NVR HANKVISION model HK-7104 с паролем.

[displays]

Добрый день. Принесли китайское чудо NVR HANKVISION model HK-7104 с паролем. Порт 23 есть с телнета есть но пароль на root не известен, пароли перепробовал с инета разные но не один не подошел.

Starting Microloader ASM built on 8月 16 2014 19:06:19...
Initializing PLLs...
Initializing Clocks..
Initializing DDR PLLs/Clocks...
Initializing DDR controller...
Initializing data section...
Initializing stack ptr...
Switching to 'C' code...
Starting Microloader C...
Found Internal Ethernet PHY on GMAC0....
Stop buzzer!
Finish stop buzzer!
GCS in ISA MODE
GCS: NAND DEVICE SETUP COMPLETE
NAND: Initialization complete
SecureHeader Check:ssboot image is unsigned...
MICRON MT29F1G08ABAEAWP
Setting up default ATAG list...
Jumping to Uboot ...


U-Boot 2009.08 ( 4月 05 2014 - 14:19:55)

DRAM: 256 MB
malloc: Using memory from 0x04200000 to 0x04400000
GCS: Setup In ISA MODE
UART Boot not Supported .....
GCS: NAND DEVICE SETUP COMPLETE
Boot Device: NAND Flash
NAND: ONFI flash detected
ONFI param page 0 valid
128 MiB
Bad block table found at page 65472, version 0x02
Bad block table found at page 65408, version 0x02
nand_read_bbt: Bad block at 0x05260000
*** Warning - bad CRC or NAND, using default environment

BootDev is NAND Flash, Alt Flash can't be same as Boot Device
In: serial
Out: serial
Err: serial
Net: lip0
Hit any key to stop autoboot: 0
nand_read_skip_bad 524288
uldr_check_header begin
uldr isn't exit , crc 0xffffffff, length 0xffffffff
uldr is new

NAND read: device 0 offset 0x180000, size 0x700000
nx_nand: [INFO] ecc error corrected - page = 0x30c, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0x529, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0x537, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0x67d, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0x932, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0xaf2, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0xb97, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0xb99, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0xbb5, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0xbcc, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0xc4d, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0xcdb, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0xdc9, stat = 0xc0
nx_nand: [INFO] ecc error corrected - page = 0xe19, stat = 0xc0
Check_Image 0
7340032 bytes read: OK
## Starting application at 0x00008000 ...
nx_2016 nx_2016: map_probe failed
GMAC:Registering Ethernet ISR number 40
init started: BusyBox v1.16.1 (2014-01-18 10:24:35 CST)



Welcome to the STB development environment.

stb_065990B58276 login:








help и printenv




Starting Microloader ASM built on 8月 16 2014 19:06:19...
Initializing PLLs...
Initializing Clocks..
Initializing DDR PLLs/Clocks...
Initializing DDR controller...
Initializing data section...
Initializing stack ptr...
Switching to 'C' code...
Starting Microloader C...
Found Internal Ethernet PHY on GMAC0....
Stop buzzer!
Finish stop buzzer!
GCS in ISA MODE
GCS: NAND DEVICE SETUP COMPLETE
NAND: Initialization complete
SecureHeader Check:ssboot image is unsigned...
MICRON MT29F1G08ABAEAWP
Setting up default ATAG list...
Jumping to Uboot ...


U-Boot 2009.08 ( 4月 05 2014 - 14:19:55)

DRAM: 256 MB
malloc: Using memory from 0x04200000 to 0x04400000
GCS: Setup In ISA MODE
UART Boot not Supported .....
GCS: NAND DEVICE SETUP COMPLETE
Boot Device: NAND Flash
NAND: ONFI flash detected
ONFI param page 0 valid
128 MiB
Bad block table found at page 65472, version 0x02
Bad block table found at page 65408, version 0x02
nand_read_bbt: Bad block at 0x05260000
*** Warning - bad CRC or NAND, using default environment

BootDev is NAND Flash, Alt Flash can't be same as Boot Device
In: serial
Out: serial
Err: serial
Net: lip0
Hit any key to stop autoboot: 0
Kronos $ help
? - alias for 'help'
autoscr - DEPRECATED - use "source" command instead
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
checkuldr- update the uldr from offset by size
chpart - change active partition
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
erase - erase FLASH memory
exit - exit script
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
gcs - GCS sub-system
go - start application at address 'addr'
hdcp - HDCP key generation - input/output uses loadaddr
help - print online help
imxtract- extract a part of a multi-image
in - read data from an IO port
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
nor - NOR sub-system
out - write datum to IO port
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reginfo - print register information
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sfc - SFC sub-system
showvar - print local hushshell variables
sleep - delay execution for some time
source - run script from memory
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
uartboot- Serial sub-system
ubi - ubi commands
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
Kronos $ printenv
bootargs=noinitrd console=ttyS1,115200n8 quiet mtdparts=nx_2017:1024k@0k(uldr),512k@1024k(u-boot),7m@1536k(kernel),20m@9m(root),68m@30m(appfs),7m@99m(kernel_bak),15m@107m(rootfs_bak),2m@123m(image),512k@126m(ptb),512k@129536k(board_info),-(data) root=/dev/mtdblock3 rw rootfstype=jffs2
bootdelay=2
baudrate=115200
ethaddr=04:f9:90:c4:84:1e
ipaddr=192.168.1.239
serverip=192.168.1.236
gatewayip=192.168.1.1
netmask=255.255.255.0
bootfile="vmlinux.bin"
loadaddr=0x00008000
norparts=mtdparts=nx_2016:1024k@0k(uldr),512k@1024k(u-boot),5m@1536k(kernel),32m@7m(root),32m@39m(appfs),-(extra)
norids=nor0=nx_2016
nandparts=mtdparts=nx_2017:1024k@0k(uldr),512k@1024k(u-boot),7m@1536k(kernel),20m@9m(root),68m@30m(appfs),7m@99m(kernel_bak),15m@107m(rootfs_bak),2m@123m(image),512k@126m(ptb),512k@129536k(board_info),-(data)
nandids=nand0=nx_2017
sfcparts=mtdparts=nx_sfc:1024k@0k(uldr),512k@1024k(u-boot),5m@1536k(kernel),8m@7m(root),-(extra)
sfcids=sfc0=nx_sfc
Image=tftp 0x00008000 Image; go 0x00008000
autoload=n
uboot=tftp 0x00008000 u-boot.bin; go 0x00008000
norboot=nor read 0x180000 0x500000; go 0x8000
nandboot=checkuldr 0 0; nand read 0x180000 0x700000; go 0x8000
sfcboot=sfc read 0x180000 0x500000; go 0x8000
uboot_macaddr=1
dnsip=192.168.1.3
altflash=NAND
uboot_cmdline=1
write_uldr=nand erase uldr; tftp uldr.bin.uartboot_img; nand write uldr $filesize
write_uboot=nand erase u-boot; tftp u-boot.bin; nand write u-boot $filesize
write_kernel=nand erase kernel; tftp vmlinux.bin; nand write kernel $filesize
write_rootfs=nand erase root; tftp rootfs.arm.jffs2.nand; nand write root $filesize
write_appfs=nand erase appfs; tftp appfs.jffs2.nand; nand write appfs $filesize
done=run write_uldr; run write_uboot; run write_kernel; run write_rootfs; run write_appfs
write_kernel_bak=nand erase kernel_bak; tftp vmlinux.bin; nand write kernel_bak $filesize
done_ship=run done; run write_kernel_bak
splashaddr=0x7B00000
mtdparts=mtdparts=nx_2017:1024k@0k(uldr),512k@1024k(u-boot),7m@1536k(kernel),20m@9m(root),68m@30m(appfs),7m@99m(kernel_bak),15m@107m(rootfs_bak),2m@123m(image),512k@126m(ptb),512k@129536k(board_info),-(data)
mtdids=nand0=nx_2017
bootcmd=run nandboot
stdin=serial
stdout=serial
stderr=serial
dieid#=00000000
ethact=lip0

Environment size: 2234/131068 bytes
Kronos $

[fobos]

так вам пароль на телнет нужен или на админскую учетку?

[displays]

Желательно на админку пожалуйста. Если нету то на телнет.

[dede]

Снимайте дамп

[displays]

Пробовал по фтп слить дамп не получилось.



Starting Microloader ASM built on 8月 16 2014 19:06:19...
Initializing PLLs...
Initializing Clocks..
Initializing DDR PLLs/Clocks...
Initializing DDR controller...
Initializing data section...
Initializing stack ptr...
Switching to 'C' code...
Starting Microloader C...
Found Internal Ethernet PHY on GMAC0....
Stop buzzer!
Finish stop buzzer!
GCS in ISA MODE
GCS: NAND DEVICE SETUP COMPLETE
NAND: Initialization complete
SecureHeader Check:ssboot image is unsigned...
MICRON MT29F1G08ABAEAWP
Setting up default ATAG list...
Jumping to Uboot ...


U-Boot 2009.08 ( 4月 05 2014 - 14:19:55)

DRAM: 256 MB
malloc: Using memory from 0x04200000 to 0x04400000
GCS: Setup In ISA MODE
UART Boot not Supported .....
GCS: NAND DEVICE SETUP COMPLETE
Boot Device: NAND Flash
NAND: ONFI flash detected
ONFI param page 0 valid
128 MiB
Bad block table found at page 65472, version 0x02
Bad block table found at page 65408, version 0x02
nand_read_bbt: Bad block at 0x05260000
*** Warning - bad CRC or NAND, using default environment

BootDev is NAND Flash, Alt Flash can't be same as Boot Device
In: serial
Out: serial
Err: serial
Net: lip0
Hit any key to stop autoboot: 0
Kronos $ printenv
bootargs=noinitrd console=ttyS1,115200n8 quiet mtdparts=nx_2017:1024k@0k(uldr),512k@1024k(u-boot),7m@1536k(kernel),20m@9m(root),68m@30m(appfs),7m@99m(kernel_bak),15m@107m(rootfs_bak),2m@123m(image),512k@126m(ptb),512k@129536k(board_info),-(data) root=/dev/mtdblock3 rw rootfstype=jffs2
bootdelay=2
baudrate=115200
ethaddr=04:f9:90:c4:84:1e
ipaddr=192.168.1.239
serverip=192.168.1.236
gatewayip=192.168.1.1
netmask=255.255.255.0
bootfile="vmlinux.bin"
loadaddr=0x00008000
norparts=mtdparts=nx_2016:1024k@0k(uldr),512k@1024k(u-boot),5m@1536k(kernel),32m@7m(root),32m@39m(appfs),-(extra)
norids=nor0=nx_2016
nandparts=mtdparts=nx_2017:1024k@0k(uldr),512k@1024k(u-boot),7m@1536k(kernel),20m@9m(root),68m@30m(appfs),7m@99m(kernel_bak),15m@107m(rootfs_bak),2m@123m(image),512k@126m(ptb),512k@129536k(board_info),-(data)
nandids=nand0=nx_2017
sfcparts=mtdparts=nx_sfc:1024k@0k(uldr),512k@1024k(u-boot),5m@1536k(kernel),8m@7m(root),-(extra)
sfcids=sfc0=nx_sfc
Image=tftp 0x00008000 Image; go 0x00008000
autoload=n
uboot=tftp 0x00008000 u-boot.bin; go 0x00008000
norboot=nor read 0x180000 0x500000; go 0x8000
nandboot=checkuldr 0 0; nand read 0x180000 0x700000; go 0x8000
sfcboot=sfc read 0x180000 0x500000; go 0x8000
uboot_macaddr=1
dnsip=192.168.1.3
altflash=NAND
uboot_cmdline=1
write_uldr=nand erase uldr; tftp uldr.bin.uartboot_img; nand write uldr $filesize
write_uboot=nand erase u-boot; tftp u-boot.bin; nand write u-boot $filesize
write_kernel=nand erase kernel; tftp vmlinux.bin; nand write kernel $filesize
write_rootfs=nand erase root; tftp rootfs.arm.jffs2.nand; nand write root $filesize
write_appfs=nand erase appfs; tftp appfs.jffs2.nand; nand write appfs $filesize
done=run write_uldr; run write_uboot; run write_kernel; run write_rootfs; run write_appfs
write_kernel_bak=nand erase kernel_bak; tftp vmlinux.bin; nand write kernel_bak $filesize
done_ship=run done; run write_kernel_bak
splashaddr=0x7B00000
mtdparts=mtdparts=nx_2017:1024k@0k(uldr),512k@1024k(u-boot),7m@1536k(kernel),20m@9m(root),68m@30m(appfs),7m@99m(kernel_bak),15m@107m(rootfs_bak),2m@123m(image),512k@126m(ptb),512k@129536k(board_info),-(data)
mtdids=nand0=nx_2017
bootcmd=run nandboot
stdin=serial
stdout=serial
stderr=serial
dieid#=00000000
ethact=lip0

Environment size: 2234/131068 bytes
Kronos $ nand read 0x2000000 0 0x8000000

NAND read: device 0 offset 0x2000000, size 0x0
0 bytes read: OK
Kronos $ tftp 0x2000000 nvr.bin 0x8000000
tftpboot - boot image via network using TFTP protocol

Usage:
tftpboot [loadAddress] [[hostIPaddr:]bootfilename]
Kronos $

[M - 16.]

Картинки интерфейсов покажите.
В bootargs попробуйте дописать init=/bin/sh, может автоматом залогинится...

[displays]

Картинки интерфейсов покажите.
В bootargs попробуйте дописать init=/bin/sh, может автоматом залогинится...

По подробнй можно пожалуйста.

Вот фото платы. Это nvr wi fi камерами.

https://cloud.mail.ru/public/RLF5/8tKPx8Ho3" onclick="window.open(this.href);return false;

[dede]

setenv bootargs потом все, что было стандартно и потом в конце init=/bin/sh

Или может у вас прошивка на него есть?

[displays]

Прошивки нет на него. Первый раз вижу такой рег.

Прописал init=/bin/sh конце и нажал интр, что то не понятно.

setenv bootagrs console=ttyS1,115200n8 quiet mtdparts=nx_2017:1024k@0k(uldr),512k@1024k(u-boot),7m@1536k(kernel),20m@9m(root),68m@30m(appfs),7m@99m(kernel_bak),15m@107m(rootfs_bak),2m@123m(image),512k@126m(ptb),512k@129536k(board_info),-(data) root=/dev/mtdblock3 rw rootfstype=jffs2 init=/bin/sh

[dede]

Ну, и? saveenv и reset , есть доступ в консоль?

[displays]

Kronos $ setenv bootagrs console=ttyS1,115200n8 quiet mtdparts=nx_2017:1024k@0k(uldr),512k@1024k(u-boot),7m@1536k(kernel),20m@9m(root),68m@30m(appfs),7m@99m(kernel_bak),15m@107m(rootfs_bak),2m@123m(image),512k@126m(ptb),512k@129536k(board_info),-(data) root=/dev/mtdblock3 rw rootfstype=jffs2 init=/bin/sh
Kronos $ saveenv
Saving Environment to NAND...
Erasing Nand...
Erasing at 0x160000 -- 100% complete.
Writing to Nand... done
Kronos $ reset
resetting ...
Kronos $

В консоль не попал.
Что там стер не понятно, но пока работает рег. Прежде чем экспериментировать надо на прогере дамп скачать по ходу.

[dede]

Стёрло область env, так и должно быть. По экспериментам - вы правы, но там же НАНД вообще...

Странно, вроде ж и вывод на консоль есть, и все довольно стандартно, точно консоли нет? Если CTRL-C после загрузки понажимать, или вслепую понабирать ls