UART/RS232 on NBD8008R - 3536DV100 V1.01

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
Hi, first post here.

I was looking for the rs232 connection on my newly bought NBD8008R - 3536DV100 V1.01 Hangzhou Xiongmai First I was looking at the 4 pin connector CN4, but that seems to be a USB host. I finally found some chinese description online It wasn't quite the same board, but atleast I knew now I had to look close to the CN3 connector. There were 4 solder islands close together CN8, so soldered some pins on there and tried.... Success.








I also needed to set the RS232 in the interface to InteractCmd. I used minicom on my linux machine to output the boot.

Code:
System startup..........

System startup



U-Boot 2010.06-svn1060 (May 14 2018 - 15:54:41)



Check Flash Memory Controller v100 ... Found

SPI Nor(cs 0) ID: 0xc2 0x20 0x18

Block:64KB Chip:16MB Name:"MX25L128XX"

CONFIG_CLOSE_SPI_8PIN_4IO = y.

at hifmc100_setTB() mid:0xc2,chipsize:0x1000000 <no>.

lk[8 => 0x800000]

SPI Nor total size: 16MB

In:    serial

Out:   serial

Err:   serial

USB:   scanning bus for devices... 2 USB Device(s) found

0 Storage Device(s) found

i:0, No usb storage device found!

Press CTRL-C to abort autoboot in 2 seconds16384 KiB hi_fmc at 0:0 is now current device

CFG_BOOT_ADDR:0x0 argc 2 argv[0] logoload

### h264dvr.jpg UbootLogoload complete:bytes  oadaddr0x84000000 loaded to 0x87000000

### h264dvr.jpg UbootLogoload complete: 59577 bytes loaded to 0x87000000

jpeg decoding ...

<<addr=0x87000000, size=0xb85f9, vobuf=0x8711fc00>>

<<imgwidth=800, imgheight=600, linebytes=1600>>

decode success!!!!

decode jpeg success.

decode jpeg!

stMaxRect.u32Width:800, stMaxRect.u32Height:600.

HDMI_INFO:DispFmt2HdmiTiming[383] ,Non CEA video timing:16

HDMI_INFO:Hdmi_PixelFreqSearch[127] ,u32Fmt16.

srcAddr 0x82000000, dstAddr 0x81000000

find_squashfs_file: name bin, start_block 0, offset 2608, type 1

find_squashfs_file: name boot, start_block 0, offset 2716, type 1

read inode: name boot, sb 0, of 2716, type 1

find_squashfs_file: name zImage.img, start_block 0, offset 2640, type 2

read inode: name zImage.img, sb 0, of 2640, type 2

### FS load complete: 2824707 bytes loaded to 0x81000000

## Booting kernel from Legacy Image at 81000000 ...

   Image Name:   Linux-4.9.37

   Image Type:   ARM Linux Kernel Image (uncompressed)

   Data Size:    2824643 Bytes = 2.7 MiB

   Load Address: 80008000

   Entry Point:  80008000

   Loading Kernel Image ... OK

OK



Starting kernel ...
My final goal is to add some ftp server or smb server, so I can access my recordings easily. Since I am not a windows user and almost all available tools like activeX, CMS are only on windows available.
 
Last edited:

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
A little follow up. I have currently the following firmware installed. General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180719.bin
The .bin seems to be just a compressed zip with below files.

Code:
7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
p7zip Version 9.20 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,8 CPUs)

Processing archive: /home/maurice/Downloads/00000203(NBD8008R-PL)/General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180719.bin

Testing     web-x.cramfs.img
Testing     custom-x.cramfs.img
Testing     user-x.cramfs.img
Testing     romfs-x.cramfs.img
Testing     logo-x.cramfs.img
Testing     u-boot.bin.img
Testing     InstallDesc

Everything is Ok

Files: 7
Size:       13089492
Compressed: 13070348
Just need to figure out how to mount them, so I can see what is inside to start poking around. Just a regular cramfs mount failed. Probably an offset needed or they are somehow encrypted. See if a hexeditor can shed some light on that.
If anyone has some more info I would be happy to hear.
 

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
Ahh that was pretty easy
Code:
binwalk user-x.cramfs.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x6EF60315, created: 2018-07-19 13:47:28, image size: 4718592 bytes, Data Address: 0x430000, Entry Point: 0xB10000, data CRC: 0x2A278CF8, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: gzip, image name: "linux"
64            0x40            Squashfs filesystem, little endian, version 4.0, compression:xz, size: 4717676 bytes, 153 inodes, blocksize: 65536 bytes, created: 2018-07-19 13:47:28
Then:
NOTE: skip is the decimal value of the binwalk output of Squashfs filesystem and count are the size in bytes of the squashfs filesystem.

Code:
dd if=user-x.cramfs.img bs=1 skip=64 count=4717676 of=user-x.cramfs.img.conv
4717676+0 records in
4717676+0 records out
4717676 bytes (4,7 MB, 4,5 MiB) copied, 10,593 s, 445 kB/s
Now you unpack the squashfs:

Code:
unsquashfs user-x.cramfs.img.conv
Parallel unsquashfs: Using 8 processors
136 inodes (297 blocks) to write

[==============================================================================================================================================================================================================================================================|] 297/297 100%

created 136 files
created 17 directories
created 0 symlinks
created 0 devices
created 0 fifos
Then a directory is created named squashfs-root with the content for example below the content of squashfs-root.

Code:
squashfs-root$ ls -al
total 28
drwxrwxrwx 7 maurice maurice 4096 jul 19 15:47 .
drwxrwxr-x 4 maurice maurice 4096 aug 19 14:58 ..
drwxrwxrwx 3 maurice maurice 4096 jul 19 15:47 bin
drwxrwxrwx 4 maurice maurice 4096 jul 19 15:47 etc
drwxrwxrwx 2 maurice maurice 4096 jul 19 15:47 lib
drwxrwxrwx 2 maurice maurice 4096 jul 19 15:47 sbin
drwxrwxrwx 3 maurice maurice 4096 jul 19 15:47 share
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
It might be interesting to check the u-boot environment variables (printenv) to see if there is one that determines the mode of the UART you are connected to.
It may have something like ptzsupport = 1 in which case you could set it to 0 and see the full serial console detail.
 

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
@alastairstevenson Thanks for the info, however that would mean rebuilding the firmware and flashing it? I still need to investigate more to see what is in the headers I ignore when unpacking, else I could be left with a bricked device. I noticed that there is telnetd available in the firmware (just commented out in the init script), so looking at some security hole to run that. I saw some shell scripts they run and didn't quote the strings they are using. Just need to find one where I can adjust the string in the user interface so I can start the telnetd.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Thanks for the info, however that would mean rebuilding the firmware and flashing it?
No, not at all, it would be a simple low-risk procedure.

Sometimes the UART has a dual purpose - the default output from the bootloader and the early startup, and a controller for an external device.
The latter can be the default, in which case all the useful and interesting kernel and app messages and shell access is not available after u-boot starts up the kernel.

To check this out:
Interrupt the bootloader at startup. Normally it will show how to do this, for example 'hit any key to interrupt' 'hit Control-U to interrupt' ' etc
**edit If I'd read your post properly, I would have seen :
Press CTRL-C to abort autoboot in 2 seconds **

At the bootloader command prompt, list the existing environment variables with the command
printenv

Inspect for any that may be linked to the serial console / UART mode, such as 'ptzsupport = 1'
To change that specific example, use
setenv ptzsupport 0
saveenv

The reboot and see if the normal full kernel and apps messages now show.
 
Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I still need to investigate more to see what is in the headers I ignore when unpacking,
These are just standard uImage headers, look for the u-boot documentation that describes them UBootInstallTools < DULG < DENX
You can simply strip off the 64-byte header, as you have done, or you could get info and extract the one or more images like so (from u-boot-tools) :
Code:
alastair@PC-I5 ~/cctv/other/NBD8008/contents $ file romfs*
romfs-x.cramfs.img: u-boot legacy uImage, linux, Linux/ARM, OS Kernel Image (gzip), 3878912 bytes, Thu Jul 19 13:47:29 2018, Load Address: 0x00050000, Entry Point: 0x00430000, Header CRC: 0x451FEA7B, Data CRC: 0x0DC50892
alastair@PC-I5 ~/cctv/other/NBD8008/contents $
alastair@PC-I5 ~/cctv/other/NBD8008/contents $ dumpimage -l romfs*
Image Name:   linux
Created:      Thu Jul 19 14:47:29 2018
Image Type:   ARM Linux Kernel Image (gzip compressed)
Data Size:    3878912 Bytes = 3788.00 kB = 3.70 MB
Load Address: 00050000
Entry Point:  00430000
alastair@PC-I5 ~/cctv/other/NBD8008/contents $ dumpimage -i romfs* romfs-x.squashfs
alastair@PC-I5 ~/cctv/other/NBD8008/contents $ file *.squashfs
romfs-x.squashfs: Squashfs filesystem, little endian, version 4.0, 3876178 bytes, 208 inodes, blocksize: 262144 bytes, created: Thu Jul 19 13:47:29 2018
alastair@PC-I5 ~/cctv/other/NBD8008/contents $ unsquashfs -d temp romfs-x.squashfs
Parallel unsquashfs: Using 4 processors
175 inodes (190 blocks) to write

[===================================================================================================================|] 190/190 100%

created 47 files
created 33 directories
created 128 symlinks
created 0 devices
created 0 fifos
alastair@PC-I5 ~/cctv/other/NBD8008/contents $
*edit* Oh, and by the way, the root passwords as used by telnetd are
Code:
alastair@PC-I5 ~/cctv/other/NBD8008 $ john --show passwd_file_1.txt
root:xc3511:0:0:root:/:/bin/sh
root:helpme:0:0::/root:/bin/sh

2 password hashes cracked, 0 left
 

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
@alastairstevenson Thanks for the link and also for the root password. It was on my todo list to bruteforce the hash.

Oops, had the tx wire wrong. that is why I couldn't interrupt the boot. I tried setting ptzsupport, it wasn't set and it also didn't have any effect after setting it. I will look into it. BTW updated the first post with a new image and the correct connections of the UART.

Code:
hisilicon # printenv

bootcmd=sf probe 0;sf read 0x84000000 0xf60000 0x20000;logoload 0x84000000;decjpg;sf read 0x82000000 0x50000 0x500000;squashfsload 82000000;bootm 0x81000000

bootdelay=1

baudrate=115200

ethaddr=00:0b:3f:00:00:01

ipaddr=192.168.1.10

serverip=192.168.1.1

netmask=255.255.255.0

gatewayip=192.168.0.1

bootfile="uImage"

da=mw.b 0x82000000 ff 1000000;tftp 0x82000000 u-boot.bin.img;sf probe 0;flwrite

du=mw.b 0x82000000 ff 1000000;tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwrite

dr=mw.b 0x82000000 ff 1000000;tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwrite

dw=mw.b 0x82000000 ff 1000000;tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwrite

dl=mw.b 0x82000000 ff 1000000;tftp 0x82000000 logo-x.cramfs.img;sf probe 0;flwrite

dc=mw.b 0x82000000 ff 1000000;tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwrite

up=mw.b 0x82000000 ff 1000000;tftp 0x82000000 update.img;sf probe 0;flwrite

tk=mw.b 0x82000000 ff 1000000;tftp 0x82000000 zImage.img; bootm 0x82000000

dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwrite

bootargs=mem=83M console=ttyAMA0,115200 root=/dev/mtdblock1 rootfstype=squashfs mtdparts=hi_sfc:320K(boot),3968K(romfs),7040K(usr),1600K(web),2816K(custom),128K(logo),512K(mtd) coherent_pool=2M

appVideoStandard=PAL

appSystemLanguage=English

ptzsupport=0

stdin=serial

stdout=serial

stderr=serial

verify=n

ver=U-Boot 2010.06-svn1060 (May 14 2018 - 15:54:41)



Environment size: 1399/65532 bytes
*edit* maybe the console is not the right device in the bootargs. already tried some other standard device nodes like ttyS0 - ttyS3 but still no luck. Well I will look at it at a later time.
 
Last edited:

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
Time to write some progress down on how to flash a modified rootfs to the device.

Extract the firmware, I used sudo, because I am afraid of loosing file permissions ownership of files. Didn't check yet if it is true, but for now just in case. I used dumpimage like always on linux there are a 1000 ways to do things.
Code:
sudo dumpimage -i romfs-x.cramfs.img romfs-x.squashfs
Extract the squashfs
Code:
sudo unsquashfs -d temp romfs-x.squashfs
Edit for example temp/etc/init.d/rcS I coudn't get the telnetd started, still looking at that, but added "&" to "dvrHelper /lib/modules /usr/bin/Sofia 127.0.0.1 9578 1 &" This will drop you into a shell on the UART.
Now make the squashfs
Code:
maurice@maurice-N73SM:~/Downloads/extract$ sudo mksquashfs temp rootfs.img -b 64K -comp xz
Parallel mksquashfs: Using 8 processors
Creating 4.0 filesystem on rootfs.img, block size 65536.
[==============================================================================================================================================================================================================================================================/] 132/132 100%

Exportable Squashfs 4.0 filesystem, xz compressed, data block size 65536
    compressed data, compressed metadata, compressed fragments, compressed xattrs
    duplicates are removed
Filesystem size 3832.00 Kbytes (3.74 Mbytes)
    63.66% of uncompressed filesystem size (6019.72 Kbytes)
Inode table size 1462 bytes (1.43 Kbytes)
    19.80% of uncompressed inode table size (7384 bytes)
Directory table size 1946 bytes (1.90 Kbytes)
    56.72% of uncompressed directory table size (3431 bytes)
Number of duplicate files found 3
Number of inodes 208
Number of files 47
Number of fragments 3
Number of symbolic links  128
Number of device nodes 0
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 33
Number of ids (unique uids + gids) 3
Number of uids 3
    unknown (1001)
    unknown (563)
    unknown (521)
Number of gids 3
    unknown (1001)
    unknown (563)
    unknown (521)
Now make the uboot image
Code:
maurice@maurice-N73SM:~/Downloads/extract$ sudo mkimage -A ARM -O linux -T kernel -a 00050000 -e 00430000 -C gzip -d "/home/maurice/Downloads/extract/rootfs.img" -n romfs-x.cramfs.img romfs-x.cramfs.img.new
Image Name:   romfs-x.cramfs.img
Created:      Fri Aug 24 19:08:25 2018
Image Type:   ARM Linux Kernel Image (gzip compressed)
Data Size:    3928064 Bytes = 3836.00 kB = 3.75 MB
Load Address: 00050000
Entry Point:  00430000
I setup a tftp server on ubuntu
Code:
sudo apt-get install tftpd-hpa
Edited /etc/default/tftpd-hpa Commented out the --secure option.
Code:
maurice@maurice-N73SM:~/Downloads/extract$ cat /etc/default/tftpd-hpa
# /etc/default/tftpd-hpa

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/tftpboot"
TFTP_ADDRESS=":69"
#TFTP_OPTIONS="--secure"
Then copied my newly made uboot image to /tftpboot.
Now in the uboot shell
Code:
mw.b 0x82000000 ff 1000000;tftp 0x82000000 /tftpboot/romfs-x.cramfs.img;sf probe 0;flwrite
You could also do this step by step. It should start downloading the image and then writing it to flash.
After the flash just "reset" to restart.

Some info about the device
Code:
~ # cat /proc/cpuinfo

processor       : 0

model name      : ARMv7 Processor rev 5 (v7l)

BogoMIPS        : 1699.02

Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae 

CPU implementer : 0x41

CPU architecture: 7

CPU variant     : 0x0

CPU part        : 0xc07

CPU revision    : 5



Hardware        : Hisilicon Hi3536DV100 (Flattened Device Tree)

Revision        : 0000

Serial          : 0000000000000000

~ # cat /proc/version

Linux version 4.9.37 (chenwenrong@xm-5) (gcc version 6.2.1 20161016 (Hisilicon_v510_20171111) ) #13 Thu Mar 8 15:40:12 CST 2018
 
Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Hey, you're really getting into this stuff, that's a quick learning curve!
maybe the console is not the right device in the bootargs. already tried some other standard device nodes like ttyS0 - ttyS3 but still no luck.
Good try on that.
 

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
Hey, you're really getting into this stuff, that's a quick learning curve
@alastairstevenson Well all ready had some experience with embedded arm devices, although it was quite some years ago.
The serial port ttyAMA0 is correct, why it doesn't output the kernel messages there, I am not entirely sure. Maybe in the kernel it is somehow disabled. Telnetd crashes when I try to connect. Not going to invest more time in that, probably some config. I prefer ssh. See if I setup a crosscompiler and build openssh for it. For now the UART shell will do. Only thing is that busybox is very stripped down. No grep or find is a bit irritating. Think I am going to fix that first.
 

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
Hmm a little set back, I was afraid of this, the recording hdd is written to directly. It doesn't use a filesystem. Although it should be possible to retrieve data from the drive it won't be of use for me. I just wanted to share it across the network, which is easy todo when it was using some sort of linux filesystem. Need to think about what my other options are.

Sofia startup output
 
Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Only thing is that busybox is very stripped down. No grep or find is a bit irritating. Think I am going to fix that first.
If you don't have it already, attached is a Busybox that should work OK.
This is how I added it in a Hikvision NVR :
Code:
# Add in the fuller busybox, which has telnetd in it and more.
echo "<<1a> install full busybox and start telnetd >>"
mv /home/app/busybox-armv7l /bin
chmod +x /bin/busybox-armv7l
/bin/busybox-armv7l --install -s /bin
/bin/busybox-armv7l telnetd
It looks like you figured out how to get the console logging active.
The u-boot environment variables, and the name 'sofia' for the main app have the flavour of Dahua firmware.
They have an environment variable dh_keyboard that determines the mode of the serial interface, normally it's already defined, =0 enables the console.
 

Attachments

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
@alastairstevenson Yeah, already got the busybox version busybox-1.29.2 To install it I had to do it a bit different, because of the squashfs filesystem which is readonly and there is no overlayfs present. Also there is not a lot of room on the device, this can however later be easily solved with an ext4 usb stick that I can mount on startup.
For experimenting now I did it as described below:
Created an nfs mount from my network on /home on the device with a folder busybox. Installed busybox in /home/busybox
Then added that folder in front of $PATH "PATH=/home/busybox:$PATH".
Thanks for your continuous support. It is nice to have some feedback and pointers, it brings up new ideas :)

* edit * BTW the telnetd from this new busybox works fine. Login: root and password: xc3511
 
Last edited:

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
Another little update: Installed Entware/Entware on the device, just for trying out some things. Programs I installed through entware like ffmpeg, nano work fine. This saves me some time to go through the trouble of building my own with a crosscompiler ( I can still do that if it is needed). Looking at some options now to stream the GUI over ethernet or make a backup from the hdd to my NAS on a regular base. Both options will be a though one, but still fun to see if we can get it done.
 

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
Just collecting the information here, found a nice python based device manager tool NeiroNx/python-dvr from NeiroNx on github. When I am making some serious progress I can add it all to the wiki
in some nice logical order. BTW the tool can also be used on the command line and what is most imported for me it runs on linux. MIT licensed.



Screenshot_2018-09-02_09-31-18.png
 

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
I got an over the air update today on the device, so I will do a little write up on how to extract the new firmware from u-boot and upload it to the tftp-server.
Make sure you create a filename in the tftp folder from the server that is named the same way you want to use in u-boot to save your flash memory, also make it writable for anybody.
Im my case /tftpboot is my tftp server folder.
On my PC:
Code:
touch /tftpboot/romfs.img
touch /tftpboot/user.img
touch /tftpboot/web.img
touch /tftpboot/custom.img
sudo chmod 0666 /tftpboot/*.img
Note that the flash offsets and length I got from the old firmware with dumpimage -l. When saving to the tftp server you need to subtract the two to get the length. 0x430000-0x50000=0x3e0000
In u-boot:
Code:
mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0x50000 0x430000;tftp 0x82000000 /tftpboot/romfs.img 0x3e0000
mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0x430000 0xb10000;tftp 0x82000000 /tftpboot/user.img 0x6e0000
mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0xb10000 0xca0000;tftp 0x82000000 /tftpboot/web.img 0x190000
mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0xca0000 0xf60000;tftp 0x82000000 /tftpboot/custom.img 0x2c0000
* edit * web and custom image seems to have a different memory entrypoint, looking at that. For the rest, I edited the romfs image to get telnetd running and my nfs mount for entware and busybox. Repacked and flashed so I got a shell again. ;) to be continued.

When running the above command you should get something like:
Code:
isilicon # mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0x50000 0x430000;tftp 0x82000000 /tftpboot/romfs.img 0x3e0000

16384 KiB hi_fmc at 0:0 is now current device

Hisilicon ETH net controler

MAC:   00-0B-3F-00-00-01

eth0 : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M

eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M

TFTP to server 192.168.178.93; our IP address is 192.168.178.125

Upload Filename '/tftpboot/romfs.img'.

Upload from address: 0x82000000, 3.896 MB to be send ...

Uploading: #    [ Connected ]

################################        [ 2.888 MB]

###########

         3.896 MB upload ok.

hisilicon # mw.b 0x82000000 ff 1000000;sf probe 0;sf read 0x82000000 0x430000 0xb10000;tftp 0x82000000 /tftpboot/user.img 0x6e0000

16384 KiB hi_fmc at 0:0 is now current device

Hisilicon ETH net controler

MAC:   00-0B-3F-00-00-01

eth0 : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M

eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M

TFTP to server 192.168.178.93; our IP address is 192.168.178.125

Upload Filename '/tftpboot/user.img'.

Upload from address: 0x82000000, 6.896 MB to be send ...

Uploading: #    [ Connected ]

################################        [ 2.888 MB]

################################        [ 5.752 MB]

############

         6.896 MB upload ok.
Copy your image to a working directory and run unsquashfs to extract it:
Code:
maurice@maurice-N73SM:~/Downloads/extract/new$ sudo unsquashfs -d romfs romfs.img
Parallel unsquashfs: Using 8 processors
175 inodes (190 blocks) to write

[=================================================================================

created 47 files
created 33 directories
created 128 symlinks
created 0 devices
created 0 fifos
To repack it and flash it again is explained in a couple of posts above.

happy hacking :)

* edit 2 * For some reason I cannot read the flash in u-boot when starting at 0xb10000 where the web squashfs files starts. It gives me an "ERROR: read/write area is out of range!" I know for sure the offsets on the flash are correct. kernel messages also tells me that. See starting at line 100
* edit 3 * Still not sure why I don't have access in u-boot, For now I used the shell and used dd to dump the image from the flash partition.
Code:
dd if=/dev/mtdblock3 of=/home/web.img bs=1k

1600+0 records in

1600+0 records out

1638400 bytes (1.6MB) copied, 0.372374 seconds, 4.2MB/s
BTW current firmware

Code:
cat FirmwareInfo
NET_UPGRADE_FILE=General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180901.bin
BURN_FILE=upall_General_General_NBD8008R-PL.7601.Nat.OnvifC.20180901.bin
Attached strace from starting /usr/bin/sofia

* edit 4 * Thread to keep an eye on 求购WFS0.2、WFS0.3、WFS0.4源码 - 海思平台开放论坛 - 易百纳论坛 - Powered by Discuz! WFS0.4 hdd recording
 

Attachments

Last edited:

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
My thoughts, about the device/software after playing around with it. The software/firmware is pretty solid and also looks secure especially when you look at china devices a couple of years back. When the Sofia program is started with dvrhelper it will kill any existing telnetd. (using openssh from entware-ng now) So when you want to use a telnetd you will have to start it after Sofia starts with a delay. 5 seconds was good for me. The dvrhelper will also watch the threads needed, if there crashes one like Sofia, it will auto reboot the device after about 20 seconds. USB disks are mounted by Sofia at the moment you want to write something to it and unmounted again when it is finished writing. This is a good practice and doesn't corrupt your USB disk as long as you don't disconnect when it is writing.
My initial thought was to put this device somewhere tugged away with no monitor and backup or access the recorded files over my home network. This will however consume too much of my limited time I can spend on it. I have a rpi with google assistant running which is connected to a monitor. I see if I can get hdmi splitter with an input that I can control with the rpi and connect the NVR to the same monitor.
The one thing I want to do is adjust the webinterface so that I can get a screenshot of my cams instead of the plugin not supported in chrome. This I think should be doable with ffmpeg.

Following will update a snapshot image of camera 1 every second. I use stream=1 the low res url, because I run into memory issues when using the main stream. (1920x1080px vs 352x288px) See if we can improve this a bit.
ffmpeg needed resources: CPU load is about 6-7% memory about 34%
Code:
ffmpeg -loglevel verbose -i rtsp://192.168.178.125:554/user=admin&password=xxxx&channel=1&stream=1.sdp?real_stream -vf fps=fps=1 -pix_fmt yuvj420p -updatefirst 1 /home/snapshot_cam1.jpg
 
Last edited:

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
Hmm again an OTA update This time we also have a newly build kernel.
Code:
~ # cat /mnt/custom/FirmwareInfo
NET_UPGRADE_FILE=General_General_NBD8008R-PL_V4.02.R11.7601.Nat.OnvifC.20180905.bin
BURN_FILE=upall_General_General_NBD8008R-PL.7601.Nat.OnvifC.20180905.bin
~ # uname -a
Linux localhost 4.9.37 #16 Tue Sep 4 16:29:28 CST 2018 armv7l GNU/Linux
* edit * This new firmware can be downloaded at Hangzhou Xiongmai Technology Co.,LTD.-8ch 1080P H.265 NVR Board
 
Last edited:

divx118

n3wb
Joined
Aug 18, 2018
Messages
26
Reaction score
7
Location
Netherlands
A little info on where the settings of the NVR/DVR are stored:
In /mnt/mtd/Config/Json are gunzip compressed Json files which contain the settings. NetWork is one of those files it will contain your cams ip and passwords in plain text once unpacked. The .second files are I guess backups. Note that when you try to gunzip them on a modern linux system the extension must be changed to .gz For some reason someone decided in the past to force you to work with extensions on linux. IMO a stupid decision, but I guess they had there reasons.
When you unpack them with a remote session telnet or ssh on the device /bin/gunzip and also in my case gunzip from entware doesn't have this problem.
To unpack a file and write it to a different location in a remote session:
Code:
/mnt/mtd/Config/Json # gunzip -c AVEnc > /home/AVEnc
/mnt/mtd/Config/Json # cat /home/AVEnc
{ "AHDChannelState" : [ { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 }, { "EncodeInfo" : { "BitRate" : 0, "CurResolution" : 0, "FPS" : 0 }, "Resolution" : 0 } ], "CombineEncode" : [ { "ExtraFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false } ], "MainFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false } ], "SnapFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : true }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false } ] }, { "ExtraFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 256, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 3, "Resolution" : "QCIF" }, "VideoEnable" : false } ], "MainFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 25, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false } ], "SnapFormat" : [ { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : true }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false }, { "Audio" : { "BitRate" : 10, "MaxVolume" : 10, "SampleRate" : 10 }, "AudioEnable" : false, "Video" : { "BitRate" : 512, "BitRateControl" : "VBR", "Compression" : "H.264", "FPS" : 1, "GOP" : 2, "Quality" : 4, "Resolution" : "CIF" }, "VideoEnable" : false } ] } ], "Encode" : null, "SmartH264" : null, "VideoColor" : null, "VideoWidget" : [ { "ChannelTitle" : { "Name" : "Frontdoor", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D02", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D03", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D04", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D05", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D06", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D07", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } }, { "ChannelTitle" : { "Name" : "D08", "SerialNo" : "20081125" }, "ChannelTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 570, 7552, 255, 24 ] }, "Covers" : [ { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] }, { "BackColor" : "0x80000000", "EncodeBlend" : false, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : false, "RelativePos" : [ 1024, 1024, 2048, 2048 ] } ], "CoversNum" : 0, "TimeTitleAttribute" : { "BackColor" : "0x80000000", "EncodeBlend" : true, "FrontColor" : "0xF0FFFFFF", "PreviewBlend" : true, "RelativePos" : [ 5166, 512, 255, 24 ] } } ], "WaterMark" : null }
 
Top