How To fix “Read-only File system” issue when SSH access to Hikvision IP Camera

davinci

n3wb
Joined
Sep 4, 2015
Messages
9
Reaction score
0
Have a HikVision IP Camera. After SSH access as root, there are a few directories, such as /bin, /root, /dav, etc. It is this directory "/dav" is giving the issue of "Read-only File system", whenever I want to create a subdirectory, or create a file inside it.
here is what is seen with "mount": /dev/mtdblock5 on /dav type cramfs (ro,relatime)

cramfs
is a read only file system. (wiki explained). This is probably the reason.

Does anyone have any solution to this issue? I will need to be able to write/modify files in this "/dav" directory.

Thank you!
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
cramfs is a read only file system. (wiki explained). This is probably the reason.
Yes, that is exactly the reason 'Compressed ReadOnlyMemory File System'.
What model of camera do you have that's using cramfs? The cameras are usually UBIFS, and the NVRs are usually cramfs.
Use 'df' to see what mount point has enough space for what you want to do.

But - you may encounter a new problem if you add new data to the file system - depending on how the specific camera firmware has been constructed, it's possible the entire file system is re-created at bootup and any changes may vanish.
Worth testing before you put a lot of effort in.
 

davinci

n3wb
Joined
Sep 4, 2015
Messages
9
Reaction score
0
It is 2cd-2110-I

so do u think there is a possibility to crack it? Means, to update some files inside the /dav directory.

Thanks!

- - - Updated - - -
 
Last edited by a moderator:

davinci

n3wb
Joined
Sep 4, 2015
Messages
9
Reaction score
0
Yes, that is exactly the reason 'Compressed ReadOnlyMemory File System'.
What model of camera do you have that's using cramfs? The cameras are usually UBIFS, and the NVRs are usually cramfs.
Use 'df' to see what mount point has enough space for what you want to do.

But - you may encounter a new problem if you add new data to the file system - depending on how the specific camera firmware has been constructed, it's possible the entire file system is re-created at bootup and any changes may vanish.
Worth testing before you put a lot of effort in.
It is 2cd-2110-I

so do u think there is a possibility to crack it? to update some files inside the /dav directory.

Thanks!

- - - Updated - - -
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
You won't be able to change anything in the folder structure mounted from the 'cramfs' source. By design, it's 'read-only'.
You could change files in the /dav folder if you change the firmware and update the camera with it. The result will still be read-only.
Depending on how the camera firmware boots up, the rw mount points may be re-created each time, and rootfs for example is in RAM.
You will be able to change files if you add an external NAS mount point, most easily done via the NetHDD or Storage menus.
 

davinci

n3wb
Joined
Sep 4, 2015
Messages
9
Reaction score
0
You will be able to change files if you add an external NAS mount point, most easily done via the NetHDD or Storage menus.
thanks for the advice. do you have any further resource about how to do it? NetHDD has already been attached to the IP camera
 

whoslooking

IPCT Contributor
Joined
Oct 3, 2014
Messages
1,524
Reaction score
548
Location
London
It can be hacked, you have change the mtd's like other cameras but on this model it's mtd2 not mtd6 (also mtd5) also you may have to unmount mtd2 first.

You have to treat this camera as an NVR @alastairstevenson has done some good post on how to on the 7816 NVR.
 
Last edited by a moderator:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
thanks for the advice. do you have any further resource about how to do it? NetHDD has already been attached to the IP camera
It's just normal file operations on a remote file share. Obviously it would depend on the reliable availability of the NetHDD destination, and also what you have in mind to do.

This is an NVR, but probably would be much the same from your camera. The remote mount is a NAS share, with the screenshot below a view of it via a Windows PC.
Code:
dvrdvs login: root
Password:

BusyBox v1.16.1 (2014-05-19 09:41:10 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
can not change to guest!
[root@dvrdvs /] # mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock2 on /home/hik type cramfs (ro,relatime)
192.168.1.201:/cctv1 on /mnt/tnfs00 type nfs (rw,sync,relatime,vers=3,rsize=8192,wsize=8192,namlen=255,acregmin=0,acregmax=0,acdirmin=0,acdirmax=0,soft,noac,nolock,proto=udp,port=2049,timeo=7,retrans=3,sec=sys,local_lock=all,addr=192.168.1.201)
[root@dvrdvs /] # cd /mnt/tnfs00
[root@dvrdvs tnfs00] # ll
drwxrwxrwx    3 root     root          4096 Sep  5 09:44 @Recycle
-rw-------    1 root     root            68 Sep  5 09:44 info.bin
drwxrwxrwx    3 root     root         12288 Jun 26 11:08 mtd
[root@dvrdvs tnfs00] # cp /home/hik/* .
[root@dvrdvs tnfs00] # ll
drwxrwxrwx    3 root     root          4096 Sep  5 09:44 @Recycle
-rw-r--r--    1 root     root       1056171 Sep  5 09:44 app.tar.lzma
-rwxr--r--    1 root     root       1113218 Sep  5 09:44 bonding.ko
-rw-r--r--    1 root     root         11792 Sep  5 09:44 dvrCmd.tar.gz
-rw-r--r--    1 root     root       4252633 Sep  5 09:44 hicore.tar.lzma
-rw-r--r--    1 root     root       1011328 Sep  5 09:44 hisi.tar.lzma
-rw-------    1 root     root            68 Sep  5 09:44 info.bin
-rw-r--r--    1 root     root        266257 Sep  5 09:44 iscsi.tar.lzma
drwxrwxrwx    3 root     root         12288 Jun 26 11:08 mtd
-rwxr--r--    1 root     root        360256 Sep  5 09:44 ntfs-3g
-rwxr--r--    1 root     root        633856 Sep  5 09:44 player.bin
-rwxr--r--    1 root     root         61776 Sep  5 09:44 ptzCfg.bin
-rwxr--r--    1 root     root         13572 Sep  5 09:44 showlogo
-rwxr--r--    1 root     root          1428 Sep  5 09:44 start.sh
-rwxr--r--    1 root     root       2786352 Sep  5 09:44 uImage
-rwxr--r--    1 root     root        157329 Sep  5 09:44 vca_encrypt_3535.ko
-rw-r--r--    1 root     root         87750 Sep  5 09:44 versionctr.tar.lzma
-rwxr--r--    1 root     root       2369775 Sep  5 09:44 webs.tar.lzma
[root@dvrdvs tnfs00] #
 

Attachments

davinci

n3wb
Joined
Sep 4, 2015
Messages
9
Reaction score
0
It's just normal file operations on a remote file share. Obviously it would depend on the reliable availability of the NetHDD destination, and also what you have in mind to do.

This is an NVR, but probably would be much the same from your camera. The remote mount is a NAS share, with the screenshot below a view of it via a Windows PC.
Code:
dvrdvs login: root
Password:

BusyBox v1.16.1 (2014-05-19 09:41:10 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
can not change to guest!
[root@dvrdvs /] # mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock2 on /home/hik type cramfs (ro,relatime)
192.168.1.201:/cctv1 on /mnt/tnfs00 type nfs (rw,sync,relatime,vers=3,rsize=8192,wsize=8192,namlen=255,acregmin=0,acregmax=0,acdirmin=0,acdirmax=0,soft,noac,nolock,proto=udp,port=2049,timeo=7,retrans=3,sec=sys,local_lock=all,addr=192.168.1.201)
[root@dvrdvs /] # cd /mnt/tnfs00
[root@dvrdvs tnfs00] # ll
drwxrwxrwx    3 root     root          4096 Sep  5 09:44 @Recycle
-rw-------    1 root     root            68 Sep  5 09:44 info.bin
drwxrwxrwx    3 root     root         12288 Jun 26 11:08 mtd
[root@dvrdvs tnfs00] # cp /home/hik/* .
[root@dvrdvs tnfs00] # ll
drwxrwxrwx    3 root     root          4096 Sep  5 09:44 @Recycle
-rw-r--r--    1 root     root       1056171 Sep  5 09:44 app.tar.lzma
-rwxr--r--    1 root     root       1113218 Sep  5 09:44 bonding.ko
-rw-r--r--    1 root     root         11792 Sep  5 09:44 dvrCmd.tar.gz
-rw-r--r--    1 root     root       4252633 Sep  5 09:44 hicore.tar.lzma
-rw-r--r--    1 root     root       1011328 Sep  5 09:44 hisi.tar.lzma
-rw-------    1 root     root            68 Sep  5 09:44 info.bin
-rw-r--r--    1 root     root        266257 Sep  5 09:44 iscsi.tar.lzma
drwxrwxrwx    3 root     root         12288 Jun 26 11:08 mtd
-rwxr--r--    1 root     root        360256 Sep  5 09:44 ntfs-3g
-rwxr--r--    1 root     root        633856 Sep  5 09:44 player.bin
-rwxr--r--    1 root     root         61776 Sep  5 09:44 ptzCfg.bin
-rwxr--r--    1 root     root         13572 Sep  5 09:44 showlogo
-rwxr--r--    1 root     root          1428 Sep  5 09:44 start.sh
-rwxr--r--    1 root     root       2786352 Sep  5 09:44 uImage
-rwxr--r--    1 root     root        157329 Sep  5 09:44 vca_encrypt_3535.ko
-rw-r--r--    1 root     root         87750 Sep  5 09:44 versionctr.tar.lzma
-rwxr--r--    1 root     root       2369775 Sep  5 09:44 webs.tar.lzma
[root@dvrdvs tnfs00] #
thanks! will definitely try it!
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
The example shown was how to copy out the files from the read-only cramfs mount point to an external NAs folder, so that the files could then be modified and re-packed into a new cramfs.img file which could then be applied back to the camera.
The cramfs mount point is always going to be read-only due to the design of the cramfs 'compressed read-only memory file system'.
 

tony2016

n3wb
Joined
Dec 28, 2015
Messages
5
Reaction score
0
Location
China
Dear alastairstevenson, the file IEfile.tar.gz, I already copy to the NAS folder via ssh, but now the problem for me is how to make "cramfs.img" file as you mentioned,and then be applied back to the camera, those operating now I don't know. Thanks
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,779
Location
Scotland
Under Linux there are the mkfs.cramfs and mkcramfs command-line tools.
Under Windows - sorry, I don't know, I have not seen any cramfs utilities.
Others may comment.
 

whoslooking

IPCT Contributor
Joined
Oct 3, 2014
Messages
1,524
Reaction score
548
Location
London
I had CBX make a patch for this type of camera, it's serial number locked to the camera, maybe someone would like to reverse it to see how it was done.
 

Enabler

Getting the hang of it
Joined
Oct 11, 2015
Messages
265
Reaction score
41
Location
Bolton
I had CBX make a patch for this type of camera, it's serial number locked to the camera, maybe someone would like to reverse it to see how it was done.
I had some stuff from CBX, but I agreed to keep it confidential beforehand. Didn't you agree the same with him first?
 
Top