Skip to content

Instantly share code, notes, and snippets.

@JanLoebel

JanLoebel/README.md

Last active March 20, 2024 00:17
Show Gist options
  • Save JanLoebel/b5dafcda555323785d32ccb7d643dbcd to your computer and use it in GitHub Desktop.
Save JanLoebel/b5dafcda555323785d32ccb7d643dbcd to your computer and use it in GitHub Desktop.
Download ZIP
Hikam S6 Reverse Engineering (HI3518 E)
Raw
README.md

Reverse Engineering of Hikam S6 (HI3518 E)

Why?

I wanted to integrate the camera into my home security system. The only problem is that I want to toggle the alarm of the camera based on the security system status. Currently, this is only available via the app or a time trigger which is booth not sufficient for me. So the main target was to change the alarm status without the app.

What I've done so far:

My first try was to capture the TCP packages between the Android app and the camera. Soon I realized that they are only TCP+SSL (not pinned) requests to a cloud service of Hikam. So I installed an emulator with the Hikam app and Wireshark. I've seen some packages but the payload is very strange and even if I send the UDP commands again the status won't change. So this was a dead end for me.

I opened the camera and found the UART port of the HI3518E chip which is inside the camera. I used a USB-to-Serial-Adapter together with Putty and a speed of 115200 to connect the camera. Finally I was able to see the startup.log (see below). Root password? It's not needed because it will auto login which is very great :D Linux Hikam-4119 3.4.35 #3 Wed Mar 28 14:22:13 HKT 2018 armv5tejl GNU/Linux is the result of uname -a. Stuff like the passwd-hash of the root user and some other debug-information is added as an extra document below.

There are two interesting extra mounted directories:

  • /mnt/config/master which looks like the "backup" store with all configurations (binary?!)
  • /mnt/mtd/bin contains binaries that are used to provide all the functions of the camera.

On the system there are 5 main applications running:

  • ipc_daemon Works as a watchdog to restart any of the processes if one dies.
  • webs Seems to serve the web interface to login to the camera which is running under port 80.
  • platform ?! I think it's the cloud connection and handle some basic calls to the hardware.
  • media Capture Video, providing ONVIF-Stream support etc..
  • upgrade_manager Handle upgrades of the camera.

So I've tried to decompile these applications with snowman but the resulting code is too confusing. I've had a look at nearly any other file in the system but was not able to find anything useful. I've found some log files and debug-messages when the alarm is turned on or off, see below.

I've tried one last thing.. in the config-directory /mnt/config/master is one file called alarmconf.conf. So I've set the alarm to on and copied the resulting file to alarmconf.conf.on, deactivated the alarm and copied it to alarmconf.conf.off. If I now, execute cp alarmconf.conf.on alarmconf.conf it will activate the alarm, and if I execute cp alarmconf.conf.off alarmconf.conf it is off. So the system seems to watch the file and reload the configuration then. So for my use case, I could now compile a small program which opens a simple TCP connection or HTTP and listen for commands to exchange config files. But if anything is changed with a new firmware version I'm pretty sure something break.

So now It's YOUR TURN.. any ideas on how to proceed or any help here? I could offer you a "complete" file system dump.

Others

Links:

Raw
debug-msg-alarm.log
ALARM ON:
/mnt # normal msg_type[60]len[112] peer[3]
night auto on 1
send msg:0x3d len[112] to peer:3
normal msg_type[18]len[44] peer[3]
send msg:0x18 len[48] to peer:3
send msg:0x25 len[52] to peer:3
send msg:0x3f len[112] to peer:3
send msg:0x51 len[48] to peer:3
send msg:0x31 len[96] to peer:3
return get network type retcode[0]peer[3]
send msg:0x43 len[48] to peer:3
2018-06-20 17:39:15 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
2018-06-20 17:39:15 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:85
normal msg_type[62]len[112] peer[3]
send msg:0x3f len[112] to peer:3
normal msg_type[76]len[112] peer[3]
send msg:0x4d len[9496] to peer:3
normal msg_type[62]len[112] peer[3]
send msg:0x3f len[112] to peer:3
##################################################
ALARM OFF
/mnt # normal msg_type[62]len[112] peer[3]
send msg:0x3f len[112] to peer:3
normal msg_type[60]len[112] peer[3]
night auto off 0
send msg:0x3d len[112] to peer:3
normal msg_type[18]len[44] peer[3]
send msg:0x18 len[48] to peer:3
send msg:0x25 len[52] to peer:3
send msg:0x3f len[112] to peer:3
return get network type retcode[0]peer[3]
send msg:0x43 len[48] to peer:3
2018-06-20 17:39:59 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
2018-06-20 17:39:59 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:85
send msg:0x51 len[48] to peer:3
send msg:0x31 len[96] to peer:3
##################################################
Raw
other-information.log
####### U-BOOT
hisilicon # printenv
bootdelay=1
baudrate=115200
ethaddr=00:00:23:34:45:66
ipaddr=192.168.1.10
serverip=192.168.1.2
netmask=255.255.255.0
bootfile="uImage"
bootargs=mem=38M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=hi_sfc:512k(boot),2816k(kernel),7M(rootfs),4M(app),512k(master),1280k(log)
bootcmd=sf probe 0;sf read 0x82000000 0x80000 0x2c0000;bootm 0x82000000
filesize=198
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Jun 15 2017 - 14:15:50)
Environment size: 476/65532 bytes
####### LINUX
~ # uname -a
Linux Hikam-4119 3.4.35 #3 Wed Mar 28 14:22:13 HKT 2018 armv5tejl GNU/Linux
~ # less /etc/passwd
root:$1$h2qS9ibK$zgxEvDi.1O4hFIPlm6jWp.:0:0::/root:/bin/sh^
Available commands:
[ fsync mknod smemcap
[[ ftpd mkpasswd softlimit
acpid ftpget mkswap sort
add-shell ftpput mktemp split
addgroup fuser modinfo ssp_read
adduser getopt modprobe ssp_write
adjtimex getty more start-stop-daemon
arp grep mount stat
arping groups mountpoint strings
ash gunzip mpstat stty
awk gzip mt su
base64 halt mv sulogin
basename hd nameif sum
beep hdparm nanddump sv
blkid head nandwrite svlogd
blockdev hexdump nbd-client swapoff
bootchartd hiddrs nc swapon
brctl hier netstat switch_root
btools hiew nfsroot sync
bunzip2 himc nice sysctl
busybox himd nmeter syslogd
bzcat himd.l nohup tac
bzip2 himm nslookup tail
cal hostid ntpd tar
cat hostname od tcpsvd
catv httpd openvt tee
chat hush passwd telnet
chgrp hwclock patch telnetd
chmod i2c_read pgrep test
chown i2c_write pidof tftp
chpasswd id ping tftpd
chpst ifconfig ping6 time
chroot ifdown pipe_progress timeout
chrt ifenslave pivot_root tools/
chvt ifplugd pkill top
cksum ifup pmap touch
clear inetd popmaildir tr
cmp init poweroff traceroute
comm insmod powertop traceroute6
conspy install printenv true
cp ionice printf tty
cpio iostat ps ttysize
crond ip pscan tunctl
crontab ipaddr pstree ubiattach
cryptpw ipcalc pwd ubidetach
cttyhack ipcrm pwdx ubimkvol
cut ipcs raidautorun ubirmvol
date iplink rdate ubirsvol
dc iproute rdev ubiupdatevol
dd iprule readahead udevadm
deallocvt iptunnel readlink udevd
delgroup kbd_mode readprofile udhcpc
deluser kill realpath udhcpd
depmod killall reboot udpsvd
devmem killall5 reformime umount
df klogd remove-shell uname
dhcprelay last renice unexpand
diff less reset uniq
dirname linux32 resize unix2dos
dmesg linux64 rev unlzma
dnsd ln rm unlzop
dnsdomainname loadfont rmdir unxz
dos2unix loadkmap rmmod unzip
du logger route uptime
dumpkmap login rpm users
dumpleases logname rpm2cpio usleep
echo logread rtcwake uudecode
ed losetup run-parts uuencode
egrep lpd runlevel vconfig
eject lpq runsv vi
env lpr runsvdir vlock
envdir ls rx volname
envuidgid lsmod script wall
ether-wake lsof scriptreplay watch
expand lspci sed watchdog
expr lsusb sendmail wc
fakeidentd lzcat seq wget
false lzma setarch which
fbset lzop setconsole who
fbsplash lzopcat setfont whoami
fdflush makedevs setkeycodes whois
fdformat makemime setlogcons wpa_cli
fdisk man setserial wpa_supplicant
fgconsole md5sum setsid xargs
fgrep mdev setuidgid xz
find mesg sh xzcat
findfs microcom sha1sum yes
flock mkdir sha256sum zcat
fold mkdosfs sha512sum zcip
free mkfifo showkey
freeramdisk mkfs.minix slattach
fsck.minix mkfs.vfat sleep
~ # lsof
1 /bin/busybox /dev/console
1 /bin/busybox /dev/console
1 /bin/busybox /dev/console
634 /bin/udevd /dev/null
634 /bin/udevd /dev/null
634 /bin/udevd /dev/null
634 /bin/udevd /dev/.udev/queue.bin
634 /bin/udevd socket:[173]
634 /bin/udevd socket:[174]
634 /bin/udevd anon_inode:inotify
634 /bin/udevd anon_inode:[signalfd]
634 /bin/udevd socket:[175]
634 /bin/udevd socket:[176]
717 /bin/udevd /dev/null
717 /bin/udevd /dev/null
717 /bin/udevd /dev/null
717 /bin/udevd anon_inode:inotify
717 /bin/udevd socket:[176]
717 /bin/udevd socket:[286]
719 /bin/udevd /dev/null
719 /bin/udevd /dev/null
719 /bin/udevd /dev/null
719 /bin/udevd anon_inode:inotify
719 /bin/udevd socket:[176]
719 /bin/udevd socket:[287]
1174 /bin/busybox /dev/ttyS000
1174 /bin/busybox /dev/ttyS000
1174 /bin/busybox /dev/ttyS000
1174 /bin/busybox /dev/tty
1176 /mnt/mtd/bin/ipc_daemon /dev/null
1176 /mnt/mtd/bin/ipc_daemon /dev/console
1176 /mnt/mtd/bin/ipc_daemon /dev/console
1176 /mnt/mtd/bin/ipc_daemon /mnt/mtd/etc/.ipc_daemon_lockfile
1176 /mnt/mtd/bin/ipc_daemon /mnt/log/ipc_daemon.log
1176 /mnt/mtd/bin/ipc_daemon /dev/watchdog
1176 /mnt/mtd/bin/ipc_daemon /mnt/mtd/etc/ipc_daemon.conf
1181 /mnt/mtd/bin/plat_main /dev/null
1181 /mnt/mtd/bin/plat_main /dev/console
1181 /mnt/mtd/bin/plat_main /dev/console
1181 /mnt/mtd/bin/plat_main /mnt/mtd/etc/.ipc_daemon_lockfile
1181 /mnt/mtd/bin/plat_main /mnt/log/ipc_daemon.log
1181 /mnt/mtd/bin/plat_main /dev/watchdog
1181 /mnt/mtd/bin/plat_main /mnt/mtd/etc/ipc_daemon.conf
1181 /mnt/mtd/bin/plat_main /mnt/log/platform.log
1181 /mnt/mtd/bin/plat_main socket:[1096]
1181 /mnt/mtd/bin/plat_main socket:[1254]
1181 /mnt/mtd/bin/plat_main /dev/hi_gpio
1181 /mnt/mtd/bin/plat_main /dev/hi_adc
1181 /mnt/mtd/bin/plat_main /dev/hi_gpio
1208 /mnt/mtd/bin/dev_manager /dev/null
1208 /mnt/mtd/bin/dev_manager /dev/console
1208 /mnt/mtd/bin/dev_manager /dev/console
1208 /mnt/mtd/bin/dev_manager /mnt/mtd/etc/.ipc_daemon_lockfile
1208 /mnt/mtd/bin/dev_manager /mnt/log/ipc_daemon.log
1208 /mnt/mtd/bin/dev_manager /dev/watchdog
1208 /mnt/mtd/bin/dev_manager /mnt/mtd/etc/ipc_daemon.conf
1208 /mnt/mtd/bin/dev_manager /mnt/log/devmanager.log
1208 /mnt/mtd/bin/dev_manager socket:[1191]
1208 /mnt/mtd/bin/dev_manager socket:[1204]
1208 /mnt/mtd/bin/dev_manager socket:[1206]
1220 /bin/wpa_supplicant /dev/null
1220 /bin/wpa_supplicant /dev/null
1220 /bin/wpa_supplicant /dev/null
1220 /bin/wpa_supplicant /mnt/mtd/etc/.ipc_daemon_lockfile
1220 /bin/wpa_supplicant /mnt/log/ipc_daemon.log
1220 /bin/wpa_supplicant /dev/watchdog
1220 /bin/wpa_supplicant /mnt/mtd/etc/ipc_daemon.conf
1220 /bin/wpa_supplicant /mnt/log/platform.log
1220 /bin/wpa_supplicant socket:[1087]
1220 /bin/wpa_supplicant socket:[1088]
1220 /bin/wpa_supplicant socket:[1093]
1220 /bin/wpa_supplicant socket:[1094]
1223 /mnt/mtd/bin/media_biz /dev/null
1223 /mnt/mtd/bin/media_biz /dev/console
1223 /mnt/mtd/bin/media_biz /dev/console
1223 /mnt/mtd/bin/media_biz /mnt/mtd/etc/.ipc_daemon_lockfile
1223 /mnt/mtd/bin/media_biz /mnt/log/ipc_daemon.log
1223 /mnt/mtd/bin/media_biz /dev/watchdog
1223 /mnt/mtd/bin/media_biz /mnt/mtd/etc/ipc_daemon.conf
1223 /mnt/mtd/bin/media_biz /mnt/log/media.log
1223 /mnt/mtd/bin/media_biz /dev/vb
1223 /mnt/mtd/bin/media_biz /dev/sys
1223 /mnt/mtd/bin/media_biz /dev/isp_dev
1223 /mnt/mtd/bin/media_biz /dev/isp_dev
1223 /mnt/mtd/bin/media_biz /dev/mem
1223 /mnt/mtd/bin/media_biz /dev/i2c-0
1223 /mnt/mtd/bin/media_biz /dev/vi
1223 /mnt/mtd/bin/media_biz /dev/vi
1223 /mnt/mtd/bin/media_biz /dev/vpss
1223 /mnt/mtd/bin/media_biz /dev/vpss
1223 /mnt/mtd/bin/media_biz /dev/vpss
1223 /mnt/mtd/bin/media_biz /dev/venc
1223 /mnt/mtd/bin/media_biz /dev/venc
1223 /mnt/mtd/bin/media_biz /dev/venc
1223 /mnt/mtd/bin/media_biz /dev/isp_dev
1223 /mnt/mtd/bin/media_biz /dev/venc
1223 /mnt/mtd/bin/media_biz /dev/venc
1223 /mnt/mtd/bin/media_biz /mnt/mtd/bin/ASC32
1223 /mnt/mtd/bin/media_biz /mnt/mtd/bin/ASC16
1223 /mnt/mtd/bin/media_biz /dev/rgn
1223 /mnt/mtd/bin/media_biz /dev/isp_dev
1223 /mnt/mtd/bin/media_biz /dev/isp_dev
1223 /mnt/mtd/bin/media_biz /dev/isp_dev
1223 /mnt/mtd/bin/media_biz /dev/ai
1223 /mnt/mtd/bin/media_biz /dev/ai
1223 /mnt/mtd/bin/media_biz /dev/aenc
1223 /mnt/mtd/bin/media_biz /dev/mmz_userdev
1223 /mnt/mtd/bin/media_biz /dev/adec
1223 /mnt/mtd/bin/media_biz /dev/ao
1223 /mnt/mtd/bin/media_biz /dev/isp_dev
1223 /mnt/mtd/bin/media_biz /dev/vi
1223 /mnt/mtd/bin/media_biz /dev/ive
1223 /mnt/mtd/bin/media_biz /dev/mmz_userdev
1223 /mnt/mtd/bin/media_biz socket:[1207]
1223 /mnt/mtd/bin/media_biz socket:[1216]
1223 /mnt/mtd/bin/media_biz socket:[1221]
1223 /mnt/mtd/bin/media_biz socket:[1222]
1223 /mnt/mtd/bin/media_biz socket:[1236]
1223 /mnt/mtd/bin/media_biz socket:[1902]
1223 /mnt/mtd/bin/media_biz socket:[1903]
1227 /mnt/mtd/bin/webs /dev/null
1227 /mnt/mtd/bin/webs /dev/console
1227 /mnt/mtd/bin/webs /dev/console
1227 /mnt/mtd/bin/webs /mnt/mtd/etc/.ipc_daemon_lockfile
1227 /mnt/mtd/bin/webs /mnt/log/ipc_daemon.log
1227 /mnt/mtd/bin/webs /dev/watchdog
1227 /mnt/mtd/bin/webs /mnt/mtd/etc/ipc_daemon.conf
1227 /mnt/mtd/bin/webs socket:[1135]
1231 /mnt/mtd/bin/upgrade_manager /dev/null
1231 /mnt/mtd/bin/upgrade_manager /dev/console
1231 /mnt/mtd/bin/upgrade_manager /dev/console
1231 /mnt/mtd/bin/upgrade_manager /mnt/mtd/etc/.ipc_daemon_lockfile
1231 /mnt/mtd/bin/upgrade_manager /mnt/log/ipc_daemon.log
1231 /mnt/mtd/bin/upgrade_manager /dev/watchdog
1231 /mnt/mtd/bin/upgrade_manager /mnt/mtd/etc/ipc_daemon.conf
1231 /mnt/mtd/bin/upgrade_manager /mnt/log/upgrademanager.log
1231 /mnt/mtd/bin/upgrade_manager socket:[1182]
1231 /mnt/mtd/bin/upgrade_manager socket:[1183]
1231 /mnt/mtd/bin/upgrade_manager socket:[1184]
1231 /mnt/mtd/bin/upgrade_manager socket:[1185]
1246 /bin/busybox /dev/null
1246 /bin/busybox /dev/null
1246 /bin/busybox /dev/null
1246 /bin/busybox /mnt/mtd/etc/.ipc_daemon_lockfile
1246 /bin/busybox /mnt/log/ipc_daemon.log
1246 /bin/busybox /dev/watchdog
1246 /bin/busybox /mnt/mtd/etc/ipc_daemon.conf
1246 /bin/busybox /mnt/log/platform.log
1246 /bin/busybox socket:[1096]
1246 /bin/busybox pipe:[1162]
1246 /bin/busybox pipe:[1162]
Raw
startup.log
System startup
U-Boot 2010.06 (Jun 15 2017 - 14:15:50)
Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
SPI Nor total size: 16MB
Cannot found a valid SPI Nand Device
MMC:
EMMC/MMC/SD controller initialization.
Card did not respond to voltage select!
No EMMC/MMC/SD device found !
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
16384 KiB hi_fmc at 0:0 is now current device
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.4.35
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2702096 Bytes = 2.6 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0
Linux version 3.4.35 ([email protected]) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v300) ) #3 Wed Mar 28 14:22:13 HKT 2018
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518ev200
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 9652
Kernel command line: mem=38M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=hi_sfc:512k(boot),2816k(kernel),7M(rootfs),4M(app),512k(master),1280k(log)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 38MB = 38MB total
Memory: 33056k/33056k available, 5856k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
vmalloc : 0xc2800000 - 0xff000000 ( 968 MB)
lowmem : 0xc0000000 - 0xc2600000 ( 38 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.text : 0xc0008000 - 0xc04bf000 (4828 kB)
.init : 0xc04bf000 - 0xc04e12a4 ( 137 kB)
.data : 0xc04e2000 - 0xc0510300 ( 185 kB)
.bss : 0xc0510324 - 0xc054f650 ( 253 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32
VIC @fe0d0000: id 0x00641190, vendor 0x41
sched_clock: 32 bits at 49MHz, resolution 20ns, wraps every 86767ms
Console: colour dummy device 80x30
Calibrating delay loop... 269.10 BogoMIPS (lpj=1345536)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x803a77d8 - 0x803a7830
dummy:
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 30) is a PL011 rev2
uart:2: ttyAMA2 at MMIO 0x200a0000 (irq = 25) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
hi-spi-master hi-spi-master.0: with 1 chip select slaves attached
hi-spi-master hi-spi-master.1: with 2 chip select slaves attached
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource timer0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NFS: Registering the id_resolver key type
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.18)
msgmni has been set to 64
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
Check Flash Memory Controller v100 ... Found.
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
SPI Nor total size: 16MB
6 cmdlinepart partitions found on MTD device hi_sfc
6 cmdlinepart partitions found on MTD device hi_sfc
Creating 6 MTD partitions on "hi_sfc":
0x000000000000-0x000000080000 : "boot"
0x000000080000-0x000000340000 : "kernel"
0x000000340000-0x000000a40000 : "rootfs"
0x000000a40000-0x000000e40000 : "app"
0x000000e40000-0x000000ec0000 : "master"
0x000000ec0000-0x000001000000 : "log"
SPI Nand ID Table Version 2.2
Cannot found a valid SPI Nand Device
himii: probed
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mousedev: PS/2 mouse device common for all mice
i2c /dev entries driver
hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed!
hisi_i2c hisi_i2c.1: Hisilicon [i2c-1] probed!
hisi_i2c hisi_i2c.2: Hisilicon [i2c-2] probed!
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
usb 1-1: new high-speed USB device number 2 using hiusb-ehci
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
Registering the dns_resolver key type
VFS: Mounted root (cramfs filesystem) readonly on device 31:2.
Freeing init memory: 136K
mount: mounting none on /dev/pts failed: No such file or directory
_ _ _ _ _ _ _ _ _ _ _ _
\ _ _ _ _ _ ___
/ /__/ \ |_/
/ __ / - _ ___
/ / / / / /
_ _ _ _/ / / \_/ \_ ______
___________\___\__________________
[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01mdev
mmc1: new high speed SDHC card at address e624
mmcblk0: mmc1:e624 SU04G 3.69 GiB
mmcblk0:
[RCS]: /etc/init.d/S01udev
mkdir: can't create directory '/dev/pts': File exists
mount: mounting devpts on /dev/pts failed: Device or resource busy
udev[634]: starting version 164
Not recognise ACTION:change
Not recognise ACTION:change
Not recognise ACTION:change
[RCS]: /etc/init.d/S80network
[RCS]: /etc/init.d/S90hibernate
mount: mounting none on /proc failed: Device or resource busy
mmz_start: 0x82600000, mmz_size: 26M
Hisilicon Media Memory Zone Manager
Module himedia: init ok
hi3518e_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
load sys.ko for Hi3518EV200...OK!
load tde.ko ...OK!
load region.ko ....OK!
load vgs.ko for Hi3518EV200...OK!
ISP Mod init!
load viu.ko for Hi3518EV200...OK!
load vpss.ko ....OK!
load rc.ko ...OK!
load venc.ko ...OK!
load chnl.ko for Hi3518EV200...OK!
load h264e.ko ...OK!
load jpege.ko ...OK!
load ive.ko for Hi3518EV200...OK!
load sensor_i2c.ko ...OK!
==== Your input Sensor type is ar0130 ====
load pwm.ko ...OK!
load piris.ko ...OK!
load hi_rtc.ko ...OK!
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=30 sec (nowayout= 0, nodeamon= 0)
acodec inited!
load hi3518e_aio.ko ...OK!
load ai.ko ...OK!
load ao.ko ...OK!
load aenc.ko ...OK!
load adec.ko ...OK!
insert audio
mipi_init
init phy power successful!
load hi_mipi.ko ...OK!
g_gpio_conf is null,set default
sensor reset pin_group:6 pin_number:6
detect ret:0, sensor_type:12, expect_value:4096, value:4096
++++++++++++++++ar0130-960 sensor detect!!!!!!++++++++++++++++
==== Your input Sensor type is ar0130 ====
++++++++++++++++8188eu wifi detect!!!!!!++++++++++++++++
Auto login as root ...
Jan 1 00:00:14 login[1174]: root login on 'ttyS000'
Welcome to HiLinux.
None of nfsroot found in cmdline.
~ # killall: plat_main: no process killed
log init: logdir[/mnt/log] logname[platform] level[3]
log enable!
1970-01-01 00:00:14 [Level: 2] platform_main.c(2587)-main:device manager msg queue: 0
platform_hw_select_conf sensor_type:0
SYSV sem init: key:0x760d0406, name:/var/.network, init value:1
SYSV semid is 0x0
wifi nums:1!!!!!!!wirenet nums:0!!!!!!
killall: wpa_supplicant: no process killed
killall: udhcpd: no process killed
killall: udhcpc: no process killed
killall: hostapd: no process killed
conf->wifi_conf.wifi_conf=1
rmmod: can't unload '8188eu': unknown symbol in module, or unknown parameter
RTL871X: module init start
RTL871X: rtl8188eu v4.3.24_16705.20160509_r17784
RTL871X: build time: Jan 8 2018 11:59:14
bFWReady == _FALSE call reset 8051...
RTL871X: hal_com_config_channel_plan chplan:0x20
RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=88:83:5d:c8:ce:37
RTL871X: rtw_ndev_init(wlan1) if2 mac_addr=8a:83:5d:c8:ce:37
usbcore: registered new interface driver rtl8188eu
RTL871X: module init ret=0
killall: dev_manager: no process killed
log init: logdir[/mnt/log] logname[devmanager] level[4]
log enable!
1970-01-01 00:00:16 [Level: 2] sys_msg.c(136)-usr_create_msgQ:create 7 msq queen failed, maybe already exist, err:File exists
list device manager msg queue: 327687
==> rtl8188e_iol_efuse_patch
RTL871X: set bssid:00:00:00:00:00:00
ioctl[SIOCSIWAP]: Operation not permitted
Selected interface 'wlan0'
wifi_ifname=wlan0
wpa_cli_open_connection func: cfile=/var/run/wpa_supplicant/wlan0
wifi init ok!!!!
scan command return:OK
killall: media_biz: no process killed
log init: logdir[/mnt/log] logname[media] level[3]
log enable!
1970-01-01 00:00:19 [Level: 2] sys_msg.c(136)-usr_create_msgQ:create 9 msq queen failed, maybe already exist, err:File exists
media bussiness msg queue: 360457
1970-01-01 00:00:19 [Level: 3] Waiting for platform_init_flag:0
RTL871X: nolinked power save enter
disable network command return len:5, buf:FAIL
remove_network command return len:5, buf:FAIL
wifi dial: add_network, network id:0
set network command=SET_NETWORK 0 ssid "<WLAN_NAME>"
set network ssid command return len:3, buf:OK
set network command=SET_NETWORK 0 scan_ssid 1
set network scan_ssid command return len:3, buf:OK
set network command=SET_NETWORK 0 psk "<WLAN_PASSWORD>"
set network psk command return len:3, buf:OK
set network command=SELECT_NETWORK 0
select network command return len:3, buf:OK
set network command=ENABLE_NETWORK 0
==> rtl8188e_iol_efuse_patch
killall: webs: no process killed
RTL871X: nolinked power save leave
group=Administrator
enable network command return len:3, buf:OK
RTL871X: set ssid [<WLAN_NAME>] fw_state=0x00000008
RTL871X: start auth
RTL871X: auth success, start assoc
RTL871X: assoc success
RTL871X: recv eapol packet
RTL871X: send eapol packet
RTL871X: recv eapol packet
RTL871X: send eapol packet
RTL871X: set pairwise key camid:4, addr:54:67:51:c1:af:fd, kid:0, type:AES
RTL871X: set group key camid:5, addr:54:67:51:c1:af:fd, kid:1, type:TKIP
killall: upgrade_manager: no process killed
log init: logdir[/mnt/log] logname[upgrademanager] level[3]
log enable!
1970-01-01 00:00:23 [Level: 2] sys_msg.c(136)-usr_create_msgQ:create 6 msq queen failed, maybe already exist, err:File exists
1970-01-01 00:00:23 [Level: 3] device upgrade msg queue: 425990
killall -9 udhcpc
killall: udhcpc: no process killed
udhcpc (v1.20.2) started
Setting IP address 0.0.0.0 on wlan0
Sending discover...
Sending select for 192.168.0.178...
Lease of 192.168.0.178 obtained, lease time 3600
Setting IP address 192.168.0.178 on wlan0
Deleting routers
route: SIOCDELRT: No such process
Adding router 192.168.0.1
Recreating /tmp/resolv.conf
Adding DNS server 80.69.96.12
Adding DNS server 81.210.129.4
conf->wifi_nums > 0 && conf->wifi_conf.wifi_conf == 1
ntpclient_start,:interval:300
ntpclient.c:ntpclient_start use ntp server:
return 0;ntp_main threadid:-1230904128
####################################### Start Primary loop ###############
ntp server:time.nist.gov
setup_receive setup_receive
setup_transmit setup_transmit
Listening...
primary_loop select time:0 in
primary_loop select time:0 out
Sending ...
primary_loop select time:2 in
1970-01-01 00:00:27 [Level: 3] platform_main.c(1413)-platform_timer_check_thread:found adc vol[3.300000] is higher than night_vol_low!!!turn to high cds mode
1970-01-01 00:00:28 [Level: 3] platform_main.c(1442)-platform_timer_check_thread:now switch to high cds mode
night auto off 0
ntp client is running.
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 3] start media bussiness ...
SYSV sem init: key:0x760d0406, name:/var/.network, init value:1
SYSV semid is 0x0
1970-01-01 00:00:29 [Level: 3] load libs OK!
SYSV sem init: key:0x760d049e, name:/var/.media, init value:1
SYSV semid is 0x8001
primary_loop select time:0 out
Sending ...
primary_loop select time:4 in
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,
g_mediapro created:0x14e7808
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
linear mode
1970-01-01 00:00:29 [Level: 3] receive platform main init flag
1970-01-01 00:00:29 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!
1970-01-01 00:00:29 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!
1970-01-01 00:00:29 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!
1970-01-01 00:00:30 [Level: 4] dev_manager.c(2542)-main:receive platform main init flag
SYSV sem init: key:0x760d0406, name:/var/.network, init value:1
SYSV semid is 0x0
get default common setting:sync-mode:2, time_zone[120]:GMT, curr_time:0, date-type:0, langluge:0, xialingshi:0
Selected interface 'wlan0'
wifi_ifname=wlan0
wpa_cli_open_connection func: cfile=/var/run/wpa_supplicant/wlan0
wifi init ok!!!!
in onvif start
get default common setting:sync-mode:2, time_zone[120]:GMT, curr_time:0, date-type:0, langluge:0, xialingshi:0
get ntp=
onvif param init over !!!!
filebuf=/mnt/log/alarm_info0.txt
fopen init no alarm_info txt
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
Listen http 8090 is successful
add multi group 239.255.255.250:3702
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:31 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!
1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,
1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1
1970-01-01 00:00:31 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:31 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!
1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,
1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1
1970-01-01 00:00:31 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,
1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1
1970-01-01 00:00:31 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!
1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,
1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1
1970-01-01 00:00:31 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!
1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,
1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1
Aptina AR0130 sensor 720P30fps init success!
ret:0, vichnnl attr:cap wh[1280:720] dest wh[1280:720]
use gamma1
search video encode chnnl group, VencGroup:0
[Func]:HI_MPI_ISP_QueryExposureInfo [Line]:726 [Info]:Get Active Stat Buffer Err
gain level = 0
1970-01-01 00:00:31 [Level: 2] mediaproc.cpp(3090)-VencStart:video encode thread running!!!!!!!
search video encode chnnl group, VencGroup:1
get default common setting:sync-mode:2, time_zone[120]:GMT, curr_time:0, date-type:0, langluge:0, xialingshi:0
osd_create_region 520:DisplayContent[1970-01-01 00:00:31]
[Func]:HI_MPI_ISP_QueryExposureInfo [Line]:726 [Info]:Get Active Stat Buffer Err
[Func]:HI_MPI_ISP_QueryExposureInfo [Line]:726 [Info]:Get Active Stat Buffer Err
[Func]:HI_MPI_ISP_QueryExposureInfo [Line]:726 [Info]:Get Active Stat Buffer Err
1970-01-01 00:00:31 [Level: 3] media lib init OK!
flag=2
flag=4
1970-01-01 00:00:31 [Level: 3] stream conf OK!
1970-01-01 00:00:31 [Level: 3] rtp SendThres:13107,39321
1970-01-01 00:00:31 [Level: 3] media init OK!
audio enable = 1
HCWS_Acodec_CfgAudio: ACODEC_GET_ADCL_VOL:0x1e
HCWS_Acodec_CfgAudio: ACODEC_SET_ADCL_VOL:0x8
AiDevId=0,s32AiChnCnt=2
enSamplerate=8000,enBitwidth=1,,enWorkmode=0,enSoundmode=0,u32EXFlag=1,u32FrmNum=10,u32PtNumPerFrm=160,u32ChnCnt=2,u32ClkSel=0
[Func]:HI_MPI_ISP_QueryExposureInfo [Line]:726 [Info]:Get Active Stat Buffer Err
1970-01-01 00:00:31 [Level: 3] audio init OK!
init_md_config()
1970-01-01 00:00:32 [Level: 3] hd control, videv[0] picwidth[640] picheight[352]
1970-01-01 00:00:32 [Level: 3] hd control, ucEnable:1 iMdState:0 ucEnable:0!
init_md_config() OK.
1970-01-01 00:00:32 [Level: 3] md init OK!
init_zone_mask_config() enable = 0, channel = 0
enable = 0, (0, 0), (0, 0)
enable = 0, (0, 0), (0, 0)
enable = 0, (0, 0), (0, 0)
enable = 0, (0, 0), (0, 0)
init_zone_mask_config() init zone mask OK.
1970-01-01 00:00:32 [Level: 3] zone mask init OK!
init_isp_conf()
init_isp_conf() OK.
1970-01-01 00:00:32 [Level: 3] isp init OK!
Selected interface 'wlan0'
wifi_ifname=wlan0
wpa_cli_open_connection func: cfile=/var/run/wpa_supplicant/wlan0
wifi init ok!!!!
1970-01-01 00:00:32 [Level: 3] wifi init OK!
1970-01-01 00:00:32 [Level: 3] alarm log init OK!
1970-01-01 00:00:32 [Level: 3] speaker init OK!
hcws p2p init, local config active flag:1
devinfo_conf.basic_info.szSerialNumber=A024119,p2plicense:EUA-024119-ZTNWL,VWFMEA
1970-01-01 00:00:32 [Level: 3] ******************compile time[Jun 9 2018:11:02:15]ver[1.3.18]**************
p2p test: prepare to init hcws p2p client sdk, devid:A024119, local_ip:192.168.0.178
1970-01-01 00:00:32 [Level: 3] P2P_Client_SDK_Init: first client init
1970-01-01 00:00:32 [Level: 3] got dev license info:license[EUA-024119-ZTNWL,VWFMEA] serial[A024119] obj_org_id[0]lbsnum[2]
1970-01-01 00:00:32 [Level: 3] lbs[0]:domainName[ec2-52-59-26-183.eu-central-1.compute.amazonaws.com]ip[52.59.26.183]
1970-01-01 00:00:32 [Level: 3] lbs[1]:domainName[52.8.79.200]ip[52.8.79.200]
1970-01-01 00:00:32 [Level: 3] P2P_Client_SDK_Init:init client[192.168.0.178], log file[/mnt/log/param]
1970-01-01 00:00:32 [Level: 3] *****************sdk compile time[Jun 9 2018:11:00:16]**************
[OSThread::Start] OrgPrio:0, NewPrio:0
1970-01-01 00:00:32 [Level: 2] create_read_socket_thread() OK.
P2P_Client_SDK_Init: DID[EUA-024119-ZTNWL] API_LICENSE[VWFMEA]
PPCS_API Version: 2.0.0.1
1970-01-01 00:00:32 [Level: 3] process_read_socket() thread starts running.
CreateDeviceDiscoveryThread start.
CreateDeviceDiscoveryThread finished.
get alarmpush config:account[[email protected]],1,0
res_nums=2
res[i].stream_id.channel = 0, res[i].stream_id.trackid = 3
res[i].stream_id.channel = 1, res[i].stream_id.trackid = 4
[OSThread::Start] OrgPrio:0, NewPrio:0
[OSThread::Start] OrgPrio:0, NewPrio:0
[OSThread::Start] OrgPrio:0, NewPrio:0
1970-01-01 00:00:32 [Level: 3] Init stream, trackid[3]chnl[0]audio_en[1]audio_track[25]VideoBitsRate[786432]spslen[31]ppslen[4]
1970-01-01 00:00:32 [Level: 3] Init cache, trackid[3]chnl[0]audio_en[1]audio_track[25]this[0x153a580]m_nSize[2]srcType[1]
1970-01-01 00:00:32 [Level: 3] vbrate:786432,m_SendThres:31457
[OSThread::Start] OrgPrio:0, NewPrio:0
1970-01-01 00:00:32 [Level: 3] create_stream_process_task_thread() OK.
1970-01-01 00:00:32 [Level: 3] SetupStreamRes[0]devid[A024119]chnl[0]trackid[3]vframeRate[20]vBitRate[786432]aEn[1]aTrack[25]aSampleFreq[50]aBitRate[128000]aSampleBit[8000]spslen[31]ppslen[4]
1970-01-01 00:00:32 [Level: 3] Init stream, trackid[4]chnl[1]audio_en[1]audio_track[25]VideoBitsRate[262144]spslen[32]ppslen[4]
1970-01-01 00:00:32 [Level: 3] Init cache, trackid[4]chnl[1]audio_en[1]audio_track[25]this[0x15599c0]m_nSize[2]srcType[1]
1970-01-01 00:00:32 [Level: 3] vbrate:262144,m_SendThres:13107
[OSThread::Start] OrgPrio:0, NewPrio:0
1970-01-01 00:00:32 [Level: 3] create_stream_process_task_thread() OK.
1970-01-01 00:00:32 [Level: 3] process_stream_data_task() thread starts running.
1970-01-01 00:00:32 [Level: 3] process_stream_data_task() thread starts running.
1970-01-01 00:00:32 [Level: 3] SetupStreamRes[1]devid[A024119]chnl[1]trackid[4]vframeRate[15]vBitRate[262144]aEn[1]aTrack[25]aSampleFreq[50]aBitRate[128000]aSampleBit[8000]spslen[32]ppslen[4]
1970-01-01 00:00:32 [Level: 3] p2p init OK!
hcws_local_record_init()
1970-01-01 00:00:32 [Level: 3] record frame buffer init OK!
1970-01-01 00:00:32 [Level: 3] record lib init, offFlag:1 configType:3!
zmd_init_storage_device()
1970-01-01 00:00:32 [Level: 3] new sd_card OK!
sd_card::umount_device() umount OK.
no sub partitions.
1970-01-01 00:00:32 [Level: 3] sd_card::format_device() the device has already been formatted.
zmd_util::mkdir() mkdir [/tmp/mmc] OK.
sd_card::mount_device() cmd = mount -t vfat /dev/mmcblk0 /tmp/mmc
1970-01-01 00:00:32 [Level: 3] PPCS_NetworkDetect() ret = 0
1970-01-01 00:00:32 [Level: 3] -------------- NetInfo: -------------------
sd_card::mount_device() mount OK.
1970-01-01 00:00:32 [Level: 3] Internet Reachable : YES
1970-01-01 00:00:32 [Level: 3] P2P Server IP resolved : YES
1970-01-01 00:00:32 [Level: 3] P2P Server Hello Ack : YES
1970-01-01 00:00:32 [Level: 3] Local NAT Type :
1970-01-01 00:00:32 [Level: 3] Port-Restricted Cone
1970-01-01 00:00:32 [Level: 3] My Wan IP : 46.5.201.81
1970-01-01 00:00:32 [Level: 3] My Lan IP : 192.168.0.178
1970-01-01 00:00:32 [Level: 3] GetFastLbs() send request OK, send bytes = 24.lbsip[52.59.26.183]port[8811]
1970-01-01 00:00:32 [Level: 3] GetFastLbs() send request OK, send bytes = 24.lbsip[52.8.79.200]port[8811]
1970-01-01 00:00:32 [Level: 3] get dev region:1
normal msg_type[136]len[4] peer[(null)]
1970-01-01 00:00:32 [Level: 3] get fast lbs info, ip[52.59.26.183]name[]
1970-01-01 00:00:32 [Level: 3] set dev fast lbs[52.59.26.183]
++++++++++now, get register server++++++++++++++
get register server ,local license's obj_org_id[0]
1970-01-01 00:00:32 [Level: 2] lbs info is same[2].
1970-01-01 00:00:32 [Level: 3] process_get_register_server_add_resp() get ap server addr OK, ip = 52.59.26.183, port = 8831
1970-01-01 00:00:32 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:1, ret:0
1970-01-01 00:00:32 [Level: 3] get register server ok
1970-01-01 00:00:32 [Level: 3] serial:A024119
1970-01-01 00:00:32 [Level: 3] login() send login request OK.
1970-01-01 00:00:32 [Level: 3] process_login_resp() register OK, hdt days:0, active time:0
1970-01-01 00:00:32 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:2, ret:0
1970-01-01 00:00:32 [Level: 3] QueryIpsAddr() send request OK.
1970-01-01 00:00:32 [Level: 3] process_get_ips_addr_resp() get ips server addr OK, ip = 34.246.136.117, port = 8851
1970-01-01 00:00:33 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:13, ret:0
1970-01-01 00:00:33 [Level: 3] QueryIpsAddr OK.
[OSThread::Start] OrgPrio:0, NewPrio:0
1970-01-01 00:00:33 [Level: 3] process_proto_timer() OK.
1970-01-01 00:00:33 [Level: 3] register and login success^^^^^^^^^^
1970-01-01 00:00:33 [Level: 3] process_proto_timer() thread starts running.
sd_card::try_init() partition size = 3957456896
sd_card::try_init() init storage device OK.
sd_card::init() init storage device OK.
1970-01-01 00:00:33 [Level: 3] sd_card init OK!
create_scan_thread() OK.
1970-01-01 00:00:33 [Level: 3] create scan thread OK!
zmd_init_storage_device() init store dev OK.
1970-01-01 00:00:33 [Level: 3] storage device init OK!
1970-01-01 00:00:33 [Level: 2] ../record/src/zmd_record_index.cpp(482)-sql_get_unfinish_file:index file[/tmp/mmc/index/filelist] is not exist!
[DEBUG]Init get record config:type[3]offFlag[1]alarmRecordTime[3]stime[00:00]etime[00:00]resolution[0]
1970-01-01 00:00:33 [Level: 3] local record init OK!
[DEBUG][../record/src/zmd_record_file_imp.cpp:117]record imp thread start.
1970-01-01 00:00:33 [Level: 3] ../clips/src/clips_index.cpp(363)-index_get_unfinish_file:index file /tmp/mmc/clips/filelist is not exist!
1970-01-01 00:00:33 [Level: 3] clips record init OK!
[DEBUG]init_hcws_record() init OK.
[DEBUG]record_lib_init() init record OK.
1970-01-01 00:00:33 [Level: 3] record lib init OK!
hcws_local_record_init() init local record lib success.
g_main_stream_frame_rate = 20
g_sub_stream_frame_rate = 15
1970-01-01 00:00:33 [Level: 3] init local record lib OK.
get default common setting:sync-mode:2, time_zone[120]:GMT, curr_time:0, date-type:0, langluge:0, xialingshi:0
1970-01-01 00:00:33 [Level: 3] start upload, bInit:1 bRun:0!
1970-01-01 00:00:33 [Level: 3] start upload, timeZone:2 region:1 masterAccount:!
1970-01-01 00:00:33 [Level: 3] start upload OK!
init_cloud_storage_conf() OK.
1970-01-01 00:00:33 [Level: 3] cloud storage init OK!
1970-01-01 00:00:33 [Level: 3] Enter doUploadTask !!!
1970-01-01 00:00:33 [Level: 3] msgbus init OK!
start check_timing_alarm_thread ...
1970-01-01 00:00:33 [Level: 3] timing alarm init OK!
CreateDetachedThread
1970-01-01 00:00:33 [Level: 3] ~~~~~~~~~~~~~~~~~~~~wait for exit signal~~~~~~~~~~~~~~~~~
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
g_mediapro now:0x14e7808, mode:1
++++++++media turn to night mode++++++
in check_timing_alarm_thread !!!
in check_stream_thread !!!
primary_loop select time:0 out
Sending ...
######restart ntp...
ntp server:time.nist.gov
setup_receive setup_receive
setup_transmit setup_transmit
Listening...
primary_loop select time:0 in
primary_loop select time:0 out
Sending ...
primary_loop select time:2 in
rtsp_server_listen
primary_loop select time:0 out
Sending ...
primary_loop select time:4 in
primary_loop select time:0 out
Sending ...
######restart ntp...
ntp server:pool.ntp.org
setup_receive setup_receive
setup_transmit setup_transmit
Listening...
primary_loop select time:0 in
primary_loop select time:0 out
Sending ...
primary_loop select time:2 in
primary_loop select time:1 out
packet of length 48 received
Source: INET Port 123 host 178.63.9.110
LI=0 VN=3 Mode=4 Stratum=2 Poll=4 Precision=-29
Delay=8606.0 Dispersion=0.0 Refid=131.188.3.221
Reference 3738484851.685960
(sent) 2208988839.751140
Originate 2208988839.751140
Receive 3738490065.601641
Transmit 3738490065.601644
Our recv 2208988839.954316
Total elapsed: 203173.00
Server stall: 2.86
Slop: 203170.14
Skew: 1529501225748602.70
Frequency: 0
day second elapsed stall skew dispersion freq
begin getTimeZoneInfo
IP: 45.32.138.210
getTimeZoneInfo,recv:: Success
get default common setting:sync-mode:2, time_zone[120]:GMT, curr_time:0, date-type:0, langluge:0, xialingshi:0
scan command return:OK
xontemplate 2208988839 1529501225748602.7 203173.0 0
25567 00039.954 203173.0 2.9 1529501225748602.7 0.0 0
rfc1305print return ok,count is :2
primary_loop select time:300 in
2018-06-20 15:27:46 [Level: 3] platform_main.c(2034)-platform_timer_wifi_thread:[wifi check]ssid:<WLAN_NAME> wifi level:57
2018-06-20 15:27:47 [Level: 3] register overtime, now to register again!
2018-06-20 15:27:47 [Level: 3] p2p client object receive heartbeat timeout exception callback!!!
2018-06-20 15:27:47 [Level: 3] query ips overtime, now to query again!
2018-06-20 15:27:47 [Level: 3] PPCS_NetworkDetect() ret = 0
2018-06-20 15:27:47 [Level: 3] -------------- NetInfo: -------------------
2018-06-20 15:27:47 [Level: 3] Internet Reachable : YES
2018-06-20 15:27:47 [Level: 3] P2P Server IP resolved : YES
2018-06-20 15:27:47 [Level: 3] P2P Server Hello Ack : YES
2018-06-20 15:27:47 [Level: 3] Local NAT Type :
2018-06-20 15:27:47 [Level: 3] Port-Restricted Cone
2018-06-20 15:27:47 [Level: 3] My Wan IP : 46.5.201.81
2018-06-20 15:27:47 [Level: 3] My Lan IP : 192.168.0.178
2018-06-20 15:27:47 [Level: 3] GetFastLbs() send request OK, send bytes = 24.lbsip[52.59.26.183]port[8811]
2018-06-20 15:27:47 [Level: 3] GetFastLbs() send request OK, send bytes = 24.lbsip[52.8.79.200]port[8811]
2018-06-20 15:27:47 [Level: 3] get dev region:1
normal msg_type[136]len[4] peer[(null)]
2018-06-20 15:27:47 [Level: 3] get fast lbs info, ip[52.59.26.183]name[]
2018-06-20 15:27:47 [Level: 3] set dev fast lbs[52.59.26.183]
++++++++++now, get register server++++++++++++++
get register server ,local license's obj_org_id[0]
2018-06-20 15:27:47 [Level: 2] lbs info is same[2].
2018-06-20 15:27:47 [Level: 3] process_get_register_server_add_resp() get ap server addr OK, ip = 52.59.26.183, port = 8831
2018-06-20 15:27:47 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:1, ret:0
2018-06-20 15:27:47 [Level: 3] get register server ok
2018-06-20 15:27:47 [Level: 3] serial:A024119
2018-06-20 15:27:47 [Level: 3] login() send login request OK.
2018-06-20 15:27:47 [Level: 3] process_login_resp() register OK, hdt days:0, active time:0
2018-06-20 15:27:47 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:2, ret:0
2018-06-20 15:27:47 [Level: 3] QueryIpsAddr() send request OK.
2018-06-20 15:27:47 [Level: 3] process_get_ips_addr_resp() get ips server addr OK, ip = 34.246.136.117, port = 8851
2018-06-20 15:27:47 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:13, ret:0
2018-06-20 15:27:47 [Level: 3] QueryIpsAddr OK.
2018-06-20 15:27:47 [Level: 2] process_proto_timer() create thread already create!!
2018-06-20 15:27:47 [Level: 3] register and login success^^^^^^^^^^
@angrybobcat
Copy link

I am currently trying to revive the bricked successor of the S6 - and so far I think that I wont avoid doing so using the UART-Interface...
Did you need any pin-soldering or how did you establish the connection?

I diassembled the whole camera down to its mainboard (also Hi8318E-Base) and I'm not sure about what is the interface (I think its the Rx/Tx-Labeled ones, right?)
My next step would be to connect a USB-to-Serial-Adapter but for this I think I will need some soldering (which is why i want to make sure I use the right pins before ;))

@JanLoebel
Copy link
Author

@angrybobcat yeah :) RX/TX is right! Let us know how it went!

@madmac4u
Copy link

https://drive.google.com/file/d/1I79YdF69BLVwvlMkDGr9mI_JjmZeQXVk/view?usp=sharing
https://drive.google.com/file/d/1I7iImjjHUfT3W_v6B1aFAB1rmheEvIRS/view?usp=sharing

I have this camera module based on hi3518 chip.
will this method work on this too ?

@EpicLPer
Copy link

I know this is somewhat old (and apparently I already commented on it a few ago lol) but has anyone tried OpenIPC on the S6 yet? Curious, cause would really want to flash a new firmware on it since the hardware is still nice, but the firmware is apparently riddled with security flaws...

@JanLoebel
Copy link
Author

I know this is somewhat old (and apparently I already commented on it a few ago lol) but has anyone tried OpenIPC on the S6 yet? Curious, cause would really want to flash a new firmware on it since the hardware is still nice, but the firmware is apparently riddled with security flaws...

Sorry I've tried it yet, but would be interested as well :)

@EpicLPer
Copy link

EpicLPer commented Jan 21, 2023 •
edited
Loading

I know this is somewhat old (and apparently I already commented on it a few ago lol) but has anyone tried OpenIPC on the S6 yet? Curious, cause would really want to flash a new firmware on it since the hardware is still nice, but the firmware is apparently riddled with security flaws...

Sorry I've tried it yet, but would be interested as well :)

The cam is based on a HI3518CV200, tho OpenIPC is supporting only the CV100 and another HI3516CV200 so far. Not sure how much different or how hard it'd be to port it to this one. Their community is sadly not toooo active, at least Telegram. Need to see if they have more active channels or forums somewhere.

Nevermind, I read the chip wrong, it is supported! Currently working on getting OpenIPC working :)

@EpicLPer
Copy link

EpicLPer commented Feb 6, 2023

Just to update on this, I've destroyed the camera accidentally and not sure why... think a cap is shorted or I somehow cracked another component due to heat. It's entirely dead now.

@Solarbotics
Copy link

Aw, that's unfortunate. I'm in a similar place with a Lorex cam with the same chipset. Somehow I've lost root / login access, so I'm trying to figure out how to add credentials into the squashfs. Your thread was very parallel to what I'm doing. Maybe I'll jump onto the OpenIPC strategy too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment