If you have PPSTRONG based camera, which you can assume from ONVIF or UART, you can use these guidelines to work with it

In ONVIF tool, you will see a firmware update filename starting with ppstrong- and/or other mention of either PPSTRONG or PPS in camera identification section.

Assume you have UART access. How to know your camera is PPSTRONG platform? Place an empty ppsMmcTool.txt into the root of FAT formatted SD card, insert to camera, hold down reset button while powering the camera. Alternatively you may also hold the reset button until the camera restarts itself.

In u-boot log there will be something like this:

reset key pressed!
cmd:fatload mmc 0 0x80600000 ppsMmcTool.txt
reading ppsMmcTool.txt

Set ppsMmcTool.txt contents to be:

style=upgrade,,writeAddr=0,,password=nothing,,writeLen=0,,fileName=ppsMmcTool.txt - 0x0;printenv,,

Reboot camera again, holding down the reset button You will get full boot environment variables output, like

reset key pressed!
cmd:fatload mmc 0 0x80600000 ppsMmcTool.txt
reading ppsMmcTool.txt
%d bytes read in %d ms (%.02f KiB/s)
cmdBuf:fatload mmc 0 0x80600000 ppsMmcTool.txt - 0x0;printenv,,
reading env

[...]

baudrate=115200
bootargs=console=/dev/null mem=40M@0x0 rmem=20M@0x2800000 nmem=4M@0x3C00000 init=/linuxrc mtdparts=sfc0_nor:256k(BOOT),2560k(sys),7680k(app),5120k(recove),640k(cfg),64k(enc),64k(sysflg) lpj=11968512 debug_mode=0
bootcmd=sf0 probe;sf0 read 0x80600
bootdelay=2
ethact=Jz4775-9161
ethaddr=00:11:22:56:96:69
filesize=ca
gatewayip=193.169.4.1
ipaddr=193.169.4.151
loads_echo=1
netmask=255.255.255.0
serverip=193.169.4.2
stderr=serial
stdin=serial
stdout=serial

Environment size: 503/4092 bytes
error: Pack header size error!
error: upgrade.bin unpack error!
mmc power off ...

Set ppsMmcTool.txt contents to be:

style=upgrade,,writeAddr=0,,password=nothing,,writeLen=0,,fileName=ppsMmcTool.txt - 0x7b;env import -t 80600000;printenv,,
bootargs=console=ttyS1,115200n8 mem=40M@0x0 rmem=20M@0x2800000 nmem=4M@0x3C00000 init=/linuxrc mtdparts=sfc0_nor:256k(BOOT),2560k(sys),7680k(app),5120k(recove),640k(cfg),64k(enc),64k(sysflg) lpj=11968512

and any env vars you would like to set

NOTE: Do NOT alter bootcmd unless you know what you are doing! Remove it from the list of vars to be set! Altering it (even to the same value) will very likely trigger a callback that will force removal of decryption key and the camera will no longer boot without knowledge of the factory key. Again, if this happens, it is NOT reversible by reverting bootcmd to the original value nor restoring env defaults and reflash of stock firmware will most likely be necessary.

Boot again.

Env should now be set to the new values. This is change is ephemeral (unless you altered bootcmd).

If you want to make the change permanent, append ;saveenv to the commands on the first line an adjust the skip offset from 0x7b to hex value of final length of the first line, ie. 0x83:

style=upgrade,,writeAddr=0,,password=nothing,,writeLen=0,,fileName=ppsMmcTool.txt - 0x83;env import -t 80600000;printenv;saveenv,,
bootargs=console=ttyS1,115200n8 mem=40M@0x0 rmem=20M@0x2800000 nmem=4M@0x3C00000 init=/linuxrc mtdparts=sfc0_nor:256k(BOOT),2560k(sys),7680k(app),5120k(recove),640k(cfg),64k(enc),64k(sysflg) lpj=11968512

The camera will now always use the env vars in the file. SDcard may now safely be removed and the changes will be kept, unless firmware changes it again.

The above builds on top of existing processes discovered by @guino, namely it stems from No programmer, No UART, No problem! but has been repurposed altered for changing the boot environment variables. And it's just a single file.

You may run additional u-boot, commands, i.e. help or flash thingino directly from SD card