erew123
commented
4 years ago For reference, heres the board connection settings
Open erew123 opened 4 years ago
erew123
commented
4 years ago For reference, heres the board connection settings
erew123
commented
4 years ago If its of any use... these are the help options in Uboot
T20# help
? - alias for 'help'
base - print or set address offset
boot - boot default, i.e., run 'bootcmd'
boota - boot android system
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
chpart - change active partition
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
downboot- load u-boot.bin
downekernel- load uImage
downfilesys- downfilesys - download file system to flash device
downfireware- downfireware - download and write All-Image to flash device
downimage- downimage - download and write All-Image to flash device
downipcfs- load ipcfs.sqfs
downkernel- load uImage
downmboot- load u-boot.bin
downmfilesys- downfilesys - download file system to flash device
downmfireware- downmfireware - download and write All-Image to flash device
downmimage- downmimage - download and write All-Image to flash device
downmipcfs- load ipcfs.sqfs
downmiscfs- load filesys.jffs2
downmkernel- load uImage
downmmiscfs- load filesys.jffs2
downmrootfs- load rootfs.sqfs
downrootfs- load rootfs.sqfs
downxboot- load u-boot.bin (xmodem mode)
echo - echo args to console
env - environment handling commands
eraseenv- env default
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
format - format environment
gettime - get timer val elapsed,
go - start application at address 'addr'
help - print command description/usage
jzsoc - jz soc info
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
sleep - delay execution for some time
source - run script from memory
tftpboot- boot image via network using TFTP protocol
version - print monitor, compiler and linker versionand printenv
T20# printenv
baudrate=115200
bootargs=console=ttyS1,115200n8 mem=37712K@0x0 ispmem=8100K@0x24D4000 rmem=19724K@0x2CBD000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock3 flash=SF sensor=JXF22 maxheight=1080 eeprom=NONE device_id=3040006 ethaddr=00:11:22:33:44:72 devinfo=jcoxa20181001o217701b85d351d8ff206292d283c261f64 cpu=T20 ddr=64M mtdparts=jz_sfc:256K@0K(sf-bootloader),32K@256K(sf-bootenv),1472K@288K(sf-kernel),1152K@1760K(sf-rootfs),4576K@2912K(sf-ipcfs),704K@7488K(sf-miscfs) feature=4 lang=2
bootcmd=sf probe;sf read 0x80600000 0x48000 0x280000; bootm 0x80600000
bootdelay=1
device_id=30400065083
devinfo=jcoxa20181001o217701b85d351d8ff206292d283c261f64
ethact=Jz4775-9161
ethaddr=00:11:22:33:44:72
gatewayip=192.168.2.1
ipaddr=192.168.2.84
loads_echo=1
netmask=255.255.255.0
serverip=192.168.2.81
stderr=serial
stdin=serial
stdout=serial
Environment size: 894/32764 bytesThis gets me to a prompt I can type things at...
setenv bootargs console=ttyS1,115200n8 mem=37712K@0x0 ispmem=8100K@0x24D4000 rmem=19724K@0x2CBD000 init=/bin/sh rootfstype=squashfs root=/dev/mtdblock3 rw flash=SF sensor=JXF22 maxheight=1080 eeprom=NONE device_id=3040006 ethaddr=00:11:22:33:44:72 devinfo=jcoxa20181001o217701b85d351d8ff206292d283c261f64 cpu=T20 ddr=64M mtdparts=jz_sfc:256K@0K(sf-bootloader),32K@256K(sf-bootenv),1472K@288K(sf-kernel),1152K@1760K(sf-rootfs),4576K@2912K(sf-ipcfs),704K@7488K(sf-miscfs) feature=4 lang=2,-(flag)
However, it looks like there is a watchdog timer as the system reboots to Uboot after maybe 60 seconds. The only folder in the file structure I can find anything in, is the bin folder, which has all the standard unix utilities.
cat /proc/mtd fails
The file system I can see, remains read only, because Ive tried to use passwd to and Im told that it cant change the password, because the file system is read only.
One other thing, the device has ports 8004, 8006, 9527 and 9999 open. A port scanner shows nothing, however, if you hit it on port 8006, the inbuilt speaker says its upgrading.
erew123
commented
4 years ago Some success.
1) Let the device boot normally. 2) Press enter until you get a jabsco login: prompt 3) Log in as root with the password jco66688 4) If you havnt already, insert your SD card that you have formatted as FAT32 with a 512MB partition on it. 5) Type cd /opt/media/mmcblk0p1 to move your location to the SD card's 512MB partition. 6) Run the following commands, one line at a time, to make a backup of the running system:
dd if=/dev/mtdblock0 of=sf-bootloader dd if=/dev/mtdblock1 of=sf-bootenv dd if=/dev/mtdblock2 of=sf-kernel dd if=/dev/mtdblock3 of=sf-rootfs dd if=/dev/mtdblock4 of=sf-ipcfs dd if=/dev/mtdblock5 of=sf-miscfs
(I will include a zipped dump, when I have reset my device and removed my personal info out of the files)
erew123
commented
4 years ago @EliasKotlyar Hi Elias, hope you are keeping well. Im sorry to @ you on this, but hoped if you have time you may have a spare moment to take a look and help me? If so, thanks. Also, if you can help me, I will write a full guide for anyone else who attempts this.
What should I try from here on these other cameras? or do you not think this will work?
Many thanks
EliasKotlyar
commented
4 years ago Hello @erew123,
many thanks for reaching out, unfortunately i havent been working on this project since some time due to other projects. Regarding your questions:
Try flashing the ones listed here: https://github.com/Dafang-Hacks/uboot/tree/master/compiled_bootloader Especially the sannce ones are different. You will see if the changes when you analyse the changes which were made in the code. Search for SANNCE Constants.
Regarding future steps: Sannce Support is highly experemential. Altough we managed to make the main binary work with almost every ingenic device for delivering a RTSP, this is not true for other features like LEDs, Rotating etc due to the hardware implementation of the particular device device.
I do not know which kind of goals you are setting - if you want to have the device supporting every feature of this hack, it will not work on SANNCE without investing huge efforts. If you are just trying to make a RTSP work, it should work because the sensor seems to be supported
erew123
commented
4 years ago Hi @EliasKotlyar
Thanks so much for taking the time to reply, I really appreciate it.
Ill give that a go over the next few days when I have a spare moment and see where I get to (will feed back on here for others, if I can get it working).
Again, thanks!!
anonjokerps15
commented
4 years ago hello guys > I cant access to root user ! i has been try sudo passwd root ichanged the passwd many times ! who can help
erew123
commented
4 years ago I only know the inbuilt Sannce 141HD password.... I dont know any other passwords
Log in as root with the password jco66688
Hope that helps
cristian-ene
commented
2 years ago I'm not really a fan of bringing dead to life... but here goes nothing. Has anyone managed to get this camera RTSP/ONVIF? It's sitting in my drawer for ages now... and I would rather have it at my parents house.
I have a Sannce I41HD, which Ive managed to get Serial access. It appears to have 256MB of memory and Im trying to figure how to get route access, EDIT - Managed to get to root access, backups of the firmware etc link I just need help deciding which firmware to try.
This is also the same as the Wetrans wifi camera 1080P
Thanks