EZVIZ CP4/DP2C

ezvizfmw

n3wb
Joined
Nov 8, 2022
Messages
2
Reaction score
1
Location
Europe
Hi,

I'm trying to get a root shell on an EZVIZ CP4 door viewer (seems to be the same as DP2C) but I'm a bit stuck:
The device only has ports 8000, 9010, 9020 open, no 554 for RTSP or 80 for HTTP.

The serial port is restricted to the busybox protect shell (psh) and the bootloader seems to be something different than U-Boot, or at least heavily modified:
NPIp>T00000001ETH trim = 00001B05
>RT>
> SPI NOR and nor set clock rate => change default clock rate to 24MHz
r[RCS]: /etc/init.d/S00devs
...
"NPIp>" is the first thing the device prints when booting. I've tried interrupting the boot by pressing CTRL+U, CTRL+Q or just enter with little success.
When pressing the enter key, the device reacts with "> " but it still boots very quickly and there's not much time to try anything.
I've already looked through the open source release archive for this firmware where they include a (lightly) modified U-Boot 2019.04, but there's no explanation for "NPIp" to be found.

Has anyone ever encountered this kind of bootloader on any hikvision or ezviz devices? Any ideas how to get a a root shell on this device?
 
Top