Geekly articles weekly

来自跳蚤市场的珍珠或IP摄像机DCS-5220A1的逆向工程

夏季愉快地结束了，这意味着该是该离开家园，当地的夏季合作社和背包去这座城市的时候了。 一切都会好起来的，但是以某种方式让家人无人看管长达六个月之久，这真是令人恐惧。 我也问过类似的问题。 结果，我决定为该站点配备一个可通过网络摄像头和Internet访问（最可能是3G）的简单工具包。 我像往常一样从一小部分开始-搜索适合预算的相机。 我的预算大约是20美元。


原则上，正常的东西无法达到这个数量，因此，存在诸如“ DIR-320 + openwrt +笔记本电脑的UVC摄像机”的选项，这些选项密封在一个密封的塑料袋中，并悬挂在树上。 但是有一个晚上，我浏览了当地跳蚤市场的广告，发现出售了D-link DCS-5220A1 IP摄像机，甚至还有10美元的PTZ功能。 对于那些不知道的人，我将摘录于维基百科
平移变焦相机（PTZ相机）-支持方向和变焦的远程控制的相机。 PTZ是摇摄，倾斜和变焦（摇摄，倾斜，变焦）的缩写，它描述了摄像机的控制功能。
是的，警惕。 但是蟾蜍压倒了一切，自信也向她回响（“真的，我们不会想出来吗？！”）。 相机原来是旧的，但是带有出色的感光传感器（正是您需要观察晚上的情况）。 决定了，相机在我桌上。



第一[+]：

  1. 出色的夜间灵敏度（无任何红外照明）-f1.4时为0.5 Lux
  2. PTZ（尽管仅数字变焦）
  3. WiFi通过miniPCI RT2560F卡实现。 在速卖通上，您已经可以找到802.11n（例如AR9160 ，以最高质量替换并驱动视频流（相机支持mpeg4和H.263））
  4. 支持通过RTSP，HTTP等进行广播
  5. UPnP支持
  6. 他们没有在板上腾出金，所有接触层都是资本。
  7. 在您的Web服务器上。 和基于linux的系统一样 甚至发布了一些源代码 。 的确，最初无法访问SSH和telnet。

然后注意到[-]：

  1. 最高分辨率为640x480。 相机，显然是地狱般的（我立即想到它通常是通过lvds连接的，其连接器非常相似。
  2. 初始连接有困难。 摄像机只能通过集线器或通过电缆交叉线连接到计算机。 而且不知道什么IP地址。

应该立即指出，在Internet上关于我的特定信息模型的信息很少-d-link网站上的页面就是这样。 因此，我决定先打开机壳，这一切都归功于所有三个螺钉。 顺便说一句，对我来说，在盒子的底部有一个用于摄影三脚架的标准安装座（1/4英寸）似乎很不错。通常，在取下盖子后，我看到了这张照片：


带元素标题的图片



带有版权说明的照片，使它在细胞修复车间中成为过去。 在出现类似型号的情况下，您始终可以自己做出决定:)。 我看了很长时间的板子，把所有东西放在一起，决定看看相机如何与本机软件一起工作（幸运的是，我设法从d-link服务器上下载了一些大软件包）。

尽管起先仔细研究了俄语，然后仔细研究了英语手册，但我对如何找到相机一无所知。 我必须在夹层楼上寻找一个旧的集线器，将相机连接到它，安装Wireshark并收听以太网。 侦听的IP地址为“ 192.168.0.99”。 将其锤击到d-link网络摄像机安装程序的手动设置中后，摄像机便被拿起。 为了与此类相机配合使用，设计了d-link D-ViewCam的另一个实用程序。 还必须手动输入，出现摄像机，我什至可以检查PTZ的操作。 摄像头控制得很好，并以“一瓣齿轮”的分辨率左右/上下驱动。 事实是不断点击有点烦人。

在谷歌搜索中，我找到了文档“ DCS-5220，DCS-2120的URL命令 ”，其中说您可以使用以下命令控制摄像机：http：///cgi-bin/camctrl.cgi？ [move =] [＆speedpan =] [＆speedtilt =]，其中，值=上/下/左/右/原点+ -5-进入驱动齿轮的一个齿。
原则上，似乎一切都应该存在，但令人怀疑的蠕虫并没有解决。 Unix上有一个Web界面。 在查看模拟摄像机并阅读forum.openwrt.org之后，发现了一个漏洞，该漏洞允许Web请求启用摄像机中的telnet。 所需要做的就是在浏览器行中编写
http：// <摄像机地址> /cgi/admin/telnetd.cgi?command=on

在完成摄像头的工作之后，我强烈建议您关闭telnet，方法是通过请求以类似方式进行
http：// <摄像机地址> /cgi/admin/telnetd.cgi?command=off

最终结果是，telnet会话给出的答案远远超过所有官方站点（甚至包括官方Telegram频道：）的总和。 以下是通过telnet和UART控制台收集的有关此相机硬件功能的信息:)：

Dmesg输出
~ $ dmesg
Linux version 2.4.26-vrs1 (root@rd1-1) (gcc version 3.3.2) #1742 Fri Jul 20 09:20:51 CST 2007
CPU: FA526id(wb) revision 1
Machine: Vivotek VVTK1000
Ignoring unrecognised tag 0x00000000
Ignoring unrecognised tag 0x00000000
On node 0 totalpages: 6144
zone(0): 6144 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram rw initrd=0x800000,4194304 mem=24M ahbclk=110592000 pciclk=27648000
Relocating machine vectors to 0xffff0000
IRQ timer at interrupt number 0x08 clock 55296000
Calibrating delay loop... 136.80 BogoMIPS
Memory: 24MB = 24MB total
Memory: 18172KB available (1496K code, 430K data, 68K init)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
CPU: Testing write buffer: pass
POSIX conformance testing by UNIFIX
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Journalled Block Device driver loaded
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xf9890000 (irq = 3) is a NULL
ttyS01 at 0xf98b0000 (irq = 4) is a NULL
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
VVTK1000 flash device: 800000 at 10000000
init_vvtk1000_flash_map() -- type: cfi_probe
VVTK1000 flash: Found 1 x16 devices at 0x0 in 8-bit mode
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Using VVTK1000 partition definition
Creating 2 MTD partitions on "VVTK1000 flash":
0x00000000-0x00600000 : "kernel"
0x00600000-0x00800000 : "jffs2"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 4096K
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 68K
IRQ UART at interrupt number 0x3
WDT device driver version 1.0.0.1
GPIOI2C device driver version 1.0.0.5
RTC device driver version 1.0.0.1
GPIO Device Driver version 1.1.0.0.
I2C slave device driver version 1.1.0.0. (H/W Rev. 0x10500)
Queue driver installed !!
MTR device driver version 1.0.0.4
I2S w UDA1345TS driver v 1.1.0.1. Copyright 2004 Vivotek, Inc.
i2s_intc_value: 0x0000a431
i2s_intc_value: 0x0000a431
hwinfo 1.1.0.0 initialized.
CFC Device Driver version 1.0.0.0.
VVDC_Clk_init_module: VVDC Clock Delay is 0x00503030.
VVDC_Clk_cleanup_module: Module removed ok!
8139too Fast Ethernet driver 0.9.26
eth0: RealTek RTL8139 at 0xc28b7000, 00:ab:cd:ab:cd:ef, IRQ 1
eth0: Identified 8139 chip type 'RTL-8100B/8139D'
eth0: link up, 100Mbps, full-duplex, lpa 0x45E1
enable_irq(31) unbalanced from c2880b18
enable_irq(29) unbalanced from c288639c
enable_irq(30) unbalanced from c2884330
enable_irq(7) unbalanced from c2896c54
upnpdd: unhandled page fault at pc=0x0000c840, lr=0xbf7ffd40 (bad address=0xdf7ffcbc, code 5)
pc : [0000c840] lr : [bf7ffd40] Tainted: P
sp : bf7ffc54 ip : 07ffffff fp : 0001bec0
r10: 000170e8 r9 : 00000000 r8 : 00002802
r7 : 00017550 r6 : 00000000 r5 : df7ffd3c r4 : 00000001
r3 : 00000020 r2 : 00000040 r1 : 00000006 r0 : bf7ffd40
Flags: nzCv IRQs on FIQs on Mode USER_32 Segment user
Control: 397F Table: 00B0C000 DAC: 00000015

df -h输出
~ # df -h
Filesystem Size Used Available Use% Mounted on
/dev/ramdisk 4.9M 4.7M 0 100% /
/dev/mtdblock1 2.0M 896.0k 1.1M 44% /mnt/flash
none 10.0M 16.0k 10.0M 0% /mnt/ramdisk

PS轴输出
~ $ ps ax
PID Uid VmSize Stat Command
1 root 344 S init
2 root SW [keventd]
3 root SWN [ksoftirqd_CPU0]
4 root SW [kswapd]
5 root SW [bdflush]
6 root SW [kupdated]
7 root SW [mtdblockd]
30 root SWN [jffs2_gcd_mtd1]
80 root 260 S /sbin/watchdog 60 5
89 root 200 S /usr/sbin/hresetd /dev/gpio4
179 root 320 S /sbin/syslogd -m 0 -o 64000
196 root 336 S /usr/sbin/drmd
198 root 336 S /usr/sbin/drmd
199 root 336 S /usr/sbin/drmd
233 root 312 S /usr/sbin/inetd /etc/inetd.conf
254 root 316 S /usr/sbin/urecorder
265 root 320 S /usr/sbin/smbrecorder
288 root 260 S /usr/sbin/swatchdog -t 60 -p /var/run/swatchdog.farseer.pid -a /usr/bin/soft-reboot-bg
293 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
294 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
296 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
297 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
298 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
299 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
300 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
321 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
322 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
323 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
329 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
330 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
337 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
338 root 2716 S /usr/sbin/farseer.out -d -c /tmp/farseer.fifo
354 root 372 S /usr/sbin/crond -l 0
435 root 188 S /usr/sbin/ledctrl /dev/cfc2 1000000
454 root 836 S /bin/sh /usr/bin/detectnet
458 root 364 S /sbin/getty -L ttyS0 38400 vt100
21042 root 372 S telnetd
21045 admin 440 S -sh
21207 root Z [sh]
21208 root 268 S sleep 2
21212 admin 364 R ps ax

输出ls / dev /
~ $ ls /dev/
cfc0 dsp0 gpio2 gpio_i2c hda13 hda4 i2c mtd0 ptmx ptyp4 ram2 stdin tty1 tty7 ttyp1 ttyp7 watchdog
cfc1 dsp1 gpio3 hda hda14 hda5 i2c_slave mtd1 pts ptyp5 ram3 stdout tty2 ttyAM0 ttyp2 urandom wdt
cfc2 fd gpio4 hda1 hda15 hda6 i2s mtdblock1 ptyp0 ptyp6 ramdisk tracer tty3 ttyAM1 ttyp3 vma_ae zero
cmmap gpio gpio5 hda10 hda16 hda7 log mtr1 ptyp1 ptyp7 random tracerU tty4 ttyS0 ttyp4 vma_be
console gpio0 gpio6 hda11 hda2 hda8 mem null ptyp2 ram0 rtc tty tty5 ttyS1 ttyp5 vma_me
dsp gpio1 gpio7 hda12 hda3 hda9 mmap ppp ptyp3 ram1 stderr tty0 tty6 ttyp0 ttyp6 vma_vpe

LSMOD输出
~ $ lsmod
Module Size Used by Tainted: P
8139too 12460 1
mii 2344 0 [8139too]
cfc 1264 1
hwinfo 2200 0 (unused)
vaudio 4112 1
motor 5424 1
mmap 1136 1
cmmap 1128 1
vma_ae 2792 0 (unused)
vma_be 2856 2
vma_me 2616 4
vma_vpe 4040 1
i2c_slave 3304 0 (unused)
gpio 2552 8
rtc 2908 0 (unused)
gpio_i2c 2584 1 [rtc]
wdt 992 1

Uname -a输出
uname -a
Linux Network-Camera 2.4.26-vrs1 #1742 Fri Jul 20 09:20:51 CST 2007 armv4l unknown

Cat / proc / cpuinfo输出
~ $ cat /proc/cpuinfo
Processor : FA526id(wb) rev 1 (v4l)
BogoMIPS : 136.80
Features : swp half thumb
Hardware : Vivotek VVTK1000
Revision : 0000
Serial : 0000000000000000



UART输出
The system is going down NOW
Sending SIGTERM to all processes.
Sending SIGKILL to all processes.
Please stand by while rebooting the system.flushing ide devices:
Restarting system.
ARMboot 1.1.0 (Nov 23 2006 - 17:31:45)
Vivotek EVM version 1.6.0.0 (System:110592000, UART:18432000)
ARMboot code: 00000000 ~ 000355f8
DRAM Configuration:
Bank #0 at 0x10000000 32 MB
Bank #1 at 0x00000000 0 KB
Flash: 8 MB
VVTK1000 PCI Driver for ARMBoot
....Found PCI Device at (0,0,0) ID=0x4321159B
parameter: 68 45 00503030
....Found PCI Device at (11,0,0) ID=0x813910EC
ethaddr: 00:AB:CD:AB:CD:EF
Hit any key to stop autoboot: 1 0
## Booting image at 10020000 ...
Image Name: linux-2.4.26
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2934880 Bytes = 2866 kB = 2 MB
Load Address: 00408000
Entry Point: 00408000
Verifying Checksum ... OK
Loading Kernel Image ... OK
Starting kernel ...
Uncompressing Linux............................................................. done, booting the kernel.
Linux version 2.4.26-vrs1 (klaymen@rd1-2.vivotek.tw) (gcc version 3.3.2) #1 Mon Oct 20 20:33:14 CST 2008
CPU: FA526id(wb) revision 1
Machine: Vivotek VVTK1000
Ignoring unrecognised tag 0x00000000
Ignoring unrecognised tag 0x00000000
On node 0 totalpages: 6144
zone(0): 6144 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram rw initrd=0x800000,4194304 mem=24M ahbclk=110592000 pciclk=27648000
IRQ timer at interrupt number 0x08 clock 55296000
Calibrating delay loop... 136.80 BogoMIPS
Memory: 24MB = 24MB total
Memory: 18172KB available (1496K code, 430K data, 68K init)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
CPU: Testing write buffer: pass
POSIX conformance testing by UNIFIX
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Journalled Block Device driver loaded
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xf9890000 (irq = 3) is a NULL
ttyS01 at 0xf98b0000 (irq = 4) is a NULL
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
VVTK1000 flash device: 800000 at 10000000
init_vvtk1000_flash_map() -- type: cfi_probe
VVTK1000 flash: Found 1 x16 devices at 0x0 in 8-bit mode
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Using VVTK1000 partition definition
Creating 2 MTD partitions on "VVTK1000 flash":
0x00000000-0x00600000 : "kernel"
0x00600000-0x00800000 : "jffs2"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 4096K
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 68K
IRQ UART at interrupt number 0x3
init started: BusyBox v1.00 (2006.01.16-08:12+0000) multi-call binary
init started: BusyBox v1.00 (2006.01.16-08:12+0000) multi-call binary
Starting pid 10, console /dev/ttyS0: '/etc/init.d/rcS'
ifconfig: Warning: cannot open /proc/net/dev. Limited output.: No such file or directory
ifconfig: eth0: error fetching interface information: Device not found
Using /drivers/wdt.o
WDT device driver version 1.0.0.1
Using /drivers/gpio_i2c.o
GPIOI2C device driver version 1.0.0.5
Using /drivers/rtc.o
RTC device driver version 1.0.0.1
Using /drivers/gpio.o
GPIO Device Driver version 1.1.0.0.
Using /drivers/i2c_slave.o
I2C slave device driver version 1.1.0.0. (H/W Rev. 0x10500)
Using /drivers/vma_vpe.o
Using /drivers/vma_me.o
Queue driver installed !!
Using /drivers/vma_be.o
Using /drivers/vma_ae.o
Using /drivers/cmmap.o
Using /drivers/mmap.o
Using /drivers/motor.o
MTR device driver version 1.0.0.4
Using /drivers/vaudio.o
I2S driver v 1.4.0.1. Copyright 2004 Vivotek, Inc.
for UDA1345
i2s_intc_value: 0x0000a430
i2s_intc_value: 0x0000a430
Using /drivers/hwinfo.o
hwinfo 1.1.0.0 initialized.
Using /drivers/cfc.o
CFC Device Driver version 1.0.0.0.
/etc/init.d/rcS: 44: /mnt/flash/patch/apply_patch: not found
Starting restore: update system configuration...
cp: unable to remove `./etc/rcK.d/K07bootlogger': Success
cp: unable to remove `./etc/rcK.d/K97smbrecord': No such file or directory
cp: unable to remove `./etc/rcK.d/K69upnpdd': No such file or directory
cp: unable to remove `./etc/rcK.d/K94watchdog': No such file or directory
cp: unable to remove `./etc/rcK.d/K44inetd': No such file or directory
cp: unable to remove `./etc/rcK.d/K88sysklogd': No such file or directory
cp: unable to remove `./etc/rcK.d/K09eventd': No such file or directory
cp: unable to remove `./etc/rcK.d/K60ddnsc': No such file or directory
cp: unable to remove `./etc/rcK.d/K67upnpigdcp': No such file or directory
cp: unable to remove `./etc/rcK.d/K20urecorder': No such file or directory
cp: unable to remove `./etc/rcK.d/K95led': No such file or directory
cp: unable to remove `./etc/rcK.d/K05heartbeat': No such file or directory
cp: unable to remove `./etc/rcK.d/K90network': No such file or directory
cp: unable to remove `./etc/rcK.d/K93hresetd': No such file or directory
cp: unable to remove `./etc/rcK.d/K96restore': No such file or directory
cp: unable to remove `./etc/rcK.d/K10farseer': No such file or directory
cp: unable to remove `./etc/rcK.d/K75netfs~': No such file or directory
cp: unable to remove `./etc/rcK.d/K40bbcrond': No such file or directory
cp: unable to remove `./etc/rcK.d/K21smbrecorder': No such file or directory
cp: unable to remove `./etc/rcK.d/K70drmd': No such file or directory
modifying root privilege...
The system is going down NOW !!
The system is going down NOW !!
Starting led: /dev/cfc0 1
Starting watchdog: .
Starting hresetd:
Sendi
Sending SIGKILL to all processes.
Please stand by while rebooting the system.
flushing ide devices:
Restarting system.
ARMboot 1.1.0 (Nov 23 2006 - 17:31:45)
Vivotek EVM version 1.6.0.0 (System:110592000, UART:18432000)
ARMboot code: 00000000 ~ 000355f8
DRAM Configuration:
Bank #0 at 0x10000000 32 MB
Bank #1 at 0x00000000 0 KB
Flash: 8 MB
VVTK1000 PCI Driver for ARMBoot
....Found PCI Device at (0,0,0) ID=0x4321159B
ARMboot 1.1.0 (Nov 23 2006 - 17:31:45)
Vivotek EVM version 1.6.0.0 (System:110592000, UART:18432000)
ARMboot code: 00000000 ~ 000355f8
DRAM Configuration:
Bank #0 at 0x10000000 32 MB
Bank #1 at 0x00000000 0 KB
Flash: 8 MB
VVTK1000 PCI Driver for ARMBoot
....Found PCI Device at (0,0,0) ID=0x4321159B
parameter: 68 45 00503030
....Found PCI Device at (11,0,0) ID=0x813910EC
ethaddr: 00:AB:CD:AB:CD:EF
Hit any key to stop autoboot: 1 0
## Booting image at 10020000 ...
Image Name: linux-2.4.26
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2934880 Bytes = 2866 kB = 2 MB
Load Address: 00408000
Entry Point: 00408000
Verifying Checksum ... OK
Loading Kernel Image ... OK
Starting kernel ...
Uncompressing Linux............................................................. done, booting the kernel.
Linux version 2.4.26-vrs1 (klaymen@rd1-2.vivotek.tw) (gcc version 3.3.2) #1 Mon Oct 20 20:33:14 CST 2008
CPU: FA526id(wb) revision 1
Machine: Vivotek VVTK1000
Ignoring unrecognised tag 0x00000000
Ignoring unrecognised tag 0x00000000
On node 0 totalpages: 6144
zone(0): 6144 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram rw initrd=0x800000,4194304 mem=24M ahbclk=110592000 pciclk=27648000
IRQ timer at interrupt number 0x08 clock 55296000
Calibrating delay loop... 136.80 BogoMIPS
Memory: 24MB = 24MB total
Memory: 18172KB available (1496K code, 430K data, 68K init)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
CPU: Testing write buffer: pass
POSIX conformance testing by UNIFIX
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Journalled Block Device driver loaded
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xf9890000 (irq = 3) is a NULL
ttyS01 at 0xf98b0000 (irq = 4) is a NULL
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
VVTK1000 flash device: 800000 at 10000000
init_vvtk1000_flash_map() -- type: cfi_probe
VVTK1000 flash: Found 1 x16 devices at 0x0 in 8-bit mode
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Using VVTK1000 partition definition
Creating 2 MTD partitions on "VVTK1000 flash":
0x00000000-0x00600000 : "kernel"
0x00600000-0x00800000 : "jffs2"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 4096K
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 68K
IRQ UART at interrupt number 0x3
init started: BusyBox v1.00 (2006.01.16-08:12+0000) multi-call binary
init started: BusyBox v1.00 (2006.01.16-08:12+0000) multi-call binary
Starting pid 10, console /dev/ttyS0: '/etc/init.d/rcS'
ifconfig: Warning: cannot open /proc/net/dev. Limited output.: No such file or directory
ifconfig: eth0: error fetching interface information: Device not found
Using /drivers/wdt.o
WDT device driver version 1.0.0.1
Using /drivers/gpio_i2c.o
GPIOI2C device driver version 1.0.0.5
Using /drivers/rtc.o
RTC device driver version 1.0.0.1
Using /drivers/gpio.o
GPIO Device Driver version 1.1.0.0.
Using /drivers/i2c_slave.o
I2C slave device driver version 1.1.0.0. (H/W Rev. 0x10500)
Using /drivers/vma_vpe.o
Using /drivers/vma_me.o
Queue driver installed !!
Using /drivers/vma_be.o
Using /drivers/vma_ae.o
Using /drivers/cmmap.o
Using /drivers/mmap.o
Using /drivers/motor.o
MTR device driver version 1.0.0.4
Using /drivers/vaudio.o
I2S driver v 1.4.0.1. Copyright 2004 Vivotek, Inc.
for UDA1345
i2s_intc_value: 0x0000a430
i2s_intc_value: 0x0000a430
Using /drivers/hwinfo.o
hwinfo 1.1.0.0 initialized.
Using /drivers/cfc.o
CFC Device Driver version 1.0.0.0.
/etc/init.d/rcS: 44: /mnt/flash/patch/apply_patch: not found
Starting restore: .
Starting led: /dev/cfc0 1
Starting watchdog: .
Starting hresetd: .
Starting synctime: .
Starting ptburn: .
Starting network: /dev/cfc1 1
Copied 256 bytes from address 0x00002000 in flash to /tmp/pci_scan_dump
Using /drivers/vvdc_clk.o
Warning: loaup0: 00000068
dilow0: 00000045
ngup1: 00000064
vlow1: 0000003f
vdVVDC_Clk_init_module: VVDC Clock Delay is 0x00503030.
c_clk will taint the kernel: no license
See http://www.tux.org/lkml/#export-tainted for information about tainted modules
VVDC_Clk_cleanup_module: Module removed ok!
Using /lib/modules/2.4.26-vrs1/kernel/drivers/net/mii.o
Using /lib/modules/2.4.26-vrs1/kernel/drivers/net/8139too.o
8139too Fast Ethernet driver 0.9.26
eth0: RealTek RTL8139 at 0xc28b7000, 00:ab:cd:ab:cd:ef, IRQ 1
eth0: link up, 100Mbps, full-duplex, lpa 0x45E1
eth0: negotiated 100baseTx-FD, link ok
Usage: /usr/sbin/setdns dns1 dns2 ... dnsN
/dev/cfc1 0
Starting syslogd: .
run-parts: /etc/rcS.d/S50upnpigdcp exited with return code 1: Success
Starting inetd: .
Starting crond: .
Starting urecorder: .
Starting smbrecorder: .
Stop pan/tilt burning program...Stopping ptburn: no /usr/bin/ptburn found; none killed.
Starting swatchdog: .
Starting farseer.out: enable_irq(31) unbalanced from c2880b18
enable_irq(29) unbalanced from c288639c
enable_irq(30) unbalanced from c2884330
enable_irq(7) unbalanced from c2896c54
Starting ddnsc: DDNS client is disabled
run-parts: /etc/rcS.d/S86ddnsc exited with return code 1: Success
Starting upnpdd: enable 1
Starting drmd: .
Starting eventd: Stopping crond: stopped crond (pid 232).
Starting crond: .
Starting system boot messages: Sending startup log
BusyBox v1.00 (2006.01.16-08:12+0000) multi-call binary
Usage: rm [OPTION]... FILE...
rm: cannot remove `/mnt/ramdisk/eventd./*': No such file or directory
Starting ledctrl: /dev/cfc0 1
Starting smbmount: rm: cannot remove `/var/spool/cron/root-crontabs/smbmount.crontab': No such file or directory
Reloading configuration crond: .
lo no wireless extensions.
eth0 no wireless extensions.
cp: /mnt/flash/etc/daylight.c
Starting pid 491, console /dev/ttyS0: '/sbin/getty'
Network-Camera login:
The system pc : [00015230] lr : [0000e4d4] Tainted: P
issp : bf1ff020 ip : 4005ed4c fp : 00000003
gr10: 4005ea40 r9 : 00000000 r8 : 00000000
oir7 : 00000000 r6 : 0000000f r5 : 00086320 r4 : 00087d70
ngr3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : 00000000
dFlags: nZCvow IRQs on FIQs on Mode USER_32 Segment user
n Control: 397F Table: 00990000 DAC: 00000015
NOW pc : [00015230] lr : [0000e4d4] Tainted: P
!!sp : bf5ff940 ip : 4005ed4c fp : 00082f90
r10: 4005ea40 r9 : 00000000 r8 : 00000000
Ser7 : 00000000 r6 : 0000000f r5 : 00086320 r4 : 00087d70
ndr3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : 00000000
inFlags: nZCvg IRQs on FIQs on Mode USER_32 Segment user
SIControl: 397F Table: 00990000 DAC: 00000015
GTERM to all processes.
pc : [00015230] lr : [0000e4d4] Tainted: P
sp : bffff528 ip : 4005ed4c fp : 00082d4c
r10: 4005ea40 r9 : 00000000 r8 : 00001000
r7 : 401237d0 r6 : 0000000f r5 : 00086320 r4 : 00087d70
r3 : 00000000 r2 : 00001000 r1 : 00000000 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode USER_32 Segment user
Control: 397F Table: 00990000 DAC: 00000015
pc : [00015230] lr : [0000e4d4] Tainted: P
sp : befffbe0 ip : 4005ed4c fp : 000e60b0
r10: 4005ea40 r9 : 00000000 r8 : befffcc8
r7 : 00000000 r6 : 0000000f r5 : 00086320 r4 : 00087d70
r3 : 00000000 r2 : befffcc8 r1 : 00000000 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode USER_32 Segment user
Control: 397F Table: 00990000 DAC: 00000015
pc : [00015230] lr : [0000e4d4] Tainted: P
sp : be9ff8e8 ip : 4005ed4c fp : 00000210
r10: 4005ea40 r9 : 00000000 r8 : 00000000
r7 : 00000000 r6 : 0000000f r5 : 00086320 r4 : 00087d70
r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode USER_32 Segment user
Control: 397F Table: 00990000 DAC: 00000015
pc : [00015230] lr : [0000e4d4] Tainted: P
sp : be7ff980 ip : 4005ed4c fp : 00000210
r10: 4005ea40 r9 : 00000000 r8 : 00000000
r7 : 00000000 r6 : 0000000f r5 : 00086320 r4 : 00087d70
r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode USER_32 Segment user
Control: 397F Table: 00990000 DAC: 00000015
pc : [00015230] lr : [0000e4d4] Tainted: P
sp : be5ffb58 ip : 4005ed4c fp : 00000022
r10: 4005ea40 r9 : 00000000 r8 : 00000000
r7 : be5ffca0 r6 : 0000000f r5 : 00086320 r4 : 00087d70
r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode USER_32 Segment user
Control: 397F Table: 00990000 DAC: 00000015
pc : [00015230] lr : [0000e4d4] Tainted: P
sp : be3ff9c0 ip : 4005ed4c fp : 00000210
r10: 4005ea40 r9 : 00000000 r8 : 00000000
r7 : 00000000 r6 : 0000000f r5 : 00086320 r4 : 00087d70
r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode USER_32 Segment user
Control: 397F Table: 00990000 DAC: 00000015
Sending SIGKILL to all processes.
Please stand by while rebooting the system.flushing ide devices:
Restarting system.
ARMboot 1.1.0 (Nov 23 2006 - 17:31:45)
Vivotek EVM version 1.6.0.0 (System:110592000, UART:18432000)
ARMboot code: 00000000 ~ 000355f8
DRAM Configuration:
Bank #0 at 0x10000000 32 MB
Bank #1 at 0x00000000 0 KB
Flash: 8 MB
VVTK1000 PCI Driver for ARMBoot
....Found PCI Device at (0,0,0) ID=0x4321159B
Erasing sector 1 ... ok.
parameter: 68 45 00503030
....Found PCI Device at (11,0,0) ID=0x813910EC
ethaddr: 00:AB:CD:AB:CD:EF
Hit any key to stop autoboot: 1 0
## Booting image at 10020000 ...
Image Name: linux-2.4.26
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2934880 Bytes = 2866 kB = 2 MB
Load Address: 00408000
Entry Point: 00408000
Verifying Checksum ... OK
Loading Kernel Image ... OK
Starting kernel ...
Uncompressing Linux............................................................. done, booting the kernel.
Linux version 2.4.26-vrs1 (klaymen@rd1-2.vivotek.tw) (gcc version 3.3.2) #1 Mon Oct 20 20:33:14 CST 2008
CPU: FA526id(wb) revision 1
Machine: Vivotek VVTK1000
Ignoring unrecognised tag 0x00000000
Ignoring unrecognised tag 0x00000000
On node 0 totalpages: 6144
zone(0): 6144 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram rw initrd=0x800000,4194304 mem=24M ahbclk=110592000 pciclk=27648000
IRQ timer at interrupt number 0x08 clock 55296000
Calibrating delay loop... 136.80 BogoMIPS
Memory: 24MB = 24MB total
Memory: 18172KB available (1496K code, 430K data, 68K init)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
CPU: Testing write buffer: pass
POSIX conformance testing by UNIFIX
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Journalled Block Device driver loaded
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xf9890000 (irq = 3) is a NULL
ttyS01 at 0xf98b0000 (irq = 4) is a NULL
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
VVTK1000 flash device: 800000 at 10000000
init_vvtk1000_flash_map() -- type: cfi_probe
VVTK1000 flash: Found 1 x16 devices at 0x0 in 8-bit mode
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Using VVTK1000 partition definition
Creating 2 MTD partitions on "VVTK1000 flash":
0x00000000-0x00600000 : "kernel"
0x00600000-0x00800000 : "jffs2"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 4096K
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 68K
IRQ UART at interrupt number 0x3
init started: BusyBox v1.00 (2006.01.16-08:12+0000) multi-call binary
init started: BusyBox v1.00 (2006.01.16-08:12+0000) multi-call binary
Starting pid 10, console /dev/ttyS0: '/etc/init.d/rcS'
ifconfig: Warning: cannot open /proc/net/dev. Limited output.: No such file or directory
ifconfig: eth0: error fetching interface information: Device not found
Using /drivers/wdt.o
WDT device driver version 1.0.0.1
Using /drivers/gpio_i2c.o
GPIOI2C device driver version 1.0.0.5
Using /drivers/rtc.o
RTC device driver version 1.0.0.1
Using /drivers/gpio.o
GPIO Device Driver version 1.1.0.0.
Using /drivers/i2c_slave.o
I2C slave device driver version 1.1.0.0. (H/W Rev. 0x10500)
Using /drivers/vma_vpe.o
Using /drivers/vma_me.o
Queue driver installed !!
Using /drivers/vma_be.o
Using /drivers/vma_ae.o
Using /drivers/cmmap.o
Using /drivers/mmap.o
Using /drivers/motor.o
MTR device driver version 1.0.0.4
Using /drivers/vaudio.o
I2S driver v 1.4.0.1. Copyright 2004 Vivotek, Inc.
for UDA1345
i2s_intc_value: 0x0000a430
i2s_intc_value: 0x0000a430
Using /drivers/hwinfo.o
hwinfo 1.1.0.0 initialized.
Using /drivers/cfc.o
CFC Device Driver version 1.0.0.0.
/etc/init.d/rcS: 44: /mnt/flash/patch/apply_patch: not found
Starting restore: restore default setting...
Erased 8192 bytes from address 0x00002000 in flash
The system is goi
Sending SIGKILL to all processes.
Please stand by while rebooting the system.
flushing ide devices:
Restarting system.
ARMboot 1.1.0 (Nov 23 2006 - 17:31:45)
Vivotek EVM version 1.6.0.0 (System:110592000, UART:18432000)
ARMboot code: 00000000 ~ 000355f8
DRAM Configuration:
Bank #0 at 0x10000000 32 MB
Bank #1 at 0x00000000 0 KB
Flash: 8 MB
VVTK1000 PCI Driver for ARMBoot
....Found PCI Device at (0,0,0) ID=0x4321159B
Erasing sector 1 ... ok.
parameter: 68 46 00503030
.....Found PCI Device at (11,0,0) ID=0x813910EC
ethaddr: 00:AB:CD:AB:CD:EF
Hit any key to stop autoboot: 1 0
## Booting image at 10020000 ...
Image Name: linux-2.4.26
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2934880 Bytes = 2866 kB = 2 MB
Load Address: 00408000
Entry Point: 00408000
Verifying Checksum ... OK
Loading Kernel Image ... OK
Starting kernel ...
Uncompressing Linux............................................................. done, booting the kernel.
Linux version 2.4.26-vrs1 (klaymen@rd1-2.vivotek.tw) (gcc version 3.3.2) #1 Mon Oct 20 20:33:14 CST 2008
CPU: FA526id(wb) revision 1
Machine: Vivotek VVTK1000
Ignoring unrecognised tag 0x00000000
Ignoring unrecognised tag 0x00000000
On node 0 totalpages: 6144
zone(0): 6144 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram rw initrd=0x800000,4194304 mem=24M ahbclk=110592000 pciclk=27648000
IRQ timer at interrupt number 0x08 clock 55296000
Calibrating delay loop... 136.80 BogoMIPS
Memory: 24MB = 24MB total
Memory: 18172KB available (1496K code, 430K data, 68K init)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
CPU: Testing write buffer: pass
POSIX conformance testing by UNIFIX
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Journalled Block Device driver loaded
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xf9890000 (irq = 3) is a NULL
ttyS01 at 0xf98b0000 (irq = 4) is a NULL
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
VVTK1000 flash device: 800000 at 10000000
init_vvtk1000_flash_map() -- type: cfi_probe
VVTK1000 flash: Found 1 x16 devices at 0x0 in 8-bit mode
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Using VVTK1000 partition definition
Creating 2 MTD partitions on "VVTK1000 flash":
0x00000000-0x00600000 : "kernel"
0x00600000-0x00800000 : "jffs2"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 4096K
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 68K
IRQ UART at interrupt number 0x3
init started: BusyBox v1.00 (2006.01.16-08:12+0000) multi-call binary
init started: BusyBox v1.00 (2006.01.16-08:12+0000) multi-call binary
Starting pid 10, console /dev/ttyS0: '/etc/init.d/rcS'
ifconfig: Warning: cannot open /proc/net/dev. Limited output.: No such file or directory
ifconfig: eth0: error fetching interface information: Device not found
Using /drivers/wdt.o
WDT device driver version 1.0.0.1
Using /drivers/gpio_i2c.o
GPIOI2C device driver version 1.0.0.5
Using /drivers/rtc.o
RTC device driver version 1.0.0.1
Using /drivers/gpio.o
GPIO Device Driver version 1.1.0.0.
Using /drivers/i2c_slave.o
I2C slave device driver version 1.1.0.0. (H/W Rev. 0x10500)
Using /drivers/vma_vpe.o
Using /drivers/vma_me.o
Queue driver installed !!
Using /drivers/vma_be.o
Using /drivers/vma_ae.o
Using /drivers/cmmap.o
Using /drivers/mmap.o
Using /drivers/motor.o
MTR device driver version 1.0.0.4
Using /drivers/vaudio.o
I2S driver v 1.4.0.1. Copyright 2004 Vivotek, Inc.
for UDA1345
i2s_intc_value: 0x0000a430
i2s_intc_value: 0x0000a430
Using /drivers/hwinfo.o
hwinfo 1.1.0.0 initialized.
Using /drivers/cfc.o
CFC Device Driver version 1.0.0.0.
/etc/init.d/rcS: 44: /mnt/flash/patch/apply_patch: not found
Starting restore: .
Starting led: /dev/cfc0 1
Starting watchdog: .
Starting hresetd: .
Starting synctime: .
Starting ptburn: .
Starting network: /dev/cfc1 1
Copied 256 bytes from address 0x00002000 in flash to /tmp/pci_scan_dump
Using /drivers/vvdc_clk.o
Warning: loaup0: 00000068
dilow0: 00000046
ngup1: 00000064
vlow1: 0000003e
vdVVDC_Clk_init_module: VVDC Clock Delay is 0x00503030.
c_clk will taint the kernel: no license
See http://www.tux.org/lkml/#export-tainted for information about tainted modulesVVDC_Clk_cleanup_module: Module removed ok!
Using /lib/modules/2.4.26-vrs1/kernel/drivers/net/mii.o
Using /lib/modules/2.4.26-vrs1/kernel/drivers/net/8139too.o
8139too Fast Ethernet driver 0.9.26
eth0: RealTek RTL8139 at 0xc28b7000, 00:ab:cd:ab:cd:ef, IRQ 1
eth0: link up, 100Mbps, full-duplex, lpa 0x45E1
eth0: negotiated 100baseTx-FD, link ok
Usage: /usr/sbin/setdns dns1 dns2 ... dnsN
/dev/cfc1 0
Starting syslogd: .
run-parts: /etc/rcS.d/S50upnpigdcp exited with return code 1: Success
Starting inetd: .
Starting crond: .
Starting urecorder: .
Starting smbrecorder: .
Stop pan/tilt burning program...Stopping ptburn: no /usr/bin/ptburn found; none killed.
Starting swatchdog: .
Starting farseer.out: enable_irq(31) unbalanced from c2880b18
enable_irq(29) unbalanced from c288639c
enable_irq(30) unbalanced from c2884330
enable_irq(7) unbalanced from c2896c54
Starting ddnsc: DDNS client is disabled
run-parts: /etc/rcS.d/S86ddnsc exited with return code 1: Success
Starting upnpdd: enable 1
Starting drmd: .
Starting eventd: Stopping crond: stopped crond (pid 232).
Starting crond: .
Starting system boot messages: Sending startup log
BusyBox v1.00 (2006.01.16-08:12+0000) multi-call binary
Usage: rm [OPTION]... FILE...
rm: cannot remove `/mnt/ramdisk/eventd./*': No such file or directory
Starting ledctrl: /dev/cfc0 1
Starting smbmount: rm: cannot remove `/var/spool/cron/root-crontabs/smbmount.crontab': No such file or directory
Reloading configuration crond: .
lo no wireless extensions.
eth0 no wireless extensions.
cp: /mnt/flash/etc/daylight.crontab: No such file or directory
Starting pid 491, console /dev/ttyS0: '/sbin/getty'
Network-Camera login

给决定重复此类实验的每个人注意/提醒-通过电平转换器（我有FTDI232）连接到UART输出。

在仔细分析控制台启动日志之后，可以很明显地看出内核是直接解压缩到RAM中的。 从理论上讲，在该站点上可以找到GPL固件，如果不是每个人都可以找到，那么至少可以找到许多d-link产品。 但是对于我的型号，无法下载最新固件。 好的，我选择了第一个文件（* .pkg文件）并将其送入binwalk。

结果是：

$binwalk DCS-5220_A2_v1.05.pkg
DECIMAL HEXADECIMAL DESCRIPTION
__________________________________________
54_0x36_uImage header, OS Kernel Image, compression type: none, image name: "linux-2.4.26"
11770 _0x2DFA _gzip compressed data, maximum compression,
897238_0xDB0D6_gzip compressed data, maximum compression, file name: "initrd.img"
2935070_0x2CC91E_gzip compressed data

在进行进一步研究之前，我对角看了看是否有提及拆卸和/或重新组装此类相机的固件。 我遇到了一个称为“用于IP摄像机的固件解包器”的资源，其中包含用于解压缩D-Link IP摄像机和类似的Trendnet摄像机的固件的脚本。 不幸的是，我的模特不在那儿。 以防万一，我试图写信给作者。 令我惊讶的是，后者回答并确认了binwalk提供的信息-固件中有简单的存档。 使用-e开关运行binwalk可获得以下图片：



使用tar -xvf命令可以轻松提取简单的TAR归档文件。 内容如下：

2CC91E的文件内容
www /
www / ret.html
www / logout.html
www / common.js
www /导航栏/
www / navbar / statusnav.html
www / navbar / helpnav.html
www / navbar / setupnav.html
www / navbar / helpnav.js
www / navbar / topnav.html
www / navbar / maintenancenav.html
www / navbar / homenav.html
www / client.html
www /帮助/
www / help / htool.html
www / help / menu.html
www / help / hadv.html
www / help / hhome.html
www / help / hstatus.html
www / plugindef.js
www / clientset.js
www / indexreal.html
www / RtspVaPgDec.cab
www / dlink.css
www / realqt.mov
www / index.html
www / camctrl.js
www /设置/
www / setup / accesslist.html
www / setup / devinfo.html
www / setup / config_index.html
www / setup / audiovideo.html
www / setup / wireless.html
www / setup / definepatrolname.js
www / setup / videoclip.html
www / setup / network.html
www / setup / edituser.html
www / setup / application.html
www / setup / accesslist.js
www / setup / firmwareupdate.html
www /设置/ time_date.js
www / setup / wireless.js
www / setup / maintain.html
www / setup / netstat.js
www / setup / config.html
www / setup / recording.html
www /设置/ ddns.js
www / setup / ddns.html
www / setup / network.js
www / setup / snapshot1.html
www / setup / security.html
www / setup / security.js
www / setup / audiovideo.js
www / setup / time_date.html
www /设置/向导/
www /设置/向导/ Wizardutil.js
www /设置/向导/ network.html
www /设置/向导/ wiznetwork.js
www / setup / wizard / wizard.html
www /设置/向导/ motion.html
www /设置/向导/ wizmotion.js
www / setup / patrolname.js
www / setup / image.html
www / setup / mailftp.html
www / setup / motion.html
www / setup / camctrl.html
www / setup / syslog.html
www / snapshot.html
www / webinfo.html
www / home.html
www /图片/
www / pic / ctrlhome.gif
www / pic / helpzoom.jpg
www / pic / helppause.jpg
www / pic / helpstop.jpg
www / pic / ctrldown.gif
www / pic / autopan.gif
www / pic / ctrlup_g.gif
www / pic / wlan_masthead.gif
www / pic / ctrlleft.gif
www / pic / sideright1.gif
www / pic / ctrldown_g.gif
www / pic / ctrlright_g.gif
www / pic / helpvolume.jpg
www / pic / ctrlhome_g.gif
www / pic / stop.gif
www / pic / ctrlleft_g.gif
www / pic / sideleft1.gif
www / pic / ctrlright.gif
www / pic / autopatrol.gif
www / pic / helpmute.jpg
www / pic / sideleft2.gif
www / pic / sideright2.gif
www / pic / short_modnum.gif
www / pic / ctrlup.gif
www / pic / wireless_bottom.gif

文件内容378A40
设置/
设置/写网页
设置/ writebootimage
设置/安装
设置/ writebootenv
设置/ .svn /
设置/ .svn /道具/
设置/ .svn /格式
设置/ .svn / prop-base /
设置/ .svn / prop-base / writel1l2.svn-base
设置/ .svn / prop-base / writewebpage.svn-base
设置/ .svn / prop-base / writebootenv.svn-base
设置/ .svn / prop-base / install.svn-base
设置/ .svn / prop-base / writebootimage.svn-base
设置/ .svn / all-wcprops
设置/ .svn /条目
设置/ .svn /文字库/
设置/ .svn /文本库/ writel1l2.svn库
设置/ .svn /文本库/ writewebpage.svn-base
设置/ .svn /文本库/ writebootenv.svn库
设置/ .svn /文本库/ install.svn-base
设置/ .svn /文本库/ writebootimage.svn库
设置/ .svn / tmp /
设置/ .svn / tmp /道具/
设置/ .svn / tmp / prop-base /
设置/ .svn / tmp /基于文本的目录/
设置/ writel1l2

由于内部没有发现任何有趣的内容，因此决定将其放入initrd.img 。 为了进行分析，只需使用以下命令安装映像：
$ sudo mount -o loop initrd.img /主页/ imagefile /

内部是一个标准集，可供研究者进行编辑:)
$ ls
bin开发驱动程序等，主目录lib linuxrc丢失+找到mnt proc root sbin tmp usr var

一路上，我发现5220摄像机修订版A1和修订版A2的固件相同并且可以完全互换。 但是从版本B到具有版本A硬件的相机的固件绝对不适合。

通常，从理论上定制固件并不难。 以及添加必要的驱动程序（例如，在更换miniPCI卡时）。 您可以通过D-ViewCam或“安装向导”程序的标准界面（我在开始时就谈到过）对照相机进行闪光。

但是还有另一种选择。 将完成的固件（以前重命名为flash.pkg）拖放到摄像机的内部ftp（ftp服务器应以telnet服务器启动，但是出于安全原因，默认情况下telnet处于禁用状态，需要通过特殊请求进行特殊启动）。 也许这些都不起作用-没有足够的时间检查。 所有这些都是来自标准应用程序的固件过程日志，使用wireshark拍摄：

线控固件过程
35 438.799789 192.168.0.99 192.168.0.56 FTP 114 Response: 220 Network-Camera FTP server (GNU inetutils 1.4.2) ready.
337 438.800105 192.168.0.56 192.168.0.99 FTP 66 Request: USER admin
339 438.803092 192.168.0.99 192.168.0.56 FTP 88 Response: 331 Password required for admin.
341 438.803503 192.168.0.56 192.168.0.99 FTP 61 Request: PASS
342 438.805896 192.168.0.99 192.168.0.56 FTP 81 Response: 230 User admin logged in.
344 438.806687 192.168.0.56 192.168.0.99 FTP 62 Request: TYPE I
345 438.818062 192.168.0.99 192.168.0.56 FTP 74 Response: 200 Type set to I.
347 438.818488 192.168.0.56 192.168.0.99 FTP 60 Request: PASV
348 438.820099 192.168.0.99 192.168.0.56 FTP 100 Response: 227 Entering Passive Mode (192,168,0,99,4,1)
353 438.821111 192.168.0.56 192.168.0.99 FTP 70 Request: STOR flash.pkg
354 438.838508 192.168.0.99 192.168.0.56 FTP 112 Response: 150 Opening BINARY mode data connection for 'flash.pkg'.
356 438.839333 192.168.0.99 192.168.0.56 FTP 81 Response: 214-firmware upgrade begin
358 438.843916 192.168.0.56 192.168.0.99 FTP-DATA 5894 [TCP Window Full] FTP Data: 5840 bytes (PASV) (STOR flash.pkg)
360 438.845280 192.168.0.56 192.168.0.99 FTP-DATA 2406 FTP Data: 2352 bytes (PASV) (STOR flash.pkg)
381 439.300480 192.168.0.99 192.168.0.56 FTP 123 Response: It will takes about 3-5 minutes.<br>
385 439.426777 192.168.0.99 192.168.0.56 FTP 128 Response: Do not turn off the power or remove the network cable during upgrade!<br>
391 439.926748 192.168.0.99 192.168.0.56 FTP 123 Response: System will restart automatically when upgrade is finished.<br>
395 440.399163 192.168.0.99 192.168.0.56 FTP 123 Response: Please wait...<br>
1763 460.987774 192.168.0.56 192.168.0.99 FTP-DATA 4671 FTP Data: 4617 bytes (PASV) (STOR flash.pkg)
1775 478.867766 192.168.0.99 192.168.0.56 FTP 69 Response: Processing<br>

就是这样，我决定写这本书是因为完全没有这种相机的任何信息，并且该文章提醒我们必须将固件处理到底。 如果有人确认或驳斥我的猜测，我将感到非常高兴。


注意：最初，我是openwrt的热心粉丝，我承认我爬进了摄像机内部，以了解是否可以在其中安装openwrt。 答案是，您可以保存网络功能，但PTZ功能将完全消失。 因此，最好修改现有固件。 但是我将该主题保存在openwrt.org论坛上，并在那里发布了所有我可以学习的有关d-link DCS-5220的新内容。

重要！ 现在可以在我的电报频道lab66中看到所有更新和临时注释，然后可以轻松地形成habr文章。 订阅以免期望下一篇文章，而立即了解所有研究信息：)

Source: https://habr.com/ru/post/zh-CN424919/

More articles:


All Articles