Honeywell H4D3PRV2 (только ping)

[dimonster]

Из вывода интересен пункт devalias=IPC-HDBW2320R-ZS. Получается, что теперь известна модель камеры. Осталось найти для неё ПО и можно пробовать восстанавливать?

Ну, если этот ваш "девалиас" не врёт, то вот вам прошивка http://ftp.viatec.ua/Dahua/Firmware/IPC ... 2X-Themis/
По крайней мере, в описании ( list HX1X2X-Themis.txt ) упоминается эта модель.
Скачиваете DH_IPC-HX1X2X-Themis_Eng_P_V2.620.0000004.0.R.191130.bin, программой вроде WinHex меняете внутри файла первые два символа "DH" на "PK", потом меняте расширение .bin на .zip. Получаете архивчик. Из архивчика вытаскиваете все файлики, кроме тех, где упоминается boot
Эти файлики подсовываете TFTP-серверу, возвращаете на место оригинальный Commands.txt, снова запускаете Commands.bat, запускаете TFTP-сервер и перезагружаете камеру. Загрузчик должен подхватить прошивку и по кусочкам её залить. Смотрите в консоль и ждите окончания процесса.

Если есть сложности с превращением бин-файла в архивчик и вытаскиванием оттуда нужных кусков прошивки, то вот вам архивчик уже без лишних файлов.
https://dropmefiles.com/jRZ8i

[artemiy]

Сделал, как Вы написали. Процесс загрузки ПО проходит хорошо, только последний пункт, почему-то, не удаётся выполнить:

Код: Выделить всё

run dr
run dk
run du
run dw
run dp
run dc
tftp 0x82000000 pd-x.squashfs.img; flwrite

Код: Выделить всё

Client 192.168.1.108:2653 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:2521 root\romfs-x.squashfs.img, 514 Blocks Served
Client 192.168.1.108:3467 root\kernel.img, 822 Blocks Served
Client 192.168.1.108:1403 root\user-x.squashfs.img, 5673 Blocks Served
Client 192.168.1.108:3571 root\web-x.squashfs.img, 2015 Blocks Served
Client 192.168.1.108:3557 root\partition-x.cramfs.img, 3 Blocks Served
Client 192.168.1.108:1367 root\custom-x.squashfs.img, 28 Blocks Served
Client 192.168.1.108:2300 root\pd-x.squashfs.img, Timeout

При этом консоль пуста.

[dimonster]

Плохо, что в консоли ничего не видно. Жаль, что нет USB-UART адаптера, чтобы непосредственно к камере подключиться и посмотреть, на что конкретно она ругается.

А ещё попробуйте убрать из Commands.txt команду

Код: Выделить всё

tftp 0x82000000 pd-x.squashfs.img; flwrite

Потом запустить Commands.bat и по новой прошить камеру.
Если ядро Линукса запустится и поднимется веб-интерфейс, то потом прошьёте из веб-интерфейса по нормальному.
А запустилось ли ядро можно узнать по характерному щелчку светофильтра при запуске камеры.

Ещё есть мысль, что для работы новой прошивки требуется также обновить загрузчик. Но лучше пока не рисковать и обойтись без обновления загрузчика. А то есть риск вообще "окирпичить" камеру.

[artemiy]

Убрал команду - вот такой вывод получил:

Код: Выделить всё

Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x2000000
Downloading: T
done
Bytes transferred = 753728 (b8040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   romfs
   Created:      2017-12-29   2:49:45 UTC
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    753664 Bytes = 736 KiB
   Load Address: 00230000
   Entry Point:  00310000
   Verifying Checksum ... OK
Programing start at: 0x00230000
SPI probe: 16384 KiB GD25Q128C at 0:0 is now current device
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'kernel.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1205400 (126498 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   kernel
   Created:      2017-12-29   2:49:44 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    1205336 Bytes = 1.1 MiB
   Load Address: 000d0000
   Entry Point:  00230000
   Verifying Checksum ... OK
Programing start at: 0x000d0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'user-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 8327232 (7f1040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   user
   Created:      2017-12-29   2:49:49 UTC
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    8327168 Bytes = 7.9 MiB
   Load Address: 00620000
   Entry Point:  00f10000
   Verifying Checksum ... OK
Programing start at: 0x00620000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'web-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 2957376 (2d2040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   web
   Created:      2017-12-29   2:49:49 UTC
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    2957312 Bytes = 2.8 MiB
   Load Address: 00310000
   Entry Point:  00620000
   Verifying Checksum ... OK
Programing start at: 0x00310000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 4160 (1040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   partition
   Created:      2017-12-29   2:49:43 UTC
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    4096 Bytes = 4 KiB
   Load Address: 00080000
   Entry Point:  00090000
   Verifying Checksum ... OK
Programing start at: 0x00080000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 41024 (a040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   custom
   Created:      2017-12-29   2:49:47 UTC
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    40960 Bytes = 40 KiB
   Load Address: 00090000
   Entry Point:  000b0000
   Verifying Checksum ... OK
Programing start at: 0x00090000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x82000000
Downloading: *
done
 t to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,1677

Пустой файл с именем .FLASHING_DONE_STOP_TFTP_NOW нужен лишь для того, как я понимаю, чтобы человек, занимающийся восстановлением ПО, увидел появление его в консоли TFTP-сервер и выключил TFTP-сервер
Сервер выключил. Камера продолжает перезагружаться.

[artemiy]

Жаль, что нет USB-UART адаптера

Заказал из Китая, посылка недели через две-три ожидается.

[dimonster]

Я сейчас повнимательнее прочитал выдачу от команды printenv и понял, что файлы должны записываться в память по адресу 0x2000000, а не 0x82000000
Понятно, почему команда

Код: Выделить всё

tftp 0x82000000 pd-x.squashfs.img; flwrite

вызывала сбой. Попробуйте вот такое прописать в Commands.txt (и запустить Commands.bat не забудьте)

Код: Выделить всё

dr 
dk
du
dw
dp
dc
tftp 0x2000000 pd-x.squashfs.img; flwrite
tftp 0x2000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5

Да, тот пустой файл нужен для того, чтобы челоек понял, что прошивка завершена.
Кроме того, загрузчик может запрашивать файлы failed.txt / success.txt, которых нет, и сам запрос - просто сообщение о результате процесса прошивания

[artemiy]

Сделал. В консоли добавилась запись об успешной "прошивке" pd-squashfs.img:

Код: Выделить всё

Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'pd-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 28736 (7040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   pd
   Created:      2017-12-29   2:50:42 UTC
   Image Type:   ARM Linux Standalone Program (gzip compressed)
   Data Size:    28672 Bytes = 28 KiB
   Load Address: 000b0000
   Entry Point:  000d0000
   Verifying Checksum ... OK
Programing start at: 0x000b0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x2000000
Downloading: *
done
  area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216
fail to read partinfo head
Attempt to read outside the flash area,16777216

Камере это не помогает.

[artemiy]

Добавил последней командой boot. Вот вывод в консоли:

Код: Выделить всё

Wrong Image Format for bootm command
ERROR: can't get kernel image!
try:kload 0x2000000 fail to get partinfo
failed!
cmd Failed boot!

[dimonster]

Мда.. Прошивка явно улеглась на флешь неправильно.
Либо данная прошивка не подходит для данной камеры, несмотрея на "devalias", либо микросхема флешь-памяти помирает.

Вот тут https://dahuacctv.com/threads/%D0%9F%D1 ... -vfs.1009/
у человека нечто похожее было с подобными ругательствами в консоли. Кончилось заменой микросхемы флеш-памяти и вознёй с программатором.

[VirtualLink]

Добавил последней командой boot. Вот вывод в консоли:

Код: Выделить всё

Wrong Image Format for bootm command
ERROR: can't get kernel image!
try:kload 0x2000000 fail to get partinfo
failed!
cmd Failed boot!

Подключись к TTL адаптером напрямую обновляй!
Покажи полный вывод всего, а не обрывки!

[artemiy]

С сайта Dahua пробовал качать ПО для камеры, модель которой значится в devalias: https://www.dahuasecurity.com/products/ ... etail/6151 Видимо, не для испытуемой камеры это ПО.
Ещё раз попробовал загрузить ПО DH_IPC-HX1X2X-Themis_Eng_P_V2.620.0000004.0.R.191130.
Команды в command.txt:

Код: Выделить всё

setenv dh_keyboard 0
saveenv
printenv
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x2000000 pd-x.squashfs.img; flwrite
tftp 0x2000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
partition
bdinfo

Полный вывод в консоли:

Код: Выделить всё

Ncat: Version 7.40 ( https://nmap.org/ncat )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0xc81840c8
Fail to get uboot hd.
partition file version 2
rootfstype squashfs root /dev/mtdblock5
TEXT_BASE:01000000
Net:   Detected MACID:00:12:34:56:78:9a
PHY:0x001cc816,addr:0x00
phy RTL8201 init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 255 (ff hex)
Saving Environment to SPI Flash...
Erasing SPI flash...
Writing to SPI flash...
unknown core,use back
done
bootargs=console=ttyS0,115200 mem=110M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrcbootcmd=sf read 0x200100 0x8000 0x8000;sf read 0x2000000 0xf0000 0x180000;bootm 0x2000000bootdelay=3baudrate=115200ethaddr=00:12:34:56:78:9Aipaddr=192.168.1.108serverip=192.168.1.1autoload=yesgatewayip=192.168.1.1netmask=255.255.255.0ID=000000000000000000da=tftp 0x02000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img

;flwritedr=tftp 0x02000000 romfs-x.squashfs.img; flwritedk=tftp 0x02000000 kernel.img; flwritedu=tftp 0x02000000 user-x.squashfs.img; flwritedw=tftp 0x02000000 web-x.squashfs.img; flwritedp=tftp 0x02000000 partition-x.cramfs.img;flwritedc=tftp 0x02000000 custom-x.squashfs.img; flwriteup=tftp 0x02000000 update.img; flwritetk=tftp 0x02000000 uImage; bootmsysbackup=1logserver=127.0.0.1loglevel=4 autosip=192.168.254.254autolip=192.168.1.108autogw=192.168.1.1autonm=255.255.255.0pd=tftp 0x02000000 pd-x.squashfs.img; flwriteethact=ambarella macappauto=0stdin=serialstdout=serialstderr=serialfilesize=FFfileaddr=5000000dh_keyboard=0
Environment size: 1079/131068 bytes
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1364032 (14d040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   romfs
   Created:

   2019-11-30   4:59:21 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1363968 Bytes = 1.3 MiB
   Load Address: 00270000
   Entry Point:  003c0000
   Verifying Checksum ... OK
Programing start at: 0x00270000
SPI probe: 16384 KiB GD25Q128C at 0:0 is now current device
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'kernel.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1558640 (17c870 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   kernel
   Created:      2019-11-30   4:59:17 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    1558576 Bytes = 1.5 MiB
   Load Address: 000f0000
   Entry Point:  00270000
   Verifying Checksum ... OK
Programing start at: 0x000f0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'user-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 8290368 (7e8040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   user
   Created:      2019-11-30   4:59:30 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    8290304 Bytes = 7.9 MiB
   Load Address: 005d0000
   Entry Point:  00e00000
   Verifying Checksum ... OK
Programing start at: 0x005d0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'web-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 2121792 (206040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   web
   Created:      2019-11-30   4:59:23 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    2121728 Bytes = 2 MiB
   Load Address: 003c0000
   Entry Point:  005d0000
   Verifying Checksum ... OK
Programing start at: 0x003c0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 4160 (1040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   partition
   Created:      2019-11-30   4:59:17 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    4096 Bytes = 4 KiB
   Load Address: 000e0000
   Entry Point:  000f0000
   Verifying Checksum ... OK
Programing start at: 0x000e0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 45120 (b040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   custom
   Created:      2019-11-30   4:59:32 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    45056 Bytes = 44 KiB
   Load Address: 00eb0000
   Entry Point:  00ed0000
   Verifying Checksum ... OK
Programing start at: 0x00eb0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'pd-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 61504 (f040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   pd
   Created:      2019-11-30   4:59:32 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    61440 Bytes = 60 KiB
   Load Address: 00ea0000
   Entry Point:  00eb0000
   Verifying Checksum ... OK
Programing start at: 0x00ea0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x2000000
Downloading: *
done
            name    cs   offset             size               flag   fs_flags      fs_type
         MinBoot    0 0x0000000000000000 0x0000000000040000 0x00000000 0x00000000 0x00000000
          U-Boot    0 0x0000000000080000 0x0000000000040000 0x00000000 0x00000000 0x00000000
            hwid    0 0x00000000000c0000 0x0000000000020000 0x00000000 0x00000000 0x00000000
       partition    0 0x00000000000e0000 0x0000000000010000 0x00000000 0x00000001 0x00000001
          Kernel    0 0x00000000000f0000 0x0000000000180000 0x00000000 0x00000000 0x00000000
           romfs    0 0x0000000000270000 0x0000000000150000 0x00000000 0x00000001 0x00000002
             web    0 0x00000000003c0000 0x0000000000210000 0x00000000 0x00000001 0x00000002
            user    0 0x00000000005d0000 0x0000000000830000 0x00000000 0x00000001 0x00000002
      updateflag    0 0x0000000000e00000 0x0000000000030000 0x00000000 0x00000000 0x00000000
          config    0 0x0000000000e30000 0x0000000000070000 0x00000000 0x00000003 0x00000004
         product    0 0x0000000000ea0000 0x0000000000010000 0x00000000 0x00000001 0x00000002
          custom    0 0x0000000000eb0000 0x0000000000020000 0x00000000 0x00000001 0x00000002
       backupker    0 0x0000000000ed0000 0x00000000000e0000 0x00000000 0x00000001 0x00000002
        backupfs    0 0x0000000000fb0000 0x0000000000050000 0x00000000 0x00000001 0x00000002
           user1    0 0x0000000001000000 0x0000000001000000 0x00000000 0x00000001 0x00000002
         MinBoot mountcmd:
          U-Boot mountcmd:
            hwid mountcmd:
       partition mountcmd:
          Kernel mountcmd:
           romfs mountcmd:
             web mountcmd:mount /dev/mtdblock6 /mnt/web/
            user mountcmd:mount /dev/mtdblock7 /usr/
      updateflag mountcmd:
          config mountcmd:mnt_jffs2 /dev/mtdblock9 /mnt/mtd jffs2
         product mountcmd:mount /dev/mtdblock10 /mnt/pd/
          custom mountcmd:mount /dev/mtdblock11 /mnt/custom/
       backupker mountcmd:
        backupfs mountcmd:
           user1 mountcmd:mount /dev/mtdblock14 /mnt/user/
arch_number = 0x23283041
env_t       = 0x00000000
boot_params = 0x00200000
DRAM bank   = 0x00000000
-> start    = 0x00200000
-> size     = 0x06E00000
ethaddr     = 00:12:34:56:78:9A
ip_addr     = 192.168.1.108
baudrate    = 115200 bps

Как только вижу загрузку файла ".FLASHING_DONE_STOP_TFTP_NOW", выключаю tftp-сервер.
Камера отвечает на ping по адресу 192.168.1.108 стабильно, web недоступен. Через минуту, примерно, перестаёт отвечать на ping.
TTL-адаптер ожидаю из Китая. Как получу, смогу подключиться (писал об этом ранее ).

[artemiy]

Проанализировал вывод printenv и увидел:

Код: Выделить всё

ID=000000000000000000

Также заметил, что отсутствуют BSN, HWID, hwidEx, devalias, а также mac-address указан не укникальный:

Код: Выделить всё

ethaddr=00:12:34:56:78:9A

Сделал файл commands.txt следующего содержания:

Код: Выделить всё

setenv autoapp 1
setenv BSN 2J03C13PAA00600
setenv HWID IPC-HDBW2320R-ZS:01:02:02:19:18:00:01:00:00:00:04:258:00:00:00:00:00:00:00:00:100
setenv hwidEx 00:01:00:00:00:00:00:00:00:00:00:00:00:00:00:00
setenv devalias IPC-HDBW2320R-ZS
setenv ID Z283100332
setenv ethaddr 00:1F:55:2D:0C:1E
saveenv
printenv
run dr
run dk
run du
run dw
run dp
run dc
tftp 0x2000000 pd-x.squashfs.img; flwrite
tftp 0x2000000 .FLASHING_DONE_STOP_TFTP_NOW
sleep 5
partition
bdinfo
printenv

Получил такой вывод:

Код: Выделить всё

Ncat: Version 7.40 ( https://nmap.org/ncat )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0xc81840c8
Fail to get uboot hd.
partition file version 2
rootfstype squashfs root /dev/mtdblock5
TEXT_BASE:01000000
Net:   Detected MACID:00:12:34:56:78:9a
PHY:0x001cc816,addr:0x00
phy RTL8201 init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 550 (226 hex)
Saving Environment to SPI Flash...
Erasing SPI flash...
Writing to SPI flash...
done
bootargs=console=ttyS0,115200 mem=110M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrcbootcmd=sf read 0x200100 0x8000 0x8000;sf read 0x2000000 0xf0000 0x180000;bootm 0x2000000bootdelay=3baudrate=115200ethaddr=00:12:34:56:78:9Aipaddr=192.168.1.108serverip=192.168.1.1autoload=yesgatewayip=192.168.1.1netmask=255.255.255.0da=tftp 0x02000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwritedr=tftp 0x02000000 romfs-x.squashfs.img; flwritedk=tftp 0x02000000 kernel.img; flwritedu=tftp 0x02000000 user-x.squashfs.img; flwritedw=tftp 0x02000000 web-x.squashfs.img; flwritedp=tftp 0x02000000 partition-x.cramfs.img;flwritedc=tftp 0x02000000 custom-x.squashfs.img; flwriteup=tftp 0x02000000 update.img; flwritetk=tftp 0x02000000 uImage; bootmsysbackup=1logserver=127.0.0.1loglevel=4 autosip=192.168.254.254autolip=192.168.1.108autogw=192.168.1.1autonm=255.255.255.0pd=tftp 0x02000000 pd-x.squashfs.img; flwriteethact=ambarella macappauto=0stdin=serialstdout=serialstderr=serialfilesize=226fileaddr=5000000dh_keyboard=0autoapp=1BSN=2J03C13PAA00600HWID=IPC-HDBW2320R-ZS:01:02:02:19:18:00:01:00:00:00:04:258:00:00:00:00:00:00:00:00:100hwidEx=00:01:00:00:00:00:00:00:00:00:00:00:00:00:00:00devalias=IPC-HDBW2320R-ZSID=Z283100332
Environment size: 1270/131068 bytes
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1364032 (14d040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   romfs
   Created:      2019-11-30   4:59:21 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1363968 Bytes = 1.3 MiB
   Load Address: 00270000
   Entry Point:  003c0000
   Verifying Checksum ... OK
Programing start at: 0x00270000
SPI probe: 16384 KiB GD25Q128C at 0:0 is now current device
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'kernel.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 1558640 (17c870 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   kernel
   Created:      2019-11-30   4:59:17 UTC
   Image Type:   ARM Linux Firmware (uncompressed)
   Data Size:    1558576 Bytes = 1.5 MiB
   Load Address: 000f0000
   Entry Point:  00270000
   Verifying Checksum ... OK
Programing start at: 0x000f0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'user-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 8290368 (7e8040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   user
   Created:      2019-11-30   4:59:30 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    8290304 Bytes = 7.9 MiB
   Load Address: 005d0000
   Entry Point:  00e00000
   Verifying Checksum ... OK
Programing start at: 0x005d0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'web-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 2121792 (206040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   web
   Created:      2019-11-30   4:59:23 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    2121728 Bytes = 2 MiB
   Load Address: 003c0000
   Entry Point:  005d0000
   Verifying Checksum ... OK
Programing start at: 0x003c0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 4160 (1040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   partition
   Created:      2019-11-30   4:59:17 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    4096 Bytes = 4 KiB
   Load Address: 000e0000
   Entry Point:  000f0000
   Verifying Checksum ... OK
Programing start at: 0x000e0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 45120 (b040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   custom
   Created:      2019-11-30   4:59:32 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    45056 Bytes = 44 KiB
   Load Address: 00eb0000
   Entry Point:  00ed0000
   Verifying Checksum ... OK
Programing start at: 0x00eb0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'pd-x.squashfs.img'.Download to address: 0x2000000
Downloading: *
done
Bytes transferred = 61504 (f040 hex)

## Checking Image at 02000000 ...
   Legacy image found
   Image Name:   pd
   Created:      2019-11-30   4:59:32 UTC
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    61440 Bytes = 60 KiB
   Load Address: 00ea0000
   Entry Point:  00eb0000
   Verifying Checksum ... OK
Programing start at: 0x00ea0000
write : 100%
done
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x2000000
Downloading: *
done
            name    cs   offset             size               flag   fs_flags      fs_type
         MinBoot    0 0x0000000000000000 0x0000000000040000 0x00000000 0x00000000 0x00000000
          U-Boot    0 0x0000000000080000 0x0000000000040000 0x00000000 0x00000000 0x00000000
            hwid    0 0x00000000000c0000 0x0000000000020000 0x00000000 0x00000000 0x00000000
       partition    0 0x00000000000e0000 0x0000000000010000 0x00000000 0x00000001 0x00000001
          Kernel    0 0x00000000000f0000 0x0000000000180000 0x00000000 0x00000000 0x00000000
           romfs    0 0x0000000000270000 0x0000000000150000 0x00000000 0x00000001 0x00000002
             web    0 0x00000000003c0000 0x0000000000210000 0x00000000 0x00000001 0x00000002
            user    0 0x00000000005d0000 0x0000000000830000 0x00000000 0x00000001 0x00000002
      updateflag    0 0x0000000000e00000 0x0000000000030000 0x00000000 0x00000000 0x00000000
          config    0 0x0000000000e30000 0x0000000000070000 0x00000000 0x00000003 0x00000004
         product    0 0x0000000000ea0000 0x0000000000010000 0x00000000 0x00000001 0x00000002
          custom    0 0x0000000000eb0000 0x0000000000020000 0x00000000 0x00000001 0x00000002
       backupker    0 0x0000000000ed0000 0x00000000000e0000 0x00000000 0x00000001 0x00000002
        backupfs    0 0x0000000000fb0000 0x0000000000050000 0x00000000 0x00000001 0x00000002
           user1    0 0x0000000001000000 0x0000000001000000 0x00000000 0x00000001 0x00000002
         MinBoot mountcmd:
          U-Boot mountcmd:
            hwid mountcmd:
       partition mountcmd:
          Kernel mountcmd:
           romfs mountcmd:
             web mountcmd:mount /dev/mtdblock6 /mnt/web/
            user mountcmd:mount /dev/mtdblock7 /usr/
      updateflag mountcmd:
          config mountcmd:mnt_jffs2 /dev/mtdblock9 /mnt/mtd jffs2
         product mountcmd:mount /dev/mtdblock10 /mnt/pd/
          custom mountcmd:mount /dev/mtdblock11 /mnt/custom/
       backupker mountcmd:
        backupfs mountcmd:
           user1 mountcmd:mount /dev/mtdblock14 /mnt/user/
arch_number = 0x23283041
env_t       = 0x00000000
boot_params = 0x00200000
DRAM bank   = 0x00000000
-> start    = 0x00200000
-> size     = 0x06E00000
ethaddr     = 00:12:34:56:78:9A
ip_addr     = 192.168.1.108
baudrate    = 115200 bps
bootargs=console=ttyS0,115200 mem=110M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrcbootcmd=sf read 0x200100 0x8000 0x8000;sf read 0x2000000 0xf0000 0x180000;bootm 0x2000000bootdelay=3baudrate=115200ethaddr=00:12:34:56:78:9Aipaddr=192.168.1.108serverip=192.168.1.1autoload=yesgatewayip=192.168.1.1netmask=255.255.255.0da=tftp 0x02000000 dhboot.bin.img; flwrite;tftp dhboot-min.bin.img;flwritedr=tftp 0x02000000 romfs-x.squashfs.img; flwritedk=tftp 0x02000000 kernel.img; flwritedu=tftp 0x02000000 user-x.squashfs.img; flwritedw=tftp 0x02000000 web-x.squashfs.img; flwritedp=tftp 0x02000000 partition-x.cramfs.img;flwritedc=tftp 0x02000000 custom-x.squashfs.img; flwriteup=tftp 0x02000000 update.img; flwritetk=tftp 0x02000000 uImage; bootmsysbackup=1logserver=127.0.0.1loglevel=4 autosip=192.168.254.254autolip=192.168.1.108autogw=192.168.1.1autonm=255.255.255.0pd=tftp 0x02000000 pd-x.squashfs.img; flwriteethact=ambarella macappauto=0stdin=serialstdout=serialstderr=serialdh_keyboard=0autoapp=1BSN=2J03C13PAA00600HWID=IPC-HDBW2320R-ZS:01:02:02:19:18:00:01:00:00:00:04:258:00:00:00:00:00:00:00:00:100hwidEx=00:01:00:00:00:00:00:00:00:00:00:00:00:00:00:00devalias=IPC-HDBW2320R-ZSID=Z283100332filesize=F040fileaddr=2000000
Environment size: 1271/131068 bytes

Теперь камера отвечает на ping стабильно. После перезагрузки камеры mac-address у камеры тот, который я указал. Но: все порты на камере закрыты (сканировал nmap).
Видимо, сервисы не запускаются или что-то блокирует доступ к камере изнутри.