Serial Connection to Module

Hello, I see that you have activated the P/T unit control, hence my question. I have the same camera, but after connecting the P/T unit (Videotec Ullise) with the Pelco-D protocol set to pin 3 and pin 4 of the camera and trying to control it, nothing happens. The P/T unit is certainly technically efficient because I can control it from the test monitor via RS485, Baudrate 9600 and the Pelco-D protocol. Is the Pelco-D protocol enabled by default in this camera or do I have to change it somewhere? How did you deal with it?

It was enabled by default for me. On CN2, 3 and 4 are connected to the P/T unit, 5 is ground and 6 is 12v power......And then the LAN cables on CN1

On the web browser inferface, you can go to "configuration" at the top...Then "PTZ" tab on the left, then "PTZ Configuration" to confirm it's the baud rate, Pelco-D and such.
 
Here is a bootlog but without cam: github gist
Board sending data on the pin close to center. Do not have time to test further for now.

Unfortunately, still no luck for me. I do start getting readable information about the camera using these pins (though with junk characters in between)...But when holding enter on boot up, it's asking for login and password

Code:
EDDDDDDDDDDDDDDDDDDDDDD@@▒▒▒▒▒▒%DDDDDDDDD     ▒▒DD▒DDDDDDDDDDDDDDDDDDDDDD@D#DDDDDDDDDDDD▒ ▒vDDDDDDDDDDDDD▒EDD▒DDD▒_DDDDDDFDDDDDDDDDDDDD▒"x▒׿▒▒
IPCAM-B93ECB-MC800S_V2_AF login: ▒▒▒▒▒▒▒▒▒▒▒▒
▒▒Password: M
▒▒▒▒▒▒▒▒▒▒▒V▒w▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
▒▒▒▒▒▒▒▒▒▒▒▒▒/▒▒▒▒▒▒▒▒▒▒w▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒Mw▒▒
߿▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒m▒▒▒▒▒▒M▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒w▒▒▒
▒▒▒▒▒▒▒▒▒▒▒▒▒▒w▒▒▒▒▒▒▒▒▒▒▒▒▒▒3wLogin incorrect
IPCAM-B93ECB-MC800S_V2_AF login: ▒▒▒▒wK▒▒"▒▒▒▒▒߿▒▒▒▒▒▒▒▒▒▒▒▒▒▒w▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒L▒▒▒▒▒▒▒▒▒▒▒▒▒▒ww▒▒▒▒▒▒▒▒▒w▒/▒w▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒=▒▒▒▒▒▒▒▒w▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒/▒w▒▒▒ww▒▒▒▒▒▒▒w▒▒w▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒տ▒▒w▒w▒▒▒▒▒▒▒▒▒▒▒▒▒▒v▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒5▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒Login incorrect
▒▒▒▒(▒F▒▒▒▒▒▒▒▒w▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ww▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒w▒▒▒▒▒▒▒▒▒▒g▒▒▒▒▒▒▒▒▒▒▒▒w▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒Login incorrect


Here is some of the information on bootup without holding enter. Of note, it does say "U-Boot 2015.01 (Aug 02 2022 - 15:48:47)" where in your link, it is dated Dec 2020. So maybe it's been password protected since then?

Code:
HW Reset
MCP1866_4X
miupll_400MHz
256MB
BIST0_0001-OK
Load I▒ϙݕ▒:0t0▒▒
cust_size:00006100
Checksum OK
JMP+++
IPL_CUST 85ea583
MXP found at 0x0000f000
▒ffset:00020▒XZ de▒▒▒  decomp_size=0x00000000

U-Boot 2015.01 (Aug 02 2022 - 15:48:47)

Version: I6E#g#######
I2C:   ready
DRAM:
WARNING: Caches not enabled
MMC:   MStar SD/MMC: 0
no▒▒▒▒cces▒RnNF▒X.
                  @́detected (0x0B05, 0xC8, 0x40, 0x18)
SF: Detected nor0 with total size 16 MiB
MXP found at mxp_offset[2]=0x0000F000, size=▒▒ٮ▒▒0z3F20▒"u▒v_▒K▒▒0x1000
Flash is detected (0x0B05, 0xC8, 0x40, 0x18)
SF: Detected nor0 with total size 16 MiB
In:   ▒▒?▒▒grr:$ ▒共7
                     Net:   MAC Address 6C:18:E8:07:D0:01
Auto-NegOtiation...
uboot net upgrade timeout
Flash is detected (0x0B05, 0xC8, 0x40, 0x18)
SF: Detected nor0 with total size 16 MiB
SF: 2097152 bytes @ 0x40000 Read: OK
##  Booting kernel from Legacy Image at 22000000 ...
   Image Name:   ▒▒▒▒9#▒%M▒
0▒`Image Type:   ARM Linux Kernel Image (lzma compressed)
   Data Size:    2083496 Bytes = 2 MiB
   Load Address: 20008000
   Entry Point:  20008000
▒OKVe▒
   Uncompressing Kernel Image ...
[XZ] !!!reserved 0x21000000 length=0x 1000000 for xz!!
W
 ▒▒э▒▒▒▒сsize is 8 bytes.
usbcore: registered new interface driver usbfs
u▒▒▒݅Z▒▒ɉōg1 ▒˕Ɂhub
usbcore: registered new device driver usb
clocksource: Switched to clocksource arch_sys_counter
nQ▒▒▒egZ▒W▒ed▒▒▒ѽ▒▒▒▒family 2
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 3, 40960 bytes)
TCP: H▒▒e ▒y▒wː▒▒с2148 bind 2048)
UDP hash table entries: 128 (order: 0, 6144 bytes)
UDP-Lite hash table entries: 128 (order: 0, 6144 bytes)
NET: Registered protocol familyRPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registere▒c▒en1trqnsport$module.
hw perfevents: enabled with armv7_cortex_a7 PMU driver, 5 counters available
*squashfs: version 4.0 (2009/01/31) Phi▒OFS▒$▒▒Wk▒ɥ▒▒▒the id_resolver key type
Key type id_resolver registered
Key type id_legacy registered
jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (defatlt)
        nfinity6e PHY probe, base:fd2a4600
set wifi to high
IRLED driv▒Glibphy: Fixed MDIO Bus: probed
ehci_hcd: USB 2.0 'Enhanced' Host Controhler (EHCI) Driver
ehci monitor start running
Mstar_ehc_init version:2018030▒▒.k▒Y▒H▒1f221000.uart0: ttyS0 at MMIO 0x0 (irq = 45, base_baud = 10800000) is a unknown
ms_uart: probe of 1f221200.uart1 failed with error -22
}S▒Rӑ▒7%=▒px▒)KŁ= 49, base_baud = 10800000) is a unknown
[MS_PM_INTC] hw:9 -> v:71
[MS_PM_INTC] hw:10 -> v:72
>> [sdmmc] ms_sdmmc_probe
>> [sdmmc_0] Probe Platform Devices
>> [sdmmc_1] Probe Platform Devices
MSYS: DMEM request:▒▒▒▒▒j▒]▒YS▒▒V▒M!▒Y\]Y.▒ڕ▒▒▒▒_buff]:0x00000812 success, CPU phy:@0x25848000, virt:@0xC5848000
libphy: mdio: probed
mdio_bus mdio-bus@emac0: /soc/emac0/mdio-bu▒io▒x+▒▒▒ae`ad▒re▒▒H▒▒▒▒}▒▒́mdio-bus@emac0: scan ph▒▒▒▒ɹ▒ѵphy at address 0
ldio_bus mdio-bus@emac0: scan phy ethernet-phy at address 1
mdio_bus mdio-bus@emac0▒$V▒▒%▒́mdio-bus@emac0: scan phy ethernet-phy at address 4
mdio_bus mdio-bus@emac0: scan ph▒▒▒݁5C若▒_c]▒j▒▒▒▒bus@emac0: scan phy ethernet-phy at address 6
mdio_bus mdio-bus@Y[X,▒▒▒▒▒▒phy ethernet-phy at address 7
mdio_bus mdio-bus@emac0: scan phy ethern▒[V▒}b]n▒▒▒▒▒▒▒▒▒▒▒▒: scan phy ethernet-phy at address 9
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 10
mdio_bus mdio-bus@emac0: scan phy ethernet-phy a▒}us▒} iokV▒▒▒▒▒▒: scan phy ethernet-phy at address 12
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 13
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at add▒buwAemz,▒▒cX+▒▒▒ethernet-phy at address 15
mdio_bus mdio-bus@emac0: scan phy etherlet-phy at address 16
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 1▒▒@g}x▒▒"▒ͅn ▒+▒ethernet-phy at address 18
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 19
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 20
md▒▒퐷▒▒        ▒"eth{.▒ѵphy at address 21
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 22
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 23
mdio_bus▒▒K▒▒▒euhe▒▒▒-ply▒X
                           ▒▒ɕ▒́24
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 25
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 26
mdio_bus mdio▒h▒▒▒鹕ѵph^▒сaddress 27
mdio_bus mdio-bus@emac0: scan phy ethernet-phy at address 28
mdio_bus mdio-bus@emac0:▒K▒▒ registered 1f006800.rtcpwc as rtc0
MSYS: DMEM request: [BDMA_FSP_WBUFF]:0x00010040
MSY{en}MA       Uu:0x10010040 success, CPU phy:@0x25850000, virt:@0xC5850000
[Ser flash] phys=0x25850000, virt=0xc5850000, bus=0x05850000 len:0x10040
[FSP] Flash is detected (▒b▒▒▒J▒W▒1/NC▒+▒▒▒j▒j▒2MQ}I▒MODE
mtd .name = NOR_FLASH, .size = 0x01000000 (16IirɅ▒▒ɥ▒=  p00010000 .numeraseregions = 0
MXP_PARTS!!
▒}offs{▒%▒▒ty0204F000, size=0x1000
Creating 5 MTD partitions on "NOR_FLASH":
0x000000000000-0x000000020000 : "BOOT"
0x000000040000-0x000000240000 : "K▒0x000000240000-0x000000f60000 : "SYSTEM"
0x000000020000-0x000000040000 : "UBOOT"
0x000000f60000-0x000001000000 : "DATA"
MSYS: DMEM request: [AESDMA_ENG]:0x00001000
MSYS: DMEM request: [AESDMA_ENG]:0x00001000 success, CPU phy:@0x25▒▒▒C▒MSYS▒$T▒@▒request: [AESDMA_ENG1]:0x00001000
MSYS: DMEM request: [@ESDMA_ENG1]:0x00001000 success, CPU phy:@0x2584A000, virt:@0xC584A000
[ms_cpufr▒nW▒▒▒▒▒k▒[i6e][pwm] use ms_pwm->group_data
[NOTICE]pwm-isr(62) success If nOt i6e Or i6b0, pls confirm it on .dtsi
[MSPI] mspi 0 use dma mode
mstar notify driver install successfully
NET: Registered protocol family 17
Key type dns_resolver registered
[mstar_pm_init] resuae_pbw▒▒▒▒}imZg▒▒▒g=▒xd0057000
ThumbEE CPU extension supported.
Registering SWP/SWPB emulation handler
▒(1252)wc 1f006800.▒▒▒m!s▒oc{▒to!Lnj▒▒j▒▒▒▒Ғ▒Ҫ▒▒Q
OF: fdt:not creating '/sys/firmware/fdt': CRC check failed
squashfs: SQUASHFS error: Xattrs in filesystem, ▒O▒▒WՅsx▒s: SQUASHFS error: unable to read xattr id index table
A▒ww▒▒Wwwwwww▒VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
de▒W▒▒ mounted
This architecture does not have kernel memory prOtection.
Nw▒▒▒▒C▒Ϳ▒▒сtoneC▒▒▒▒▒▒▒▒▒▒▒▒▒
▒▒J▒▒cat: can't open '/sys/devices/soc0/mw▒▒▒▒▒▒▒mount: can't find devpts in /etc/fstab
▒▒lt▒_▒N▒¢▒Cʻ▒▒▒K▒▒rmem_max = 163840
net.core.wmem_default = 524288
net.core.wmem_max = 1048576
net.ipv4.tcp_mem = 924  1232  1848
net.ipv4.tcp_rmem = 4096  87380  ▒▒w▒O▒3▒"▒▒▒▒▒▒▒ʚ▒▒▒j
                                                      net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tp_recycle = 1
net.ipv4.tcp_fin_timeout = 30
@s▒www▒swWGv▒mount: mounting none on /sys failed: Devic▒▒\վ▒▒▒▒▒▒▒w▒[▒▒▒▒ mounting none on /sys/kernel/debug/ failed: Device or resource busy
▒mkdir: can't create directory '/var/lock': Read-only file system              ▒▒umount: can't unmount /mnt/usb: Invalid argument
mounp: mounting ubi0:data on /data failed: No such device
mount: mounting /dev/m/▒▒▒
                          ▒Ս▒▒▒▒▒Ձor directory
7▒▒V▒▒▒▒▒▒▒▒▒▒w▒▒▒▒w͍▒w▒w/
                         ▒▒▒▒w
w▒[SWiW▒ɕ=
          Request CSI IRQ[0]#30
CSI interrupt registered
vif driver probe
Create device f▒▒▒0▒▒▒▒▒▒▒jpe driver probed
[Isp_Driver_Init]
▒▒}▒OHWH▒▒▒▒▒▒▒▒▒▒[ISP] Request IRQ: 29, 57
[IspMid_Driver_Init]
[emac_phy_link_adjust] EMAC Link Up
ispsclttl:0
▒▒▒▒▒▒▒▒26
▒▒▒w▒▒▒
▒w▒▒▒▒m▒ձg _s~▒J▒▒▒5
                    ▒▒▒▒▒▒▒▒ctl:m▒▒▒▒▒▒▒}ѽ▒▒▒ argv0:load_config
config...... cmdpath:/config/cOnfig_tool, `rgv1:/misc/config.ini
config...... cmdpath:/config/config_tool, argv2:/misc/PQCo▒▒r s[▒▒▒h:?▒oo▒Z▒i▒▒▒▒▒}ѽ▒▒▒ argv3:(null)
▒▒▒module [sensor] init-▒
▒▒▒module [mipitx] init
▒▒module [ao] init
▒▒"[rwn}▒[;▒5
             ▒uwwsw▒module [▒▒▒▒▒▒▒▒module [vpe] in▒b▒j▒eդ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒^Ehsw▒▒▒uwwsw▒w$▒w▒▒▒▒▒▒▒▒▒ww▒▒▒▒▒▒▒▒▒▒▒!^▒7sww▒ww^A▒www▒module [shadow] init
module [gyro] init
▒ul[▒۵▒w▒▒▒▒▒7N▒▒▒▒module [venc] init Mar  1 2021 15:16:44
module [panel] init
▒insmod: can't read▒v£▒m▒_eZ>▒y▒▒▒▒
                                   ▒Ս▒▒file or directory
▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒module [ipu] init
▒module [divp] init
▒module [ai] init
insmod: can't read '/config/modules/4.9.84/mi_vdisp.ko': No such file or directory
▒▒wCqm_w]utexInz7)▒ɕ▒▒▒inited, LR:0xBF829C3B
CamOsMutexInit already inited, LR:0xBF829C3B
▒▒Set Scl level 512
▒▒▒▒▒nut.▒K▒▒wo{X^▒▒▒
                     ▒▒▒▒▒j
                           net.core.rmem_default = 163840
net.core.rmem_max = 163840
net.core.wmem_default = 524288
net.core.wmem_max = 1048576
wnet.ipv4.tcp_mem = 924▒▒W▒▒▒▒}▒▒m1O▒3▒º▒�▒▒▒▒▒▒j
                                                 net.ipv4.tcp_wmem = 4096  131072  393216
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30
^@▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ login: ▒$▒www▒w▒▒▒▒▒▒▒▒w▒▒▒▒ד▒▒ocma▒▒땕▒ɕ▒▒}▒ɥ▒▒▒1475] procman enable console

/opt/ch/unicode_16x16.font: font count: 6907
                      #             #    #                                                           ▒▒▒▒▒8;1▒ p▒k▒▒▒▒[redirect_print:1507] procman disable console

▒▒H▒▒▒▒▒▒▒w▒w▒[MS_PM_INTC] hw:2 -> v:73
▒[MS_PM_INTC] hw:3 -> v:74
 
Also, in case anyone wants to see what I'm working with, I've attached the firmware. The first is the original .bin file...Second file is a .zip of the files that were extracted from this .bin using binwalk (a program like 7z will let you click on the squashfs to view all the linux directories and files, including the "etc" folder where I found the password hash.) Maybe someone more experienced with this stuff can find something useful that would lead me in the right direction.

My goal here is to get the Telnet password so I can first make an emergency backup of the MTDblocks in case I ever brick the thing by screwing around with it...Then I can use my website-building experience to modify some of the HTML, Javascript and CSS files to make the web browser user interface a little more user friendly and such. Then take it from there to see what else productive I can accomplish. Never dreamed it would be this much of a challenge to get into this thing, though. On one hand, it's too frustrating, yet on the other hand, I can't seem to let myself give up on it and accept defeat.
Hi "PTZ freak", I don't know where you got those Firmware, but I need the the .bin file for the firmware MC800S_AF_V3-A_STARC-H5 V3.2.2.4 build 2023-04-11 09:10:14 or NEWER. Do you know where can I find it? Thanks and have a great day.