Victure PC330

[Nold360]

Description

I'm currently working on a Victure PC330. I couldn't get a serial root shell but I was able to dump the flash by writing it to the SD-card.

Also i was able to create a modified rootfs.img with telnetd running & flash it back using the same method.

1. Extract the rootfs.bin using unsquashfs

2. modify /etc/init.d/rcS [uncomment #telnetd]

3. Repack with mksquashfs squashfs-root roothack.bin -b 131072 -comp xz -Xdict-size 100%

4. Add padding dd if=/dev/zero of=zeros.img bs=323584 count=1 && cat roothack.bin zeros.img > rootfsmod.bin

5. Copy rootfsmod.bin to SD-Card, connect UART to camera & boot it up.

6. Flash modified image:

   fatload mmc 0:1 0x80600000  rootfsmod.bin
   sf probe
   sf update 0x80600000 0x210000 0x2C0000

The bootloader is also looking for a file named update.img - sadly i have no idea how that update file needs to be structured.

I will do some more work soon & update this issue.

Hardware

SOC: T20L RAM: 64MB? Flash: 8Mb Wifi Chip: Realtek 8188FTV

Data

DHCP Hostname: IPC365

uBoot

isvp_t20# sf probe
the manufacturer ef
SF: Detected W25Q64

isvp_t20# printenv
HWID=0000000000000000000000000000000000000000
ID=0000000000000000000000000000000000
IP=110.112.119.64
MAC=40:6A:8E:51:C4:36
SENSOR=2235
SSID_NAME=CCTV187
SSID_VALUE=ABCD.01234567
TYPE=T20L
WIFI=8188FTV
baudrate=115200
bootargs=console=ttyS1,115200n8 mem=39M@0x0 ispmem=8M@0x2700000 rmem=17M@0x2F00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:512K(boot),1600k(kernel),2816k(root),1536k(user),832k(web),896k(mtd)
bootcmd=sf probe;sf read 0x80600000 0x80000 0x280000; bootm 0x80600000
bootdelay=1
ethact=Jz4775-9161
ethaddr=40:6A:8E:51:C4:36
gatewayip=193.169.4.1
ipaddr=193.169.4.81
ipncauto=1
ipncuart=1
loads_echo=1
netmask=255.255.255.0
serverip=193.169.4.2
stderr=serial
stdin=serial
stdout=serial

Environment size: 783/131068 bytes

Linux

dmesg:

[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.14 (hys@localhost.localdomain) (gcc version 4.7.2 (Ingenic r2.3.3 2016.12) ) #1 PREEMPT Fri Mar 23 19:07:57 CST 2018
[    0.000000] CPU0 RESET ERROR PC:00973103
[    0.000000] CPU0 revision is: 00d00101 (Ingenic Xburst)
[    0.000000] FPU revision is: 00b70000
[    0.000000] cgu_get_rate, parent = 712704000, rate = 0, m = 0, n = 0, reg val = 0x000020ff
[    0.000000] CCLK:712MHz L2CLK:356Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 00446000 @ 00010000 (usable)
[    0.000000]  memory: 0003a000 @ 00456000 (usable after init)
[    0.000000] Malformed early option 'ipncuart'
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 02700000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x026fffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x026fffff]
[    0.000000] On node 0 totalpages: 9984
[    0.000000] free_area_init_node: node 0, pgdat 804536d0, node_mem_map 81000000
[    0.000000]   Normal zone: 78 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 9984 pages, LIFO batch:1
[    0.000000] Primary instruction cache 32kB, 8-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 8-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] pls check processor_id[0x00d00101],sc_jz not support!
[    0.000000] MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 9906
[    0.000000] Kernel command line: console=ttyS1,115200n8 mem=39M@0x0 ispmem=8M@0x2700000 rmem=17M@0x2F00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:512K(boot),1600k(kernel),2816k(root),1536k(user),832k(web),896k(mtd) HWID=0000000000000000000000000000000000000000 ID=0000000000000000000000000000000000 SSID_NAME=CCTV187 SSID_VALUE=ABCD.01234567 MAC=40:6A:8E:51:C4:36 IP=110.112.119.64 SENSOR=2235 WIFI=8188FTV TYPE=T20L ipncuart=1 ipncauto=1
[    0.000000] puwell print------>The file:kernel/printk.c,the function:console_setup,the line:1803,ipncuart:1
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 34260k/39936k available (3705k kernel code, 5676k reserved, 670k data, 232k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:418
[    0.000000] clockevents_config_and_register success.
[    0.000028] Calibrating delay loop... 709.42 BogoMIPS (lpj=3547136)
[    0.059996] pid_max: default: 32768 minimum: 301
[    0.060374] Mount-cache hash table entries: 512
[    0.061070] Initializing cgroup subsys debug
[    0.061096] Initializing cgroup subsys freezer
[    0.064318] regulator-dummy: no parameters
[    0.064532] NET: Registered protocol family 16
[    0.070760] bio: create slab <bio-0> at 0
[    0.073582] jz-dma jz-dma: JZ SoC DMA initialized
[    0.074014] usbcore: registered new interface driver usbfs
[    0.074080] usbcore: registered new interface driver hub
[    0.074268] usbcore: registered new device driver usb
[    0.074475]  (null): set:249  hold:250 dev=100000000 h=500 l=500
[    0.074618] media: Linux media interface: v0.10
[    0.074677] Linux video capture interface: v2.00
[    0.077362] Switching to clocksource jz_clocksource
[    0.078176] jz-dwc2 jz-dwc2: cgu clk gate get error
[    0.078206] jz-dwc2 jz-dwc2: regulator vbus get error
[    0.078229] DWC IN OTG MODE
[    0.080104] cfg80211: Calling CRDA to update world regulatory domain
[    0.228516] sft id =========================off
[    0.228642] dwc2 dwc2: Keep PHY ON
[    0.228659] dwc2 dwc2: Using Buffer DMA mode
[    0.428024] dwc2 dwc2: Core Release: 3.00a
[    0.428078] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[    0.428116] dwc2 dwc2: new USB bus registered, assigned bus number 1
[    0.429229] hub 1-0:1.0: USB hub found
[    0.429264] hub 1-0:1.0: 1 port detected
[    0.429470] dwc2 dwc2: DWC2 Host Initialized
[    0.429770] NET: Registered protocol family 2
[    0.430494] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.430535] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.430561] TCP: Hash tables configured (established 512 bind 512)
[    0.430640] TCP: reno registered
[    0.430660] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.430695] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.431048] NET: Registered protocol family 1
[    0.431449] RPC: Registered named UNIX socket transport module.
[    0.431468] RPC: Registered udp transport module.
[    0.431478] RPC: Registered tcp transport module.
[    0.431489] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.432184] freq_udelay_jiffys[0].max_num = 10
[    0.432198] cpufreq  udelay  loops_per_jiffy 
[    0.432210] 12000     59724   59724  
[    0.432220] 24000     119448  119448 
[    0.432231] 60000     298620  298620 
[    0.432242] 120000    597241  597241 
[    0.432252] 200000    995402  995402 
[    0.432264] 300000    1493103     1493103    
[    0.432274] 600000    2986206     2986206    
[    0.432286] 792000    3941793     3941793    
[    0.432296] 1008000   5016827     5016827    
[    0.432308] 1200000   5972413     5972413    
[    0.438978] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.440172] jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
[    0.440665] msgmni has been set to 66
[    0.442389] io scheduler noop registered
[    0.442448] io scheduler cfq registered (default)
[    0.444570] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[    0.449782] brd: module loaded
[    0.452279] loop: module loaded
[    0.453058] zram: Created 2 device(s) ...
[    0.453162] logger: created 256K log 'log_main'
[    0.454006] jz SADC driver registeres over!
[    0.455243] jz TCU driver register completed
[    0.455755] the id code = ef4017, the flash name is W25Q64
[    0.455774] JZ SFC Controller for SFC channel 0 driver register
[    0.455806] 6 cmdlinepart partitions found on MTD device jz_sfc
[    0.455818] Creating 6 MTD partitions on "jz_sfc":
[    0.455836] 0x000000000000-0x000000080000 : "boot"
[    0.456534] 0x000000080000-0x000000210000 : "kernel"
[    0.457149] 0x000000210000-0x0000004d0000 : "root"
[    0.457892] 0x0000004d0000-0x000000650000 : "user"
[    0.458564] 0x000000650000-0x000000720000 : "web"
[    0.459204] 0x000000720000-0x000000800000 : "mtd"
[    0.459845] SPI NOR MTD LOAD OK
[    0.459942] tun: Universal TUN/TAP device driver, 1.6
[    0.459954] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    0.460096] Bus Mode Reg after reset: 0x00020101, cnt=0
[    0.463891] libphy: jz_mii_bus: probed
[    0.464010] =======>gmacdev = 0x81a10f00<================
[    0.464023] =========>gmacdev->MacBase = 0xb34b0000 DmaBase = 0xb34b1000
[    0.464036] Bus Mode Reg after reset: 0x00020101, cnt=0
[    0.465718] jz_mac jz_mac.0: JZ on-chip Ethernet MAC driver, Version 1.0
[    0.465894] usbcore: registered new interface driver zd1201
[    0.466305] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[    0.467460] jzmmc_v1.2 jzmmc_v1.2.0: card inserted, state=0
[    0.497476] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[    0.497911] TCP: cubic registered
[    0.497932] NET: Registered protocol family 17
[    0.499185] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[    0.499429] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[    0.499588] Warning: unable to open an initial console.
[    0.503824] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    0.504334] Freeing unused kernel memory: 232K (80456000 - 80490000)
[    0.528092] dwc2 dwc2: ID PIN CHANGED!
[    0.528143] init DWC as A_HOST
[    0.987525] usb 1-1: new high-speed USB device number 2 using dwc2
[    1.446159] zram0: detected capacity change from 0 to 15728640
[    1.453118] Adding 15356k swap on /dev/zram0.  Priority:-1 extents:1 across:15356k SS
[    1.509238] wait stable.[246][cgu_msc0]
[    1.509336] mmc0: new high speed SDHC card at address 0001
[    1.520370] mmcblk0: mmc0:0001 SD8GB 7.35 GiB 
[    1.521884]  mmcblk0: p1
[    2.054711] RTL871X: module init start
[    2.054733] RTL871X: rtl8188fu v4.3.23.6_20964.20170110
[    2.054744] RTL871X: build time: Jul 31 2017 13:04:55
[    2.054871] RTL871X: 
[    2.054871] usb_endpoint_descriptor(0):
[    2.054887] RTL871X: bLength=7
[    2.054896] RTL871X: bDescriptorType=5
[    2.054906] RTL871X: bEndpointAddress=81
[    2.054916] RTL871X: wMaxPacketSize=512
[    2.054925] RTL871X: bInterval=0
[    2.054935] RTL871X: RT_usb_endpoint_is_bulk_in = 1
[    2.054945] RTL871X: 
[    2.054945] usb_endpoint_descriptor(1):
[    2.054959] RTL871X: bLength=7
[    2.054968] RTL871X: bDescriptorType=5
[    2.054977] RTL871X: bEndpointAddress=2
[    2.054987] RTL871X: wMaxPacketSize=512
[    2.054996] RTL871X: bInterval=0
[    2.055005] RTL871X: RT_usb_endpoint_is_bulk_out = 2
[    2.055015] RTL871X: 
[    2.055015] usb_endpoint_descriptor(2):
[    2.055029] RTL871X: bLength=7
[    2.055038] RTL871X: bDescriptorType=5
[    2.055047] RTL871X: bEndpointAddress=3
[    2.055057] RTL871X: wMaxPacketSize=512
[    2.055066] RTL871X: bInterval=0
[    2.055076] RTL871X: RT_usb_endpoint_is_bulk_out = 3
[    2.055087] RTL871X: nr_endpoint=3, in_num=1, out_num=2
[    2.055087] 
[    2.055101] RTL871X: USB_SPEED_HIGH
[    2.055112] RTL871X: CHIP TYPE: RTL8188FU
[    2.055497] RTL871X: rtw_hal_config_rftype RF_Type is 3 TotalTxPath is 1 
[    2.055527] RTL871X: Chip Version Info: CHIP_8188F_Normal_Chip_SMIC_B_CUT_1T1R_RomVer(0)
[    2.055545] RTL871X: _ConfigChipOutEP_8188F OutEpQueueSel(0x05), OutEpNumber(2)
[    2.055627] RTL871X: EEPROM type is E-FUSE
[    2.055878] RTL871X: Boot from EFUSE, Autoload OK !
[    2.056102] RTL871X: hal_EfuseSwitchToBank: Efuse switch bank to 0
[    2.105665] RTL871X: hal_ReadEFuse_WiFi: data end at address=0x6e
[    2.105689] RTL871X: Efuse Realmap:
[    2.105699] 29 81 00 FC 0B 00 00 00 00 0C 04 4C 10 07 00 00
[    2.105755] 2F 2F 2F 30 31 31 2F 2F 2F 30 31 11 FF FF FF FF
[    2.105812] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.105869] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.105926] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.105983] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106040] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106097] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106154] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106211] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106268] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106325] FF FF FF FF FF FF FF FF 23 1B 1A 00 00 00 00 FF
[    2.106381] FF 02 00 10 00 FF 00 FF 00 00 FF FF FF FF FF FF
[    2.106437] DA 0B 79 F1 47 66 40 74 EE 2A 47 01 37 09 03 52
[    2.106493] 65 61 6C 74 65 6B 09 03 38 30 32 2E 31 31 6E 00
[    2.106550] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106607] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106664] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106721] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106778] C1 B6 FF FF FF FF FF FF FF FF 00 11 FF FF FF FF
[    2.106835] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106891] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.106949] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.107005] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.107062] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.107119] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.107176] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.107233] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.107290] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.107347] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.107457] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.107514] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
[    2.107645] RTL871X: EEPROM VID = 0x bda
[    2.107657] RTL871X: EEPROM PID = 0xf179
[    2.107689] RTL871X: hal_com_config_channel_plan chplan:0x23
[    2.107706] RTL871X: Hal_EfuseParsePowerSavingMode_8188F...bHWPwrPindetect(0)-bHWPowerdown(0) ,bSupportRemoteWakeup(1)
[    2.107719] RTL871X: ### PS params=>  power_mgnt(0),usbss_enable(0) ###
[    2.108449] RTL871X: kfree Pwr Trim flag:1
[    2.108461] RTL871X: bb_gain:3
[    2.110337] RTL871X: rtl8188f_FirmwareDownload fw: FW_NIC, size: 21020
[    2.110359] RTL871X: rtl8188f_FirmwareDownload: fw_ver=4 fw_subver=0000 sig=0x88f1, Month=08, Date=22, Hour=17, Minute=36
[    2.110371] RTL871X: rtl8188f_FirmwareDownload(): Shift for fw header!
[    2.110382] RTL871X: rtl8188f_FirmwareDownload by IO write!
[    2.127962] RTL871X: polling_fwdl_chksum: Checksum report OK! (1, 0ms), REG_MCUFWDL:0x00050105
[    2.128733] RTL871X: _8051Reset8188: Finish
[    2.142187] RTL871X: _FWFreeToGo: Polling FW ready OK! (225, 10ms), REG_MCUFWDL:0x000501c6
[    2.142201] RTL871X: rtl8188f_FirmwareDownload: DLFW OK !
[    2.142214] RTL871X: rtl8188f_FirmwareDownload success. write_fw:1, 30ms
[    2.142278] RTL871X:  <=== rtl8188f_FirmwareDownload()
[    2.154333] RTL871X: CardDisableRTL8188FU
[    2.156643] RTL871X: hal_read_mac_hidden_rpt OK! (2, 10ms), fwdl:1, id:0x19
[    2.156659] RTL871X: InitAdapterVariablesByPROM_8188FU(): REPLACEMENT = 0
[    2.156671] RTL871X: rtw_hal_read_chip_info in 100 ms
[    2.156949] RTL871X: init_channel_set((null)) ChannelPlan ID:0x23, ch num:14
[    2.157864] RTL871X: NR_RECVBUFF: 8
[    2.157884] RTL871X: MAX_RECVBUF_SZ: 4000
[    2.157905] RTL871X: NR_PREALLOC_RECV_SKB: 8
[    2.158255] RTL871X: rtw_alloc_macid((null)) if1, hwaddr:ff:ff:ff:ff:ff:ff macid:1
[    2.158309] RTL871X: Init_ODM_ComInfo_8188f(): fab_ver=0 cut_ver=1
[    2.158458] RTL871X: phy_ConfigBBWithPgParaFile(): No File PHY_REG_PG.txt, Load from HWImg Array!
[    2.158488] RTL871X: default power by rate loaded
[    2.159349] RTL871X: rtw_macaddr_cfg mac addr:74:ee:2a:47:01:37
[    2.159365] RTL871X: bDriverStopped:True, bSurpriseRemoved:False, bup:0, hw_init_completed:0
[    2.159459] RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=74:ee:2a:47:01:37
[    2.174272] usbcore: registered new interface driver rtl8188fu
[    2.174291] RTL871X: module init ret=0
[    2.211406] hrtimer is active!
[    2.252661] jz_pwm_probe[207] d_name = tcu_chn3
[    2.255345] The version of PWM driver is H20180309a
[    2.264761] request pwm channel 3 successfully
[    2.267643] pwm-jz pwm-jz: jz_pwm_probe register ok !
[    2.279637] jz_codec_register: probe() successful!
[    2.279763] cgu_set_rate, parent = 712704000, rate = 2048000, n = 348, reg val = 0x0000215c
[    2.279779] cgu_enable,cgu_i2s reg val = 0x2000215c
[    2.627926] dma dma0chan24: Channel 24 have been requested.(phy id 7,type 0x06 desc a090a000)
[    2.628449] dma dma0chan25: Channel 25 have been requested.(phy id 6,type 0x06 desc a0b3f000)
[    2.802052] register all isp device successfully!
[    2.805042] @@@@ tx-isp-probe ok @@@@@
[    3.113035] RTL871X: +871x_drv - drv_open, bup=0
[    3.115020] RTL871X:  power-on :REG_SYS_CLKR 0x09=0xfc. REG_CR 0x100=0x3f.
[    3.115032] RTL871X:  MAC has already power on.
[    3.115557] RTL871X: rtl8188f_FirmwareDownload fw: FW_NIC, size: 21020
[    3.115579] RTL871X: rtl8188f_FirmwareDownload: fw_ver=4 fw_subver=0000 sig=0x88f1, Month=08, Date=22, Hour=17, Minute=36
[    3.115590] RTL871X: rtl8188f_FirmwareDownload(): Shift for fw header!
[    3.115602] RTL871X: rtl8188f_FirmwareDownload by IO write!
[    3.133048] RTL871X: polling_fwdl_chksum: Checksum report OK! (1, 0ms), REG_MCUFWDL:0x00050105
[    3.133667] RTL871X: _8051Reset8188: Finish
[    3.147165] RTL871X: _FWFreeToGo: Polling FW ready OK! (256, 10ms), REG_MCUFWDL:0x000501c6
[    3.147178] RTL871X: rtl8188f_FirmwareDownload: DLFW OK !
[    3.147192] RTL871X: rtl8188f_FirmwareDownload success. write_fw:1, 30ms
[    3.147261] RTL871X:  <=== rtl8188f_FirmwareDownload()
[    3.147272] RTL871X: fw download ok!
[    3.153137] RTL871X: PHY_MACConfig8188F OK!
[    3.169734] RTL871X: PHY_BBConfig8188F OK!
[    3.417683] RTL871X: PHY_RFConfig8188F OK!
[    3.426425] RTL871X: pDM_Odm TxPowerTrackControl = 1
[    3.426496] RTL871X: pDM_Odm TxPowerTrackControl = 1
[    3.685252] RTL871X: rtl8188fu_hal_init in 570ms
[    3.690489] RTL871X: #### hw_var_set_opmode() -5079 iface_type(0) mode = 2 ####
[    3.690760] RTL871X: rtw_rf_get_kfree_tx_gain_offset path:0, ch:6, bb_gain_sel:0, kfree_offset:3
[    3.691328] RTL871X: kfree gain_offset 0x55:0x82060 RTL871X:  after :0x8e070
[    3.692507] RTL871X: MAC Address = 74:ee:2a:47:01:37
[    3.692719] RTL871X: -871x_drv - drv_open, bup=1
[    3.692844] RTL871X: [rtw_wx_set_pmkid] IW_PMKSA_FLUSH!
[    3.692891] RTL871X: set_mode = IW_MODE_INFRA
[    3.693041] RTL871X: set bssid:00:00:00:00:00:00
[    3.693118] RTL871X: =>rtw_wx_set_essid
[    3.693131] RTL871X: ssid=g\C6isQ\FFJ\EC)ͺ\AB\F2\FB\E3F|\C2T\F8\E8\E7\8DvZ.c3\9Fɚ, len=32
[    3.693148] RTL871X: set ssid [g\C6isQ\FFJ\EC)ͺ\AB\F2\FB\E3F|\C2T\F8\E8\E7\8DvZ.c3\9FɚH\9Dǀ@D\81\F8\D9\80\B0\9Dǀ\8B] fw_state=0x00000008
[    3.693159] RTL871X: Set SSID under fw_state=0x00000008
[    3.693181] RTL871X: <=rtw_wx_set_essid, ret 0
[    3.693825] RTL871X: #### hw_var_set_opmode() -5079 iface_type(0) mode = 2 ####
[    3.737624] RTL871X: [rtw_wx_set_pmkid] IW_PMKSA_FLUSH!
[    5.406405] RTL871X: survey done event(30) band:0 for wlan0
[    5.406462] RTL871X: rtw_select_and_join_from_scanned_queue: return _FAIL(candidate == NULL)
[    5.406476] RTL871X: try_to_join, but select scanning queue fail, to_roam:0
[    5.406489] RTL871X: indicate disassoc
[    5.406524] RTL871X: rtw_indicate_scan_done(wlan0)
[    5.406546] RTL871X: rtw_reset_securitypriv(wlan0) - End to Disconnect
[    5.691606] RTL871X: HwRateToMRate(): Non supported Rate [ff]!!!
[    6.339752] Bus Mode Reg after reset: 0x00020101, cnt=0
[    7.162722] ioctrl_set_initparam(step_speed=400)
[    7.162742] Warning:sm_mod_params.type(2) APPSET!
[    7.162766] <request_gpio_pins_1363> request the gpio port succeed!!<set_gpio_default_1384> set the gpio port succeed!!
[    7.162808] mod_params:type=2,step-speed=400
[    7.162819] init:cfg: step-speed = 400
[    7.162828] c_init_step_defs[n]={step1,step2,target-range}
[    7.162844]  defs[0]={{2002->0},{0->978},{0--1974}}
[    7.162858]  defs[1]={{711->0},{0->142},{28--540}}<6>[    7.162868] direct_def=2,board_id=0
[    7.162879] pulse_xor[2]={0,3}
[    7.162900] motor[0].status={state[0],rorate_dir[0] step(0/->0) pulse_count=0 pos_detect=0x0}
[    7.162912]  sm_set_newstate(state[0]=[1])
[    7.162929] motor[0].status={state[1],rorate_dir[0] step(2002/->0) pulse_count=0 pos_detect=0x0}
[    7.162940]  sm_set_rotate_dir(new_rorate_dir=[1])
[    7.213958] motor[0].status={state[1],rorate_dir[1] step(2002/->0) pulse_count=1 pos_detect=0x0}
[    7.213980]  sm_set_rotate_dir(new_rorate_dir=[3])
[    7.389815] codec_codec_ctl: set repaly channel...
[    7.389844] codec_codec_ctl: set sample rate...
[    7.390128] codec_codec_ctl: set device...
[    7.627415] codec_set_device: set device: speaker...
[    7.886522] set sensor gpio as PA-high-10bit
[    7.886549] @@@@@@@probe ok ------->sc2235
[    7.908493] -----sc2235_detect: 521 ret = 0, v = 0x22
[    7.909034] -----sc2235_detect: 529 ret = 0, v = 0x35
[    7.909050] sc2235 0-0030: sc2235 chip found @ 0x30 (i2c0)
[    7.909065] tx_isp: Registered sensor subdevice sc2235 0-0030
[    7.909115] do not support ctrl->cmd ====1
[    7.909135] do not support ctrl->cmd ====0
[    7.924809] do not support ctrl->cmd ====1
[    8.509222] do not support ctrl->cmd ====1
[    8.510121] sc2235 stream on
[    8.549464] ###### image_tuning_v4l2_open 4329 #######
[    8.574068] &&& chan1  scaler.max_width = 1920 max_height = 1080  min_width = 128 min_height = 128 &&&
[    8.596013] &&& chan2  scaler.max_width = 800 max_height = 800  min_width = 128 min_height = 128 &&&
[    8.597333] codec_codec_ctl: set sample rate...
[    8.597993] codec_codec_ctl: set device...
[    8.997445] codec_set_device: set device: MIC...
[    9.098608] ###### VIC ERROR status = 0x00400000
[    9.703336] RTL871X: HwRateToMRate(): Non supported Rate [ff]!!!
[    9.804956] RTL871X: rtw_wx_get_rts, rts_thresh=2347
[    9.804984] RTL871X: rtw_wx_get_frag, frag_len=2346
[    9.874096] Alloca uses obsolete (PF_INET,SOCK_PACKET)
[    9.875821] RTL871X: rtw_wx_get_rts, rts_thresh=2347
[    9.875865] RTL871X: rtw_wx_get_frag, frag_len=2346
[    9.902382] RTL871X: rtw_wx_get_rts, rts_thresh=2347
[    9.902411] RTL871X: rtw_wx_get_frag, frag_len=2346
[   10.457685] libphy: 0:00 - Link is Up - 100/Full
[   11.126711] RTL871X: (2)871x_drv - drv_close, bup=1, hw_init_completed=_TRUE
[   11.132464] RTL871X: indicate disassoc
[   11.132542] RTL871X: rtw_reset_securitypriv(wlan0) - End to Disconnect
[   11.132598] RTL871X: free disconnecting network of scanned_queue failed due to pwlan== NULL
[   11.132598] 
[   11.132625] RTL871X: -871x_drv - drv_close, bup=1
[   12.135295] RTL871X: +871x_drv - drv_open, bup=1
[   12.135337] RTL871X: -871x_drv - drv_open, bup=1
[   12.226448] motor[0].status={state[1],rorate_dir[3] step(0/->0) pulse_count=2003 pos_detect=0x0}
[   12.226471]  sm_set_rotate_dir(new_rorate_dir=[1])
[   12.228954] motor[0].status={state[1],rorate_dir[1] step(0/->0) pulse_count=1 pos_detect=0x0}
[   12.228971]  sm_set_rotate_dir(new_rorate_dir=[4])
[   12.231438] motor[0].status={state[1],rorate_dir[4] step(0/->0) pulse_count=1 pos_detect=0x0}
[   12.231451]  sm_set_newstate(state[0]=[2])
[   12.231469] motor[0].status={state[2],rorate_dir[4] step(0/->978) pulse_count=1 pos_detect=0x0}
[   12.231480]  sm_set_rotate_dir(new_rorate_dir=[0])
[   12.233951] motor[0].status={state[2],rorate_dir[0] step(0/->978) pulse_count=1 pos_detect=0x0}
[   12.233967]  sm_set_rotate_dir(new_rorate_dir=[1])
[   12.236449] motor[0].status={state[2],rorate_dir[1] step(0/->978) pulse_count=1 pos_detect=0x0}
[   12.236465]  sm_set_rotate_dir(new_rorate_dir=[2])
[   14.683969] motor[0].status={state[2],rorate_dir[2] step(978/->978) pulse_count=979 pos_detect=0x0}
[   14.683991]  sm_set_rotate_dir(new_rorate_dir=[1])
[   14.686439] motor[0].status={state[2],rorate_dir[1] step(978/->978) pulse_count=1 pos_detect=0x0}
[   14.686451]  sm_set_rotate_dir(new_rorate_dir=[4])
[   14.688947] motor[0].status={state[2],rorate_dir[4] step(978/->978) pulse_count=1 pos_detect=0x0}
[   14.688965]  sm_set_newstate(state[0]=[3])
[   14.688983] motor[0].status={state[3],rorate_dir[4] step(978/->978) pulse_count=1 pos_detect=0x0}
[   14.688994]  sm_set_rotate_dir(new_rorate_dir=[0])
[   14.691459] motor[1].status={state[0],rorate_dir[0] step(0/->0) pulse_count=2989 pos_detect=0x0}
[   14.691480]  sm_set_newstate(state[1]=[1])
[   14.691497] motor[1].status={state[1],rorate_dir[0] step(711/->0) pulse_count=2989 pos_detect=0x0}
[   14.691509]  sm_set_rotate_dir(new_rorate_dir=[1])
[   14.691542] motor[1].status={state[1],rorate_dir[1] step(711/->0) pulse_count=1 pos_detect=0x0}
[   14.691554]  sm_set_rotate_dir(new_rorate_dir=[3])
[   14.889915] RTL871X: rtw_wx_get_rts, rts_thresh=2347
[   14.889943] RTL871X: rtw_wx_get_frag, frag_len=2346
[   15.153461] RTL871X: (2)871x_drv - drv_close, bup=1, hw_init_completed=_TRUE
[   15.155396] RTL871X: indicate disassoc
[   15.155542] RTL871X: rtw_reset_securitypriv(wlan0) - End to Disconnect
[   15.155587] RTL871X: free disconnecting network of scanned_queue failed due to pwlan== NULL
[   15.155587] 
[   15.155613] RTL871X: -871x_drv - drv_close, bup=1
[   16.156727] RTL871X: +871x_drv - drv_open, bup=1
[   16.156801] RTL871X: -871x_drv - drv_open, bup=1
[   16.471474] motor[1].status={state[1],rorate_dir[3] step(0/->0) pulse_count=712 pos_detect=0x0}
[   16.471510]  sm_set_rotate_dir(new_rorate_dir=[1])
[   16.473964] motor[1].status={state[1],rorate_dir[1] step(0/->0) pulse_count=1 pos_detect=0x0}
[   16.473978]  sm_set_rotate_dir(new_rorate_dir=[4])
[   16.476450] motor[1].status={state[1],rorate_dir[4] step(0/->0) pulse_count=1 pos_detect=0x0}
[   16.476464]  sm_set_newstate(state[1]=[2])
[   16.476482] motor[1].status={state[2],rorate_dir[4] step(0/->142) pulse_count=1 pos_detect=0x0}
[   16.476494]  sm_set_rotate_dir(new_rorate_dir=[0])
[   16.478990] motor[1].status={state[2],rorate_dir[0] step(0/->142) pulse_count=1 pos_detect=0x0}
[   16.479012]  sm_set_rotate_dir(new_rorate_dir=[1])
[   16.481484] motor[1].status={state[2],rorate_dir[1] step(0/->142) pulse_count=1 pos_detect=0x0}
[   16.481506]  sm_set_rotate_dir(new_rorate_dir=[2])
[   16.838971] motor[1].status={state[2],rorate_dir[2] step(142/->142) pulse_count=143 pos_detect=0x0}
[   16.838994]  sm_set_rotate_dir(new_rorate_dir=[1])
[   16.841482] motor[1].status={state[2],rorate_dir[1] step(142/->142) pulse_count=1 pos_detect=0x0}
[   16.841506]  sm_set_rotate_dir(new_rorate_dir=[4])
[   16.843986] motor[1].status={state[2],rorate_dir[4] step(142/->142) pulse_count=1 pos_detect=0x0}
[   16.844008]  sm_set_newstate(state[1]=[3])
[   16.844026] motor[1].status={state[3],rorate_dir[4] step(142/->142) pulse_count=1 pos_detect=0x0}
[   16.844037]  sm_set_rotate_dir(new_rorate_dir=[0])
[   16.846441] motor[0].status={state[3],rorate_dir[0] step(978/->978) pulse_count=862 pos_detect=0x0}
[   16.846454]  sm_set_newstate(state[0]=[4])
[   16.846472] motor[1].status={state[3],rorate_dir[0] step(142/->142) pulse_count=0 pos_detect=0x0}
[   16.846484]  sm_set_newstate(state[1]=[4])
[   18.152845] RTL871X: HwRateToMRate(): Non supported Rate [ff]!!!
[   18.345148] do not support ctrl->cmd ====1
[   19.894579] RTL871X: rtw_wx_get_rts, rts_thresh=2347
[   19.894607] RTL871X: rtw_wx_get_frag, frag_len=2346
[   22.151610] RTL871X: HwRateToMRate(): Non supported Rate [ff]!!!
[   24.899294] RTL871X: rtw_wx_get_rts, rts_thresh=2347
[   24.899323] RTL871X: rtw_wx_get_frag, frag_len=2346
[   26.152541] RTL871X: HwRateToMRate(): Non supported Rate [ff]!!!
[   29.904294] RTL871X: rtw_wx_get_rts, rts_thresh=2347
[   29.904323] RTL871X: rtw_wx_get_frag, frag_len=2346
[   30.153133] RTL871X: HwRateToMRate(): Non supported Rate [ff]!!!
[   34.152584] RTL871X: HwRateToMRate(): Non supported Rate [ff]!!!
[   34.909219] RTL871X: rtw_wx_get_rts, rts_thresh=2347
[   34.909249] RTL871X: rtw_wx_get_frag, frag_len=2346
[   38.151888] RTL871X: HwRateToMRate(): Non supported Rate [ff]!!!
...

[root@puwell:~]# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00008000 "boot"
mtd1: 00190000 00008000 "kernel"
mtd2: 002c0000 00008000 "root"
mtd3: 00180000 00008000 "user"
mtd4: 000d0000 00008000 "web"
mtd5: 000e0000 00008000 "mtd"

[root@puwell:~]# mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
tmpfs on /dev type tmpfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /run type tmpfs (rw,nosuid,nodev,relatime,mode=755)
sysfs on /sys type sysfs (rw,relatime)
/dev/mtdblock3 on /user type squashfs (ro,relatime)
/dev/mtdblock4 on /puwell/voice type squashfs (ro,relatime)
/dev/mtdblock5 on /puwell/mtd type jffs2 (rw,relatime)
/dev/mmcblk0p1 on /media type vfat (rw,noatime,nodiratime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)

Some RAM seems to be reserved?! swap = zram

[root@puwell:~]# free
             total         used         free       shared      buffers
Mem:         34492        33488         1004            0          576
-/+ buffers:              32912         1580
Swap:        15356         1976        13380

[root@puwell:~]# lsmod
sensor_sc2235 7648 1 - Live 0xc0501000 (O)
tx_isp 307488 4 - Live 0xc04ac000 (O)
audio 52368 2 - Live 0xc0430000 (O)
sample_pwm_hal 3008 0 - Live 0xc0414000 (O)
sample_pwm_core 2240 1 - Live 0xc040d000 (O)
steppermotor 6976 1 - Live 0xc0405000 (O)
8188fu 1111600 0 [permanent], Live 0xc027d000 (O)

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[s00500]

How did you get the original firmware ? I am currently playing with a victure PC420, have not gotten a root shell yet... but I have access to uboot... any tipps how to get the original root fs ?

[benjjyman]

huh been scouring internet for victure pc220 root access info or anyway to dump firmware (back is called IPC_flash_up.bin) running on an Ingenic T20 Xburst

no matter how I play with Uboot it will either reboot after 3 seconds or close console early.....

keep me informed if you have better luck please

[benjjyman]

How did you get the original firmware ? I am currently playing with a victure PC420, have not gotten a root shell yet... but I have access to uboot... any tipps how to get the original root fs ?

[Nold360]

How did you get the original firmware ? I am currently playing with a victure PC420, have not gotten a root shell yet... but I have access to uboot... any tipps how to get the original root fs ?

Hey, sorry this was quite i while ago.. but IIRC there are commands in uboot, which allow reading flash & also accessing the sd-card. or at least write data to it.. basically the opposite of this command:

fatload mmc 0:1 0x80600000 rootfsmod.bin

0x80600000 should be the address of the root partition, mmc 0:1 the sd-card[-partition!?] and rootfsmod.bin the name of the file on the sd-card.

What i did to get the "original" firmware, was basically dump all these partitions.

[benjjyman]

How did you get the original firmware ? I am currently playing with a victure PC420, have not gotten a root shell yet... but I have access to uboot... any tipps how to get the original root fs ?

Hey, sorry this was quite i while ago.. but IIRC there are commands in uboot, which allow reading flash & also accessing the sd-card. or at least write data to it.. basically the opposite of this command:

fatload mmc 0:1 0x80600000 rootfsmod.bin

0x80600000 should be the address of the root partition, mmc 0:1 the sd-card[-partition!?] and rootfsmod.bin the name of the file on the sd-card.

What i did to get the "original" firmware, was basically dump all these partitions.

Sorry to bother you again, after reading my logs last night in my sleep deprived state I've copied the line "fatload mmc 0:1 0x80600000 rootfsmod.bin" To putty and ran this has now produced

[ 1.893865] SQUASHFS error: unable to read id index table

Im assuming that I did this before I dumped flash to console overnight, so that's probably missing the "id index for SQUASHFS"

So as this only my 2nd attempt at reverse engineering anything I'm guessing I've bricked the cam unless I can recreate the ID INDEX or obtain an original copy of firmware ??? ( Victure line looks very siimilar to YI cameras, (shape and components) maybe worth flashing with that ??)

Any suggestions please ( the camera was a find , cost me nothing its just a learning experience ). Thanks

[Nold360]

[ 1.893865] SQUASHFS error: unable to read id index table

According to this the error means that the end of the filesystem has been truncated. so the rootfsmod.bin doesn't seem to be a valid squashfs

[s00500]

Hi @Nold360, Thanks for still answering! If I got this correctly then fatload mmc 0:1 0x80600000 rootfsmod.bin Will try to load a file called rootfsmod.bin from the sd card...

But I am trying to do the oposite... now the fatload function seems to be not what I should use for that... I could try to have uboot print out the memory contents via serial (using md) and then store them to a file, but I feel there must be a better way to tell uboot to dump it to a file on the sd card... I am just unsure what command to use...

isvp_t20# help
?       - alias for 'help'
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
boota   - boot android system
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
env     - environment handling commands
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
gettime - get timer val elapsed,

go      - start application at address 'addr'
help    - print command description/usage
jzsoc   - jz soc info
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
sleep   - delay execution for some time
source  - run script from memory
tftpboot- boot image via network using TFTP protocol
version - print monitor, compiler and linker version
isvp_t20# 

[benjjyman]

@s00500 Hi Ive not quite got figured it out but from :- https://cybergibbons.com/hardware-hacking/recovering-firmware-through-u-boot/

we need to read flash into ram

sf probe 0 (intialise flash)

DEMO VALUES ONLY !! YOUR PARTITIONS WILL BE DIFFERENT CHECK YOUR LOGS sf read 0x82000000 0x0 0x1000000 (read a parttion into memory)

then we can either use the rest of the above tutorial to dump memory to console, save the log, edit and use the python program to rebuild the bin (I assume we can recover partitions from this)

OR

the mmc write command can be used to dump to SD card which is quicker but the data is written raw to SD card and I havent figured out how to parse it back together and not 100% sure if its the targeted portion of memory .

Best of luck.

[s00500]

@benjjyman Hihi I found the exact same blogpost earlier, I think I will just try to dump the memory via serial, this seems easiest after all, lets see where I will get...

[s00500]

Hey all, I managed to successfully get a shell today, used the blogpost to dump the firmware, found something thaat looked like a squashfs in it, (both of them actually) unpacked one, activated the telnet in the init script and then put it on the sd card and flashed it back with the same offsets as in the original post here. Now I can get in via telnet =D

I actually did not add 0 padding to the squashfs... and I just got much further than I expected, so if any of you has some inspiration what to test / experiment next please let me know

I think the next things I wanna figure out is if I can get some selfcompiled binary to run on it and see if I can find the original streamer software... again, pointers are welcome =D