Genius! I would never have thought to try that.
I shorted the Tx and Tx lines together and turned on the camera and it booted as normal. I tried shorting the Tx and Rx lines together as soon as the "Hit any key etc" message appeared and it still booted as normal. I then disconnected the USB to serial adaptor from the computers USB socket and turned on the camera with the Tx and Rx lines shorted together. Removed the short and reconnected the USB serial adaptor to the computers USB socket and Putty showed :-
<INTERRUPT>
sonix #
I then tried help to see what commands it took. I tried using the suggested "cat1029" password but it didn't work. I tried the bdinfo command which gave some information and then tried to check the partitions using your command :- root@RT-IPC:tmpfs$ cat /proc/mtd but that didn't work. It looks like the later firmware has reduced the amount of commands available as well as disabling the Telnet access.
The ethernet light is on and flashing so it looks like it is enabled but the SV3C Search tool doesn't find the camera, although it will find my other camera.
Not sure if I can go any further. I realise it isn't cost effective to spend time on the camera, especially as it is working with the later firmware installed. But it would be nice to be able to install the earlier firmware again to regain the Hikvision compatibility that was removed in the later firmware and also for the satisfaction of doing it successfully. I hate to be beaten when I think something should be possible!
Below is the Putty log, from the initial <INTERRUPT> to the output of the cat commands in case anyone is interested or has any ideas.
Code:
<INTERRUPT>
sonix # cat1029
Unknown command 'cat1029' - try 'help'
sonix # help
? - alias for 'help'
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
devinfo - devinfo
dump - dump image
erase - erase FLASH memory
eraseetc- eraseetc
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
fatupdate- update firmware from fat32 filesystem
flinfo - print FLASH memory information
go - start application at address 'addr'
help - print command description/usage
hwcrc16 - hwcrc16 - hardware crc16 calculate
loadb - load binary file over serial line (kermit mode) and update to flash
loadkernel- loadkernel
loady - load binary file over serial line (ymodem mode) and update to flash
md - memory display
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables
spi - spi - Serial Flash sub-system
tftpboot- boot image via network using TFTP protocol
update - update image, u-env, factory, u-logo, user, kernel, rootfs-r, rootfs-r w, firmware/firmware_f
upgrade - upgrade board
usb - USB sub-system
usbboot - boot from USB device
verify - verify image, flash-info, hw-setting, flash-layout, u-boot, rescue, us er, factory, kernel, rootfs-r, u-env
version - print monitor, compiler and linker version
sonix # bdinfo
arch_number = 0x0000067D
boot_params = 0x00000100
DRAM bank = 0x00000000
-> start = 0x00000000
-> size = 0x04000000
ethaddr = 00:B0:27:08:90:14
ip_addr = 192.168.0.124
baudrate = 115200 bps
TLB addr = 0x03FF0000
relocaddr = 0x03D75000
reloc off = 0x02075000
irq_sp = 0x03D14D58
sp start = 0x03D14D48
FB base = 0x03DF0000
sonix # devinfo
## Device Info Starting ...
Invalid rootfsr
Flash-Type=SPI
SPI : u-boot/factory/kernel/rootfs-r/rootfs-rw/user/u-logo
hw-setting=0x00000000,0x00000FFF
u-boot=0x00002000,0x0004DFFF
u-env=0x0004E000,0x0004EFFF
flash-layout=0x0004F000,0x0004FFFF
factory=0x0004FFFF,0x0004FFFF
kernel=0x00050000,0x0034FFFF
rootfs-r=0x00350000,0x00A4FFFF
rootfs-app=0x00A4FFFF,0x00A4FFFF
rootfs-rw =0x00A50000,0x00B4FFFF
user=0x00B4FFFF,0x00B4FFFF
u-logo=0x00B4FFFF,0x00B4FFFF
rescue=0x00A4FFFF,0x00A4FFFF
u-boot.ver=u-boot-2011-09
u-boot.tm=
factory.ver=:)¦¦¦"¦rKb¦¦M¦C¦¦¦¦¦?¦¦¦p¦¦¦¦¦
P?¦Y
factory.tm=¦3¦r+4¦T¦¦2i¦
kernel.ver=master_054a_20160511_1704
kernel.tm=2016-07-01 20:27
user.ver=¦E
¦l+
¦$¦¦"¦d¦¦¦~c
user.tm=¦¦¦¦8R¦Hx0¦¦¦d
rootfs-r.ver=
rootfs-r.tm=
## Device Info End, rc = 0xFFFFFFFB
ERROR: devinfo read version time Failed
sonix # fatinfo
usage: fatinfo <interface> <dev[:part]>
sonix # flinfo
Bank # 1: AMD Unknown Chip Type
sonix # cat /proc/mtd
Unknown command 'cat' - try 'help'
sonix # root@RT-IPC:tmpfs$ cat /proc/mtd
Unknown command 'root@RT-IPC:tmpfs$' - try 'help'
sonix # root
Unknown command 'root' - try 'help'
Oh, you're trying to enter commands that were supposed to be used on source camera via telnet during firmware extraction. You don't need to do that since you already have the files downloaded from me.
So here's the detailed guide what you need to do, only to get those files to your camera to downgrade the firmware in it:
1. setup
TFTP server on your computer or server; it should be on the same local network as the camera (I'm using
Tftpd32: an opensource free firewall friendly dhcp, syslog sntp and tftp server/service for windows, tftp client)
2. copy the extracted files from the zip archive you downloaded from me (mtd0 - mtd3) to TFTP's root directory (the directory selected "Current directroy" on TFTP server tab)
3. connect the camera via USB/TTL adapter to your computer and start your telnet program (Putty)
4. power on the camera and interrupt the bootloader by pressing any key. I had the same problem as you - the bootloader ignored my keystrokes from USB/TTL output, so I created a loopback - redirected the camera's own output to it's input and that helped to interrupt the standard bootloader sequence and get to the U-boot prompt, see next image. Keep the connection to adapter's RX input so you can see what's going on.
After you're successful with getting into U-boot prompt, remove the shortcut and rewire the adapter to standard connection:
5. now check the camera's variables, that hold IP addresses:
You should see output similar to this:
Code:
baudrate=115200
bootargs=console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/bin/sh mem=64M isp=11M vc=11M vo=0M mtdparts=snx-spi:320k(uboot),1408k(kernel),6016k(rootfs),64k(key),384k(etc)
bootcmd=loadkernel 0x00007FFC 0x0;bootm 0x00008000
bootdelay=0
bootfile=uImage
console_pwd=mmnipcam
ethaddr=C0:99:C3:xx:xx:xx
gatewayip=xxx.xxx.xxx.xxx
ipaddr=xxx.xxx.xxx.xxx
netmask=255.255.255.0
netretry=3
serverip=xxx.xxx.xxx.xxx
stderr=serial
stdin=serial
stdout=serial
Environment size: 501/131068 bytes
Look for these 3 values:
Code:
ipaddr=xxx.xxx.xxx.xxx
netmask=255.255.255.0
serverip=xxx.xxx.xxx.xxx
The
ipaddr should be any unused IP address of your local network,
netmask should be the same as used in your network and
serverip must be set to IP address of computer with TFTP server from step 1 - that's the source from where the camera will download the firmware files in next step.
To set these values use
setenv command. For example I'd like the camera to use address 192.168.2.70 and my computer with running TFTP server has IP address 192.168.2.6 so I would set set them like this:
Code:
setenv ipaddr 192.168.2.70
setenv serverip 192.168.2.6
saveenv
Don't forget to save the values with
saveenv command!
6. Now everything is set for flashing. Enter the following command sequence to flash the first partition -
kernel:
Code:
spi erase 0x00050000 0x00160000
tftp 0x0008000 mtd1
spi write 0x0008000 0x00050000 0x00160000
and then continue with
rootfs and
key partitions:
Code:
spi erase 0x001B0000 0x005E0000
tftp 0x0008000 mtd2
spi write 0x0008000 0x001B0000 0x005E0000
spi erase 0x00790000 0x00010000
tftp 0x0008000 mtd3
spi write 0x0008000 0x00790000 0x00010000
This is for the last partition -
etc and for the
uboot partitition, which I don't think you need to flash, but for the complete reference here's the sequence for them too:
Code:
spi erase 0x007A0000 0x00060000
tftp 0x0008000 mtd4
spi write 0x0008000 0x007A0000 0x00060000
spi erase 0x00000000 0x00050000
tftp 0x0008000 mtd0
spi write 0x0008000 0x00000000 0x00050000
7. enter
reset command and if everything went good, the camera should boot up into the freshly flashed older version of the firmware. The camera will probably have IP address from my settings - 192.168.2.18 - you can change that with the IPCameraSearch tool.
