Speed3C (hi3518e) camera

[amraohs]

I have a Speed3C camera (sold under pettec snoop cam) that I'm trying to access, for webaccess I tried a lot of the user/pass combinations posted in other threads but these didnt work. So I connected the cam via RX TX on the board.

I connected the device tru serial:

Spoiler: startup

buffer = SPI Nor(cs 0) ID: 0x5e 0x40 0x17
SPI Nor total size: 8MB
PPS:Feb 20 2019 16:26:46 meari_c2: 0
magic err
ARM Linux Kernel Image (uncompressed)
2619600 Bytes = 2.5 MiB
Loading Kernel Image ... magic err
___mem=37M ethphy=3#3 console=ttyAMA0,115200 loglevel=0 ppsdebug=off mtdparts=hi_sfc:192k(bld)ro,64k(env)ro,64k(enc)ro,64k(sysflg)ro,2560k(sys),4608k(app),640k(cfg) pps
Uncompressing Linux... done, booting the kernel.

after this it stops printing info.

If I press a key at startup it asks for a password:

Spoiler: startup after press key

buffer = SPI Nor(cs 0) ID: 0x5e 0x40 0x17
SPI Nor total size: 8MB
PPS:Feb 20 2019 16:26:46 meari_c2: 0


please input password::

tried some passwords, or tried to leave it empty but i says password err and reboots.

I'm a little bit stuck now, I'm trying to get root access to the device. What else can I try?

 

[watchful_ip]

I've never seen this bootloader before.

Interesting. Could try:

debug
hiklinux
zhimakaimen

Perhaps someone will know. If you do get in would be interested to see a bootloader (mtd0) dump for analysis!

 

[watchful_ip]

You could also try Hikvision TFTP and see if camera asks for a digicap.dav file during bootloader startup. That might be a way to recover also.

 

[amraohs]

I've never seen this bootloader before.

Interesting. Could try:

debug
hiklinux
zhimakaimen

Perhaps someone will know. If you do get in would be interested to see a bootloader (mtd0) dump for analysis!

Tnx for the reply, I tried the passwords but they don't work.

 

[amraohs]

You could also try Hikvision TFTP and see if camera asks for a digicap.dav file during bootloader startup. That might be a way to recover also.

It's a wifi cam, so i don't know how to connect to it. It connects to the wifi (after reset) with a QRcode thats generated in their app with the wifi credentials.