Comments (16)
Aah that is a shame, if you need any help in the future, let me know.
from lscindoorcameralocal1080p.
Hi @Onandon11,
Thanks for contacting me. What is the production date of the camera?
You can see it on the back of the camera.
from lscindoorcameralocal1080p.
Here you go 😃 Looks like the same Revision...
from lscindoorcameralocal1080p.
Interesting...
I would not expect the hash to be different if the production date is the same 🤔
Can you try to perform a second dump and check the hash again? Just to be sure it is not corrupt.
I can give you my dump if there are no hardware differences, then you can continue with the instructions described in this repo.
If the hash is still the same I could take a look at the binary in a reverse engineering tool an check what is different.
from lscindoorcameralocal1080p.
Sure! I will recreate the dump again using this command (?)
# COPY LINE FOR LINE!
mw.b ${baseaddr} ff ${flashsize}
sf probe 0
sf read ${baseaddr} 0x0 ${flashsize}
mmc write dev0 ${baseaddr} 0x10 0x4000
If it's still the same different hash I will want to try it with your dump indeed, it's just laying around and bricking doesn't matter 😀
Will try to do it tomorrow, getting into UBOOT is matter of patience ;)
Besides, curious how you did all this and did all the reversed engineering.
from lscindoorcameralocal1080p.
Yes all those Uboot commands are for a 64Mbit flash or 8MB flash.
For this camera I saw two types of flashes:
- XM25QH64A
- XM25QH64C
You can take a look at what model flash you have.
Besides, curious how you did all this and did all the reversed engineering.
I started of with this user: https://github.com/guino/LSC1080P and continued from there. Did not had any experience with hardware and things like Uboot. I learned some things on the way, destroyed maybe 2 camera's 🙈.
Used Ghidra to take a look at what the code does. Developers left a lot of printf
statements. That helps a lot if you are looking at assembly and C like pseudo code. At that point it is just flipping switches... and see what the app is doing on the camera.
from lscindoorcameralocal1080p.
The output line of binwalk -e fulldump.bin
gave:
2490368 0x260000 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 4671858 bytes, 222 inodes, blocksize: 131072 bytes, created: 2022-04-26 07:12:43
Which is almost the same as your output, except for the created datetime. Maybe there the difference comes from..
Running sha256sum _fulldump.bin.extracted/squashfs-root/usr/bin/dgiot
gave again:
e82679a9575c150a718b5a211b7584bb82556eddbfefdf3f932bbc1288a4c1e0 _fulldump.bin.extracted/squashfs-root/usr/bin/dgiot
If you want to take a look at the binary; fulldump.zip
from lscindoorcameralocal1080p.
Thanks for sharing. Here is mine:
2490368 0x260000 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 4671622 bytes, 222 inodes, blocksize: 131072 bytes, created: 2022-04-27 11:38:29
from lscindoorcameralocal1080p.
Taking a quick look at your binary dump, the only change seems to be the dgiot
.
from lscindoorcameralocal1080p.
Taking a quick look at your binary dump, the only change seems to be the
dgiot
.
Does that mean I can just continue? Shall I use your dump or continue with mine?
from lscindoorcameralocal1080p.
I could not find any major changes in your binary. But to continue with the patch I provided in this repo you need to use my version of dgiot
.
You can use my full dump or you can just replace your dgiot
with the one that is inside the dump I provided to you. After that, you are good to go 😄
from lscindoorcameralocal1080p.
Almost there but after a reboot I've got a permission denied:
U-Boot> reset
resetting ...
ROM: Use nor flash.
ROM: Init DDR..Training done.
ROM: Ok
U-Boot 2010.06 (Sep 08 2021 - 09:21:26)
DRAM: 64 MiB
master [ctl : mem] = [0 : 0]
SF: Got idcode 20 40 17 20 40
use default flash ops...
spi_flash_probe_default multi wire open flag is 0
found speed : delay = 50000000 ;1
In: serial
Out: serial
Err: serial
MMC: FH_MMC: 0
MMC FLASH INIT: No card on slot!
Net: FH EMAC
Hit any key to stop autoboot: 0
master [ctl : mem] = [0 : 0]
SF: Got idcode 20 40 17 20 40
use default flash ops...
spi_flash_probe_default multi wire open flag is 0
found speed : delay = 50000000 ;1
8192 KiB default_flash at 0:0 is now current device
## Booting kernel from Legacy Image at a1000000 ...
Image Name: Linux-4.9.129
Created: 2021-12-11 3:44:31 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1899280 Bytes = 1.8 MiB
Load Address: a0008000
Entry Point: a0008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK
prepare atags
Starting kernel ...
[ 0.302845] rtc get time:rtc core busy 248
[ 0.306535] rtc get time:rtc core busy 248
[ 0.309539] rtc get time:rtc core busy 248
starting pid 62, tty '': '/etc/init.d/rcS'
[RCS]: /etc/init.d/S01udev
Starting udev: [ OK ]
[RCS]: /etc/init.d/S02init_rootfs
[RCS]: /etc/init.d/S03network
starting pid 98, tty '': '/sbin/getty -L console 115200 vt100 '
(none) login: [ 3.450933] SSV6XXX_SDIO mmc1:0001:1: vendor = 0x5653 device = 0x2060
[ 3.494871] SSV6XXX_SDIO mmc1:0001:1: dataIOPort 0x10000 regIOPort 0x10020
[ 3.521934] SSV6XXX_SDIO mmc1:0001:1: dataIOPort 0x10000 regIOPort 0x10020
[ 3.536029] SSV6XXX HCI TX Task started.
[ 3.566098] Enable HCI TX aggregation
start
/usr/init/app_init.sh: line 38: ./init.sh: Permission denied
from lscindoorcameralocal1080p.
Edit: The script needs to be executable before you copy that to the camera. That file should have already been executable by the way.
chmod +x init.sh
from lscindoorcameralocal1080p.
Yeah I did that - couple of times even - even tried with chmod 777
.
Current output of ls -l _fulldump.bin.extracted/squashfs-root/usr/bin
total 28
-rwxr-xr-x 1 dietpi dietpi 13900 Apr 27 2022 daemon
-rwxr--r-- 1 dietpi dietpi 2640 Sep 26 2021 day_mis2006_mipi_attr.hex
lrwxrwxrwx 1 dietpi dietpi 10 Jul 12 07:43 dgiot -> /mnt/dgiot
-rwxrwxrwx 1 dietpi dietpi 3505 Jul 12 07:50 init.sh
-rwxr--r-- 1 dietpi dietpi 2640 Sep 24 2021 night_mis2006_mipi_attr.hex
from lscindoorcameralocal1080p.
I was trying to do all over again just to double check, however one of my leads broke of the UART, while soldering I think I fried one of the components 🙃
So I'm sorry to say that the story ends for know...
from lscindoorcameralocal1080p.
I will, thanks for your help and efforts!
from lscindoorcameralocal1080p.
Related Issues (3)
- Bricked Device? HOT 6
- Bootloop after modding HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lscindoorcameralocal1080p.