Bricked GXV3610_HD

[novex]

Hi!

Has got to me used camera, obviously inoperative. Electrical problems not found. I connect it to serial console and see this message:

Spoiler

GrandStream UBL Version: 2.22

ARM: 297 MHZ
DDR: 270 MHZ


U-Boot 1.3.4 (Aug 22 2013 - 11:06:25)

I2C: ready
DRAM: 128 MB
NAND: 128 MiB
ARM: 297 MHZ
DDR: 270 MHZ
CLK2: 27 MHZ
In: serial
Out: serial
Err: serial
Ethernet PHY: KSZ804 @ 0x00
Hit any key to stop autoboot: 2 1 0
partition [Uboot] is okay
invalid header detected for partition[CORE]
buffer mismatch, 16 vs 13
partition [BASE] is okay
partition [APP1] is okay
partition [APP2] is okay

NAND read: device 0 offset 0x300000, size 0x280000
2621440 bytes read: OK
Wrong Image Format for bootm command
ERROR: can't get kernel image!

So, kernel image is wrong, absent or something else.

I viewed listing of u-boot environments:

Spoiler

gsipca1:>printenv 
bootdelay=2
baudrate=115200
bootfile="uImage"
clearenv=nand erase 0xc0000 0x40000;
cleardata=nand erase 0x2b00000 0x400000;
updatecfg=tftp 0x82000000 gsipca1cfg.bin;nand erase 0x200000 0x100000;nand write 0x82000000 0x200000 ${filesize};setmac
updateubl=tftp 0x82000000 gsipca1ubl.bin;nand erase 0x0 0xc0000;nand write.ubl 0x82000000 0x20000 ${filesize}
updateuboot=tftp 0x82000000 gsipca1uboot-fact.bin;image_preburn;nand erase 0x100000 0x100000;nand write 0x82000000 0x100000 ${filesize}
updatecore=tftp 0x82000000 gsipca1core-fact.bin;image_preburn;nand erase 0x300000 0x400000;nand write 0x82000000 0x300000 ${filesize}
updatebase=tftp 0x82000000 gsipca1base-fact.bin;image_preburn;nand erase 0x700000 0x1000000;nand write.squashfs 0x82000000 0x700000 ${filesize}
updateprog1=tftp 0x82000000 gsipca1app1-fact.bin;image_preburn;nand erase 0x01700000 0x800000; nand write.squashfs 0x82000000 0x01700000 ${filesize}
updateprog2=tftp 0x82000000 gsipca1app2-fact.bin;image_preburn;nand erase 0x01f00000 0x800000; nand write.squashfs 0x82000000 0x01f00000 ${filesize}
updateall=run updateubl; run updateuboot; run updatecore; run updatebase; run updateprog1; run updateprog2; run cleardata; run updatecfg
tftpboot=tftp 0x82000000 uImage;setenv bootargs hw=${productid} ${bootargs};bootm 0x82000000
bootcmd=nand read.kernel 0x82000000 0x300000 0x280000;setenv bootargs hw=${productid} ${bootargs};bootm 0x82000000
serverip=192.168.84.160
ipaddr=192.168.84.161
ethaddr=00:0b:82:55:49:13
productid=IP960B2
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.3.4 (Aug 22 2013 - 11:06:25)
bootargs=hw=IP960B2 hw=IP960B2 console=ttyS0,115200n8 root=/dev/mtdblock4 ip=192.168.1.168:192.168.1.1::::: video=davincifb:vid0=OFF:vid1=OFF:osd0=OFF:osd1=OFF

Environment size: 1744/262140 bytes

I was trying to extract gsipca1core.bin from last firmware files for GXV3610_HD and IP960B2, upload it to the camera through tftp, execute command "image_preburn", dump memory after this command, but memory content has nothing to do with linux kernel.

As far as I understand, firmware different versions have different encryption key?

Anybody can share right "gsipca1*.bin" or "uImage" files for recovery the camera? Or may be somebody give advice on restoration?

Thanx and sorry for my bad english!

 

[novex]

I answer to myself:
Grandstream support informed, that these files are only for developers!
Thus, the firmware has been disassembled, unpacked and linux kernel downloaded to the camera (Thx article on habrahabr about Grandstream voip phone!).
But! Camera not fully running, it somewhere stops, but I not see any boot messages when kernel starts.
When i trying run any others kernel for dm365 (not Grandstream), they stops on:

MUX: initialized GPIO33


New question - how to enable boot messages on Grandstream kernels?