Hello friends!

[matrhint]

Hi,

Just doing the thing you do when you join a forum like this--but please don't take that as a reason to stop reading.

I have quite a few interests I feel that will be served well in this forum.
Getting into collecting cheap Chinese cameras, revealed how almost all of them seem to be running on similar hardware (boards look different, but have all the same parts; it appears that several brands will sell the same camera in a different cases and only vary in having different passwords, update file locations, device name, which server your video is being sent to, and so on. I feel like their software has started keeping people out of their own cameras and I want to make my camera work as I want it to. The Cameras that I own are Momentum brand Cori... they call it a mocam720, but the internals don't look like the one on fccid. There was a person who did a great security vulnerability report on how the camera was insecure in so many ways. I reproduced his steps with firmware exploration on the newest update file. I want to learn from the people who know how to modify firmware or build new firmware to replace what's on there and help other people put some cheap cameras to use.

I found a couple things strange. Every website that has some sort of link to a camera is the same cookie cutter website about how you can contact their engineering team to make your device an iot device. Though looking through some folders in the unsquashed_fs there was a folder named what I am to assume was the IC manufacturer-- Fullhan. Because the IC on my ip camera has a very generic stencil that doesn't appear to correlate to a part number ( I assume it is all ran in huge batches and it is more about keeping track of what company a camera belongs to) . I also noticed some weirdness with the file system, it seemed weird. I think it may be running rt-thread because there is a partition called rtthread and on rt-thread's supported hardware, there is a listing for a FH8620. And on the page it showed that rt-thread is supported by or partners with Fullhan.

With a few more hours on the ole google box, I found many cameras with the same processor and want to know if the firmware is the only real difference other than the pcb arrangements, as they seem to be the same circuits. I found the openipc project and it seems to confirm my hypothesis. Can someone confirm if that is true? I understand that there are several processor types, but they all seem to function across all devices that have the same processor type.

My main goal is to find or diy or alternative firmware -- like openipc, but with options to play doom, or if nothing else, publish a message to home assistant.

I know it is silly, but it seems like the tools are there; all you need to do is build the new firmware and build it into a fake update file and then re-flash your device. Is this a bad assumption, based on another bad assumption? If these cookie cutter embedded engineering websites all are doing the same thing for different companies (or just fake companies) what makes it so hard to do for a regular guy?

TLDR: I want to know if there is a SDK for making firmware for these cameras like Yocto, RT-thread, or embeded OS sdk and have experience with this process?

Thanks for reading my way too long introduction.

Special thanks to the person who attempts to answer my question.

 

[matrhint]

Well here I am back discussing what I have found. It seems like RT-Thread is a sdk for firmware building for Chinese cameras and other IOT things. I have emailed a few addresses That were open from the Fullhan website for some support with their processors. Looking around on the internet I found some people building their own firmware for cameras, but they were all from 3+ years ago. The processor is a fh8812, not a fh8620 as I suspected.

After searching more I found this: TUYA_IPC_SDK/README.md.bk at master · TuyaInc/TUYA_IPC_SDK ; looks like they got a driver!

 

[matrhint]

GD25Q64C - GD25Q Family NOR Flash

GD25Q64C



PCF8563: Real-Time Clock/Calendar

PCF8563 | NXP Semiconductors



DM9051 SPI to Ethernet Controller

DM9051 Datasheet | DAVICOM - Datasheetspdf.com

 

[RabidGorilla]

It seems HikVision DS-HD1 is built on this same platform. I have a flash dump and serial console. Surprisingly, many u-boot commands are intact.

• Same flash: GD25Q64C
• Has drivers for DM9051 SPI Ethernet and I suspect some test points on the board are for connecting this NIC for debugging.
• Running strings on the dump gives me the following
  • Built from fh8830_rtos_doorbell example provided by RT
  • Also supports ENC28J60 10Mbps SPI Ethernet?
  • AK7755 audio DSP
  • OmniVision OV9750 sensor OV9750 | OMNIVISION
  • Silicon Optronics (SOI) H62 MIPI 72* sensor?
  • Uses libavcodec 57.34.100

Questions

• The minimal shell available over UART hasn't accepted a single command I've tried. What commands are available?
• There are several public keys in the dump, I'm assuming to verify firmware updates... can they be replaced and a modified firmware then flashed using the standard method?
• Any way to modify init args to get a more open shell?
• Binwalk doesn't give me much,just config and audio files. How can the remaining filesystems be extracted?
• Can third-party firmware be built using the RT-Thread SDK Doorbell example? Drivers for much of the hardware seems to exist somewhere on Github. Can it be replaced with Linux?

U-Boot 2010.06-svn-43155 (Oct 30 2018 - 10:01:33)
Find sd card.
DM9051-MAC
Hit Ctrl+u to stop autoboot:  3  2  0
HKVS # help
?       - alias for 'help'
arc_go  - start application at address 'addr'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
editenv - edit environment variable
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
format  - format flash except bootloader area
go      - go xxx.bin thru network
go_orig - start application at address 'addr'
gos     - go xxx.bin thru serial
help    - print command description/usage
iminfo  - print header information for application image
imxtract- extract a part of a multi-image
loadb   - load binary file over serial line (kermit mode)
loadk   - load kernel to DRAM
loadm   - load mini to DRAM
loads   - load S-Record file over serial line
loadss  - load safe system
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
mtest   - simple RAM read/write test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pinctrl - Pin Ctrl
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
sleep   - delay execution for some time
source  - run script from memory
sspi    - SPI utility commands
tftpboot- boot image via network using TFTP protocol
upa     - update app image
uparc   - update arc
update  - update digicap.dav
updateb - update ramboot and uboot
updateu - update uboot
updevinfo- update devinfo
upf     - update firmware, format and update (factory use)
upk     - update uImage
upmcu   - update mcu
upmini  - update minisys
upram   - update ramboot
upres   - update res
version - print monitor version
wdt     - WDT utility commands

pinctrl

HKVS # pinctrl printall
id        name    addr         reg     sel      ie      oe    pupd
00    CIS_HSYNC    0xf0000080    0x00011000    0000    -001    0000    -002
01    CIS_VSYNC    0xf0000084    0x00011000    0000    -001    0000    -002
02    CIS_PCLK    0xf0000088    0x00011000    0000    -001    0000    -002
03     CIS_D_0    0xf000008c    0x00011000    0000    -001    0000    -002
04     CIS_D_1    0xf0000090    0x00011000    0000    -001    0000    -002
05     CIS_D_2    0xf0000094    0x00011000    0000    -001    0000    -002
06     CIS_D_3    0xf0000098    0x00011000    0000    -001    0000    -002
07     CIS_D_4    0xf000009c    0x00011000    0000    -001    0000    -002
08     CIS_D_5    0xf00000a0    0x00011000    0000    -001    0000    -002
09     CIS_D_6    0xf00000a4    0x00011000    0000    -001    0000    -002
10     CIS_D_7    0xf00000a8    0x00011000    0000    -001    0000    -002
11     CIS_D_8    0xf00000ac    0x00011000    0000    -001    0000    -002
12     CIS_D_9    0xf00000b0    0x00011000    0000    -001    0000    -002
13    CIS_D_10    0xf00000b4    0x00011000    0000    -001    0000    -002
14    CIS_D_11    0xf00000b8    0x00011000    0000    -001    0000    -002
15    MAC_RMII_CLK    0xf00000bc    0x00101000    0000    -001    0000    0000
16    MAC_REF_CLK    0xf00000c0    0x10101000    0000    -001    -001    0000
17     MAC_MDC    0xf00000c4    0x00101000    0000    -001    0000    0000
18    MAC_MDIO    0xf00000c8    0x00101000    0000    -001    0000    0000
19      GPIO32    0xf00000cc    0x01001000    0001    -001    0000    0001
20      GPIO33    0xf00000d0    0x01101000    0001    -001    0000    0000
21      GPIO36    0xf00000d4    0x01101000    0001    -001    0000    0000
22    MAC_RXD_0    0xf00000d8    0x00101000    0000    -001    0000    0000
23    MAC_RXD_1    0xf00000dc    0x00101000    0000    -001    0000    0000
24      GPIO37    0xf00000e0    0x01001000    0001    -001    0000    0001
25      GPIO38    0xf00000e4    0x01001000    0001    -001    0000    0001
26    MAC_RXDV    0xf00000e8    0x00101000    0000    -001    0000    0000
27      GPIO41    0xf00000ec    0x01001000    0001    -001    0000    0001
28    MAC_TXD_0    0xf00000f0    0x00101000    0000    -001    0000    0000
29    MAC_TXD_1    0xf00000f4    0x00101000    0000    -001    0000    0000
30      GPIO42    0xf00000f8    0x01001000    0001    -001    0000    0001
31      GPIO43    0xf00000fc    0x01001000    0001    -001    0000    0001
32    MAC_TXEN    0xf0000100    0x00101000    0000    -001    0000    0000
33    MAC_RXER    0xf0000104    0x00101000    0000    -001    0000    0000
34      GPIO45    0xf0000108    0x01011000    0001    -001    0000    -002
35       GPIO0    0xf000010c    0x04001000    0004    -001    0000    0001
36       GPIO1    0xf0000110    0x04001000    0004    -001    0000    0001
37       GPIO2    0xf0000114    0x04001000    0004    -001    0000    0001
38       GPIO3    0xf0000118    0x04001000    0004    -001    0000    0001
39       GPIO4    0xf000011c    0x04001000    0004    -001    0000    0001
40       GPIO5    0xf0000120    0x03001000    0003    -001    0000    0001
41       GPIO6    0xf0000124    0x03001000    0003    -001    0000    0001
42       GPIO7    0xf0000128    0x03001000    0003    -001    0000    0001
43       GPIO8    0xf000012c    0x03001000    0003    -001    0000    0001
44       GPIO9    0xf0000130    0x03001000    0003    -001    0000    0001
45      GPIO10    0xf0000134    0x02001000    0002    -001    0000    0001
46      GPIO11    0xf0000138    0x02001000    0002    -001    0000    0001
47     CIS_CLK    0xf000013c    0x00101000    0000    -001    0000    0000
48      GPIO13    0xf0000140    0x01101000    0001    -001    0000    0000
49      GPIO14    0xf0000144    0x01101000    0001    -001    0000    0000
50    UART0_RX    0xf0000148    0x00001000    0000    -001    0000    0000
51    UART0_TX    0xf000014c    0x00001000    0000    -001    0000    0000
52    I2C0_SCL    0xf0000150    0x00001000    0000    -001    0000    0000
53    I2C0_SDA    0xf0000154    0x00001000    0000    -001    0000    0000
54      GPIO61    0xf0000158    0x03001000    0003    -001    0000    0000
55      GPIO60    0xf000015c    0x03001000    0003    -001    0000    0000
56    SSI0_CLK    0xf0000160    0x00001000    0000    -001    0000    0001
57    SSI0_TXD    0xf0000164    0x00001000    0000    -001    0000    0001
58      GPIO54    0xf0000168    0x01001000    0001    -001    0000    0001
59      GPIO55    0xf000016c    0x01001000    0001    -001    0000    0001
60    SSI0_RXD    0xf0000170    0x00001000    0000    -001    0000    0001
61      SD0_CD    0xf0000174    0x01101000    0000    -001    0000    0001
62      SD0_WP    0xf0000178    0x01101000    0000    -001    0000    0001
63     SD0_CLK    0xf000017c    0x00001000    0000    -001    0000    0001
64    SD0_CMD_RSP    0xf0000180    0x00001000    0000    -001    0000    0001
65    SD0_DATA_0    0xf0000184    0x00001000    0000    -001    0000    0001
66    SD0_DATA_1    0xf0000188    0x00001000    0000    -001    0000    0001
67    SD0_DATA_2    0xf000018c    0x01101000    0000    -001    0000    0001
68    SD0_DATA_3    0xf0000190    0x05101000    0000    -001    0000    0001
69      SD1_CD    0xf0000194    0x00001000    0000    -001    0000    0001
70      SD1_WP    0xf0000198    0x00001000    0000    -001    0000    0001
71     SD1_CLK    0xf000019c    0x00001000    0000    -001    0000    0001
72    SD1_CMD_RSP    0xf00001a0    0x00001000    0000    -001    0000    0001
73    SD1_DATA_0    0xf00001a4    0x00001000    0000    -001    0000    0001
74    SD1_DATA_1    0xf00001a8    0x00001000    0000    -001    0000    0001
75    SD1_DATA_2    0xf00001ac    0x00001000    0000    -001    0000    0001
76    SD1_DATA_3    0xf00001b0    0x00001000    0000    -001    0000    0001

printenv

HKVS # printenv
bootcmd=loadss;run runargs;bootm
bootdelay=3
baudrate=115200
update_flag=update_ok
serverip=192.0.0.128
bldfile="u-boot_y4.bin"
runargs=set bootargs console=ttyS0,115200 root=/dev/ram0 mem=64M  ethaddr=${ethaddr} ip=${ipaddr}:${serverip} dbg=0
phymode=RMII
ethact=DM9051-MAC
update_source=sd
boot_from=PART_MAIN
ipaddr=192.0.0.64
PT_TEST=TRUE
stdin=serial
stdout=serial
stderr=serial
verify=n
ethaddr=64:f2:fb:XX:XX:XX

Environment size: 420/65532 bytes

sf probe

HKVS # sf probe 0
8192 KiB W25Q64 at 0:0 is now current device

update help

HKVS # help uparc
uparc - update arc

Usage:
uparc - No additional help available.
HKVS # help update
update - update digicap.dav

Usage:
update - No additional help available.
HKVS # help updateb
updateb - update ramboot and uboot

Usage:
updateb - No additional help available.
HKVS # help updateu
updateu - update uboot

Usage:
updateu - No additional help available.
HKVS # help updevinfo
updevinfo - update devinfo

Usage:
updevinfo - No additional help available.

HKVS # help upf
upf - update firmware, format and update (factory use)

Usage:
upf - No additional help available.
HKVS # help upk
upk - update uImage

Usage:
upk - No additional help available.
HKVS # help upmcu
upmcu - update mcu

Usage:
upmcu - No additional help available.
HKVS # help upmini
upmini - update minisys

Usage:
upmini - No additional help available.
HKVS # help upram
upram - update ramboot

Usage:
upram - No additional help available.
HKVS # help upres
upres - update res

Usage:
upres - No additional help available.

RT-Thread boot

HKVS # boot
app start
load app to 0xa0000000 ...
header_data.u32Magic is 0xa7b4c9f8
header_data.u32header_len  is 0x10
header_data.u32RawDataLen is 0x62000
rtt stage1  head data
Done!
## Starting application at a0000000 ...
2.1.0 build Nov  1 2021 - 13:44:57 svn-00000
<ISP>get first stage isp params from mcu.failed!##
<ISP>get first stage isp params from mcu.failed!
set isp_aclk freq: 160000000 hz
GD64 detection

[RTC] not init done.
pbootconf=0xffffffff,=0x00230000
app mode
JPEG init success!
vou driver not install
bgm driver not install
fd driver not install
time costs: 527ed0e - 53055f6 - 536337c
GPIO40:

ERROR: RTC is not ready
lwIP-2.0.2 initialized!
288: ENC28J60_INT = 1
854-spi30_spi2net_detect_enc28
857-spi30_spi2net_detect_enc28
863-spi30_spi2net_detect_enc28
871-spi30_spi2net_detect_enc28
873-spi30_spi2net_detect_enc28
884-spi30_spi2net_detect_enc28
888-spi30_spi2net_detect_enc28
890-spi30_spi2net_detect_enc28
893-spi30_spi2net_detect_enc28
898-spi30_spi2net_detect_enc28
ENC28J60 PHY ID not correct!

emac_rev:255

phy_rev:0F

phy_pn:3F

phy_id:01FFFFF8

spi30_spi2net_detect_enc28 error= -8
spi30_spi2net_detect_dm9051 start
failed to read device ID
spi30_spi2net_detect_dm9051 error= -1
fh_pinctrl_sdev start
SD0:

sd mmc_obj->id =0 mmc_obj->irq=24
cd_pin_valid=1
init card connected
##exe sd card mmcsd_detect:964  sd_hw_power reset
fh_pinctrl_sdev end
try detect SD card
mtdblock10 File System initialized!
mtdblock8 File System initialized!
ak7755_drv_init
user_main...
main_init----------------------------
FD init success!
bgm init success!
[LIBSYS INFO]: Libsys svn version is 42737
[LIBSYS INFO]: mcu_comm is not support.
[LIBSYS INFO]: val=309, adc_bit_num=10, max=3300mV, cur=995mV, bat_vol=1990mV
[LIBSYS INFO]: Libsys init ok!
[wdt] set topval: 4
[wdt] set topval: 9
[LIBSYS INFO]: watchdog_init success
[01 00:01:27][OTHER][ERROR]set_ap_enable !!!
GenerateDefaultBootParam_DB1
[LIBSYS INFO]:init_boot_params ret=0  [1]
init_core_info ret=0 nor_size=8 ram_size=128
dev_log_start_task begin
ask begin
size=8 ram_size=128
..
ERROR: fh_mmc_get_response, get response timeout, RINTSTS: 0x104
fh_mmc_request,get response returns -2, cmd: 5
##exe mmcsd_detect:1034
[mmcsd_send_app_op_cond:446] ocr=0x0
[mmcsd_send_app_op_cond:466] ocr=0, cmd.resp[0]=0x40ff8000, i=100
[mmcsd_send_app_op_cond:497] read rocr=0x40ff8000
##exe sd card mmcsd_detect:1041
[mmcsd_sd_init_card:620] set ocr to HCS, ocr=0x300000
[mmcsd_send_app_op_cond:446] ocr=0x40300000
dev_log_start_task
dev_log_start_task re[mmcsd_send_app_op_cond:481] CARD_BUSY, cmd.resp[0]=0xc0ff8000, i=98

*******************************************
csd->csd_structure=0x1
csd->taac=0xe
csd->nsac=0x0
csd->tran_speed=0x32
csd->card_cmd_class=0x5b5
csd->rd_blk_len=0x9
csd->rd_blk_part=0x0
csd->wr_blk_misalign=0x0
csd->rd_blk_misalign=0x0
csd->dsr_imp=0x0
csd->c_size=0xedc8
csd->c_size_mult=0x0
csd->r2w_factor=0x2
csd->wr_blk_len=0x9
csd->wr_blk_partial=0x0
csd->csd_crc=0x61

*******************************************

SD card csd_structure=1 capacity 31166976 KB
t 0
log_ctrl_task
start dev log ctrl!
log_mem_size: 16384
log file num 1
file_size 0
probe mmcsd block device!
rt_mmcsd_req_blk status=0
card flag has CARD_FLAG_SDHC, card->flag=0x3
found part[0], begin: 0x2, size:0x3b72320 29.740GB
dfs_filesystem_get_partition status=0,i=0
i=0 type=0xc o=0x2 n=0x3b72320
dfs_filesystem_get_partition status=255,i=1
set_stor_state state=1
mmcsd_wait_cd_changed:839  recv mmcsd_hotpluge_mb, sd_status=1
timer_add_element id:1
[01 00:01:27][DEVLOG][ERROR]zone:19 timzezone[-6:0], Dst enable:1, DSTBias:60, tz_index:190, start[3-2-0-2],end[11-1-0-2]
init_config_field [0] encrypt_cfg 44, hiksdk_cfg 3192, disk_cfg 4, ezvizcfg 788, reccfg 720, device_cfg 48
dsp_cfg 1576, isp_cfg 44, alarm_cfg 2100, time_cfg 52, network_cfg 892, preview_cfg 8, bsp_cfg 12, sadp_cfg 20
pt_cfg 2192
version_cfg.version=1024
ezvizcfg.foreign.tz_index 190
mkdir devinfo success
[01 00:01:27][CONFIG][ERROR]open failed! /devinfo/ipc_db
[01 00:01:27][CONFIG][ERROR]config_file_to_json error
[01 00:01:27][CONFIG][ERROR]recover_config_file
[01 00:01:27][CONFIG][ERROR]/data1/hujialiang5/work/bell/RTOS/app/config/config.c 185 can not open file /devinfo/ipc_db_backup
[01 00:01:27][CONFIG][ERROR]write_default_param
timer_add_element id:2
DB version = 400
create_bcm_config_file
get_wifi_bcm_country_code code:3 zone:19
create_new_bcm_config_file_v2 contry_code = 3, zone=19 ret=19
hwif dsp init beg
get_lenstype lenstype=1
[01 00:01:28][DSP][ERROR]init dsp: lenstype=1, enAK7755=0 b_isp_stard=0
[01 00:01:28][DSP][ERROR]init dsp: type=22 res:num=2 [0x101e 0x1014] [0x1063 0x0]
[01 00:01:28][DSP][ERROR]init dsp: viwide vihigh[0x0 0x0] viwide vihigh[0x0 0x0]
[01 00:01:28][DSP][ERROR]hwif_dsp_init: vitype 16, encChanCnt 2, device_type 165, bHaveMenu 0 b_fd:0
[01 00:01:28][DSP][ERROR]hwif_dsp_init: viType 38, hdr_mode 0, image_viH 1536, image_viW 2048, original_viW 2048, original_viH 1536, dspMemSize 64
powerLineFrequencyMode = 1
[01 00:01:28][DSP][ERROR]hwif_dsp_init: viStandard:4098 frame_rate 30
[01 00:01:28][DSP][ERROR]hwif_dsp_init:    resolution  30
[01 00:01:28][DSP][ERROR]hwif_dsp_init: index 0, resolution 0x101e[30], streamType 1001, audioType 0, videoType 2, bps 2097152, bpsType 0, fps f, IFrameInterval 60
[01 00:01:28][DSP][ERROR]hwif_dsp_init:    resolution  1
[01 00:01:28][DSP][ERROR]hwif_dsp_init: index 1, resolution 0x1001[1], streamType 1001, audioType 0, videoType 2, bps 131072, bpsType 0, fps 8, IFrameInterval 32
[dsp]global_param_init
[dsp]ShareQueueInit
[dsp]initSemaphore
[dsp]DSP_TO_HOST_CMD_SEND_SEM_ID
[dsp]DSP_TO_HOST_CMD_BACK_SEM_ID
[dsp]init_module_global_params
[dsp]InitHeapMem
[dsp]initStreamPack
[dsp]DSP_SYS_Init success
<ISP> isp stage 3 start
<ISP> inner_param->print_en 0
#############################
platform:rt_f2
version:10.0.67
build:  œ# ã
code:2684551168 release
#############################
<ISP> sensor_id = 38
<ISP> platform_start_isp success
pram len=9623
[AK7755] ak7755_write_ram RamNo=0, len=9623
nDSPRun = 33.
ram crc ok........
nDSPRun = 33.
ram crc ok........
hwif dsp init end ret=0
[dsp][venc.c][HostStartEncode]line:2009  [dsp]HostStartEncode chan = 0
[dsp][venc.c][venc_start_chan]line:1437  [dsp]venc_start_encode had started chan: 0
u32Text1Len: 0
[01 00:01:29][DSP][ERROR]stFlag not math S W,enable_ampm = 0, hourOsdType=0 stFlag=0
u32Text1Len: 0
u32Text1Len: 0
[dsp][venc.c][HostStartEncode]line:2009  [dsp]HostStartEncode chan = 1
u32Text1Len: 0
==== fast config_stand  [time:89 tick:416] ====
map_blcmode : mirrorType=0 from=0 *to=0
[01 00:01:29][SENSOR][ERROR]value = 40000 slow_shutter_mod = 0
[01 00:01:29][SENSOR][ERROR]value = 40000 map_val=33333 slow_shutter_mod = 0
[01 00:01:29][SENSOR][ERROR]config_hue value=50
[01 00:01:29][DSP][ERROR]stFlag not math S W,enable_ampm = 0, hourOsdType=0 stFlag=0
u32Text1Len: 0
u32Text1Len: 0
--------Set GOSD OK
register share memory type=6 size=1572864, malloc succ
hwif_rtc_read beg
hwif_rtc_read end
ispcfg.ccd.dayNightFilterType:2 input_mode:255
automode,cut to day!!!
<ISP>  Reload isp params when icr change
day_night_init end
w_start-311: (mode 0 sleep_flag 0) wifi_is_on 0
fh_wifi_init-382: Hik_Bcm_Driver version: V2.0.0
fh_wifi_init-383: SDK version: WICED-Studio-5.0
fh_wifi_init-384 sleep_flag: 0
read_data: ccode=US
regrev=0


##hik_conf_read_config: ccode=US,regrev=0
[WIFI]host_enable_oob_interrupt-112: gpio_set_irq_type(gpio 39) ret 0, then install sdio_oob_irq_handler
[WIFI]wwd_bus_sdio_download_firmware-899: wwd_bus_write_wifi_firmware_image() ret 0
[WIFI]wwd_bus_sdio_download_firmware-914: wwd_bus_write_wifi_nvram_image() ret 0
[WIFI]wwd_bus_init-406 loop_count 6
WLAN Firmware    : wl0: Nov 21 2017 12:38:05 version 7.45.100.9 (r CY) FWID 01-af476c14

[WIFI]w_start-417 wifi_mac : 80:91:33:AA:BB:B3
[WIFI]wwd_ethernetif_init-327
[WIFI]wwd_ethernetif_init-357 CALL low_level_init
[WIFI]low_level_init-169 netif->flags:0x2f (w0)
[WIFI]w_start-479: wifi_is_on = 1
ap_enable=1 sta_ssid= sta_len=0 active=1 wired=0
set ap enable !!!

[WIFI]exec_app_msg-1481 conf_type 2
[WIFI*dbg]wifi_mgmt_handle_msg-1233: msg->msg_type(0)
wwd_wifi_scan result:0

[WIFI][w_state chg]fh_wifi_change_state_by_scan_event-102 STA_DISCONNECTED->STA_SCANNING

[WIFI][w_state chg]fh_wifi_change_state_by_scan_event-102 STA_SCANNING->STA_DISCONNECTED
rt_sem_take result:0
w_sta_scan-1605: exec_app_msg(STA_SCAN) ret 0
[01 00:01:37][SIMPLECFG][ERROR]wifi_get_ap_list num = 14

----- REMOVED SSIDs/BSSIDs -----

[01 00:01:37][SIMPLECFG][ERROR]scan end:97, Thu Jan  1 00:01:37 1970
hdctril_init end
rtcp_init success.
[01 00:01:37][DEVLOG][ERROR]init_metadata_mem packetlen = 1460
[01 00:01:37][DEVLOG][ERROR]packetlen = 1460
[01 00:01:37][DEVLOG][ERROR]g_metadata_mem.base = -1587937244
[01 00:01:37][DEVLOG][ERROR]g_metadata_mem.totalsize = 93440
[01 00:01:37][DEVLOG][ERROR]g_metadata_mem.ridx = 0
[01 00:01:37][DEVLOG][ERROR]g_metadata_mem.widx = 0
[01 00:01:37][DEVLOG][ERROR]g_metadata_mem.packetlen = 1460
[01 00:01:37][DEVLOG][ERROR]g_metadata_mem.peer_packetlen = 1460
timer_add_element id:3
CRtspServer
StartServer
rtp_startport is 0
rtp_endport is 0
m_socket_family is AF_INET
pthreadSpawn start, the port is 554 change 10754
[01-01 00:01:37][1][a090a024]preview set send stream mode = 1
log_path: /devinfo/log/opensdk log_size: 102400 log_level: 3
talk_max_buf = 51200
cloud_max_channel 1
preview_link_max 4 channel_max_num 1 stream_max_num 3
playback_link_max 4
bLightreg:0 reg_mode1
[01 00:01:37][EZVIZ][ERROR]ezdevsdk_init lbs ip: litedev.ezvizlife.com, regmode 1
ezDevSDK_base_function_init
[01-01 00:01:37][1][a090a024]ezdev_set_sleep_status   enable:0
Shadow_extern_init
[SHADOW]Shadow_extern_init.....
[01-01 00:01:37][1][a090a024]ezDevSDK_Common_Module_RedirectReg 21
[01-01 00:01:37][1][a090a024]ezDevSDK_Common_Module_RedirectReg 32
Thread::Start
Thread::Start 0
Thread::Start
Thread::Start 0
timer_add_element id:1
timer_add_element id:2
ezDevSDK_talk_init
talk_extern_init
[01 00:01:37][EZVIZ][ERROR]ezDevSDK_alarm_init
[01-01 00:01:37][1][a090a024]ezdev_call_pic_init malloc succ
[01-01 00:01:37][1][a090a024]ezdev_call_pic_start_task success
alarm_extern_init
[01-01 00:01:37][1][a090a024]alarm ezDevSDK_Common_Module_RedirectReg type 300, command 18699, domain 2000
[01-01 00:01:37][1][a090a024]alarm ezDevSDK_Common_Module_RedirectReg type Alarm_Light, command 19213, domain 2000
[01-01 00:01:37][1][a090a024]alarm ezDevSDK_Common_Module_RedirectReg error, ret 7, command 4b0d
auto_defense_check start!
timer_add_element id:3
alarm_extern_init ret 7
ezDevSDK_cloud_init
ezDevSDK_cloud_init method:0
cloud_rec_init 352, channel 2
[01-01 00:01:38][1][a090a024]unlink mq /ezdev_cloudRecordMSGQ error, errno 2
ezdev_video_rec_init 1
ezdev_video_rec_init 2
ezdev_video_rec_init 16624, channel 2
[01-01 00:01:38][1][a090a024]cloud: create record thread ok
[01-01 00:01:38][1][a090a024]video_pic_start_task success
cloud_extern_init
cloud_extern_init end, 0
[01 00:01:38][EZVIZ][ERROR]ezDevSDK_preview_init
[01-01 00:01:38][1][a090a024]ezDevSDK_preview_init enter
[01-01 00:01:38][1][a090a024]preview_init enter, link_max 4 channel_max_num 1 stream_max_num 3
[01-01 00:01:38][1][a090a024]preview buf init, NO
Thread::Start
Thread::Start 0
Thread::Start
Thread::Start 0
[01 00:01:38][EZVIZ][ERROR]preview not support cmd 6
[01 00:01:38][EZVIZ][ERROR]preview not support cmd 6
[01 00:01:38][EZVIZ][ERROR]preview not support cmd 6
[01 00:01:38][EZVIZ][ERROR]preview not support cmd 6
[01 00:01:38][EZVIZ][ERROR]preview not support cmd 6
[01-01 00:01:38][1][a090a024]preview_extern_init enter
[01-01 00:01:38][1][a090a024]preview_extern_init exit
[01 00:01:38][EZVIZ][ERROR]ezdev_adaptive_video_task start ok...
[01 00:01:38][EZVIZ][ERROR]ezDevSDK_playback_init
[01-01 00:01:38][1][a090a024]playback_session_init, playback init success
[01 00:01:38][EZVIZ][ERROR]ezDevSDK_Start
[01 00:01:38][EZVIZ][ERROR]recv_msg_from_sdk_thread begin
[01 00:01:38][EZVIZ][ERROR]ezdevsdk_init end ret 0
set net_conns cb over
timer_add_element id:4
timer_add_element id:5
sadp_init, version V5.2.4
timer_add_element id:6
[01 00:01:38][BASE][ERROR]start net_broken_probe_task method=1 def_interface=4
timer_add_element id:7
set_dev_capability begin
kernel version = 0-0-0
kernel kern_svn_build_no = 0
update_flag = 514002002115000001
set_dev_capability end
timer_add_element id:8
[01 00:01:38][BSP][ERROR]recv_bsp_cmd_task begin
initSADP(e0=)iRet= -1
probe_net_connect, status 0
[01 00:01:38][BASE][ERROR]no interface can be used 1, chk 1
umount /mnt/mmc01
ezdev_start dev log ctrl!
log_mem_size: 16384
[01-01 00:01:38][1][a159ea24]ezDevSDK_report_status_yeild start, g_instance_count = 5
[01-01 00:01:38][1][a159ef24]unlink mq ezdev_MQ_CALLPIC error, error 2
[01-01 00:01:38][1][a159f124]unlink mq ezdev_MQ_VIDEOPIC error, error 2
[01-01 00:01:38][1][a159f524]preview_check_stream_thr enter...
[01 00:01:38][EZVIZ][ERROR]esdk_error 10, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
[01-01 00:01:38][1][a159f624]ezdev_sdk_kernel_get_stun error 10
[01-01 00:01:38][1][a159f724]RLIMIT getrlimit rlim_cur = 512 max = 5120
[01-01 00:01:38][1][a159fa24]playback session check thread start
[01 00:01:38][EZVIZ][ERROR]esdk_error 10, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
Shadow_extend_start_cb
[01-01 00:01:38][1][a159fd24]extend_start_cb
[01 00:01:38][BASE][ERROR]get_ipaddr ioctl error and errno=0
[01 00:01:38][BASE][ERROR]get_ipaddr ioctl error and errno=0
mount /dev/mmc01 - /mnt/mmc01
ezviz log file idx 0
ezviz log file num 1
file_size 0
[01-01 00:01:38][1][a159f524]stream send mode
[01 00:01:38][SD][ERROR]<sdctrl> partition /mnt/mmc01 mount success.
total sectors = 62333952
set_hdisk_param hd_param->totalSize=30436MaddPartition
[01-01 00:01:38][1][a159f724]setrlimit fail
[01-01 00:01:38][1][a159fd24]s:3445
[01-01 00:01:38][1][a159f724]RLIMIT X fd rlim_cur = 256 max = 256
talk_extend_start_cb
alarm_extend_start_cb
cloud_extend_start_cb
[01 00:01:38][RECORD][ERROR]cleanupRecbuf:Chan 0: [2097152][1585200] readIdx[1],  Clear recBuf, writeIdx[1585200], readIdx[0], streamLen[1585200], pChan->IFrameNums[0].
checkIdxFiles_comm 1
[01 00:01:38][HDMANAGER][ERROR]checkPartition: checkPartition ERROR
[01 00:01:38][HDMANAGER][ERROR]checkPartition_P failed!
[01 00:01:38][HDMANAGER][ERROR]part->bPicPart=0
checkIdxFiles_comm 1
checkIdxFiles_comm 2
checkIdxFiles_comm 3
checkIdxFiles_comm end
checkPartition rt_memalign 2 : idx0Fd = 13, idx1Fd = 14 files=117 mallocLen= 3744
[01 00:01:38][HDMANAGER][ERROR][1]readCurSegIdx:/mnt/mmc01 fileno:13 status:0
checkFileNo_comm rt_memalign avfiles=117[512] len=936
check_logfile 1
[01 00:01:38][SYSLOG][ERROR]check_logfile 2
[01 00:01:38][SYSLOG][ERROR]main log name /mnt/mmc01/logMainFile.bin
[01 00:01:38][SYSLOG][ERROR]cur log name /mnt/mmc01/logCurFile.bin
hdisk_operate 0xa03c86c0, name /mnt/mmc01/logMainFile.bin
add_operation_main_log_info enter
add_operation_main_log_info 1
add_operation_main_log_info 2
add_operation_main_log_info 3
add_operation_main_log_info 4
add_operation_main_log_info 5
add_operation_main_log_info end
open_log[15]
[01 00:01:38][SYSLOG][ERROR]new_hd write_loghead 1 /mnt/mmc01/logCurFile.bin
[01 00:01:38][SYSLOG][ERROR]new_hd write_loghead 2 /mnt/mmc01/logCurFile.bin
[01 00:01:38][SYSLOG][ERROR]new_hd success /mnt/mmc01/logCurFile.bin
[01 00:01:39][ONVIF][ERROR]ptz not support
[01 00:01:39][BASE][ERROR]get_ipaddr ioctl error and errno=0
[01 00:01:39][BASE][ERROR]no interface can be used 1, chk 1
initSADP(e0=)iRet= -1
[01 00:01:40][BASE][ERROR]get_ipaddr ioctl error and errno=0
[01 00:01:40][BASE][ERROR]no interface can be used 1, chk 1
initSADP(e0=)iRet= -1
[01 00:01:40][EZVIZ][ERROR]esdk_error 10, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
day_night_set_config_time :100
day_night_set_config_time :100
<ISP>  Reload isp params when icr change
[01 00:01:41][BASE][ERROR]get_ipaddr ioctl error and errno=0
[01 00:01:41][BASE][ERROR]no interface can be used 1, chk 1
initSADP(e0=)iRet= -1
[01 00:01:42][BASE][ERROR]get_ipaddr ioctl error and errno=0
[01 00:01:42][BASE][ERROR]no interface can be used 1, chk 1
initSADP(e0=)iRet= -1
[01 00:01:42][EZVIZ][ERROR]esdk_error 10, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
[01 00:01:43][BASE][ERROR]get_ipaddr ioctl error and errno=0
getDevModel dev_type:DS-HD1
[01 00:01:43][OTHER][ERROR]g_ap_support is true !!!
appweb: Error: Can't get sufficient random data for secure SSL operation. If SSL is used, it will not be secure.


111 HostSetAudioPlay CMD soundtype /home/voice/smt_st.aac play_time is 1 file_tpye 2
[01 00:01:43][BASE][ERROR]no interface can be used 1, chk 1
initSADP(e0=)iRet= -1
getDevModel dev_type:DS-HD1
[01 00:01:43][OTHER][ERROR]g_ap_support is true !!!
w_stop-1817: (mode 0) wifi_is_on 1
[WIFI]wifi_sta_reconn_thread_quit-1361: wifi_sta_reconn_thread_func() end

[WIFI]exec_app_msg-1481 conf_type 9
[WIFI*dbg]wifi_mgmt_handle_msg-1233: msg->msg_type(0)
[WIFI]wlan_stop-1193: mode 0 set wifi_mgmt_thread_quit = 1
[WIFI]wwd_wifi_set_down-3262: TO wwd_sdpcm_send_ioctl(SDPCM_SET, WLC_DOWN,)
[WIFI]wwd_wifi_set_down-3264: wwd_sdpcm_send_ioctl( SDPCM_SET, WLC_DOWN, buffer, 0, WWD_STA_INTERFACE ) success
[WIFI]fh_wifi_power_set-1470
wlan_stop-1206: wifi_is_on = 0
w_stop-1823: exec_app_msg(STOP) mode 0 ret 0
wwd_thread_quit-298
wwd_thread_func-440
[WIFI]wwd_sdpcm_quit-487
wwd_thread_quit-302: host_rtos_set_semaphore( &wwd_transceive_semaphore) ret 0
[WIFI]wwd_thread_quit-311: wwd_thread_func() end!!!
initSADP(e0=)iRet= -1
[01 00:01:44][EZVIZ][ERROR]esdk_error 10, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
initSADP(e0=)iRet= -1
[WIFI]wifi_mgmt_thread_wait_end-1170: wifi_mgmt_thread() end!!!
[01 00:01:46][BASE][ERROR]dhcp task already stop!
[01 00:01:46][BASE][ERROR]dhcp task already stop!
wifi_driver_init_imp do nothing!
initSADP(e0=)iRet= -1
[01 00:01:46][EZVIZ][ERROR]esdk_error 10, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
[dsp] check_file_last_frame return
net_bridge_start_imp noting to do!
net_bridge_alloc_addr_imp to do!
wifi_ap_star_imp
w_start-311: (mode 1 sleep_flag 0) wifi_is_on 0
initSADP(e0=)iRet= -1
fh_wifi_init-382: Hik_Bcm_Driver version: V2.0.0
fh_wifi_init-383: SDK version: WICED-Studio-5.0
fh_wifi_init-384 sleep_flag: 0
read_data: ccode=US
regrev=0


##hik_conf_read_config: ccode=US,regrev=0
[WIFI]host_enable_oob_interrupt-112: gpio_set_irq_type(gpio 39) ret 0, then install sdio_oob_irq_handler
[WIFI]wwd_bus_sdio_download_firmware-899: wwd_bus_write_wifi_firmware_image() ret 0
[WIFI]wwd_bus_sdio_download_firmware-914: wwd_bus_write_wifi_nvram_image() ret 0
[01 00:01:48][EZVIZ][ERROR]esdk_error 10, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
initSADP(e0=)iRet= -1
initSADP(e0=)iRet= -1
[01 00:01:50][EZVIZ][ERROR]esdk_error 10, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
initSADP(e0=)iRet= -1
[WIFI]wwd_bus_init-406 loop_count 5
WLAN Firmware    : wl0: Nov 21 2017 12:38:05 version 7.45.100.9 (r CY) FWID 01-af476c14

[WIFI]w_start-417 wifi_mac : 80:91:33:XX:XX:XX
[WIFI]wwd_ethernetif_init-327
[WIFI]wwd_ethernetif_init-357 CALL low_level_init
[WIFI]low_level_init-169 netif->flags:0x2f (ap)
[WIFI]w_start-479: wifi_is_on = 1

[WIFI]exec_app_msg-1481 conf_type 10
[WIFI*dbg]wifi_mgmt_handle_msg-1233: msg->msg_type(0)
assert wwd_sdpcm_send_ioctl-1180 IOCTL failed



==============================

ap: UP

ssid:softap_DeviceSerialNo

channel: 1

security: WPA2 Mixed

password: softap_DevicePwd


w_ap_on-1867: exec_app_msg(AP_ON) ret 0
initSADP(e0=)iRet= -1
gateway_set_imp
fork_exec_imp, start /dav/udhcpd &
Net share is running, ssid = softap_RemovedSerialNo, key = softap_RemovedDevicePwd
start_udhcpd: tv_sec 7200
stat ezviz.dav failed
main, before while...
stat ezviz.dav failed
[30]remove_upgrade_file fail
[01 00:01:52][SADP][ERROR]init_default_param !!!
sadp_init_mul_sock device:ap
initSADP(ap=)iRet= 0
stat ezviz.dav failed
[27]remove_upgrade_file fail
stat ezviz.dav failed
[24]remove_upgrade_file fail
stat ezviz.dav failed
[21]remove_upgrade_file fail
stat ezviz.dav failed
[18]remove_upgrade_file fail
stat ezviz.dav failed
[15]remove_upgrade_file fail
select litedev.ezvizlife.com:8666 returnvalue=0 ,error=-2stat ezviz.dav failed
[12]remove_upgrade_file fail
stat ezviz.dav failed
[9]remove_upgrade_file fail
stat ezviz.dav failed
[6]remove_upgrade_file fail
stat ezviz.dav failed
[3]remove_upgrade_file fail
stat ezviz.dav failed
[0]remove_upgrade_file fail
select :8666 returnvalue=0 ,error=-2[01 00:02:02][EZVIZ][ERROR]esdk_error 11, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
PIR[0x31,3,2600,3892]
select litedev.ezvizlife.com:8666 returnvalue=0 ,error=-2PIR[0x31,3,2600,2917]
select :8666 returnvalue=0 ,error=-2[01 00:02:12][EZVIZ][ERROR]esdk_error 11, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
select litedev.ezvizlife.com:8666 returnvalue=0 ,error=-2PIR[0x31,3,2800,3092]
select :8666 returnvalue=0 ,error=-2[01 00:02:22][EZVIZ][ERROR]esdk_error 11, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
select litedev.ezvizlife.com:8666 returnvalue=0 ,error=-2select :8666 returnvalue=0 ,error=-2[01 00:02:32][EZVIZ][ERROR]esdk_error 11, othercode 0, lbs_connect net_work_connect ip error, server:litedev.ezvizlife.com, ip:, port:8666
PIR[0x31,3,3300,3346]

 

[RabidGorilla]

Some updates for you.

RT-Thread removed the FH8620 BSP because the GPLv2 license of the BSP provided by Fullhan conflicts with the license that is used by the RT-Thread project (Apache). The RT-Thread FH8620 BSP is still available by downloading the old release of RT-Thread or browsing Github, but that's not much use if the CPU is actually a FH8812. Unfortunately, development resources for Fullhan CPUs are not easy to find.

GD25Q64C - GD25Q Family NOR Flash

GD25Q64C

GigaDevice GD25Q are interchangeable with Winbond W25Q. The Winbond SPI flash source can be copied and the identification of GigaDevice ICs can be added - I don't think any other changes are necessary. It appears that this is what HikVision has done in their cameras to add support for GigaDevice parts. My device identifies GigaDevice GD25Q64 as a Winbond W25Q64 during boot.

DM9051 SPI to Ethernet Controller

DM9051 Datasheet | DAVICOM - Datasheetspdf.com

This appears to be supported by FH8830 and FH8630 in all other devices that I've looked into. It may be worth flashing a kernel from one of those to see what happens, but you should have a full flash backup and a programmer to restore. It's very likely that the kernel will not start.