search

OpenIPC / firmware

Alternative IP Camera firmware from an open community
https://openipc.org
MIT License
1.26k stars 241 forks source link

RFQ: gk7205v300 - ICSEE Dome camera #1181

Open hvegh opened 10 months ago

hvegh commented 10 months ago

Recently I bought this Icsee 5mp Poe Ip Ptz Camera 4x optical Zoom IP cam.

The camera controller is connected via the UART to the PTZ controller board.

I have managed to extract the firmware from the device.

Here is a bootlog:

System startup

Uncompress Ok!

U-Boot 2016.11-g4bd9c94-dirty (Apr 22 2022 - 21:25:43 +0800)gk7205v300

Relocation Offset is: 0771f000
Relocating to 47f1f000, new gd at 47edeef0, sp at 47edeed0
SPI Nor:  Check Flash Memory Controller v100 ... Found
SPI Nor ID Table Version 1.0
@hifmc_spi_nor_probe(), SPI Nor(cs 0) ID: 0xa1 0x40 0x18 <Read>
@hifmc_spi_nor_probe(), SPI Nor(cs 0) ID: 0xa1 0x40 0x18 <Found>
SPI Nor(cs 0) ID: 0xa1 0x40 0x18
eFlashType: 30.
@XmSpiNor_initSr3() need No SR3!
@XmSpiNor_printWps(), WPS Enabled!
Flash Name: XM_FM25Q128A{0xA14018), 0x1000000.
@hifmc_spi_nor_probe(), XmSpiNor_ProtMgr_probe(): OK.
@XmSpiNor_enableQuadMode(), Quad was Disabled, SRx: [2, 0x8].
Block:64KB Chip:16MB Name:"XM_FM25Q128A"
CONFIG_CLOSE_SPI_8PIN_4IO = y.
read->iftype[0: STD, 1: DUAL, 2: DIO, 3: QUAD, 4: QIO]: 1.
lk[7 => 0x1000000], Total Lock Blks: 286 <WPS=1>
SRx val: {[1, 0x20], [1, 0x8], [1, 0x0], [0, 0x0]}, SrVal: 0x700000000000820.
SPI Nor total size: 16MB
In:    serial
Out:   serial
Err:   serial
Net:   eth0
autoboot:  0 
@do_spi_flash_probe() flash->erase_size: 65536, flash->sector_size: 0
device 0 offset 0x40000, size 0x540000

SF: 5505024 bytes @ 0x40000 Read: OK
srcAddr: 0x43000000, dstAddr: 0x42000000, filename: boot/uImage.
created_inode 0x47edfc18
find_squashfs_file: name bin, start_block 0, offset 1824, type 1
find_squashfs_file: name boot, start_block 0, offset 1996, type 1
read inode: name boot, sb 0, of 1996, type 1
find_squashfs_file: name uImage, start_block 0, offset 1856, type 2
read inode: name uImage, sb 0, of 1856, type 2
write_file: regular file, blocks 27
len 1723581
### get_squashfs_file OK: loade 1723581 bytes to 0x42000000
## Booting kernel from Legacy Image at 42000000 ...
   Image Name:   Linux-4.9.37
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1723517 Bytes = 1.6 MiB
   Load Address: 40008000
   Entry Point:  40008000
   Loading Kernel Image ... OK
using: ATAGS
at setup_xminfo_tag() g_nXmBootSysIndex: 0, g_nXmRomfsIndex: 0.

Starting kernel ...
stipe-jurkovic commented 10 months ago

I have the same one, with the dirty. Managed to install openipc bit now i am having no video. I have the Sc5239P sensor

hvegh commented 10 months ago

I have 5MP, also Sc5239P I suspect.

Tried to access the bootloader by shorting the clk/data pin, but is password protected. So I just de-soldered the flash chip and read the contents:

./40000.squashfs
./40000/bin
./40000/bin/EnvPartCheck
./40000/bin/XmDvrBox
./40000/bin/ash
./40000/bin/awk
./40000/bin/btools
./40000/bin/busybox
./40000/bin/cat
./40000/bin/chmod
./40000/bin/cp
./40000/bin/cut
./40000/bin/date
./40000/bin/dmesg
./40000/bin/dumpleases
./40000/bin/echo
./40000/bin/free
./40000/bin/grep
./40000/bin/gunzip
./40000/bin/gzip
./40000/bin/head
./40000/bin/hiddrs
./40000/bin/himc
./40000/bin/himd
./40000/bin/himd.l
./40000/bin/himm
./40000/bin/i2c_read
./40000/bin/i2c_write
./40000/bin/kill
./40000/bin/killall
./40000/bin/ln
./40000/bin/login
./40000/bin/ls
./40000/bin/mkdir
./40000/bin/mkfifo
./40000/bin/mknod
./40000/bin/mount
./40000/bin/mv
./40000/bin/netinit
./40000/bin/netstat
./40000/bin/ping
./40000/bin/ping6
./40000/bin/ps
./40000/bin/pwd
./40000/bin/rm
./40000/bin/rmdir
./40000/bin/sed
./40000/bin/sh
./40000/bin/sleep
./40000/bin/ssp_read
./40000/bin/ssp_write
./40000/bin/sync
./40000/bin/tar
./40000/bin/top
./40000/bin/touch
./40000/bin/tty
./40000/bin/umount
./40000/bin/unlink
./40000/bin/upgrader
./40000/bin/xmmm
./40000/boot
./40000/boot/uImage
./40000/dev
./40000/etc
./40000/etc/automount.sh
./40000/etc/fs-version
./40000/etc/fstab
./40000/etc/group
./40000/etc/init.d
./40000/etc/init.d/dnode
./40000/etc/init.d/rcS
./40000/etc/inittab
./40000/etc/localtime
./40000/etc/mdev.conf
./40000/etc/mtab
./40000/etc/passwd
./40000/etc/passwd-
./40000/etc/ppp
./40000/etc/ppp/peers
./40000/etc/ppp/pppoe-options
./40000/etc/ppp/pppoe-start
./40000/etc/profile
./40000/etc/protocols
./40000/etc/resolv.conf
./40000/etc/services
./40000/etc/sysver
./40000/etc/udev
./40000/etc/udev/disk-hotplug.sh
./40000/etc/udev/firmware.sh
./40000/etc/udev/rules.d
./40000/etc/udev/rules.d/11-usb-hotplug.rules
./40000/etc/udev/rules.d/50-firmware.rules
./40000/etc/udev/rules.d/54-gphoto.rules
./40000/etc/udev/rules.d/60-pcmcia.rules
./40000/etc/udev/rules.d/75-cd-aliases-generator.rules.optional
./40000/etc/udev/rules.d/75-persistent-net-generator.rules.optional
./40000/etc/udev/rules.d/90-hal.rules
./40000/etc/udev/rules.d/97-bluetooth-serial.rules
./40000/etc/udev/rules.d/99-fuse.rules
./40000/etc/udev/rules.d/device-mapper.rules
./40000/etc/udev/udev.conf
./40000/etc/udev/usbdev-hotplug.sh
./40000/home
./40000/lib
./40000/lib/a7_softfp_neon-vfpv4
./40000/lib/ld-linux-armhf.so.3
./40000/lib/ld-linux.so.3
./40000/lib/ld-uClibc-0.9.33.2.so
./40000/lib/ld-uClibc.so.0
./40000/lib/libXMcrypto.so
./40000/lib/libXmAuto.so
./40000/lib/libXmComm.so
./40000/lib/libXmDvr.so
./40000/lib/libXmJson.so
./40000/lib/libc.so.0
./40000/lib/libc.so.6
./40000/lib/libcrypt-0.9.33.2.so
./40000/lib/libcrypt.so.0
./40000/lib/libdl-0.9.33.2.so
./40000/lib/libdl.so.0
./40000/lib/libgcc_s.so
./40000/lib/libgcc_s.so.1
./40000/lib/libm-0.9.33.2.so
./40000/lib/libm.so.0
./40000/lib/libnsl-0.9.33.2.so
./40000/lib/libnsl.so.0
./40000/lib/libpolarssl.so
./40000/lib/libpthread-0.9.33.2.so
./40000/lib/libpthread.so.0
./40000/lib/libresolv-0.9.33.2.so
./40000/lib/libresolv.so.0
./40000/lib/librt-0.9.33.2.so
./40000/lib/librt.so.0
./40000/lib/libstdc++.so
./40000/lib/libstdc++.so.6
./40000/lib/libstdc++.so.6.0.23
./40000/lib/libthread_db-0.9.33.2.so
./40000/lib/libthread_db.so.1
./40000/lib/libuClibc-0.9.33.2.so
./40000/lib/libutil-0.9.33.2.so
./40000/lib/libutil.so.0
./40000/lib/modules
./40000/lib/modules/XmCommon.ko
./40000/lib/modules/XmDemux.ko
./40000/lib/modules/XmE2prom.ko
./40000/lib/modules/XmGpio.ko
./40000/lib/modules/XmGpioI2c.ko
./40000/linuxrc
./40000/mnt
./40000/mnt/custom
./40000/mnt/data
./40000/mnt/logo
./40000/mnt/mtd
./40000/mnt/sd
./40000/mnt/usb
./40000/mnt/web
./40000/mnt/work
./40000/opt
./40000/proc
./40000/root
./40000/root/.profile
./40000/sbin
./40000/sbin/XmServices_Mgr
./40000/sbin/arping
./40000/sbin/brctl
./40000/sbin/devmem
./40000/sbin/env_mtdparts
./40000/sbin/envext
./40000/sbin/flash_eraseall
./40000/sbin/getty
./40000/sbin/ifconfig
./40000/sbin/init
./40000/sbin/insmod
./40000/sbin/lsmod
./40000/sbin/mdev
./40000/sbin/modinfo
./40000/sbin/reboot
./40000/sbin/rmmod
./40000/sbin/route
./40000/sbin/timetest
./40000/sbin/udhcpc
./40000/sbin/udhcpd
./40000/sys
./40000/tmp
./40000/usr
./40000/usr/lib
./40000/usr/share
./40000/utils
./40000/var
./40000/var/run
./40000/var/run/utmp
./40000/var/tmp
./40000/xm_version
./40000/xm_version/buildtime
./580000
./580000.squashfs
./580000/bin
./580000/bin/App
./580000/bin/ProductDefinition
./580000/bin/Squirrel
./580000/bin/Squirrel/ptz
./580000/bin/Squirrel/ptz/MainPtz
./580000/bin/Squirrel/ptz/PELCOD.nut
./580000/bin/Squirrel/ptz/PELCOP.nut
./580000/bin/Squirrel/ptz/PtzBase
./580000/bin/Squirrel/rs485
./580000/bin/Squirrel/rs485/GPS.nut
./580000/bin/Squirrel/rs485/InteractCmd.nut
./580000/bin/Squirrel/rs485/MainRS485
./580000/bin/Squirrel/rs485/RS485Base
./580000/bin/Squirrel/rs485/TelPubBase
./580000/bin/Squirrel/rs485/Transparent.nut
./580000/bin/Squirrel/rs485/TransparentBase
./580000/bin/XmDemux
./580000/bin/XmEnv
./580000/bin/XmGpio
./580000/bin/XmNetPhy
./580000/etc
./580000/etc/loadmod
./580000/etc/loadpublic
./580000/jsons
./580000/jsons/GK7205V300_CHIP_INFO.json
./580000/jsons/GK7205V300_IPC_G5F_LIBXMCAP.json
./580000/jsons/GK7205V300_IPC_G5F_LIBXMDVR.json
./580000/jsons/GK7205V300_IPC_G5F_LIBXMVIDEO.json
./580000/jsons/GK7205V300_IPC_G5F_XMSERVICES_MGR.json
./580000/jsons/IPC_PRODUCT_TYPES.json
./580000/jsons/IPC_UNKNOWN_LIBXMCAP.json
./580000/jsons/IPC_UNKNOWN_LIBXMDVR.json
./580000/jsons/IPC_UNKNOWN_LIBXMVIDEO.json
./580000/jsons/IPC_UNKNOWN_XMSERVICES_MGR.json
./580000/jsons/LIBXMCAP_Sensors.json
./580000/jsons/LIBXMVIDEO_Sensors.json
./580000/lib
./580000/lib/modules
./580000/lib/modules/Load_GK7205V300
./580000/lib/modules/gk7205v200_acodec.ko
./580000/lib/modules/gk7205v200_adec.ko
./580000/lib/modules/gk7205v200_aenc.ko
./580000/lib/modules/gk7205v200_ai.ko
./580000/lib/modules/gk7205v200_aio.ko
./580000/lib/modules/gk7205v200_ao.ko
./580000/lib/modules/gk7205v200_base.ko
./580000/lib/modules/gk7205v200_chnl.ko
./580000/lib/modules/gk7205v200_h264e.ko
./580000/lib/modules/gk7205v200_h265e.ko
./580000/lib/modules/gk7205v200_isp.ko
./580000/lib/modules/gk7205v200_ive.ko
./580000/lib/modules/gk7205v200_jpege.ko
./580000/lib/modules/gk7205v200_rc.ko
./580000/lib/modules/gk7205v200_rgn.ko
./580000/lib/modules/gk7205v200_sys.ko
./580000/lib/modules/gk7205v200_tde.ko
./580000/lib/modules/gk7205v200_vedu.ko
./580000/lib/modules/gk7205v200_venc.ko
./580000/lib/modules/gk7205v200_vgs.ko
./580000/lib/modules/gk7205v200_vi.ko
./580000/lib/modules/gk7205v200_vpss.ko
./580000/lib/modules/gk7205v200_wdt.ko
./580000/lib/modules/isp_piris.ko
./580000/lib/modules/isp_pwm.ko
./580000/lib/modules/isp_sensor_i2c.ko
./580000/lib/modules/isp_sensor_spi.ko
./580000/lib/modules/mipi_rx.ko
./580000/lib/modules/osal.ko
./580000/lib/modules/sysconfig.ko
./580000/res
./580000/res/ivp_re_allday_f1y4f2m3_640x360_v1006.oms
./580000/sbin
./580000/sbin/AppRun.sh
./580000/sbin/media
./580000/sbin/mnt
./580000/sbin/run_loop
./580000/sbin/xmprop
./580000/share
./580000/share/music
./580000/share/music/huanyingguanglin.pcm
./580000/share/music/huanyingguanglin_english.pcm
./580000/share/music/jiankongquyu.pcm
./580000/share/music/jiankongquyu_english.pcm
./580000/share/music/jingjiequyu.pcm
./580000/share/music/jingjiequyu_english.pcm
./580000/share/music/sirenlingyu.pcm
./580000/share/music/sirenlingyu_english.pcm
./580000/share/music/xiaojiaojingbao.pcm
./580000/share/zoneinfo
./580000/share/zoneinfo/GMT+0
./580000/share/zoneinfo/GMT+120
./580000/share/zoneinfo/GMT+180
./580000/share/zoneinfo/GMT+210
./580000/share/zoneinfo/GMT+240
./580000/share/zoneinfo/GMT+300
./580000/share/zoneinfo/GMT+360
./580000/share/zoneinfo/GMT+420
./580000/share/zoneinfo/GMT+480
./580000/share/zoneinfo/GMT+540
./580000/share/zoneinfo/GMT+60
./580000/share/zoneinfo/GMT+600
./580000/share/zoneinfo/GMT+660
./580000/share/zoneinfo/GMT+720
./580000/share/zoneinfo/GMT-120
./580000/share/zoneinfo/GMT-180
./580000/share/zoneinfo/GMT-210
./580000/share/zoneinfo/GMT-240
./580000/share/zoneinfo/GMT-270
./580000/share/zoneinfo/GMT-300
./580000/share/zoneinfo/GMT-330
./580000/share/zoneinfo/GMT-345
./580000/share/zoneinfo/GMT-360
./580000/share/zoneinfo/GMT-390
./580000/share/zoneinfo/GMT-420
./580000/share/zoneinfo/GMT-480
./580000/share/zoneinfo/GMT-525
./580000/share/zoneinfo/GMT-540
./580000/share/zoneinfo/GMT-570
./580000/share/zoneinfo/GMT-60
./580000/share/zoneinfo/GMT-600
./580000/share/zoneinfo/GMT-660
./580000/share/zoneinfo/GMT-720
./580000/share/zoneinfo/GMT-780
./580000/xm_version
./580000/xm_version/buildtime
./CC0000
./CC0000.cramfs
./CC0000/Fonts
./CC0000/Fonts/Font.bin
./CC0000/alert.html
./CC0000/css
./CC0000/css/RSUI.css
./CC0000/css/close.png
./CC0000/css/main.css
./CC0000/css/ocxTip.png
./CC0000/index.htm
./CC0000/js
./CC0000/js/LAB.min.js
./CC0000/js/base64.js
./CC0000/js/jcookie.js
./CC0000/js/jquery-3.5.0.min.js
./CC0000/js/jquery.form.js
./CC0000/js/jquery.mousewheel.js
./CC0000/js/jquery.qrcode.min.js
./CC0000/js/jsbn.js
./CC0000/js/json.js
./CC0000/js/main.js
./CC0000/js/md5-min.js
./CC0000/js/prng4.js
./CC0000/js/protocolcheck.js
./CC0000/js/rng.js
./CC0000/js/rsa.js
./CC0000/js/xmlhttp.js
./CC0000/pluginVersion.js
./CC0000/xm_version
./CC0000/xm_version/buildtime
./E40000
./E40000.cramfs
./E40000/CustomConfig
./E40000/CustomConfig/AVEnc.custom
./E40000/CustomConfig/Ability.custom
./E40000/CustomConfig/AppDowloadLink.custom
./E40000/CustomConfig/Camera.custom
./E40000/CustomConfig/Detect.custom
./E40000/CustomConfig/ExtDevIDConfig.custom
./E40000/CustomConfig/NetWork.custom
./E40000/CustomConfig/OEMcfg.custom
./E40000/CustomConfig/Uart.custom
./E40000/Dot
./E40000/Dot/0.dot
./E40000/FirmwareInfo
./E40000/ProductDefinition
./E40000/data
./E40000/data/Fonts
./E40000/data/Fonts/Font.bin
./E40000/data/Fonts/FontGB2312.bin
./E40000/data/Strings
./E40000/data/Strings/Arabic
./E40000/data/Strings/Brazilian
./E40000/data/Strings/Bulgarian
./E40000/data/Strings/ChineseEnglish
./E40000/data/Strings/Czech
./E40000/data/Strings/Dutch
./E40000/data/Strings/English
./E40000/data/Strings/Farsi
./E40000/data/Strings/Finnish
./E40000/data/Strings/French
./E40000/data/Strings/German
./E40000/data/Strings/Greek
./E40000/data/Strings/Hebrew
./E40000/data/Strings/Hungarian
./E40000/data/Strings/Indonesian
./E40000/data/Strings/Italian
./E40000/data/Strings/Japanese
./E40000/data/Strings/Poland
./E40000/data/Strings/Portugal
./E40000/data/Strings/Romanian
./E40000/data/Strings/Russian
./E40000/data/Strings/SimpChinese
./E40000/data/Strings/Slovakia
./E40000/data/Strings/Spanish
./E40000/data/Strings/Swedish
./E40000/data/Strings/Thai
./E40000/data/Strings/TradChinese
./E40000/data/Strings/Turkey
./E40000/data/Strings/Vietnamese
./E40000/xm_version
./E40000/xm_version/buildtime
./flash.bin
./u-boot.bin
stipe-jurkovic commented 10 months ago

I used the openipc burn utility, worked well