OpenIPC
/
wiki
mirror of https://github.com/OpenIPC/wiki.git
1
0
Fork 0
Code Activity

some fixes

pull/7/head
Luis Alves 2022-01-15 22:49:26 +00:00 committed by GitHub
parent 5c3ac004c8
commit 12670c6726
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 25 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
en/device-chacon-ipcam-ri01.md
View File

@ -121,7 +121,7 @@ If you find it hard to solder the wires on the camera micro usb connector get a
The camera uBoot is password protected with "pps_password". The camera uBoot is password protected with "pps_password".
### Creating a backup ### Creating a backup
To backup the original firmware you need a usb serial adapter connected to the board and a mmc card. To backup the original firmware you need a usb serial adapter connected to the board and a sdcard.
Find out your flash chip size: Find out your flash chip size:
``` ```
@ -131,10 +131,11 @@ D:0x20 0x70 0x17
Name:"XM25QH64AHIG" Name:"XM25QH64AHIG"
``` ```
uBoot commands to backup the entire flash memory on the mmc card (**mmc card contents will be destroyed**). uBoot commands to backup the entire flash memory on the sdcard (**all sdcard contents will be lost**).
Depending on your camera flash memory size replace \<size1\>/\<size2\> with: (size2 = size1 / 512) Depending on your camera flash memory size replace \<size1\>/\<size2\> with:
- 0x800000/0x4000 for 8M flash - 0x800000/0x4000 for 8M flash
- 0x1000000/0x8000 for a 16Mb flash - 0x1000000/0x8000 for a 16Mb flash
(size2 = size1 / 512)
``` ```
sf probe sf probe
@ -159,9 +160,9 @@ pps #
This will write the entire flash to the mmc card in "raw mode" (no filesystem). This will write the entire flash to the mmc card in "raw mode" (no filesystem).
NOTE: if you leave the card inserted in the camera and boot the original FW it will format and backup is lost! **WARNING**: if you leave the card inserted in the camera and it boots the original FW, the card will be formated and the backup lost!
To get the dump into a file insert the card in a system running linux and: Then to save the dump to a file, insert the card in a system running linux and:
``` ```
dd if=/dev/mmcblk0 of=./flash_backup.bin bs=512 count=<size2> dd if=/dev/mmcblk0 of=./flash_backup.bin bs=512 count=<size2>
``` ```
@ -169,6 +170,18 @@ dd if=/dev/mmcblk0 of=./flash_backup.bin bs=512 count=<size2>
### cat /proc/mtd ### cat /proc/mtd
8Mb flash version
```
dev: size erasesize name
mtd0: 00030000 00010000 "bld" 196608 0
mtd1: 00010000 00010000 "env" 65536 196608
mtd2: 00010000 00010000 "enc" 65536 262144
mtd3: 00010000 00010000 "sysflg" 65536 327680
mtd4: 00310000 00010000 "sys" 3211264 393216
mtd5: 00420000 00010000 "app" 4325376 3604480
mtd6: 00070000 00010000 "cfg" 458752 7929856 - 8388608
```
16Mb flash version 16Mb flash version
``` ```
dev: size erasesize name dev: size erasesize name
@ -184,18 +197,6 @@ mtd8: 002d0000 00010000 "user" 2949120 13697024
mtd9: 00020000 00010000 "oeminfo" 131072 16646144 - 16777216 mtd9: 00020000 00010000 "oeminfo" 131072 16646144 - 16777216
``` ```
8Mb flash version
```
dev: size erasesize name
mtd0: 00030000 00010000 "bld" 196608 0
mtd1: 00010000 00010000 "env" 65536 196608
mtd2: 00010000 00010000 "enc" 65536 262144
mtd3: 00010000 00010000 "sysflg" 65536 327680
mtd4: 00310000 00010000 "sys" 3211264 393216
mtd5: 00420000 00010000 "app" 4325376 3604480
mtd6: 00070000 00010000 "cfg" 458752 7929856 - 8388608
```
### dmesg ### dmesg
``` ```
@ -411,7 +412,7 @@ One of the most interesting features is the "runcmd" function (replace \<your_ca
Send request (note the \\ escaping the & for the password): Send request (note the \\ escaping the & for the password):
``` ```
curl -u PpStRoNg:#%\&wL1@*tU123zv -i http://\<your_cam_ip\>:80/devices/runcmd --request POST --data '{"cmd":"ls"}' curl -u PpStRoNg:#%\&wL1@*tU123zv -i http://<your_cam_ip>:80/devices/runcmd --request POST --data '{"cmd":"ls"}'
HTTP/1.1 200 OK HTTP/1.1 200 OK
Content-Type: application/json Content-Type: application/json
Content-Length: 0 Content-Length: 0
@ -419,7 +420,7 @@ Content-Length: 0
Get output (json format): Get output (json format):
``` ```
curl -u PpStRoNg:#%\&wL1@*tU123zv -i http://\<your_cam_ip\>:80/devices/runcmd curl -u PpStRoNg:#%\&wL1@*tU123zv -i http://<your_cam_ip>:80/devices/runcmd
HTTP/1.1 200 OK HTTP/1.1 200 OK
Content-Type: application/json Content-Type: application/json
Content-Length: 129 Content-Length: 129
@ -434,15 +435,15 @@ In the latest FW they have removed the "telnetd" binary so you need to place it
To start the server copy the telnetd binary to the sdcard and run: To start the server copy the telnetd binary to the sdcard and run:
``` ```
curl -u PpStRoNg:#%\&wL1@*tU123zv -i http://\<your_cam_ip\>:80/devices/runcmd --request POST --data '{"cmd":"echo 'anyone::0:0:root:/:/bin/sh' >> /etc/passwd"}' curl -u PpStRoNg:#%\&wL1@*tU123zv -i http://<your_cam_ip>:80/devices/runcmd --request POST --data '{"cmd":"echo 'anyone::0:0:root:/:/bin/sh' >> /etc/passwd"}'
curl -u PpStRoNg:#%\&wL1@*tU123zv -i http://\<your_cam_ip\>:80/devices/runcmd --request POST --data '{"cmd":"/mnt/mmc01/telnetd &"}' curl -u PpStRoNg:#%\&wL1@*tU123zv -i http://<your_cam_ip>:80/devices/runcmd --request POST --data '{"cmd":"/mnt/mmc01/telnetd &"}'
``` ```
At this point you should be able to telnet to the camera: At this point you should be able to telnet to the camera:
``` ```
$ telnet \<your_cam_ip\> $ telnet <your_cam_ip>
Trying \<your_cam_ip\>... Trying <your_cam_ip>...
Connected to \<your_cam_ip\>. Connected to <your_cam_ip>.
Escape character is '^]'. Escape character is '^]'.
(none) login: anyone (none) login: anyone