← Home Lab

GLaDOS

seedling updated

Project Goals

  • Phase 1: Replace stock firmware with Thingino (8 MB profile) to expose local RTSP/ONVIF and decouple the camera from the Tuya cloud entirely.
  • Aspirational: Turn it into a GLaDOS camera — personality/voice running on a Jetson Orin Nano, 3D-printed GLaDOS-style body, and a third stepper motor for 3 degrees of freedom.

Hardware

Device: Instachew Purrsight 360 (PTZ pet camera, Tuya firmware from factory) Board ID: GY7630-T31-PTZV12 (PCB date 2022-05-10)

Core Silicon

Role Part Notes
SoC Ingenic T31L MIPS, standard-ISP variant; audio I/O supported
SPI NOR flash Winbond W25Q64JVSIQ 8 MB / 64 Mbit, SOIC-8
Wi-Fi + BT SSV SV6256P 2.4 GHz only; out-of-tree driver
Motor driver ULN2803LV5 8-ch Darlington; drives PTZ steppers + IR-cut solenoid
Audio amplifier Natlinear NS4150B 3 W mono Class-D; speaker / two-way audio
Image sensor TBD — read from UART boot log

Mechanics

  • Motorized pan + tilt via stepper motors driven by the ULN2803.
  • Day/night switch via solenoid-actuated IR-cut filter (ICR) assembly between lens and sensor.
  • IR illumination ring around the lens — connected via LED1 4-pin header; engages in night mode.
  • Built-in speaker driven by the NS4150B; built-in mic (labeled MIC on the PCB).
  • microSD slot — externally accessible on the camera body; available under Thingino as a standard Linux block device (/dev/mmcblk0p1).

Unused Connectors

  • SYS_LED 2-pin header on the main PCB — unpopulated; likely a status LED output (case has a cavity and pinhole above it for a 5 mm LED).
  • LED2 3-pin header on the main PCB — unpopulated; purpose unknown.
  • Main PCB ↔ USB-C board interconnect carries unused pins labeled LED, R-, R+, T-, T+. The R± / T± pairs look like differential signal pairs (candidates: USB 2.0 data, Ethernet). Stock firmware only uses the USB-C board for power.

Service / Debug Headers

  • UART: 3-pad header labeled TX / R / GND on the silkscreen. 3.3 V logic, 115200 8N1.
  • BOOT: single labeled test pad. Short to GND during power-up to force the T31 into USB recovery boot mode (fallback for unbricking).

Stock Firmware Lockdown (for Context)

Factory firmware is locked Tuya:

  • Port 6668/tcp — Tuya LAN control (AES with per-device localKey).
  • Port 5543/tcp — RTSP (ireader/media-server) — returns 403 to all DESCRIBE requests; only accepts cloud-signed URLs.
  • Port 8000/tcp — Happytimesoft HTTP admin (Digest auth).
  • No ONVIF advertised (WS-Discovery ignored).

Comments