Problem with Gadinan camera

[witchlond]

Hi,

I've bought a Chinese Gadinan camera: Gadinan Onvif HD 3MP 2MP 1080P IP Camera Support Audio With Built in Microphone Pickup Day Night Metal Dome Camera 2.8mm lens
I had a problem with rstp connection so I asked for help my friend. He changed the standard tcp port 34567 to 554. After that we cannot connect to the camera. It reacts for pings but I cannot login via http. I've installed nmap and got that:

Starting Nmap 7.80 ( Nmap: the Network Mapper - Free Security Scanner ) at 2019-09-19 11:05 ?rodkowoeuropejski czas letni
NSE: Loaded 151 scripts for scanning.
Initiating ARP Ping Scan at 11:05
Scanning 192.168.2.15 [1 port]
Completed ARP Ping Scan at 11:05, 0.22s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 11:05
Completed Parallel DNS resolution of 1 host. at 11:06, 5.53s elapsed
Initiating SYN Stealth Scan at 11:06
Scanning 192.168.2.15 [65535 ports]
Discovered open port 80/tcp on 192.168.2.15
Discovered open port 554/tcp on 192.168.2.15
Discovered open port 9530/tcp on 192.168.2.15
Completed SYN Stealth Scan at 11:06, 17.53s elapsed (65535 total ports)
Initiating Service scan at 11:06
Scanning 3 services on 192.168.2.15
Completed Service scan at 11:06, 22.13s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 192.168.2.15
Retrying OS detection (try #2) against 192.168.2.15
Retrying OS detection (try #3) against 192.168.2.15
Retrying OS detection (try #4) against 192.168.2.15
Retrying OS detection (try #5) against 192.168.2.15
NSE: Script scanning 192.168.2.15.
Initiating NSE at 11:06
Completed NSE at 11:08, 86.15s elapsed
Initiating NSE at 11:08
Completed NSE at 11:08, 2.04s elapsed
Initiating NSE at 11:08
Completed NSE at 11:08, 0.00s elapsed
Nmap scan report for 192.168.2.15
Host is up (0.020s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE VERSION
80/tcp open http?
554/tcp open rtsp?
|_rtsp-methods: ERROR: Script execution failed (use -d to debug)
9530/tcp open unknown
MAC Address: 00:12:31:3F

D:94 (Motion Control Systems)

No exact OS matches for host (If you know what OS is running on it, see Nmap OS/Service Fingerprint and Correction Submission Page ).
TCP/IP fingerprint:
OS:SCAN(V=7.80%E=4%D=9/19%OT=80%CT=1%CU=30930%PV=Y%DS=1%DC=D%G=Y%M=001231%T
OS:M=5D834589%P=i686-pc-windows-windows)SEQ(SP=FD%GCD=1%ISR=101%TI=I%CI=I%I
OS:I=I%TS=U)SEQ(CI=I%II=RI)SEQ(SP=FE%GCD=1%ISR=101%TI=RD%TS=U)OPS(O1=M5A8SN
OS:N%O2=M5A8SNN%O3=M5A8%O4=M5A8SNN%O5=M5A8SNN%O6=M5A8SNN)WIN(W1=FFFF%W2=FFF
OS:F%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)ECN(R=Y%DF=N%T=FF%W=FFFF%O=M5A8SNN%CC=
OS:N%Q=)ECN(R=N)T1(R=Y%DF=N%T=FF%S=O%A=S+%F=AS%RD=0%Q=)T1(R=N)T2(R=N)T3(R=Y
OS:%DF=N%T=FF%W=FFFF%S=O%A=S+%F=AS%O=M5A8SNN%RD=0%Q=)T3(R=N)T4(R=Y%DF=N%T=F
OS:F%W=FFFF%S=A%A=S%F=AR%O=%RD=0%Q=)T4(R=N)T5(R=Y%DF=N%T=FF%W=FFFF%S=A%A=S+
OS:%F=AR%O=%RD=0%Q=)T5(R=N)T6(R=Y%DF=N%T=FF%W=FFFF%S=A%A=S%F=AR%O=%RD=0%Q=)
OS:T6(R=N)T7(R=Y%DF=N%T=FF%W=FFFF%S=A%A=S+%F=AR%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF
S:=N%T=FF%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)U1(R=N)IE(R=Y%DFI=
OS:S%T=FF%CD=S)IE(R=N)
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 19.80 ms 192.168.2.15
Nmap done: 1 IP address (1 host up) scanned in 149.73 seconds
Raw packets sent: 66795 (2.947MB) | Rcvd: 66119 (2.646MB)

Any help - how to reset to factory settings? There's no pin onboard - I've checked it.

 

[alastairstevenson]

Port 34567 is the usual XM management port.
Port 554 is the RTSP port.
Both ports are now compromised, so a reset to defaults is needed.

 

[witchlond]

Yes, yes - I know, but I don't know how to do it. I cannot find any jumper or button onboard...
It's hi3516 chipset.

 

[witchlond]

I've found on HI3516 manual about reset circuit but I don't understand it.

http://dl.openipc.org:84/SDK/HiSilicon/Hi3516Cv500_Dv300/HI3516C V500R001C02SPC001/ReleaseDoc/en/00.hardware/board/Hi3516DV300/Hi3516D V300 Hardware Design User Guide.pdf

 

[alastairstevenson]

I cannot find any jumper or button onboard...

Maybe try the DeviceManager utility - though I don't know for sure if it will work, or how safe it is.
Hangzhou Xiongmai Technology Co.,LTD.-DeviceManager

**edit** VirusTotal had just one detection. So not too bad.

Or the reset config tool.
Forgotten Password Hikvision/Dahua/XM/Hisilicon IP Cameras, How to Reset?

 

[witchlond]

I've tried these programs. There's a "device is not connected" message... I suppose that everything is using 34567 port. I suppose that only reset circuit will solve the problem but I cannot understand that hi3516 manual... The camera looks like that.

 

[alastairstevenson]

There's a "device is not connected" message... I suppose that everything is using 34567 port.

That does sound likely.

There is no obvious reset button on the image you attached, unless J3 is involved. There is no guarantee that one is included in the design.

I'd guess that the 4 pads at the bottom right are the serial console connections.

**edit** It might be a long shot to try the Gadinan 'contact us' email address. But you never know.

 

[witchlond]

I've wrote do Gadinan.
But I just wonder if someone understand what does it mean, what is written in manual I've attached above:
1.1.2. Reset Circuit.
Hi3516D V300 supports power-on reser (POR) and does not support external reset.
After the master chip is powered on, the internat POR circuit is userd to reset the entire chip (the pulse width of the reset signal is about 32 ms).
You are advided do use the reset signal output by the T3 pin (SYS_RSTN_OUT) of Hi3516D V300 to reset the peripherals related to the small system (such as the boot flash memory), SYS_RSTN_OUT connects to a 1 kilohm pull-down resistor.
The level of the SYS_RSNT_OUT signal is consistent with that of DVDD3318_FLASH (R5 pin of Hi3516D V300).
Caution! Peripherals related to the small system (such as the boot flash memory) must release the reset signal before Hi3516D V300 or they release the reset signals simultaneously to ensure that the system boots properly. Otherwise, exceptions such as system boot failure may occur.

 

[alastairstevenson]

A 'power on reset' (POR) is just a part of the normal startup process and nothing to do with resetting a configuration to defaults.

If you think it's worth the effort, hooking up to the serial console will allow full access to the operation of the camera including resetting the configuration.

 

[witchlond]

Ok. I will try
Thank you very much for help