How to find IP camera database inside the firmware

[reb12]

Hi,

I need to reset the password on a IP camera DS-IPC-T12-I. I've been doing some research and I found that the password is stored somewhere inside the firmware using SQLite 3. I've been able to extract the file system which is a squash and then there are about 1.5Mb of the firmware (downloaded it reading the flash with a programmer) there seems to be some kind of database related information. It contains strings like "db-journal". I searched for this and it's information created by the database engine to perform rollback. I know the database is encrypted. But I would like to know the exact location of the database and then try to decrypt it. Could it be posible that linux mounts the database as a partition at boot? I tried using the serial console but there are no useful commands and also the main process called "davinci" is constantly outputting messages. Oh, I almos forgot the camera model is DS-IPC-T12-I. Any ideas?? I'll appreciate any comment.

Thanks!

 

[alastairstevenson]

I found that the password is stored somewhere inside the firmware using SQLite 3.

That's quite common in some firmware for Hikvision cameras.

I know the database is encrypted.

Certainly the stored password is encoded, and probably not realistic to reverse.
If the database was deleted or otherwise wiped, the system would recreate it with default values.
Here is an example :



But there are probably easier ways to reset the camera.
What's the version of firmware?
Use SADP to show it.

 

[reb12]

Firmware version is V5.5.97 200311. I'll try to delete all information after the file system. Maybe that would trigger davinci to create a new database.

 

[alastairstevenson]

Firmware version is V5.5.97 200311

OK, so that version of firmware doesn't have the Hikvision backdoor that would allow the configuration to be extracted and decrypted.

I'll try to delete all information after the file system.

Take care!