Hi3518 module notes 

A while ago I have bought a Hi3518 based camera module from the Aliexpress.

It is called BLK18E-0712C-38X38_S (V1.01)

Some initial findings:

- No DHCP is set. Static IP at
- Default username for HTTP and RSTP is admin with blank password.
- HTTP interface lang is set to chinese atm. I have no idea where to change this.
- Streaming is done through RSTP on the following URL: rtsp://
(Firefox did not have a plugin for this on Ubuntu, but VLC plays the stream well.)
- I have tried several telnet passwords which is out in the wild root+(juantech, klv123) but neither let me in.

NMAP log shows nothing more intresting (port 8899 IMHO for onvif):

23/tcp open telnet Busybox telnetd
80/tcp open tcpwrapped
|_http-favicon: Unknown favicon MD5: EC9D1C872C50DD7DA7D826D9C85FC158
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: NETSurveillance WEB
554/tcp open rtsp?
| rtsp-methods:
8899/tcp open soap gSOAP soap 2.7

I have managed to find the UART on the device:

Uboot output:

U-Boot 2010.06-svn (Jan 04 2015 - 13:37:41)

DRAM: 256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17
Spi(cs1): Block:64KB Chip:8MB Name:"MX25L6406E"
envcrc 0xc96922ac
ENV_SIZE = 0xfffc
In: serial
Out: serial
Err: serial
Press Ctrl+C to stop autoboot
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # <INTERRUPT>
hisilicon # help
? - alias for 'help'
base - print or set address offset
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
fload - fload - load binary file from a filesystem image for system boot

flwrite - SPI flash sub-system
getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
lip - lip - set local ip address but not save to flash

loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
mac - mac - set mac address and save to flash

md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
sip - sip - set server ip address but not save to flash

tftp - tftp - download or upload image via network using TFTP protocol
version - print monitor version

[ 1 hozzászólás ] ( 626 megtekintés ) [ 0 trackbackek ] permalink ( 3 / 266 )
Daily rant - CS lab CSMIO/IP-M firmware update - Float point division by zero. 

I got a task to get a CSMIO/IP-M based machine running.
First I have started the experimentation in Virtualbox.
Installed MACH3, and the CSLab plugin. From MACH 3 it says it needs firmware update. Okay, let's check the firmware updater!

I have started to have bad feelings when it started with the following message:

Float point division by zero.


After passing this dialog here is the main screen:

Okay, it must be some problem with the Virtualbox.
So I have setup a Windows based machine, and it produced the same there. Contacted with the support, but no response.

While waiting to their support I have fired up my VBox and accidentally resized my Virtualbox window, and guess what:

After this trick I have been able to flash my drive and use the MACH3 later.

Driven by the curiosity I have tried to change the resolution on the native machine, but it did not helped, however the buttons are working even if you do not see anything in the window. So if you need this tool try to click blindly and it will ask for the FW upload file. They attached two files, nothing says which one needs to be flashed, so T have flashed both and it runs now.


[ hozzászólás ] ( 40 megtekintés ) [ 0 trackbackek ] permalink ( 3.1 / 159 )
Samsung D60 - no flash repair 

My father's Samsung D60 compact camera's flash stopped working.
I have taken it apart to see what happened. In our case the problem source was a broken flex PCB between the flash capacitor and the flash charge PCB.

Repair procedure:
- Remove the screws.
- Remove the back plastic cover
- Disconnect the LCD and unscrew the LCD holding frame.
- Disconnect the upper buttons
- Remove the front cover

WARNING: the flash capacitor is charged to >300V. It can cause injury or damage if you touch it when it is charged. Discharge it before starting the flash disassembling process.

There is a black tape on the main PCB right to the upper buttons connector. Measure DC voltage between the rightmost two pins. If you can measure the flash capacitor voltage (>10V) then your problem will be different. If not carefully desolder the pads of that flex PCB one by one.

Remove the flash holding screw, and remove the flash assembly including the flash capacitor.

Discharge the cap and solder back to the flex PCB:

Bonus: I have found the UART of the main MCU.

Unfortunatelly nothing exciting just a blue colored "end" string comes at the boot with 11500 8n1. It does not seems to be responding to anything.

Samsung Digimax S730 could be also affected. (Using the same flash assembly AD92-00338A (STS3-73))

[ hozzászólás ] ( 140 megtekintés ) [ 0 trackbackek ] permalink ( 3.1 / 171 )
Extract ROM file from Sony VAIO BIOS update 

I needed to reflash a Sony VAIO BIOS flash with an external programmer. I have had no contents for that so I have had to extract it from the vendor BIOS upgrade.

Unfortunatelly my update did not put the ROM file to the %temp% folder as it is suggested here:

I have fired up the ProcessMonitor and it helped me to figure out where is it:

So always look for the ROM file in the C:\ProgramData\Sony Corporation\Sony Packaging Manager\PackagingTemp while the updater is running.
[ 1 hozzászólás ] ( 14 megtekintés ) [ 0 trackbackek ] permalink ( 2.9 / 149 )
Install driver inf under Windows 7 from command line side notes... 

Just a side note to this blogpost:
http://users.atw.hu/balubati/blog/index ... 529-094303

The method only works if the INF file has a DefaultInstall key.

Something like this:

; Default Installer


Also I have learned how to get rid from a device driver totally:
List installed drivers with pnputil -e.
Find the appropiate one (oem[n].inf)
Uninstall the devices from device manager using this driver
Run pnputil -d oem[n].inf to delete the driver
[ hozzászólás ] ( 21 megtekintés ) [ 0 trackbackek ] permalink ( 2.9 / 154 )

<< <Előző | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | Következő> >>