打造 HI3518 摄像头从入门到放弃最强帖

哇酷小二 · 2020-04-22 20:05:01

Q群转载的入门教程: boyun刷机教程A.pdf

原厂固件: boyun博云摄像头出厂固件备份.7z

哇酷小二 · 2020-04-22 20:06:28

各种破解教程: https://github.com/felix-001/hackboyun

哇酷小二 · 2020-04-22 20:06:30

保留位置

哇酷小二 · 2020-04-22 20:17:02

焊上串口线:
QQ图片20200422202004.jpg

接上USB转TTL:
QQ图片20200422202000.jpg

自带固件的 log:

System startup


U-Boot 2010.06 (Mar 10 2017 - 01:59:47)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xef 0x40 0x18
spi_general_qe_enable(294): Error: Disable Quad failed! reg: 0x2
Block:64KB Chip:16MB Name:"W25Q128(B/F)V"
SPI Nor total size: 16MB
MMC:
EMMC/MMC/SD controller initialization.
Card did not respond to voltage select!
No EMMC/MMC/SD device found !
In:    serial
Out:   serial
Err:   serial
Auto Update.Compile at Mar 10 2017 02:00:31
No mmc storage device found!
Hit any key to stop autoboot:  0
16384 KiB hi_fmc at 0:0 is now current device

## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.4.35
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2061104 Bytes = 2 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0
Linux version 3.4.35 (test@ubuntu) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v300) ) #38 Fri Jan 5 13:15:47 CST 2018
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518ev200
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 11684
Kernel command line: mem=46M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=hi_sfc:512K(boot),2048K(kernel),2560K(romfs),4096K(user),4096K(user2),512K(web),1536K(custom),1024K(mtd)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 46MB = 46MB total
Memory: 42452k/42452k available, 4652k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xc3000000 - 0xff000000   ( 960 MB)
    lowmem  : 0xc0000000 - 0xc2e00000   (  46 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc0397000   (3644 kB)
      .init : 0xc0397000 - 0xc03b529c   ( 121 kB)
      .data : 0xc03b6000 - 0xc03d6760   ( 130 kB)
       .bss : 0xc03d6784 - 0xc0412878   ( 241 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32
VIC @fe0d0000: id 0x00641190, vendor 0x41
sched_clock: 32 bits at 49MHz, resolution 20ns, wraps every 86767ms
Calibrating delay loop... 269.10 BogoMIPS (lpj=1345536)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x802b7b18 - 0x802b7b70
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 30) is a PL011 rev2
uart:2: ttyAMA2 at MMIO 0x200a0000 (irq = 25) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
hi-spi-master hi-spi-master.0: with 1 chip select slaves attached
hi-spi-master hi-spi-master.1: with 2 chip select slaves attached
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource timer0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.18)
msgmni has been set to 82
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
Check Flash Memory Controller v100 ...  Found.
SPI Nor(cs 0) ID: 0xef 0x40 0x18
enter pps drivers/mtd/devices/hifmc100/hifmc100_spi_general.c spi_general_qe_enable 512
pps status2=2
pps status=0
pps will write nothing
pps will write 50  1 0
pps spi_clean_status2 status=2 op=0
pps spi_clean_status2 status=0
pps spi_clean_status2 after & ~0x40 status=0
pps will write 50  1 0 end
spi_general_qe_enable(604): Error: Disable Quad failed! reg: 0x2
Block:64KB Chip:16MB Name:"W25Q128(B/F)V"
SPI Nor total size: 16MB
8 cmdlinepart partitions found on MTD device hi_sfc
8 cmdlinepart partitions found on MTD device hi_sfc
Creating 8 MTD partitions on "hi_sfc":
0x000000000000-0x000000080000 : "boot"
0x000000080000-0x000000280000 : "kernel"
0x000000280000-0x000000500000 : "romfs"
0x000000500000-0x000000900000 : "user"
0x000000900000-0x000000d00000 : "user2"
0x000000d00000-0x000000d80000 : "web"
0x000000d80000-0x000000f00000 : "custom"
0x000000f00000-0x000001000000 : "mtd"
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
i2c /dev entries driver
hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed!
hisi_i2c hisi_i2c.1: Hisilicon [i2c-1] probed!
hisi_i2c hisi_i2c.2: Hisilicon [i2c-2] probed!
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
VFS: Mounted root (cramfs filesystem) readonly on device 31:2.
Freeing init memory: 120K
usb 1-1: new high-speed USB device number 2 using hiusb-ehci

            _ _ _ _ _ _ _ _ _ _ _ _
            \  _  _   _  _ _ ___
            / /__/ \ |_/
           / __   /  -  _ ___
          / /  / /  / /
  _ _ _ _/ /  /  \_/  \_ ______
___________\___\__________________

[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01udev
udevd (389): /proc/389/oom_adj is deprecated, please use /proc/389/oom_score_adj instead.
[RCS]: /etc/init.d/S80network
0
0
0
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20180400: 0x00000000 --> 0x00000010
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20180040: 0x00000000 --> 0x000000FF
[END]
RTL871X: module init start
RTL871X: rtl8188eu v4.3.0.8_13968.20150417
RTL871X: build time: Sep 30 2016 10:36:48
RTL871X:
usb_endpoint_descriptor(0):
RTL871X: bLength=7
RTL871X: bDescriptorType=5
RTL871X: bEndpointAddress=81
RTL871X: wMaxPacketSize=512
RTL871X: bInterval=0
RTL871X: RT_usb_endpoint_is_bulk_in = 1
RTL871X:
usb_endpoint_descriptor(1):
RTL871X: bLength=7
RTL871X: bDescriptorType=5
RTL871X: bEndpointAddress=2
RTL871X: wMaxPacketSize=512
RTL871X: bInterval=0
RTL871X: RT_usb_endpoint_is_bulk_out = 2
RTL871X:
usb_endpoint_descriptor(2):
RTL871X: bLength=7
RTL871X: bDescriptorType=5
RTL871X: bEndpointAddress=3
RTL871X: wMaxPacketSize=512
RTL871X: bInterval=0
RTL871X: RT_usb_endpoint_is_bulk_out = 3
RTL871X: nr_endpoint=3, in_num=1, out_num=2

RTL871X: USB_SPEED_HIGH
RTL871X: CHIP TYPE: RTL8188E
RTL871X: register rtw_netdev_ops to netdev_ops
RTL871X: Chip Version Info: CHIP_8188E_Normal_Chip_TSMC_D_CUT_1T1R_RomVer(0)
RTL871X: RF_Type is 3!!
RTL871X: _ConfigNormalChipOutEP_8188E OutEpQueueSel(0x05), OutEpNumber(2)
RTL871X: EEPROM type is E-FUSE
RTL871X: ====> _ReadAdapterInfo8188EU
RTL871X: Boot from EFUSE, Autoload OK !
RTL871X: SetHwReg8188EU: bMacPwrCtrlOn=1
bFWReady == _FALSE call reset 8051...
RTL871X: =====> _8051Reset88E(): 8051 reset success .
RTL871X: efuse_read_phymap_from_txpktbuf bcnhead:0
RTL871X: efuse_read_phymap_from_txpktbuf len:125, lenbak:125, aaa:125, aaabak:125
RTL871X: efuse_read_phymap_from_txpktbuf read count:123
RTL871X: EEPROM ID=0x8129
RTL871X: VID = 0x0BDA, PID = 0x0179
RTL871X: Customer ID: 0x00, SubCustomer ID: 0xCD
RTL871X: Hal_ReadPowerSavingMode88E...bHWPwrPindetect(0)-bHWPowerdown(0) ,bSupportRemoteWakeup(1)
RTL871X: ### PS params=>  power_mgnt(1),usbss_enable(0) ###
RTL871X: ======= Path 0, Channel 1 =======
RTL871X: Index24G_CCK_Base[0][1] = 0x28
RTL871X: Index24G_BW40_Base[0][1] = 0x2d
RTL871X: ======= Path 0, Channel 2 =======
RTL871X: Index24G_CCK_Base[0][2] = 0x28
RTL871X: Index24G_BW40_Base[0][2] = 0x2d
RTL871X: ======= Path 0, Channel 3 =======
RTL871X: Index24G_CCK_Base[0][3] = 0x28
RTL871X: Index24G_BW40_Base[0][3] = 0x2d
RTL871X: ======= Path 0, Channel 4 =======
RTL871X: Index24G_CCK_Base[0][4] = 0x28
RTL871X: Index24G_BW40_Base[0][4] = 0x2d
RTL871X: ======= Path 0, Channel 5 =======
RTL871X: Index24G_CCK_Base[0][5] = 0x28
RTL871X: Index24G_BW40_Base[0][5] = 0x2d
RTL871X: ======= Path 0, Channel 6 =======
RTL871X: Index24G_CCK_Base[0][6] = 0x28
RTL871X: Index24G_BW40_Base[0][6] = 0x2d
RTL871X: ======= Path 0, Channel 7 =======
RTL871X: Index24G_CCK_Base[0][7] = 0x28
RTL871X: Index24G_BW40_Base[0][7] = 0x2d
RTL871X: ======= Path 0, Channel 8 =======
RTL871X: Index24G_CCK_Base[0][8] = 0x28
RTL871X: Index24G_BW40_Base[0][8] = 0x2d
RTL871X: ======= Path 0, Channel 9 =======
RTL871X: Index24G_CCK_Base[0][9] = 0x28
RTL871X: Index24G_BW40_Base[0][9] = 0x2d
RTL871X: ======= Path 0, Channel 10 =======
RTL871X: Index24G_CCK_Base[0][10] = 0x28
RTL871X: Index24G_BW40_Base[0][10] = 0x2d
RTL871X: ======= Path 0, Channel 11 =======
RTL871X: Index24G_CCK_Base[0][11] = 0x28
RTL871X: Index24G_BW40_Base[0][11] = 0x2d
RTL871X: ======= Path 0, Channel 12 =======
RTL871X: Index24G_CCK_Base[0][12] = 0x28
RTL871X: Index24G_BW40_Base[0][12] = 0x2d
RTL871X: ======= Path 0, Channel 13 =======
RTL871X: Index24G_CCK_Base[0][13] = 0x28
RTL871X: Index24G_BW40_Base[0][13] = 0x2d
RTL871X: ======= Path 0, Channel 14 =======
RTL871X: Index24G_CCK_Base[0][14] = 0x28
RTL871X: Index24G_BW40_Base[0][14] = 0x2d
RTL871X: ======= TxCount 0 =======
RTL871X: CCK_24G_Diff[0][0]= 0
RTL871X: OFDM_24G_Diff[0][0]= 0
RTL871X: BW20_24G_Diff[0][0]= 0
RTL871X: BW40_24G_Diff[0][0]= 0
RTL871X: EEPROMRegulatory = 0x0
RTL871X: mlmepriv.ChannelPlan = 0x20
RTL871X: CrystalCap: 0x32
RTL871X: EEPROM Customer ID: 0x 0
RTL871X: EEPROM : AntDivCfg = 0, TRxAntDivType = 3
RTL871X: Board Type: 0x 0
RTL871X: ThermalMeter = 0x1b
RTL871X: <==== _ReadAdapterInfo8188EU in 280 ms
RTL871X: init_channel_set ChannelPlan ID 20 Chan num:13
RTL871X: pwrctrlpriv.bSupportRemoteWakeup~~~~~~
RTL871X: pwrctrlpriv.bSupportRemoteWakeup~~~[1]~~~
RTL871X: rtw_macaddr_cfg MAC Address  = ac:35:ee:90:8c:a3
RTL871X: bDriverStopped:1, bSurpriseRemoved:0, bup:0, hw_init_completed:0
RTL871X: rtw_ndev_init(ra0)
RTL871X: _rtw_drv_register_netdev, MAC Address (if1) = ac:35:ee:90:8c:a3
usbcore: registered new interface driver rtl8188eu
RTL871X: module init ret=0
Successfully initialized wpa_supplicant
RTL871X: +871x_drv - drv_open, bup=0
RTL871X: Set RF Chip ID to RF_6052 and RF type to 1T1R.
RTL871X: rtl8188e_FirmwareDownload fw:NIC, size: 13904
RTL871X: rtl8188e_FirmwareDownload: fw_ver=b fw_subver=0001 sig=0x88e1, Month=11, Date=27, Hour=30, Minute=36
RTL871X: polling_fwdl_chksum: Checksum report OK! (1, 0ms), REG_MCUFWDL:0x00030005
RTL871X: =====> _8051Reset88E(): 8051 reset success .
RTL871X: _FWFreeToGo: Polling FW ready OK! (1, 10ms), REG_MCUFWDL:0x000300c6
RTL871X: FWDL success. write_fw:1, 50ms
==> rtl8188e_iol_efuse_patch
RTL871X: pDM_Odm TxPowerTrackControl = 1
RTL871X: rtl8188eu_hal_init in 720ms
RTL871X: hw_var_set_opmode()-4042 mode = 2
RTL871X: MAC Address = ac:35:ee:90:8c:a3
RTL871X: -871x_drv - drv_open, bup=1
RTL871X: [rtw_wx_set_pmkid] IW_PMKSA_FLUSH!
RTL871X: set_mode = IW_MODE_INFRA
RTL871X: set bssid:00:00:00:00:00:00
ioctl[SIOCSIWAP]: Operation not permittedRTL871X: =>rtw_wx_set_essid

RTL871X: ssid=g▒isQ▒J▒)ͺ▒▒▒▒F|▒T▒▒vZ.c3▒ɚi2c-2, len=32
RTL871X: set ssid [g▒isQ▒J▒)ͺ▒▒▒▒F|▒T▒▒vZ.c3▒ɚ▒▒▒▒▒>▒▒.▒▒] fw_state=0x00000008
RTL871X: Set SSID under fw_state=0x00000008
RTL871X: <=rtw_wx_set_essid, ret 0
RTL871X: hw_var_set_opmode()-4042 mode = 2
ioctl[SIOCSIWENCODEEXT]: Invalid argumentRTL871X: [rtw_wx_set_pmkid] IW_PMKSA_FLUSH!

ioctl[SIOCSIWENCODEEXT]: Invalid argument
mmz_start: 0x82e00000, mmz_size: 18M
rmmod: can't unload 'tlv_320aic31': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_adec': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_aenc': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_ao': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_ai': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_aio': unknown symbol in module, or unknown parameter
rmmod: can't unload 'acodec': unknown symbol in module, or unknown parameter
remove audio
rmmod: can't unload 'pwm': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_ive': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_rc': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_jpege': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_h264e': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_chnl': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_venc': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hifb': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_vou': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_vpss': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_viu': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi_mipi': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_vgs': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_region': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_tde': unknown symbol in module, or unknown parameter
rmmod: can't unload 'piris': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_isp': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_sys': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi3518e_base': unknown symbol in module, or unknown parameter
rmmod: can't unload 'hi_media': unknown symbol in module, or unknown parameter
rmmod: can't unload 'mmz': unknown symbol in module, or unknown parameter
==== Your input Sensor type is ov9732 ====
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0040: 0x00000000 --> 0x00000002
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0044: 0x00000000 --> 0x00000002
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f007c: 0x00000000 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0080: 0x00000000 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0084: 0x00000000 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0088: 0x00000000 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f008c: 0x00000000 --> 0x00000002
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0090: 0x00000000 --> 0x00000002
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0094: 0x00000000 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x2003002c: 0x000C4003 --> 0x000C4001
[END]
insert audio
==== Your input Sensor type is ov9732 ====
Sun Jan  1 00:00:00 CST 2017
Password: [loadProcesses]-90: Watchdog::loadProcesses 0 pName bycam startDelay 2000

[loadProcesses]-90: Watchdog::loadProcesses 1 pName smarthome startDelay 2000

[start]-115: Watchdog start ok

[respawnProcessList]-300: startProcess[bycam] success!
[respawnProcessList]-300: startProcess[smarthome] success!
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f00c0: 0x00000000 --> 0x00000003
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f00c8: 0x00000000 --> 0x00000003
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f00f4: 0x00000000 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x201b0400: 0x00000010 --> 0x000000A8
[END]
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x201b0080: 0x00000020 --> 0x000000FF
[END]
cpu = HI3516C_TYPE
gpio_remap


pMuxCtrlVirtAddr 0x200f0000
gpio_init
BYUN set ircut io default(high)
bycam version=1.0.14.0 !
LIBDVR : NetSetDefaultEth SaveEthAttrInFile ethname[ra0] filename[/mnt/mtd/Config/default_netcard]
[2017-01-01 00:00:04.135][APP]:bycam: $Rev: 1053 $, Build in:Mar 20 2018, 16:52:25, 0 level=2

[startWatchDogClient]-186: WatchDogClient::startWatchDogClient start ok

LIBDVR : NetSetDefaultEth SaveEthAttrInFile ethname[ra0] filename[/mnt/mtd/Config/default_netcard]


Infra: $Rev: 921 $, Build in:Mar 20 2018, 16:50:42
CInfra::start()>>>>>>>>>>
[watchdogRegister]-497: Watchdog::watchdogRegister process[bycam] clearDogInterval[2000] register success

CThreadManager::CThreadManager()>>>>>>>>>
[2017-01-01 00:00:04.141][MANAGER]:CConfigManager::start()...

ThreadBody start success! threadId[768] threadName[TimerManager]
ThreadBody start success! threadId[769] threadName[EventManager]
[2017-01-01 00:00:04.280][MANAGER]:parse custom config:/mnt/custom/CustomConfig/Camera.custom failed!

[2017-01-01 00:00:04.285][MANAGER]:CVerifyConfig::Start()...

[2017-01-01 00:00:04.293][MANAGER]:CDefaultConfig::Start()...

[2017-01-01 00:00:04.352][MANAGER]:CConfigManager::setDefault config NetWork.RemoteDevice verify failed with ret:20!

MAC : <ac:35:ee:90:8c:a3>
[2017-01-01 00:00:04.504][MANAGER]:@CDevAbility::start()>>>>>>>>>>
[2017-01-01 00:00:04.504][MANAGER]:m_nVTotalChns: 1, m_nVCapChns: 1, m_nVPlayChns: 0, m_nDigDecChns: 0

Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
[2017-01-01 00:00:04.508][MANAGER]:CConfigManager::setConfigInter(Ability.DeviceDesc, )

[2017-01-01 00:00:04.509][MANAGER]:CConfigManager::setConfigInter m_applyMap config .Ability.DeviceDesc verify failed with ret:120!

[2017-01-01 00:00:04.509][NETIP]:TFCardConfigUtil::TFCardConfigUtil called!!
[2017-01-01 00:00:04.511][NETIP]:[TFCardConfigUtil::ReadUIDFromFlash] uid=4ZXNAPP28352YK1Z111A!
[2017-01-01 00:00:04.511][NETIP]:TFCardConfigUtil::MountSD TF card not found or private file system found!
[2017-01-01 00:00:04.511][NETIP]:TFCardConfigUtil::LoadConfigFromTFCard MountSD failed!
[2017-01-01 00:00:04.512][NETIP]:TFCardConfigUtil::MountSD TF card not found or private file system found!
[2017-01-01 00:00:04.513][MANAGER]:

Manager: $Rev: 1008 $, Build in:Mar 20 2018, 16:52:14

[2017-01-01 00:00:04.513][MANAGER]:CManager::start()>>>>>>>>>>

[2017-01-01 00:00:04.513][MANAGER]:CConsole::start()...

[2017-01-01 00:00:04.514][MANAGER]:CMagicBox::start()...

[2017-01-01 00:00:04.516][MANAGER]:ProductDefinition:dir=/mnt/custom [buffer={
  "Vendor":"BOYUN",
  "Model":"BYH21C02",
  "PackSize":8192
}
H]!

Log Manager starting....!
ThreadBody start success! threadId[771] threadName[Console]
[2017-01-01 00:00:04.524][MANAGER]:CAutoMaintain::Start()...

[2017-01-01 00:00:04.525][MANAGER]:CDaylight::start()...

Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
[2017-01-01 00:00:04.531][MANAGER]:CUserManager::start......

ThreadBody start success! threadId[772] threadName[LogSaveFile]
[2017-01-01 00:00:04.559][MANAGER]:user:default password invalid

CPacketManagerImp::CPacketManagerImp()>>>>>>>>>
sm_packetBuf null use self heap memory!
Adjust Page!
Packet usage : 0K / 4095K, 0%

----------------------[01-01 00:00:04]
[2017-01-01 00:00:04.565][APP]:======= pre record buf 2048

Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!


GDI: $Rev: 923 $, Build in:Dec  7 2012, 14:04:54
CGDI::start()>>>>>>>>

@=================================
         @mem = 0x00000000 0x00000000 0x00000000
         @pitch = 0
         @width = 0
         @height = 0
         @foramt = 0
@===================================
CLocales::CLocales()>>>>>>>>>
CFontManager::CFontManager()>>>>>>>>>
CFontManager::CFontManager Open FontSmallEn.bin File Failed!
SuportLang:English
SuportLang:SimpChinese
ThreadBody start success! threadId[773] threadName[DevMouse]
[2017-01-01 00:00:04.620][NETIP]:============TFCardConfigUtil=====storage start==!

============> ide_init 423
LIBDVR : create hotplug monitor thread!LIBDVR : ------ ide library : version 2.00, built at Mar 20 2018, 16:50:29 -----
============> InitStorageDev 118
============> InitStorageDev 121:devinfo[MMC_TYPE] 1
===> line major minor  #blocks  name

===> line

===> line  240        0        512 romblock0

===> line   31        0        512 mtdblock0

===> line  240        1       2048 romblock1

===> line   31        1       2048 mtdblock1

===> line  240        2       2560 romblock2

===> line   31        2       2560 mtdblock2

===> line  240        3       4096 romblock3

===> line   31        3       4096 mtdblock3

===> line  240        4       4096 romblock4

===> line   31        4       4096 mtdblock4

===> line  240        5        512 romblock5

===> line   31        5        512 mtdblock5

===> line  240        6       1536 romblock6

===> line   31        6       1536 mtdblock6

===> line  240        7       1024 romblock7

===> line   31        7       1024 mtdblock7

scan_mmc_info 496
scsi_num 0, mmc_num 0, cdrw_num 0
LIBDVR : FILE -> misc/scanbus.c, LINE -> 320: opendir /proc/scsi/usb-storage/
usb_num -1, disk_num 0
============> InitStorageDev 144:devnum 0
LIBDVR : Can't Find Any Sata Dev
============> InitStorageDev 259
wfs_file_sys_init() libWFS.a $Rev: 9 $, Build in:Sep 17 2012 11:03:47
disk_num = 0
ide_num:0
ide_port:1
ide_mask:0x0
ide_bad:0x0
cap:
ThreadBody start success! threadId[774] threadName[Backup]
wfs_file_sys_init() end============================

driver basic parameter:
 ----------------------------------------------------------------------------------------------------
| dev.part |type|total_clus | temp_off | index_off | dir_off | data_off | rev_clus | sec/clus |status|
|----------|----|-----------|----------|-----------|---------|----------|----------|----------|------|
 ------------------------------------------------------------------------------------------------
driver operation parameter:
 -------------------------------------------------------------------------------------------------------------------------
| dev.part | F| S|  curr  |        start1         |         end1          |        start2         |        end2           |
|          |  |  |        |MM-DD HH:MM:SS|  clus  |MM-DD HH:MM:SS|  clus  |MM-DD HH:MM:SS|  clus  |MM-DD HH:MM:SS|  clus  |
|----------|--|--|--------|--------------|--------|--------------|--------|--------------|--------|--------------|--------|
 --------------------------------------------------------------------------------------------------------------------------
driver time chart:
 --------------------------------------------------------------------------
|dev.part | period of time                                                 |
|---------|----------------------------------------------------------------|
 ------------------------------------------------------------------------
driver time sections:
 ------------------------------------------------------------------------
|dev part |start_clus| end_clus |    start_time     |   end_time        |
 ------------------------------------------------------------------------

smSetDebugLevel debug_level = 0xffffffff
**************************************   系统是小端模式!   *******************************************
************************************   Mar 15 2018 08:44:02 build   **********************************
************************************   20161231 16:00:04 run   ***************************************
[2017-01-01 00:00:04.984][MANAGER]:CVerifyConfig::onVerifyEncode Extra iResolution > main iResolution
[2017-01-01 00:00:04.984][MANAGER]:CConfigManager::setDefault config AVEnc.Encode verify failed with ret:20!

ThreadBody start success! threadId[778] threadName[DriverManager]
[2017-01-01 00:00:05.020][MANAGER]:CConfigManager::setDefault config fVideo.Play verify failed with ret:20!

AAAAAA
AAAAAA
AAAAAA
AAAAAA
ChainCreate
CreateLinkEngOver = 0
AAAAAA
AAAAAA
AAAAAA
AAAAAA
NNNNNN
NNNNNN
NNNNNN
NNNNNN
AddNode( bAxiZUp=0; bSupportMinusTilt=0; lHeight=200 )
AddNodeOver = 0
NNNNNN
NNNNNN
NNNNNN
NNNNNN
PPPPPP
PPPPPP
PPPPPP
PPPPPP
ChainSetPanoAttr( g_pEngineHandle=38924608; pPanoAttr=-1093684988; )

AddBaseNode(lNodeTilt=90; lPanoType=8704; )
Elli.Center=(0.000000, 0.000000)
Elli.Para=(0.000000, 0.000000, 0.000000, 0.000000, 0.000000, 0.000000)

AddBaseNodeOver = 0
PPPPPP
PPPPPP
PPPPPP
PPPPPP
TTTTTT
TTTTTT
TTTTTT
TTTTTT
ChainSetPtzAttr( g_pEngineHandle=38924608; PtzNo=0 ; pPtzAttr=38884776; )

pPtzAttrInfo( PtzNo=0; PitchAngleDir=0; NegAngle=1; FixHeight=0 )

SetNode( PtzNo=0; bAxiZUp=0; bSupportMinusTilt=1; lHeight=0 )

SetNodeOver = 0
TTTTTT
TTTTTT
TTTTTT
TTTTTT
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
================reset sensor====================
=============SAMPLE_COMM_VI_SetMipiAttr enWDRMode: 0
cmos_get_awb_default called!
linear mode
=========================================================
===ominivision ov9732 sensor 720P30fps(Parallel port) init success!=====
=========================================================
cmos_get_awb_default called!
HI_MPI_VI_SetLDCAttr set success!!!!
[1483200005.669] StartVideoEncodeAndBindToVpss success vencChn1[], vpssGrp[0], vpssChn[1],!

[1483200005.670] StartVideoEncodeAndBindToVpss success vencChn2[], vpssGrp[0], vpssChn[2],!

37: ACODEC_SET_INPUT_VOL set
8: ACODEC_GET_GAIN_MIC set
To OPEN Audio Module LibName:(libhive_AEC.so)
To OPEN Audio Module LibName:(libhive_HPF.so)
To OPEN Audio Module LibName:(libhive_ANR.so)
To OPEN Audio Module LibName:(libhive_AGC.so)
[1483200005.802] CapDev_StartStreamProc start video encode thread [-1340058448]

===============start mpp finished!====================
ThreadBody start success! threadId[783] threadName[CaptureManager]
sched set 98, 2
==============> SysIRCClose
[1483200005.850] CameraSetAEAttr start!
[1483200005.894] CameraSetAEAttr stop!
[2017-01-01 00:00:05.896][PLAY]:CPlayer::start()......

CPacketBuffer::CPacketBuffer size = 2047 KB
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
[2017-01-01 00:00:05.950][PLAY]:CLocalPlayer::start()........

Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
[2017-01-01 00:00:05.962][MANAGER]:CConfigManager::setConfigInter(General.SystemState, )

SetStaticVeAttr  called!  VeChn[1] ImgSize[23] Norm[0] width[640] height[360] maxwidth[640] maxheight[360] fr32DstFrmRate[10] u32SrcFrmRate[25] u32MinQp[32] u32MaxQp[41] IsStarted[0]
[1483200006.020] CapDev_SetCodecAttr failed! stream[1] not supported
[1483200006.021] CapDev_SetCodecAttr failed! stream[2] not supported
[1483200006.025] CapDev_SetTitle called but OSD is disabled Chn[0] StrmId[0]

[1483200006.064] CapDev_SetTitle called but OSD is disabled Chn[0] StrmId[0]

[2017-01-01 00:00:06.080][SNAP]:CSnapManager::start()...

Cap(CaptureStart , 466):CaptureStart channel 0, dwType 0
ThreadBody start success! threadId[785] threadName[RecordManager]
[2017-01-01 00:00:06.150][COMM]:CFrontBoardProtocol::start()......

[2017-01-01 00:00:06.153][COMM]:KeyMap OK .............

ThreadBody start success! threadId[786] threadName[DevFrontboard]
[2017-01-01 00:00:06.751][COMM]:CNutParser::Init()>>>>>>>>>

[2017-01-01 00:00:06.761][COMM]:CComm::start()>>>>>>>>>

[2017-01-01 00:00:06.761][COMM]:CDevComm::open failed!

[2017-01-01 00:00:06.765][COMM]:CPtz::CPtz()>>>>>>>>>

[2017-01-01 00:00:06.855][COMM]:CPtz::Init()>>>>>>>>>

[2017-01-01 00:00:06.902][COMM]:CNutParser::Init()>>>>>>>>>

ThreadBody start success! threadId[787] threadName[DevPtz]
[2017-01-01 00:00:06.956][COMM]:CRS485Protocol start...

[LocalClient::DoWork] Ready m_bLoop=1 m_CliConn=-1!
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20090034: 0x00000012 --> 0x00000000
[END]
[1483200007.377] =====MDSetParameter enable block end enabled 1 level 3=====

[1483200007.377] MDSetParameter VeChn[0] MDSense[280] MDThreshold[300] enable[1]

ThreadBody start success! threadId[798] threadName[Alarm]
MAC : <ac:35:ee:90:8c:a3>
[2017-01-01 00:00:07.423][APP]:ethMac:ac:35:ee:90:8c:a3

[2017-01-01 00:00:07.423][APP]:enmac=ac35ee908ca3 uid=4ZXNAPP28352YK1Z111A!
killall: udhcpc: no process killed
[2017-01-01 00:00:07.513][MANAGER]:CConfigManager::setConfigInter(General.TFInfo, )

CNetClientWireless::Start strNetType[Infra]
killall: hostapd: no process killed
killall: udhcpd: no process killed
killall: udhcpc: no process killed
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
ThreadBody start success! threadId[808] threadName[NoName]
LIBDVR : Monitor thread recv:remove@/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/net/ra0/queues/tx-3
LIBDVR : Monitor thread recv:remove@/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/net/ra0/queues/tx-2
LIBDVR : Monitor thread recv:remove@/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/net/ra0/queues/tx-1
LIBDVR : Monitor thread recv:remove@/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/net/ra0/queues/tx-0
LIBDVR : Monitor thread recv:remove@/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/net/ra0
open adc sucess i=0
open adc sucess i=1
LIBDVR : Monitor thread recv:remove@/bus/usb/drivers/rtl8188eu
LIBDVR : Monitor thread recv:remove@/module/8188eu
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
LIBDVR : Monitor thread recv:add@/module/8188eu
LIBDVR : Monitor thread recv:add@/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/net/ra0
LIBDVR : Monitor thread recv:add@/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/net/ra0/queues/tx-0
LIBDVR : Monitor thread recv:add@/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/net/ra0/queues/tx-1
LIBDVR : Monitor thread recv:add@/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/net/ra0/queues/tx-2
LIBDVR : Monitor thread recv:add@/devices/platform/hiusb-ehci.0/usb1/1-1/1-1:1.0/net/ra0/queues/tx-3
LIBDVR : Monitor thread recv:add@/bus/usb/drivers/rtl8188eu
[LocalClient::Init] OK b=1!
[startWatchDogClient]-186: WatchDogClient::startWatchDogClient start ok

LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
[watchdogRegister]-497: Watchdog::watchdogRegister process[smarthome] clearDogInterval[2000] register success

[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
==>CPacketManagerImp: allocate buffer:0x02673B70 size:167936
LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
==============> SysIRCOpen
LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
ioctl[SIOCSIWAP]: Operation not permitted
ioctl[SIOCSIWENCODEEXT]: Invalid argument
ioctl[SIOCSIWENCODEEXT]: Invalid argument
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
enter InitWpaCtlInterFace
ctrl->local.sun_path=/tmp/wpa_ctrl_754-1
int wpa_cli socket interface /mnt/mtd/Config/ sucess!!!!!!!!!!
ra0       unassociated  Nickname:"<WIFI@REALTEK>"
          Mode:Managed  Frequency=-2.50749e-116 ▒  Access Point: Not-Associated
          Sensitivity:0/0
          Retry:off   RTS thr:off   Fragment thr:off
          Encryption key:off
          Power Management:off
          Link Quality:0  Signal level:0  Noise level:0
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

WLanOpen     sucesss
[2017-01-01 00:00:15.183][NETSERVICE]:NetIP: $Rev: 1055 $Build in:Mar 20 2018, 16:52:07

[2017-01-01 00:00:15.184][NETSERVICE]:CNetService::start()>>>>>>>>>>

Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
Value::asCString:null
 failed!
[2017-01-01 00:00:15.296][NETSERVICE]:DHCPD: start ...

MAC : <ac:35:ee:90:8c:a3>
[2017-01-01 00:00:15.318][NETSERVICE]:NETSTATED: start ...

ThreadBody start success! threadId[858] threadName[CNetStateReport]
open file[/mnt/mtd/Config/RT2870STA.dat] fail, creat default file
[2017-01-01 00:00:15.357][NETSERVICE]:[CNtpCli::config] enable=1 name=time.nist.gov ip=0 time=30!

[2017-01-01 00:00:15.357][NETSERVICE]:NTPD: Start OK enable=1...

CAutoSearchDevice sMac=FF:00:00:00:00:00 ip=0x7B01A8C0!
[2017-01-01 00:00:15.359][NETSERVICE]:[CNtpCli::AdjustTimeWithNTP] ntp server=time-nw.nist.gov time=30!

gethostbyname error, iError=Network is unreachable time-nw.nist.gov
[2017-01-01 00:00:15.365][NETSERVICE]:AUTOSEARCH: tp_setsockopt init success No such file or directory!
ThreadBody start success! threadId[860] threadName[FTP]
[2017-01-01 00:00:15.367][NETSERVICE]:AUTOSEARCH: start ...

[2017-01-01 00:00:15.375][NETSERVICE]:AlarmCenter: Start ....

****************************************************************************httpd  1.00 Mar 20 2018, Status: NOK
***** http port = 80, tcp port = 34567, language = 1, file name:
****************************************************************************[2017-01-01 00:00:15.378][NETSERVICE]:ARSP: Start ....

ThreadBody start success! threadId[861] threadName[CAutoSearchDevice]
ThreadBody start success! threadId[862] threadName[NetAlarmCenter]
[2017-01-01 00:00:15.390][NETSERVICE]:CArspCli Init Config First

[2017-01-01 00:00:15.391][NETIP]:NetIP: $Rev: 1055 $, $Author: chencb $, Build in:Mar 20 2018, 16:51:54

[2017-01-01 00:00:15.392][NETIP]:CNetIP::start()>>>>>>>>>>

[2017-01-01 00:00:15.393][MEDIA]:CTalk::PlayVoice voice config onoff 1
ThreadBody start success! threadId[865] threadName[ARSP]
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
cp: can't stat '/usr/etc/Wireless/wireless.cfg': No such file or directory
cp: can't stat '/usr/etc/Wireless/RT2870STA.dat': No such file or directory
open file [/mnt/mtd/Config/RT2870STA.dat] failed
37: ACODEC_SET_INPUT_VOL set
8: ACODEC_GET_GAIN_MIC set
To OPEN Audio Module LibName:(libhive_HPF.so)
To OPEN Audio Module LibName:(libhive_ANR.so)
To OPEN Audio Module LibName:(libhive_AGC.so)
To OPEN Audio Module LibName:(libhive_EQ.so)
==========ACODEC_SET_OUTPUT_VOL = 2
LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
[2017-01-01 00:00:17.368][NETSERVICE]:[CNtpCli::AdjustTimeWithNTP] ntp server=time-a.nist.gov time=30!

gethostbyname error, iError=Network is unreachable time-a.nist.gov
LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
[2017-01-01 00:00:18.848][COMM]:CCamera::onConfigIRCut unkonw ircut mode!
Transport: CServerIOThread start OK
CNetIPManage::Start()==>cfgNetCommon.TCPPort=[34567]
Transport: CServerIOThread start OK
cfgNetCommon.UDPPort=[34568]
MAC : <ac:35:ee:90:8c:a3>
s_DeviceMac=[FE2F26345CFAFA11]
-----------OnEncode----------->
<-----------OnEncode-----------
[2017-01-01 00:00:19.167][NETIP]:CNetManager start ok

ThreadBody start success! threadId[875] threadName[UDP_Server]
LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
ThreadBody start success! threadId[874] threadName[TCP_Server]
ThreadBody start success! threadId[876] threadName[CNetIPManage]
<3>CTRL-EVENT-BSS-ADDED 0 d4:ee:07:55:e6:b4
<3>CTRL-EVENT-BSS-ADDED 1 08:10:77:c6:e3:80
<3>CTRL-EVENT-BSS-ADDED 2 f4:bf:80:71:60:fc
<3>CTRL-EVENT-BSS-ADDED 3 fe:7c:02:df:e1:cf
<3>CTRL-EVENT-BSS-ADDED 4 f4:bf:80:71:61:01
<3>CTRL-EVENT-BSS-ADDED 5 98:bb:99:55:1b:3d
<3>CTRL-EVENT-BSS-ADDED 6 f4:bf:80:71:60:fd
<3>CTRL-EVENT-BSS-ADDED 7 46:d1:fa:73:9c:1f
<3>CTRL-EVENT-BSS-ADDED 8 9c:a6:15:51:86:50
<3>CTRL-EVENT-BSS-ADDED 9 80:8f:1d:25:c8:40
<3>CTRL-EVENT-BSS-ADDED 10 6c:38:45:67:1c:dd
<3>CTRL-EVENT-BSS-ADDED 11 34:96:72:68:c6:a0
<3>CTRL-EVENT-BSS-ADDED 12 98:bb:99:58:d1:8d
<3>CTRL-EVENT-BSS-ADDED 13 88:11:96:1b:ec:1d
<3>CTRL-EVENT-BSS-ADDED 14 88:11:96:1b:ec:19
<3>CTRL-EVENT-BSS-ADDED 15 70:85:40:7f:7a:fa
<3>CTRL-EVENT-BSS-ADDED 16 86:0d:8e:84:4f:39
<3>CTRL-EVENT-BSS-ADDED 17 8e:53:c3:2c:e2:87
<3>CTRL-EVENT-SCAN-RESULTS
[LocalClient::DoWork] start create m_CliConn
[LocalClient::Create] connect failed: : No such file or directory
[LocalClient::DoWork] Create failed! try again aftet 1 second! m_CliConn=-1
[2017-01-01 00:00:19.379][NETSERVICE]:[CNtpCli::AdjustTimeWithNTP] ntp server=ntp.sjtu.edu.cn time=30!

gethostbyname error, iError=Network is unreachable ntp.sjtu.edu.cn
func:WLanGetLinkStatus, status:wpa_state=INACTIVE
address=ac:35:ee:90:8c:a3

[2017-01-01 00:00:19.747][PLATFORM]:[CLocalSDKManager::Init] attach ok!
[2017-01-01 00:00:19.756][PLATFORM]:CLocalSDKManager start ok

Transport: CServerIOThread start OK
-----------OnEncode----------->
<-----------OnEncode-----------
CNetManager start ok
ThreadBody start success! threadId[877] threadName[LocalSDK]
ThreadBody start success! threadId[878] threadName[TCP_Server]
ThreadBody start success! threadId[879] threadName[NetIPManager]
ThreadBody start success! threadId[880] threadName[CAutoSearchIP]
ThreadBody start success! threadId[881] threadName[plugplay]
iotcl error
get_mac error
[2017-01-01 00:00:19.795][P2P]:[CNetP2PManage::Start] start ok

Value::asCString:null
 failed!
Value::asCString:null
 failed!
ThreadBody start success! threadId[888] threadName[CNetP2PManage]
[2017-01-01 00:00:19.796][P2P]:[CNetP2PManage::ThreadProc IOTC_Listen] IOTC_ER_EXCEED_MAX_SESSION n=0 sid=-12
[2017-01-01 00:00:19.796][P2P]:[CNetP2PManage::ThreadProc IOTC_Listen] IOTC_ER_EXCEED_MAX_SESSION n=0 sid=-12
[2017-01-01 00:00:19.797][P2P]:[CNetP2PManage::ThreadProc IOTC_Listen] IOTC_ER_EXCEED_MAX_SESSION n=0 sid=-12
[2017-01-01 00:00:19.797][P2P]:[CNetP2PManage::ThreadProc IOTC_Listen] IOTC_ER_EXCEED_MAX_SESSION n=0 sid=-12
[2017-01-01 00:00:19.797][P2P]:[CNetP2PManage::ThreadProc IOTC_Listen] IOTC_ER_EXCEED_MAX_SESSION n=0 sid=-12
[2017-01-01 00:00:19.798][P2P]:[CNetP2PManage::ThreadProc IOTC_Listen] IOTC_ER_EXCEED_MAX_SESSION n=0 sid=-12
[2017-01-01 00:00:19.803][P2P]:[CNetP2PManage::Init] IOTCAPI version[3.1.4.55] AVAPI version[3.1.4.55]!
ThreadBody start success! threadId[886] threadName[AudioSender]
LocalClient::SendRequest send failed!! m_CliConn is invalid m_CliConn
[LocalClient::DoWork] start create m_CliConn
=======LocalClient::Create success 7
[LocalClient::DoWork] Create m_CliConn=7!
open file[/mnt/mtd/Config/RT2870STA.dat] fail, creat default file
cp: can't stat '/usr/etc/Wireless/wireless.cfg': No such file or directory
cp: can't stat '/usr/etc/Wireless/RT2870STA.dat': No such file or directory
open file [/mnt/mtd/Config/RT2870STA.dat] failed
CNetClientWireless::Start strNetType[Infra]
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
sched set 98, 2
ThreadBody start success! threadId[897] threadName[CNetClientAcoustic]
[2017-01-01 00:00:20.811][UPGRADE]:[ManualUpgrade::Check] DeviceModel=BYH21C02!
[2017-01-01 00:00:21.029][MEDIA]:CTalk::PlayVoice voice config onoff 1
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Value::asCString:null
 failed!
Threads:
               Name            PID  Prior State
_______________________________________________________
                    Main        754   64  Normal
                 Console        771   50  Normal
            TimerManager        768   50  Normal
                  Pooled        769   50  Normal
           DevFrontboard        786   50  Normal
                  Pooled        772   50  Normal
                DevMouse        773   50  Normal
                  Backup        774   50  Normal
           DriverManager        778   50  Normal
          CaptureManager        783   98  Timeout
           RecordManager        785   50  Normal
                  DevPtz        787   50  Normal
                  Pooled        808   50  Normal
          NetAlarmCenter        862   50  Normal
           CAutoSearchIP        880   50  Normal
              TCP_Server        878   50  Normal
              TCP_Server        874   50  Normal
                plugplay        881   50  Normal
                    ARSP        865   50  Normal
         CNetStateReport        858   50  Normal
           CNetP2PManage        888   50  Normal
             AudioSender        886   50  Normal
      CNetClientAcoustic        897   98  Normal
            CNetIPManage        876   50  Normal
              UDP_Server        875   50  Normal
       CAutoSearchDevice        861   50  Timeout
                     FTP        860   50  Normal
                LocalSDK        877   50  Normal
                   Alarm        798   50  Normal
_________________________________________
        TPtzLink 4294699426 Idel
          NoName 4294699436 Idel
     DetectTimer 4294699456 Idel
    EventManager 4294699476 Idel
          NoName 4294699506 Idel
          NoName 4294699566 Idel
             ntp 4294699726 Idel
        SaveTime 4294699856 Idel
        LockUser 4294699906 Idel
       CLocalSDK 4294700086 Idel
    StorageAlarm 4294700146 Idel
          Encode 4294700406 Idel
     BitrateStat 4294702156 Idel
        IRCutCfg 4294702186 Idel
   NetBitrateCal 4294702246 Idel
    AutoMaintain 4294702866 Idel
     LogSaveFile 4294712866 Idel
      WdrAttrCfg 4294804186 Idel
         Console 15560 Idel
[2017-01-01 00:00:21.094][APP]:AutoSearchIP:/mnt/mtd/AutoSearchIP is same,nothing to be done!!!

[2017-01-01 00:00:21.095][APP]:===================1==================================================

[2017-01-01 00:00:21.097][APP]:create_one_bitmap: [0]=> xy(100,100)lt(168,24),pStr[IP:192.168.1.123
]

[2017-01-01 00:00:21.102][APP]:create_one_bitmap: [1]=> xy(100,124)lt(240,24),pStr[Submask:255.255.255.0
]

[2017-01-01 00:00:21.105][APP]:create_one_bitmap: [2]=> xy(100,148)lt(216,24),pStr[GateWay:192.168.1.1
]

[2017-01-01 00:00:21.112][APP]:create_one_bitmap: [3]=> xy(100,172)lt(216,24),pStr[Mac:[ac35ee908ca3]
]

MAC : <ac:35:ee:90:8c:a3>
[2017-01-01 00:00:21.121][APP]:create_one_bitmap: [4]=> xy(100,196)lt(288,24),pStr[Serial:[FE2F26345CFAFA11]
]

[2017-01-01 00:00:21.181][APP]:===================2==================================================

[MsgManager::SetRequest] seq=0 cmd=1597!
[LocalClient::Send] success 20
[2017-01-01 00:00:21.199][PLATFORM]:CLocalSDKManager::OnData recv msg to proc [1597]

[2017-01-01 00:00:21.205][NETIP]:[P2PConfig::Read] uid=4ZXNAPP28352YK1Z111A OnOff=1!
[LocalClient::GetUID] uid=4ZXNAPP28352YK1Z111A!
[2017-01-01 00:00:21.398][NETSERVICE]:[CNtpCli::AdjustTimeWithNTP] ntp server=time-b.nist.gov time=30!

gethostbyname error, iError=Network is unreachable time-b.nist.gov
*** Board tools : ver0.0.1_20121120 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x201b0080: 0x00000020 --> 0x00000000
[END]

37: ACODEC_SET_INPUT_VOL set
8: ACODEC_GET_GAIN_MIC set
To OPEN Audio Module LibName:(libhive_HPF.so)
To OPEN Audio Module LibName:(libhive_ANR.so)
To OPEN Audio Module LibName:(libhive_AGC.so)
To OPEN Audio Module LibName:(libhive_EQ.so)
==========ACODEC_SET_OUTPUT_VOL = 2


rm: can't remove '/mnt/mtd/Upgrade.stz': No such file or directory
rm: can't remove '/mnt/mtd/Zigbee.Hex': No such file or directory
rm: can't remove '/mnt/mtd/Zigbee2.Hex': No such file or directory
rm: can't remove '/mnt/mtd/Zigbee2.md5': No such file or directory
[2017-01-01 00:00:23.148][NETIP]:[P2PConfig::GetAlarmOnOff] bOnOff=1!

S_Time_Sync = 0
[2017-01-01 00:00:23.409][NETSERVICE]:[CNtpCli::AdjustTimeWithNTP] ntp server=time.nist.gov time=30!

gethostbyname error, iError=Network is unreachable time.nist.gov
[2017-01-01 00:00:23.849][COMM]:CCamera::onConfigIRCut unkonw ircut mode!
Login incorrect
LocalHost login: Cap(CaptureStop , 480):CaptureStop channel 0, dwType 0
Cap(CaptureStop , 480):CaptureStop channel 0, dwType 4
Cap(CaptureDestroy , 162):CaptureDestroy called 0
56: ACODEC_SET_INPUT_VOL set
8: ACODEC_GET_GAIN_MIC set
[2017-01-01 00:00:24.908][NETIP]:[P2PConfig::GetAlarmOnOff] bOnOff=1!

[2017-01-01 00:00:25.423][NETSERVICE]:[CNtpCli::AdjustTimeWithNTP] ntp server=time.windows.com time=30!

gethostbyname error, iError=Network is unreachable time.windows.com
open file[/mnt/mtd/Config/RT2870STA.dat] fail, creat default file
cp: can't stat '/usr/etc/Wireless/wireless.cfg': No such file or directory
cp: can't stat '/usr/etc/Wireless/RT2870STA.dat': No such file or directory
open file [/mnt/mtd/Config/RT2870STA.dat] failed

根据小伙伴们爆破结果, 得到原厂固件的 root 的密码了: boyuniot

登录进去看 mtd 分区:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00010000 "boot"
mtd1: 00200000 00010000 "kernel"
mtd2: 00280000 00010000 "romfs"
mtd3: 00400000 00010000 "user"
mtd4: 00400000 00010000 "user2"
mtd5: 00080000 00010000 "web"
mtd6: 00180000 00010000 "custom"
mtd7: 00100000 00010000 "mtd"

刚刚从大神 @mybays 那里偷学来的爆破流程:

1. 提取原厂固件,用binwalk解包
2. 提取 /etc/passwd 文件
3. 用john爆破密码文件

微凉VeiLiang · 2020-04-22 20:18:31

前排占位，支持楼主分享教程。感谢感谢

哇酷小二 · 2020-04-22 20:24:59

根据上面的log, 可以看到分区起始位置与大小:

Creating 8 MTD partitions on "hi_sfc":
0x000000000000-0x000000080000 : "boot"
0x000000080000-0x000000280000 : "kernel"
0x000000280000-0x000000500000 : "romfs"
0x000000500000-0x000000900000 : "user"
0x000000900000-0x000000d00000 : "user2"
0x000000d00000-0x000000d80000 : "web"
0x000000d80000-0x000000f00000 : "custom"
0x000000f00000-0x000001000000 : "mtd"

一步一步操作:

#导出romfs
dd if=boyun博云摄像头出厂固件备份.bin of=romfs.bin bs=1 skip=$((0x280000)) count=$((0x500000-0x280000))

#创建挂载目录
mkdir /tmp/romfs -p

#挂载romfs.bin到该目录
sudo mount -o loop romfs.bin /tmp/romfs/

显示正常:

$ ls /tmp/romfs/ -l
total 9
drwxr-xr-x 1 1003 235 2064 Jan  1  1970 bin
drwxr-xr-x 1 1003 235    0 Jan  1  1970 boot
-rwxr-xr-x 1 1003 235  456 Jan  1  1970 boot.sh
drwxr-xr-x 1 1003 235    0 Jan  1  1970 dev
drwxr-xr-x 1 1003 235  436 Jan  1  1970 etc
drwxr-xr-x 1 1003 235    0 Jan  1  1970 home
lrwxrwxrwx 1 1003 235    9 Jan  1  1970 init -> sbin/init
drwxr-xr-x 1 1003 235  836 Jan  1  1970 lib
lrwxrwxrwx 1 1003 235   11 Jan  1  1970 linuxrc -> bin/busybox
drwxr-xr-x 1 1003 235    0 Jan  1  1970 lost+found
drwxr-xr-x 1 1003 235  120 Jan  1  1970 mnt
drwxr-xr-x 1 1003 235    0 Jan  1  1970 nfsroot
drwxr-xr-x 1 1003 235    0 Jan  1  1970 opt
drwxr-xr-x 1 1003 235    0 Jan  1  1970 proc
drwxr-xr-x 1 1003 235    0 Jan  1  1970 root
drwxr-xr-x 1 1003 235 1200 Jan  1  1970 sbin
drwxr-xr-x 1 1003 235    0 Jan  1  1970 share
drwxr-xr-x 1 1003 235    0 Jan  1  1970 sys
drwxr-xr-x 1 1003 235    0 Jan  1  1970 tmp
drwxr-xr-x 1 1003 235   68 Jan  1  1970 usr
drwxr-xr-x 1 1003 235   32 Jan  1  1970 var

获取密文:

$ cat /tmp/romfs/etc/passwd
root:$1$nRKDu.re$OSqz0AcP.6jOEEvNYGTIX1:0:0::/root:/bin/sh

哇酷小二 · 2020-04-22 20:25:02

保留位置

哇酷小二 · 2020-04-22 20:25:04

保留位置

哇酷小二 · 2020-04-22 20:27:04

保留位置

哇酷小二 · 2020-04-22 20:27:06

保留位置

哇酷小二 · 2020-04-22 20:27:07

保留位置

哇酷小二 · 2020-04-22 20:27:09

保留位置

哇酷小二 · 2020-04-22 20:27:15

保留位置

哇酷小二 · 2020-04-22 20:27:17

保留位置

哇酷小二 · 2020-04-22 20:27:19

保留位置

哇酷小二 · 2020-04-22 20:27:21

保留位置

哇酷小二 · 2020-04-22 20:27:22

保留位置

哇酷小二 · 2020-04-22 20:27:24

保留位置

哇酷小二 · 2020-04-22 20:27:26

保留位置

哇酷小二 · 2020-04-22 20:27:28

QQ图片20200423230430.jpg

sea18c · 2020-04-22 21:54:16

这个绝对是牛B plus，学习了，感谢感谢

xyyangkun · 2020-04-22 22:31:07

这个zigbee模块有什么有？有搞过这方面开发的不？
看里面的固件与雄迈的有点像，是不是雄迈OEM的？

illusion · 2020-04-23 08:13:08

厉害了，有了原厂的密码，可以干很多事情，至少能扒下来一些配置文件了，还是比较期待原厂固件。

Jmhh247 · 2020-04-23 08:51:03

厉害了，等楼主更新编译固件的教程。

wujique · 2020-04-23 09:24:15

顶礼膜拜

jake2020 · 2020-04-23 12:47:18

厉害了，等楼主更新编译固件的教程。

neriq · 2020-04-23 13:27:48

已经买了，跟着大佬一起折腾折腾

KingJin · 2020-04-23 14:03:57

厉害

Jmhh247 · 2020-04-24 13:56:16

"提取原厂固件,用binwalk解包"---大神，怎么提取

哇酷小二 · 2020-04-24 14:21:37

Jmhh247 说：

"提取原厂固件,用binwalk解包"---大神，怎么提取

更新到6楼了。

skycover · 2020-04-24 14:36:21

买一个玩一玩啊

小智 · 2020-04-24 14:54:41

qq群被封了

哇酷小二 · 2020-04-24 14:58:14

小智说：

qq群被封了

1102813231 新群

metro · 2020-04-24 15:35:03

补充一下6楼：在WSL下无法直接使用mount命令挂载，此时可以使用fsck.cramfs命令进行解压（压缩应使用mkfs.cramfs），用法为：

fsck.cramfs --extract=解压目录 文件路径

哇酷小二 · 2020-04-24 15:45:10

metro 说：

补充一下6楼：在WSL下无法直接使用mount命令挂载，此时可以使用fsck.cramfs命令进行解压（压缩应使用mkfs.cramfs），用法为：
fsck.cramfs --extract=解压目录 文件路径

又增加了新知识点。

JZH1996 · 2020-04-24 15:57:45

说起来我有点好奇那个空焊盘本来设计的是什么芯片来着

有梦的地方 · 2020-04-24 16:05:39

JZH1996 说：

说起来我有点好奇那个空焊盘本来设计的是什么芯片来着

十有八九是模拟cvbs接入的，一个adc芯片。

Jmhh247 · 2020-04-26 11:17:55

水一下：

#### 编译hello world

##### 测试前提
- ubuntu18 （用ubuntu16提示glibc库版本不合适，直接用18不折腾）
- 已刷固件包firmware-20200420.tar.gz
- Q群获得arm-openwrt-linux-gcc.tar.gz

1. 安装工具链

sudo tar zxvf arm-openwrt-linux-gcc.tar.gz -C /opt
echo "export PATH=$PATH:/opt/arm-openwrt-linux-gcc/bin" >> ~/.bashrc
source ~/.bashrc

2. hello-openwrt-app.c：

#include <stdio.h>

int main(int argc, char const *argv[])
{
    printf("hello openwrt!\r\n");
    return 0;
}

3. 在ubuntu18编译并复制到开发板（看log更直观）

embedtest@linux-hostgs:~/work/boyuniot/code-build/hello-test$ arm-openwrt-linux-gcc -o hello-openwrt-app hello-openwrt-app.c 
arm-openwrt-linux-gcc: warning: environment variable 'STAGING_DIR' not defined
arm-openwrt-linux-gcc: warning: environment variable 'STAGING_DIR' not defined
arm-openwrt-linux-gcc: warning: environment variable 'STAGING_DIR' not defined
embedtest@linux-hostgs:~/work/boyuniot/code-build/hello-test$ ls
a.out  hello-openwrt-app  hello-openwrt-app.c
embedtest@linux-hostgs:~/work/boyuniot/code-build/hello-test$ scp hello-openwrt-app root@192.168.0.100:~
hello-openwrt-app                                                                                                                                 100% 7056   180.0KB/s   00:00    
embedtest@linux-hostgs:~/work/boyuniot/code-build/hello-test$

4. 在开发板上运行app

root@ByunHawkeye:/# cd
root@ByunHawkeye:~# ls
hello-openwrt-app  minihttp           minihttp.ini
root@ByunHawkeye:~# ./hello-openwrt-app
hello openwrt!
root@ByunHawkeye:~#

---

编译时有个警告，加下这句可以消除：

export STAGING_DIR=/opt/arm-openwrt-linux-gcc/bin/:$STAGING_DIR

enjoy it!

最近编辑记录 Jmhh247 (2020-04-26 11:18:34)

Jmhh247 · 2020-04-30 11:44:52

#### 刷回原厂固件

复制BoYun.bin到TF卡，把TF卡插到摄像头,进入uboot命令行：

sf probe 0
sf lock 0
fatload mmc 0 0x82000000 BoYun.bin
sf erase 0x0 0x1000000
sf write 0x82000000 0x0 $(filesize)
reset

账户：root
密码：boyuniot

歌以咏志 · 2020-04-30 11:53:12

@Jmhh247 为什么 sf lock 之后还能 sf erase?

Jmhh247 · 2020-04-30 13:12:09

这个问题我也有疑惑，实际上这条指令是解锁的：

bad MBR sector signature 0x584d
Unable to use mmc for fatls
Hit any key to stop autoboot:  0
hisilicon #
hisilicon # sf probe 0
16384 KiB hi_fmc at 0:0 is now current device
hisilicon # sf lock 0
unlock all block.
hisilicon #

歌以咏志说：

@Jmhh247 为什么 sf lock 之后还能 sf erase?

歌以咏志 · 2020-04-30 13:41:50

那是不是 sf unlock 就是加锁呢？
记得 spi flash 没有锁定的指令，我去翻翻看。

Jmhh247 · 2020-04-30 13:49:46

这个我就不清楚了，我试过不加解锁那句，照样可以擦除成功。

歌以咏志说：

那是不是 sf unlock 就是加锁呢？
记得 spi flash 没有锁定的指令，我去翻翻看。

gddddd · 2020-05-01 18:37:04

歌以咏志说：

那是不是 sf unlock 就是加锁呢？
记得 spi flash 没有锁定的指令，我去翻翻看。

加锁命令是sf lock [1~7]，不过好像这个命令没啥实际用处了，一般用用就不用特意加锁吧

最近编辑记录 gddddd (2020-05-01 18:38:03)

gimmychen · 2020-05-11 16:36:47

看起来很厉害的样子，收藏先

traff07 · 2020-05-17 13:01:56

很厉害的样子，收藏先

beijingjiufang · 2020-05-26 16:16:01

强烈关注，积极支持

bitter · 2020-06-03 21:46:44

积极关注，强烈支持

lzr325 · 2020-06-09 17:13:48

向大佬致敬，买了一块3516的模块，准备搞起来

whyabc666 · 2020-06-10 22:43:30

怎么知道大家会放弃的？这种过家家的玩法看来是注定失败的?

狼狼 · 2020-06-14 18:09:47

whyabc666 说：

怎么知道大家会放弃的？这种过家家的玩法看来是注定失败的?

应该只是一种调侃，不是针真的让大家放弃，类似于《MySQL从删库到跑路》一样，娱乐性质的。

touchey · 2020-06-14 19:33:43

这个太强了，
不用开发板了
拆个摄像头完事

狼狼说：

应该只是一种调侃，不是针真的让大家放弃，类似于《MySQL从删库到跑路》一样，娱乐性质的。

狼狼 · 2020-06-14 19:44:10

touchey 说：

这个太强了，
不用开发板了
拆个摄像头完事

逆向果然有意思。另外学过Hi3518，这比f1c100s容易上手多了。
这是 Hi3518EV200R001C01SPC040 SDK：
链接： https://pan.baidu.com/s/17KQv6kHNEwzWBjGi36HcZg
提取码：7zuw

naveedakhter01@gmail.com · 2020-06-16 00:46:13

3518 PCB files?

狼狼 · 2020-07-06 23:45:30

请问这个板各部分引脚连接信息，有人知道么

狼狼 · 2020-07-06 23:47:21

我照着群文件里给出的信息，用himm写寄存器它没反应，比如文件里说GPIO8_0控制绿色LED，然而我做以下操作的时候，寄存器能修改，但是灯一直亮：
绿色LED：GPIO8_0
--引脚复用
himm 0x200f0100 0x01
--GPIO8_0-方向输出
himm 0x201C0400 0x01
--GPIO8_0-输出高电平
himm 0x201C0004 0x01
--GPIO8_0-输出低电平
himm 0x201C0004 0x0

修改===原来这个是红色灯，，，改之后被耀眼的绿色给盖住了

最近编辑记录狼狼 (2020-07-06 23:57:33)

狼狼 · 2020-07-07 10:47:31

根据群里提供的引脚信息，已经可以独立控制这些器件啦~！

红色LED：GPIO8_0
--引脚复用
himm 0x200f0100 0x01
--GPIO8_0-方向输出
himm 0x201C0400 0x01
--GPIO8_0-输出高电平=灭
himm 0x201C0004 0x01
--GPIO8_0-输出低电平=亮
himm 0x201C0004 0x0

绿色LED：GPIO7_4
--引脚复用
himm 0x200f00f0 0x01
--GPIO7_4-方向输出
himm 0x201B0400 0x10
--GPIO7_4-输出高电平=灭
himm 0x201B0040 0x10
--GPIO7_4-输出低电平=亮
himm 0x201B0040 0x0

红外LED：GPIO7_7
--引脚复用
himm 0x200f00fc 0x01
--GPIO7_7-方向输出
himm 0x201B0400 0x80
--GPIO7_7-输出高电平=亮
himm 0x201B0200 0x80
--GPIO7_7-输出低电平=灭
himm 0x201B0200 0x0

红外接收管：GPIO7_6
--引脚复用
himm 0x200f00f8 0x1
--GPIO7_6-方向输入
himm 0x201B0400 0x00
周围光线亮时读值为1，周围光线暗（夜晚）时读值为0，可以通过写1查看当前寄存器值（该操作不影响输入电平）：
himm 0x201B0100 0x40

IRCUT经IC(AE1511)受控于GPIO0_1
+---------AE1511----------+
| Input | Output |
+---------+-----------------+
| FBC | OUT1 | OUT2 |
+-------+--------+--------+
| 上升沿 | 脉冲 | 低电平 |--->开启IRCUT
+-------+--------+--------+
| 下降沿 | 低电平 | 脉冲 |--->关闭IRCUT
+-------+--------+--------+
--引脚复用
himm 0x200f0074 0x0
--驱动能力4mA(可以不用)
himm 0x200f0884 0x30
--GPIO0_1-方向输出
himm 0x20140400 0x02
--GPIO0_1-输出高电平
himm 0x20140008 0x02
--GPIO0_1-输出低电平
himm 0x20140008 0x0

狼狼 · 2020-07-07 12:14:31

把LED和IRCUT操作写到sh里，操作会方便一些。
先运行Pins_Init.sh初始化相关引脚方向和复用，然后再执行控制sh。
红外接收和Zigbee没写（买的不带CC2530的版本）
QQ截图20200707121328.png
pincontrol.zip

狼狼 · 2020-07-07 12:25:31

如果运行海思例程，OV9732的VI掩码要从0xFFC0000改为0x3FF0000。也就是说此成品板的OV9732(10bit)连接在VI_DATA[9:0]。

whyabc666 · 2020-07-07 14:21:34

以为有新玩法了！话说谁移植onvif了吗？

狼狼 · 2020-07-07 15:52:51

狼狼说：

如果运行海思例程，OV9732的VI掩码要从0xFFC0000改为0x3FF0000。也就是说此成品板的OV9732(10bit)连接在VI_DATA[9:0]。

掩码是0x3FF00000，上面少打了一个0...刚上手学习，玩不出太深的东西，权当交流了哈~

哇酷小二 · 2020-07-14 13:48:19

狼狼说：

狼狼说：
如果运行海思例程，OV9732的VI掩码要从0xFFC0000改为0x3FF0000。也就是说此成品板的OV9732(10bit)连接在VI_DATA[9:0]。
掩码是0x3FF00000，上面少打了一个0...刚上手学习，玩不出太深的东西，权当交流了哈~

这是 @狼狼给我发的私信:

我是作者，这条消息是错误的，掩码0x3FF0000是正确的，我发上来的时候参照了错误版本的测试程序，等发现已经不能自己删除了，请管理员帮忙删除以免误导他人，谢谢，给你们添麻烦了。

JasonWoo · 2020-07-14 15:41:43

我只感兴趣怎么爆破原厂密码 -_-!

JasonWoo · 2020-07-14 15:43:12

1. 提取原厂固件,用binwalk解包
2. 提取 /etc/passwd 文件
3. 用john爆破密码文件

--
这个谁清楚啊

pqpqme · 2021-05-10 11:08:57

现在网上有这款，但要五六十元了。但是比这个老一代的38包邮两个。性能差不多，都是720p
你这个是3518ev200，linux内核3.4.5，38包邮两个的是3518cv100，内核3.0.8
折腾出来几乎没区别

joeydeng · 2023-09-09 17:18:05

太强了，所以sdk有大佬开源吗😀😀

joeydeng · 2023-09-09 17:19:37

joeydeng 说：

太强了，所以sdk有大佬开源吗😀😀

说错了🤣是hdk

dgtg · 2024-08-23 09:43:01

Hi3518，我有一批板子，数量大概200，有没有人收啊？

WhyCan Forum(哇酷开发者社区)

楼主 #1 2020-04-22 20:05:01 分享评论

打造 HI3518 摄像头从入门到放弃最强帖

楼主 #2 2020-04-22 20:06:28 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #3 2020-04-22 20:06:30 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #4 2020-04-22 20:17:02 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#5 2020-04-22 20:18:31 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #6 2020-04-22 20:24:59 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #7 2020-04-22 20:25:02 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #8 2020-04-22 20:25:04 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #9 2020-04-22 20:27:04 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #10 2020-04-22 20:27:06 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #11 2020-04-22 20:27:07 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #12 2020-04-22 20:27:09 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #13 2020-04-22 20:27:15 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #14 2020-04-22 20:27:17 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #15 2020-04-22 20:27:19 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #16 2020-04-22 20:27:21 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #17 2020-04-22 20:27:22 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #18 2020-04-22 20:27:24 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #19 2020-04-22 20:27:26 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #20 2020-04-22 20:27:28 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#21 2020-04-22 21:54:16 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#22 2020-04-22 22:31:07 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#23 2020-04-23 08:13:08 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#24 2020-04-23 08:51:03 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#25 2020-04-23 09:24:15 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#26 2020-04-23 12:47:18 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#27 2020-04-23 13:27:48 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#28 2020-04-23 14:03:57 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#29 2020-04-24 13:56:16 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #30 2020-04-24 14:21:37 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#31 2020-04-24 14:36:21 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#32 2020-04-24 14:54:41 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #33 2020-04-24 14:58:14 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#34 2020-04-24 15:35:03 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

楼主 #35 2020-04-24 15:45:10 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#36 2020-04-24 15:57:45 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#37 2020-04-24 16:05:39 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#38 2020-04-26 11:17:55 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#39 2020-04-30 11:44:52 分享评论

Re: 打造 HI3518 摄像头从入门到放弃最强帖

#40 2020-04-30 11:53:12 分享评论