Different SHA256 about lscindoorcameralocal1080p HOT 16 CLOSED

Aah that is a shame, if you need any help in the future, let me know.

from lscindoorcameralocal1080p.

Hi @Onandon11,

Thanks for contacting me. What is the production date of the camera?
You can see it on the back of the camera.

from lscindoorcameralocal1080p.

Here you go 😃 Looks like the same Revision...

from lscindoorcameralocal1080p.

Interesting...

I would not expect the hash to be different if the production date is the same 🤔
Can you try to perform a second dump and check the hash again? Just to be sure it is not corrupt.

I can give you my dump if there are no hardware differences, then you can continue with the instructions described in this repo.

If the hash is still the same I could take a look at the binary in a reverse engineering tool an check what is different.

from lscindoorcameralocal1080p.

Sure! I will recreate the dump again using this command (?)

# COPY LINE FOR LINE!

mw.b ${baseaddr} ff ${flashsize}
sf probe 0
sf read ${baseaddr} 0x0 ${flashsize}
mmc write dev0 ${baseaddr} 0x10 0x4000

If it's still the same different hash I will want to try it with your dump indeed, it's just laying around and bricking doesn't matter 😀

Will try to do it tomorrow, getting into UBOOT is matter of patience ;)

Besides, curious how you did all this and did all the reversed engineering.

from lscindoorcameralocal1080p.

Yes all those Uboot commands are for a 64Mbit flash or 8MB flash.

For this camera I saw two types of flashes:

• XM25QH64A
• XM25QH64C

You can take a look at what model flash you have.

Besides, curious how you did all this and did all the reversed engineering.

I started of with this user: https://github.com/guino/LSC1080P and continued from there. Did not had any experience with hardware and things like Uboot. I learned some things on the way, destroyed maybe 2 camera's 🙈.
Used Ghidra to take a look at what the code does. Developers left a lot of printf statements. That helps a lot if you are looking at assembly and C like pseudo code. At that point it is just flipping switches... and see what the app is doing on the camera.

from lscindoorcameralocal1080p.

The output line of binwalk -e fulldump.bin gave:

2490368       0x260000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 4671858 bytes, 222 inodes, blocksize: 131072 bytes, created: 2022-04-26 07:12:43

Which is almost the same as your output, except for the created datetime. Maybe there the difference comes from..

Running sha256sum _fulldump.bin.extracted/squashfs-root/usr/bin/dgiot gave again:

e82679a9575c150a718b5a211b7584bb82556eddbfefdf3f932bbc1288a4c1e0  _fulldump.bin.extracted/squashfs-root/usr/bin/dgiot

If you want to take a look at the binary; fulldump.zip

from lscindoorcameralocal1080p.

Thanks for sharing. Here is mine:

fulldump.zip

2490368 0x260000 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 4671622 bytes, 222 inodes, blocksize: 131072 bytes, created: 2022-04-27 11:38:29

from lscindoorcameralocal1080p.

Taking a quick look at your binary dump, the only change seems to be the dgiot.

from lscindoorcameralocal1080p.

Taking a quick look at your binary dump, the only change seems to be the dgiot.

Does that mean I can just continue? Shall I use your dump or continue with mine?

from lscindoorcameralocal1080p.

I could not find any major changes in your binary. But to continue with the patch I provided in this repo you need to use my version of dgiot.

You can use my full dump or you can just replace your dgiot with the one that is inside the dump I provided to you. After that, you are good to go 😄

from lscindoorcameralocal1080p.

Almost there but after a reboot I've got a permission denied:

U-Boot> reset
resetting ...
ROM:    Use nor flash.
ROM:    Init DDR..Training done.
ROM:    Ok


U-Boot 2010.06 (Sep 08 2021 - 09:21:26)

DRAM:  64 MiB
master [ctl : mem] = [0 : 0]
SF: Got idcode 20 40 17 20 40
use default flash ops...
spi_flash_probe_default multi wire open flag is 0
found speed : delay = 50000000 ;1
In:    serial
Out:   serial
Err:   serial
MMC:   FH_MMC: 0
MMC FLASH INIT: No card on slot!
Net:   FH EMAC
Hit any key to stop autoboot:  0
master [ctl : mem] = [0 : 0]
SF: Got idcode 20 40 17 20 40
use default flash ops...
spi_flash_probe_default multi wire open flag is 0
found speed : delay = 50000000 ;1
8192 KiB default_flash at 0:0 is now current device
## Booting kernel from Legacy Image at a1000000 ...
   Image Name:   Linux-4.9.129
   Created:      2021-12-11   3:44:31 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1899280 Bytes = 1.8 MiB
   Load Address: a0008000
   Entry Point:  a0008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
prepare atags

Starting kernel ...

[    0.302845] rtc get time:rtc core busy 248
[    0.306535] rtc get time:rtc core busy 248
[    0.309539] rtc get time:rtc core busy 248
starting pid 62, tty '': '/etc/init.d/rcS'
[RCS]: /etc/init.d/S01udev
Starting udev:      [ OK ]
[RCS]: /etc/init.d/S02init_rootfs
[RCS]: /etc/init.d/S03network
starting pid 98, tty '': '/sbin/getty -L console 115200 vt100 '

(none) login: [    3.450933] SSV6XXX_SDIO mmc1:0001:1: vendor = 0x5653 device = 0x2060
[    3.494871] SSV6XXX_SDIO mmc1:0001:1: dataIOPort 0x10000 regIOPort 0x10020
[    3.521934] SSV6XXX_SDIO mmc1:0001:1: dataIOPort 0x10000 regIOPort 0x10020
[    3.536029] SSV6XXX HCI TX Task started.
[    3.566098] Enable HCI TX aggregation
start
/usr/init/app_init.sh: line 38: ./init.sh: Permission denied

from lscindoorcameralocal1080p.

Edit: The script needs to be executable before you copy that to the camera. That file should have already been executable by the way.

chmod +x init.sh

from lscindoorcameralocal1080p.

Yeah I did that - couple of times even - even tried with chmod 777.

Current output of ls -l _fulldump.bin.extracted/squashfs-root/usr/bin

total 28
-rwxr-xr-x 1 dietpi dietpi 13900 Apr 27  2022 daemon
-rwxr--r-- 1 dietpi dietpi  2640 Sep 26  2021 day_mis2006_mipi_attr.hex
lrwxrwxrwx 1 dietpi dietpi    10 Jul 12 07:43 dgiot -> /mnt/dgiot
-rwxrwxrwx 1 dietpi dietpi  3505 Jul 12 07:50 init.sh
-rwxr--r-- 1 dietpi dietpi  2640 Sep 24  2021 night_mis2006_mipi_attr.hex

from lscindoorcameralocal1080p.

I was trying to do all over again just to double check, however one of my leads broke of the UART, while soldering I think I fried one of the components 🙃

So I'm sorry to say that the story ends for know...

from lscindoorcameralocal1080p.

I will, thanks for your help and efforts!

from lscindoorcameralocal1080p.