As this is a less common, Chinese market turret camera, and even less likely that someone will have unpicked its internals, I recognise that this is a long-shot request. I've had this G0 3335D for a while - but CN menus, and has rejected all stock and tweaked firmware thrown at it by whatever method, even the newly-published IPC_G0_CN_STD_5.4.41_170710 specifically for this model. While trying this new firmware, via the serial console, I accidentally issued the 'upf' (Upgrade - factory only) command. This has the effect of erasing the entire set of flash partitions, bar the bootloader, in preparation for a factory-issue firmware pack. Dohh... It was an interesting exercise in tftp booting and figuring out how the firmware environment is organised (it's a kind of hybrid of R0 and R7 series) that has got me to the point of correctly repopulating the kernel and app partitions. But I'm missing what will be the equivalent of mtdblock5/6 in the R0 series, so the camera now boots OK but won't start up normal services as there is no hardware information. I don't even know in which partition or where the 'hardware descriptor block' is located that would allow a spoofed copy to be made. So my rather optimistic help request is: Does anyone know where the hardware descriptor block (the mtdblock5/6 if it was an R0 camera) is located, or, even better, have a copy of the relevant partition, or even the entire flash as an image file? Many thanks in advance.