educational purposes only and you can easily brick your camera.
26.  
27. Back to the “This camera can only be used in China” message. So if you look carefully in the log file “/tmp/log.txt” at some point you will see the forbidden.g726 sound being played and not long before that there is an API call to the mothership to check  if you device is allowed to run on not. With this call the camera sends your IP automatically so there is not much to be done about that.
28.  
29. [/home/cloud][4/29/22:51:48:52]: req_info=https://api.xiaoyi.com/v4/ipc/check_did?hmac=XXXXXXXXXXXXXXX%3D&seq=9
30. &uid=XXXXXXXXXXXXXX&timestamp=4294938554
31. {"allow":false,"code":"20000"}
32. Now the nice thing about this is that we can fake the response from the server in many different ways.
33.  
34. 1. You set up a proxy to be used and the proxy will change the reply from “allow”: false to true.  The certificate on the camera can be changed so you can set up a valid proxy for https request for a man in the middle attack. (/home/ca.crt). Possible but too complicated and you need a proxy running.
35.  
36. 2. You can set up a fake response on the camera via the local http server and redirect (see point 3 ? ) the check_did call to this file. (/home/web/response.json -> {“allow”:true,”code”:”20000″}). Again possible but not really needed.
37.  
38. 3. And finally we got to the solution. In the log files we saw that /home/cloud is responsible to check the permission for our device. This is a binary file and we can check what calls are made from this file:
39.  
40. # strings /home/cloud | grep http
41. http://log.xiaoyi.com/info.gif?p=home_v1&sysVersion=%s&mac=(lots' of other details)
42. %s -c 311 -url https://api.xiaoyi.cox/v4/ipc/check_did -uid %s -keySec %s
43. %s -c 139 -keySec %s -url https://api.xiaoyi.com/v4/ipc/reset -uid %s -version %s -mac %s
44. ......
45. %s -c 138 -key %s -keySec %s -url https://api.xiaoyi.com/v4/ipc/on_line -uid %s
46. -version %s -mac %s -packetloss %d -p2pconnect %d -p2pconnect_success %d -tfstat %d
47. %s -c 136 -url http://api.xiaoyi.com/v2/ipc/sync_time
48. (yes, the camera logs and sends everything back to xiaomi)
49. Now if we change the call check_did to our local file mentioned above that would make /home/cloud happy and the camera will run. Luckily /home/cloud will lock your device just if the remote server replied with “allow”: false. Now all we need to do is to block that call or break/invalidate that url (ie. dns error).
50.  
51. THE SOLUTION:
52.  
53. # ps | grep /home/watch_process | grep -v "grep" | awk '{print $1}' | xargs kill -9
54. # ps | grep /home/cloud | grep -v "grep" | awk '{print $1}' | xargs kill -9
55. # sed -i  's|api.xiaoyi.com/v4/ipc/check_did|api.xiaoyi.cox/v4/ipc/check_did|g' /home/cloud
56. # reboot
57. First commands will kill watch_process so it doesn’t restart other processes.
58. Second command will stop the cloud service, so we can change the file.
59. The third one will change the text in the binary file. It will change com to cox which will invalidate the url and will not return the allow: false message anymore.
60.  
61. Once the camera reboots it will be functional just as before you upgraded to the latest firmware. In case anything goes wrong just install a fresh, unmodified firmware.
62.  
63. Drop me a line if this worked for you!
64.  
65. Some websites to check to see how you can enable the remote access (telnet):
66.  
67. http://xiaoyi.querex.be/
68. https://yadi.sk/d/MpaQaTC1mU2kQ
69. http://en.miui.com/thread-224653-1-1.html
70.  
71. 28 Responses to [SOLVED] Xiaomi Xiao Yi Ant HOME – This camera can only be used in China (1.8.6.1)
72.  
73.         Sabi says:
74. May 9, 2016 at 5:55 pm
75. Hi I ordered this camera recently (Apr 28) from ali express. When i received the camera I was told by seller to downgrade the firmware and i did that but it never connects and always fails at the QR scanning step and tell me to reset it. So the only time i was able to have it work was using the latest firmware (1.8.6.1) and chinese app (not updated) but it connects for a second and then i get the message saying this camera can only be used in China. Seems like you have the solution but instructions arent clear can you please tell me how to use Telnet to modify the camera code? or how you got it to work? According to the supplier i am doomed and i wont get a refund. Thanks looking forward to your reply.
76.  
77. Reply
78.         DIY says:
79. May 9, 2016 at 10:33 pm
80. In order to get telnet access you can follow the instructions from here:
81. http://en.miui.com/thread-224653-1-1.html
82.  
83. In a nutshell:
84. Connect the memory card to a computer via a card reader
85. Create a directory named “test” on the sdcard root
86. Edit file X:\test\equip_test.sh with notepad or your favorite text editor.
87. Add this content:
88.  
89. #!/bin/sh
90. # Telnet
91. if [ ! -f "/etc/init.d/S88telnet" ]; then
92. echo "#!/bin/sh" > /etc/init.d/S88telnet
93. echo "telnetd &" >> /etc/init.d/S88telnet
94. chmod 755 /etc/init.d/S88telnet
95. fi
96. dr=`dirname $0`
97. # fix bootcycle
98. mv $dr/equip_test.sh $dr/equip_test.sh.moved
99. reboot
100.  
101. Safetly detach sdcard, put it into your camera, it will reboot twice.
102.  
103. The login details are:
104. User: root
105. Password: 1234qwer
106.  
107. Once you have access you can follow the steps in the SOLUTION section on this page.
108.  
109. Reply
110.         werew01f says:
111. May 17, 2016 at 12:30 am
112. I have the same issue. when I downgrade my Yi camera firmware, it will have failure connecting to my WIFI, having the error “Wi-Fi password invalid”. But when I install the latest firmware 1.8.6.1B, it will connect to my Wifi but have the error “Not to be use outside china”
113.  
114. Previous firmware that can enable Telnet, cannot connect to wifi. The latest firmware that can connect to wifi not able to enable the Telnet.
115.  
116. Hope someone can help to advise.
117.  
118. Reply
119.         john says:
120. May 21, 2016 at 5:34 pm
121. same as me. now new lot of can it have problem WiFi password error for firmware 1.8.5
122.  
123. Reply
124.         jloong says:
125. May 9, 2016 at 11:56 pm
126. When I typed in the command
127.  
128. sed -i ‘s|https://api.xiaoyi.com/v4/ipc/check_did|https://api.xiaoyi.cox/v4/ipc/check_did|g’
129.  
130. It complains “sed -i” missing argument
131.  
132. Reply
133.         DIY says:
134. May 10, 2016 at 10:02 am
135. The end of the command was not visible on the page. I’ve updated the command and now you should see the end of it as well. Give it another try.
136.  
137. Reply
138.         robert says:
139. May 10, 2016 at 7:04 pm
140. Can’t run “sed”..can’t find the correct line..below is what I have after using the K firmware..pls help.
141. # strings /home/cloud | grep http
142. %s -c 136 -url http://api.xiaoyi.com/v2/ipc/sync_time
143. /home/curl http://%s/cgi-bin/luci/api/xqsystem/init_info
144.  
145. Reply
146.         DIY says:
147. May 10, 2016 at 9:49 pm
148. The K firmware doesn’t have this restriction. you should use MiHome on iOS to connect to the camera.
149.  
150. Reply
151.         robert says:
152. May 10, 2016 at 10:34 pm
153. I can connect now the camera thru Wi-Fi but still unable to connect using LTE. Before the error 5400 last month, it was still working and just two days after it was restored(May 3-4)..Where do you think I have a problem. Thanks
154.  
155.         Bart says:
156. May 10, 2016 at 5:14 am
157. Hi,I have a CN version but i wrote to contact support in Poland and They send me a file – home and home.bin of international version for YI. I try to upgrade firmware to use with Google Play version of app but not work. Is there a solution? The app from GP is much better – some stuff from motion detection etc.
158.  
159. Reply
160.         DIY says:
161. May 10, 2016 at 9:59 am
162. If the camera is the CN version the international firmware will not work. However MiHome iOS app is in english so there is no drama using that. The camera itself has motion detection, so it does not matter what app you are using on your phone. For now, until someone manages to convert a CN version to international one, stick to the CN firmware.
163.  
164. Reply
165.         Bart says:
166. May 10, 2016 at 2:35 pm
167. Ok my works with CN firmware and CN app. But International version with Goggle Play app have a motion detection section to mark and have a Sensivity Level – https://www.youtube.com/watch?v=HNhWKRzhWes
168. ?
169.  
170. Reply
171.         Tom says:
172. May 10, 2016 at 8:56 am
173. Excellent work ! It works perfectly with the new firmware.
174. At the beginning, I have difficulty to enter the solution command because the third line is too long and not able to read the end part of the command.
175.  
176. I have to do a cut and paste the whole solution section to a text editor in order to see the complete command.
177.  
178. Thanks a lot for sharing !!
179.  
180. Reply
181.         DIY says:
182. May 10, 2016 at 9:55 am
183. Thx for the feedback. I’ve updated the command to fit to the screen.
184.  
185. Reply
186.         Sam Wong says:
187. May 11, 2016 at 10:13 pm
188. I have put the sd card back to the Yi camera and power on it. But the camera stuck at orange light.
189. It does not reboot twice as mentioned above. What step did i miss?
190.  
191. Reply
192.         Deltaflyer says:
193. May 12, 2016 at 11:49 am
194. It’s work!!! Thank you I am using 1.8.6.1A
195.  
196. Reply
197.         Deltaflyer says:
198. May 12, 2016 at 12:36 pm
199. However, 1.8.6.1A Lost the RTSP Support! I can only telnet to it!
200. Any fix?
201. Thanks
202.  
203. Reply
204.         DIY says:
205. May 12, 2016 at 12:42 pm
206. I haven’t seen RTSP to be released for the latest version yet. If you need rtsp stick to an older version.
207.  
208. Reply
209.         Deltaflyer says:
210. May 15, 2016 at 11:09 pm
211. However, I have tried all older version. All of them not support outside China.
212. I will stick with current version better that it is still working
213. Thank!
214.  
215. Reply
216.         LuHash says:
217. May 16, 2016 at 1:08 am
218. Hello there, the trick provided enabled me to use the cam on the latest fw, however, it seems that the camera losts conectivity with cloud after few minutes after booting up ?
219. Did anyone encounter this on the 1.8.6.1B? Any solution?
220.  
221. Reply
222.         Travis says:
223. May 18, 2016 at 1:34 pm
224. 1.8.6.1B Update — I followed the instructions, rolled back to a previous version (1.8.5.1M from http://xiaoyi.querex.be, along with the RTSP/Telnet script), let it flash, then re-flashed the 1.8.6.1B official firmware (which is the only one that seems to allow connection to wifi). Immediately, telnet was there. I logged in and ran the commands in THE SOLUTION, which ultimately modified the URL check service. All is working… I will never get those past few hours of my life back, but at least this input may help someone else.
225.  
226. Just
227.  
228. Reply
229.         dokmai says:
230. May 21, 2016 at 2:39 am
231. It’s works!. I’m 1.8.6.1B version. Big Thanks!
232.  
233. Reply
234.         Aji Purwoseputro says:
235. May 21, 2016 at 11:20 am
236. Your sed command has double space after sed – i. After deleted extra space, I can execute the command. Thanks for the guide ?
237.  
238. Btw, my Yi ant only available in same Wifi network. If I remotely view via Yi Home android app, I cannot connect (only shows 5%), the workaround is to use MI Home instead of Yi Home.
239.  
240. Reply
241.         Edward says:
242. May 21, 2016 at 12:56 pm
243. I have no idea how to telnet this camera. Could someone tell me how to do it?
244.  
245. Reply
246.         flashkaisel says:
247. May 22, 2016 at 2:55 am
248. Many Thanks for your work, work perfectly.
249.  
250. Reply
251.         Van Thu says:
252. May 22, 2016 at 6:08 pm
253. It’s nice if you could make this for Yi smart camera 2, I just update OTA then it’s not outside China. Thank you.
254.  
255. Reply
256.         Rob says:
257. May 22, 2016 at 11:37 pm
258. These instructions worked perfectly!
259. Out of my 5 Xiaoyi cameras, two were China models and once upgrading the the current latest firmware (1.8.6.1B) spoke the dreaded China only message…
260.  
261. Following the instructions above worked perfectly – thanks !
262.  
263. Reply
264.         derekk says:
265. May 23, 2016 at 3:35 am
266. thanks for the guide! It save me! I ‘m on 1.8.6.1b firmware and i’ve got “… only used within china”: with “the solution” now all works, even the notification popup (it didn’t work on previous firmware!)
267. Only one thing: it’s possible setup motion detection sensibility? It only works sometimes and I don’t understand why
268.  
269. Reply
270. Leave a Reply
271.  
272. Your email address will not be published. Required fields are marked *
273.  
274. Comment
275.  
276. Name *
277.  
278. Email *
279.  
280. Website
281.  
282.  
283.  
284.  Post Comment
285.  
286. Search
287. RECENT POSTS
288.  
289. [SOLVED] Xiaomi Xiao Yi Ant HOME – This camera can only be used in China (1.8.6.1)
290. Western Digital My Net N900 – add scheduled reboot support
291. [SOLVED] – KLM/KMZ to GPX – Namespace prefix ‘xsi’ not declared
292. [SOLVED] – Panasonic Lumix Time Lapse (TZ40, GH3)
293. [SOLVED] – Change the Default Folder Location for Box Sync (external drive)
294. CATEGORIES
295.  
296. Aquarium
297. IT DIY
298. ARCHIVES
299.  
300. May 2016
301. January 2016
302. November 2015
303. February 2015
304. December 2014
305. January 2014
306. July 2012
307. © 2016 Make, How To, and DIY About Us