Camera bricked after region changer hack

harrijs

Young grasshopper
Joined
May 8, 2014
Messages
50
Reaction score
12
Crap, I just realized what he is trying to do. He is trying to mount an SMB or CIFS share on a windows host to the camera's file system. I don't know enough about these cameras to state whether they can mount a non NFS share. The command that I included above will work if he is trying to mount an NFS share being presented by a linux machine.
 

networkcameracritic

Getting the hang of it
Joined
Mar 10, 2014
Messages
719
Reaction score
203
Seems like a lot of confusion. You telnet into the camera at it's IP address, be it 192.0.0.64 or what you changed it to. Once you log in and at the command prompt for the camera, you can do a mount command to your PC where you created a Windows share, so say it's c:\mtdutils, you write clicked, you shared it. Then on the telnet prompt, you issue a mount command with the IP address of your PC, if your PC (not the camera) is 192.168.1.100, then mount -t cifs //192.168.1.100/mtdutils /mnt/nfs07 -o username=youruserid,password=yourpassword". The username and password is the username and password you log into your PC as.
 

harrijs

Young grasshopper
Joined
May 8, 2014
Messages
50
Reaction score
12
OK, I misunderstood what azthig was trying to do. This is really over the heads of many of these users when they can't even explain what environment they are in. I was making some major assumptions on what he was trying to do based off the description "When I try to telnet the Windows share into the camera" I figured that the guy was trying to make a successful NFS mount from a camera to a share. Then he made mention of an NFS share but had CIFS listed with credentials and it was even more confusing.
 

aztihg

n3wb
Joined
Feb 11, 2015
Messages
21
Reaction score
0
I'm sorry I confused you guys, but my English is not my native language. Please excuse it. I followed networkcameracritic's instructions, which are very clear to me, but I'm getting this message "failed: Invalid argument" all the time. The camera is functional, but I cannot use it with iVMS42000 due to the Chinese language. I can telnet into the camera and I was successful to make it multilingual (from the same machine), but it is still not accepted by the iVMS and has the day of the week in Chinese. I tried to telnet from another machine and I'm getting same messages. It is a DS-2CD2332-I and I got it from Aliexpress and was delivered late December 2014.

If I check the dmesg command, I find this:

CIFS: Unknown mount option "my Windows-username"
CIFS: Unknown mount option "my Windows-password"
CIFS VFS: No username specified

Also, how do I know when the mount was successful? Your help is much appreciated.

aztihg
 
Last edited by a moderator:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,972
Reaction score
6,795
Location
Scotland
A simple way to avoid struggling with the syntax to add a network mount is to use the camera web GUI to add a NAS destination in the 'NAS' tab of the 'Storage' menu under Advanced Configuration.
Select either NFS or SMB/CIFS depending on what file server / share you have available on your LAN.
Fill in the needed address, sharename and access credentials as needed.
Use the 'Test' button to validate your settings. This performs a temporary directory create / delete to assess the ability to write to the destination.
Save the settings.
It's NOT necessary to 'format / initiallise' the NAS destination under the 'storage management' tab.

When that's done, via Telnet or SSH you can inspect the mount point with the 'mount' command to see where the files will be located.
Strictly - the NFS syntax should have a few more options than the example shown earlier - but as it's only for temporary use, probably not a problem.
Sample result:
[login as: root
root@192.168.254.11's password:

BusyBox v1.19.3 (2014-07-11 11:25:54 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
ramfs on /home type ramfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/ubi1_0 on /dav type ubifs (rw,relatime)
/dev/ubi3_0 on /davinci type ubifs (rw,relatime)
/dev/ubi4_0 on /config type ubifs (rw,relatime)
192.168.1.201:/cctv1 on /mnt/nfs00 type nfs (rw,sync,relatime,vers=3,rsize=4096,wsize=4096,namlen=255,acregmin=0,acregmax=0,acdirmin=0,acdirmax=0,soft,noac,nolock,proto=tcp,port=65535,timeo=70,retrans=3,sec=sys,local_lock=all,addr=192.168.1.201)
#

/QUOTE]
 

aztihg

n3wb
Joined
Feb 11, 2015
Messages
21
Reaction score
0
Thanks alastairstevenson. I followed your suggestion and I got


# mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
ramfs on /home type ramfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/ubi1_0 on /dav type ubifs (rw,relatime)
/dev/ubi3_0 on /davinci type ubifs (rw,relatime)
/dev/ubi4_0 on /config type ubifs (rw,relatime)
//192.168.1.129\mtdutils on /mnt/nfs00 type cifs (rw,mand,relatime,unc=\192.168.1.129\mtdutils,username=Family,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.1.129,file_mode=0755,dir_mode=0755,nobrl,rsize=4096,wsize=4096,actimeo=1)

I change the command from /mnt/nfs07 to /mnt/nfs00 with same results

CIFS: Mount option noac not supported. Instead set /proc/fs/cifs/LookupCacheEnabled to 0
CIFS: Unknown mount option "username"
CIFS: Unknown mount option "password"
CIFS VFS: No username specified

If I change the command as per some net suggestion to

mount -o unc=\\\\192.168.1.129\\mtdutils username,password -t cifs mtdutils /m
nt/nfs00

and getting

BusyBox v1.19.3 (2014-07-11 11:25:54 CST) multi-call binary.

Usage: mount [OPTIONS] [-o OPTS] DEVICE NODE

Mount a filesystem. Filesystem autodetection requires /proc.

-a Mount all filesystems in fstab
-f Dry run
-r Read-only mount
-w Read-write mount (default)
-t FSTYPE Filesystem type
-O OPT Mount only filesystems with option OPT (-a only)
-o OPT:
[a]sync Writes are [a]synchronous
[no]atime Disable/enable updates to inode access times
[no]diratime Disable/enable atime updates to directories
[no]relatime Disable/enable atime updates relative to modification time
[no]dev (Dis)allow use of special device files
[no]exec (Dis)allow use of executable files
[no]suid (Dis)allow set-user-id-root programs
[r]shared Convert [recursively] to a shared subtree
[r]slave Convert [recursively] to a slave subtree
[r]private Convert [recursively] to a private subtree
[un]bindable Make mount point [un]able to be bind mounted
[r]bind Bind a file or directory [recursively] to another location
move Relocate an existing mount point
remount Remount a mounted filesystem, changing flags
ro/rw Same as -r/-w

There are filesystem-specific -o flags.

Your help is much appreciated.
aztihg
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,972
Reaction score
6,795
Location
Scotland
OK, here is a CIFS/SMB example:

login as: root
root@192.168.254.11's password:

BusyBox v1.19.3 (2014-07-11 11:25:54 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
ramfs on /home type ramfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/ubi1_0 on /dav type ubifs (rw,relatime)
/dev/ubi3_0 on /davinci type ubifs (rw,relatime)
/dev/ubi4_0 on /config type ubifs (rw,relatime)
//192.168.1.201/cctv1 on /mnt/nfs00 type cifs (rw,mand,relatime,unc=\192.168.1.201\cctv1,username=IPcam,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.1.201,file_mode=0755,dir_mode=0755,nobrl,rsize=4096,wsize=4096,actimeo=1)
#
On the face of it - the same as you have not used successfully.
This is a 2032-I with 5.2.0 firmware.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,972
Reaction score
6,795
Location
Scotland
But - aztihg - your initial mount list result looks OK. Is this the one you did from the web GUI Storage NAS setting, with a good result from the 'Test' button?
Once you've done that, the job is done, you've mounted the network location successfully. No need for any more mount attempts at the command line.
You just have to check the mount list result to see where the device placed the mount point, in your first example, /mnt/nfs00
 

klasipca

Banned
Joined
Mar 27, 2014
Messages
3,146
Reaction score
750
Why do you bother with mounting, when it's not working if the camera is in the root mode. just use ftp, which is what I did.
 

networkcameracritic

Getting the hang of it
Joined
Mar 10, 2014
Messages
719
Reaction score
203
Yes, mount does not work in this root mode, just start the FTP deamon by entering ftpd & and then use an FTP tool to move files back and forth.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,972
Reaction score
6,795
Location
Scotland
Actually, mounting the Windows share to be able to execute the components of mtdutils without copying them over is part of your original instructions - that's what's being followed here.

Then what you need to do is create a Windows share on your PC, unzip the file into this directory, telnet into the camera and mount this share, like mount -t cifs //192.168.1.50/mtdutils /mnt/nfs07 -o username=pcuser,password=pcpass.
While logged into the camera, cd /mnt/nfs07/mtdutils-1.5.0-arm-linux-gnueabi/sbin to run the commands.

Start with these commands to read flash as these will put the flash in your windows share -

./nanddump -nof mtd5_temp /dev/mtd5
./nanddump
-nof mtd6_temp /dev/mtd6

From here you can use a Windows hex editor like HxD to read these files and note that in the locations above (decimal, you will need to change to hex to see the language flag) is 02 for Chinese, changing it to 01 makes it English.
 

aztihg

n3wb
Joined
Feb 11, 2015
Messages
21
Reaction score
0
Thank you all for your help. Now I can connect to my camera through iVMS4200, no more issues with the mismatch language. I used the web interface method. Regards.

aztihg
 

klasipca

Banned
Joined
Mar 27, 2014
Messages
3,146
Reaction score
750
Actually, mounting the Windows share to be able to execute the components of mtdutils without copying them over is part of your original instructions - that's what's being followed here.
the instructions work when camera is not in root mode, when in root I couldn't mount it and just used ftp.
 

ddnet

n3wb
Joined
Mar 2, 2015
Messages
5
Reaction score
0
How to mount mtdutils from Windows PC to the NVR ?

NVR not have NFS07 in the /mnt directory
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,972
Reaction score
6,795
Location
Scotland
The mount point is only there if you actually put it there - either by using the 'mount' program with suitable parameters at the command line, or by using the web admin GUI to define a NAS storage destination.
It doesn't have to be called nfs07, it could actually be called anything.
How did you set up the mount point, and what does the 'mount' command show when you use it to list the mount points?


As an example from earlier in this thread:
A simple way to avoid struggling with the syntax to add a network mount is to use the camera web GUI to add a NAS destination in the 'NAS' tab of the 'Storage' menu under Advanced Configuration.
Select either NFS or SMB/CIFS depending on what file server / share you have available on your LAN.
Fill in the needed address, sharename and access credentials as needed.
Use the 'Test' button to validate your settings. This performs a temporary directory create / delete to assess the ability to write to the destination.
Save the settings.
It's NOT necessary to 'format / initiallise' the NAS destination under the 'storage management' tab.

When that's done, via Telnet or SSH you can inspect the mount point with the 'mount' command to see where the files will be located.
Strictly - the NFS syntax should have a few more options than the example shown earlier - but as it's only for temporary use, probably not a problem.
Sample result:
login as: root
root@192.168.254.11's password:

BusyBox v1.19.3 (2014-07-11 11:25:54 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
ramfs on /home type ramfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/ubi1_0 on /dav type ubifs (rw,relatime)
/dev/ubi3_0 on /davinci type ubifs (rw,relatime)
/dev/ubi4_0 on /config type ubifs (rw,relatime)
192.168.1.201:/cctv1 on /mnt/nfs00 type nfs (rw,sync,relatime,vers=3,rsize=4096,wsize=4096,nam len=255,acregmin=0,acregmax=0,acdirmin=0,acdirmax= 0,soft,noac,nolock,proto=tcp,port=65535,timeo=70,r etrans=3,sec=sys,local_lock=all,addr=192.168.1.201 )
#
 

ddnet

n3wb
Joined
Mar 2, 2015
Messages
5
Reaction score
0
The NVR not have NAS functionality by webaccess.

No such device error when mount by telnet.

dvrdvs login: root
Password:


BusyBox v1.16.1 (2014-05-19 09:41:10 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

can not change to guest!
[root@dvrdvs /] # ls
bin etc lib mnt proc sys usr
dev home linuxrc opt sbin tmp var
[root@dvrdvs /] # cd /mnt
[root@dvrdvs /mnt] # ls -l
drwxr-xr-x 2 root root 1024 Jul 3 2012 esda1
drwxr-xr-x 2 root root 1024 Jul 3 2012 esda2
drwxr-xr-x 2 root root 1024 Jul 3 2012 esda3
drwxr-xr-x 2 root root 1024 Jul 3 2012 esda4
drwxr-xr-x 2 root root 1024 Jul 3 2012 esdb1
drwxr-xr-x 2 root root 1024 Jul 3 2012 esdb2
drwxr-xr-x 2 root root 1024 Jul 3 2012 esdb3
drwxr-xr-x 2 root root 1024 Jul 3 2012 esdb4
[root@dvrdvs /mnt] # mount -t cifs //192.0.0.128/mtd /mnt/esda1 -o username=*******,password=******
mount: mounting //192.0.0.128/mtd on /mnt/esda1 failed: No such device
[root@dvrdvs /mnt] # mount
rootfs on / type rootfs (rw)
/dev/root on / type ext2 (rw,relatime,errors=continue)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock1 on /home/hik type jffs2 (rw,relatime)
tmpfs on /home/app type tmpfs (rw,relatime)
[root@dvrdvs /mnt] #
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,972
Reaction score
6,795
Location
Scotland
The error suggests that the network destination does not exist or is not reachable.
Have you confirmed that the PC at 192.0.0.128 is reachable from the NVR? Can you ping it? What is the IP address of the NVR?
What's the model of the NVR? Looks like old firmware.

Presumably the NVR has USB ports. You could probably plug in a USB memory stick with a copy of mtdutils in a folder.
After you've plugged in the memory stick, use the 'mount' command to list where the mount point is.
 

ddnet

n3wb
Joined
Mar 2, 2015
Messages
5
Reaction score
0
Ip address of NVR is 192.0.0.64, both side network reachable can ping also i can telnet to NVR.
NVR model is DS-7104N-SN

[root@dvrdvs /] # getHardInfo
Start at 2015-03-03 17:27:07
Serial NO :0420150116AARR498946575WCVU
V3.0.10 build 141128
KernelVersion: V1.0.0 build 140725
dspSoftVersion: V5.0 build 141127
codecVersion: V5.0 build 080808
hardwareVersion = 0xc600
encodeChans = 0
decodeChans = 4
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 1
flashsize = 0x8
ramSize = 0x100
networksNums = 1
language = 2
devType:DS-7104N-SN
bootPartition = 2
randomCode = PATIAG
[root@dvrdvs /] #
 
Top