Menu
What's new

U-Boot_r6.bin

N

Nick Robinson

n3wb
Joined
May 29, 2018
Messages
15
Reaction score
0
Location
Canada
Hey,
I’m looking for A copy of U-boot_r6.bin. I’ve got a DS-2CD2145 that is corrupt and I’m hoping that this will fix my problems!
Thanks.
 
alastairstevenson

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,980
Reaction score
6,802
Location
Scotland
If the bootloader is corrupt you'd be struggling to recover from that.
Would a partition dump of an R6 bst and bld be of any use to you?
mtdblock0&1
 
N

Nick Robinson

n3wb
Joined
May 29, 2018
Messages
15
Reaction score
0
Location
Canada
Hey,
It's not that it's corrupt but for some reason I cannot change the "bootargs"!

Code: 
HKVS # printenv
ipaddr=192.168.2.109
serverip=192.168.2.18
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=94:e1:ac:6e:87:77
loadaddr=0x00208000
bootfile=hImage
bootcmd=null
bootargs=console=ttyS0
bootdelay=4
dbg=9

HKVS # setenv bootargs console=ttys0
Type 'help setenv' for help
HKVS # help setenv

Help for 'setenv':
setenv [param] [val]
ipaddr        - network ip address
serverip    - tftp server ip address
netmask    - network ip mask
gatewayip    - gateway ip address
ethaddr    - ethernet mac address
bootdelay    - boot delay time
dbg            - debug level
HKVS # setenv bootargs
Type 'help setenv' for help
HKVS # setenv bootarg
Type 'help setenv' for help

This is a camera that I've been working on for quite a while. Every few months I pull it out and try again. Until I get to frustrated with it! Some of the memory has become bad/corrupt and the camera will not boot past BusyBox.

Code: 
starting pid 318, tty '': '-/bin/psh'
BusyBox v1.2.1-344545 Protect Shell (psh)
Enter 'help' for a list of davinci system commands.
Unfortunately because I cannot change the bootargs, I end up in a protected shell (psh) and I do not have access to all of the commands.
So, I was hoping to load another copy of U-Boot so that I can have full access to the commands or better yet get a full copy of all the firmware loaded into a DS-2CD2142FWD-IS so I can re-flash everything.
Any help would be greatly appreciated!!
Thanks.
 
N

Nick Robinson

n3wb
Joined
May 29, 2018
Messages
15
Reaction score
0
Location
Canada
However, if I could get a copy of what you’ve got perhaps I can get the camera to work.. would you be able to send it to me or post a link for it?
thanks.
 
alastairstevenson

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,980
Reaction score
6,802
Location
Scotland
Nick Robinson said:
I’ve got a DS-2CD2145 that is corrupt
Click to expand...
Nick Robinson said:
get a full copy of all the firmware loaded into a DS-2CD2142FWD-IS so I can re-flash everything.
Click to expand...
I'm not sure those are the same series.

However - you are welcome to the copies of the flash partitions of a DS-2CD2142FWD that I bought off eBay that was supposed to be a DS-2CD2085FWD.
The installed firmware was 5.4.5
The bootloader still allowed the bootargs variable to be modified to gain root shell access.
I fixed it up and re-sold it.
Code: 
HKVS #
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=18:68:cb:02:ad:a8
loadaddr=0x00208000
bootfile=hImage
bootcmd=null
bootargs=console=ttyS0
bootdelay=2
HKVS #
HKVS #
HKVS #
HKVS # setenv bootargs console=ttyS0 init=/bin/sh single
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=18:68:cb:02:ad:a8
loadaddr=0x00208000
bootfile=hImage
bootcmd=null
bootargs=console=ttyS0 init=/bin/sh single
bootdelay=2
HKVS # saveenv
Writing env to Nand... done
HKVS #
ŠKVS # reset

U-Boot 3.1.6-195297 (Nov 14 2016-11:19:43)
As the size is a bit big for attaching here, Ill sent you a download link via 'Conversations'.
 
N

Nick Robinson

n3wb
Joined
May 29, 2018
Messages
15
Reaction score
0
Location
Canada
Yup, for some reason I cannot changed the bootargs

Code: 
HKVS # setenv bootargs console=ttyS0 init=/bin/sh single
Type 'help setenv' for help
If you know of anyway to change that please let me know!
Thanks
 
N

Nick Robinson

n3wb
Joined
May 29, 2018
Messages
15
Reaction score
0
Location
Canada
I have a copy of mImage_r06 that someone sent to me a while ago but It Is also keeping me from being able to update it.
Code: 
HKVS # upf

***** UPDATE START *****
MAC: 94:e1:ac:6e:87:77

TFTP from server 192.168.2.18; our IP address is 192.168.2.109

Filename: 'mImage_r6'

Load address: 0x00207F00

do_tftp_load:bld_udp_recv RRQ ok,opcode=3

################################################################################

################################################################################

################################################################################

################################################################################

################################################################################

######### got 10485760 bytes (10240 KB)

[ INFO][BLD]TFTP: Download File [OK]


version2 error.
hdr->crc32=0x8f639cdd
hdr->img_len=4108596
hdr->mem_addr=0xffffffff
hdr->magic=0x4d535953
build_time:Wed May 25 11:46:35 2016
username:  zhangjianzhong
hostname:  Cpl-Frt-BSP
verify data failed! error: upm.
update mini system [FAIL]!error: upf.
!!!!! UPDATE FAIL !!!!!
Very Frustrating!
 
alastairstevenson

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,980
Reaction score
6,802
Location
Scotland
When we manage to do 'intetesting' things with the cameras and NVRs Hikvision trends to block them going forward.
The u-boot used to be very well equipped but is now a shadow of its former self.

I have a vague recollection that the version 2 error can be circumvented, maybe some information in the mimage threads.
 
N

Nick Robinson

n3wb
Joined
May 29, 2018
Messages
15
Reaction score
0
Location
Canada
One last option.
I have another camera (same model) still in service, would you be able to run me through the steps/process of copying all OS and firmware from the good one and placing it on the corrupt one? I can create a NFS share or use the on board SD slot to copy the data to. As well, then there would be a full copy of the data for the next poor guy who has a corrupt camera.
 
alastairstevenson

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,980
Reaction score
6,802
Location
Scotland
From what I recall (though I can't find the specific post) the 'version2 error' is linked to a field in the minisys header that specifies the compatible version of bootloader. It would give that error if the bootloader was too new.
@rearanger zeroed the bytes and the minisys was no longer rejected by the bootloader.
It may be in this thread, but worth a read anyway :

Hikvision G1 5.5+ firmware Exploring the Cam & attempting unlock

The G1 runs on ambarella S3L (also used in dahua cams) minishell below will work with U-Boot 3.1.6-279309 (May 11 2017-13:36:13) or earlier https://ipcamtalk.com/threads/unrestricted-root-shell-on-g1-cameras.23213/#post-221134 However will not work with U-Boot 3.1.6-297597 (Aug 30...
ipcamtalk.com ipcamtalk.com
 
alastairstevenson

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,980
Reaction score
6,802
Location
Scotland
Nick Robinson said:
would you be able to run me through the steps/process of copying all OS and firmware from the good one
Click to expand...
Here are some transcript fragments from how I extracted the flash partitions from the DS-2CD2142FWD-I
The steps are :
Modify bootargs in the bootloader to boot to a root shell, no psh
use /etc/rcS to complete the normal initiallisation.
After the camera has fully booted, mount an NFS share and copy out the flash partiions.
Copying those back in to another camera would be best done when a minisys is running.
And generally it would be quite risky attempting to re-write the bootloader that way.

Mod the bootloader and complete the normal bootup.
Code: 
HKVS #
HKVS #
HKVS #
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=18:68:cb:02:ad:a8
loadaddr=0x00208000
bootfile=hImage
bootcmd=null
bootargs=console=ttyS0
bootdelay=2
HKVS #
HKVS #
HKVS #
HKVS # setenv bootargs console=ttyS0 init=/bin/sh single
HKVS # printenv
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=18:68:cb:02:ad:a8
loadaddr=0x00208000
bootfile=hImage
bootcmd=null
bootargs=console=ttyS0 init=/bin/sh single
bootdelay=2
HKVS # saveenv
Writing env to Nand... done
HKVS #
ŠKVS # reset

U-Boot 3.1.6-195297 (Nov 14 2016-11:19:43)
boards:234948
Boot From: NAND 2048 RC
SYS_CONFIG: 0x3006005B POC: 101
Cortex freq: 600000000
ENET freq: 50000000
iDSP freq: 216000000
Dram freq: 564000000
Core freq: 216000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 24000000
SD freq: 50000000
SDIO freq: 50000000
SDXC freq: 60000000
dev_model:DS-2CD2142FWD-I
Hit Ctrl+u to stop autoboot: 0
|BIND err|
cmd 'null' is not supported.
nand booting ...
booting from pri part...
load kernel...
[    1.517283] Card authentication succeeded
init started: BusyBox v1.19.3 (2017-01-23 16:59:43 CST)
starting pid 45, tty '': '-/bin/sh'
#
#
#
#
# /etc/init.d/rcS
Starting udev:      [ OK ]

Code: 
#
#
# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00020000 "bst"
mtd1: 00100000 00020000 "bld"
mtd2: 000e0000 00020000 "ptb"
mtd3: 00080000 00020000 "env"
mtd4: 00100000 00020000 "sysflg"
mtd5: 00080000 00020000 "param"
mtd6: 00100000 00020000 "dpt"
mtd7: 00a00000 00020000 "rcvy"
mtd8: 00800000 00020000 "krn_pri"
mtd9: 00800000 00020000 "krn_sec"
mtd10: 02200000 00020000 "app_pri"
mtd11: 02200000 00020000 "app_sec"
mtd12: 00600000 00020000 "cfg_pri"
mtd13: 00600000 00020000 "cfg_sec"
mtd14: 00800000 00020000 "dbg"
mtd15: 00800000 00020000 "syslog"
# ifconfig
eth0      Link encap:Ethernet  HWaddr 18:68:CB:02:AD:A8
          inet addr:192.168.1.20  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::1a68:cbff:fe02:ada8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:97 errors:0 dropped:0 overruns:0 frame:0
          TX packets:114 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:17637 (17.2 KiB)  TX bytes:47207 (46.1 KiB)
          Interrupt:27

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:11 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2193 (2.1 KiB)  TX bytes:2193 (2.1 KiB)

#
#
# mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
ramfs on /home type ramfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/ubi1_0 on /dav type ubifs (rw,relatime)
/dev/ubi3_0 on /davinci type ubifs (rw,relatime)
/dev/ubi4_0 on /config type ubifs (rw,relatime)
none on /proc/bus/usb type usbfs (rw,relatime)
#
# ls -al /mnt
drwxr-xr-x   13 admin    root             0 Jan 23  2017 .
drwxr-xr-x   20 admin    root             0 Jan  1 01:41 ..
drwxr-xr-x    2 admin    root             0 Jan 23  2017 mmc01
drwxr-xr-x    2 admin    root             0 Jan 23  2017 mmc02
drwxr-xr-x    2 admin    root             0 Jan 23  2017 nfs0
drwxr-xr-x    2 admin    root             0 Jan 23  2017 nfs00
drwxr-xr-x    2 admin    root             0 Jan 23  2017 nfs01
drwxr-xr-x    2 admin    root             0 Jan 23  2017 nfs02
drwxr-xr-x    2 admin    root             0 Jan 23  2017 nfs03
drwxr-xr-x    2 admin    root             0 Jan 23  2017 nfs04
drwxr-xr-x    2 admin    root             0 Jan 23  2017 nfs05
drwxr-xr-x    2 admin    root             0 Jan 23  2017 nfs06
drwxr-xr-x    2 admin    root             0 Jan 23  2017 nfs07
# mount -t nfs -o nolock 192.168.1.201:/cctv1 /mnt/nfs00
# cd /mnt/nfs00
# mkdir DS-2CD2142FWD-I
#
# cd DS-2CD2142FWD-I
# ls -al
drwxr-xr-x    2 admin    root          4096 Oct 19  2019 .
drwxrwxrwx   12 admin    root          4096 Oct 19  2019 ..
# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00020000 "bst"
mtd1: 00100000 00020000 "bld"
mtd2: 000e0000 00020000 "ptb"
mtd3: 00080000 00020000 "env"
mtd4: 00100000 00020000 "sysflg"
mtd5: 00080000 00020000 "param"
mtd6: 00100000 00020000 "dpt"
mtd7: 00a00000 00020000 "rcvy"
mtd8: 00800000 00020000 "krn_pri"
mtd9: 00800000 00020000 "krn_sec"
mtd10: 02200000 00020000 "app_pri"
mtd11: 02200000 00020000 "app_sec"
mtd12: 00600000 00020000 "cfg_pri"
mtd13: 00600000 00020000 "cfg_sec"
mtd14: 00800000 00020000 "dbg"
mtd15: 00800000 00020000 "syslog"
#
# cat /dev/mtd0ro > mtd0ro
# cat /dev/mtd1ro > mtd1ro
# cat /dev/mtd2ro > mtd2ro
# cat /dev/mtd3ro > mtd3ro
# cat /dev/mtd4ro > mtd4ro
# cat /dev/mtd5ro > mtd5ro
# cat /dev/mtd6ro > mtd6ro
# cat /dev/mtd7ro > mtd7ro
# cat /dev/mtd8ro > mtd8ro
# cat /dev/mtd9ro > mtd9ro
# cat /dev/mtd10ro > mtd10ro
# cat /dev/mtd11ro > mtd11ro
# cat /dev/mtd12ro > mtd12ro
# cat /dev/mtd13ro > mtd13ro
# cat /dev/mtd14ro > mtd14ro
# cat /dev/mtd15ro > mtd15ro
#
#
#
# mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
ramfs on /home type ramfs (rw,relatime)
udev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/ubi1_0 on /dav type ubifs (rw,relatime)
/dev/ubi3_0 on /davinci type ubifs (rw,relatime)
/dev/ubi4_0 on /config type ubifs (rw,relatime)
none on /proc/bus/usb type usbfs (rw,relatime)
192.168.1.201:/cctv1 on /mnt/nfs00 type nfs (rw,relatime,vers=3,rsize=131072,wsize=131072,namlen=255,hard,nolock,proto=tcp,port=2049,timeo=70,retrans=3,sec=sys,local_lock=all,addr=192.168.1.201)
#
#
 
You must log in or register to reply here.
Top