-
-
Save matiaspl/1649da91f7132d526a47c42e865cd879 to your computer and use it in GitHub Desktop.
U-Boot 2010.06 (Aug 11 2018 - 18:47:37) | |
Check Flash Memory Controller v100 ... Found | |
SPI Nor(cs 0) ID: 0xc2 0x20 0x17 | |
Block:64KB Chip:8MB Name:"MX25L6436F" | |
SPI Nor total size: 8MB | |
Cannot found a valid SPI Nand Device | |
In: serial | |
Out: serial | |
Err: serial | |
Hit any key to stop autoboot: 1 ··· 0 | |
dev 0 set background color! | |
jpeg decoding ... | |
ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ cmd = ˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇ | |
<<addr=0x7e0000, size=0xd12a, vobuf=0x8ac00000>> | |
spi_flash 8084d920 | |
[FILE = jpegd.c LINE = 147] logo flag = 0 | |
mmu_enable | |
<<imgwidth=1280, imgheight=720, linebytes=2560>> | |
decode success!!!! | |
decode jpeg! | |
OpenDev vo:0 intf_type:36 out_sync:8 | |
dev 0 opened! | |
graphic layer 0 opened! | |
upgrade flag = 0 | |
8192 KiB hi_fmc at 0:0 is now current device | |
## Booting kernel from Legacy Image at 82000000 ... | |
Image Name: Linux-3.10.0 | |
Image Type: ARM Linux Kernel Image (uncompressed) | |
Data Size: 4568424 Bytes = 4.4 MiB | |
Load Address: 80008000 | |
Entry Point: 80008000 | |
Loading Kernel Image ... OK | |
OK | |
Starting kernel ... | |
Uncompressing Linux... done, booting the kernel. | |
Booting Linux on physical CPU 0x0 | |
Linux version 3.10.0 (root@visual digital-virtual-machine) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v400) ) #3 Sat Aug 4 14:13:59 CST 2018 | |
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d | |
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache | |
Machine: bigfish | |
Memory policy: ECC disabled, Data cache writeback | |
CPU: All CPU(s) started in SVC mode. | |
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512 | |
Kernel command line: mem=128M console=ttyAMA0,115200 mtdparts=hi_sfc:384k(uboot),4608K(core),2560K(app),512k(para) | |
PID hash table entries: 512 (order: -1, 2048 bytes) | |
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) | |
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) | |
Memory: 128MB = 128MB total | |
Memory: 116328k/116328k available, 14744k reserved, 0K highmem | |
Virtual kernel memory layout: | |
vector : 0xffff0000 - 0xffff1000 ( 4 kB) | |
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB) | |
vmalloc : 0xc8800000 - 0xff000000 ( 872 MB) | |
lowmem : 0xc0000000 - 0xc8000000 ( 128 MB) | |
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB) | |
modules : 0xbf000000 - 0xbfe00000 ( 14 MB) | |
.text : 0xc0008000 - 0xc052ba9c (5263 kB) | |
.init : 0xc052c000 - 0xc0ce89f4 (7923 kB) | |
.data : 0xc0cea000 - 0xc0d1e320 ( 209 kB) | |
.bss : 0xc0d1e320 - 0xc0d3fee8 ( 135 kB) | |
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 | |
NR_IRQS:128 | |
GIC CPU mask not found - kernel will fail to boot. | |
GIC CPU mask not found - kernel will fail to boot. | |
sched_clock: 32 bits at 62MHz, resolution 16ns, wraps every 68719ms | |
Console: colour dummy device 80x30 | |
Calibrating delay loop... 2190.54 BogoMIPS (lpj=10952704) | |
pid_max: default: 32768 minimum: 301 | |
Mount-cache hash table entries: 512 | |
Initializing cgroup subsys freezer | |
CPU: Testing write buffer coherency: ok | |
Setting up static identity map for 0xc03d0f98 - 0xc03d0ff0 | |
NET: Registered protocol family 16 | |
DMA: preallocated 256 KiB pool for atomic coherent allocations | |
hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers. | |
hw-breakpoint: maximum watchpoint size is 8 bytes. | |
Serial: AMBA PL011 UART driver | |
uart:0: ttyAMA0 at MMIO 0x12080000 (irq = 38) is a PL011 rev2 | |
console [ttyAMA0] enabled | |
uart:1: ttyAMA1 at MMIO 0x12090000 (irq = 39) is a PL011 rev2 | |
uart:2: ttyAMA2 at MMIO 0x120a0000 (irq = 40) is a PL011 rev2 | |
bio: create slab <bio-0> at 0 | |
SCSI subsystem initialized | |
hi-spi-master hi-spi-master.0: with 2 chip select slaves attached | |
usbcore: registered new interface driver usbfs | |
usbcore: registered new interface driver hub | |
usbcore: registered new device driver usb | |
Switching to clocksource timer0 | |
NET: Registered protocol family 2 | |
TCP established hash table entries: 1024 (order: 1, 8192 bytes) | |
TCP bind hash table entries: 1024 (order: 0, 4096 bytes) | |
TCP: Hash tables configured (established 1024 bind 1024) | |
TCP: reno registered | |
UDP hash table entries: 256 (order: 0, 4096 bytes) | |
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) | |
NET: Registered protocol family 1 | |
RPC: Registered named UNIX socket transport module. | |
RPC: Registered udp transport module. | |
RPC: Registered tcp transport module. | |
RPC: Registered tcp NFSv4.1 backchannel transport module. | |
NetWinder Floating Point Emulator V0.97 (double precision) | |
CPU PMU: probing PMU on CPU 0 | |
hw perfevents: enabled with ARMv7 Cortex-A7 PMU driver, 5 counters available | |
VFS: Disk quotas dquot_6.5.2 | |
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) | |
squashfs: version 4.0 (2009/01/31) Phillip Lougher | |
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. | |
fuse init (API version 7.22) | |
SGI XFS with ACLs, security attributes, realtime, large block/inode numbers, no debug enabled | |
msgmni has been set to 227 | |
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) | |
io scheduler noop registered | |
io scheduler deadline registered (default) | |
io scheduler cfq registered | |
brd: module loaded | |
loop: module loaded | |
hiahci: initializing | |
ahci ahci.0: can't get clock | |
ahci: SSS flag set, parallel bus scan disabled | |
ahci ahci.0: AHCI 0001.0300 32 slots 2 ports 6 Gbps 0x3 impl platform mode | |
ahci ahci.0: flags: ncq sntf stag pm led clo only pmp fbs slum part ccc sxs boh | |
scsi0 : ahci_platform | |
scsi1 : ahci_platform | |
ata1: SATA max UDMA/133 mmio [mem 0x11010000-0x1101ffff] port 0x100 irq 49 | |
ata2: SATA max UDMA/133 mmio [mem 0x11010000-0x1101ffff] port 0x180 irq 49 | |
Check Flash Memory Controller v100 ... Found. | |
SPI Nor(cs 0) ID: 0xc2 0x20 0x17 | |
Block:64KB Chip:8MB Name:"MX25L6436F" | |
SPI Nor total size: 8MB | |
4 cmdlinepart partitions found on MTD device hi_sfc | |
4 cmdlinepart partitions found on MTD device hi_sfc | |
Creating 4 MTD partitions on "hi_sfc": | |
0x000000000000-0x000000060000 : "uboot" | |
0x000000060000-0x0000004e0000 : "core" | |
0x0000004e0000-0x000000760000 : "app" | |
0x000000760000-0x0000007e0000 : "para" | |
SPI Nand ID Table Version 2.2 | |
Cannot found a valid SPI Nand Device | |
Higmac dma_sg_phy: 0x86f00000 | |
libphy: higmac_mdio_bus: probed | |
PHY mdio0:01 not found | |
ETH0: rmii, phy_addr=1, mii_name=mdio0 | |
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver | |
before uhci_hcd and ohci_hcd, not after | |
hiusb-ehci hiusb-ehci.0: HIUSB EHCI | |
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1 | |
hiusb-ehci hiusb-ehci.0: irq 51, io mem 0x10040000 | |
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00 | |
hub 1-0:1.0: USB hub found | |
hub 1-0:1.0: 2 ports detected | |
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver | |
hiusb-ohci hiusb-ohci.0: HIUSB OHCI | |
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2 | |
hiusb-ohci hiusb-ohci.0: irq 50, io mem 0x10030000 | |
hub 2-0:1.0: USB hub found | |
hub 2-0:1.0: 2 ports detected | |
usbcore: registered new interface driver usb-storage | |
mousedev: PS/2 mouse device common for all mice | |
ata1: SATA link down (SStatus 0 SControl 300) | |
i2c /dev entries driver | |
hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed! | |
usbcore: registered new interface driver usbhid | |
usbhid: USB HID core driver | |
oprofile: using timer interrupt. | |
TCP: cubic registered | |
NET: Registered protocol family 17 | |
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5 | |
ˇata2: SATA link down (SStatus 0 SControl 300) | |
Freeing unused kernel memory: 7920K (c052c000 - c0ce8000) | |
[RCS]: /etc/init.d/S00devs | |
[RCS]: /etc/init.d/S01udev | |
udevd (644): /proc/644/oom_adj is deprecated, please use /proc/644/oom_score_adj instead. | |
[RCS]: /etc/init.d/S80network | |
[RCS]: /etc/init.d/S90init | |
modules/ | |
modules/hi3521a_chnl.ko | |
modules/hi3521a_ai.ko | |
modules/hi_rtc.ko | |
modules/hiuser.ko | |
modules/hi3521a_jpege.ko | |
modules/hi3521a_venc.ko | |
modules/hi3521a_region.ko | |
modules/pinmux_hi3521a_vga_hdmi_spi.sh | |
modules/hi3521a_aenc.ko | |
modules/hi_media.ko | |
modules/hi3521a_adec.ko | |
modules/hi3521a_vfmw.ko | |
modules/hi3521a_ao.ko | |
modules/pinmux_hi3521a_vicap.sh | |
modules/load3521a | |
modules/extdrv/ | |
modules/extdrv/sii1i2c.ko | |
modules/extdrv/i2c_phys.ko | |
modules/extdrv/gpio.ko | |
modules/extdrv/hi_ir.ko | |
modules/extdrv/sii0i2c.ko | |
modules/extdrv/sii3i2c.ko | |
modules/extdrv/sii2i2c.ko | |
modules/extdrv/hdmii2c.ko | |
modules/hi3521a_vdec.ko | |
modules/sysctl_hi3521a_asic.sh | |
modules/hi3521a_vou.ko | |
modules/hi3521a_ive.ko | |
modules/hi3521a_rc.ko | |
modules/crgctrl_hi3521a.sh | |
modules/hi3521a_hdmi.ko | |
modules/hi3521a_vpss.ko | |
modules/hi3521a_aio.ko | |
modules/hi3521a_jpegd.ko | |
modules/hi3521a_viu.ko | |
modules/hi3521a_h264e.ko | |
modules/hi3521a_vgs.ko | |
modules/hifb.ko | |
modules/hi3521a_tde.ko | |
modules/hi3521a_vda.ko | |
modules/pinmux_hi3521a_i2s.sh | |
modules/hi3521a_base.ko | |
modules/hi3521a_sys.ko | |
modules/mmz.ko | |
Hisilicon Media Memory Zone Manager | |
Module himedia: init ok | |
hi3521a_base: module license 'Proprietary' taints kernel. | |
Disabling lock debugging due to kernel taint | |
load sys.ko for Hi3521A...OK! | |
load vdec.ko ....OK | |
load vhd firmware.ko OK | |
Load hi_jpegdec.ko success.·(SDK_VERSION:[SDK_VERSION] Build Time:[Jan 13 2017, 18:19:19]) | |
Load hi_tde.ko success.··(SDK_VERSION:[SDK_VERSION] Build Time:[Jan 13 2017, 18:19:06]) | |
load region.ko ....OK! | |
load vgs.ko for Hi3521A...OK! | |
load viu.ko ...OK! | |
load vpss.ko ....OK! | |
load vou.ko ....OK! | |
load hdmi.ko ....OK! | |
load rc.ko for Hi3521A...OK! | |
load venc.ko for Hi3521A...OK! | |
load chnl.ko for Hi3521A...OK! | |
load h264e.ko for Hi3521A...OK! | |
load jpege.ko for Hi3521A...OK! | |
load vda.ko ....OK! | |
load ive.ko ... OK! | |
KERN_INFO OSDRV_MODULE_VERSION_STRING | |
HISI_IRDA-MF @Hi3518v100R001 | |
hiir: init ok. ver=Aug 3 2018, 23:11:54. | |
KERN_INFO OSDRV_MODULE_VERSION_STRING | |
KERN_INFO OSDRV_MODULE_VERSION_STRING | |
KERN_INFO OSDRV_MODULE_VERSION_STRING | |
KERN_INFO OSDRV_MODULE_VERSION_STRING | |
load ai.ko for Hi3521A...OK! | |
load ao.ko for Hi3521A...OK! | |
load aenc.ko for Hi3521A...OK! | |
load adec.ko for Hi3521A...OK! | |
www/ | |
www/Reboot.html | |
www/Reset.html | |
www/SystemUpdate.html | |
www/images/ | |
www/images/b.png | |
www/images/bg-login-top.png | |
www/images/exclamation.png | |
www/images/bg-button-green.gif | |
www/images/cross.png | |
www/images/bg-body.gif | |
www/images/jquery_wysiwyg.gif | |
www/images/bg-sidebar.gif | |
www/images/tick_circle.png | |
www/images/bg-form-field.gif | |
www/images/br.png | |
www/images/bl.png | |
www/images/Thumbs.db | |
www/images/bullet_black.png | |
www/images/bg-login.gif | |
www/images/cross_circle.png | |
www/images/bg-radial-gradient.gif | |
www/images/tl.png | |
www/images/shortcut-button-bg.gif | |
www/images/hammer_screwdriver.png | |
www/images/bg-menu-item-green.gif | |
www/images/bg-menu-item-current.gif | |
www/images/loading.gif | |
www/images/bg-content-box.gif | |
www/images/information.png | |
www/images/tr.png | |
www/images/cross_grey_small.png | |
www/images/logo.png | |
www/images/menu-current-arrow.gif | |
www/css/ | |
www/css/jquery.percentageloader-0.1.css | |
www/css/reset.css | |
www/css/style.css | |
www/css/invalid.css | |
www/connect.html | |
www/SetPassword.html | |
www/SetNet.html | |
www/index.html | |
www/setBaudRate.html | |
www/js/ | |
www/js/jquery.percentageloader-0.1.js | |
www/js/simpla.jquery.configuration.js | |
www/js/jquery-1.4.1.min.js | |
www/js/ajaxfileupload.js | |
www/js/jquery-1.3.2.min.js | |
www/js/getagain.js | |
www/js/jquery.wysiwyg.js | |
www/OutputP1Main.html | |
lib/ | |
lib/libcommonlib.so | |
lib/libAPI.so | |
lib/libLRCF.so | |
bin/ | |
bin/webserver | |
bin/SII9293A1 | |
bin/FWUpgrade | |
bin/IFrameVieoNet.h264 | |
bin/SII9293A2 | |
bin/lighttpd | |
bin/SII9293A0 | |
bin/DevMsg | |
bin/MediaServer | |
bin/ddnsclient | |
bin/DisPlay | |
bin/IFrameVieoLoss.h264 | |
bin/WatchDog | |
bin/SII9293A3 | |
*** Board tools : ver0.0.1_20130123 *** | |
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm | |
0x120f0184: 0x00000001 --> 0x00000000 | |
[END] | |
*** Board tools : ver0.0.1_20130123 *** | |
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm | |
0x120f0188: 0x00000001 --> 0x00000000 | |
[END] | |
*** Board tools : ver0.0.1_20130123 *** | |
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm | |
0x120f00e0: 0x00000001 --> 0x00000000 | |
[END] | |
*** Board tools : ver0.0.1_20130123 *** | |
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm | |
0x120f00e4: 0x00000001 --> 0x00000000 | |
[END] | |
*** Board tools : ver0.0.1_20130123 *** | |
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm | |
0x120f017c: 0x00000001 --> 0x00000001 | |
[END] | |
*** Board tools : ver0.0.1_20130123 *** | |
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm | |
0x120f0180: 0x00000001 --> 0x00000001 | |
[END] | |
*** Board tools : ver0.0.1_20130123 *** | |
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm | |
0x120f00ac: 0x00000002 --> 0x00000001 | |
[END] | |
Please press Enter to activate this console. 1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:56]get msg qeue msgid:0 | |
1970-01-01 00:00:03.000 [WATCH_DOG main.cpp:50]wang wang wang ! | |
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdogConfig.cpp:91]read name is TX | |
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdogConfig.cpp:100]Product is Tx | |
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:77]get process:SII9293A0 | |
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:77]get process:SII9293A1 | |
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:77]get process:SII9293A2 | |
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:77]get process:SII9293A3 | |
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:77]get process:DisPlay | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:369]kill sub process:SII9293A0 fail | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:371]killed sub process:SII9293A0, pid:54188 | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:270][ startSubProcess name:/var/bin/SII9293A0, param:(null) ] | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:279]Create child:1008 | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:369]kill sub process:SII9293A1 fail | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:371]killed sub process:SII9293A1, pid:54188 | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:270][ startSubProcess name:/var/bin/SII9293A1, param:(null) ] | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:279]Create child:1009 | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:369]kill sub process:SII9293A2 fail | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:371]killed sub process:SII9293A2, pid:54188 | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:270][ startSubProcess name:/var/bin/SII9293A2, param:(null) ] | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:279]Create child:1010 | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:369]kill sub process:SII9293A3 fail | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:371]killed sub process:SII9293A3, pid:54188 | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:270][ startSubProcess name:/var/bin/SII9293A3, param:(null) ] | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:279]Create child:1011 | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:369]kill sub process:DisPlay fail | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:371]killed sub process:DisPlay, pid:54188 | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:270][ startSubProcess name:/var/bin/DisPlay, param:(null) ] | |
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:279]Create child:1012 | |
sii9293drv driver starting! | |
Version: CP5293-v1.00.00 | |
Build: 16:34:53-Aug 21 2018 | |
register_chrdev 9293 addr = 1 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:201]Get Video Index = 0 | |
write head info error or more of User count = 0datasize = 1024 dataoffset = 4096 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:76]Starting sii-9293 | |
sii9293drv driver starting! | |
Version: CP5293-v1.00.00 | |
Build: 16:35:04-Aug 21 2018 | |
register_chrdev 9293 addr = 2 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:201]Get Video Index = 0 | |
write head info error or more of User count = 0datasize = 1024 dataoffset = 4096 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:76]Starting sii-9293 | |
sii9293drv driver starting! | |
Version: CP5293-v1.00.00 | |
Build: 16:35:15-Aug 21 2018 | |
register_chrdev 9293 addr = 3 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:201]Get Video Index = 0 | |
write head info error or more of User count = 0datasize = 1024 dataoffset = 4096 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:76]Starting sii-9293 | |
sii9293drv driver starting! | |
Version: CP5293-v1.00.00 | |
Build: 16:34:42-Aug 21 2018 | |
register_chrdev 9293 addr = 0 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:201]Get Video Index = 0 | |
write head info error or more of User count = 0datasize = 1024 dataoffset = 4096 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:76]Starting sii-9293 | |
1970-01-01 00:00:05.000 [DISPLAY main.cpp:52]feed dog now!!! | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:123]Device ID: 9293 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:124]Device Revision: 01 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_evita.c:77]#################read 4A = 0x0 60 = 0xff | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:123]Device ID: 9293 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:124]Device Revision: 01 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_evita.c:77]#################read 4A = 0x0 60 = 0xff | |
=======================================id= 10 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:123]Device ID: 9293 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:124]Device Revision: 01 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_evita.c:77]#################read 4A = 0x0 60 = 0xff | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:123]Device ID: 9293 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:124]Device Revision: 01 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_evita.c:77]#################read 4A = 0x0 60 = 0xff | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_rx.c:248]SII9293 OUT sysn mode = 0xf0 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_rx.c:248]SII9293 OUT sysn mode = 0xf0 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_rx.c:248]SII9293 OUT sysn mode = 0xf0 | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_rx.c:248]SII9293 OUT sysn mode = 0xf0 | |
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:287]RX Audio: Fs code = 01 | |
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:287]RX Audio: Fs code = 01 | |
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:287]RX Audio: Fs code = 01 | |
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:287]RX Audio: Fs code = 01 | |
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:351]update audio info restart now | |
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:351]update audio info restart now | |
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:351]update audio info restart now | |
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:351]update audio info restart now | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:354]state is not chage ID: 1 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:354]state is not chage ID: 2 | |
1970-01-01 00:00:05.000 [LRCF · LRcfServerT.hpp:209]setTask NOW !!! MaxTask = 5 StackSize = 51200 | |
1970-01-01 00:00:05.000 [LRCF · LRcfServerT.hpp:228]Start LRCF NOW !!! Link = /tmp/.LRCFCodec | |
1970-01-01 00:00:05.000 [LRCF · LRcfServer.cpp:36]setTask NOW !!! MaxTask = 5 StackSize = 51200 | |
1970-01-01 00:00:05.000 [LRCF · LRcfServer.cpp:54]Start LRCF NOW !!! Link = /tmp/.LRCFCodec | |
1970-01-01 00:00:05.000 [LRCF · Sock.cpp:123]Start SetServer NOW !!! Link = /tmp/.LRCFCodec | |
1970-01-01 00:00:05.000 [LRCF · Sock.cpp:217]SERVER link = /tmp/.LRCFCodec CLicet link = sock = 6 | |
1970-01-01 00:00:05.000 [LRCF · Sock.cpp:217]SERVER link = /tmp/.LRCFCodec CLicet link = sock = 6 | |
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:24]ThreadPool Num:5, stack:51200 | |
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:254]PIC LEN = 14429 | |
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:266]PIC LEN = 10204 | |
1970-01-01 00:00:05.000 [DISPLAY Dconfig.cpp:61]load config from /mnt/mtd/app/config/DisPlayConfig.ini | |
datasize = 1024 dataoffset = 4096 | |
datasize = 1024 dataoffset = 4096 | |
datasize = 1024 dataoffset = 4096 | |
datasize = 1024 dataoffset = 4096 | |
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:421]can not get input0 res Use Default | |
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:421]can not get input0 res Use Default | |
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:421]can not get input0 res Use Default | |
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:421]can not get input0 res Use Default | |
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:544]init 0x1f663b0 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:354]state is not chage ID: 0 | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:354]state is not chage ID: 3 | |
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:65]Start worker thread tid:-1238885280 | |
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:65]Start worker thread tid:-1238832032 | |
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:65]Start worker thread tid:-1238778784 | |
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:65]Start worker thread tid:-1238725536 | |
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:65]Start worker thread tid:-1238672288 | |
1970-01-01 00:00:05.000 [DISPLAY hAudio.cpp:271]Ai(0,0) bind to AencChn:0 ok! | |
1970-01-01 00:00:05.000 [DISPLAY hAudio.cpp:271]Ai(0,1) bind to AencChn:1 ok! | |
1970-01-01 00:00:05.000 [CODEC hAVi.cpp:205]create VI success!!! | |
1970-01-01 00:00:05.000 [CODEC hAVi.cpp:205]create VI success!!! | |
1970-01-01 00:00:05.000 [CODEC hAVi.cpp:205]create VI success!!! | |
1970-01-01 00:00:05.000 [CODEC hAVi.cpp:205]create VI success!!! | |
1970-01-01 00:00:05.000 [DISPLAY hSys.cpp:41]SysBind[16-0-0]:[7-3-2] | |
1970-01-01 00:00:05.000 [DISPLAY hSys.cpp:41]SysBind[16-1-4]:[7-2-2] | |
1970-01-01 00:00:05.000 [DISPLAY hSys.cpp:41]SysBind[16-2-8]:[7-1-2] | |
1970-01-01 00:00:05.000 [DISPLAY hSys.cpp:41]SysBind[16-3-12]:[7-0-2] | |
1970-01-01 00:00:05.000 [DISPLAY hWnd.cpp:158]DisableHdmi err ret = 0xa0288004 | |
1970-01-01 00:00:05.000 [DISPLAY hWnd.cpp:691]enIntfSync = 12 | |
1970-01-01 00:00:05.000 [DISPLAY hWnd.cpp:72]InitDev >>><<< w:1920 h:1080 frmt = 60 | |
1970-01-01 00:00:05.000 [DISPLAY hWnd.cpp:123]EnableHdmi ...... | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:403]state is no source connected | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:316]Cable connection change: cable out | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:403]state is no source connected | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:316]Cable connection change: cable out | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:403]state is no source connected | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:316]Cable connection change: cable out | |
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:403]state is no source connected | |
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:316]Cable connection change: cable out | |
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:339]display RGB flag = 0 | |
1970-01-01 00:00:06.000 [DISPLAY hAudio.cpp:648]bind is ok ao ch = 0 adchn = 0 AoDev = 1 | |
1970-01-01 00:00:06.000 [DISPLAY CDisPlay.cpp:606]clear uboot buf | |
1970-01-01 00:00:06.000 [DISPLAY hAudio.cpp:119]enSample rate = 48000 | |
1970-01-01 00:00:06.000 [DISPLAY hAudio.cpp:393]clk = 2 | |
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:691]enIntfSync = 12 | |
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1026]vo display x = 0 y = 0 w = 1920 h = 1080 mode = 5 i = 0 | |
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1227]^_^ @ ^_^ [x-0, y-0, w-1440, h-1080] [dev:0 ch:0] | |
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:1295]SetChnFrameRate Dev:0 Chn:0 frmt:30 err ret = 0xa00f804a | |
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1026]vo display x = 0 y = 0 w = 1920 h = 1080 mode = 5 i = 1 | |
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1227]^_^ @ ^_^ [x-1440, y-0, w-480, h-360] [dev:0 ch:1] | |
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:1295]SetChnFrameRate Dev:0 Chn:1 frmt:30 err ret = 0xa00f804a | |
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1026]vo display x = 0 y = 0 w = 1920 h = 1080 mode = 5 i = 2 | |
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1227]^_^ @ ^_^ [x-1440, y-360, w-480, h-360] [dev:0 ch:2] | |
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:1295]SetChnFrameRate Dev:0 Chn:2 frmt:30 err ret = 0xa00f804a | |
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1026]vo display x = 0 y = 0 w = 1920 h = 1080 mode = 5 i = 3 | |
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1227]^_^ @ ^_^ [x-1440, y-720, w-480, h-360] [dev:0 ch:3] | |
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:1295]SetChnFrameRate Dev:0 Chn:3 frmt:30 err ret = 0xa00f804a | |
1970-01-01 00:00:06.000 [DISPLAY hSys.cpp:41]SysBind[7-1-3]:[15-0-0] | |
1970-01-01 00:00:06.000 [DISPLAY hSys.cpp:41]SysBind[7-2-3]:[15-0-1] | |
1970-01-01 00:00:06.000 [DISPLAY hSys.cpp:41]SysBind[7-3-3]:[15-0-2] | |
1970-01-01 00:00:06.000 [DISPLAY hSys.cpp:41]SysBind[7-0-3]:[15-0-3] | |
1970-01-01 00:00:06.000 [DISPLAY CDisPlay.cpp:1233]SET VOIDE MODE IS 14 | |
1970-01-01 00:00:06.000 [DISPLAY hAudio.cpp:119]enSample rate = 44100 | |
1970-01-01 00:00:06.000 [DISPLAY hAudio.cpp:393]clk = 1 | |
1970-01-01 00:00:07.000 [DISPLAY hWnd.cpp:339]display RGB flag = 0 | |
1970-01-01 00:00:07.000 [DISPLAY CDisPlay.cpp:1270]open /dev/ttyAMA1 is ok fd = 58 | |
(none) login: |
Today let's inspect the init scripts.
/etc/init.d/S00devs:
#!/bin/sh
#mknod -m 660 /dev/console c 5 1
#mknod -m 660 /dev/null c 1 3
mknod /dev/ttyAMA0 c 204 64
mknod /dev/ttyAMA1 c 204 65
mknod /dev/ttyS000 c 204 64
#mknod /dev/ttyAMA2 c 204 66
#mknod /dev/ttyAMA3 c 204 67
mknod -m 666 /dev/mtdblock0 b 31 0
mknod -m 666 /dev/mtdblock1 b 31 1
mknod -m 666 /dev/mtdblock2 b 31 2
#mknod -m 666 /dev/mtdblock3 b 31 3
#mknod -m 666 /dev/mtdblock4 b 31 4
mknod -m 666 /dev/mtd0 c 90 0
mknod -m 666 /dev/mtd1 c 90 2
mknod -m 666 /dev/mtd2 c 90 4
#mknod -m 666 /dev/mtd3 c 90 6
#mknod -m 666 /dev/mtd4 c 90 8
#mount -t squashfs /dev/mtdblock2 /mnt/mtd/app
mount -t jffs2 /dev/mtdblock2 /mnt/mtd/
#mount -t jffs2 /dev/mtdblock3 /mnt/mtd/config
So, there are perfectly writable filesystems around here... B-)
/etc/init.d/S01udev
#!/bin/sh
mkdir -m 660 /dev/pts
mount -t devpts devpts /dev/pts
udevd --daemon
udevstart
Nothing interesting, moving along,
/etc/init.d/S80network
#!/bin/sh
ipaddr=
bootp=
gateway=
netmask=
hostname=
netdev=
autoconf=
for ipinfo in `cat /proc/cmdline`
do
case "$ipinfo" in
ip=*)
for var in ipaddr bootp gateway netmask hostname netdev autoconf
do
eval read $var
done << EOF
`echo "$ipinfo" | sed "s/:/\n/g" | sed "s/^[ ]*$/-/g"`
EOF
ipaddr=`echo "$ipaddr" | cut -d = -f 2`
[ x$ipaddr == x ] && ipaddr=x
;;
esac
done
[ -z "$ipaddr" ] && exit 0
echo " IP: $ipaddr"
echo " BOOTP: $bootp"
echo " GATEWAY: $gateway"
echo " NETMASK: $netmask"
echo "HOSTNAME: $hostname"
echo " NETDEV: $netdev"
echo "AUTOCONF: $autoconf"
if [ x$ipaddr == x- ] ; then
# use DHCP
:
else
cmd="ifconfig $netdev $ipaddr"
[ x$netmask != x- ] && cmd="$cmd netmask $netmask"
eval $cmd
[ x$gateway != x- ] && route add default gw $gateway
fi
ifconfig lo 127.0.0.1
Somebody forgot the 'up' word in the last line. Not that this makes any difference on a device that has zero network connectivity. I guess this is one of many leftovers from a DVR device repurposed as a multiviewer (which to me is a ingenious idea, hats off to the Chinese engineer who did this). Last but not least in this directory
/etc/init.d/S90init
#!/bin/sh
if [ -e /mnt/mtd/boot.sh ]; then
sh /mnt/mtd/boot.sh
fi
Bingo. boot.sh script looks like a perfect payload for my more or less permanent root access hack that doesn't cripple the devices' functionality (single user mode doesn't do anything creative unless all /proc, /sys, etc filesystems are mounted and init scripts were run).
/mnt/mtd/boot.sh
#!/bin/sh
mkdir -m 777 /var
mkdir -m 777 /tmp/upload
mount -t jffs2 /dev/mtdblock3 /mnt/mtd/app/config
tar xJvf /mnt/mtd/app/modules.xz -C /tmp/
cd /tmp/modules && ./load3521a -i
rm -rf /tmp/modules/
tar zxf /mnt/mtd/app/lighttpd-1.4.30-hi.tgz -C /usr/local/
chmod 777 /tmp/*
tar xJvf /mnt/mtd/app/www.xz -C /tmp/
mkdir /var/nfs
tar xJvf /mnt/mtd/app/soft.xz -C /var/
ln -s /var/bin/* /bin
ln -s /var/lib/libAPI.so /lib/libAPI.so
ln -s /var/lib/libLRCF.so /lib/libLRCF.so
ln -s /var/lib/libcommonlib.so /lib/libcommonlib.so
telnetd &
cd /mnt/mtd/
./vi.sh
echo "1048576" >> /proc/sys/net/core/wmem_max
echo "1048576" >> /proc/sys/net/core/rmem_max
echo "1048576" >> /proc/sys/net/core/wmem_default
echo "1048576" >> /proc/sys/net/core/rmem_default
WatchDog &
vi.sh
#!/bin/sh
#i2c0
#i2c1
#i2c2
himm 0x120f0184 0
himm 0x120f0188 0
#i2c3
himm 0x120f00e0 0
himm 0x120f00e4 0
#hdmi out
himm 0x120f017c 1
himm 0x120f0180 1
#audio
himm 0x120f00ac 1
#uart1
load3251a
#!/bin/sh
# Useage: ./load3521a [ -r|-i|-a ] [ ad ]
# -r : rmmod all modules
# -i : insmod all modules
# default : rmmod all moules and then insmod them
#
####################Variables Definition##########################
AD_TYPE=6124 # ad type
mem_total=512; # 512M, total mem
mem_start=0x80000000; # phy mem start
os_mem_size=128; # 64M, os mem
mmz_start=0x88000000; # mmz start addr
mmz_size=350M; # 128M, mmz size
##################################################################
report_error()
{
echo "******* Error: There's something wrong, please check! *****"
exit 1
}
insert_audio()
{
insmod hi3521a_aio.ko
insmod hi3521a_ai.ko
insmod hi3521a_ao.ko
insmod hi3521a_aenc.ko
insmod hi3521a_adec.ko
# insmod extdrv/tlv_320aic31.ko
}
remove_audio()
{
# rmmod tlv_320aic31.ko
rmmod hi3521a_adec
rmmod hi3521a_aenc
rmmod hi3521a_ao
rmmod hi3521a_ai
rmmod hi3521a_aio
}
insert_ad()
{
case $AD_TYPE in
6124)
insmod extdrv/nvp6124.ko
;;
2823)
insmod extdrv/tp2823.ko
;;
6574)
insmod extdrv/rn6574.ko
;;
*)
echo "xxxx Invalid ad type $AD_TYPE xxxx"
report_error
;;
esac
}
remove_ad()
{
case $AD_TYPE in
6124)
rmmod nvp6124
;;
2823)
rmmod tp2823
;;
6574)
rmmod rn6574
;;
*)
echo "xxxx Invalid ad type $AD_TYPE xxxx"
report_error
;;
esac
}
insert_ko()
{
# low power control
# source ./lowpower.sh > /dev/null
# pinmux configuration
source ./pinmux_hi3521a_vicap.sh > /dev/null
source ./pinmux_hi3521a_vga_hdmi_spi.sh > /dev/null
source ./pinmux_hi3521a_i2s.sh > /dev/null
# crg configuration
source ./crgctrl_hi3521a.sh > /dev/null
# system configuration
source ./sysctl_hi3521a_asic.sh > /dev/null
# driver load
insmod mmz.ko mmz=anonymous,0,$mmz_start,$mmz_size anony=1 || report_error
insmod hiuser.ko
insmod hi_media.ko
insmod hi3521a_base.ko
insmod hi3521a_sys.ko
insmod hi3521a_vdec.ko
insmod hi3521a_vfmw.ko
insmod hi3521a_jpegd.ko
insmod hi3521a_tde.ko
insmod hi3521a_region.ko
insmod hi3521a_vgs.ko
insmod hi3521a_viu.ko detect_err_frame=10
insmod hi3521a_vpss.ko
insmod hi3521a_vou.ko
insmod hifb.ko video="hifb:vram0_size:8100,vram1_size:1620,vram2_size:128"
insmod hi3521a_hdmi.ko
insmod hi3521a_rc.ko
insmod hi3521a_venc.ko
insmod hi3521a_chnl.ko
insmod hi3521a_h264e.ko
insmod hi3521a_jpege.ko
insmod hi3521a_vda.ko
insmod hi3521a_ive.ko
insmod extdrv/gpio.ko
insmod extdrv/hdmii2c.ko
insmod extdrv/hi_ir.ko
insmod extdrv/i2c_phys.ko
insmod extdrv/sii0i2c.ko
insmod extdrv/sii1i2c.ko
insmod extdrv/sii2i2c.ko
insmod extdrv/sii3i2c.ko
# echo "==== Your input AD type is $AD_TYPE ===="
insert_audio
}
remove_ko()
{
remove_audio
rmmod gpio
rmmod hdmii2c
rmmod hi_ir
rmmod i2c_phys
rmmod sii0i2c
rmmod sii1i2c
rmmod sii2i2c
rmmod sii3i2c
rmmod hi3521a_ive
rmmod hi3521a_vda
rmmod hi3521a_rc
rmmod hi3521a_jpege
rmmod hi3521a_h264e
rmmod hi3521a_chnl
rmmod hi3521a_venc
rmmod hi3521a_hdmi
rmmod hifb
rmmod hi3521a_vou
rmmod hi3521a_vpss
rmmod hi3521a_viu
rmmod hi3521a_vgs
rmmod hi3521a_region
rmmod hi3521a_tde
rmmod hi3521a_jpegd
rmmod hi3521a_vfmw
rmmod hi3521a_vdec
rmmod hi3521a_sys
rmmod hi3521a_base
rmmod hi_media
rmmod hiuser
rmmod mmz
}
load_usage()
{
echo "Usage: ./load3521a [-option] [ad_name]"
echo "options:"
echo " -i insert modules"
echo " -r remove modules"
echo " -a remove modules first, then insert modules"
echo " -ad ad_name config AD type [default: nvp6124]"
echo " -osmem os_mem_size config os mem size [unit: M, default: 64]"
echo " -h help information"
echo -e "Available ad: nvp6124, tp2823"
echo -e "notes: osmem option can't be used when mmz zone partition is enable\n\n"
echo -e "for example: ./load3521a -a -ad 6124 -osmem 64\n"
}
calc_mmz_info()
{
mmz_start=`echo "$mem_start $os_mem_size" |
awk 'BEGIN { temp = 0; }
{
temp = $1/1024/1024 + $2;
}
END { printf("0x%x00000\n", temp); }'`
mmz_size=`echo "$mem_total $os_mem_size" |
awk 'BEGIN { temp = 0; }
{
temp = $1 - $2;
}
END { printf("%dM\n", temp); }'`
echo "mmz_start: $mmz_start, mmz_size: $mmz_size"
}
######################parse arg###################################
b_arg_os_mem=0
b_arg_ad=0
b_arg_insmod=0
b_arg_remove=0
for arg in $@
do
if [ $b_arg_os_mem -eq 1 ] ; then
b_arg_os_mem=0;
os_mem_size=$arg;
if [ -z $os_mem_size ]; then
echo "[error] os_mem_size is null"
exit;
fi
if [ $os_mem_size -ge $mem_total ] ; then
echo "[err] os_mem[$os_mem_size], over total_mem[$mem_total]"
exit;
fi
calc_mmz_info;
fi
if [ $b_arg_ad -eq 1 ] ; then
b_arg_ad=0
AD_TYPE=$arg;
fi
case $arg in
"-i")
b_arg_insmod=1;
;;
"-r")
b_arg_remove=1;
;;
"-a")
b_arg_insmod=1;
b_arg_remove=1;
;;
"-h")
load_usage;
;;
"-ad")
b_arg_ad=1;
;;
"-osmem")
b_arg_os_mem=1;
;;
esac
done
#######################parse arg end########################
#######################Action###############################
if [ $b_arg_remove -eq 1 ]; then
remove_ko;
fi
if [ $b_arg_insmod -eq 1 ]; then
insert_ko;
fi
Final touch. I forgot to document the most important thing - to get root access I overwrite /etc/passwd with /etc/passwd- in boot.sh script. Add a line cp -r /etc/passwd- /etc/passwd
there. Since boot.sh lays on a writable filesystem as a result I get to overwrite the initrd ram filesystem at every boot. Then I get to log in as root with root:rosevide credentials. Finis coronat opus ;)
Post scriptum:
For the time being I lost interest in further hacking but feel free to take over and post what you managed to do with this beauty/beast.
Hello!! :-D
Thanks a lot for your guide, i have seen your guide but i don't know how can i put my payload.
My device is HI
some info from ny busybox in single user mode:
/etc/init.d # busybox
BusyBox v1.26.2 (2019-07-15 17:52:17 CST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.
Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...
BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.
Currently defined functions:
[, [[, arp, arping, ash, awk, base64, basename, blkdiscard, blkid,
blockdev, brctl, cal, cat, catv, chat, chgrp, chmod, chown, chroot,
cksum, clear, comm, cp, crond, crontab, cttyhack, cut, date, dc, dd,
deallocvt, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd,
dnsdomainname, dos2unix, du, dumpleases, echo, env, ether-wake, expand,
expr, fakeidentd, false, fatattr, fdflush, fdisk, find, fold, free,
fsync, fuser, getopt, getty, grep, groups, gzip, halt, hdparm, head,
hexdump, hostid, hostname, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifup, inetd, init, insmod, ionice, iostat, ip, ipaddr,
ipcalc, iplink, ipneigh, iproute, iprule, iptunnel, kill, killall,
last, less, linux32, linuxrc, ln, login, logname, losetup, ls, lsmod,
lsof, lsusb, makedevs, md5sum, mdev, mkdir, mkfifo, mknod, mkswap,
mktemp, more, mount, mountpoint, mpstat, mt, mv, nameif, nbd-client,
nc, netstat, nice, nmeter, nohup, nslookup, ntpd, od, pidof, ping,
pkill, poweroff, printenv, printf, ps, pscan, pstree, pwd, pwdx,
readlink, realpath, reboot, renice, reset, resize, rm, rmdir, rmmod,
route, runlevel, runsv, sed, seq, sh, sha1sum, sha256sum, sha3sum,
sha512sum, shuf, slattach, sleep, smemcap, sort, split, stat, strings,
stty, sum, swapoff, swapon, sysctl, tac, tail, tar, tcpsvd, tee,
telnet, telnetd, test, tftp, time, timeout, top, touch, tr, traceroute,
true, truncate, tty, ttysize, tunctl, udhcpc, udhcpd, udpsvd, uevent,
umount, uname, unexpand, uniq, unlink, uptime, users, usleep, uudecode,
uuencode, vconfig, watch, wc, wget, which, who, whoami, whois, xargs,
yes, zcip
Filesystem Size Used Available Use% Mounted on
/dev/root.old 1.0M 1.0M 0 100% /
tmpfs 54.3M 0 54.3M 0% /dev
tmpfs 54.3M 0 54.3M 0% /tmp
tmpfs 54.3M 0 54.3M 0% /media
tmpfs 54.3M 0 54.3M 0% /var/run
tmpfs 54.3M 0 54.3M 0% /var/lock
How can i decrypt this pass?
/etc # more passwd
root:x:0:0:root:/root:/bin/sh
stb:x:1000:1000:Linux User,,,:/home/stb:/bin/sh
/etc # more passwd-
root:$1$$64lU4r1qa6icjzK/sBmQo.:0:0::/root:/bin/sh
Or do you know how can i flash an old FW (the old FW have a backdoor) via tftp or some else?
Thanks a lot for all your help
Stefano
I think i have found an entrypoint can you help me only to decrypt the user passord?
/etc # more passwd-
root:$1$$64lU4r1qa6icjzK/sBmQo.:0:0::/root:/bin/sh
Hi @wes1993, I somehow missed your message.
The ❌'es in your /etc/passwd file suggests that there's also an /etc/shadow present, so you might check if there's a known hash there.
The hash in your passwd- file (md5crypt type hash) has been seen online: https://forums.hak5.org/topic/38353-embedded-device-password-cracking/ so it's likely the camera uses a more or less known password.
Even if it's not, feel free to use my hash and known password and try to fin a way to alter the contents of the passwd (hopfully you will find a script ran on startup on a writable - or remountable as rw - filesystem as I did. And changing the password is as easy as rewriting the contents of /etc/passwd or/etc/shadow. You can use echo for that purpose.
Thanks a lot for your reply matiaspl,
finally i have find a way to mount my passwd so i have root access :-D
I doesen't have find a way to stream the video for now but i have telnet access :-D
Best Regards
Stefano
I have been able to break in using the "bomb out to U-Boot" technique with the following procedure:
Upon boot during the first second or two (just when "Hit any key to stop autoboot:" prompt appears) connect pin 2 (SO) of the flash chip to GND. Following a bad kernel image read (detected properly by U-Boot) you will be dropped back to a passwordless (yay!) U-Boot console:
The 'printenv' command gives the following:
So far so good. Let's run a single user environment just for fun (too bad the root folder is in the initrd image - no writing possible):
Now let's save the environment variables and reset the CPU
And we're booting...
Root console it is. Let's check what busybox can do for us in the future
To be continued ;)