Smartwares CIP-39218AT Ethernet + WiFi fisheye

Moderator: leecollings

Post Reply
metsys
Posts: 5
Joined: Friday 22 July 2022 11:18
Target OS: Linux
Domoticz version: 2022.1
Contact:

Smartwares CIP-39218AT Ethernet + WiFi fisheye

Post by metsys »

I am still looking for a suitable camera with full access to the operating system.
Found another camera at a flea market and got this information:

SoC HiSilicon 3518EV200
WiFi Realtek 8188FTV
Etherenet Realtek RTL8201F
Flash KH25L12835F
CryptoIC FT24C02A
SD-card reader
Some pictures:
Image
Spoiler: show
Image
Image
Image
Image
Image
Image
Image
UART and boot log:
Spoiler: show

Code: Select all

System startup


U-Boot 2010.06 (Oct 12 2015 - 21:54:32)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
SPI Nor total size: 16MB
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0 
16384 KiB hi_fmc at 0:0 is now current device


## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.4.35
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1936288 Bytes = 1.8 MiB
   Load Address: 80008000
   Entry Point:  80008000
## Loading init Ramdisk from Legacy Image at 81700000 ...
   Image Name:   JUAN filesystem
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    5111808 Bytes = 4.9 MiB
   Load Address: 81000000
   Entry Point:  81000000
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0
Linux version 3.4.35 (root@john-pc) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v300) ) #3 Sat Dec 23 11:01:37 CST 2017
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518ev200
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 10922
Kernel command line: mem=43M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:192K(uboot),64K(env),64K(user),704K(conf),2560K(kernel),9216K(rootf0
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 43MB = 43MB total
Memory: 33144k/33144k available, 10888k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xc3000000 - 0xff000000   ( 960 MB)
    lowmem  : 0xc0000000 - 0xc2b00000   (  43 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc04c6000   (4856 kB)
      .init : 0xc04c6000 - 0xc04e7c0c   ( 136 kB)
      .data : 0xc04e8000 - 0xc0512c00   ( 171 kB)
       .bss : 0xc0512c24 - 0xc0550878   ( 248 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32
VIC @fe0d0000: id 0x00641190, vendor 0x41
sched_clock: 32 bits at 49MHz, resolution 20ns, wraps every 86767ms
Console: colour dummy device 80x30
Calibrating delay loop... 269.10 BogoMIPS (lpj=1345536)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x803a4588 - 0x803a45e0
dummy: 
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 30) is a PL011 rev2
uart:2: ttyAMA2 at MMIO 0x200a0000 (irq = 25) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
hi-spi-master hi-spi-master.0: with 1 chip select slaves attached
hi-spi-master hi-spi-master.1: with 2 chip select slaves attached
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer0
FS-Cache: Loaded
CacheFiles: Loaded
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (junk in compressed archive); looks like an initrd
Freeing initrd memory: 4992K
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NFS: Registering the id_resolver key type
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
ROMFS MTD (C) 2007 Red Hat, Inc.
fuse init (API version 7.18)
msgmni has been set to 74
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
loop: module loaded
Check Flash Memory Controller v100 ...  Found.
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
SPI Nor total size: 16MB
7 cmdlinepart partitions found on MTD device hi_sfc
7 cmdlinepart partitions found on MTD device hi_sfc
Creating 7 MTD partitions on "hi_sfc":
0x000000000000-0x000000030000 : "uboot"
0x000000030000-0x000000040000 : "env"
0x000000040000-0x000000050000 : "user"
0x000000050000-0x000000100000 : "conf"
0x000000100000-0x000000380000 : "kernel"
0x000000380000-0x000000c80000 : "rootfs"
0x000000c80000-0x000001000000 : "custom"
himii: probed
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
NET: Registered protocol family 24
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
usbcore: registered new interface driver option
USB Serial support registered for GSM modem (1-port)
dwc_otg: version 3.00a 10-AUG-2012
Core Release: 3.10a
Setting default values for core params
Using Buffer DMA mode
Periodic Transfer Interrupt Enhancement - disabled
Multiprocessor Interrupt Enhancement - disabled
OTG VER PARAM: 0, OTG VER FLAG: 0
Dedicated Tx FIFOs mode
i2c /dev entries driver
hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed!
hisi_i2c hisi_i2c.1: Hisilicon [i2c-1] probed!
hisi_i2c hisi_i2c.2: Hisilicon [i2c-2] probed!
TCP: bic registered
TCP: cubic registered
TCP: westwood registered
TCP: htcp registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
8021q: 802.1Q VLAN Support v1.8
lib80211: common routines for IEEE802.11 drivers
Registering the dns_resolver key type
ÿRAMDISK: squashfs filesystem found at block 0
RAMDISK: Loading 4989KiB [1 disk] into ram disk... done.
VFS: Mounted root (squashfs filesystem) readonly on device 1:0.
Freeing init memory: 132K
starting pid 622, tty '': '/etc/init.d/rcS'

            _ _ _ _ _ _ _ _ _ _ _ _
            \  _  _   _  _ _ ___
            / /__/ \ |_/
           / __   /  -  _ ___
          / /  / /  / /
  _ _ _ _/ /  /  \_/  \_ ______
___________\___\__________________

[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01udev
Not recognise ACTION:change
Not recognise ACTION:change
[RCS]: /etc/init.d/S10mpp
route: SIOCADDRT: No such process
[RCS]: /etc/init.d/S80network
mmz_start: 0x82b00000, mmz_size: 21M
Hisilicon Media Memory Zone Manager
Module himedia: init ok
hi3518e_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
load sys.ko for Hi3518EV200...OK!
load tde.ko ...OK!
load region.ko ....OK!
load vgs.ko for Hi3518EV200...OK!
ISP Mod init!
load viu.ko for Hi3518EV200...OK!
load vpss.ko ....OK!
load rc.ko for Hi3518EV200...OK!
load venc.ko for Hi3518EV200...OK!
load chnl.ko for Hi3518EV200...OK!
load h264e.ko for Hi3518EV200...OK!
load jpege.ko for Hi3518EV200...OK!
load ive.ko for Hi3518EV200...OK!
==== Your input Sensor type is ar0130 ====
JUAN Watchdog Timer: 0.01 initialized. default_margin=60 sec (nowayout= 0, nodeamon= 0)
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0040: 0x00000000 --> 0x00000002 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0044: 0x00000000 --> 0x00000002 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x2PHY: himii:01 - Link is Up00f007c: 0x00000000 --> 0x00000001 
[EN - 100/FullD]

*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0080: 0x00000000 --> 0x00000001 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0084: 0x00000000 --> 0x00000001 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0088: 0x00000000 --> 0x00000001 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f008c: 0x00000000 --> 0x00000002 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0090: 0x00000000 --> 0x00000002 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0094: 0x00000000 --> 0x00000001 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x2003002c: 0x000C4003 --> 0x000B4001 
[END]
acodec inited!
insert audio
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0004: 0x00000000 --> 0x00000001 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20140400: 0x00000000 --> 0x000000A3 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20140080: 0x00000000 --> 0x00000020 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20140080: 0x00000020 --> 0x00000000 
[END]
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20140080: 0x00000000 --> 0x00000020 
[END]
mipi_init
init phy power successful!
load hi_mipi driver successful!
hi_i2c init is ok!
==== Your input Sensor type is ar0130 ====
starting pid 1077, tty '': '/sbin/getty -L ttyS000 115200 vt100 -n root -I "Auto login as root ..."'
Auto login as root ...
(none) login: ***link down status changed***.
PHY: himii:01 - Link is Down
mount dir('/media/tf') isn't exist now!
mount: mounting /dev/mmcblk0p1 on /media/tf failed: No such file or directory
no debug ini file
mknod: /dev/ppp: File exists
Do You Want to Run Application ? (y/n)
JPROCESS::CRIT: [ja_process.c: 663] new ok@child
JPROCESS::CRIT: [ja_process.c: 497] JPROCESS proc....
JPROCESS::CRIT: [ja_process.c: 584] JPROCESS proc....
JPROCESS::CRIT: [ja_process.c: 677] new ok@parent
/usr/share/ipcam/app: invalid option -- c
[    custom.c: 257] NO OEM number
[    custom.c: 257] NO OEM number
[    custom.c: 257] NO OEM number
[    custom.c: 257] NO OEM number
hi_i2c_wait_rxfifo_notempty->281: 
abort! int_raw_status: 0x550!

hi_i2c_abortprocess->87: 
tx_abrt_src is 1.

hi_i2c read faild!
hi_i2c_wait_rxfifo_notempty->281: 
abort! int_raw_status: 0x550!

hi_i2c_abortprocess->87: 
tx_abrt_src is 1.

hi_i2c read faild!
 PS5270 sensor probe rethi_i2c_wait_rxfifo_notempty->281: _data1=0;ret_data2=0

abort! int_raw_status: 0x550!

hi_i2c_abortprocess->87: 
tx_abrt_src is 1.

hi_i2c read faild!
hi_i2c_wait_rxfifo_notempty->281: 
abort! int_raw_status: 0x550!

hi_i2c_abortprocess->87: 
tx_abrt_src is 1.

hi_i2c read faild!
hi_i2c_wait_rxfifo_notempty->281: 
abort! int_raw_status: 0x550!

hi_i2c_abortprocess->87: 
tx_abrt_src is 1.

hi_i2c read faild!
hi_i2c_wait_rxfifo_notempty->281: 
abort! int_raw_status: 0x550!

hi_i2c_abortprocess->87: 
tx_abrt_src is 1.

hi_i2c read faild!
hi_i2c_wait_rxfifo_notempty->281: 
abort! int_raw_status: 0x550!

hi_i2c_abortprocess->87: 
tx_abrt_src is 1.

hi_i2c read faild!
HI_SDK_ISP_sensor_check-1352--31
[model_conf.c:  73] model_conf->snumber.chipModel:0x3518e200
[model_conf.c:  74] model_conf->snumber.productModel:0x20000300
[model_conf.c:  75] model_conf->modelName:P3
sn odm=d-0
enter main application
global_setSystime recover system time 1657634391
RTC_sync_to_system:887 Cur RTC time: 1970/01/01 00:03:43
RTC_sync_to_system 894 sysnc fail,rtc curtime.year 1970
[secure_chip.c: 119] Secure chip init success!
[     ipcam.c: 532] new chip UC_SNumberGet:F4881460739582
[     ipcam.c: 558] hardware version:10100--ID:1880856123
[app_tfcard.c: 588] system cmd: echo 5 > /proc/sys/vm/dirty_ratio
NK_PROCESS::CRIT: [ja_process.c: 167] PROCESS(1116) wait done
[    ticker.c: 130] Add new task(0)
[   sysconf.c: 366] SOC = HI3518E_V2 model = hi3518e_v2-inception
device sn:F4881880856123
upgrade_soc:P3_N18EV2
[      usrm.c: 211] MD5 "cc80e00e3e38841464f4495a43ed147f"
WATCHDOG->[WATCHDOG_init]:297 get watchdog timeout:120 

hi3518e_v2-inception
get sensor type from file:31
SmartSens SC2235 sensor 1080P30fps init success!
HI_SDK_ISP_set_sensor_resolution-1901:1920x1080
width x height = 1920 x 1080 
*** Board tools : ver0.0.1_20121120 *** 
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x201200c8: 0x20F23A2C --> 0x20F23A2C 
[END]
linear mode
==================================================
===SC2235 sensor 1080P30fps reg init success!=====
==================================================
old saturation =128 
daylight mode!
new saturation =160 
sensor type:sc2235-31
NETSDK_conf_load
[    ticker.c: 130] Add new task(1)
[app_netsdk.c: 832] copy isp cfg file:/media/custom/ispcfg/Px/isp_cfg_sc2235_1.ini
[    ticker.c: 130] Add new task(2)
init under AAC mode, init the PtNumPerFrm:1024
[    ticker.c: 152] Delete task(2)
[    ticker.c: 130] Add new task(2)
[ media_buf.c: 318] media buf init success
[   hi3518e_enc.c: 787] Create JPEG CHN 14, 640x360
[   hi3518e_enc.c: 787] Create JPEG CHN 15, 640x360
----system memery size:37Mbytes----
[mediabuffer.c: 228] NEW MB:ch0_0.264 2.00MB(2097152)@0x0xb6257008 max_user:8
vin =0vin =0vin =0vin =0******HI_SDK_ISP_set_flip**flip =0 ***
******HI_SDK_ISP_set_mirror***mirror =0**
[   hi3518e_enc.c: 372] Create H264 Stream(0,0,ch0_0.264) 1920x1080 @ 15/150
src=0.562500   dst=0.562500
stLowDelayInfo bEnable = 0,lines=16
stLowDelayInfo bEnable = 1,lines=540
func:HI_MPI_VENC_SetChnAttr, set chn attr err 0xa0088003 in line:930
----system memery size:37Mbytes----
[mediabuffer.c: 228] NEW MB:ch0_1.264 0.15MB(153600)@0x0xe35718 max_user:8
[   hi3518e_enc.c: 372] Create H264 Stream(0,1,ch0_1.264) 640x360 @ 15/150
src=0.562500   dst=0.562500
[app_netsdk.c: 832] copy isp cfg file:/media/custom/ispcfg/Px/isp_cfg_sc2235_1.ini
old_FRate = 25.000000
new_FRate = 25.000000
old_FRate = 25.000000
new_FRate = 25.000000
[    ticker.c: 152] Delete task(2)
[    ticker.c: 130] Add new task(2)
[   hi3518e_enc.c:1168] create AAC @ 0/0
[    ticker.c: 130] Add new task(3)
[    ticker.c: 130] Add new task(4)
Error open File:/media/tf/production_test.ini
[      wifi.c: 247] system cmd: ifconfig wlan0 down
ifconfig: SIOCGIFFLAGS: No such device
NK_PROCESS::CRIT: [ja_process.c: 167] PROCESS(1125) wait done
[      wifi.c: 248] system cmd: kill -9 `pidof wpa_supplicant`
sh: you need to specify whom to kill
NK_PROCESS::CRIT: [ja_process.c: 167] PROCESS(1132) wait done
[      wifi.c: 249] system cmd: kill -9 `pidof udhcpc`
sh: you need to specify whom to kill
NK_PROCESS::CRIT: [ja_process.c: 167] PROCESS(1135) wait done
[      wifi.c: 250] system cmd: kill -9 `pidof hostapd`
sh: you need to specify whom to kill
NK_PROCESS::CRIT: [ja_process.c: 167] PROCESS(1138) wait done
[      wifi.c: 251] system cmd: kill -9 `pidof udhcpd`
sh: you need to specify whom to kill
NK_PROCESS::CRIT: [ja_process.c: 167] PROCESS(1141) wait done
[ipcam_network.c: 871] MAC Address: 00:9a:34:80:cc:3b
Phy device is connected !!! 
[    ticker.c: 152] Delete task(1)
[app_netsdk.c: 800] NetSDK Image Conf Save!!
[netsdk_image.c: 117] NetSDK Image Conf Save!!
save only one conf:image
[    ticker.c: 152] Delete task(2)
[app_netsdk.c: 488] NetSDK Audio Conf Save!!
[netsdk_audio.c:  61] NetSDK Audio Conf Save!!
save only one conf:audio
PHY: himii:01 - Link is Up - 100/Full
cmd:ifconfig eth0:1 193.169.3.33 netmask 255.255.255.0
[ipcam_network.c: 921] system cmd: ifconfig eth0:1 193.169.3.33 netmask 255.255.255.0
NK_PROCESS::CRIT: [ja_process.c: 167] PROCESS(1149) wait done
Phy device is connected !!! 
Phy device is connected !!! 
[  net_dhcp.c: 269] system cmd: udhcpc -q -s /usr/share/ipcam/shell/landhcp.script -i eth0 &
NK_PROCESS::CRIT: [ja_process.c: 167] PROCESS(1156) wait done
cmd:ifconfig eth0:2 192.168.168.168 netmask 255.255.255.0
[ipcam_network.c: 944] system cmd: ifconfig eth0:2 192.168.168.168 netmask 255.255.255.0
udhcpc (v1.24.1) started
Use default IP in dhcp script!
Sending discover...
NK_PROCESS::CRIT: [ja_process.c: 167] PROCESS(1159) wait done
[ipcam_network.c: 960] GMT: 800
[GMT_SET:191] set TZ(CST-08:00)
sh: can't create /etc/TZ: Read-only file system
[DST_SET:219] source TZ : CST-08:00
set TZ ENV to : CST-08:00DST-09:00,M3.4.0/02:00,M10.4.0/03:00 success!
tzname:CST/DST tzone:-28800 daylight:1
-NK_N1Device_TwoWayTalk_init-
PHY: himii:01 - Link is Up - 100/Full
[app_hichip.c: 191] HICHIP INIT:eth0
[    hichip.c: 274] hichip start
[     spook.c: 194] Spook service "minirtsp" added!
[     spook.c: 194] Spook service "onvif" added!
[    hichip.c: 138] eth0
[hichip_discover.c: 370] bind ip:192.168.168.168
[    hichip.c: 157] system cmd: route add -net 224.0.0.0 netmask 224.0.0.0 eth0
NK_PROCESS::CRIT: [ja_process.c: 167] PROCESS(1167) wait done
host: pool.ntp.org -- ip: 46.249.42.12
[     spook.c: 194] Spook service "owsp" added!
[     spook.c: 194] Spook service "bubble" added!
[     spook.c: 194] Spook service "web" added!
[     spook.c: 194] Spook service "rtmp" added!
[     spook.c: 194] Spook service "regRW" added!
P2PDeviceDemo version:2.0.27.57801231
P2P pthread start sucess
============reboot time==========
week : 2
time : 2:3:25
=================================
[reboot_ontime.c: 222] reboot module init success!
[app_tfcard.c:1319] Record check thread started.
[app_tfcard.c:1380] Mp4 rec daemon thread started.
[ media_buf.c: 433] id=0, i-frame interval=30
recv from 46.249.42.12
RTC_settime:839 Timestamp to set: 1657644365
[    ticker.c: 130] Add new task(1)
[    ticker.c: 130] Add new task(2)
Sending discover...
[ media_buf.c: 433] id=1, i-frame interval=30
Sending select for 192.168.1.199...
Lease of 192.168.1.199 obtained, lease time 43200
[    ticker.c: 130] Add new task(5)
RTC_settime:857 Set RTC: 2022/07/12 16:46:05
ifconfig eth0 192.168.1.199 broadcast 192.168.1.255 netmask 255.255.255.0
deleting routers
Wed Jul 13 01:46:05 DST 2022
[    ticker.c: 130] Add new task(6)
route: SIOCDELRT: No such process
adding dns 192.168.1.1
[    ticker.c: 130] Add new task(7)
[    ticker.c: 130] Add new task(8)
[    ticker.c: 130] Add new task(9)
[    ticker.c: 130] Add new task(10)
[    ticker.c: 130] Add new task(11)
[    ticker.c: 130] Add new task(12)
[    ticker.c: 130] Add new task(13)
[    ticker.c: 130] Add new task(14)
[    ticker.c: 130] Add new task(15)
[    ticker.c: 130] Add new task(16)
[    ticker.c: 130] Add new task(17)
[app_video_ctrl.c: 241] &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
[  net_dhcp.c:  24] arp query ip: 192.168.1.199 not found
Device 1880856123 logined Server!!!
[    ticker.c: 152] Delete task(6)
[ media_buf.c: 433] id=1, i-frame interval=187
[ media_buf.c: 433] id=0, i-frame interval=188
FastUdx Close Done
Device 880856123 logined Server!!!
nk_wifi_adapter_monitor thread id (3050779840) start.
[ media_buf.c: 433] id=1, i-frame interval=227
[ media_buf.c: 433] id=0, i-frame interval=228

 del_task:ipcam_wifi_modify_bps!
[    ticker.c: 152] Delete task(7)
[  net_dhcp.c:  24] arp query ip: 192.168.1.199 not found
post result:0
Login timed out after 60 seconds
process '/sbin/getty -L ttyS000 115200 vt100 -n root -I "Auto login as root ..."' (pid 1077) exited. Scheduling for restart.
starting pid 1224, tty '': '/sbin/getty -L ttyS000 115200 vt100 -n root -I "Auto login as root ..."'
Auto login as root ...
(none) login: 
[  net_dhcp.c:  24] arp query ip: 192.168.1.199 not found
[app_video_ctrl.c: 118] videl stream change to: fps:2 gop:20 bps:256
[ media_buf.c: 433] id=0, i-frame interval=231
[  net_dhcp.c:  24] arp query ip: 192.168.1.199 not found
[ media_buf.c: 433] id=1, i-frame interval=228
[app_video_ctrl.c: 118] videl stream change to: fps:15 gop:150 bps:1024
post result:0

U-boot open (without password)

Code: Select all

hisilicon # help
?       - alias for 'help'
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
ddr     - ddr training function
getinfo - print hardware information
go      - start application at address 'addr'
help    - print command description/usage
loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
tftp    - tftp  - download or upload image via network using TFTP protocol
version - print monitor version

Code: Select all

hisilicon # printenv
bootdelay=1
baudrate=115200
ethaddr=00:9A:9B:9C:9D:9E
ipaddr=192.168.1.10
serverip=192.168.1.40
netmask=255.255.255.0
bootargs=mem=43M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:192K(uboot),64K(env),64K(user),704K(conf),2560K(kernel),9216K(rootfs),3584K(cus0
set_led_gpio7_5=mw 0x200F00F4 0x01
set_led_gpio7_3=mw 0x200F00EC 0x01
set_led_gpio_dir=mw 0x201b0400 0x28
set_led_gpio_enable=mw 0x201b00a0 0xFF
bootcmd=${set_led_gpio7_3}; ${set_led_gpio7_5}; ${set_led_gpio_dir}; ${set_led_gpio_enable};sf probe 0;sf read 0x82000000 0x100000 0x280000;sf read 0x81700000 ;
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Oct 12 2015 - 21:54:32)

Environment size: 745/65532 bytes
SPI flash partitions:

Code: Select all

0x000000000000-0x000000030000 : "uboot"
0x000000030000-0x000000040000 : "env"
0x000000040000-0x000000050000 : "user"
0x000000050000-0x000000100000 : "conf"
0x000000100000-0x000000380000 : "kernel"
0x000000380000-0x000000c80000 : "rootfs"
0x000000c80000-0x000001000000 : "custom"
Sensor 1080P 1/2.7" SmartSens SC2235
metsys
Posts: 5
Joined: Friday 22 July 2022 11:18
Target OS: Linux
Domoticz version: 2022.1
Contact:

Re: Smartwares CIP-39218AT Ethernet + WiFi fisheye

Post by metsys »

Successfully created SPI fullflash image, in case of something went wrong.
All actions via UART:

Code: Select all

System startup


U-Boot 2010.06 (Oct 12 2015 - 21:54:32)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
SPI Nor total size: 16MB
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0       <------just hit any key
hisilicon #
Prepare variables for tftp environment

Code: Select all

hisilicon # setenv ipaddr 192.168.1.253
hisilicon # setenv netmask 255.255.255.0
hisilicon # setenv gatewayip 192.168.1.1
hisilicon # setenv serverip 192.168.1.160
hisilicon # saveenv
Saving Environment to SPI Flash...
Erasing SPI flash, offset 0x00030000 size 64K ...done
Writing to SPI flash, offset 0x00030000 size 64K ...done
finaly

Code: Select all

hisilicon # sf probe 0
16384 KiB hi_fmc at 0:0 is now current device
hisilicon # mw.b 0x82000000 ff 0x1000000
hisilicon # sf read 0x82000000 0x0 0x1000000

hisilicon # tftp 0x82000000 fullflash-CIP39218at.bin 0x1000000  
Hisilicon ETH net controler
MAC:   00-9A-9B-9C-9D-9E
eth0 : phy status change : LINK=DOWN : DUPLEX=FULL : SPEED=100M
eth0 : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP to server 192.168.1.160; our IP address is 192.168.1.253
Upload Filename 'fullflash-CIP39218at.bin'.
Upload from address: 0x82000000, 16.000 MB to be send ...
Uploading: #    [ Connected ]
################################        [ 2.888 MB]
################################        [ 5.752 MB]
################################        [ 8.616 MB]
################################        [11.480 MB]
############################%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%]
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%#%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
         16.000 MB upload ok.

Code: Select all

sf probe 0
select serial flash as current device

Code: Select all

mw.b 0x82000000 ff 0x1000000
clear a section of RAM 0x1000000 bytes for a 16MB chip with starting address 0x82000000 with FF

Code: Select all

sf read 0x82000000 0x0 0x1000000
reading whole amount of data from flash memory chip into RAM

Code: Select all

tftp 0x82000000 fullflash-CIP39218at.bin 0x1000000
download the copied data from RAM to the tftp server with name fullflash-CIP39218at.bin

Now we can use https://hexed.it/ to extract rootfs partion from 0x000000380000 till 0x000000c80000 to rootfs.bin
Image

Image

Image

and extract filesystem with

Code: Select all

binwalk -e rootfs.bin
There in /etc/passwd root hash

Code: Select all

root:xt5USRjG7rEDE:0:0::/root:/bin/sh
Maybe someone can bruteforce it?
metsys
Posts: 5
Joined: Friday 22 July 2022 11:18
Target OS: Linux
Domoticz version: 2022.1
Contact:

Re: Smartwares CIP-39218AT Ethernet + WiFi fisheye

Post by metsys »

A month ago I was pleasantly surprised to find a great project with alternative firmwares https://openipc.org for different SoC.
Since I was stumped by the problem of access to the system itself, the solution came from where I wasn't expecting it - a firmware change.
It wasn't easy, but I made it.
What does it end up yielding:
Spoiler: show
Video
http://192.168.1.10/mjpeg
MJPEG video stream.
http://192.168.1.10/video.mp4
fMP4 video stream.
rtsp://username:[email protected]/stream=0
RTSP main stream (video0).
rtsp://username:[email protected]/stream=1
RTSP substream (video1).
http://192.168.1.10/hls
HLS live-streaming in web browser.
http://192.168.1.10/mjpeg.html
MJPEG & MP3 live-streaming in web browser.
Audio
http://192.168.1.10/audio.opus
Opus audio stream.
http://192.168.1.10/audio.pcm
Raw PCM audio stream.
http://192.168.1.10/audio.m4a
AAC audio stream.
http://192.168.1.10/audio.mp3
MP3 audio stream.
http://192.168.1.10/audio.alaw
A-law compressed audio stream.
http://192.168.1.10/audio.ulaw
μ-law compressed audio stream.
http://192.168.1.10/audio.g711a
G.711 A-law audio stream.
Still Images
http://192.168.1.10/image.jpg
Snapshot in JPEG format.
Optional parameters:
width, height - size of resulting image
qfactor - JPEG quality factor (1-99)
color2gray - convert to grayscale
crop - crop resulting image as 16x16x320x320
http://192.168.1.10/image.heif
Snapshot in HEIF format.
http://192.168.1.10/image.yuv420
Snapshot in YUV420 format.
http://192.168.1.10/image.dngSnapshot in Adobe DNG format (raw).
Night API
http://192.168.1.10/night/on
Turn on night mode.
http://192.168.1.10/night/off
Turn off night mode.
http://192.168.1.10/night/toggle
Toggle current night mode.
Monitoring
http://192.168.1.10/api/v1/config.json
Actual Majestic config in JSON format.
http://192.168.1.10/metrics
Node exporter for Prometheus.
VPN: vtun, wireguard
Send snapshots to Telegram, e-mail, ftp, etc
YouTube streaming
MQTT
Local WebRTC
RTMP(S) support
FPV version
List of features not limited to this list, but it may vary , for example my SoC cannot H265.

The process itself is mandatory with a backup, above this has already been done.

The next step after the backup is to replace the stock U-Boot with the U-Boot of the OpenIPC build.
specifically for my camera, it can be found here:
https://github.com/OpenIPC/firmware/rel ... versal.bin

Download u-boot-hi3518ev200-universal.bin and save it to the TFTP root directory.

Power on the camera and when the message "Hit any key to stop autoboot " appears, just do it.
You will get to the factory U-boot command line.
Then execute line by line, not all together!

Code: Select all

setenv ipaddr 192.168.17.253
setenv serverip 192.168.17.160
mw.b 0x82000000 ff 0x50000
tftp 0x82000000 u-boot-hi3518ev200-universal.bin
sf probe 0
sf erase 0x0 0x50000
sf write 0x82000000 0x0 ${filesize}
reset
ipaddr, serverip replace with yours
After this step the camera should boot from the OpenIPC U-Boot.

Then it is necessary to flash the kernel and root file system.
Download openipc.hi3518ev200-br.tgz file from: https://github.com/OpenIPC/firmware/rel ... 200-br.tgz
extract archive and save uImage.hi3518ev200 and rootfs.squashfs.hi3518ev200 files to the TFTP root directory.
Power on the camera and when the message "Hit any key to stop autoboot " appears, just do it.
You will get to the openipc U-boot command line.

Code: Select all

run setnor16m
Camera automatically restarts to apply changes!

Code: Select all

setenv ipaddr 192.168.17.253
setenv serverip 192.168.17.160
setenv ethaddr 00:9A:34:80:CC:3B
saveenv
run uknor16m 
run urnor16m
reset
After this step the camera should boot the OpenIPC firmware.
First time SSH or CLI login: root password: no password/empty.
You can find out the IP address of the camera on the router, the camera should get it via the DHCP protocol.
The camera should become available at http://cameraip:85 in browser with login admin and password 12345 and then ‘change password’ dialog page.
You must set your own password.
After that the main menu will appear.

ROLLBACK

It is assumed that you have made a backup. Then place fullflash-cip39218at.bin file to the TFTP root directory.
Power on the camera and when the message "Hit any key to stop autoboot " appears, just do it.
You will get to the openipc U-boot command line.

Code: Select all

mw.b 0x82000000 ff 1000000
tftp 0x82000000 fullflash-cip39218at.bin
sf probe 0
sf erase 0x0 0x1000000
sf write 0x82000000 0x0 ${filesize}
reset

I also made a video of this transition:


I hope my efforts will help someone!
ps
live communication on technical questions here https://t.me/OpenIPC
pps
I will try to make a similar instruction for another camera on the same SoC from the neighboring topic viewtopic.php?t=38878
User avatar
waltervl
Posts: 5148
Joined: Monday 28 January 2019 18:48
Target OS: Linux
Domoticz version: 2024.7
Location: NL
Contact:

Re: Smartwares CIP-39218AT Ethernet + WiFi fisheye

Post by waltervl »

And then the big question: How were you able to connect the camera to Domoticz?
Domoticz running on Udoo X86 (on Ubuntu)
Devices/plugins: ZigbeeforDomoticz (with Xiaomi, Ikea, Tuya devices), Nefit Easy, Midea Airco, Omnik Solar, Goodwe Solar
metsys
Posts: 5
Joined: Friday 22 July 2022 11:18
Target OS: Linux
Domoticz version: 2022.1
Contact:

Re: Smartwares CIP-39218AT Ethernet + WiFi fisheye

Post by metsys »

waltervl wrote: Tuesday 18 October 2022 22:53 And then the big question: How were you able to connect the camera to Domoticz?
Domoticz.png
Domoticz.png (227.17 KiB) Viewed 3731 times
"Stream video" also works good
I apologize for the picture - my window is fogged up

also mqtt available, there you can trigger any scenario (for example motion detect)

Code: Select all

root@openipc-hi3518ev200:~# mosquitto_pub
Error: Both topic and message must be supplied.
mosquitto_pub is a simple mqtt client that will publish a message on a single topic and exit.
mosquitto_pub version 1.6.14 running on libmosquitto 1.6.14.

Usage: mosquitto_pub {[-h host] [-p port] [-u username] [-P password] -t topic | -L URL}
                     {-f file | -l | -n | -m message}
                     [-c] [-k keepalive] [-q qos] [-r] [--repeat N] [--repeat-delay time]
                     [-A bind_address]
                     [-i id] [-I id_prefix]
                     [-d] [--quiet]
                     [-M max_inflight]
                     [-u username [-P password]]
                     [--will-topic [--will-payload payload] [--will-qos qos] [--will-retain]]
                     [--proxy socks-url]
                     [--property command identifier value]
                     [-D command identifier value]
       mosquitto_pub --help

 -A : bind the outgoing socket to this host/ip address. Use to control which interface
      the client communicates over.
 -d : enable debug messages.
 -D : Define MQTT v5 properties. See the documentation for more details.
 -f : send the contents of a file as the message.
 -h : mqtt host to connect to. Defaults to localhost.
 -i : id to use for this client. Defaults to mosquitto_pub_ appended with the process id.
 -I : define the client id as id_prefix appended with the process id. Useful for when the
      broker is using the clientid_prefixes option.
 -k : keep alive in seconds for this client. Defaults to 60.
 -L : specify user, password, hostname, port and topic as a URL in the form:
      mqtt(s)://[username[:password]@]host[:port]/topic
 -l : read messages from stdin, sending a separate message for each line.
 -m : message payload to send.
 -M : the maximum inflight messages for QoS 1/2..
 -n : send a null (zero length) message.
 -p : network port to connect to. Defaults to 1883 for plain MQTT and 8883 for MQTT over TLS.
 -P : provide a password
 -q : quality of service level to use for all messages. Defaults to 0.
 -r : message should be retained.
 -s : read message from stdin, sending the entire input as a message.
 -t : mqtt topic to publish to.
 -u : provide a username
 -V : specify the version of the MQTT protocol to use when connecting.
      Can be mqttv5, mqttv311 or mqttv31. Defaults to mqttv311.
 --help : display this message.
 --repeat : if publish mode is -f, -m, or -s, then repeat the publish N times.
 --repeat-delay : if using --repeat, wait time seconds between publishes. Defaults to 0.
 --quiet : don't print error messages.
 --will-payload : payload for the client Will, which is sent by the broker in case of
                  unexpected disconnection. If not given and will-topic is set, a zero
                  length message will be sent.
 --will-qos : QoS level for the client Will.
 --will-retain : if given, make the client Will retained.
 --will-topic : the topic on which to publish the client Will.
 --proxy : SOCKS5 proxy URL of the form:
           socks5h://[username[:password]@]hostname[:port]
           Only "none" and "username" authentication is supported.

See https://mosquitto.org/ for more information.
alcomys
Posts: 1
Joined: Wednesday 12 April 2023 22:08
Target OS: Windows
Domoticz version:
Contact:

Re: Smartwares CIP-39218AT Ethernet + WiFi fisheye

Post by alcomys »

@Metsys

Can you tell me how did you replaced the fisheye lens?
and where can i buy a new normal lens? and witch type of lens did you bought?

Thanks in advanced.
Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests