G0 baremetal app for a limited u-boot ver

J

JAFO

n3wb
Feb 23, 2017
19
18
sec.bin is u-boot standalone/bare metal app for a limited
hik's G0 cameras like 2cd3345fi 2cd2635f
and having u-boot version:
"U-Boot 2010.06-209953 (Jul 29 2016 - 10:09:34)"

Put sec.bin to tftp dir for dl and use hidden go. cmd (yes, go with dot)
App is dloaded and started to/from 0x82000000 so use mem area above of it like 0x82100000
App is possible to start again using cmd: go 0x82000000
Cmd can be also std u-boot cmd but app will then return to std u-boot.

With app is possible to backup mtd partitions and yaffs2 partition's files.
std g0 u-boot is stripped therefore this toy is needed to have recovery features.
Use it at your own risk !

PTSD Commands:
show enc : Shows enc mtd2 params
tftp [loadAddress] [bootfilename] <upload_size>: Download or upload file via network using TFTP protocol
ymount [part] : mount yaffs2 mtd partition 7-12 . Default is 7
yumount : umount mounted yaffs2 mtd
yls : lists yaffs directory
yrd [file] : Displays yaffs file ex. /nand/initrun.sh
yrdm [file] [addr] : read file to memory from yaffs ex. /nand/initrun.sh 0x82100000
ywrm [file] [addr] [size] : write file from memory to yaffs ex. /nand/initrun.sh 0x82100000 0x19F6
ymkdir [dir] : yaffs2 mkdir
yrmdir [dir] : yaffs2 rmdir
yrm [path] : yaffs2 rm
ymv [old] [new] : yaffs2 mv
ymkdir [dir] : yaffs2
mtd info : display mtd info
mtd size [part] : display mtd partition size part=0-12
mtd read [part] [addr] <size> : read mtd partition to memory, part=0-6, size's default is part size
mtd erase [part] : erase partition
mtd write [part] [addr] [size] : write mtd partition from memory, part=0-6
md [addr] [size] : display memory
mw [addr] [size] : modify memory
chkdav [addr] : check dl'ed digicap.dav
q : Quit - ctrl-c

please remember to yumount after yaffs2 mount!

Br, jafo
 

Attachments

Last edited:
  • Like
Reactions: tangent, Gul-Dukat, cguenther and 1 other person
Tell me this work also for DS-2Cd2035-I ? This camera is on platform G0. I need convert it from CN to EN. Now i have FW 5.5.53 and uboot: 2010-06-153460 (Oct 10 2015 15:21:59)
 
pepeEL said:
Tell me this work also for DS-2Cd2035-I ? This camera is on platform G0. I need convert it from CN to EN. Now i have FW 5.5.53 and uboot: 2010-06-153460 (Oct 10 2015 15:21:59)
Click to expand...

Did you try this? I have the same u-boot as yourself with limited access via serial console.
 
Yes i try and nothing....
AUthor not replay and no help from him... Tell me that he not have a time....
 
so it failed to load sec.bin via tftp/serial console eg attempts to update but outputs error.. I think sec.bin is unique to the u-boot version. (some people will get many messages from many people,not surprised many do not have the time/want to waste the time)

I assume you then updated to the CH version(5.5). now you are stuck with CH menus and are unable to roll back ?
 
Last edited:
rearanger said:
I have the same u-boot as yourself with limited access via serial console.
Click to expand...
Depending on the version of the bootloader, you should be able to boot to a shell prompt (not psh) so that firmware files can be directly added and changed.

Code: 
This gets to an ash shell
setenv bootargs console=ttyAMA0,115200 init=/bin/sh single loglevel=9

This also gets to an ash shell
setenv bootargs console=ttyAMA0,115200 single loglevel=9


Then to complete the initiallisation and a mount to your NAS NFS share :

/bin/mount -t proc proc /proc
/bin/mount -t sysfs none /sys
/bin/mount -t ramfs ramfs /home

/etc/S_udev

ifconfig eth0 192.168.1.64 up

mount -t nfs -o nolock 192.168.1.201:/cctv1 /mnt/nfs00

cd /mnt/nfs00
 
  • Like
Reactions: VorlonFrog
hi, tried that on a U-Boot 2010.06-153460 and it goes into PSH. (ill try the other 2 setenv options you have given and see what happens.)

setenv bootargs console=ttyAMA0,115200 init=/bin/sh rootfs=0x82000000 rootfstype=initrd debug single loglevel=9
saveenv

reset

------------------------


U-Boot 2010.06-153460 (Oct 10 2015 - 18:21:59)

NAND: 128 MiB
Hit Ctrl+u to stop autoboot: 0
ETH0: PHY(phyaddr=3, mii) link UP: DUPLEX=FULL : SPEED=100M
MAC: 28-57-BE-2C-4A-64
|NUL ethaddr| TFTP server not found
booting from pri partition...
Load kernel to 0x80007fc0 ... Done!
## Booting kernel from Legacy Image at 80007fc0 ...
Image Name: Linux-3.4.35-g0
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4415592 Bytes = 4.2 MiB
Load Address: 80008000
Entry Point: 80008000
XIP Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Starting udev: [ OK ]
route: ioctl 0x890c failed: No such process
applib/
applib/libiconv_utf8Gbk.so
applib/libhikosip.so
applib/libfsp_base.so
applib/libipc_unix.so
applib/libcrypto.so
applib/libsqlite3.so
ASC16
certs.tar.gz
da_info
execSystemCmd
flash_eraseall
GBK
help.tar.gz
hikdsp
IEfile.tar.gz
libdadsp.so
libr7_isp.so
pppd
pppoe
pppoed
process/
process/davinci_bak
process/net_process
process/daemon_fsp_app
ptzCfg.bin
r7_isp_config.tar.gz
r7_modules.tgz
sound.tar.gz
t1
_uImage/
hikdrv/8188eu.ko
hikdrv/abf_trigger.ko
hikdrv/alarm.ko
hikdrv/an41908.ko
hikdrv/base.ko
hikdrv/bcm43362/
hikdrv/bcm43362/fw_bcm40181a2-5.90.195.89.26.rxglom.bin
hikdrv/bcm43362/nvram_ap6181.txt
hikdrv/bcmdhd_sdio.ko
hikdrv/cfg80211.ko
hikdrv/dome_timer.ko
hikdrv/eth_debug.ko
hikdrv/event_notify.ko
hikdrv/hikcomm.ko
hikdrv/hi_sensor_i2c.ko
hikdrv/hi_sspi.ko
hikdrv/mmz.ko
hikdrv/modules.dep
hikdrv/motor.ko
hikdrv/option.ko
hikdrv/uart232.ko
hikdrv/usbserial.ko
hikdrv/usb_wwan.ko
hisdrv/acodec.ko
hisdrv/clkcfg_hi3516a.sh
hisdrv/clkcfg_hi3516d.sh
hisdrv/extdrv/
hisdrv/extdrv/sil9034.ko
hisdrv/extdrv/sensor_i2c.ko
hisdrv/extdrv/ssp_pana.ko
hisdrv/extdrv/sil9024.ko
hisdrv/extdrv/tlv_320aic31.ko
hisdrv/extdrv/ssp_sony.ko
hisdrv/extdrv/ssp_ad9020.ko
hisdrv/extdrv/pwm.ko
hisdrv/hi3516a_adec.ko
hisdrv/hi3516a_aenc.ko
hisdrv/hi3516a_ai.ko
hisdrv/hi3516a_aio.ko
hisdrv/hi3516a_ao.ko
hisdrv/hi3516a_base.ko
hisdrv/hi3516a_chnl.ko
hisdrv/hi3516a_h264e.ko
hisdrv/hi3516a_h265e.ko
hisdrv/hi3516a_isp.ko
hisdrv/hi3516a_ive.ko
hisdrv/hi3516a_jpege.ko
hisdrv/hi3516a_pm.ko
hisdrv/hi3516a_rc.ko
hisdrv/hi3516a_region.ko
hisdrv/hi3516a_sys.ko
hisdrv/hi3516a_tde.ko
hisdrv/hi3516a_vda.ko
hisdrv/hi3516a_venc.ko
hisdrv/hi3516a_vgs.ko
hisdrv/hi3516a_viu.ko
hisdrv/hi3516a_vou.ko
hisdrv/hi3516a_vpss.ko
hisdrv/hifb.ko
hisdrv/hi_media.ko
hisdrv/hi_mipi.ko
hisdrv/hi_rtc.ko
hisdrv/hiuser.ko
hisdrv/load3516a
hisdrv/load3516d
hisdrv/pinmux_hi3516a.sh
hisdrv/sysctl_hi3516a.sh
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0060: 0x00000000 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0064: 0x00000000 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0068: 0x00000000 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f006c: 0x00000000 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0004: 0x00000000 --> 0x00000002
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f006c: 0x00000001 --> 0x00000001
[END]
Insmod ko start...
Insmod ko end...
Press Ctrl-C to stop ...
infd read End
Unix bus 0 .
netprocess version: 1.6.1 [11:02:19-Jul 18 2015].
[04-18 08:05:16][pid:1202][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[04-18 08:05:16][pid:1208][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[04-18 08:05:16][pid:1208][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[04-18 08:05:16][pid:1208][UNI_IF][ERROR]communicaite_to_davinci failed!!!
==================PPPoE is disable!!!
[04-18 08:05:17][pid:1202][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[04-18 08:05:17][pid:1208][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[04-18 08:05:17][pid:1208][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[04-18 08:05:17][pid:1208][UNI_IF][ERROR]communicaite_to_davinci failed!!!
App Start ...
[04-18 08:05:18][pid:1202][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[04-18 08:05:18][pid:1208][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[04-18 08:05:18][pid:1208][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[04-18 08:05:18][pid:1208][UNI_IF][ERROR]communicaite_to_davinci failed!!!
IEfile uncompressed.


BusyBox v1.19.3 (2015-05-14 15:28:53 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

BusyBox v1.2.1 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.

# [04-18 08:05:19][pid:1202][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[04-18 08:05:19][pid:1208][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[04-18 08:05:19][pid:1208][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[04-18 08:05:19][pid:1208][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[04-18 08:05:20][pid:1202][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[04-18 08:05:20][pid:1208][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[04-18 08:05:20][pid:1208][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[04-18 08:05:20][pid:1208][UNI_IF][ERROR]communicaite_to_davinci failed!!!
Bingo errno 2 ,/home/process/davinci.lzma /home/process/davinci.lzma
Unix bus End
[04-18 08:05:21][pid:1202][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[04-18 08:05:21][pid:1208][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[04-18 08:05:21][pid:1208][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[04-18 08:05:21][pid:1208][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[04-18 08:05:22][pid:1202][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[04-18 08:05:22][pid:1208][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[04-18 08:05:22][pid:1208][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[04-18 08:05:22][pid:1208][UNI_IF][ERROR]communicaite_to_davinci failed!!!
[04-18 08:05:23][pid:1202][IPC][ERROR]daemon can not find Dst process.load_type 0x10012 is_need_ack 1
[04-18 08:05:23][pid:1208][IPC][ERROR] from daemon ack, dst not work len 0 , load_type is [10012]
[04-18 08:05:23][pid:1208][UNI_IF][ERROR]65554:ipc_unix_call_service failed, ret = -3.
[04-18 08:05:23][pid:1208][UNI_IF][ERROR]communicaite_to_davinci failed!!!
insmod: can't insert '/home/event_notify.ko': File exists
[04-18 08:05:28][pid:1208][UNI_IF][ERROR]



===Davinci Init Finish...
umount: can't forcibly umount /mnt/mmc01: Invalid argument
insmod: can't insert '/home/alarm.ko': File exists
umount: can't forcibly umount /mnt/mmc01: Invalid argument
===Davinci Init Finish...
umount: can't forcibly umount /mnt/mmc01: Invalid argument
insmod: can't insert '/home/alarm.ko': File exists
umount: can't forcibly umount /mnt/mmc01: Invalid argument
Click to expand...
 
That's a pity.
Hikvision do have a habit of closing off any 'interesting' methods that appear in public.
The later bootloaders and the kernel provide fewer and fewer opportunities.
You can't even tftp boot a uImage now.
 
These are the commands I have in this u-boot(I do have another cam with an older u-boot however I would like to sort this cam first)



U-Boot 2010.06-153460 (Oct 10 2015 - 18:21:59)

NAND: 128 MiB
Hit Ctrl+u to stop autoboot: 0
HKVS # help
? - alias for 'help'
base - print or set address offset
bootss - boot from snapshot image
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
ddr - ddr training function
format - format flash except bootloader area
go - start application at address 'addr'
help - print command description/usage
loadk - load kernel to DRAM
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables
update - update digicap.dav
updateb - update bootloader
upf - update firmware, format and update (factory use)
version - print monitor version
Click to expand...
 
rearanger said:
These are the commands I have in this u-boot
Click to expand...
Yes, not a lot of any use there any more.

No sf flash commands.
No SPI flash commands.
No tftp to download stuff and write it to flash or boot from it.

I wonder if the update command with an invalid / unavailable argument still leaves the min-system kernel and file system running?
That was also a useful way in.
 
rearanger said:
Does uImage contain files?
Click to expand...
Yes, it can do, but this varies with the specific uImage. Binwalk can provide some good clues.

Here is an example (with extra verbiage) :
Code: 
#!/bin/sh
# This script holds the steps to unpack uImage file from the IPC_R0_EN_STD_5.4.0_160530 firmware.
# The offsets will very likely be specific to that version of firmware. There is no attempt to
# use logic to make it universal - it's as much a memory-jogger as anything.
#
# First of all we copy out the 64 byte u-boot header. We probably don't need it as mkimage will re-create
# with updated CRCs etc.
dd bs=1 if=hImage_orig of=u-boot_header count=64
#
# The part that remains after the u-boot header we'll call mainbody.
# In the NVR firmware, this isn't yet the pure Linux kernel as it has a small uncompressor at the beginning, before
# the main section which is LZMA compressed. But how is the camera equivalent constructed?
dd ibs=1 obs=512 if=hImage_orig of=mainbody skip=64
#
# So we need to strip off that uncompressor to leave the gzipped main section.
# But it will be useful to have the uncompressor by itself if we want to put the pieces together later.
# dd bs=1 if=zImage of=uncompressor count=10920
# dd ibs=1 skip=64 if=uImage_orig of=uncompressor count=16339
#
# For the packing operation of the uncompressed mainbody of uImage back to the lzma-compressed version, there is an
# extra tail of 59 bytes on uImage_orig based on complaints about trailing garbage from gunzip.
# This value determined empirically by using 'head -c -59 mainbody.gz > test.gz' until no complaints about trailing
# zero or garbage.
# Locations within maybe are accessed by the 'uncompressor'
# So in the interests of getting a fully reversible unpack / pack process, we can strip off the tail and append it during pack.
#
# tail -c 55 uImage_orig > uImage_orig_extra_tail
#
# And now the main body - which is the original uImage with the 64-byte u-boot header and the uncompressor stripped off.
#dd ibs=1 obs=512 if=uImage_orig of=mainbody_1.gz skip=16403
#head -c -55 mainbody_1.gz > mainbody.gz
#
# On the basis that the remaining main section is purely gz compressed, it can now be extracted. The option to process
# what may be trailing garbage is used, or xz (unlzma) gives an error:
# "unlzma: mainbody.lzma: Compressed data is corrupt"
# This might be caused by the 'uImage_extra_tail. **It is ** If the 62 bytes is stripped off, no more unlzma error.
# I haven't been able to find a definitive definition of what the EOS (End Of Stream) marker is.
# And this needs some different options now that I have installed 'LZMA utils' to see things like header info etc.
# unlzma -k -f --single-stream mainbody.lzma
#gunzip -k -v mainbody.gz
#
# Now we have the full decompressed Linux kernel.
# There are at least 2 cpio archives held within it, which are used for the initramfs / initrd function.
# The first holds dev, dev/console, root and is at offset 3,930,548
# The second holds bin and so on and is at offset 5,105,056
#
# But - there is an embedded chunk of just over 1MB in between these 2 cpio headers that may be part of the kernel.
# Perhaps that first block of 3 cpio headers (dev, dev/console, root) are there to obfuscate the following binary data.
# So lets extract the possible kernel, and the (valid) 2nd cpio archive section like so:
#
# dd ibs=1 obs=1 if=mainbody of=kernel count=5105056
dd ibs=1 obs=512 if=hImage_orig of=cpio_1 skip=133036
#dd ibs=1 obs=512 if=mainbody of=cpio_2 skip=5105056
#
# It may be that the order of the files in the uImage matters - so lets preserve the file list as it comes.
cpio -t < cpio_1 > cpio_1_files_list.txt
#
# And finally the extraction of the cpio archives to reveal the full contents of the initial file system.
# We need the privileged mode to handle the dev/null and dev/console
[ ! -d cpio_extract ] && mkdir cpio_extract
cd cpio_extract
sudo cpio -idvm < ../cpio_1 2>../transcript1.txt
#
#sudo cpio -idvm < ../cpio_2 2>../transcript2.txt
#
#
# Now, for convenience, copy the needed files over to the 'packing' folder where they can if required be modified.
#cd ..
#cp --preserve=all uncompressor ../packing
#cp --preserve=all mainbody ../packing/mainbody_modified
#cp --preserve=all uImage_orig_extra_tail ../packing
#cp --preserve=all kernel ../packing
#sudo cp --preserve=all -R cpio_extract ../packing
#cp --preserve=all cpio_files_list.txt ../packing
# That's the lot. For now.
 
with ethernet plugged in , just seems to keep retrying

HKVS # update
ETH0: PHY(phyaddr=3, mii) link UP: DUPLEX=FULL : SPEED=100M
MAC: 28-57-BE-2C-4A-64
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.
Download to address: 0x82000000
Downloading: *
ARP Retry count exceeded; starting again
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'digicap.dav'.
Download to address: 0x82000000
Downloading: *
Click to expand...
 
OK, so tftp is available for use.
That may be within the recovery environment, or it may be within the bootloader, just not in the available commands.

Suggestion:
Whilst it's trying the download, hit it with a Control-C and see what environment it gets left in.

Give it a file digicap.dav with invalid contents and see where it ends up after it is rejected.

The 'help' command should make it clear what environment is running, if the prompt does not.

**edit**
Another thing I've done is to masquerade a uImage as a digicap.dav and boot it from memory after it's been downloaded and rejected.
But I have a recollection that in the newer bootloaders they clean the memory after the rejection to inhibit that sneak path.
 
Managed to get some extra commands in shell

HKVS # go.
ETH0: PHY(phyaddr=3, mii) link UP: DUPLEX=FULL : SPEED=100M
MAC: 28-57-BE-2C-4A-64
TFTP from server 192.0.0.128; our IP address is 192.0.0.64
Download Filename 'sec.bin'.
Download to address: 0x81fffed8
Downloading: # [ Connected ]
################################ [ 1.000 MB]
#
done
Bytes transferred = 1100416 (10ca80 hex)


U-Boot 2010.06 (Nov 27 2017 - 10:43:55)

NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
Block:128KB Page:2KB Chip:128MB*1 OOB:64B ECC:4bit/512
128 MiB
Check spi flash controller v350... Found
Can't find a valid spi flash chip.
Can't find a valid spi flash chip.
*** Warning - bad CRC or NAND, using default environment

In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
Wrong Image Format for bootm command
ERROR: can't get kernel image!
hisilicon # help
? - alias for 'help'
base - print or set address offset
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
bootss - boot from snapshot image
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
ddr - ddr training function
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
tftp - tftp - download or upload image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
hisilicon #
hisilicon # go 0x82000000
## Starting application at 0x82000000 ...


U-Boot 2010.06 (Nov 27 2017 - 10:43:55)

NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
Block:128KB Page:2KB Chip:128MB*1 OOB:64B ECC:4bit/512
128 MiB
Check spi flash controller v350... Found
Can't find a valid spi flash chip.
Can't find a valid spi flash chip.
*** Warning - bad CRC or NAND, using default environment

In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Click to expand...
 
You must log in or register to reply here.
Top Bottom