Hikam S6 Reverse Engineering (HI3518 E)

README.md

Reverse Engineering of Hikam S6 (HI3518 E)

Why?

I wanted to integrate the camera into my home security system. The only problem is that I want to toggle the alarm of the camera based on the security system status. Currently, this is only available via the app or a time trigger which is booth not sufficient for me. So the main target was to change the alarm status without the app.

What I've done so far:

My first try was to capture the TCP packages between the Android app and the camera. Soon I realized that they are only TCP+SSL (not pinned) requests to a cloud service of Hikam. So I installed an emulator with the Hikam app and Wireshark. I've seen some packages but the payload is very strange and even if I send the UDP commands again the status won't change. So this was a dead end for me.

I opened the camera and found the UART port of the HI3518E chip which is inside the camera. I used a USB-to-Serial-Adapter together with Putty and a speed of 115200 to connect the camera. Finally I was able to see the startup.log (see below). Root password? It's not needed because it will auto login which is very great :D Linux Hikam-4119 3.4.35 #3 Wed Mar 28 14:22:13 HKT 2018 armv5tejl GNU/Linux is the result of uname -a. Stuff like the passwd-hash of the root user and some other debug-information is added as an extra document below.

There are two interesting extra mounted directories:

• /mnt/config/master which looks like the "backup" store with all configurations (binary?!)
• /mnt/mtd/bin contains binaries that are used to provide all the functions of the camera.

On the system there are 5 main applications running:

• ipc_daemon Works as a watchdog to restart any of the processes if one dies.
• webs Seems to serve the web interface to login to the camera which is running under port 80.
• platform ?! I think it's the cloud connection and handle some basic calls to the hardware.
• media Capture Video, providing ONVIF-Stream support etc..
• upgrade_manager Handle upgrades of the camera.

So I've tried to decompile these applications with snowman but the resulting code is too confusing. I've had a look at nearly any other file in the system but was not able to find anything useful. I've found some log files and debug-messages when the alarm is turned on or off, see below.

I've tried one last thing.. in the config-directory /mnt/config/master is one file called alarmconf.conf. So I've set the alarm to on and copied the resulting file to alarmconf.conf.on, deactivated the alarm and copied it to alarmconf.conf.off. If I now, execute cp alarmconf.conf.on alarmconf.conf it will activate the alarm, and if I execute cp alarmconf.conf.off alarmconf.conf it is off. So the system seems to watch the file and reload the configuration then. So for my use case, I could now compile a small program which opens a simple TCP connection or HTTP and listen for commands to exchange config files. But if anything is changed with a new firmware version I'm pretty sure something break.

So now It's YOUR TURN.. any ideas on how to proceed or any help here? I could offer you a "complete" file system dump.

Others

Links:

• DataSheet

debug-msg-alarm.log

ALARM ON:

/mnt # normal msg_type[60]len[112] peer[3]
night  auto  on  1
send msg:0x3d len[112] to peer:3
normal msg_type[18]len[44] peer[3]
send msg:0x18 len[48] to peer:3
send msg:0x25 len[52] to peer:3
send msg:0x3f len[112] to peer:3
send msg:0x51 len[48] to peer:3
send msg:0x31 len[96] to peer:3
return get network type retcode[0]peer[3]
send msg:0x43 len[48] to peer:3
2018-06-20 17:39:15 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

2018-06-20 17:39:15 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:85

normal msg_type[62]len[112] peer[3]
send msg:0x3f len[112] to peer:3
normal msg_type[76]len[112] peer[3]
send msg:0x4d len[9496] to peer:3
normal msg_type[62]len[112] peer[3]
send msg:0x3f len[112] to peer:3

##################################################

ALARM OFF

/mnt # normal msg_type[62]len[112] peer[3]
send msg:0x3f len[112] to peer:3
normal msg_type[60]len[112] peer[3]
night  auto  off  0
send msg:0x3d len[112] to peer:3
normal msg_type[18]len[44] peer[3]
send msg:0x18 len[48] to peer:3
send msg:0x25 len[52] to peer:3
send msg:0x3f len[112] to peer:3
return get network type retcode[0]peer[3]
send msg:0x43 len[48] to peer:3
2018-06-20 17:39:59 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

2018-06-20 17:39:59 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:85

send msg:0x51 len[48] to peer:3
send msg:0x31 len[96] to peer:3
##################################################

other-information.log

####### U-BOOT
hisilicon # printenv
bootdelay=1
baudrate=115200
ethaddr=00:00:23:34:45:66
ipaddr=192.168.1.10
serverip=192.168.1.2
netmask=255.255.255.0
bootfile="uImage"
bootargs=mem=38M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=hi_sfc:512k(boot),2816k(kernel),7M(rootfs),4M(app),512k(master),1280k(log)
bootcmd=sf probe 0;sf read 0x82000000 0x80000 0x2c0000;bootm 0x82000000
filesize=198
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Jun 15 2017 - 14:15:50)

Environment size: 476/65532 bytes


####### LINUX
~ # uname -a
Linux Hikam-4119 3.4.35 #3 Wed Mar 28 14:22:13 HKT 2018 armv5tejl GNU/Linux

~ # less /etc/passwd
root:$1$h2qS9ibK$zgxEvDi.1O4hFIPlm6jWp.:0:0::/root:/bin/sh^

Available commands:
[                  fsync              mknod              smemcap
[[                 ftpd               mkpasswd           softlimit
acpid              ftpget             mkswap             sort
add-shell          ftpput             mktemp             split
addgroup           fuser              modinfo            ssp_read
adduser            getopt             modprobe           ssp_write
adjtimex           getty              more               start-stop-daemon
arp                grep               mount              stat
arping             groups             mountpoint         strings
ash                gunzip             mpstat             stty
awk                gzip               mt                 su
base64             halt               mv                 sulogin
basename           hd                 nameif             sum
beep               hdparm             nanddump           sv
blkid              head               nandwrite          svlogd
blockdev           hexdump            nbd-client         swapoff
bootchartd         hiddrs             nc                 swapon
brctl              hier               netstat            switch_root
btools             hiew               nfsroot            sync
bunzip2            himc               nice               sysctl
busybox            himd               nmeter             syslogd
bzcat              himd.l             nohup              tac
bzip2              himm               nslookup           tail
cal                hostid             ntpd               tar
cat                hostname           od                 tcpsvd
catv               httpd              openvt             tee
chat               hush               passwd             telnet
chgrp              hwclock            patch              telnetd
chmod              i2c_read           pgrep              test
chown              i2c_write          pidof              tftp
chpasswd           id                 ping               tftpd
chpst              ifconfig           ping6              time
chroot             ifdown             pipe_progress      timeout
chrt               ifenslave          pivot_root         tools/
chvt               ifplugd            pkill              top
cksum              ifup               pmap               touch
clear              inetd              popmaildir         tr
cmp                init               poweroff           traceroute
comm               insmod             powertop           traceroute6
conspy             install            printenv           true
cp                 ionice             printf             tty
cpio               iostat             ps                 ttysize
crond              ip                 pscan              tunctl
crontab            ipaddr             pstree             ubiattach
cryptpw            ipcalc             pwd                ubidetach
cttyhack           ipcrm              pwdx               ubimkvol
cut                ipcs               raidautorun        ubirmvol
date               iplink             rdate              ubirsvol
dc                 iproute            rdev               ubiupdatevol
dd                 iprule             readahead          udevadm
deallocvt          iptunnel           readlink           udevd
delgroup           kbd_mode           readprofile        udhcpc
deluser            kill               realpath           udhcpd
depmod             killall            reboot             udpsvd
devmem             killall5           reformime          umount
df                 klogd              remove-shell       uname
dhcprelay          last               renice             unexpand
diff               less               reset              uniq
dirname            linux32            resize             unix2dos
dmesg              linux64            rev                unlzma
dnsd               ln                 rm                 unlzop
dnsdomainname      loadfont           rmdir              unxz
dos2unix           loadkmap           rmmod              unzip
du                 logger             route              uptime
dumpkmap           login              rpm                users
dumpleases         logname            rpm2cpio           usleep
echo               logread            rtcwake            uudecode
ed                 losetup            run-parts          uuencode
egrep              lpd                runlevel           vconfig
eject              lpq                runsv              vi
env                lpr                runsvdir           vlock
envdir             ls                 rx                 volname
envuidgid          lsmod              script             wall
ether-wake         lsof               scriptreplay       watch
expand             lspci              sed                watchdog
expr               lsusb              sendmail           wc
fakeidentd         lzcat              seq                wget
false              lzma               setarch            which
fbset              lzop               setconsole         who
fbsplash           lzopcat            setfont            whoami
fdflush            makedevs           setkeycodes        whois
fdformat           makemime           setlogcons         wpa_cli
fdisk              man                setserial          wpa_supplicant
fgconsole          md5sum             setsid             xargs
fgrep              mdev               setuidgid          xz
find               mesg               sh                 xzcat
findfs             microcom           sha1sum            yes
flock              mkdir              sha256sum          zcat
fold               mkdosfs            sha512sum          zcip
free               mkfifo             showkey
freeramdisk        mkfs.minix         slattach
fsck.minix         mkfs.vfat          sleep

~ # lsof
1       /bin/busybox    /dev/console
1       /bin/busybox    /dev/console
1       /bin/busybox    /dev/console
634     /bin/udevd      /dev/null
634     /bin/udevd      /dev/null
634     /bin/udevd      /dev/null
634     /bin/udevd      /dev/.udev/queue.bin
634     /bin/udevd      socket:[173]
634     /bin/udevd      socket:[174]
634     /bin/udevd      anon_inode:inotify
634     /bin/udevd      anon_inode:[signalfd]
634     /bin/udevd      socket:[175]
634     /bin/udevd      socket:[176]
717     /bin/udevd      /dev/null
717     /bin/udevd      /dev/null
717     /bin/udevd      /dev/null
717     /bin/udevd      anon_inode:inotify
717     /bin/udevd      socket:[176]
717     /bin/udevd      socket:[286]
719     /bin/udevd      /dev/null
719     /bin/udevd      /dev/null
719     /bin/udevd      /dev/null
719     /bin/udevd      anon_inode:inotify
719     /bin/udevd      socket:[176]
719     /bin/udevd      socket:[287]
1174    /bin/busybox    /dev/ttyS000
1174    /bin/busybox    /dev/ttyS000
1174    /bin/busybox    /dev/ttyS000
1174    /bin/busybox    /dev/tty
1176    /mnt/mtd/bin/ipc_daemon /dev/null
1176    /mnt/mtd/bin/ipc_daemon /dev/console
1176    /mnt/mtd/bin/ipc_daemon /dev/console
1176    /mnt/mtd/bin/ipc_daemon /mnt/mtd/etc/.ipc_daemon_lockfile
1176    /mnt/mtd/bin/ipc_daemon /mnt/log/ipc_daemon.log
1176    /mnt/mtd/bin/ipc_daemon /dev/watchdog
1176    /mnt/mtd/bin/ipc_daemon /mnt/mtd/etc/ipc_daemon.conf
1181    /mnt/mtd/bin/plat_main  /dev/null
1181    /mnt/mtd/bin/plat_main  /dev/console
1181    /mnt/mtd/bin/plat_main  /dev/console
1181    /mnt/mtd/bin/plat_main  /mnt/mtd/etc/.ipc_daemon_lockfile
1181    /mnt/mtd/bin/plat_main  /mnt/log/ipc_daemon.log
1181    /mnt/mtd/bin/plat_main  /dev/watchdog
1181    /mnt/mtd/bin/plat_main  /mnt/mtd/etc/ipc_daemon.conf
1181    /mnt/mtd/bin/plat_main  /mnt/log/platform.log
1181    /mnt/mtd/bin/plat_main  socket:[1096]
1181    /mnt/mtd/bin/plat_main  socket:[1254]
1181    /mnt/mtd/bin/plat_main  /dev/hi_gpio
1181    /mnt/mtd/bin/plat_main  /dev/hi_adc
1181    /mnt/mtd/bin/plat_main  /dev/hi_gpio
1208    /mnt/mtd/bin/dev_manager        /dev/null
1208    /mnt/mtd/bin/dev_manager        /dev/console
1208    /mnt/mtd/bin/dev_manager        /dev/console
1208    /mnt/mtd/bin/dev_manager        /mnt/mtd/etc/.ipc_daemon_lockfile
1208    /mnt/mtd/bin/dev_manager        /mnt/log/ipc_daemon.log
1208    /mnt/mtd/bin/dev_manager        /dev/watchdog
1208    /mnt/mtd/bin/dev_manager        /mnt/mtd/etc/ipc_daemon.conf
1208    /mnt/mtd/bin/dev_manager        /mnt/log/devmanager.log
1208    /mnt/mtd/bin/dev_manager        socket:[1191]
1208    /mnt/mtd/bin/dev_manager        socket:[1204]
1208    /mnt/mtd/bin/dev_manager        socket:[1206]
1220    /bin/wpa_supplicant     /dev/null
1220    /bin/wpa_supplicant     /dev/null
1220    /bin/wpa_supplicant     /dev/null
1220    /bin/wpa_supplicant     /mnt/mtd/etc/.ipc_daemon_lockfile
1220    /bin/wpa_supplicant     /mnt/log/ipc_daemon.log
1220    /bin/wpa_supplicant     /dev/watchdog
1220    /bin/wpa_supplicant     /mnt/mtd/etc/ipc_daemon.conf
1220    /bin/wpa_supplicant     /mnt/log/platform.log
1220    /bin/wpa_supplicant     socket:[1087]
1220    /bin/wpa_supplicant     socket:[1088]
1220    /bin/wpa_supplicant     socket:[1093]
1220    /bin/wpa_supplicant     socket:[1094]
1223    /mnt/mtd/bin/media_biz  /dev/null
1223    /mnt/mtd/bin/media_biz  /dev/console
1223    /mnt/mtd/bin/media_biz  /dev/console
1223    /mnt/mtd/bin/media_biz  /mnt/mtd/etc/.ipc_daemon_lockfile
1223    /mnt/mtd/bin/media_biz  /mnt/log/ipc_daemon.log
1223    /mnt/mtd/bin/media_biz  /dev/watchdog
1223    /mnt/mtd/bin/media_biz  /mnt/mtd/etc/ipc_daemon.conf
1223    /mnt/mtd/bin/media_biz  /mnt/log/media.log
1223    /mnt/mtd/bin/media_biz  /dev/vb
1223    /mnt/mtd/bin/media_biz  /dev/sys
1223    /mnt/mtd/bin/media_biz  /dev/isp_dev
1223    /mnt/mtd/bin/media_biz  /dev/isp_dev
1223    /mnt/mtd/bin/media_biz  /dev/mem
1223    /mnt/mtd/bin/media_biz  /dev/i2c-0
1223    /mnt/mtd/bin/media_biz  /dev/vi
1223    /mnt/mtd/bin/media_biz  /dev/vi
1223    /mnt/mtd/bin/media_biz  /dev/vpss
1223    /mnt/mtd/bin/media_biz  /dev/vpss
1223    /mnt/mtd/bin/media_biz  /dev/vpss
1223    /mnt/mtd/bin/media_biz  /dev/venc
1223    /mnt/mtd/bin/media_biz  /dev/venc
1223    /mnt/mtd/bin/media_biz  /dev/venc
1223    /mnt/mtd/bin/media_biz  /dev/isp_dev
1223    /mnt/mtd/bin/media_biz  /dev/venc
1223    /mnt/mtd/bin/media_biz  /dev/venc
1223    /mnt/mtd/bin/media_biz  /mnt/mtd/bin/ASC32
1223    /mnt/mtd/bin/media_biz  /mnt/mtd/bin/ASC16
1223    /mnt/mtd/bin/media_biz  /dev/rgn
1223    /mnt/mtd/bin/media_biz  /dev/isp_dev
1223    /mnt/mtd/bin/media_biz  /dev/isp_dev
1223    /mnt/mtd/bin/media_biz  /dev/isp_dev
1223    /mnt/mtd/bin/media_biz  /dev/ai
1223    /mnt/mtd/bin/media_biz  /dev/ai
1223    /mnt/mtd/bin/media_biz  /dev/aenc
1223    /mnt/mtd/bin/media_biz  /dev/mmz_userdev
1223    /mnt/mtd/bin/media_biz  /dev/adec
1223    /mnt/mtd/bin/media_biz  /dev/ao
1223    /mnt/mtd/bin/media_biz  /dev/isp_dev
1223    /mnt/mtd/bin/media_biz  /dev/vi
1223    /mnt/mtd/bin/media_biz  /dev/ive
1223    /mnt/mtd/bin/media_biz  /dev/mmz_userdev
1223    /mnt/mtd/bin/media_biz  socket:[1207]
1223    /mnt/mtd/bin/media_biz  socket:[1216]
1223    /mnt/mtd/bin/media_biz  socket:[1221]
1223    /mnt/mtd/bin/media_biz  socket:[1222]
1223    /mnt/mtd/bin/media_biz  socket:[1236]
1223    /mnt/mtd/bin/media_biz  socket:[1902]
1223    /mnt/mtd/bin/media_biz  socket:[1903]
1227    /mnt/mtd/bin/webs       /dev/null
1227    /mnt/mtd/bin/webs       /dev/console
1227    /mnt/mtd/bin/webs       /dev/console
1227    /mnt/mtd/bin/webs       /mnt/mtd/etc/.ipc_daemon_lockfile
1227    /mnt/mtd/bin/webs       /mnt/log/ipc_daemon.log
1227    /mnt/mtd/bin/webs       /dev/watchdog
1227    /mnt/mtd/bin/webs       /mnt/mtd/etc/ipc_daemon.conf
1227    /mnt/mtd/bin/webs       socket:[1135]
1231    /mnt/mtd/bin/upgrade_manager    /dev/null
1231    /mnt/mtd/bin/upgrade_manager    /dev/console
1231    /mnt/mtd/bin/upgrade_manager    /dev/console
1231    /mnt/mtd/bin/upgrade_manager    /mnt/mtd/etc/.ipc_daemon_lockfile
1231    /mnt/mtd/bin/upgrade_manager    /mnt/log/ipc_daemon.log
1231    /mnt/mtd/bin/upgrade_manager    /dev/watchdog
1231    /mnt/mtd/bin/upgrade_manager    /mnt/mtd/etc/ipc_daemon.conf
1231    /mnt/mtd/bin/upgrade_manager    /mnt/log/upgrademanager.log
1231    /mnt/mtd/bin/upgrade_manager    socket:[1182]
1231    /mnt/mtd/bin/upgrade_manager    socket:[1183]
1231    /mnt/mtd/bin/upgrade_manager    socket:[1184]
1231    /mnt/mtd/bin/upgrade_manager    socket:[1185]
1246    /bin/busybox    /dev/null
1246    /bin/busybox    /dev/null
1246    /bin/busybox    /dev/null
1246    /bin/busybox    /mnt/mtd/etc/.ipc_daemon_lockfile
1246    /bin/busybox    /mnt/log/ipc_daemon.log
1246    /bin/busybox    /dev/watchdog
1246    /bin/busybox    /mnt/mtd/etc/ipc_daemon.conf
1246    /bin/busybox    /mnt/log/platform.log
1246    /bin/busybox    socket:[1096]
1246    /bin/busybox    pipe:[1162]
1246    /bin/busybox    pipe:[1162]

startup.log

System startup


U-Boot 2010.06 (Jun 15 2017 - 14:15:50)

Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
SPI Nor total size: 16MB
Cannot found a valid SPI Nand Device
MMC:
EMMC/MMC/SD controller initialization.
Card did not respond to voltage select!
No EMMC/MMC/SD device found !
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0
16384 KiB hi_fmc at 0:0 is now current device

## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   Linux-3.4.35
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2702096 Bytes = 2.6 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0
Linux version 3.4.35 (root@eric.work.linux) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v300) ) #3 Wed Mar 28 14:22:13 HKT 2018
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518ev200
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 9652
Kernel command line: mem=38M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=hi_sfc:512k(boot),2816k(kernel),7M(rootfs),4M(app),512k(master),1280k(log)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 38MB = 38MB total
Memory: 33056k/33056k available, 5856k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xc2800000 - 0xff000000   ( 968 MB)
    lowmem  : 0xc0000000 - 0xc2600000   (  38 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc04bf000   (4828 kB)
      .init : 0xc04bf000 - 0xc04e12a4   ( 137 kB)
      .data : 0xc04e2000 - 0xc0510300   ( 185 kB)
       .bss : 0xc0510324 - 0xc054f650   ( 253 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32
VIC @fe0d0000: id 0x00641190, vendor 0x41
sched_clock: 32 bits at 49MHz, resolution 20ns, wraps every 86767ms
Console: colour dummy device 80x30
Calibrating delay loop... 269.10 BogoMIPS (lpj=1345536)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x803a77d8 - 0x803a7830
dummy:
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 30) is a PL011 rev2
uart:2: ttyAMA2 at MMIO 0x200a0000 (irq = 25) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
hi-spi-master hi-spi-master.0: with 1 chip select slaves attached
hi-spi-master hi-spi-master.1: with 2 chip select slaves attached
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource timer0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NFS: Registering the id_resolver key type
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.18)
msgmni has been set to 64
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
Check Flash Memory Controller v100 ...  Found.
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
SPI Nor total size: 16MB
6 cmdlinepart partitions found on MTD device hi_sfc
6 cmdlinepart partitions found on MTD device hi_sfc
Creating 6 MTD partitions on "hi_sfc":
0x000000000000-0x000000080000 : "boot"
0x000000080000-0x000000340000 : "kernel"
0x000000340000-0x000000a40000 : "rootfs"
0x000000a40000-0x000000e40000 : "app"
0x000000e40000-0x000000ec0000 : "master"
0x000000ec0000-0x000001000000 : "log"
SPI Nand ID Table Version 2.2
Cannot found a valid SPI Nand Device
himii: probed
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mousedev: PS/2 mouse device common for all mice
i2c /dev entries driver
hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed!
hisi_i2c hisi_i2c.1: Hisilicon [i2c-1] probed!
hisi_i2c hisi_i2c.2: Hisilicon [i2c-2] probed!
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
usb 1-1: new high-speed USB device number 2 using hiusb-ehci
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
Registering the dns_resolver key type
VFS: Mounted root (cramfs filesystem) readonly on device 31:2.
Freeing init memory: 136K
mount: mounting none on /dev/pts failed: No such file or directory

            _ _ _ _ _ _ _ _ _ _ _ _
            \  _  _   _  _ _ ___
            / /__/ \ |_/
           / __   /  -  _ ___
          / /  / /  / /
  _ _ _ _/ /  /  \_/  \_ ______
___________\___\__________________

[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01mdev
mmc1: new high speed SDHC card at address e624
mmcblk0: mmc1:e624 SU04G 3.69 GiB
 mmcblk0:
[RCS]: /etc/init.d/S01udev
mkdir: can't create directory '/dev/pts': File exists
mount: mounting devpts on /dev/pts failed: Device or resource busy
udev[634]: starting version 164
Not recognise ACTION:change
Not recognise ACTION:change
Not recognise ACTION:change
[RCS]: /etc/init.d/S80network
[RCS]: /etc/init.d/S90hibernate
mount: mounting none on /proc failed: Device or resource busy
mmz_start: 0x82600000, mmz_size: 26M
Hisilicon Media Memory Zone Manager
Module himedia: init ok
hi3518e_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
load sys.ko for Hi3518EV200...OK!
load tde.ko ...OK!
load region.ko ....OK!
load vgs.ko for Hi3518EV200...OK!
ISP Mod init!
load viu.ko for Hi3518EV200...OK!
load vpss.ko ....OK!
load rc.ko ...OK!
load venc.ko ...OK!
load chnl.ko for Hi3518EV200...OK!
load h264e.ko ...OK!
load jpege.ko ...OK!
load ive.ko for Hi3518EV200...OK!
load sensor_i2c.ko ...OK!
==== Your input Sensor type is ar0130 ====
load pwm.ko ...OK!
load piris.ko ...OK!
load hi_rtc.ko ...OK!
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=30 sec (nowayout= 0, nodeamon= 0)
acodec inited!
load hi3518e_aio.ko ...OK!
load ai.ko ...OK!
load ao.ko ...OK!
load aenc.ko ...OK!
load adec.ko ...OK!
insert audio
mipi_init
init phy power successful!
load hi_mipi.ko ...OK!
g_gpio_conf is null,set default
sensor reset pin_group:6 pin_number:6
detect ret:0, sensor_type:12, expect_value:4096, value:4096
++++++++++++++++ar0130-960 sensor detect!!!!!!++++++++++++++++
==== Your input Sensor type is ar0130 ====
++++++++++++++++8188eu wifi detect!!!!!!++++++++++++++++
Auto login as root ...
Jan  1 00:00:14 login[1174]: root login on 'ttyS000'
Welcome to HiLinux.
None of nfsroot found in cmdline.
~ # killall: plat_main: no process killed
log init: logdir[/mnt/log] logname[platform] level[3]
log enable!
1970-01-01 00:00:14 [Level: 2] platform_main.c(2587)-main:device manager msg queue: 0

platform_hw_select_conf sensor_type:0
SYSV sem init: key:0x760d0406, name:/var/.network, init value:1
SYSV semid is 0x0
wifi nums:1!!!!!!!wirenet nums:0!!!!!!
killall: wpa_supplicant: no process killed
killall: udhcpd: no process killed
killall: udhcpc: no process killed
killall: hostapd: no process killed
conf->wifi_conf.wifi_conf=1
rmmod: can't unload '8188eu': unknown symbol in module, or unknown parameter
RTL871X: module init start
RTL871X: rtl8188eu v4.3.24_16705.20160509_r17784
RTL871X: build time: Jan  8 2018 11:59:14
bFWReady == _FALSE call reset 8051...
RTL871X: hal_com_config_channel_plan chplan:0x20
RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=88:83:5d:c8:ce:37
RTL871X: rtw_ndev_init(wlan1) if2 mac_addr=8a:83:5d:c8:ce:37
usbcore: registered new interface driver rtl8188eu
RTL871X: module init ret=0
killall: dev_manager: no process killed
log init: logdir[/mnt/log] logname[devmanager] level[4]
log enable!
1970-01-01 00:00:16 [Level: 2] sys_msg.c(136)-usr_create_msgQ:create 7 msq queen failed, maybe already exist, err:File exists

list device manager msg queue: 327687
==> rtl8188e_iol_efuse_patch
RTL871X: set bssid:00:00:00:00:00:00
ioctl[SIOCSIWAP]: Operation not permitted
Selected interface 'wlan0'
wifi_ifname=wlan0
wpa_cli_open_connection func: cfile=/var/run/wpa_supplicant/wlan0
wifi init ok!!!!
scan command return:OK

killall: media_biz: no process killed
log init: logdir[/mnt/log] logname[media] level[3]
log enable!
1970-01-01 00:00:19 [Level: 2] sys_msg.c(136)-usr_create_msgQ:create 9 msq queen failed, maybe already exist, err:File exists

media bussiness msg queue: 360457
1970-01-01 00:00:19 [Level: 3] Waiting for platform_init_flag:0

RTL871X: nolinked power save enter
disable network command return len:5, buf:FAIL

remove_network command return len:5, buf:FAIL

wifi dial: add_network, network id:0
set network command=SET_NETWORK 0 ssid "<WLAN_NAME>"
set network ssid command return len:3, buf:OK

set network command=SET_NETWORK 0 scan_ssid 1
set network scan_ssid command return len:3, buf:OK

set network command=SET_NETWORK 0 psk "<WLAN_PASSWORD>"
set network psk command return len:3, buf:OK

set network command=SELECT_NETWORK 0
select network command return len:3, buf:OK

set network command=ENABLE_NETWORK 0
==> rtl8188e_iol_efuse_patch
killall: webs: no process killed
RTL871X: nolinked power save leave
group=Administrator
enable network command return len:3, buf:OK

RTL871X: set ssid [<WLAN_NAME>] fw_state=0x00000008
RTL871X: start auth
RTL871X: auth success, start assoc
RTL871X: assoc success
RTL871X: recv eapol packet
RTL871X: send eapol packet
RTL871X: recv eapol packet
RTL871X: send eapol packet
RTL871X: set pairwise key camid:4, addr:54:67:51:c1:af:fd, kid:0, type:AES
RTL871X: set group key camid:5, addr:54:67:51:c1:af:fd, kid:1, type:TKIP
killall: upgrade_manager: no process killed
log init: logdir[/mnt/log] logname[upgrademanager] level[3]
log enable!
1970-01-01 00:00:23 [Level: 2] sys_msg.c(136)-usr_create_msgQ:create 6 msq queen failed, maybe already exist, err:File exists

1970-01-01 00:00:23 [Level: 3] device upgrade msg queue: 425990

killall  -9 udhcpc
killall: udhcpc: no process killed
udhcpc (v1.20.2) started
Setting IP address 0.0.0.0 on wlan0
Sending discover...
Sending select for 192.168.0.178...
Lease of 192.168.0.178 obtained, lease time 3600
Setting IP address 192.168.0.178 on wlan0
Deleting routers
route: SIOCDELRT: No such process
Adding router 192.168.0.1
Recreating /tmp/resolv.conf
 Adding DNS server 80.69.96.12
 Adding DNS server 81.210.129.4
conf->wifi_nums > 0 && conf->wifi_conf.wifi_conf == 1
ntpclient_start,:interval:300
ntpclient.c:ntpclient_start use ntp server:
return 0;ntp_main threadid:-1230904128
####################################### Start Primary loop ###############
ntp server:time.nist.gov
setup_receive setup_receive
setup_transmit setup_transmit
Listening...
primary_loop select time:0 in
primary_loop select time:0 out
Sending ...
primary_loop select time:2 in
1970-01-01 00:00:27 [Level: 3] platform_main.c(1413)-platform_timer_check_thread:found adc vol[3.300000] is higher than night_vol_low!!!turn to high cds mode

1970-01-01 00:00:28 [Level: 3] platform_main.c(1442)-platform_timer_check_thread:now switch to high cds mode

night  auto  off  0
ntp client is running.
1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 3] start media bussiness ...

SYSV sem init: key:0x760d0406, name:/var/.network, init value:1
SYSV semid is 0x0
1970-01-01 00:00:29 [Level: 3] load libs OK!

SYSV sem init: key:0x760d049e, name:/var/.media, init value:1
SYSV semid is 0x8001
primary_loop select time:0 out
Sending ...
primary_loop select time:4 in
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,

g_mediapro created:0x14e7808
1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1

1970-01-01 00:00:29 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:29 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

linear mode
1970-01-01 00:00:29 [Level: 3] receive platform main init flag

1970-01-01 00:00:29 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!

1970-01-01 00:00:29 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!

1970-01-01 00:00:29 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!

1970-01-01 00:00:30 [Level: 4] dev_manager.c(2542)-main:receive platform main init flag

SYSV sem init: key:0x760d0406, name:/var/.network, init value:1
SYSV semid is 0x0
get default common setting:sync-mode:2, time_zone[120]:GMT, curr_time:0, date-type:0, langluge:0, xialingshi:0
Selected interface 'wlan0'
wifi_ifname=wlan0
wpa_cli_open_connection func: cfile=/var/run/wpa_supplicant/wlan0
wifi init ok!!!!
in onvif start
get default common setting:sync-mode:2, time_zone[120]:GMT, curr_time:0, date-type:0, langluge:0, xialingshi:0
get ntp=
onvif param init over !!!!
filebuf=/mnt/log/alarm_info0.txt
fopen init no alarm_info txt
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

Listen http 8090 is successful
add multi group 239.255.255.250:3702
1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:30 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:31 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!

1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,

1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1

1970-01-01 00:00:31 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:31 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!

1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,

1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1

1970-01-01 00:00:31 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:9,

1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:9, session_id:1

1970-01-01 00:00:31 [Level: 1] receive msg[3001] which upgrade_manager can not recognize!

1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:6,

1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:6, session_id:1

1970-01-01 00:00:31 [Level: 3] dev_manager.c(2112)-msgbus_handle_thread:receive msg[3001] which dev_manager can not recognize!

1970-01-01 00:00:31 [Level: 2] platform_main.c(360)-RespRequestMsg:send back response: s_app:7,

1970-01-01 00:00:31 [Level: 2] platform_main.c(361)-RespRequestMsg:send back response: s_app:7, session_id:1

Aptina AR0130 sensor 720P30fps init success!
ret:0, vichnnl attr:cap wh[1280:720] dest wh[1280:720]
use gamma1
search video encode chnnl group, VencGroup:0
[Func]:HI_MPI_ISP_QueryExposureInfo [Line]:726 [Info]:Get Active Stat Buffer Err
gain level = 0
1970-01-01 00:00:31 [Level: 2] mediaproc.cpp(3090)-VencStart:video encode thread running!!!!!!!

search video encode chnnl group, VencGroup:1
get default common setting:sync-mode:2, time_zone[120]:GMT, curr_time:0, date-type:0, langluge:0, xialingshi:0
osd_create_region 520:DisplayContent[1970-01-01 00:00:31]
[Func]:HI_MPI_ISP_QueryExposureInfo [Line]:726 [Info]:Get Active Stat Buffer Err
[Func]:HI_MPI_ISP_QueryExposureInfo [Line]:726 [Info]:Get Active Stat Buffer Err
[Func]:HI_MPI_ISP_QueryExposureInfo [Line]:726 [Info]:Get Active Stat Buffer Err
1970-01-01 00:00:31 [Level: 3] media lib init OK!

flag=2
flag=4
1970-01-01 00:00:31 [Level: 3] stream conf OK!

1970-01-01 00:00:31 [Level: 3] rtp SendThres:13107,39321

1970-01-01 00:00:31 [Level: 3] media init OK!

audio enable = 1
HCWS_Acodec_CfgAudio: ACODEC_GET_ADCL_VOL:0x1e
HCWS_Acodec_CfgAudio: ACODEC_SET_ADCL_VOL:0x8
AiDevId=0,s32AiChnCnt=2
enSamplerate=8000,enBitwidth=1,,enWorkmode=0,enSoundmode=0,u32EXFlag=1,u32FrmNum=10,u32PtNumPerFrm=160,u32ChnCnt=2,u32ClkSel=0
[Func]:HI_MPI_ISP_QueryExposureInfo [Line]:726 [Info]:Get Active Stat Buffer Err
1970-01-01 00:00:31 [Level: 3] audio init OK!

init_md_config()
1970-01-01 00:00:32 [Level: 3] hd control, videv[0] picwidth[640] picheight[352]

1970-01-01 00:00:32 [Level: 3] hd control, ucEnable:1 iMdState:0 ucEnable:0!

init_md_config() OK.
1970-01-01 00:00:32 [Level: 3] md init OK!

init_zone_mask_config() enable = 0, channel = 0
enable = 0, (0, 0), (0, 0)
enable = 0, (0, 0), (0, 0)
enable = 0, (0, 0), (0, 0)
enable = 0, (0, 0), (0, 0)
init_zone_mask_config() init zone mask OK.
1970-01-01 00:00:32 [Level: 3] zone mask init OK!

init_isp_conf()
init_isp_conf() OK.
1970-01-01 00:00:32 [Level: 3] isp init OK!

Selected interface 'wlan0'
wifi_ifname=wlan0
wpa_cli_open_connection func: cfile=/var/run/wpa_supplicant/wlan0
wifi init ok!!!!
1970-01-01 00:00:32 [Level: 3] wifi init OK!

1970-01-01 00:00:32 [Level: 3] alarm log init OK!

1970-01-01 00:00:32 [Level: 3] speaker init OK!

hcws p2p init, local config active flag:1
devinfo_conf.basic_info.szSerialNumber=A024119,p2plicense:EUA-024119-ZTNWL,VWFMEA
1970-01-01 00:00:32 [Level: 3] ******************compile time[Jun  9 2018:11:02:15]ver[1.3.18]**************

p2p test: prepare to init hcws p2p client sdk, devid:A024119, local_ip:192.168.0.178
1970-01-01 00:00:32 [Level: 3] P2P_Client_SDK_Init: first client init

1970-01-01 00:00:32 [Level: 3] got dev license info:license[EUA-024119-ZTNWL,VWFMEA] serial[A024119] obj_org_id[0]lbsnum[2]

1970-01-01 00:00:32 [Level: 3] lbs[0]:domainName[ec2-52-59-26-183.eu-central-1.compute.amazonaws.com]ip[52.59.26.183]

1970-01-01 00:00:32 [Level: 3] lbs[1]:domainName[52.8.79.200]ip[52.8.79.200]

1970-01-01 00:00:32 [Level: 3] P2P_Client_SDK_Init:init client[192.168.0.178], log file[/mnt/log/param]

1970-01-01 00:00:32 [Level: 3] *****************sdk compile time[Jun  9 2018:11:00:16]**************

[OSThread::Start] OrgPrio:0, NewPrio:0
1970-01-01 00:00:32 [Level: 2] create_read_socket_thread() OK.

P2P_Client_SDK_Init: DID[EUA-024119-ZTNWL] API_LICENSE[VWFMEA]
PPCS_API Version: 2.0.0.1
1970-01-01 00:00:32 [Level: 3] process_read_socket() thread starts running.

CreateDeviceDiscoveryThread start.
CreateDeviceDiscoveryThread finished.
get alarmpush config:account[najjannaj@hi-kam.net],1,0
res_nums=2
res[i].stream_id.channel = 0, res[i].stream_id.trackid = 3
res[i].stream_id.channel = 1, res[i].stream_id.trackid = 4
[OSThread::Start] OrgPrio:0, NewPrio:0
[OSThread::Start] OrgPrio:0, NewPrio:0
[OSThread::Start] OrgPrio:0, NewPrio:0
1970-01-01 00:00:32 [Level: 3] Init stream, trackid[3]chnl[0]audio_en[1]audio_track[25]VideoBitsRate[786432]spslen[31]ppslen[4]

1970-01-01 00:00:32 [Level: 3] Init cache, trackid[3]chnl[0]audio_en[1]audio_track[25]this[0x153a580]m_nSize[2]srcType[1]

1970-01-01 00:00:32 [Level: 3] vbrate:786432,m_SendThres:31457

[OSThread::Start] OrgPrio:0, NewPrio:0
1970-01-01 00:00:32 [Level: 3] create_stream_process_task_thread() OK.

1970-01-01 00:00:32 [Level: 3] SetupStreamRes[0]devid[A024119]chnl[0]trackid[3]vframeRate[20]vBitRate[786432]aEn[1]aTrack[25]aSampleFreq[50]aBitRate[128000]aSampleBit[8000]spslen[31]ppslen[4]

1970-01-01 00:00:32 [Level: 3] Init stream, trackid[4]chnl[1]audio_en[1]audio_track[25]VideoBitsRate[262144]spslen[32]ppslen[4]

1970-01-01 00:00:32 [Level: 3] Init cache, trackid[4]chnl[1]audio_en[1]audio_track[25]this[0x15599c0]m_nSize[2]srcType[1]

1970-01-01 00:00:32 [Level: 3] vbrate:262144,m_SendThres:13107

[OSThread::Start] OrgPrio:0, NewPrio:0
1970-01-01 00:00:32 [Level: 3] create_stream_process_task_thread() OK.

1970-01-01 00:00:32 [Level: 3] process_stream_data_task() thread starts running.

1970-01-01 00:00:32 [Level: 3] process_stream_data_task() thread starts running.

1970-01-01 00:00:32 [Level: 3] SetupStreamRes[1]devid[A024119]chnl[1]trackid[4]vframeRate[15]vBitRate[262144]aEn[1]aTrack[25]aSampleFreq[50]aBitRate[128000]aSampleBit[8000]spslen[32]ppslen[4]

1970-01-01 00:00:32 [Level: 3] p2p init OK!

hcws_local_record_init()
1970-01-01 00:00:32 [Level: 3] record frame buffer init OK!
1970-01-01 00:00:32 [Level: 3] record lib init, offFlag:1 configType:3!
zmd_init_storage_device()
1970-01-01 00:00:32 [Level: 3] new sd_card OK!
sd_card::umount_device() umount OK.
no sub partitions.
1970-01-01 00:00:32 [Level: 3] sd_card::format_device() the device has already been formatted.

zmd_util::mkdir() mkdir [/tmp/mmc] OK.
sd_card::mount_device() cmd = mount -t vfat /dev/mmcblk0 /tmp/mmc
1970-01-01 00:00:32 [Level: 3] PPCS_NetworkDetect() ret = 0

1970-01-01 00:00:32 [Level: 3] -------------- NetInfo: -------------------

sd_card::mount_device() mount OK.
1970-01-01 00:00:32 [Level: 3] Internet Reachable     : YES

1970-01-01 00:00:32 [Level: 3] P2P Server IP resolved : YES

1970-01-01 00:00:32 [Level: 3] P2P Server Hello Ack   : YES

1970-01-01 00:00:32 [Level: 3] Local NAT Type         :
1970-01-01 00:00:32 [Level: 3]  Port-Restricted Cone

1970-01-01 00:00:32 [Level: 3] My Wan IP : 46.5.201.81

1970-01-01 00:00:32 [Level: 3] My Lan IP : 192.168.0.178

1970-01-01 00:00:32 [Level: 3] GetFastLbs() send request OK, send bytes = 24.lbsip[52.59.26.183]port[8811]

1970-01-01 00:00:32 [Level: 3] GetFastLbs() send request OK, send bytes = 24.lbsip[52.8.79.200]port[8811]

1970-01-01 00:00:32 [Level: 3] get dev region:1

normal msg_type[136]len[4] peer[(null)]
1970-01-01 00:00:32 [Level: 3] get fast lbs info, ip[52.59.26.183]name[]

1970-01-01 00:00:32 [Level: 3] set dev fast lbs[52.59.26.183]

++++++++++now, get register server++++++++++++++
get register server ,local license's obj_org_id[0]
1970-01-01 00:00:32 [Level: 2] lbs info is same[2].

1970-01-01 00:00:32 [Level: 3] process_get_register_server_add_resp() get ap server addr OK, ip = 52.59.26.183, port = 8831

1970-01-01 00:00:32 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:1, ret:0

1970-01-01 00:00:32 [Level: 3] get register server ok

1970-01-01 00:00:32 [Level: 3] serial:A024119

1970-01-01 00:00:32 [Level: 3] login() send login request OK.

1970-01-01 00:00:32 [Level: 3] process_login_resp() register OK, hdt days:0, active time:0

1970-01-01 00:00:32 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:2, ret:0

1970-01-01 00:00:32 [Level: 3] QueryIpsAddr() send request OK.

1970-01-01 00:00:32 [Level: 3] process_get_ips_addr_resp() get ips server addr OK, ip = 34.246.136.117, port = 8851

1970-01-01 00:00:33 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:13, ret:0

1970-01-01 00:00:33 [Level: 3] QueryIpsAddr OK.

[OSThread::Start] OrgPrio:0, NewPrio:0
1970-01-01 00:00:33 [Level: 3] process_proto_timer() OK.

1970-01-01 00:00:33 [Level: 3] register and login success^^^^^^^^^^

1970-01-01 00:00:33 [Level: 3] process_proto_timer() thread starts running.

sd_card::try_init() partition size = 3957456896
sd_card::try_init() init storage device OK.
sd_card::init() init storage device OK.
1970-01-01 00:00:33 [Level: 3] sd_card init OK!
create_scan_thread() OK.
1970-01-01 00:00:33 [Level: 3] create scan thread OK!
zmd_init_storage_device() init store dev OK.
1970-01-01 00:00:33 [Level: 3] storage device init OK!
1970-01-01 00:00:33 [Level: 2] ../record/src/zmd_record_index.cpp(482)-sql_get_unfinish_file:index file[/tmp/mmc/index/filelist] is not exist!
[DEBUG]Init get record config:type[3]offFlag[1]alarmRecordTime[3]stime[00:00]etime[00:00]resolution[0]
1970-01-01 00:00:33 [Level: 3] local record init OK!
[DEBUG][../record/src/zmd_record_file_imp.cpp:117]record imp thread start.
1970-01-01 00:00:33 [Level: 3] ../clips/src/clips_index.cpp(363)-index_get_unfinish_file:index file /tmp/mmc/clips/filelist is not exist!
1970-01-01 00:00:33 [Level: 3] clips record init OK!
[DEBUG]init_hcws_record() init OK.

[DEBUG]record_lib_init() init record OK.

1970-01-01 00:00:33 [Level: 3] record lib init OK!
hcws_local_record_init() init local record lib success.
g_main_stream_frame_rate = 20
g_sub_stream_frame_rate = 15
1970-01-01 00:00:33 [Level: 3] init local record lib OK.

get default common setting:sync-mode:2, time_zone[120]:GMT, curr_time:0, date-type:0, langluge:0, xialingshi:0
1970-01-01 00:00:33 [Level: 3] start upload, bInit:1 bRun:0!

1970-01-01 00:00:33 [Level: 3] start upload, timeZone:2 region:1 masterAccount:!

1970-01-01 00:00:33 [Level: 3] start upload OK!

init_cloud_storage_conf() OK.
1970-01-01 00:00:33 [Level: 3] cloud storage init OK!

1970-01-01 00:00:33 [Level: 3] Enter doUploadTask !!!

1970-01-01 00:00:33 [Level: 3] msgbus init OK!

start check_timing_alarm_thread ...
1970-01-01 00:00:33 [Level: 3] timing alarm init OK!

CreateDetachedThread
1970-01-01 00:00:33 [Level: 3] ~~~~~~~~~~~~~~~~~~~~wait for exit signal~~~~~~~~~~~~~~~~~

receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
receive msg[3001] which media_biz can not recognize!
g_mediapro now:0x14e7808, mode:1
++++++++media turn to night mode++++++
in check_timing_alarm_thread !!!
in check_stream_thread !!!
primary_loop select time:0 out
Sending ...
######restart ntp...
ntp server:time.nist.gov
setup_receive setup_receive
setup_transmit setup_transmit
Listening...
primary_loop select time:0 in
primary_loop select time:0 out
Sending ...
primary_loop select time:2 in
rtsp_server_listen
primary_loop select time:0 out
Sending ...
primary_loop select time:4 in
primary_loop select time:0 out
Sending ...
######restart ntp...
ntp server:pool.ntp.org
setup_receive setup_receive
setup_transmit setup_transmit
Listening...
primary_loop select time:0 in
primary_loop select time:0 out
Sending ...
primary_loop select time:2 in
primary_loop select time:1 out
packet of length 48 received
Source: INET Port 123 host 178.63.9.110
LI=0  VN=3  Mode=4  Stratum=2  Poll=4  Precision=-29
Delay=8606.0  Dispersion=0.0  Refid=131.188.3.221
Reference 3738484851.685960
(sent)    2208988839.751140
Originate 2208988839.751140
Receive   3738490065.601641
Transmit  3738490065.601644
Our recv  2208988839.954316
Total elapsed: 203173.00
Server stall:       2.86
Slop:          203170.14
Skew:          1529501225748602.70
Frequency:             0
 day   second     elapsed    stall     skew  dispersion  freq
begin getTimeZoneInfo
IP: 45.32.138.210
getTimeZoneInfo,recv:: Success
get default common setting:sync-mode:2, time_zone[120]:GMT, curr_time:0, date-type:0, langluge:0, xialingshi:0
scan command return:OK

xontemplate 2208988839 1529501225748602.7 203173.0 0
25567 00039.954  203173.0      2.9  1529501225748602.7      0.0         0
rfc1305print return ok,count is :2
primary_loop select time:300 in
2018-06-20 15:27:46 [Level: 3] platform_main.c(2034)-platform_timer_wifi_thread:[wifi check]ssid:<WLAN_NAME> wifi level:57

2018-06-20 15:27:47 [Level: 3] register overtime, now to register again!

2018-06-20 15:27:47 [Level: 3] p2p client object receive heartbeat timeout exception callback!!!

2018-06-20 15:27:47 [Level: 3] query ips overtime, now to query again!

2018-06-20 15:27:47 [Level: 3] PPCS_NetworkDetect() ret = 0

2018-06-20 15:27:47 [Level: 3] -------------- NetInfo: -------------------

2018-06-20 15:27:47 [Level: 3] Internet Reachable     : YES

2018-06-20 15:27:47 [Level: 3] P2P Server IP resolved : YES

2018-06-20 15:27:47 [Level: 3] P2P Server Hello Ack   : YES

2018-06-20 15:27:47 [Level: 3] Local NAT Type         :
2018-06-20 15:27:47 [Level: 3]  Port-Restricted Cone

2018-06-20 15:27:47 [Level: 3] My Wan IP : 46.5.201.81

2018-06-20 15:27:47 [Level: 3] My Lan IP : 192.168.0.178

2018-06-20 15:27:47 [Level: 3] GetFastLbs() send request OK, send bytes = 24.lbsip[52.59.26.183]port[8811]

2018-06-20 15:27:47 [Level: 3] GetFastLbs() send request OK, send bytes = 24.lbsip[52.8.79.200]port[8811]

2018-06-20 15:27:47 [Level: 3] get dev region:1

normal msg_type[136]len[4] peer[(null)]
2018-06-20 15:27:47 [Level: 3] get fast lbs info, ip[52.59.26.183]name[]

2018-06-20 15:27:47 [Level: 3] set dev fast lbs[52.59.26.183]

++++++++++now, get register server++++++++++++++
get register server ,local license's obj_org_id[0]
2018-06-20 15:27:47 [Level: 2] lbs info is same[2].

2018-06-20 15:27:47 [Level: 3] process_get_register_server_add_resp() get ap server addr OK, ip = 52.59.26.183, port = 8831

2018-06-20 15:27:47 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:1, ret:0

2018-06-20 15:27:47 [Level: 3] get register server ok

2018-06-20 15:27:47 [Level: 3] serial:A024119

2018-06-20 15:27:47 [Level: 3] login() send login request OK.

2018-06-20 15:27:47 [Level: 3] process_login_resp() register OK, hdt days:0, active time:0

2018-06-20 15:27:47 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:2, ret:0

2018-06-20 15:27:47 [Level: 3] QueryIpsAddr() send request OK.

2018-06-20 15:27:47 [Level: 3] process_get_ips_addr_resp() get ips server addr OK, ip = 34.246.136.117, port = 8851

2018-06-20 15:27:47 [Level: 3] get ctrler post, ret_code:1, ret_value:0, m_state:13, ret:0

2018-06-20 15:27:47 [Level: 3] QueryIpsAddr OK.

2018-06-20 15:27:47 [Level: 2] process_proto_timer() create thread already create!!

2018-06-20 15:27:47 [Level: 3] register and login success^^^^^^^^^^

A hacked firmware which basically just transforms this thing into a "dumb camera" with a webinterface with all functions and no shady outside connections would be nice.

I am currently trying to revive the bricked successor of the S6 - and so far I think that I wont avoid doing so using the UART-Interface...
Did you need any pin-soldering or how did you establish the connection?

I diassembled the whole camera down to its mainboard (also Hi8318E-Base) and I'm not sure about what is the interface (I think its the Rx/Tx-Labeled ones, right?)
My next step would be to connect a USB-to-Serial-Adapter but for this I think I will need some soldering (which is why i want to make sure I use the right pins before ;))

@angrybobcat yeah :) RX/TX is right! Let us know how it went!

https://drive.google.com/file/d/1I79YdF69BLVwvlMkDGr9mI_JjmZeQXVk/view?usp=sharing
https://drive.google.com/file/d/1I7iImjjHUfT3W_v6B1aFAB1rmheEvIRS/view?usp=sharing

I have this camera module based on hi3518 chip.
will this method work on this too ?

I know this is somewhat old (and apparently I already commented on it a few ago lol) but has anyone tried OpenIPC on the S6 yet? Curious, cause would really want to flash a new firmware on it since the hardware is still nice, but the firmware is apparently riddled with security flaws...

I know this is somewhat old (and apparently I already commented on it a few ago lol) but has anyone tried OpenIPC on the S6 yet? Curious, cause would really want to flash a new firmware on it since the hardware is still nice, but the firmware is apparently riddled with security flaws...

Sorry I've tried it yet, but would be interested as well :)

I know this is somewhat old (and apparently I already commented on it a few ago lol) but has anyone tried OpenIPC on the S6 yet? Curious, cause would really want to flash a new firmware on it since the hardware is still nice, but the firmware is apparently riddled with security flaws...

Sorry I've tried it yet, but would be interested as well :)

The cam is based on a HI3518CV200, tho OpenIPC is supporting only the CV100 and another HI3516CV200 so far. Not sure how much different or how hard it'd be to port it to this one. Their community is sadly not toooo active, at least Telegram. Need to see if they have more active channels or forums somewhere.

Nevermind, I read the chip wrong, it is supported! Currently working on getting OpenIPC working :)

Just to update on this, I've destroyed the camera accidentally and not sure why... think a cap is shorted or I somehow cracked another component due to heat. It's entirely dead now.

Aw, that's unfortunate. I'm in a similar place with a Lorex cam with the same chipset. Somehow I've lost root / login access, so I'm trying to figure out how to add credentials into the squashfs. Your thread was very parallel to what I'm doing. Maybe I'll jump onto the OpenIPC strategy too.