Device Name ip-camera
Device Model IPC
Hardware Version 1.3.0.
Software Version 1.8.43.57801022
Release Time 2017/03/22 09:34:05
The analysed camera is part of the following Zosi Tech NVR set: https://www.zositech.com/product/zosi-4ch-hd-960p-wifi-outdoor-wireless-ip-camera-system-cctv-nvr-security-video/
NVR Kit K9508-W: http://help.dvr163.com/index.php/K9508-W_100%E4%B8%87%E6%97%A0%E7%BA%BF%E5%A5%97%E8%A3%85
IPC PE3010-W: http://help.dvr163.com/index.php/PE3010-W
The firmware upgrade file can be downloaded here: https://support.zositech.com/hc/en-us/articles/115004610488-IPC-Upgrade-file-N18EV2W-1-8-43-578010-version
I found the hashed root password in /etc/passwd by connecting with FTDI and changing the uboot boot line.
root:ABgia2Z.lfFhA:0:0::/root:/bin/sh
A simple google search lead me to https://gist.github.com/maxious/c8915a436b532ab09e61bf937295a5d2 where @maxious (thanks!) cracked the password:
j1/_7sxw
Because telnetd gets started while booting, we can now simply connect via telnet (23/TCP) as root.
# mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /dev type tmpfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /media type tmpfs (rw,relatime)
tmpfs on /usr/local type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/loop0 on /media/custom type squashfs (ro,relatime)
/dev/mtdblock3 on /media/conf type jffs2 (rw,relatime)
# uname -a
Linux (none) 3.4.35 #2 Tue Aug 23 18:55:44 SGT 2016 armv5tejl GNU/Linux
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/root 3.9M 3.9M 0 100% /
tmpfs 17.3M 4.0K 17.3M 0% /dev
tmpfs 17.3M 1.6M 15.7M 9% /tmp
tmpfs 17.3M 0 17.3M 0% /media
tmpfs 17.3M 4.0K 17.3M 0% /usr/local
/dev/loop0 1.4M 1.4M 0 100% /media/custom
/dev/mtdblock3 384.0K 244.0K 140.0K 64% /media/conf
# ps -wlT
S UID PID PPID VSZ RSS TTY STIME TIME CMD
S 0 1 0 1452 328 0:0 15:46 00:00:01 {linuxrc} init
S 0 2 0 0 0 0:0 15:46 00:00:00 [kthreadd]
S 0 3 2 0 0 0:0 15:46 00:00:05 [ksoftirqd/0]
S 0 4 2 0 0 0:0 15:46 00:00:08 [kworker/0:0]
S 0 5 2 0 0 0:0 15:46 00:00:00 [kworker/u:0]
S 0 6 2 0 0 0:0 15:46 00:00:00 [khelper]
S 0 7 2 0 0 0:0 15:46 00:00:00 [kworker/u:1]
S 0 219 2 0 0 0:0 15:46 00:00:02 [sync_supers]
S 0 221 2 0 0 0:0 15:46 00:00:00 [bdi-default]
S 0 222 2 0 0 0:0 15:46 00:00:00 [kintegrityd]
S 0 224 2 0 0 0:0 15:46 00:00:00 [kblockd]
S 0 233 2 0 0 0:0 15:46 00:00:00 [spi0]
S 0 236 2 0 0 0:0 15:46 00:00:00 [spi1]
S 0 244 2 0 0 0:0 15:46 00:00:00 [khubd]
D 0 246 2 0 0 0:0 15:46 00:00:02 [kusbotg]
S 0 256 2 0 0 0:0 15:46 00:00:00 [cfg80211]
S 0 257 2 0 0 0:0 15:46 00:00:00 [kworker/0:1]
S 0 340 2 0 0 0:0 15:46 00:00:00 [rpciod]
S 0 346 2 0 0 0:0 15:46 00:00:00 [kswapd0]
S 0 401 2 0 0 0:0 15:46 00:00:00 [fsnotify_mark]
S 0 407 2 0 0 0:0 15:46 00:00:00 [nfsiod]
S 0 419 2 0 0 0:0 15:46 00:00:00 [crypto]
S 0 454 2 0 0 0:0 15:46 00:00:00 [romblock0]
S 0 457 2 0 0 0:0 15:46 00:00:00 [mtdblock0]
S 0 462 2 0 0 0:0 15:46 00:00:00 [romblock1]
S 0 465 2 0 0 0:0 15:46 00:00:00 [mtdblock1]
S 0 470 2 0 0 0:0 15:46 00:00:00 [romblock2]
S 0 473 2 0 0 0:0 15:46 00:00:00 [mtdblock2]
S 0 478 2 0 0 0:0 15:46 00:00:00 [romblock3]
S 0 481 2 0 0 0:0 15:46 00:00:00 [mtdblock3]
S 0 486 2 0 0 0:0 15:46 00:00:00 [romblock4]
S 0 489 2 0 0 0:0 15:46 00:00:00 [mtdblock4]
S 0 494 2 0 0 0:0 15:46 00:00:00 [romblock5]
S 0 497 2 0 0 0:0 15:46 00:00:00 [mtdblock5]
S 0 502 2 0 0 0:0 15:46 00:00:00 [romblock6]
S 0 505 2 0 0 0:0 15:46 00:00:00 [mtdblock6]
S 0 580 2 0 0 0:0 15:46 00:00:00 [dwc_otg]
S 0 595 2 0 0 0:0 15:46 00:00:00 [cfinteractive]
S 0 608 2 0 0 0:0 15:46 00:00:00 [deferwq]
S 0 613 1 1452 388 0:0 15:46 00:00:00 {rcS} /bin/sh /etc/init.d/rcS
S 0 629 1 1072 356 0:0 15:46 00:00:00 udevd --daemon
S 0 684 629 1072 384 0:0 15:46 00:00:00 udevd --daemon
S 0 700 629 1072 368 0:0 15:46 00:00:00 udevd --daemon
S 0 872 1 1456 304 0:0 15:46 00:00:04 telnetd
S 0 1035 2 0 0 0:0 15:46 00:00:00 [hidog]
S 0 1084 613 1456 396 0:0 15:46 00:00:00 {exe} ash /usr/share/ipcam/shell/startup.sh
S 0 1102 2 0 0 0:0 15:46 00:00:00 [loop0]
S 0 1104 2 0 0 0:0 15:46 00:00:00 [jffs2_gcd_mtd3]
S 0 1113 1084 52820 5548 0:0 15:46 00:00:10 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1115 1084 52820 5548 0:0 15:46 00:00:14 {JPROCESS_STATE} /usr/share/ipcam/app -w /media/custom/web -f /media/custom/fo
R 0 1117 1084 52820 5548 0:0 15:46 00:05:14 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1118 1084 52820 5548 0:0 15:46 00:05:10 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1135 1084 52820 5548 0:0 15:46 00:00:01 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1174 1084 52820 5548 0:0 15:46 00:00:01 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1186 1084 52820 5548 0:0 15:46 00:00:00 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1196 1084 52820 5548 0:0 15:46 00:00:49 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1204 1084 52820 5548 0:0 15:46 00:00:02 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1206 1084 52820 5548 0:0 15:46 00:00:01 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1207 1084 52820 5548 0:0 15:46 00:01:51 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1208 1084 52820 5548 0:0 15:46 00:01:02 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1209 1084 52820 5548 0:0 15:46 00:00:08 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1300 1084 52820 5548 0:0 15:46 00:00:02 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1538 1084 52820 5548 0:0 16:11 00:02:30 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1544 1084 52820 5548 0:0 16:14 00:02:21 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 4379 1084 52820 5548 0:0 17:12 00:00:03 /usr/share/ipcam/app -w /media/custom/web -f /media/custom/font -m /usr/share/
S 0 1114 1113 9336 312 0:0 15:46 00:00:03 {JPROCESS_LOOP} /usr/share/ipcam/app -w /media/custom/web -f /media/custom/fon
S 0 1159 2 0 0 0:0 15:46 00:00:10 [RTW_CMD_THREAD]
S 0 1310 1 1372 512 0:0 15:46 00:00:00 /usr/share/ipcam/wifi_tools/wpa_supplicant -Dwext -iwlan0 -C/tmp/wpa_supplican
S 0 1322 872 1460 464 pts0 15:47 00:00:00 -sh
S 0 4353 872 1468 488 pts1 17:06 00:00:00 -sh
S 0 4389 2 0 0 0:0 17:13 00:00:00 [flush-mtd-unmap]
R 0 4399 4353 1448 380 pts1 17:14 00:00:00 ps -wlT
# busybox
BusyBox v1.24.1 (2016-05-31 17:48:04 CST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.
Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...
BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.
Currently defined functions:
[, [[, adjtimex, arp, arping, ash, awk, basename, blockdev, brctl, cal, cat, catv, chgrp, chmod, chown, chpasswd, chroot, chrt, cksum, clear, comm, conspy, cp, crond, crontab, cryptpw, cttyhack, cut, date, dd,
depmod, devmem, df, dhcprelay, dirname, dmesg, dnsd, dnsdomainname, du, dumpleases, echo, egrep, eject, env, envdir, envuidgid, expand, expr, false, fdisk, find, fold, free, fsync, ftpget, ftpput, fuser, getty,
grep, groups, halt, head, hexdump, hostid, hostname, hwclock, id, ifconfig, init, inotifyd, insmod, ionice, ipcalc, kill, killall, linuxrc, ln, login, losetup, ls, lsmod, lsof, lspci, lsusb, makedevs, md5sum,
mdev, mkdir, mkfifo, mknod, mkpasswd, mktemp, modinfo, modprobe, more, mount, mv, nbd-client, netstat, nice, nohup, nslookup, ntpd, od, passwd, pidof, ping, ping6, pipe_progress, pkill, poweroff, printenv, ps,
pscan, pstree, pwd, reboot, renice, rm, rmdir, rmmod, route, run-parts, runsv, runsvdir, sed, seq, setsid, setuidgid, sh, slattach, sleep, softlimit, sort, start-stop-daemon, stat, strings, su, sulogin, sum,
switch_root, sync, sysctl, tac, tail, tar, telnet, telnetd, test, tftp, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty, ttysize, tunctl, udhcpc, udhcpd, udpsvd, uevent, umount, uname,
unexpand, uniq, unlink, uptime, usleep, vconfig, vlock, watch, watchdog, wget, which, whoami, whois, xargs, yes, zcip
# cat /proc/umap/h264e
[H264E] Version: [Hi3518EV200_MPP_V1.0.3.0 B040 Release], Build Time[May 20 2016, 12:01:09]
-----MODULE PARAM--------------------------------------------------------------
OnePack H264eVBSource H264eRcnEqualRef H264eMiniBufMode
0 1 1 1
-----CHN ATTR------------------------------------------------------------------
ID MaxWidth MaxHeight Width Height profile C2GEn BufSize ByFrame MaxStrCnt
0 1280 960 1280 960 hp N 921600 Y 200
1 640 360 640 360 hp N 172800 Y 200
-----PICTURE INFO--------------------------------------------------------------
ID EncdStart EncdSucceed Lost Disc Skip Pskip Recode RlsStr UnrdStr
0 2452 2449 19 0 19 0 3 2448 1
1 2433 2432 35 0 35 0 1 2431 1
-----STREAM BUFFER-------------------------------------------------------------
ID Base RdTail RdHead WrTail WrHead DataLen BufFree
0 0xc6700000 0xc81c0 0xca280 0xca280 0xca280 0 913152
1 0xc6380000 0x29f00 0x2a200 0x2a200 0x2a200 0 175296
-----RefParam INFO--------------------------------------------------------------
ID EnPred Base Enhance bVirtualIEnable VirtualIInterval VirtualIQpDelta GetVbFail
0 Y 1 0 N 30 0 0
1 Y 1 0 N 30 0 0
-----ROI INFO------------------------------------------------------------------
ID Index bAbsQp Qp Width Height StartX StartY BgSrcFr BgTarFr
-----Syntax INFO1---------------------------------------------------------------
ID SlcspltEn Slcmode Slcsize IntraRefresh enIslice RefreshLine QpOfIDR
0 N N/A N/A N N 15 50
1 N N/A N/A N N 5 50
-----Inter & Intra prediction INFO---------------------------------------------
ID profile HWsize VWsize P16x16 P16x8 P8x16 P8x8 MvExt I16x16 Inxn Ipcm
0 hp 7 3 Y Y Y Y Y Y Y Y
1 hp 5 2 Y Y Y Y Y Y Y Y
-----Syntax INFO2--------------------------------------------------------------
ID Profile EntrpyI EntrpyP Itrans Ptrans QMatrix POC DblkIdc Alpha Beta
0 hp cabac cabac all all N 2 0 0 0
1 hp cabac cabac all all N 2 0 0 0
# cat /proc/umap/sys
[SYS] Version: [Hi3518EV200_MPP_V1.0.3.0 B040 Release], Build Time[May 20 2016, 12:01:03]
System State: 0 (0: initialized; 1: exiting; 2: exited)
-----MODULE PARAM---------------------------------------------------------------
vi_vpss_online sensor
1 ar0130
-----SCALE COEFF INFO-----------------------------------------------------------
RangeLevel RangeValue HorLum HorChr VerLum VerChr
RANGE_0 (0, 1/4) LEVEL_0 LEVEL_0 LEVEL_0 LEVEL_0
RANGE_1 [1/4, 1/3) LEVEL_1 LEVEL_0 LEVEL_1 LEVEL_0
RANGE_2 [1/3, 1/2) LEVEL_2 LEVEL_1 LEVEL_2 LEVEL_1
RANGE_3 [1/2, 3/4) LEVEL_3 LEVEL_2 LEVEL_3 LEVEL_2
RANGE_4 [3/4, 1) LEVEL_3 LEVEL_2 LEVEL_4 LEVEL_2
RANGE_5 [1, 1] LEVEL_4 LEVEL_3 LEVEL_5 LEVEL_3
RANGE_6 (1, MAX) LEVEL_5 LEVEL_2 LEVEL_6 LEVEL_2
-----MEM TABLE--------------------------------------------------------
MOD MODNAME DEV CHN MMZNAME
-----BIND RELATION TABLE--------------------------------------------------------
FirMod FirDev FirChn SecMod SecDev SecChn TirMod TirDev TirChn SendCnt rstCnt
vpss 0 1 venc 0 14 null 0 0 0 0
vpss 0 1 venc 0 0 null 0 0 0 0
vpss 0 2 venc 0 15 null 0 0 0 0
vpss 0 2 venc 0 1 null 0 0 0 0
viu 0 0 vpss 0 1 venc 0 14 0 0
viu 0 0 vpss 0 1 venc 0 0 0 0
viu 0 0 vpss 0 2 venc 0 15 0 0
viu 0 0 vpss 0 2 venc 0 1 0 0
The application itself is located at /usr/share/ipcam
# pwd
/usr/share/ipcam
# ls -alh
drwxr-xr-x 8 root root 140 Mar 22 2017 .
drwxrwxrwx 4 root root 42 Mar 22 2017 ..
-rwxr-xr-x 1 root root 7.2M Mar 22 2017 app
-rwxr-xr-x 1 root root 1.1K May 27 2016 flashmap.ini
drwxr-xr-x 2 root root 31 May 5 2016 ja_tools
drwxr-xr-x 4 root root 771 Mar 22 2017 mpp
drwxr-xr-x 4 root root 61 Mar 22 2017 resource
drwxr-xr-x 2 root root 31 May 5 2016 sdcard_tools
drwxr-xr-x 2 root root 70 Mar 6 2017 shell
drwxr-xr-x 2 root root 153 Sep 12 2016 wifi_tools
# md5sum /usr/share/ipcam/app
51e4c0c6b7d1607cef92878b766cfcde /usr/share/ipcam/app
flashmap.ini content:
# cat flashmap.ini
[FIRMWARE]
magic=JUAN HI3518 IPCAM FIRMWARE
prefix=IPCHI18Ev2_WIFI
name=IPCAMERA
model=N18EV2W
flash_size=8MB
flash=7
[FLASH0]
name=/dev/mtdblock0
size=192K
block=1
[FLASH0_BLOCK0]
name=uboot
file=./image/uboot_hi3518e_v200.bin
offset=0
rom=no
bin=yes
[FLASH1]
name=/dev/mtdblock1
size=64K
block=1
[FLASH1_BLOCK0]
name=ubootenv
file=./image/uboot_env.bin
offset=0
rom=yes
bin=yes
[FLASH2]
name=/dev/mtdblock2
size=64K
block=1
[FLASH2_BLOCK0]
name=user
file=./image/user
offset=0
rom=no
bin=yes
[FLASH3]
name=/dev/mtdblock3
size=384K
block=1
[FLASH3_BLOCK0]
name=config
file=./image/custom.jffs2
offset=0
rom=no
bin=yes
[FLASH4]
name=/dev/mtdblock4
size=1920K
block=1
[FLASH4_BLOCK0]
name=kernel
file=./image/uImage_18e_v200
offset=0
rom=yes
bin=yes
[FLASH5]
name=/dev/mtdblock5
size=4032K
block=1
[FLASH5_BLOCK0]
name=rootfs
file=./image/rootfs.squash.uboot
offset=0
rom=yes
bin=yes
[FLASH6]
name=/dev/mtdblock6
size=1536K
block=1
[FLASH6_BLOCK0]
name=resource
file=./image/rootfs.squash.resource
offset=0
rom=yes
bin=yes
startup.sh Script (from shell folder)
# cat startup.sh
#!/bin/sh
#modprobe hiether
#sleep 3
#############################################################################################
# Linux Configuration
#############################################################################################
ETC_LINK_DIR=/usr/local/etc
ETC_LINK_RESOLV=$ETC_LINK_DIR/resolv.conf
ulimit -s 1024
mkdir -p $ETC_LINK_DIR
touch $ETC_LINK_RESOLV
echo "nameserver 8.8.8.8" >> $ETC_LINK_RESOLV
echo "nameserver 8.8.4.4" >> $ETC_LINK_RESOLV
echo "nameserver 4.4.4.4" >> $ETC_LINK_RESOLV
echo "nameserver 168.95.1.1" >> $ETC_LINK_RESOLV
sleep 1
#############################################################################################
# Frank's Debug Network Environment
#############################################################################################
ifconfig eth0 192.168.1.168 up
ifconfig eth0:1 192.168.250.250 up
ifconfig eth0:2 192.168.168.168 up
ifconfig lo 127.0.0.1 up
#############################################################################################
# Linux Telnet Service
#############################################################################################
telnetd &
#############################################################################################
# Application Environment
#############################################################################################
HOMEDIR=/usr/share/ipcam
RESDIR=$HOMEDIR/resource
FLASHMAP=$HOMEDIR/flashmap.ini
SYSCONF=/dev/mtdblock3
APPEXEC=$HOMEDIR/app
APPAGENT=$HOMEDIR/agent
APPITTB=$HOMEDIR/ittb.tar.gz
NETSDKDIR_DEF=$RESDIR/netsdk
SHELLDIR=$HOMEDIR/shell
CONFMTD=/dev/mtdblock3
CUSTOMMTD=/dev/mtdblock6
CONFDIR=/media/conf
CUSTOMDIR=/media/custom
FONTDIR=$CUSTOMDIR/font
WEBDIR=$CUSTOMDIR/web
JFFS2IMG=$CUSTOMDIR/custom.jffs2
CONFSHELLDIR=$CONFDIR/shell
HOOK_STARTUP=$CONFSHELLDIR/startup.sh
HOOK_STOP=$CONFSHELLDIR/stop.sh
#############################################################################################
#############################################################################################
# Frank's Filesystem
#############################################################################################
# make mount point
mkdir /media/conf
mkdir /media/custom
mkdir /tmp/upgrade
# mount my configuration rw filesystem
cp $CUSTOMMTD /tmp/custom.fs
mount -t squashfs /tmp/custom.fs $CUSTOMDIR
#mount -t squashfs $CUSTOMMTD $CUSTOMDIR
mount -t jffs2 $CONFMTD $CONFDIR
if [ "$?" != "0" ]; then
dd if=$JFFS2IMG of=$CONFMTD
mount -t jffs2 $CONFMTD $CONFDIR
fi
# mount my custom rw filesystem
# reset the resource environment
NETSDKDIR=$CONFDIR/netsdk
if [ ! -d "$NETSDKDIR" ]; then
echo 'Building System Configuration...'
#cp -af $NETSDKDIR_DEF $NETSDKDIR
fi
if [ ! -d "$CONFSHELLDIR" ]; then
echo 'Building shell Configuration...'
cp -af $SHELLDIR $CONFSHELLDIR
echo '#!/bin/sh' > $HOOK_STARTUP
echo 'exit 0' > $HOOK_STARTUP
chmod +x $HOOK_STARTUP
fi
#############################################
# Startup Application
#############################################
# Aplication Link
ln -s $APPEXEC /usr/local/sbin/READ_INFO
ln -s $APPEXEC /usr/local/sbin/RSERIAL_NUM
ln -s $APPEXEC /usr/local/sbin/WSERIAL_NUM
ln -s $APPEXEC /usr/local/sbin/RRTC
ln -s $APPEXEC /usr/local/sbin/WRTC
mkdir /tmp/run
#mkdir /tmp/lib
#cp /media/custom/stdlib/* /tmp/lib/
#ln -s /tmp/lib/libstdc++.so.6.0.12 /tmp/lib/libstdc++.so
#ln -s /tmp/lib/libstdc++.so.6.0.12 /tmp/lib/libstdc++.so.6
#export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:"/tmp/lib"
echo "Do You Want to Run Application ? (y/n)"
read -t 1 -n 1 char
if [ "$char" == "n" ]; then
echo "Application Cancel!"
elif [ "$char" == "f" ]; then
# Linux core
echo "Frank Debug Mode!"
ulimit -c unlimited
echo "1" > /proc/sys/kernel/core_uses_pid
echo "/tmp/%t.%e.core" > /proc/sys/kernel/core_pattern
echo "3000000" > /proc/sys/net/core/rmem_default
echo "3000000" > /proc/sys/net/core/rmem_max
# Network debug environment
ifconfig eth0 192.168.2.45 up
sleep 1
mount -t nfs -o nolock 192.168.2.41:/root/nfs /root/nfs
export PATH=$PATH:"/root/nfs/bin"
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:"/root/nfs/lib"
rmmod watchdog
else
# insmod /root/bsp/i2cm.ko
# insmod /root/bsp/rtc.ko
# insmod /root/bsp/watchdog.ko
# RTC Sync
#hwclock -r
$HOOK_STARTUP
#$HOMEDIR/startup.sh
if [ "0" == "$?" ]; then
# Loop to Startup Application
while [ 1 ]
do
cd `dirname $PWD`
# Startup with Agent
#$APPAGENT $APPEXEC -w $WEBDIR -f $FONTDIR -m $FLASHMAP -d $DEFCONF -s $SYSCONF -c $SYSCONF2
# Startup without Agent
$APPEXEC -w $WEBDIR -f $FONTDIR -m $FLASHMAP -s $SYSCONF -d $NETSDKDIR_DEF -c $NETSDKDIR
done
fi
fi
The app binary is the is the ipcam application itself.
Here are some URLs for video streaming and snapshots I found:
HD Quality:
rtsp://user:password@IPCAMIP:80/ch0_0.264
rtmp://user:password@IPCAMIP:80/ch0_0.264
SD Quality:
rtsp://user:password@IPCAMIP:80/ch0_1.264
rtmp://user:password@IPCAMIP:80/ch0_1.264
http://user:password@IPCAMIP/snapshot
http://user:password@IPCAMIP/snapshot.jpg