EZViz Camera: CS-CV110-A1, photos, passwords...

Purduephotog · Aug 11, 2019

It's been a bit frustrating but here is the EZViz camera that is causing me so much grief.

First, unless you read the FAQ, buried way in the back is the statement "No Web- secure only" and "Only compatible with the ezviz NVR". What that means is there is NO webservices, no SSH, no nothing (well, SSH is running, but disabled).
Camera in question:
ezviz 8-Channel 4K UHD NVR with 2TB HDD & 4 4K Outdoor Night Vision Bullet Cameras

Using the trojan-camera routine previously talked about (Alternative way of recovering HikVision NVR password )- and even though the NVR would NOT support the g0 camera, I was able to find the EZViz's camera password. That meant I could at least now use it with anything that took an ONVIF stream.

So I naturally disassembled everything. Photos are here:- actually I'll put it in separate boxes.

Purduephotog · Aug 11, 2019

Photos of the teardown:

Purduephotog · Aug 11, 2019

Boot Log:

Code:

U-Boot 3.1.6-297597 (Aug 30 2017-21:48:30)
boards:310094
Boot From: NAND 2048 RC BCH 6bit
SYS_CONFIG: 0x00070053 POC: 001
Cortex freq: 816000000
ENET freq: 50000000
iDSP freq: 348000000
Dram freq: 840000000
Core freq: 360000000
AHB freq: 180000000
APB freq: 90000000
UART freq: 24000000
SD freq: 50000000
SDXC freq: 50000000
dev_model:CS-CV110-A1-68R
[Uboot] In release mode!
Hit Ctrl+u to stop autoboot: 0
|BIND err|
cmd 'null' is not supported.
flash booting ...
booting from pri part...
load kernel...
[    1.546500] Card authentication succeeded
init started: BusyBox v1.19.3 (2017-09-29 19:29:33 CST)
starting pid 59, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]
create static device nodes under /dev dir
>>>run pre_app_hook
UBI device number 1, total 272 LEBs (34537472 bytes, 32.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi1_0.
pri_iUpgSuccCnt:1, sec_iUpgSuccCnt:1
UBI device number 3, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
find net_node, loop : 1
route: ioctl 0x890c failed: No such process
Default method to init without VIN drivers...
Cat this file to find out what VIN can be supported.
Default init without lens driver
Use default settings
/home/script/init.sh: line 445: which: not found
/home/script/init.sh: line 456: /lib/firmware: Permission denied
Load ucode failed!
/
mkdir: can't create directory '/var/run': File exists
modprobe: can't load module uart232 (uart232.ko): Operation not permitted
map_size = 0x500000, nr_item = 3
addr_offset = 0x00000000, filename = orccode.bin
addr_offset = 0x00300000, filename = orcme.bin
addr_offset = 0x003a0000, filename = default_binary.bin
mmap returns 0x768f5000
loading /home/firmware/orccode.bin...addr = 0x768f5000, size = 0x19bdca
loading /home/firmware/orcme.bin...addr = 0x76bf5000, size = 0x3392c
loading /home/firmware/default_binary.bin...addr = 0x76c95000, size = 0x619c0
===============================================
ucode (S3L) version = 2017/9/21 277027.273030
===============================================
ln: prtLensCurve: File exists
ln: /dev/ttyS1: File exists
ln: /bin/t1: File exists
ln: /dev/rtc: File exists
=====check_config start=====
===main db is ok===
[PACK][DBG_INFO][src/firm_unpack_lib.c][firm_pack_decode][183]:iPackIdx=0,iPackFlg=0x00650100,iPlatform=101,iDevMajor=111,iDevMinor=111,iLanguage=2

Enter DB_main-------------------
shared memory address is: 0x76c04000, sizeof(DEVICECONFIG) = 960360

netprocess Infomation:
version: 5.10.2 [20:30:31-Jul 18 2017]
Path: /Camera/Platform/Trunk/FSP_network_protocol
Last Changed Rev: 299284
Last Changed Date: 2017-07-14 17:00:38 +0800 (Fri, 14 Jul 2017)
.
wait davinci set default...
[08-11 15:54:52][pid:0][IPC_UNIX][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[08-11 15:54:52][pid:589][IPC_UNIX][ERROR] from daemon ack, dst not work  len 0 , load_type is [0x10012]
[08-11 15:54:52][pid:589][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[08-11 15:54:52][pid:589][UNI_IF][ERROR]communicaite_to_davinci failed!!!
copy default.cls ok.
[DAEMON][DBG_INFO][src/daemon.c][firm_file_output][367]:firm unpack file : /home/process/davinci.tar.gz succ.
[DAEMON][DBG_INFO][src/daemon.c][app_system_exec][242]:system cmd [tar xvzf /home/process/davinci.tar.gz -C /home/process]
davinci
IEfile uncompressed.
[08-11 15:54:53][pid:0][IPC_UNIX][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[08-11 15:54:53][pid:589][IPC_UNIX][ERROR] from daemon ack, dst not work  len 0 , load_type is [0x10012]
[08-11 15:54:53][pid:589][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[08-11 15:54:53][pid:589][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[DAEMON][DBG_INFO][src/daemon.c][app_system_exec][259]:system [tar xvzf /home/process/davinci.tar.gz -C /home/process] succ.)
[DAEMON][DBG_INFO][src/daemon.c][app_system_exec][242]:system cmd [/home/process/davinci &]
[DAEMON][DBG_INFO][src/daemon.c][app_system_exec][259]:system [/home/process/davinci &] succ.)
shared memory address is: 0x7687e000, sizeof(DEV_CAPABILITY) = 258664
bootParms.videoinType=47, bootParms.devType=141929
bootParms.abfType=0

¦?¦?¦: 0x22a69 , ¦¦¦¦?¦¦¦¦: 1, videoinType=47
[08-11 15:54:54][pid:609][OTHER][ERROR]CUSTOM_PATH open error.No such file or directory
[08-11 15:54:54][pid:609][OTHER][ERROR]analysis_custom_devtype error
patch_cap_bydev:22a69
[08-11 15:54:54][pid:609][SYSINIT][ERROR]get hardtype, bootinfo: 1, hard_type: 2.

-------Goint to init_database-1565538894
davinci enter init_database
shared memory address is: 0x76793000, sizeof(DEVICECONFIG) = 960360
davinci init_shared_memory success.
powerLineFrequencyMode = 1
[08-11 15:54:54][pid:609][UNI_IF][ERROR]stream request out range 3(2)
After set_devcfg_default, database need to init
S: cmd_get_capa_data  ,ack 1 --sizeof(ret)= 4

[08-11 15:54:54][pid:588][DATABASE][ERROR][uni_process/DB_uni_process.c 217][get_devcapa_data]communicaite_to_davinci 65574 : service_result 1
going to init database:1
Davinci wait for init dababase
[08-11 15:54:54][pid:588][DATABASE][DEBUG][main/dbutil.c 1727][db_checkandrecovery]db_main check num=0
[08-11 15:54:54][pid:588][DATABASE][DEBUG][main/dbutil.c 1732][db_checkandrecovery]main db is ok
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 8558][init_database]db version = 303105


db_enc_version = 33554432

[08-11 15:54:54][pid:588][DATABASE][DEBUG][main/dbutil.c 6727][db_getdata_byversion]Direct read from the database
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack 1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 1
S: cmd_check_capa_support  ,ack 1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 1
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
S: cmd_check_capa_support  ,ack -1

[08-11 15:54:54][pid:588][DATABASE][DEBUG][uni_process/DB_uni_process.c 138][communicaite_to_davinci]communicaite_to_davinci 65566 : service_result 255
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[10].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[34].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbshell.c 4380][db_get_local_port]unknown port_type: 5
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbshell.c 4625][db_get_local_port_ext]unknown port_type: 5
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][DATABASE][DEBUG][main/dbshell.c 20453][db_get_ipdome_ptzparam] ipdome_ptzparam_table is not exist
[08-11 15:54:54][pid:588][DATABASE][DEBUG][main/dbshell.c 17082][db_get_roi_param] roi_param_table is not exist
get 0-0-0-0.000000-0-0-0
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[93].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[94].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[95].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[96].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[97].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[98].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[99].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[100].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[121].get is null
[08-11 15:54:54][pid:588][DATABASE][ERROR][main/dbutil.c 593][get_alldata_from_db]tables_fun[122].get is null
[08-11 15:54:54][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:54][pid:588][DATABASE][DEBUG][main/dbshell.c 44159][db_get_sdi_local_output_config]select sdi_local_output_enable, local_output_hd from front_other_config where idx=1;
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

[08-11 15:54:55][pid:588][DATABASE][DEBUG][main/dbshell.c 44299][db_get_sdi_485_enable_config]select * from serial_config_table where serial_type=2;
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbshell.c 43531][db_get_security_config]invalid idx value: 0
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbshell.c 43531][db_get_security_config]invalid idx value: 0
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbshell.c 43531][db_get_security_config]invalid idx value: 0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
decrypted_data--access_key =
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
decrypted_data--secret_key =


db_enc_version = 33554432

[08-11 15:54:55][pid:588][DATABASE][DEBUG][main/dbshell.c 306][db_get_unknowname_param]gethkpwent success, len:4112
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]db_decrypt invalid source string length 42, trunc 32
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 586][get_alldata_from_db]device do not support intell monitor
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 576][get_alldata_from_db]device do not support color filter
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 556][get_alldata_from_db]device do not support judicial
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 556][get_alldata_from_db]device do not support judicial
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 556][get_alldata_from_db]device do not support judicial
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 556][get_alldata_from_db]device do not support judicial
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 556][get_alldata_from_db]device do not support judicial
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 556][get_alldata_from_db]device do not support judicial
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 556][get_alldata_from_db]device do not support judicial
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 556][get_alldata_from_db]device do not support judicial
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 566][get_alldata_from_db]device do not support judicial and prison behavior
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 556][get_alldata_from_db]device do not support judicial
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 556][get_alldata_from_db]device do not support judicial
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbshell.c 67559][db_get_dmesg_record_param_config] ************p_dev_cfg->dmesg_record_param.dmesg_record_logo:0*****************
[08-11 15:54:55][pid:588][DATABASE][DEBUG][main/dbshell.c 67566][db_get_dmesg_record_param_config] ************p_dev_cfg->dmesg_record_param.file_number:0*****************
[08-11 15:54:55][pid:588][DATABASE][DEBUG][main/dbshell.c 306][db_get_unknowname_param]gethkpwent success, len:4112
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:54:55][pid:588][DATABASE][DEBUG][main/dbutil.c 1878][add_column]add column net_apn to table lte_4g_param
[08-11 15:54:55][pid:588][DATABASE][DEBUG][main/dbutil.c 1883][add_column]column net_apn already exists in table lte_4g_param
[08-11 15:54:55][pid:588][DATABASE][ERROR][main/dbutil.c 8568][init_database]ipc_db_backup need backup.
[08-11 15:54:55][pid:588][DATABASE][DEBUG][main/DB_main.c 158][main]After init_database...
goint to set_semvalue 1...
This is database process,  table_name = 303105,load_type = 0x7001f
channel_no = 0, sensor_no = 0, smd_type = 0, scene_no = 0
EN_GET_OLD_DB_VERSION----

database going to sleep----------
---------------------This is backup_dev_cfg-------------------
current_db_version = 303105,  old_db_version = 303105
current_db_version = (303105-1184),  old_db_version = (303105-1184)
database init success, davinci wait sem success
init_database success...

-------end to init_database-1565538895
This is database process,  table_name = 0,load_type = 0x7001d
channel_no = 960360, sensor_no = 0, smd_type = 0, scene_no = 0
EN_CHECK_DEVCFG_THE_SAME----
uni_adapt_smart264_while_boot
***************   patch_dynamic_cap_bydev   ***************
[08-11 15:54:55][pid:609][UNI_IF][ERROR] channel_id ERROR----1(0)
[08-11 15:54:55][pid:609][UNI_IF][ERROR]GetConfigCompPara ERROR, chan = 1, stream_idx = 0
This is database process,  table_name = 0,load_type = 0x70037
channel_no = 0, sensor_no = 0, smd_type = 0, scene_no = 0
reboot reason is not valid, do nothing
This is database process,  table_name = 0,load_type = 0x70032
channel_no = 9393168, sensor_no = 1994323928, smd_type = 0, scene_no = 0
[08-11 15:54:56][pid:588][DATABASE][DEBUG][main/DB_process_service.c 168][db_service_task]DataBase process, load_type = 0x70032, cfg_same_count = 1, config has no change
This is database process,  table_name = 0,load_type = 0x70051
channel_no = 0, sensor_no = 0, smd_type = 0, scene_no = 0
[08-11 15:54:56][pid:588][DATABASE][DEBUG][main/DB_process_service.c 168][db_service_task]DataBase process, load_type = 0x70051, cfg_same_count = 2, config has no change
[08-11 15:54:56][pid:609][UNI_IF][ERROR]hw dev limit_type = 8, is_limited = 0.
<init_run>5293:capture_mode(155) value. 251934735
[08-11 15:54:56][pid:609][CAPA][ERROR]CAPA_NOT_SUPPORT:audioin_type = 1.
<adapt_encoder_param>max_stream_id: [2]
[08-11 15:54:56][pid:609][UNI_IF][ERROR]shutter_pal or shutter_ntsc is NULL
***************   patch_dynamic_cap_bydev   ***************
[08-11 15:54:56][pid:609][HW_IF][ERROR]hw type: 1
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

[HAL_BSP][609][hal_hikio_init]:hal_bsp(317637) init success!
[08-11 15:54:56][pid:609][SYSINIT][ERROR]device not support RS485
[08-11 15:54:56][pid:609][HW_IF][ERROR]transfer_485_config_options error [options:57]
[08-11 15:54:56][pid:609][RTC][ERROR]rtc = 1565538897 s, sys = 1565538896 s 945852 us, timeUs = -54148 us!
[08-11 15:54:57][pid:609][RTC][ERROR]stime OK, 1565538897 s!
------------------enter init_isp_frontc_lib-------------
------------------exit init_isp_frontc_lib-------------
#############################################################################
[08-11 15:54:57][pid:609][SYSINIT][ERROR]ipzoom_cam_lib_init ret = 0
#############################################################################
go to dsp
[armlib]init_dsp_lib 152:armlib build at 14:32:40--Jan 22 2018
[armlib]init_dsp_lib 179:shmKey = 65538, DSPINITPARA share size = 803924, addr 0x75521000
insertSemIdMap userId 0x6f, semId 0x10002 !!!
insertSemIdMap userId 0x70, semId 0x18003 !!!
[08-11 15:54:57][pid:609][DSP][ERROR]g_pdsp 0x75521000 ,sizeof 803924
[08-11 15:54:57][pid:609][DSP][ERROR]<hwif_get_dsp_encode_type()> ERROR!sdk_type=10
[08-11 15:54:57][pid:609][DSP][ERROR]<hwif_get_dsp_encode_type()> ERROR!sdk_type=10
p_audio_param->samplesPerSecond [16000]
p_audio_param->boardOutSamplesPerSecond : [16000]
[08-11 15:54:57][pid:609][DSP][ERROR][2]g_pdsp->audioTBShare.frameLen=80, g_pdsp->audioTBShare.totalFrame=128..
[08-11 15:54:57][pid:609][DSP][ERROR]stream_max_id=2
[08-11 15:54:57][pid:609][DSP][ERROR]g_pdsp->encChanCnt=2
[08-11 15:54:57][pid:609][DSP][ERROR]g_pdsp->viType=47
[08-11 15:54:57][pid:609][DSP][ERROR]###hardware_capa.videoout_type = 0, g_pdsp->vgaParam = 0x       0
[08-11 15:54:57][pid:609][DSP][ERROR]g_pdsp->machineType = 1
[08-11 15:54:57][pid:609][DSP][ERROR]set memory size to dsp: 512MB
[08-11 15:54:57][pid:609][DSP][ERROR]set hw-type to dsp, hw_type = 1(0),
[08-11 15:54:57][pid:609][UNI_IF][ERROR]get SVC_MODE failed or svc_not_support:1,smart_codec_support:1.
[08-11 15:54:57][pid:609][UNI_IF][ERROR]get ENC_NUM failed or not support ThrStream:2.
[08-11 15:54:57][pid:609][UNI_IF][ERROR]get_devcapa_data:HW_AUDIOTALK_NUM failed or not SupportTalkBack:0.
[08-11 15:54:57][pid:609][CAPA][ERROR]Get capa error, the type is [0], the pData is NULL .
[08-11 15:54:57][pid:609][UNI_IF][ERROR]json_object_get can't find device, key:lens_type, devtype:0x22a69.
[08-11 15:54:57][pid:609][UNI_IF][ERROR]get_lens_type_from_json err
[08-11 15:54:57][pid:609][UNI_IF][ERROR]smart_codec_support                    :1
[08-11 15:54:57][pid:609][UNI_IF][ERROR]svc_support                            :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]thrStream_support                      :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]ts_support                             :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]factoryMode_support                    :0

[08-11 15:54:57][pid:609][UNI_IF][ERROR]audio_support                          :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]audio_talk_support                     :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]echo_cancellation_support              :0

[08-11 15:54:57][pid:609][UNI_IF][ERROR](IPC)logo_support                      :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR](IPD)red_support                       :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR](IPD)privacymask_support               :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]digital_zoom_support                   :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]rotate_support                         :0

[08-11 15:54:57][pid:609][UNI_IF][ERROR]face_detect_capa_support               :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]upload_center_picture                  :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]face_snap_support                      :0

[08-11 15:54:57][pid:609][UNI_IF][ERROR]vehicle_detection_support              :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]hvt_vehicle_detection_support   :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]tfs_support                            :0

[08-11 15:54:57][pid:609][UNI_IF][ERROR]smd_support                            :1
[08-11 15:54:57][pid:609][UNI_IF][ERROR]smd_upload_center_picture)             :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR](ivs_vca_behavior_support)             :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]voice_change_support                   :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]people_detection_support               :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]heat_map_support                       :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]pdc_smart_support                      :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR](R3)pdc_vca_support                    :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR](IPC)defocus_capa_support              :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR](IPC)scene_change_capa_support  :0
[08-11 15:54:57][pid:609][UNI_IF][ERROR]is_support_qr                          :0

[08-11 15:54:57][pid:609][UNI_IF][ERROR]b_app_set_dsp_ability_all_ready :1

[08-11 15:54:57][pid:609][UNI_IF][ERROR]ldc_support     :0

[08-11 15:54:57][pid:609][DSP][ERROR]hwif_dsp_init:local_video_support = 1
[08-11 15:54:57][pid:609][HW_IF][ERROR]<read_fixed_noise_info_from_flash> (CFG_MAGIC != read.magicNumber(eaffff5a)
[08-11 15:54:57][pid:609][DSP][ERROR]DSP init mirror start...
g_pdsp->streamShareBuf.len = 0;
[armlib]start_dsp 101:start hikdsp &
hikdsp build at 14:32:38--Jan 22 2018
insertSemIdMap userId 0x6f, semId 0x10002 !!!
insertSemIdMap userId 0x70, semId 0x18003 !!!
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

AllocMemTab: space=0, size=2040, align=128
AllocMemTab: space=0, size=556320, align=128
(null)
[armlib]start_dsp 109:start dsp core timeOut, bootInfo=12(0xc)
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

[armlib]start_dsp 109:start dsp core timeOut, bootInfo=12(0xc)
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

[ISP] is_yuv_sensor type = 5
pcc_param->array_x_max:427 min:98
pcc_param->array_x_max:427 min:98


 sensor_id = 26

long_limit:13688 type:0
-----max time:50000 mid time:50000  long_expose_flag:0 framerate:25600000
expose_line:13688 code:295 time:50000
long_limit:13688 type:0
-----max time:50000 mid time:50000  long_expose_flag:0 framerate:25600000
expose_line:13688 code:295 time:50000
-----max time:33333 mid time:50000  long_expose_flag:0 framerate:25600000
-----max time:33333 mid time:50000  long_expose_flag:0 framerate:25600000
[DSP][OSD][2]overlay: start addr = 0x6f600000, total size = 0x200000 ( bytes)
========0
overlay_addr 0x6f600000:ff fe ff ff
[ISP] sensor_id: 0x3014
[DSP][OSD][2]dyn_osd_init: font32_enable 1868578816, p_overlay 0x1fc000, mem_size 1992943397
[DSP][OSD][2]area list init!num 49
========1
overlay_addr 0x6f600000: 0  0  0  0
========2
overlay_addr 0x6f600000: 0  0  0  0
[DSP][OSD][2]osd init ok!
[armlib]start_dsp 115:start dsp core ok, bootInfo=100(0x64), bDSPStarted = 1
[08-11 15:54:59][pid:609][DSP][ERROR]start_dsp success...
[armlib]getVirtAddr 60:dspMemSec[0].virtaddr =  0x73821000!!!
[DSP][OSD][2]get into text_osd_thread
-------------------------- OCB VER: 10003 ----------------------------
state:1
p_data_pre:0x7416b000 p_mem_top_half:0x6f604000 p_mem_bottom_half:0x6f702000 total_size:1040384
        idx:0 asc:(nil) hz:(nil)
        idx:1 asc:(nil) hz:(nil)
        idx:2 asc:(nil) hz:(nil)
        idx:3 asc:(nil) hz:(nil)
        idx:4 asc:(nil) hz:(nil)
area link free list:0x19ccec num:51
Connection established with kernel.
========3
overlay_addr 0x6f600000: 0  0  0  0
[armlib]getVirtAddr 68:phyaddr == 0
[armlib]getVirtAddr 78:@@@@@@@@@ getVirtAddr error!!!, phyAddr=0 @@@@@@@@
[08-11 15:55:00][pid:609][DSP][ERROR]RawPool phyAddr=0,virtAddr=0,len=0
[08-11 15:55:00][pid:609][DSP][ERROR]streamShareBuf phyAddr=75b8a130,virtAddr=74521130,len=300000
streamShareBuf len=300000
[08-11 15:55:00][pid:609][DSP][ERROR]RecPool[0] phyAddr=74e8a030,virtAddr=73821030,len=300000
[08-11 15:55:00][pid:609][DSP][ERROR]NetPool[0] phyAddr=7518a050,virtAddr=73b21050,len=300000
[08-11 15:55:00][pid:609][DSP][ERROR]secNetPool[0] phyAddr=7548a070,virtAddr=73e21070,len=300000
[08-11 15:55:00][pid:609][DSP][ERROR]thdNetPool[0] phyAddr=7578a090,virtAddr=74121090,len=300000
[08-11 15:55:00][pid:609][DSP][ERROR]RecPool[1] phyAddr=75a8a0b0,virtAddr=744210b0,len=40000
[08-11 15:55:00][pid:609][DSP][ERROR]NetPool[1] phyAddr=75aca0d0,virtAddr=744610d0,len=40000
[08-11 15:55:00][pid:609][DSP][ERROR]secNetPool[1] phyAddr=75b0a0f0,virtAddr=744a10f0,len=40000
[08-11 15:55:00][pid:609][DSP][ERROR]thdNetPool[1] phyAddr=75b4a110,virtAddr=744e1110,len=40000
[08-11 15:55:00][pid:609][DSP][ERROR]Initial: the permanent code is disable.
[08-11 15:55:00][pid:609][DSP][ERROR]DSP¦¦'¦¦¦?¦...
[PSWD][0071]:public_base64_len 188  len 140
front_task_dep_func_callback_init OK!
front_task_enable_init OK!
This is database process,  table_name = 0,load_type = 0x70089
channel_no = 0, sensor_no = 0, smd_type = 0, scene_no = 0
[08-11 15:55:00][pid:588][STRM_ANLS][ERROR]invalid encrypt paramemter,buf length:128, need length: 145
This is database process,  table_name = 0,load_type = 0x70036
channel_no = 0, sensor_no = 0, smd_type = 0, scene_no = 0
[08-11 15:55:00][pid:588][DATABASE][DEBUG][main/DB_process_service.c 168][db_service_task]DataBase process, load_type = 0x70036, cfg_same_count = 1, config has no change
This is database process,  table_name = 0,load_type = 0x700d4
channel_no = 0, sensor_no = 0, smd_type = 0, scene_no = 0
[08-11 15:55:00][pid:588][DATABASE][DEBUG][main/DB_process_service.c 168][db_service_task]DataBase process, load_type = 0x700d4, cfg_same_count = 2, config has no change
davinci receive cmd_query_davinci_param.
S: cmd_query_davinci_param

[08-11 15:55:00][pid:589][UNI_IF][ERROR]



 ===Davinci  Init Finish...
This is database process,  table_name = 0,load_type = 0x71026
channel_no = 0, sensor_no = 0, smd_type = 0, scene_no = 0
S: cmd_get_enable_list

[08-11 15:55:00][pid:589][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
[08-11 15:55:00][pid:589][STRM_ANLS][ERROR]invalid db_decrypt parameter, src len:0
S: cmd_check_capa_support  ,ack -1

[08-11 15:55:00][pid:589][UNI_IF][ERROR]
 isDm365WifiIPCAM=0 is_support_softap = 0
S: cmd_check_capa_support  ,ack -1

--------------usrapp:maxEnChanNo = 1 ----------------
[08-11 15:55:02][pid:609][SYSLOG][ERROR]no main log. system log will not work.
[08-11 15:55:02][pid:609][SYSINIT][ERROR]system_log_module_init failed, ret = -401.
[08-11 15:55:02][pid:609][SD][ERROR]it's time to set_sd_status_for_alarm !
[DSP][OSD][2]Host cmd. set enc osd. chan 0 pParam 1, pBuf 0x76b8f8dc
[DSP][OSD][2]config_osd:chan=0, fontLibAsc16x16 addr=0x7638e1d0 fontLibHz16x16 addr=0x7628e1b0 fontLibAsc32x32 addr=(nil) fontLibHz32x32 addr=(nil)
[DSP][OSD][2]Set osd font lib OK!idx 0, font asc 0x7638e1d0, font hz 0x7628e1b0
[DSP][OSD][1]Set osd font lib failed!idx 2, font asc (nil), font hz (nil)
[DSP][OSD][2]set param OK!
[DSP][OSD][2]Host cmd. start osd. chan 0 pParam 1, pBuf 0x76b8f8dc
[WDR_SET]STEP 3!
[08-11 15:55:02][pid:609][DSP][ERROR]hdr_mode 1
[08-11 15:55:02][pid:609][DSP][ERROR]video param! max_fps=15.00
[08-11 15:55:02][pid:609][DSP][ERROR]original_viW = 3840
[08-11 15:55:02][pid:609][DSP][ERROR]original_viH = 2160
[08-11 15:55:02][pid:609][DSP][ERROR]image_viW = 3840
[08-11 15:55:02][pid:609][DSP][ERROR]image_viH = 2160
[armlib]SendCmdToDsp 387:<lib>SendCmdToDsp: send pBuf is NULL!!!cmd==103
[DSP][OSD][2]thread ipc_osd_mask is suspend
[ISP] is_yuv_sensor type = 5
pcc_param->array_x_max:427 min:98
pcc_param->array_x_max:427 min:98


 sensor_id = 26

long_limit:2048 type:1
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
expose_line:4598 code:255 time:66666
long_limit:2048 type:1
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
expose_line:4598 code:255 time:66666
-----max time:33333 mid time:66666  long_expose_flag:0 framerate:34133333
-----max time:33333 mid time:66666  long_expose_flag:0 framerate:34133333
[DSP][OSD][2]osd_set_resolution. chan 0 3840x2160
[DSP][OSD][2]OSD kernel resolution is changed, width 3840, height 2160
[DSP][OSD][2]thread ipc_osd_mask is resumed
[DSP][OSD][2]Host cmd. set enc osd. chan 0 pParam 1, pBuf 0x76b8f8dc
[DSP][OSD][2]config_osd : pram is same. just return
[DSP][OSD][2]Host cmd. start osd. chan 0 pParam 1, pBuf 0x76b8f8dc
[ISP] sensor_id: 0x3014
[08-11 15:55:02][pid:609][DSP][ERROR]read_logofile_to_buf failed: width=0, height=0
[DSP][OSD][2]thread ipc_osd_mask is suspend
streamRecord[1]: start...
[ISP] parse_aaa_data fail
starting pid 667, tty '': '-/bin/psh'
BusyBox v1.2.1-303841 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# [ISP] is_yuv_sensor type = 5
pcc_param->array_x_max:427 min:98
pcc_param->array_x_max:427 min:98


 sensor_id = 26

long_limit:2048 type:1
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
expose_line:4598 code:255 time:66666
long_limit:2048 type:1
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
expose_line:4598 code:255 time:66666
-----max time:33333 mid time:66666  long_expose_flag:0 framerate:34133333
-----max time:33333 mid time:66666  long_expose_flag:0 framerate:34133333
[DSP][OSD][2]osd_set_resolution. chan 1 640x360
[DSP][OSD][2]OSD kernel resolution is changed, width 640, height 360
[DSP][OSD][2]thread ipc_osd_mask is resumed
[DSP][OSD][2]thread ipc_osd_mask is suspend
[08-11 15:55:04][pid:609][HW_IF][ERROR]set alarmout function: do not support alarm out.
[ISP] sensor_id: 0x3014
[ISP] parse_aaa_data fail
[DSP][OSD][2]thread ipc_osd_mask is resumed
[08-11 15:55:04][pid:609][CAPA][ERROR]Get capa error, the type is [0], the pData is NULL .
This is database process,  table_name = 0,load_type = 0x70062
channel_no = 0, sensor_no = 0, smd_type = 0, scene_no = 0
[08-11 15:55:04][pid:588][DATABASE][DEBUG][main/DB_process_service.c 168][db_service_task]DataBase process, load_type = 0x70062, cfg_same_count = 3, config has no change
[DSP][OSD][2]stream 2 is not exist
[DSP][OSD][2]osd resouce format p_stream idx 0, rotate 0
[DSP][OSD][2]osd resouce format p_stream idx 1, rotate 0
[DSP][OSD][2]cal osd mem size 74752
[DSP][OSD][2]stream 0 alloc done area num 2, mem 69632
[DSP][OSD][2]stream 1 alloc done area num 2, mem 74752
[DSP][OSD][2]stream 2 alloc done area num 0, mem 74752
[DSP][OSD][2]all stream alloc done total size 74752
[DSP][OSD][2]set osd info done!
[08-11 15:55:04][pid:609][PREVIEW][ERROR]in pDevCfgParam max packetlen = 1440
[08-11 15:55:04][pid:609][PREVIEW][ERROR]packetlen = 1440
[08-11 15:55:04][pid:609][PREVIEW][ERROR]g_metadata_mem[1].base = 224a9e8
[08-11 15:55:04][pid:609][PREVIEW][ERROR]g_metadata_mem[1].totalsize = 92160
[08-11 15:55:04][pid:609][PREVIEW][ERROR]g_metadata_mem[1].ridx = 0
[08-11 15:55:04][pid:609][PREVIEW][ERROR]g_metadata_mem[1].widx = 0
[08-11 15:55:04][pid:609][PREVIEW][ERROR]g_metadata_mem[1].packetlen = 1440
[08-11 15:55:04][pid:609][PREVIEW][ERROR]g_metadata_mem[1].peer_packetlen = 1440
[DSP][OSD][2]thread ipc_osd_mask is suspend
[DSP][OSD][2]thread ipc_osd_mask is resumed
[DSP][OSD][2]thread ipc_osd_mask is suspend
LIB_DESCRIPTION: HIK_FRONT_LIB_IPC
LIB_VERSION: 1.0.0
LIB_MAKE_TIME: build 2017/07/11-11:56:09
start_rtsp_server: maxEnChanNo=1, is_support_mpeg4=1
[08-11 15:55:04][pid:609][SYSINIT][ERROR]ADTM::adjustTM_Init succeed!!!
[08-11 15:55:04][pid:609][SYSINIT][ERROR]ADTM:: oldDSTBias now is 3600 s, oldZoneBias now is 28800 s, totally ZoneDst is 28800 s!
[08-11 15:55:05][pid:609][PTZ][ERROR]read  PTZFILEHEAD error!,1 0
[08-11 15:55:05][pid:609][PTZ][ERROR]fread erro 2242
[08-11 15:55:05][pid:609][ARP][ERROR]get_gateway err!
[08-11 15:55:05][pid:609][ARP][ERROR]send_arp ping  faild!
[08-11 15:55:05][pid:609][SYSINIT][ERROR]Now AdjSource is  ADJUSTTIME_MODE_FIVEMIN, autoRTC = 1!
[08-11 15:55:05][pid:609][SYSINIT][ERROR]ADTM::You have set ADJTIMEX_ADJTYPE_COMPARE!
This is database process,  table_name = 65792,load_type = 0x71027
channel_no = 9010, sensor_no = 0, smd_type = 9020, scene_no = 1347309653
This is database process,  table_name = 65792,load_type = 0x71027
channel_no = 9010, sensor_no = 0, smd_type = 9020, scene_no = 1347309653
This is database process,  table_name = 65792,load_type = 0x71027
channel_no = 9010, sensor_no = 0, smd_type = 9020, scene_no = 1347309653
[DSP][OSD][2]thread ipc_osd_mask is resumed
This is database process,  table_name = 0,load_type = 0x71026
channel_no = 0, sensor_no = 0, smd_type = 0, scene_no = 0
This is database process,  table_name = 65792,load_type = 0x71027
channel_no = 9010, sensor_no = 0, smd_type = 9020, scene_no = 1347309653
This is database process,  table_name = -1,load_type = 0x71028
channel_no = 0, sensor_no = 0, smd_type = 0, scene_no = 0
waiting task comming...
[uni_start_aging_old_thread]start!!
[08-11 15:55:08][pid:609][ISP_FRONT][ERROR]sleep 2 seconds, return 0 seconds
pcc_param->array_x_max:465 min:38
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
[WDR_SET]STEP 1!
[WDR_SET]STEP 2!
[isp_set_hdr_mode]chan 1,capturemode 155!
[WDR_SET]STEP 3!
[08-11 15:55:09][pid:609][DSP][ERROR]hdr_mode 1
[08-11 15:55:09][pid:609][DSP][ERROR]video param! max_fps=15.00
[08-11 15:55:09][pid:609][DSP][ERROR]original_viW = 3840
[08-11 15:55:09][pid:609][DSP][ERROR]original_viH = 2160
[08-11 15:55:09][pid:609][DSP][ERROR]image_viW = 3840
[08-11 15:55:09][pid:609][DSP][ERROR]image_viH = 2160
[DSP][OSD][2]thread ipc_osd_mask is suspend
[ISP] is_yuv_sensor type = 5
pcc_param->array_x_max:427 min:98
pcc_param->array_x_max:427 min:98


 sensor_id = 26

long_limit:2048 type:1
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
expose_line:4598 code:255 time:66666
long_limit:2048 type:1
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
expose_line:4598 code:255 time:66666
-----max time:33333 mid time:66666  long_expose_flag:0 framerate:34133333
-----max time:33333 mid time:66666  long_expose_flag:0 framerate:34133333
[DSP][OSD][2]osd_set_resolution. chan 0 3840x2160
[ISP] sensor_id: 0x3014
[ISP] parse_aaa_data fail
[DSP][OSD][2]thread ipc_osd_mask is resumed
[DSP][OSD][2]thread ipc_osd_mask is suspend
[DSP][OSD][2]thread ipc_osd_mask is resumed
[DSP][OSD][2]thread ipc_osd_mask is suspend
[DSP][OSD][2]thread ipc_osd_mask is resumed
[DSP][OSD][2]Host cmd. set enc osd. chan 0 pParam 1, pBuf 0x76b8f8dc
[DSP][OSD][2]config_osd : pram is same. just return
[DSP][OSD][2]Host cmd. start osd. chan 0 pParam 1, pBuf 0x76b8f8dc
[08-11 15:55:10][pid:609][UNI_IF][ERROR]this device not support FACE_DETECT
[08-11 15:55:10][pid:609][UNI_IF][ERROR]this device not support AUDIO_DENOISE
[08-11 15:55:10][pid:609][UNI_IF][ERROR]this device not support DEFOCUS
[08-11 15:55:10][pid:609][UNI_IF][ERROR]this device not support SCENE_CHANGE
lv[WDR_SET]STEP 1!
[config_daynight_frontc]refresh param....,not set icr!
[08-11 15:55:10][pid:609][UNI_IF][ERROR]uni_front_param_refresh_interface param size 16 error!
[08-11 15:55:10][pid:609][SENSOR][ERROR][config_blc_zone_frontc]not manual mode, not need to set blc zone!
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
[ISP] wdr not support scene_mode
[HAL_BSP][632][hal_hikio_init]:hal_bsp(317637) init success!
hikio = 1
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
[ISP] vin0 not support anti_flicker_mode
[ISP] vin0 not support col_type_set
[ISP] vin0 not support dehaze_enable
pcc_param->array_x_max:465 min:38
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
-----max time:66666 mid time:66666  long_expose_flag:0 framerate:34133333
[ISP] vin0 not support anti_flicker_mode
pcc_param->array_x_max:465 min:38
[08-11 15:55:13][pid:609][UNI_IF][ERROR]device ip is zero
[08-11 15:55:15][pid:609][UNI_IF][ERROR]device IP changed,new ip [192.168.254.10], reinit UPnP
###################################  Device Is Ready ########################################
[

alastairstevenson · Aug 11, 2019

Presumably the camera doesn't end up in a working state?

Despite the very large number of apparent and actual errors - that bootlog is normal enough for a Hikvision camera running a 5.8.x version of firmware.
Up until the very last half a dozen lines.
Presumably it just stops there?

It might be worth installing nmap if you don't already have it and using
nmap <camera_IP_address>
to see what listening ports it shows.
And - despite the lack of web GUI, the Batch Configuration Utility should be able to configure the camera if it gets to a working state.
Batch Config Tool

A suggestion that will give more detailed bootlog info :
Interrupt the bootloader and use -
setenv dbg 8
saveenv
reset

Purduephotog · Aug 11, 2019

dmesg info:

Code:

# dmesg
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 3.10.104 (mengxiang@Cpl-Frt-BSP) (gcc version 5.2.1 20151005 (Linaro GCC 5.2-2015.11-2) ) #1 PREEMPT Fri Sep 29 19:32:52 CST 2017
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Ambarella S3L (Flattened Device Tree), model: Ambarella S3L Olive Board
[    0.000000] chip_id:0x1
[    0.000000] dram_size:512M
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella:      AHB = 0xe0000000[0xe0000000],0x01000000 0
[    0.000000] Ambarella:      APB = 0xe8000000[0xe8000000],0x01000000 0
[    0.000000] Ambarella:      PPM = 0x00000000[0xdfe00000],0x00200000 9
[    0.000000] Ambarella:      AXI = 0xf0000000[0xf0000000],0x00030000 0
[    0.000000] Ambarella:    DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[    0.000000] Ambarella:   DBGBUS = 0xec000000[0xec000000],0x00200000 0
[    0.000000] Ambarella:  DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[    0.000000] Ambarella:   IAVMEM = 0x0c000000[          ],0x14000000
[    0.000000] Ambarella:    FBMEM = 0x0c000000[          ],0x00000000
[    0.000000] On node 0 totalpages: 48640
[    0.000000] free_area_init_node: node 0, pgdat 8081d884, node_mem_map 8084e000
[    0.000000]   Normal zone: 380 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 48640 pages, LIFO batch:15
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 48260
[    0.000000] Kernel command line: console=ttyS0 KRN_PRT=pri
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 190MB = 190MB total
[    0.000000] Memory: 184240k/184240k available, 10320k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x8c000000 - 0xff000000   (1840 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x8be00000   ( 190 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80510390   (5153 kB)
[    0.000000]       .init : 0x80511000 - 0x807e96cc   (2914 kB)
[    0.000000]       .data : 0x807ea000 - 0x808273e8   ( 245 kB)
[    0.000000]        .bss : 0x808273e8 - 0x808496a4   ( 137 kB)
[    0.000000] NR_IRQS:240
[    0.000000] sched_clock: 32 bits at 90MHz, resolution 11ns, wraps every 47721ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.000462] Calibrating delay loop... 812.64 BogoMIPS (lpj=4063232)
[    0.089993] pid_max: default: 32768 minimum: 301
[    1.546500] Card authentication succeeded
[    1.550570] Mount-cache hash table entries: 512
[    1.552822] CPU: Testing write buffer coherency: ok
[    1.553107] Setting up static identity map for 0x803cc6a0 - 0x803cc6f8
[    1.556349] devtmpfs: initialized
[    1.557431] pinctrl core: initialized pinctrl subsystem
[    1.557715] NET: Registered protocol family 16
[    1.558309] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    1.558762] Ambarella power management: Wed Aug 10 2016 [negative edge]
[    1.560685] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[    1.561083] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[    1.565862] bio: create slab <bio-0> at 0
[    1.566975] ambarella-dma e0005000.dma: Ambarella DMA Engine
[    1.567347] usbcore: registered new interface driver usbfs
[    1.567405] usbcore: registered new interface driver hub
[    1.567552] usbcore: registered new device driver usb
[    1.568667] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[    1.568890] ambarella-i2c e8001000.i2c: Ambarella I2C adapter[1] probed!
[    1.570547] ambarella-i2c e8007000.i2c: Ambarella I2C adapter[2] probed!
[    1.570843] Advanced Linux Sound Architecture Driver Initialized.
[    1.571511] Switching to clocksource ambarella-cs-timer
[    1.579725] ambarella-sd e0002000.sdmmc0: Got CD GPIO #60.
[    1.579887] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x8b740000<->0x0b940000]
[    1.579903] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[    1.579912] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[    1.701658] ambarella-sd e0002000.sdmmc0: 1 slots @ 25000000Hz
[    1.702047] ambarella-sd e001f000.sdmmc2: Got CD GPIO #117.
[    1.702177] ambarella-sd e001f000.sdmmc2: Slot0 use bounce buffer[0x8b760000<->0x0b960000]
[    1.702192] ambarella-sd e001f000.sdmmc2: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[    1.702201] ambarella-sd e001f000.sdmmc2: Slot0 use ADMA
[    1.781639] ambarella-sd e001f000.sdmmc2: 1 slots @ 50000000Hz
[    1.781821] NET: Registered protocol family 2
[    1.782513] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    1.782561] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    1.782590] TCP: Hash tables configured (established 2048 bind 2048)
[    1.782672] TCP: reno registered
[    1.782689] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.782706] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.782878] NET: Registered protocol family 1
[    1.783235] RPC: Registered named UNIX socket transport module.
[    1.783250] RPC: Registered udp transport module.
[    1.783257] RPC: Registered tcp transport module.
[    1.783263] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    1.989792] ambarella-adc e801d000.adc: Ambarella ADC driver init
[    1.991461] msgmni has been set to 359
[    1.992961] NET: Registered protocol family 38
[    1.993011] io scheduler noop registered
[    1.993023] io scheduler deadline registered
[    1.993045] io scheduler cfq registered (default)
[    1.993916] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 61) is a ambuart
[    1.994243] ambarella-uart e0032000.uart: Failed to request pinctrl
[    1.997409] loop: module loaded
[    1.997717] Ambarella read-only mtdblock
[    1.999984] ambarella-nand e0001000.nand: in ecc-[6]bit mode
[    2.000000] ambarella_nand: Use On Flash BBT
[    2.000094] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[    2.000287] Bad block table found at page 65472, version 0x01
[    2.000417] Bad block table found at page 65408, version 0x01
[    2.000622] 16 ofpart partitions found on MTD device amba_nand
[    2.000634] Creating 16 MTD partitions on "amba_nand":
[    2.000648] 0x000000000000-0x000000020000 : "bst"
[    2.001403] 0x000000020000-0x000000120000 : "bld"
[    2.002233] 0x000000120000-0x000000200000 : "ptb"
[    2.002961] 0x000000200000-0x000000280000 : "env"
[    2.003676] 0x000000280000-0x000000380000 : "sysflg"
[    2.004396] 0x000000380000-0x000000400000 : "param"
[    2.005103] 0x000000400000-0x000000500000 : "dpt"
[    2.005864] 0x000000500000-0x000000f00000 : "rcvy"
[    2.006604] 0x000000f00000-0x000001700000 : "krn_pri"
[    2.007357] 0x000001700000-0x000001f00000 : "krn_sec"
[    2.008124] 0x000001f00000-0x000004100000 : "app_pri"
[    2.008948] 0x000004100000-0x000006300000 : "app_sec"
[    2.009701] 0x000006300000-0x000006900000 : "cfg_pri"
[    2.010436] 0x000006900000-0x000006f00000 : "cfg_sec"
[    2.011176] 0x000006f00000-0x000007700000 : "dbg"
[    2.012036] 0x000007700000-0x000007f00000 : "syslog"
[    2.023460] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.
[    2.023808] ambarella-spi e0021000.spi: Ambarella spi controller 1 created.
[    2.081565] libphy: Ambarella MII Bus: probed
[    2.081593] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[    2.081609] mdio_bus e000e000.etherne: scan phy phy at address 0
[    2.081620] mdio_bus e000e000.etherne: scan phy phy at address 1
[    2.087488] mdio_bus e000e000.etherne: registered phy phy at address 1
[    2.087513] ambarella-eth e000e000.ethernet: Ethernet PHY[1]: 0x02430c54!
[    2.087928] ambarella-eth e000e000.ethernet: MAC Address[94:e1:ac:00:55:0e].
[    2.088020] PPP generic driver version 2.4.2
[    2.088236] PPP BSD Compression module registered
[    2.088250] PPP Deflate Compression module registered
[    2.088326] usbcore: registered new interface driver asix
[    2.088357] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.088367] ehci-ambarella: AMBARELLA-EHCI Host Controller driver
[    2.088535] ambarella-ehci e0018000.ehci: EHCI Host Controller
[    2.088572] ambarella-ehci e0018000.ehci: new USB bus registered, assigned bus number 1
[    2.088728] ambarella-ehci e0018000.ehci: irq 66, io mem 0xe0018000
[    2.101594] ambarella-ehci e0018000.ehci: USB 2.0 started, EHCI 1.00
[    2.102192] hub 1-0:1.0: USB hub found
[    2.102226] hub 1-0:1.0: 1 port detected
[    2.102488] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    2.102660] ambarella-ohci e0019000.ohci: Ambarella OHCI
[    2.102696] ambarella-ohci e0019000.ohci: new USB bus registered, assigned bus number 2
[    2.102747] ambarella-ohci e0019000.ohci: irq 67, io mem 0xe0019000
[    2.166149] hub 2-0:1.0: USB hub found
[    2.166186] hub 2-0:1.0: 1 port detected
[    2.166782] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[    2.166893] i2c /dev entries driver
[    2.167713] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[    2.167828] ambarella cpufreq driver init
[    2.168703] Netfilter messages via NETLINK v0.30.
[    2.168786] nf_conntrack version 0.5.0 (2878 buckets, 11512 max)
[    2.169161] ip_tables: (C) 2000-2006 Netfilter Core Team
[    2.169220] TCP: cubic registered
[    2.169262] NET: Registered protocol family 10
[    2.170085] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    2.170153] sit: IPv6 over IPv4 tunneling driver
[    2.170732] NET: Registered protocol family 17
[    2.170814] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[    2.170834] ThumbEE CPU extension supported.
[    2.172283] ambarella-rtc e8015000.rtc: setting system clock to 2019-08-11 15:54:41 UTC (1565538881)
[    2.172349] ALSA device list:
[    2.172361]   No soundcards found.
[    2.176793] Freeing unused kernel memory: 2912K (80511000 - 807e9000)
[    3.029860] UBI: attaching mtd10 to ubi1
[    3.045891] ambarella-nand e0001000.nand: BCH correct [1]bit in block[321]
[    3.088307] UBI: scanning is finished
[    3.097366] UBI: attached mtd10 (name "app_pri", size 34 MiB) to ubi1
[    3.097384] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.097392] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.097399] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.097406] UBI: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
[    3.097413] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    3.097422] UBI: max/mean erase counter: 6/2, WL threshold: 4096, image sequence number: 1699554578
[    3.097430] UBI: available PEBs: 0, total reserved PEBs: 272, PEBs reserved for bad PEB handling: 10
[    3.100218] UBI: background thread "ubi_bgt1d" started, PID 320
[    3.117449] UBIFS: background thread "ubifs_bgt1_0" started, PID 325
[    3.131198] UBIFS: recovery needed
[    3.176002] UBIFS: recovery completed
[    3.176094] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[    3.176108] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    3.176119] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)
[    3.176127] UBIFS: reserved for root: 1487352 bytes (1452 KiB)
[    3.176139] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 3314499D-7139-43BD-8998-39EC027494C9, small LPT model
[    3.191420] UBI: attaching mtd12 to ubi3
[    3.201932] UBI: scanning is finished
[    3.210412] UBI: attached mtd12 (name "cfg_pri", size 6 MiB) to ubi3
[    3.210430] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.210439] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.210446] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.210453] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    3.210459] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    3.210469] UBI: max/mean erase counter: 36/18, WL threshold: 4096, image sequence number: 2049326942
[    3.210477] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    3.211628] UBI: background thread "ubi_bgt3d" started, PID 329
[    3.230516] UBIFS: background thread "ubifs_bgt3_0" started, PID 334
[    3.243984] UBIFS: recovery needed
[    3.307239] UBIFS: recovery completed
[    3.307335] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[    3.307349] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    3.307361] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    3.307368] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    3.307381] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 84B16538-3BD6-47A3-9118-5924541D5E1D, small LPT model
[    3.355318] UBI: attaching mtd13 to ubi4
[    3.365767] UBI: scanning is finished
[    3.374341] UBI: attached mtd13 (name "cfg_sec", size 6 MiB) to ubi4
[    3.374358] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.374366] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.374374] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.374380] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    3.374387] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    3.374396] UBI: max/mean erase counter: 13/7, WL threshold: 4096, image sequence number: 1618035798
[    3.374403] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    3.377167] UBI: background thread "ubi_bgt4d" started, PID 339
[    3.394366] UBIFS: background thread "ubifs_bgt4_0" started, PID 344
[    3.408085] UBIFS: recovery needed
[    3.456478] UBIFS: recovery completed
[    3.456573] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[    3.456586] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    3.456597] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    3.456604] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    3.456616] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 6B86299E-6432-40DD-B589-DDC8817AD2A1, small LPT model
[    3.923245] net eth0: adv: sym 1, asym: 1
[    3.923392] net eth0: lp: sym: 0, asym: 0
[    3.923467] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    4.156437] ambarella-nand e0001000.nand: BCH correct [1]bit in block[334]
[    4.227711] ambarella-nand e0001000.nand: BCH correct [1]bit in block[394]
[    4.288003] ambarella-nand e0001000.nand: BCH correct [1]bit in block[404]
[    4.546419] ambarella-nand e0001000.nand: BCH correct [1]bit in block[463]
[    4.771481] ambarella-nand e0001000.nand: BCH correct [1]bit in block[470]
[    4.773994] ambarella-nand e0001000.nand: BCH correct [1]bit in block[472]
[    5.800969] hw_timer: module license 'Proprietary' taints kernel.
[    5.800988] Disabling lock debugging due to kernel taint
[    5.844661] img: IMG KERN VIRT: WR [0x8c327000, 100 KB], RD [0x8b7b0000, 36 KB].
[    5.973691] amba_debug_init 248:248.
[    6.113978] base module init.
[    6.561540] probe_rst_pin exceed
[    6.921852] net eth0: lp: sym: 1, asym: 1
[    6.921868] libphy: e000e000.etherne:01 - Link is Up - 100/Full
[    6.921894] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    9.111578] ambarella-i2c e8007000.i2c: No ACK from address 0x91, 0:0!
[    9.111597] sc16is752: read i2c failed,-16
[    9.111604] read sc16is752 failed!
[    9.111610] There is no sc16is752
[    9.264073] card->dai_link[0].name = ak7755
[    9.264091] card->dai_link[0].stream_name = ak7755 PCM
[    9.264099] card->dai_link[0].codec_dai_name = ak7755-AIF1
[    9.264155] snd_soc_card_amba sound.6: ASoC: CPU DAI (null) not registered
[    9.264194] snd_soc_card_amba sound.6: snd_soc_register_card failed (-517)
[    9.264202] tcmx: amba_soc_snd_probe faild
[    9.264228] platform sound.6: Driver snd_soc_card_amba requests probe deferral
[    9.273365] mmc0 power register success!
[    9.273418] mmc1 power register success!
[    9.273443] usb0 power register success!
[    9.925098] ambarella-nand e0001000.nand: BCH correct [1]bit in block[503]
[   13.774647] ambarella-nand e0001000.nand: BCH correct [1]bit in block[336]
[   17.810405] card->dai_link[0].name = ak7755
[   17.810424] card->dai_link[0].stream_name = ak7755 PCM
[   17.810432] card->dai_link[0].codec_dai_name = ak7755-AIF1
[   17.810504] snd_soc_card_amba sound.6: ASoC: CODEC (null) not registered
[   17.810546] snd_soc_card_amba sound.6: snd_soc_register_card failed (-517)
[   17.810554] tcmx: amba_soc_snd_probe faild
[   17.810582] platform sound.6: Driver snd_soc_card_amba requests probe deferral
[   18.035212] card->dai_link[0].name = ak7755
[   18.035231] card->dai_link[0].stream_name = ak7755 PCM
[   18.035238] card->dai_link[0].codec_dai_name = ak7755-AIF1
[   18.035294] snd_soc_card_amba sound.6: ASoC: CODEC (null) not registered
[   18.035334] snd_soc_card_amba sound.6: snd_soc_register_card failed (-517)
[   18.035342] tcmx: amba_soc_snd_probe faild
[   18.035370] platform sound.6: Driver snd_soc_card_amba requests probe deferral
[   18.117042] ambarella-nand e0001000.nand: BCH correct [1]bit in block[457]
[   20.458286] ambarella-nand e0001000.nand: BCH correct [1]bit in block[457]
[   20.921733] net eth0: lp: sym: 0, asym: 0
[   20.921764] libphy: e000e000.etherne:01 - Link is Down
[   22.921890] net eth0: lp: sym: 1, asym: 0
[   22.921910] libphy: e000e000.etherne:01 - Link is Up - 100/Full

Purduephotog · Aug 11, 2019

Code:

# prtHardInfo
Start at 2019-08-11 15:55:00
Serial NO :CS-CV110-A1-68R20180304AAWR181184768
V5.5.3 build 180122
OEM INFO: DZ20171013_100
NetProcess Version: 5.10.2 [20:30:31-Jul 18 2017]
Path: /Camera/Platform/Trunk/FSP_network_protocol
Last Changed Rev: 299284
Last Changed Date: 2017-07-14 17:00:38 +0800 (Fri, 14 Jul 2017)

Db Encrypt Version: 131072
hardwareVersion = 0x0
hardWareExtVersion      = 0x0
encodeChans             = 1
decodeChans             = 1
alarmInNums             = 0
alarmOutNums            = 0
ataCtrlNums             = 0
flashChipNums           = 0
rms                             = 0x200
networksNums            = 1
language                        = 1
devType                 = 0x22a69
net reboot count        = 0
vi_type                 = 47
hardwareType            = 1
firmwareCode            = 0000000200000100000000010c91bc6f000000010000000100000001ffffffff050500030012011600022a69
Path: /Camera/Custom/Custom_Project/2017/201711/%E6%B5%B7%E5%A4%96/PJ01C20171013100_%E5%8C%97%E7%BE%8E%E8%90%A4%E7%9F%B34K%E7%9B%B8%E6%9C%BA%E4%BD%8E%E6%88%90%E6%9C%AC%E6%96%B9%E6%A1%88%E5%AE%9A%E5%88%B6
Last Changed Rev: 358564
Last Changed Date: 2018-01-22 14:58:27 +0800 (Mon, 22 Jan 2018)




# ps
  PID USER       VSZ STAT COMMAND
    1 admin     2316 S    init
    2 admin        0 SW   [kthreadd]
    3 admin        0 SW   [ksoftirqd/0]
    4 admin        0 SW   [kworker/0:0]
    5 admin        0 SW<  [kworker/0:0H]
    7 admin        0 SW<  [khelper]
    8 admin        0 SW   [kdevtmpfs]
    9 admin        0 SW<  [writeback]
   10 admin        0 SW<  [bioset]
   11 admin        0 SW<  [crypto]
   12 admin        0 SW<  [kblockd]
   13 admin        0 SW   [khubd]
   14 admin        0 SW   [kworker/u2:1]
   27 admin        0 SW   [irq/98-e0002000]
   28 admin        0 SW   [irq/117-e001f00]
   29 admin        0 SW<  [rpciod]
   30 admin        0 SW   [kworker/0:1]
   31 admin        0 SW   [kswapd0]
   32 admin        0 SW   [fsnotify_mark]
   33 admin        0 SW<  [nfsiod]
   34 admin        0 SW<  [cifsiod]
   48 admin        0 SW   [spi0]
   49 admin        0 SW   [kworker/u2:2]
   54 admin        0 SW   [spi1]
   57 admin        0 SW<  [deferwq]
   68 admin     1432 S <  /usr/bin/udevd -d
  272 admin     1824 S    /usr/sbin/dropbear -R -I 1800
  320 admin        0 SW   [ubi_bgt1d]
  325 admin        0 SW   [ubifs_bgt1_0]
  329 admin        0 SW   [ubi_bgt3d]
  334 admin        0 SW   [ubifs_bgt3_0]
  339 admin        0 SW   [ubi_bgt4d]
  344 admin        0 SW   [ubifs_bgt4_0]
  395 admin        0 SW   [iav_guard]
  409 admin        0 SW   [hdmid]
  583 admin     2064 S    /bin/execSystemCmd
  585 admin     5456 S    /home/process/daemon_fsp_app
  588 admin    20584 S    /home/process/database_process
  589 admin    17528 S    /home/process/net_process
  609 admin     208m S    /home/process/davinci
  632 admin     447m S    ./hikdsp
  633 admin        0 SW   [vin_update_sht_]
  667 admin     1868 S    -/bin/psh
  668 admin     2316 S    init

# showStatus
len 50
no stream session
no file session
no talk session

OpenSDK version: V1.5.10 build 170609
device is active
device type long: DS-2CDVT-FCMPT-S0120180304AAWR181184768
device type: DS-2CDVT-FCMPT-S
register status: Offline
alarm_mode: close
userID:0000000000000000


# [08-11 16:12:41][2][979]check remote session thread begin

BQAAAJThrABVDiTcPWo=

Purduephotog · Aug 11, 2019

alastairstevenson said:
Presumably the camera doesn't end up in a working state?

It might be worth installing nmap if you don't already have it and using
nmap <camera_IP_address>
to see what listening ports it shows.
And - despite the lack of web GUI, the Batch Configuration Utility should be able to configure the camera if it gets to a working state.
Batch Config Tool

A suggestion that will give more detailed bootlog info :
Interrupt the bootloader and use -
setenv dbg 8
saveenv
reset

Yep, I've done quite a bit of probing using nmap. I was even going to break out metasploit .... but my firewall and antivirus got really pissy about it. I have no idea if the 7513 fingerprint is accurate or not.

The NVR has a challenge/response with salt.

The camera continues to boot right up fine- if I hooked it up to the NVR I'm betting it would display just fine.

alastairstevenson · Aug 11, 2019

That all looks normal enough.
But dmesg doesn't show the other log entries, the dbg 8 will cover them all.

What's the actual problem statement about the camera?

Purduephotog · Aug 11, 2019

The SDK port is 8000, presumably that I could use to communicate on.
# showUpnp
External IP: 0.0.0.0
CMD port: 9010, mapped port: 0
STREAM port: 9020, mapped port: 0
HTTP port: 80, mapped port: 0
RTSP port: 554, mapped port: 0
SDK port: 8000, mapped port: 0

Purduephotog · Aug 11, 2019

alastairstevenson said:
That all looks normal enough.
But dmesg doesn't show the other log entries, the dbg 8 will cover them all.

What's the actual problem statement about the camera?

I always get in trouble for not defining the problem statement.

I can't use the Cameras for anything other than viewing, unless I have the NVR in. I can't do much with the NVR, either. Thus: Find out what camera it is, put firmware on it to do what it should. enable web if it's there.

I can use blueiris now that I recovered the password for the camera.

There's one chunk of firmware out there on the web for the wired kit- it's here
https://s3.amazonaws.com/mfs.ezvizlife.com/CS-X4-104P&108P&116P_v3.4.90_180413.rar

At least that fits the model number. I'm still working on that.

Purduephotog · Aug 11, 2019

edit: Hey- I see you're the only hit for this:
Which microchips/processors does HikVision use in its cameras?
Ambarella S3L Olive Board

Full up dbg 8 dmesg log.

Code:

dmesg
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 3.10.104 (mengxiang@Cpl-Frt-BSP) (gcc version 5.2.1 20151005 (Linaro GCC 5.2-2015.11-2) ) #1 PREEMPT Fri Sep 29 19:32:52 CST 2017
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Ambarella S3L (Flattened Device Tree), model: Ambarella S3L Olive Board
[    0.000000] chip_id:0x1
[    0.000000] dram_size:512M
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] Ambarella:      AHB = 0xe0000000[0xe0000000],0x01000000 0
[    0.000000] Ambarella:      APB = 0xe8000000[0xe8000000],0x01000000 0
[    0.000000] Ambarella:      PPM = 0x00000000[0xdfe00000],0x00200000 9
[    0.000000] Ambarella:      AXI = 0xf0000000[0xf0000000],0x00030000 0
[    0.000000] Ambarella:    DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[    0.000000] Ambarella:   DBGBUS = 0xec000000[0xec000000],0x00200000 0
[    0.000000] Ambarella:  DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[    0.000000] Ambarella:   IAVMEM = 0x0c000000[          ],0x14000000
[    0.000000] Ambarella:    FBMEM = 0x0c000000[          ],0x00000000
[    0.000000] On node 0 totalpages: 48640
[    0.000000] free_area_init_node: node 0, pgdat 8081d884, node_mem_map 8084e000
[    0.000000]   Normal zone: 380 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 48640 pages, LIFO batch:15
[    0.000000] CPU: All CPU(s) started in SVC mode.
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 48260
[    0.000000] Kernel command line: console=ttyS0 KRN_PRT=pri dbg=8
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 190MB = 190MB total
[    0.000000] Memory: 184240k/184240k available, 10320k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0x8c000000 - 0xff000000   (1840 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x8be00000   ( 190 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80510390   (5153 kB)
[    0.000000]       .init : 0x80511000 - 0x807e96cc   (2914 kB)
[    0.000000]       .data : 0x807ea000 - 0x808273e8   ( 245 kB)
[    0.000000]        .bss : 0x808273e8 - 0x808496a4   ( 137 kB)
[    0.000000] NR_IRQS:240
[    0.000000] sched_clock: 32 bits at 90MHz, resolution 11ns, wraps every 47721ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttyS0] enabled
[    0.265218] Calibrating delay loop... 812.64 BogoMIPS (lpj=4063232)
[    0.302671] pid_max: default: 32768 minimum: 301
[    1.763778] Card authentication succeeded
[    1.767836] Mount-cache hash table entries: 512
[    1.774610] CPU: Testing write buffer coherency: ok
[    1.779734] Setting up static identity map for 0x803cc6a0 - 0x803cc6f8
[    1.789492] devtmpfs: initialized
[    1.793924] pinctrl core: initialized pinctrl subsystem
[    1.799401] NET: Registered protocol family 16
[    1.804459] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    1.811796] Ambarella power management: Wed Aug 10 2016 [negative edge]
[    1.820239] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[    1.828264] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[    1.839280] bio: create slab <bio-0> at 0
[    1.844426] ambarella-dma e0005000.dma: Ambarella DMA Engine
[    1.850595] usbcore: registered new interface driver usbfs
[    1.856106] usbcore: registered new interface driver hub
[    1.861554] usbcore: registered new device driver usb
[    1.867695] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[    1.874673] ambarella-i2c e8001000.i2c: Ambarella I2C adapter[1] probed!
[    1.882927] ambarella-i2c e8007000.i2c: Ambarella I2C adapter[2] probed!
[    1.889921] Advanced Linux Sound Architecture Driver Initialized.
[    1.896761] Switching to clocksource ambarella-cs-timer
[    1.910220] ambarella-sd e0002000.sdmmc0: Got CD GPIO #60.
[    1.915900] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x8b720000<->0x0b920000]
[    1.924187] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[    1.933059] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[    2.052146] ambarella-sd e0002000.sdmmc0: 1 slots @ 25000000Hz
[    2.059377] ambarella-sd e001f000.sdmmc2: Got CD GPIO #117.
[    2.067136] ambarella-sd e001f000.sdmmc2: Slot0 use bounce buffer[0x8b760000<->0x0b960000]
[    2.075452] ambarella-sd e001f000.sdmmc2: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[    2.084354] ambarella-sd e001f000.sdmmc2: Slot0 use ADMA
[    2.162137] ambarella-sd e001f000.sdmmc2: 1 slots @ 50000000Hz
[    2.168123] NET: Registered protocol family 2
[    2.173305] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    2.180368] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    2.186837] TCP: Hash tables configured (established 2048 bind 2048)
[    2.193281] TCP: reno registered
[    2.196502] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    2.202372] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    2.208798] NET: Registered protocol family 1
[    2.213471] RPC: Registered named UNIX socket transport module.
[    2.219374] RPC: Registered udp transport module.
[    2.224144] RPC: Registered tcp transport module.
[    2.228830] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    2.447329] ambarella-adc e801d000.adc: Ambarella ADC driver init
[    2.455143] msgmni has been set to 359
[    2.460253] NET: Registered protocol family 38
[    2.465863] io scheduler noop registered
[    2.469771] io scheduler deadline registered
[    2.474088] io scheduler cfq registered (default)
[    2.479634] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 61) is a ambuart
[    2.486970] ambarella-uart e0032000.uart: Failed to request pinctrl
[    2.496335] loop: module loaded
[    2.499757] Ambarella read-only mtdblock
[    2.506002] ambarella-nand e0001000.nand: in ecc-[6]bit mode
[    2.511645] ambarella_nand: Use On Flash BBT
[    2.515995] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[    2.528093] Bad block table found at page 65472, version 0x01
[    2.533976] Bad block table found at page 65408, version 0x01
[    2.539903] 16 ofpart partitions found on MTD device amba_nand
[    2.545769] Creating 16 MTD partitions on "amba_nand":
[    2.550893] 0x000000000000-0x000000020000 : "bst"
[    2.556360] 0x000000020000-0x000000120000 : "bld"
[    2.561727] 0x000000120000-0x000000200000 : "ptb"
[    2.567230] 0x000000200000-0x000000280000 : "env"
[    2.572688] 0x000000280000-0x000000380000 : "sysflg"
[    2.578338] 0x000000380000-0x000000400000 : "param"
[    2.583988] 0x000000400000-0x000000500000 : "dpt"
[    2.589499] 0x000000500000-0x000000f00000 : "rcvy"
[    2.598145] 0x000000f00000-0x000001700000 : "krn_pri"
[    2.604017] 0x000001700000-0x000001f00000 : "krn_sec"
[    2.609860] 0x000001f00000-0x000004100000 : "app_pri"
[    2.615806] 0x000004100000-0x000006300000 : "app_sec"
[    2.621640] 0x000006300000-0x000006900000 : "cfg_pri"
[    2.627501] 0x000006900000-0x000006f00000 : "cfg_sec"
[    2.633359] 0x000006f00000-0x000007700000 : "dbg"
[    2.638834] 0x000007700000-0x000007f00000 : "syslog"
[    2.655389] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.

[    2.662859] ambarella-spi e0021000.spi: Ambarella spi controller 1 created.

[    2.722041] libphy: Ambarella MII Bus: probed
[    2.726394] mdio_bus e000e000.etherne: /ahb@e0000000/ethernet@e000e000/phy@0 has invalid PHY address
[    2.735531] mdio_bus e000e000.etherne: scan phy phy at address 0
[    2.741517] mdio_bus e000e000.etherne: scan phy phy at address 1
[    2.752424] mdio_bus e000e000.etherne: registered phy phy at address 1
[    2.758942] ambarella-eth e000e000.ethernet: Ethernet PHY[1]: 0x02430c54!
[    2.766198] ambarella-eth e000e000.ethernet: MAC Address[94:e1:ac:00:55:0e].
[    2.773362] PPP generic driver version 2.4.2
[    2.777811] PPP BSD Compression module registered
[    2.782540] PPP Deflate Compression module registered
[    2.787651] usbcore: registered new interface driver asix
[    2.793081] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.799589] ehci-ambarella: AMBARELLA-EHCI Host Controller driver
[    2.805854] ambarella-ehci e0018000.ehci: EHCI Host Controller
[    2.811694] ambarella-ehci e0018000.ehci: new USB bus registered, assigned bus number 1
[    2.819856] ambarella-ehci e0018000.ehci: irq 66, io mem 0xe0018000
[    2.842059] ambarella-ehci e0018000.ehci: USB 2.0 started, EHCI 1.00
[    2.848975] hub 1-0:1.0: USB hub found
[    2.852782] hub 1-0:1.0: 1 port detected
[    2.856951] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    2.863319] ambarella-ohci e0019000.ohci: Ambarella OHCI
[    2.868640] ambarella-ohci e0019000.ohci: new USB bus registered, assigned bus number 2
[    2.876701] ambarella-ohci e0019000.ohci: irq 67, io mem 0xe0019000
[    2.946628] hub 2-0:1.0: USB hub found
[    2.950384] hub 2-0:1.0: 1 port detected
[    2.955013] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[    2.962709] i2c /dev entries driver
[    2.967029] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[    2.973862] ambarella cpufreq driver init
[    2.978729] Netfilter messages via NETLINK v0.30.
[    2.983540] nf_conntrack version 0.5.0 (2878 buckets, 11512 max)
[    2.989894] ip_tables: (C) 2000-2006 Netfilter Core Team
[    2.995276] TCP: cubic registered
[    2.998606] NET: Registered protocol family 10
[    3.003883] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    3.009318] sit: IPv6 over IPv4 tunneling driver
[    3.014540] NET: Registered protocol family 17
[    3.019041] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[    3.026721] ThumbEE CPU extension supported.
[    3.032406] ambarella-rtc e8015000.rtc: setting system clock to 2019-08-11 17:24:58 UTC (1565544298)
[    3.041564] ALSA device list:
[    3.044582]   No soundcards found.
[    3.052512] Freeing unused kernel memory: 2912K (80511000 - 807e9000)
[    3.907890] UBI: attaching mtd10 to ubi1
[    3.927888] ambarella-nand e0001000.nand: BCH correct [1]bit in block[321]
[    3.977640] UBI: scanning is finished
[    3.990336] UBI: attached mtd10 (name "app_pri", size 34 MiB) to ubi1
[    3.999432] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    4.006280] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    4.012992] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    4.019843] UBI: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
[    4.025755] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    4.032883] UBI: max/mean erase counter: 6/2, WL threshold: 4096, image sequence number: 1699554578
[    4.041899] UBI: available PEBs: 0, total reserved PEBs: 272, PEBs reserved for bad PEB handling: 10
[    4.051030] UBI: background thread "ubi_bgt1d" started, PID 320
[    4.074243] UBIFS: background thread "ubifs_bgt1_0" started, PID 325
[    4.094357] UBIFS: recovery needed
[    4.142960] UBIFS: recovery completed
[    4.146805] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[    4.152964] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    4.162103] UBIFS: FS size: 31490048 bytes (30 MiB, 248 LEBs), journal size 1523712 bytes (1 MiB, 12 LEBs)
[    4.171727] UBIFS: reserved for root: 1487352 bytes (1452 KiB)
[    4.177561] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 3314499D-7139-43BD-8998-39EC027494C9, small LPT model
[    4.202891] UBI: attaching mtd12 to ubi3
[    4.217226] UBI: scanning is finished
[    4.229356] UBI: attached mtd12 (name "cfg_pri", size 6 MiB) to ubi3
[    4.238357] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    4.245203] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    4.251883] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    4.258761] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    4.264592] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    4.271705] UBI: max/mean erase counter: 37/18, WL threshold: 4096, image sequence number: 2049326942
[    4.280910] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    4.289955] UBI: background thread "ubi_bgt3d" started, PID 329
[    4.313121] UBIFS: background thread "ubifs_bgt3_0" started, PID 334
[    4.332718] UBIFS: recovery needed
[    4.381129] UBIFS: recovery completed
[    4.385012] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[    4.391135] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    4.400279] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    4.409578] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    4.415236] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 84B16538-3BD6-47A3-9118-5924541D5E1D, small LPT model
[    4.473845] UBI: attaching mtd13 to ubi4
[    4.488169] UBI: scanning is finished
[    4.500303] UBI: attached mtd13 (name "cfg_sec", size 6 MiB) to ubi4
[    4.509310] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    4.516154] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    4.522864] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    4.529715] UBI: good PEBs: 48, bad PEBs: 0, corrupted PEBs: 0
[    4.535544] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    4.542673] UBI: max/mean erase counter: 13/7, WL threshold: 4096, image sequence number: 1618035798
[    4.551776] UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 10
[    4.560818] UBI: background thread "ubi_bgt4d" started, PID 339
[    4.583960] UBIFS: background thread "ubifs_bgt4_0" started, PID 344
[    4.603956] UBIFS: recovery needed
[    4.670662] UBIFS: recovery completed
[    4.674544] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[    4.680665] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    4.689811] UBIFS: FS size: 3047424 bytes (2 MiB, 24 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[    4.699111] UBIFS: reserved for root: 143937 bytes (140 KiB)
[    4.704770] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 6B86299E-6432-40DD-B589-DDC8817AD2A1, small LPT model
[    5.183729] net eth0: adv: sym 1, asym: 1
[    5.187857] net eth0: lp: sym: 0, asym: 0
[    5.191913] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    5.408478] ambarella-nand e0001000.nand: BCH correct [1]bit in block[332]
[    5.437579] ambarella-nand e0001000.nand: BCH correct [1]bit in block[334]
[    5.515818] ambarella-nand e0001000.nand: BCH correct [1]bit in block[394]
[    5.582973] ambarella-nand e0001000.nand: BCH correct [1]bit in block[404]
[    5.627691] ambarella-nand e0001000.nand: BCH correct [1]bit in block[411]
[    5.855291] ambarella-nand e0001000.nand: BCH correct [1]bit in block[463]
[    6.087553] ambarella-nand e0001000.nand: BCH correct [1]bit in block[470]
[    6.096959] ambarella-nand e0001000.nand: BCH correct [1]bit in block[472]
[    6.832067] probe_rst_pin exceed
[    7.135190] hw_timer: module license 'Proprietary' taints kernel.
[    7.141268] Disabling lock debugging due to kernel taint
[    7.195258] img: IMG KERN VIRT: WR [0x8c327000, 100 KB], RD [0x8b7b0000, 36 KB].
[    7.334205] amba_debug_init 248:248.
[    7.476071] base module init.
[    8.182344] net eth0: lp: sym: 1, asym: 1
[    8.186347] libphy: e000e000.etherne:01 - Link is Up - 100/Full
[    8.192296] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   10.482066] ambarella-i2c e8007000.i2c: No ACK from address 0x90, 2:0!
[   10.488586] sc16is752: read i2c failed,-16
[   10.492682] read sc16is752 failed!
[   10.496065] There is no sc16is752
[   13.582062] ambarella-i2c e8007000.i2c: No ACK from address 0x36, 2:0!
[   16.582061] ambarella-i2c e8007000.i2c: No ACK from address 0x30, 2:0!
[   16.588654] card->dai_link[0].name = ak7755
[   16.592933] card->dai_link[0].stream_name = ak7755 PCM
[   16.598136] card->dai_link[0].codec_dai_name = ak7755-AIF1
[   16.603750] snd_soc_card_amba sound.6: ASoC: CPU DAI (null) not registered
[   16.610640] snd_soc_card_amba sound.6: snd_soc_register_card failed (-517)
[   16.617517] tcmx: amba_soc_snd_probe faild
[   16.621614] platform sound.6: Driver snd_soc_card_amba requests probe deferral
[   16.637981] mmc0 power register success!
[   16.641929] mmc1 power register success!
[   16.652786] usb0 power register success!
[   17.303052] ambarella-nand e0001000.nand: BCH correct [1]bit in block[503]
[   17.587198] ambarella-nand e0001000.nand: BCH correct [1]bit in block[305]
[   21.156901] ambarella-nand e0001000.nand: BCH correct [1]bit in block[336]
[   25.447519] ambarella-nand e0001000.nand: BCH correct [1]bit in block[457]
[   27.788810] ambarella-nand e0001000.nand: BCH correct [1]bit in block[457]
[   28.402069] ambarella-i2c e8007000.i2c: No ACK from address 0x30, 2:0!
[   28.408749] card->dai_link[0].name = ak7755
[   28.413171] card->dai_link[0].stream_name = ak7755 PCM
[   28.418453] card->dai_link[0].codec_dai_name = ak7755-AIF1
[   28.424193] snd_soc_card_amba sound.6: ASoC: CODEC (null) not registered
[   28.432624] snd_soc_card_amba sound.6: snd_soc_register_card failed (-517)
[   28.439578] tcmx: amba_soc_snd_probe faild
[   28.443860] platform sound.6: Driver snd_soc_card_amba requests probe deferral
[   29.192217] net eth0: lp: sym: 0, asym: 0
[   29.196217] libphy: e000e000.etherne:01 - Link is Down
[   31.202351] net eth0: lp: sym: 1, asym: 0
[   31.206370] libphy: e000e000.etherne:01 - Link is Up - 100/Full
[   31.452076] ambarella-i2c e8007000.i2c: No ACK from address 0x36, 2:0!
[   34.452104] ambarella-i2c e8007000.i2c: No ACK from address 0x30, 2:0!
[   34.458855] card->dai_link[0].name = ak7755
[   34.468092] card->dai_link[0].stream_name = ak7755 PCM
[   34.475384] card->dai_link[0].codec_dai_name = ak7755-AIF1
[   34.481377] snd_soc_card_amba sound.6: ASoC: CODEC (null) not registered
[   34.490379] snd_soc_card_amba sound.6: snd_soc_register_card failed (-517)
[   34.499181] tcmx: amba_soc_snd_probe faild
[   34.503461] platform sound.6: Driver snd_soc_card_amba requests probe deferral
#
#

alastairstevenson · Aug 11, 2019

Purduephotog said:
There's one chunk of firmware out there on the web for the wired kit- it's here

That can be unpacked as K41 firmware using the @montecrypto repacker. [MCR] Hikvision packer/unpacker for 5.3.x and newer firmware
It could likely be modded and repacked.

The encrypted files can be decrypted using the tool, or :
openssl enc -d -in encFile -out decFile -des-ede3 -K 248BA7F54C7B9AE3987514E11CBC46E37841BC1100B92C13

Purduephotog · Aug 11, 2019

Getting used to these tools- sadly the nvr unpacking seems to abort, but not before i got to see this:

Code:

penwrt@openwrt-VirtualBox:/tmp/home/app/hisi/modules$ ls
acodec.ko         hi3535_chnl.ko      hi3535_sys.ko   hidmac.ko
clkcfg_hi3535.sh  hi3535_h264e.ko     hi3535_tde.ko   hifb.ko
dsp_pin.sh        hi3535_hdmi.ko      hi3535_vda.ko   hi_rtc.ko
extdrv            hi3535_ive.ko       hi3535_vdec.ko  hiuser.ko
hi3535_adec.ko    hi3535_jpegd.ko     hi3535_venc.ko  load3535
hi3535_aenc.ko    hi3535_jpege.ko     hi3535_vfmw.ko  mmz.ko
hi3535_ai.ko      hi3535_pciv_fmw.ko  hi3535_vgs.ko   sysctl_hi3535.sh
hi3535_aio.ko     hi3535_pciv.ko      hi3535_vou.ko
hi3535_ao.ko      hi3535_rc.ko        hi3535_vpss.ko
hi3535_base.ko    hi3535_region.ko    hi_cipher.ko
openwrt@openwrt-VirtualBox:/tmp/home/app/hisi/modules$
:w

Looks like I have an old NVR series 3535..

https://us.hikvision.com/sites/default/files/tb/ds-76xxni-e1e2p_usa_firmware_v3.0.7_build_20150303_release_notes.pdf

Now to figure out the camera. Although figuring out the NVR is nice too.

Any way in the protected shell to push back the image via tftp ?

Purduephotog · Aug 12, 2019

Is there any Ambarella S3L development boards? Something with a cheap flash that I could try pushing firmware onto ?

Just some neat things I found. I particularly like the copy of the files skipping one byte...

Code:

taskParamCtrl
cd /home/app; tar -zcvf cfg.tgz cfg
dd if=/home/app/cfg.tgz of=/dev/mtdblock1 bs=64k
dd if=/home/app/cfg.tgz of=/dev/mtdblock1 bs=64k seek=1
/paramtar-mq
paramTarMsgQ != -1
taskParamTarCtrl
rm /home/app/cfg.tgz
dd if=/dev/mtdblock1 of=/home/app/cfg.tgz count=1 bs=64k skip=1

Code:

/workteam/liuzhenhao/data/common_work/ezviz_access_sdk/ant_army/ant_army_ctrl.cc
ant army server already running!
send_msg_to_ant_army param error
start_ant_army_service

Code:

OEMINFO: DZ20180309_051
OEMCODE:%d
0x%04x
%d-%d-%d %d:%d:%d
/dev/mtdblock0
MIGJAoGBAPc7aLp/0eSmRVJ+bakzbZMi90WPUN+yZGAo0ywwoZKxWP+YlyG+5n7D8qJFryrGne/K+O1K UIlpRG4LNqP3nagb+8ONe0kk
71l+Y1NhhRVsUrNTOutAECFS5oZhLQCKDuYmft0iTgfFocouqqluFeF8 3RSlywZeLyXf8H0JQ8YBAgMBAAE=
MIGJAoGBAOZwSLecBmsjYjEixnXdeYfDeZJ39mDk6CH/cduiKSYz9KHAT6uqvWsYA5kT6JtWfitnl6fnPSd4/K9DYsVEMxs8esFElmV+H
qVo8owInBkHAol++kbH4SPw4L+RxkOgZ5zQuVlrZ1l6Lr08+Uli6clxxG2f7WxH8bEtyURJqPLzAgMBAAE=
MIGJAoGBAOgj9E3AFyFNBTY11p97Lmdd5WLnRISiFRd31KSp3DQT+38lWkY9DLGPlrQR38uvqo/zlzxlAEqxlRH8GQxfOytQJ/7FrTf7X
qFBh+v7wJp9YqBSOGb2XoQPWode/IWqgmMs+2L8LUqvHPtHE8WUpO9HPE0wSXHfqSz3sbAE/p1DAgMBAAE=
initRs485MSem
ret == 0
ptz/ptzLib.c
taskContiCommand
PANASONIC_CS850
VICON
KALATEL
PHILIPS
LILIN
INFINOVA
TECHWIN
KTD-348
%s/ptzCfg.bin
ioctl cmd HIDIOCGRAWINFO error!

Code:

The serial numb is too long, [%d] + [%d] > [%d]
set_ezviz_server failed[CODE:%d]
gyV7rKF5iuR1c3bBY0AHvAB5lmCU2eJJxcF/zKLVZg0n9ZHI1jYhFZ9wjC+Jmnww8rPGvkWCIqZ6N7T9Kb781qqUiYUXvpoPDKCpJkTDV
4vZjNPZRU4oXu9MQyexH91WVAkau2X36cEA6gVjBrl0lIybXZd2VDwWZHSnXJVMAKc=
start_ezviz_service failed[CODE:%d]

rearanger · Aug 15, 2019

Purduephotog said:
Is there any Ambarella S3L development boards? Something with a cheap flash that I could try pushing firmware onto ?

I think Dev boards are expensive and I could not get a hold of the s3l sdk from any of the Ambarella distributors. Best bet would probably be to attempt to blag from the smaller Chinese cam manufacturers that are using this SOC.

Did you try getting ASH shell?
What u-boot commands have you got?

Purduephotog · Aug 15, 2019

rearanger said:
I think Dev boards are expensive and I could not get a hold of the s3l sdk from any of the Ambarella distributors. Best bet would probably be to attempt to blag from the smaller Chinese cam manufacturers that are using this SOC.

Did you try getting ASH shell?
What u-boot commands have you got?

The uboot I have are:

The following commands are supported: boot erase help reset saveenv printenv setenv upbs format update upfusb upf updatebusb updateb gos go mii gpio ping Use help to get help on a specific command

I actually was wondering if I should get one of the cheap go-pro knockoffs as a way to get access to the chips. Then at least I could program with an soic 8 clip

edit: There's also pads for a micro-sd card. I haven't taken the time to see if I have a spare slot from aliexpress laying around, but it looks to be almost fully populated (no missing caps or resistors) so it may be as simple as putting it on.

rearanger · Aug 15, 2019

The following commands are supported: boot erase help reset saveenv printenv setenv upbs format update upfusb upf updatebusb updateb gos go mii gpio ping Use help to get help on a specific command

Whats the u-boot version ?
What happens when you type update (WITHOUT tftp server active)

Is this cam running a minisytem like the hikvision G1?

That u-boot is very cut down. The only way I know of getting root access to the cam is to replace u-boot , minsystem or the actual firmware (assuming the dbg=8 does not work.

All these have risks of trashing the cam. I do not know if there is a way to get the minisystem to load a new one in memory rather than flash. (I am still looking at hImage and mImage formats)

rearanger · Aug 15, 2019

Looks like there is not alot of protection.

root@john-VirtualBox:/media/sf_cctv/cv110# hik_repack10 -u digicap.dav en
HIKvision firmware repacker V0.10BETA, (c)oded by leecher@dose.0wnz.at 06/2019 Compiled by Rearanger

* cramfs.img

root@john-VirtualBox:/media/sf_cctv/cv110# cd en
root@john-VirtualBox:/media/sf_cctv/cv110/en# binwalk cramfs.img

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 CramFS filesystem, little endian, size: 12017664 version 2 sorted_dirs CRC 0x62037552, edition 0, 2926 blocks, 6 files

root@john-VirtualBox:/media/sf_cctv/cv110/en# binwalk -e cramfs.img

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
ls -al
0 0x0 CramFS filesystem, little endian, size: 12017664 version 2 sorted_dirs CRC 0x62037552, edition 0, 2926 blocks, 6 files

root@john-VirtualBox:/media/sf_cctv/cv110/en# ls -al
total 11736
drwxrwx--- 1 root vboxsf 0 Aug 15 12:15 .
drwxrwx--- 1 root vboxsf 0 Aug 15 12:13 ..
-rwxrwx--- 1 root vboxsf 12017664 Aug 15 12:13 cramfs.img
drwxrwx--- 1 root vboxsf 0 Aug 15 12:15 _cramfs.img.extracted
root@john-VirtualBox:/media/sf_cctv/cv110/en# ls _cramfs.img.extracted
0.cramfs cramfs-root
root@john-VirtualBox:/media/sf_cctv/cv110/en# ls cramfs-root
ls: cannot access 'cramfs-root': No such file or directory
root@john-VirtualBox:/media/sf_cctv/cv110/en# ls _cramfs.img.extracted/cramfs-root
gui_res.tar.lzma new_10.bin start.sh sys_app.tar.lzma uImage
root@john-VirtualBox:/media/sf_cctv/cv110/en#

I would attempt to dissect the digicap.dav repack so its rooted, then see if the cam takes it.

Purduephotog · Aug 15, 2019

Wait, where's that firmware from? The one on the web I saw was for the NVR (referencing the 3535). Did you find something else???

And yeah, the cramfs is right there in front of me- but again the one I grabbed off of hikvision's site appears to be for the NVR. Or is that really for the camera and I'm just slow again?

rearanger said:
Looks like there is not alot of protection.

root@john-VirtualBox:/media/sf_cctv/cv110# hik_repack10 -u digicap.dav en
HIKvision firmware repacker V0.10BETA, (c)oded by leecher@dose.0wnz.at 06/2019 Compiled by Rearanger

* cramfs.img

root@john-VirtualBox:/media/sf_cctv/cv110# cd en
root@john-VirtualBox:/media/sf_cctv/cv110/en# binwalk cramfs.img

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 CramFS filesystem, little endian, size: 12017664 version 2 sorted_dirs CRC 0x62037552, edition 0, 2926 blocks, 6 files

root@john-VirtualBox:/media/sf_cctv/cv110/en# binwalk -e cramfs.img

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
ls -al
0 0x0 CramFS filesystem, little endian, size: 12017664 version 2 sorted_dirs CRC 0x62037552, edition 0, 2926 blocks, 6 files

root@john-VirtualBox:/media/sf_cctv/cv110/en# ls -al
total 11736
drwxrwx--- 1 root vboxsf 0 Aug 15 12:15 .
drwxrwx--- 1 root vboxsf 0 Aug 15 12:13 ..
-rwxrwx--- 1 root vboxsf 12017664 Aug 15 12:13 cramfs.img
drwxrwx--- 1 root vboxsf 0 Aug 15 12:15 _cramfs.img.extracted
root@john-VirtualBox:/media/sf_cctv/cv110/en# ls _cramfs.img.extracted
0.cramfs cramfs-root
root@john-VirtualBox:/media/sf_cctv/cv110/en# ls cramfs-root
ls: cannot access 'cramfs-root': No such file or directory
root@john-VirtualBox:/media/sf_cctv/cv110/en# ls _cramfs.img.extracted/cramfs-root
gui_res.tar.lzma new_10.bin start.sh sys_app.tar.lzma uImage
root@john-VirtualBox:/media/sf_cctv/cv110/en#

I would attempt to dissect the digicap.dav repack so its rooted, then see if the cam takes it.

Purduephotog · Aug 15, 2019

Bit of fun- found this on the custom project, converted it to 'pretty', and...
北美萤石4K相机低成本方案定制

which links back to ... ezviz "fluorite" products.

Search

EZViz Camera: CS-CV110-A1, photos, passwords...

Purduephotog

Getting the hang of it

Purduephotog

Getting the hang of it

Purduephotog

Getting the hang of it

alastairstevenson

Purduephotog

Getting the hang of it

Purduephotog

Getting the hang of it

Purduephotog

Getting the hang of it

alastairstevenson

Purduephotog

Getting the hang of it

Purduephotog

Getting the hang of it

Purduephotog

Getting the hang of it

alastairstevenson

Purduephotog

Getting the hang of it

Purduephotog

Getting the hang of it

rearanger

Getting the hang of it

Purduephotog

Getting the hang of it

rearanger

Getting the hang of it

rearanger

Getting the hang of it

Purduephotog

Getting the hang of it

Purduephotog

Getting the hang of it