Help unbricking chinese cam

W8CLA

n3wb
Joined
Jun 4, 2019
Messages
3
Reaction score
0
Location
Ohio
Hello all

I jumped the gun a bit too soon while trying to upgrade firmware on my Chinese ip camera and power cycled it. I've tried different things off and on over the past few months to unbrick it with no success. I have no clue what I'm doing really and I've probably fubared it but figured I'd try and get the experts opinions. It's currently stuck in a boot loop, I can access u-boot through the serial connection and tftp. If I issue run up it starts downloading the update.img but hangs shortly after the download starts. If I issue run dr it downloads but gives an error saying the erase area was locked
 

Attachments

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
starts downloading the update.img
Has this been supplied by the manufacturer as a match for the camera?
What is the model number?
I'm guessing it's a Xiongmaitech model.

By the way - check out the PuTTY 'Copy all to clipboard' menu item, top left.
That way you get text you can save / edit / annotate / post etc.

What does
printenv
and
help
show in the bootloader?
 

W8CLA

n3wb
Joined
Jun 4, 2019
Messages
3
Reaction score
0
Location
Ohio
It is a Xiongmaitech. I bought it on Aliexpress as just the module board with lens, no case or anything. The firmware is from the link on the vendors ad which leads to the Xiongmaitech website. the little qr sticker on the board says it's an IVG-HP203Y-AE. I'm kind of leaning towards maybe the kernel got wiped somewhere along line.


putty output
Code:
hi3516cv300 System startup

Uncompress.......Ok


hi3516cv300 System startup


U-Boot 2010.06-svn1098 (Jun 11 2018 - 13:18:18)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
CONFIG_CLOSE_SPI_8PIN_4IO = y.
at hifmc100_setTB() mid:0xc2,chipsize:0x1000000 <no>.
unlock all.
SPI Nor total size: 16MB
MMC:
EMMC/MMC/SD controller initialization.
Card did not respond to voltage select!
No EMMC/MMC/SD device found !
In:    serial
Out:   serial
Err:   serial
Press Ctrl+C to stop autoboot
16384 KiB hi_fmc at 0:0 is now current device

srcAddr 0x83000000, dstAddr 0x82000000
created_inode 0x883d0200
Input is not in the XZ format (wrong magic bytes)xz_wrapper.c[unxz]:94
xz uncompress failed with error code 5
read_block: failed to read block @0xffffffffffffffff
data abort
pc : [<8841de66>]          lr : [<10000037>]
sp : 883bf500  ip : 00000020     fp : 22cda879
r10: e4481dce  r9 : c0178927     r8 : 883bffe0
r7 : 67c6b40a  r6 : 0bb5cabe     r5 : 33e35a05  r4 : d72af800
r3 : 00000000  r2 : 0000011e     r1 : bb5cabe0  r0 : 67562b07
Flags: nzcv  IRQs off  FIQs off  Mode SVC_32
Resetting CPU ...

resetting ...



hi3516cv300 System startup

Uncompress.......Ok


hi3516cv300 System startup


U-Boot 2010.06-svn1098 (Jun 11 2018 - 13:18:18)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
CONFIG_CLOSE_SPI_8PIN_4IO = y.
at hifmc100_setTB() mid:0xc2,chipsize:0x1000000 <no>.
unlock all.
SPI Nor total size: 16MB
MMC:
EMMC/MMC/SD controller initialization.
Card did not respond to voltage select!
No EMMC/MMC/SD device found !
In:    serial
Out:   serial
Err:   serial
Press Ctrl+C to stop autoboot
xmtech # <INTERRUPT>
xmtech # help
?       - alias for 'help'
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
ddr     - ddr training function
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
flwrite - SPI flash sub-system
getinfo - print hardware information
go      - start application at address 'addr'
help    - print command description/usage
lip     - lip      - set local ip address but not save to flash

loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
mac     - mac      - set mac address and save to flash

md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
sip     - sip      - set server ip address but not save to flash

squashfsload- fsload  - load binary file from a filesystem image

tftp    - tftp  - download or upload image via network using TFTP protocol
version - print monitor version
xmtech # printenv
bootargs=init=linuxrc mem=${osmem} console=ttyAMA0,115200 root=/dev/mtdblock1 rootfstype=squashfs mtdparts=hi_sfc:0x30000(boot),0x2E0000(romfs),0x300000(user),0x160000(web),0x40000(custom),0x50000(mtd)
bootcmd=setenv setargs setenv bootargs ${bootargs};run setargs;sf probe 0;sf read 83000000 30000 2E0000;squashfsload;bootm 0x82000000
bootdelay=1
baudrate=115200
bootfile="uImage"
da=tftp 0x82000000 u-boot.bin.img;sf probe 0;flwrite
du=tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwrite
dr=tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwrite
dw=tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwrite
dl=tftp 0x82000000 logo-x.cramfs.img;sf probe 0;flwrite
dc=tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwrite
up=tftp 0x82000000 update.img;sf probe 0;flwrite
ua=mw.b 0x82000000 ff 1000000;tftp 0x82000000 upall_verify.img;sf probe 0;flwrite
tk=tftp 0x82000000 uImage;setenv setargs setenv bootargs ${bootargs};run setargs;bootm 0x82000000
dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwrite
ethaddr=00:12:17:8e:d6:52
NID=0x0001
muxctl0=0x12040064
muxval0=0x0
gpio0=0x77
gpioval0=0x00
muxctl1=0x12040104
muxval1=0x00
gpio1=0x82
gpioval1=0x04
osmem=56M
appSystemLanguage=SimpChinese
appVideoStandard=PAL
filesize=1A778
fileaddr=82000000
netmask=255.255.255.0
ipaddr=192.168.1.10
serverip=192.168.1.107
restore=1
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-svn1098 (Jun 11 2018 - 13:18:18)

Environment size: 1448/65532 bytes
xmtech #
 
Top