Hi3518 module notes 

A while ago I have bought a Hi3518 based camera module from the Aliexpress.

It is called BLK18E-0712C-38X38_S (V1.01)

Some initial findings:

- No DHCP is set. Static IP at
- Default username for HTTP and RSTP is admin with blank password.
- HTTP interface lang is set to chinese atm. I have no idea where to change this.
- Streaming is done through RSTP on the following URL: rtsp://
(Firefox did not have a plugin for this on Ubuntu, but VLC plays the stream well.)
- I have tried several telnet passwords which is out in the wild root+(juantech, klv123) but neither let me in.

NMAP log shows nothing more intresting (port 8899 IMHO for onvif):

23/tcp open telnet Busybox telnetd
80/tcp open tcpwrapped
|_http-favicon: Unknown favicon MD5: EC9D1C872C50DD7DA7D826D9C85FC158
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: NETSurveillance WEB
554/tcp open rtsp?
| rtsp-methods:
8899/tcp open soap gSOAP soap 2.7

I have managed to find the UART on the device:

Uboot output:

U-Boot 2010.06-svn (Jan 04 2015 - 13:37:41)

DRAM: 256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17
Spi(cs1): Block:64KB Chip:8MB Name:"MX25L6406E"
envcrc 0xc96922ac
ENV_SIZE = 0xfffc
In: serial
Out: serial
Err: serial
Press Ctrl+C to stop autoboot
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # help
? - alias for 'help'
base - print or set address offset
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
fload - fload - load binary file from a filesystem image for system boot

flwrite - SPI flash sub-system
getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
lip - lip - set local ip address but not save to flash

loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
mac - mac - set mac address and save to flash

md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
sip - sip - set server ip address but not save to flash

tftp - tftp - download or upload image via network using TFTP protocol
version - print monitor version

[ hozzászólás ] ( 3 megtekintés ) [ 0 trackbackek ] permalink ( 2.9 / 58 )
Retro: ASUS mimic CX200 JTAG hacking 

Back in my university years I have had some issues with an Asus MIMIC CX200 camera. One of them got broken after a firmware upgrade so I have decided to fix it with JTAG. I have successfully got to UrJTAG to read the IDCODE of the S3C4510B, but I was unable to detect the flash. Now I know that I have had to tweak the bus driver and reveng the board a bit.

Here are some pics (shot with my Nokia 6230 in VGA res) about the trick:

Thin albanian wires were soldered directly to the pins.

Live together cry together series 100 Ohm level shifter JTAG adapter to LPT port.

I have designed an addon board to expose the CPU's intresting interfaces (2 serial, USB, JTAG)

It is fun to look back to those pictures from now. After 5 years we got to a state when it is easier and cheaper to buy a Rpi to solve the same problem rather than fixing that board...
[ hozzászólás ] [ 0 trackbackek ] permalink kapcsolódó link ( 3.1 / 58 )
Geovision GV-800(S) under Linux 

One of my friends asked me to get working a Geovision GV-800(S) DVR card with zoneminder.
According to the google results several people succeed with this subject. For e.g.:
http://siripong-computer-tips.blogspot. ... linux.html

I have installed a n Ubuntu 12.04 server, and the necessary packages. This distribution shuiips with a relatively new kernel (3.5.0) which means that the necessary bttv modules were included fine. The device had shown up fine: I had 4 v4l2 devices with 4 channels per each (Composite0-4). I have added these channels as sources to the Zoneminder but I have not been able to get image from them. After several trials I have installed XFCE and XAWTV. I have not been able to get image with that tool too, and at the channel changes I got I/O errors and the software claimed about invalid framebuffer address on startup.

As final trying I have installed a Windows XP to the box, and installed the Geovision software. The device had shown up in the device manager fine, but there were a yellow exclamation points next to the devices with Device cannot started message. I have seen that card working in different computer.

As a last trial we have decided to try to upgrade the BIOS, and that solved the problem.
[ hozzászólás ] [ 0 trackbackek ] permalink ( 3 / 96 )
Genesis Pro GP6308S console output 

I have receieved a GenesisPro GP6308S DVR recorder. I have read in the user manual that it runs Linux, so I could not missed taking into pieces and check the console output on it.

At first a short HW overview:

HiSilicon HI3515SoC
256MB DDR2 RAM (2 pcs. Hynix H5PS5162GFR)
8 MB flash (Spansion S29GL064N90)
Realtek RTL8201CP NIC
2 pcs. NVP1114 4 ch video decoder
DS13072 RTC


The CN5 and CN7 are USB ports.

[ hozzászólás ] ( 353 megtekintés ) [ 0 trackbackek ] permalink ( 2.9 / 108 )
Mjpeg-streamer input plugin for Icamview based IP cameras 

Today I have managed to create an input plugin for the Mjpg streamer which grabs the JPG frames from my Asus Mimic CX200 IP camera trough it's properitary protocoll.

Q: Ok but what is it good for?
A: Originally this camera was purcashed by my father for survillance purposes. But the quality of the supported softwares, made it unusable to it. The client software could only record to AVI which means the PC have to deconvert the JPG frames, and compress them to the video format. With two cameras it was a challange for his old AMD Duron config. I am going to write a survillance output plugin to the mjpg-streamer which will allows to control the input plugins and the output_file plugin configuration in a comfortable way.

I send my greetings to all developers at the Megatec for their bullshit products.

[ 1 hozzászólás ] ( 33 megtekintés ) [ 0 trackbackek ] permalink ( 2.9 / 73 )

| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 |