Да, рутовый просто так не сбросишь.Bespredel писал(а):Заказал камеру на похожей плате(90%)и таким же софтом. Слил прошивку и залил в эту. Заработала.
Пароль ROOT сбросить не получилось из под загрузчика. Стандартные не подходят.
Учитывая, что камера у меня висит в облаке, а ID изменить нельзя, дамп выкладывать не буду.
От тебя только дамп девайсаBespredel писал(а):Что именно выложить?
Как я могу выложить хэш пароля, если я в систему войти не могу.
Выстави камеру эту наружу в полный доступ!Bespredel писал(а):Что именно выложить?
Как я могу выложить хэш пароля, если я в систему войти не могу.
Код: Выделить всё
U-Boot 2010.06 (Mar 15 2013 - 13:06:03)
DRAM: 256 MiB
NAND: Special Nand id table Version 1.35
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found!!!
0 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128XX"
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
hisilicon # setenv bootargs mem=44M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=hi_sfc:512K(boot),2560K(kernel),13M(rootfs) init=/bin/sh
hisilicon # sf probe 0
16384 KiB hi_sfc at 0:0 is now current device
hisilicon # sf read 0x82000000 0x80000 0x280000
hisilicon # bootm 0x82000000
Wrong Image Format for bootm command
ERROR: can't get kernel image!Код: Выделить всё
hisilicon # printenv
bootdelay=1
baudrate=115200
ethaddr=00:00:23:34:45:66
netmask=255.255.255.0
bootfile="uImage"
ipaddr=192.168.1.9
serverip=192.168.1.7
bootcmd=sf probe 0;sf read 0x82000000 0x100000 0x300000;bootm 0x82000000
bootargs=mem=64M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=hi_sfc:1M(boot),3M(kernel),11776K(rootfs),512K(config)
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Mar 15 2013 - 13:06:03)Код: Выделить всё
? - alias for 'help'
base - print or set address offset
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
ext2load- load binary file from a Ext2 filesystem
ext2ls - list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
tftp - tftp - download or upload image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor versionСправка по командамSkif42.ru писал(а):пока ждал ответа сквозь поток данных отправил через UART
# cat /etc/passwd
И увидел ответ
# root:$1$$qRPK7m23GJusamGpoGLby/:0:0::/root:/bin/sh
Пустой пароль.
По телнету зацепился, справки по командам нет. в корневом каталоге команда ls не отображает список, по наитию зайдя в в каталог /dev вижу список папок.
Прошу прощения нуб я в юниксах полный
Код: Выделить всё
busyboxКод: Выделить всё
dmesgКод: Выделить всё
hisilicon # sf probe 0
8192 KiB hi_sfc at 0:0 is now current device
hisilicon # sf read 0x82000000 0x580000 0x200000
hisilicon # tftp 0x82000000 kernel.img 0x200000
Код: Выделить всё
# dmesg
Linux version 3.0.8 (pub@BVT-SDK-SERVER3) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #1 Fri Mar 15 13:04:56 CST 2013
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518
Memory policy: ECC disabled, Data cache writeback
AXI bus clock 220000000.
On node 0 totalpages: 16384
free_area_init_node: node 0, pgdat c0535728, node_mem_map c0554000
Normal zone: 128 pages used for memmap
Normal zone: 0 pages reserved
Normal zone: 16256 pages, LIFO batch:3
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: mem=64M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=hi_sfc:1M(boot),3M(kernel),11776K(rootfs),512K(config)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 59480k/59480k available, 6056k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
vmalloc : 0xc4800000 - 0xfe000000 ( 920 MB)
lowmem : 0xc0000000 - 0xc4000000 ( 64 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.init : 0xc0008000 - 0xc0029000 ( 132 kB)
.text : 0xc0029000 - 0xc0512000 (5028 kB)
.data : 0xc0512000 - 0xc0535da0 ( 144 kB)
.bss : 0xc0535dc4 - 0xc0553040 ( 117 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32 nr_irqs:32 32
sched_clock: 32 bits at 110MHz, resolution 9ns, wraps every 39045ms
Console: colour dummy device 80x30
Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.16)
yaffs: yaffs built Mar 15 2013 13:04:54 Installing.
msgmni has been set to 116
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
loop: module loaded
Spi id table Version 1.22
Hisilicon Spi Flash Controller V350 Device Driver, Version 1.10
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
SPI FLASH start_up_mode is 3 Bytes
Spi(cs1):
Block:64KB
Chip:16MB
Name:"MX25L128XX"
spi size: 0x16777216
chip num: 1
4 cmdlinepart partitions found on MTD device hi_sfc
Creating 4 MTD partitions on "hi_sfc":
0x000000000000-0x000000100000 : "boot"
0x000000100000-0x000000400000 : "kernel"
0x000000400000-0x000000f80000 : "rootfs"
0x000000f80000-0x000001000000 : "config"
Fixed MDIO Bus: probed
himii: probed
usbcore: registered new interface driver rt2500usb
usbcore: registered new interface driver rt73usb
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver cdc_wdm
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver ums-alauda
usbcore: registered new interface driver ums-datafab
usbcore: registered new interface driver ums-freecom
usbcore: registered new interface driver ums-isd200
usbcore: registered new interface driver ums-jumpshot
usbcore: registered new interface driver ums-sddr09
usbcore: registered new interface driver ums-sddr55
usbcore: registered new interface driver mdc800
mdc800: v0.7.5 (30/10/2000):USB Driver for Mustek MDC800 Digital Camera
mousedev: PS/2 mouse device common for all mice
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
lib80211_crypt: registered algorithm 'NULL'
Registering the dns_resolver key type
registered taskstats version 1
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
VFS: Mounted root (jffs2 filesystem) on device 31:2.
Freeing init memory: 132K
udevd (498): /proc/498/oom_adj is deprecated, please use /proc/498/oom_score_adj instead.
Hisilicon Media Memory Zone Manager
hi3518_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Hisilicon UMAP device driver interface: v3.00
pa:84000000, va:c4a00000
load sys.ko for Hi3518...OK!
load viu.ko for Hi3518...OK!
ISP Mod init!
load vpss.ko ....OK!
load vou.ko ....OK!
load venc.ko for Hi3518...OK!
load group.ko for Hi3518...OK!
load chnl.ko for Hi3518...OK!
load h264e.ko for Hi3518...OK!
load jpege.ko for Hi3518...OK!
load rc.ko for Hi3518...OK!
load region.ko ....OK!
load vda.ko ....OK!
hi_i2c init is ok!
gpio_0_base_addr_virtual:0xc4d00000 !
Set Gpio0_6 dir to 1!
Set Gpio0_6 bit to 0!
Set Gpio0_6 bit to 1!
Kernel: ssp initial ok!
acodec inited!
rtusb init rtusbSTA --->
usbcore: registered new interface driver rtusbSTA
entry jb_hi_authen0104_init
DMS_Read0104Data failed
no ic ack
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=60 sec (nowayout= 1, nodeamon= 0)
?????????????????? i2c_setgpio
?????????????????? i2c_setgpio
It is JB_AUTHEN_READ_DATA!
It is JB_AUTHEN_READ_DATA!
It is JB_AUTHEN_WRITE_DATA!
It is JB_AUTHEN_WRITE_DATA!
It is JB_AUTHEN_READ_DATA!
wait write ack ok timeout, i=6!
It is JB_AUTHEN_READ_DATA!
It is JB_AUTHEN_WRITE_DATA!
It is JB_AUTHEN_WRITE_DATA!
It is JB_AUTHEN_READ_DATA!
wait write ack ok timeout, i=6!
It is JB_AUTHEN_READ_DATA!
ADDRCONF(NETDEV_UP): eth0: link is not ready
PHY: himii:01 - Link is Up - 100/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
hirtc_set_time->394:
check state error!
hirtc_set_time->394:
check state error!
eth0: no IPv6 routers present
С флеша сливай всё в u-boot, весь образ.Skif42.ru писал(а):Это я так понимаю не полная прошивка будет?Код: Выделить всё
hisilicon # sf probe 0 8192 KiB hi_sfc at 0:0 is now current device hisilicon # sf read 0x82000000 0x580000 0x200000 hisilicon # tftp 0x82000000 kernel.img 0x200000
Вот же карта памяти.Skif42.ru писал(а):Код: Выделить всё
# dmesg ... Creating 4 MTD partitions on "hi_sfc": 0x000000000000-0x000000100000 : "boot" 0x000000100000-0x000000400000 : "kernel" 0x000000400000-0x000000f80000 : "rootfs" 0x000000f80000-0x000001000000 : "config" ...
