RunCam split recovery

What is a bricked RunCam Split?
If the Runcam failed updating or other unknown reason it could happen your runcam stops working. The only sign of life would be the red LED blinking when powered.
RunCam tells you to change the ribbon cable between sensor and mainboard and if this does not work send them nudes of you PCB, you will get a new mainboard for free. As it costs you several weeks without your RunCam you may try fixing it yourself.

How to unbrick your RCSplit:
When bricked the cam will not boot until SD firmware flashing. So we just need to install a firmware that does that and get the stock RCSplit FW via SDcard update.
1. Get an old pc with Win7 or find a way to disable driver signature…
2. Download and unpack recovery package: RCSplit_recover_V1.1.0 (including: usb monitor, putty, SPCA6350 drivers, FRM+firmware)
3. Install Driver located in driver folder.
4. Plug in USB of RCSplit while pressing the WiFi Button.
(5. Wait for drivers to install if first time connected)
6. Start FRM.exe (no warning of no device connected should appear).
7. Click „ISP“ Button. This will flash firmware and may require up to 4 minutes. (Seems to be required before burning the other images, thanks to Klaus for the feedback)
8. Swtich to „Advanced“ tab.
9. Rigthclick an item in the right treeview window and select „Burn All“.

10. Wait 2-3min to finish, click „yes“ to all dialoges. Should finish with success.
11. Take an empty SD card and place the files located in sd_card folder.
12. Insert SD card and power RCSplit from USB charger/powerbank.
13. Wait until orange light starts blinking (SD card update).
14. Do not power off until LEDs turn off.
15. RCSplit should work fine again.

Contact me if you think something is missing.

Falls ihr gebrickte PCBs habt die ihr nicht mehr braucht, könnt ihr mir sie gerne schicken

I only had my own PBC bricked, so I played around with stock firmware of EKEN H9 but never got it to sd update mode. As the replacement PCB arrived I downloaded the firmware from it and replaced parts of eken stock fw. This is all included in the download package. I don’t know if the BRN file the firmware is looking for should be called RCSplit or SPHOST, so I put 2 identical files with different names on the card. Tell me if you know wich one it is. Could be only RCSplit because it is deleted afterwards…

Bootlog & CLI:
To get the CLI connect a 3,3V UART adapter to the testpads (don’t forget GND, a GND pad is next to the SD card slot)

Baudrate is 115200.
You don’t need to connect UART for recovery, unless you want more info or play around with cli. For fancy colours use putty as serial terminal.
If someone could send me a bootlog of a unflashed, bricked on would be nice, maybe there is a faster way.

Firmware History:
RCSplit_recover_V1.0.1 (10.07.17)
RCSplit_recover_V1.1.0 (05.09.2017)

Bugs I have:

  • V1.1.0:
  • V1.0.1:
    Corrupted SD Card, readable but no write/erase/format possible. Runcam keeps recording but no files (at least visible, maybe the data is somehow on the card) => only way to restore SD Card was to format it with a Teensy3.6 (or other Arduino like device) an the SDFat lib.
    Runcam not updating to V1.1.0 from V1.0.1. Update via app fails after uploading 99% (0x000004), sd update deletes FW file but no update.
    => ok, card was currupted again and WiFi was not able to write and on pc write is performed but not permanently stored.

Problem FAQ:
Q: Can you help me…
A: No.

Q: The USB device is not detected

A: Press the WiFi button while connecting USB
A: Try reinstalling the driver.

Q: Your manual did not work for me.
A: May happen, I just fixed mine until now, I need more bricked hardware to guarantee.

Nice Wifi Hacks:
Livestream: rtsp://
FTP Server: Port 21, User/Password any combination, but:

By sniffing the file transfer via Runcam app we see they use passive mode, but file listing seems to be not implemented

If using the app for changing settings there is also a connection on port 15740, so they uses PTP/IP. They change all settings via PTP/IP, some with custom IDs

e.g Device Property 0x0000d605 replies with video resolutions somehow (1280×720 60 1920×1080 60 1920×1080 60 1920×1080 30 1280×720 60)

Hardware Info:
Sensor: 4MP Omnivision OV4689 (1/3″, 2688*1520px, 64,6bB dynamic range)
Processor: iCatch / Sunplus SPCA6350A
16MB Winbond SPI flash
A7125 Wifi Module connected via 4-bit SDIO

Same hardware setup: EKEN H9/H9R

OMNIBUS F4 V3 – Documentation

Since there is no documentation at all on any of these F4 boards, here is my try:
– STM32F405 LQFP64 (168Mhz, 1M flash, 192kB SRAM)
– MPU6000 6DOF IMU
– BMP280 barometer
– MAX7456 OSD (or fake)
– 5V Switching regulator (MP2359)
– 6pin SM06B-SRSS connector to ESC (fits Racestar RS20A4V2)
– DSM2 port for SPEKTRUM satellit
– USB CDC serial, DFU firmware update
– micro SD card slot for Blackbox logging

Latest firmware on Betaflight github releases (V3.2.0)
Configurator as Chrome App

Power Supply MP2359 (1.4MHz switching regulator)
Input Voltage: max 24V (input capacitors may limit voltage to 4S)
Output Current: max. 1.2A (1.8A current Limit)

3.3V LDO (100mA?)

Accessable pins

RSSI A0 14 Not ADC capable
PWM5 A1 5,2 1,4 15 SoftSer 11 RX(/TX)
PWM4 A2 2,3 1,1 16 Motor 4
PWM3 A3 2,4 1,6 17 Motor 3
PWM6 A8 1,1 2,3 41 SoftSer 11 TX(/RX)
UART1 TX A9 1,2 2,2 42
UART1 RX A10 1,3 ?,? 43 DSM2 SPEKSAT
PWM1 B0 3,3 1,7 26 Motor 1
PWM2 B1 3,4 1,2 27 Motor 2
Buzzer B4 56
LED_STRIP B6 4,1 1,0 58 WS2812 LED
PPM B8 12,3 n.a 61 PPM (if jumpered)
CH2 B9 62 ? wrong in BF github.
UART3 TX B10 2,3(!) ?,? 29 Shared I²C resource
UART3 RX B11 2,4(!) ?,? 30 Shared I²C resource
CRNT C1 2,4 9  external current sense ADC
VBAT C2 2,4 10  internal VBat voltage divider ADC
UART6 TX C6 8,1 2,2 37
UART6 RX C7 8,2 2,3 38 SBUS (if jumpered)

Note: Serial ports in CAPITALs are Serial1; Serial3; Serial6, Serial11 (=SoftSer1); Serial12 (=SoftSer2)
In sourcecode and portforwarding use number-1: serial0; serial2; serial5…


USB_D+ A12  45  USB data plus
USB_D- A11  44  USB data minus
SWD A13  46  SWD_DIO
SWC A14  49  SWD_CLK
OSC_IN H0  5
SPI1_MISO A6  22  MPU600 SPI
SPI1_MOSI A7  23
SPI1_CLK A5  21
SPI1_CS_MPU A4  20
MPU_INT C4  24  MPU6000 Interrupt output
SPI2_MISO B14  35  SD card SPI
SPI2_MOSI B15  36
SPI2_CLK B13  34
SPI2_CS_SD B12  33
SD_DETECT B7  59  SD Card detect switch
SPI3_MOSI C12  53
SPI3_CLK C10  51
SPI3_CS_Baro B3  55
SPI3_CS_OSD A15  50
INVERTER C8  39  Logic Level inverter enable
LED1 C5  57  onboard LED (blue)
B2  28  GND
C3  11  resistor with NRST?
C13  2  unrouted
C14  3  unrouted
C15  4  unrouted

Where to buy:
ebay (DE)
ebay (CN)

The following is pretty much for my own configuration, but might be useful for you as well:

Set throotle check min:
set min_check = 1045

Setup SoftSer 11 for runcam control:
resource Motor 5 none
resource Motor 6 none
resource serial_rx 11 A1
resource serial_tx 11 A8

Get Mag working on UART3/I²C2:
resource Serial_TX 3 none
resource Serial_RX 3 none
resource i2c_scl 2 b10
resource i2c_sda 2 b11

Dont forget to:

Lenovo Miix 2 10 – Touchscreen Reperatur

Bei einem Lenovo Miix 2 10 trat der Fehler auf dass der Touchscreen in x-Richtung insgesamt nur 23 Streifen hatte auf dem er funktioniert. Die y-Richtung war nicht betroffen. In Paint konnte man schöne grade Streifen malen:

Nach anfänglicher Treiberupdates und Softwareseitiger Fehlersuche kam mir ein Bild des Digitizer-Steckers unter:

Es ist ein zweireihiger Flachbandstecker. Schaut man sich dazu noch die Andere Seite des Kabels an sieht man dass jeder zweite Kontakt immer in der oberen bzw. unteren Reihe endet. Dabei ist der rechte Steckerteil für die x-Achse, der linke vermutlich für die y-Achse zuständig.

Wenn dieser Flachbandstecker also nicht vollständig eingesteckt ist, hat nur die obere Reihe Kontakt, während die untere nicht funktioniert. Das passt sehr gut auf das Fehlerbild von oben, wenn jeder zweite Kapazitive Balken nicht verbunden ist.

Also kurzerhand die Rückseite des Tablets mit dem Fingernagel aufclipsen und den Deckel nach unten abnehmen. Im Deckel befinden sich zwei starke Neodymagneten für das Dock (die sogar mit Nord und Süd beschriftet sind). Unter dem Deckel verbirgt sich neben etwas Luft ein 6760mAh Akku und das Mainboard. Man erkennt einen nicht verlöteten Steckplatz (PCIe? Erweiterung des Speichers für die 128GB Modelle?).


Auf der Linken Seite befindet sich der über I2C angebundene Touchcontroller mit besagten Steckern auf der Unterseite.

Weitere Bilder:

Interessant aber nicht weiter behandelt: Der Dock Anschluss. Rechts vermutlich ein USB Stecker.