search

bmork / defogger

D-Link DCS-8000LH usage info and defogging tools
264 stars 37 forks source link

Firmware upgraded to 2.07.01 last night :-( #23

Open smd100 opened 3 years ago

smd100 commented 3 years ago

Hi all. Both my DCS8100LH upgraded their firmware last night from 2.01 to 2.07. I had always switched auto upgrade off, but after a reboot, they must have switched on again. Anyway, the long and the short is that Port 80 is now closed.

I can still run dcs8000lh-configure.py ok for 'survey' and connecting to wifi network, but can no longer stream MJPEG locally. The real bummer is that I can't downgrade firmware as it refuses connection when I run 'firmwareupgrade.cgi' with old .bin fw file.

Just checking, but is my only option to downgrade to use serial port with USB-TTL adaptor? Or are there any known tricks? (Ports 8080 (http-alt), 8081 (sunproxyadmin), 8088 (radan-http) and 24923 (unknown) are still open according to a scanner, but none allow connection.)

smd100 commented 3 years ago

OK. Bit the bullet and opened the camera up. The 4 holes for the serial connector is there, but on the 8100, not lucky enough to have a socket. I had to solder 4 wires on the circuit board. Identified the wires (same as 8000) and connected to my USB serial-TTL device. Launched a serial console (Putty) with 57600 8N1, but just garbage goes to console. It seems to be writing info to the console as it boots, and the correct lights are flashing on the USB adaptor, but can't read the output.

Tried a few different data rates and stop bits, etc, but no joy. So annoying - I feel so close!

Any suggestions?

smd100 commented 3 years ago

Right, got it! Needed to use speed of 38400 and I can read everything. However, new problem. Gives me a Linux login prompt. Stuck...

bmork commented 3 years ago

Right, got it! Needed to use speed of 38400 and I can read everything. However, new problem. Gives me a Linux login prompt. Stuck...

Are you able to break into the boot loader using the procdure and password as documented at https://github.com/bmork/defogger#u-boot ?

Assuming this is similar to the DCS-8000LH, then you won't be able to see the password as you type it and there is a very short timeout. So you might want to prepare for quick cut and paste of the password at the right moment.

And, obviously, they might have used another password or some other protection.

smd100 commented 3 years ago

No, not quite the same. It says "Hit any key to stop autoboot" - if I hit any key or paste anything (including pasting 'alpha168') within half a second or so, it goes straight to the (non-root?) U-Boot command line. Also, I looked at the 8100LH source code from D-Link, but no conf files with any passwords in them.

U-Boot version is: U-Boot 2009.06-2.0.6-00127-g098908e-dirty ( 8月 07 2020 - 14:25:17)

with available commands:

U-Boot> ?
?       - alias for 'help'
alphaboot- ALPHA Boot
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dce     - DCE
echo    - echo args to console
efuse   - eFuse read/write
go      - start application at address 'addr'
gpio    - Set gpio pins
help    - print online help
jump    - Boot Linux kernel image from memory
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mmc     - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest   - simple RAM test
mw      - memory write (fill)
nand    - NAND sub-system
nm      - memory modify (constant address)
printenv- print environment variables
reserved- print reserved area
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
sdread  - Read SD card content
setenv  - set environment variables
setnet  - Set net environment variables for EVM.
sleep   - delay execution for some time
source  - run script from memory
tftpboot- boot image via network using TFTP protocol
version - print monitor version

Also the environment (printenv) is different:

Hit any key to stop autoboot:  0
U-Boot> printenv
bootargs=root=/dev/ram0 ro initrd=0x3000000,8M mem=160M bootldrversion=1.0.2 console=2,${baudrate} mmc_delay_tuning=0
bootcmd=run setargs;nand read 0xa00000 0x1E0040 0x22FFFC0;jump 0xa00000
bootdelay=1
baudrate=38400
ethaddr=00:00:00:00:00:00
ipaddr=0.0.0.0
serverip=172.17.0.6
gatewayip=172.17.0.1
netmask=255.255.0.0
mtdparts=mtdparts=M3C-nand:1280k(nand-bootldr),640k(nand-env),4m(nand-kernel),16m(nand-rootfs),-(nand-ubifs)
phy_mode=rmii
setargs=setenv bootargs ${bootargs},${baudrate};setenv bootargs ${bootargs} phy_mode=${phy_mode};
modelname=M388c
partition=0

Environment size: 568/65532 bytes

If I try to run the bootcmd (with or without preceding with setenv bootargs ${bootargs} init=/bin/sh), it will go to a Linux login prompt (I don't know the login).

Here is the boot log (from plugging in the power and not hitting a key to stop autoboot):

U-Boot 2009.06-2.0.6-00127-g098908e-dirty ( 8月 07 2020 - 14:25:17)

=== U-Boot DDR Reserved Area ===
  !! Please do not write any data to these locations. !!
  TEXT section  : 0x00002000 -> 0x000268c0
  BSS  section  : 0x000268c0 -> 0x0002af70
  MALLOC Area   : 0x0002af70 -> 0x0032af70
  STACK         : 0x0032aff0 -> 0x00375ffc
  GMAC Desc/Buf : 0x00376000 -> 0x00382200

=== DRAM Configuration ===
  Bank #0      : 0x00000000 256 MB

=== NAND Configuration ===
SPIFLASH: Got idcode ff ef aa 21 00
SF: Detected W25NO1GVSF1G with page size 2048, total 128 MB
  Flash Type   : SPI NAND Flash Chip.
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
  Chip Size    : 128 MiB

=== Boot Configuration ===
  Boot Storage : Serial NAND Flash
  Finding the environment variables in boot storage...
  The environment varialbes stored in Nand Flash are found.

  PHY TYPE     : Generic PHY(rmii)
  Link Detect  :   Link Status  : Link Up
               : Half-Duplex
  Link Speed   : 10Mbps
  MAC Address  : 00 00 00 00 00 00

=== Model Name ===
  Model Name : M388c

=== Loader Info ===
  Loader Version# : 0x20080714 (This value is stored at 0x41001000)

Hit any key to stop autoboot:  0

NAND read: device 0 offset 0x1e0000, size 0x40
NAND Reading : #
 64 bytes read: OK

NAND read: device 0 offset 0xe55ca9, size 0x24
NAND Reading : #
 36 bytes read: OK

NAND read: device 0 offset 0x38e0000, size 0x40
NAND Reading : #
 64 bytes read: OK

NAND read: device 0 offset 0x45aede9, size 0x24
NAND Reading : #
 36 bytes read: OK

NAND read: device 0 offset 0x1e0040, size 0xc75c69
NAND Reading : ####################################################################################################
 13065321 bytes read: OK
ALPHA Boot #A (1,1,1,0)...
Saving Environment to NAND...
Erasing Nand...
Erasing at 0x1c0000 -- 100% complete.
Writing to Nand... done
## Booting Linux kernel at 0x00a00000 ...
Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 3.10.49 (jenkins@DMdssdFW1) (gcc version 4.9.3 (Buildroot 2014.08) ) #1 PREEMPT Fri Aug 7 15:18:58 CST 2020
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: VATICS Pesaro SoC (Flattened Device Tree), model: Pesaro SoC
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 40640
Kernel command line: root=/dev/ram0 ro initrd=0x3000000,8M mem=160M bootldrversion=1.0.2 console=2,${baudrate} mmc_delay_tuning=0,38400 phy_mode=rmii
dwmmc: Delay tuning ... 0!
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 160MB = 160MB total
Memory: 138364k/138364k available, 25476k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xca800000 - 0xff000000   ( 840 MB)
    lowmem  : 0xc0000000 - 0xca000000   ( 160 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc05309c4   (5283 kB)
      .init : 0xc0531000 - 0xc0f02564   (10054 kB)
      .data : 0xc0f04000 - 0xc0f3ab10   ( 219 kB)
       .bss : 0xc0f3ab10 - 0xc0f50690   (  87 kB)
Preemptible hierarchical RCU implementation.
NR_IRQS:16 nr_irqs:16 16
SYSC counter at clock 12000000
TMRC at APB bus clock 100000000
vpl_sys_timer_init virq 16
sched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps every 4294967286ms
Console: colour dummy device 80x30
Calibrating delay loop... 298.59 BogoMIPS (lpj=1492992)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0xc03fc638 - 0xc03fc674
devtmpfs: initialized
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
lm device registered, virq: 31!
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Advanced Linux Sound Architecture Driver Initialized.
Bluetooth: Core ver 2.16
NET: Registered protocol family 31
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource sysc_freerun_counter
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (junk in compressed archive); looks like an initrd
Freeing initrd memory: 8192K (c3000000 - c3800000)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
msgmni has been set to 286
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
ab800000.serial: ttyS0 at MMIO 0xab800004 (irq = 18) is a 16550A
ac800000.serial: ttyS2 at MMIO 0xac800004 (irq = 19) is a 16550A
console [ttyS2] enabled
ad000000.serial: ttyS3 at MMIO 0xad000004 (irq = 20) is a 16550A
brd: module loaded
dws->irq  17, get 17
dws->max_freq 100000000
dw_spi_mmio a0800000.spi: master is unqueued, this is deprecated
 id: ef aa
NAND device: Manufacturer ID: 0xef, Chip ID: 0xaa (Unknown Windbond W25N01GV 1G 3.3V SPI), 128MiB, page size: 2048, OOB size: 64
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
14 ofpart partitions found on MTD device spi0.0
Creating 14 MTD partitions on "spi0.0":
0x000000000000-0x000007fe0000 : "ALL"
0x000000000000-0x000000140000 : "U-Boot"
0x000000140000-0x0000001e0000 : "Env"
0x0000001e0000-0x0000024e0000 : "Kernel1"
0x0000024e0000-0x0000038e0000 : "Webfs1"
0x0000038e0000-0x000005be0000 : "Kernel2"
0x000005be0000-0x000006fe0000 : "Webfs2"
0x000006fe0000-0x000007100000 : "Pib"
0x000007100000-0x000007220000 : "TinyDB"
0x000007220000-0x000007340000 : "Log"
0x000007340000-0x000007460000 : "TinyDB Backup"
0x000007460000-0x000007580000 : "Log Backup"
0x000007580000-0x000007980000 : "User"
0x000007980000-0x000007fe0000 : "Share"
GMAC: PHY mode is rmii
stmmac - user ID: 0x10, Synopsys ID: 0x40
 DMA HW capability register supported
 RX Checksum Offload Engine supported
 TX Checksum insertion supported
clk rate 200000000
        eth0 - (dev. name: 90000000.dw_eqos - id: -1, IRQ #0
        IO base addr: 0xca95c000)
libphy: dweqos_mdio: probed
PPP generic driver version 2.4.2
NET: Registered protocol family 24
vpl_rtc aa800000.vpl_rtc: rtc core: registered aa800000.vpl_rtc as rtc0
vpl_rtc aa800000.vpl_rtc: VPL Real Time Clock Hardware Rev 0x01000000
vpl_rtc aa800000.vpl_rtc: Driver Version 1.0.0.0
i2c /dev entries driver
vpl_wdt ad800000.vpl_wdt: VPL Watchdog Timer Hardware Rev 0x01020000
vpl_wdt ad800000.vpl_wdt: Driver Version 1.0.0.0: initial timeout 30 sec
Bluetooth: HCI UART driver ver 2.2
Bluetooth: HCI BCSP protocol initialized
Synopsys Designware Multimedia Card Interface Driver
dwmmc_pesaro 92000000.dwmmc0: using uhs-gpio:47
dwmmc_pesaro 92000000.dwmmc0: dev-id: 0
dwmmc_pesaro 92000000.dwmmc0: Using internal DMA controller.
dwmmc_pesaro 92000000.dwmmc0: Version ID is 270a
dwmmc_pesaro 92000000.dwmmc0: DW MMC controller at irq 23, 32 bit host data width, 16 deep fifo
dwmmc_pesaro 92000000.dwmmc0: 1 slots initialized
soc-audio soc-audio.0: ASoC: machine pesaro_evm should use snd_soc_register_card()
mmc_host mmc0: Bus speed (slot 0) = 100000000Hz (slot req 50000000Hz, actual 50000000HZ div = 1)
mmc0: new high speed SDHC card at address 0001
mmcblk0: mmc0:0001 00000 29.8 GiB
 mmcblk0: p1
soc-audio soc-audio.0:  dwc-hifi <-> vatics-pcm mapping ok
soc-audio soc-audio.0:  hdmi-hifi <-> vatics-pcm mapping ok
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
vpl_rtc aa800000.vpl_rtc: setting system clock to 1970-01-01 00:00:19 UTC (19)
pll mod is 0
dvfs_table[0]: freq 200000khz
dvfs_table[1]: freq 400000khz
dvfs_table[2]: freq 600000khz
ALSA device list:
  #0: pesaro_evm
Freeing unused kernel memory: 10052K (c0531000 - c0f02000)
init started: BusyBox v1.20.2 (2020-08-07 14:27:44 CST)
starting pid 626, tty '': '/etc/rc.d/rcS start'
mount: mounting none on /proc/bus/usb failed: No such file or directory
FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
get SString failed: group:System key Model , ret = -6
ln: /mnt/sdcard/usb: Operation not permitted
UBI: attaching mtd13 to ubi0
UBI: scanning is finished
UBI: attached mtd13 (name "Share", size 6 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 48, bad PEBs: 3, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 14/8, WL threshold: 4096, image sequence number: 1704797167
UBI: available PEBs: 0, total reserved PEBs: 48, PEBs reserved for bad PEB handling: 17
UBI: background thread "ubi_bgt0d" started, PID 678
UBI device number 0, total 48 LEBs (6094848 bytes, 5.8 MiB), available 0 LEBs (0UBIFS: background thread "ubifs_bgt0_0" started, PID 681
 bytes), LEB size 126976 bytes (124.0 KiB)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 2158592 bytes (2 MiB, 17 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
UBIFS: reserved for root: 101955 bytes (99 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID B584E9AC-323C-411C-B380-2BF2F1A50EA8, small LPT model
============ normal mode ===============
dwc_otg: version 3.0.0.6(3.10a 21-DEC-2012)
install...
stschng dirent c37ffd08
dwc_otg lm0: version 0e010004
dwc_otg lm0:  Host only
dwc_otg lm0: USB PHY value =  0x9d1c06e4 delay = 0xff00, usb_phy_clk = 0x4cb
Core Release: 3.10a
Setting default values for core params
Setting core params with module parameters
Using Buffer DMA mode
Periodic Transfer Interrupt(PTI) Enhancement - disabled
Multiprocessor Interrupt(MPI) Enhancement - disabled
OTG VER PARAM: 0, OTG VER FLAG: 0
dwc_otg lm0: DWC OTG Controller
dwc_otg lm0: new USB bus registered, assigned bus number 1
dwc_otg lm0: irq 31, io mem 0x00000000
Init: Power Port (0)
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
VPL_EDMC: initialized (driver 6.1.0.6 HW 14.6.0.2) Jan 18 2016 15:53:40
DRAM 0 base address = 0x0A000000, size = 0x06000000
Install VPL_DMAC device driver version 1.0.0.4 on VPL_DMAC hardware version 2.1.0.0 complete !!
Install VMA_JEBE device driver version 2.0.0.4 on VMA_JEBE hardware version 1.4.0.23 complete !!
Indeed it is in host mode hprt0 = 00021501
Install VMA_H4CDE device driver version 2.0.0.7 on VMA_H4EE hardware version 16.1.0.43 complete !!
Install VMA_ISPE device driver version 7.0.0.2 on VMA_ISPE hardware version 4.7.0.3 complete !!
Install VMA_MEAE device driver version 1.0.0.3 on VMA_MEAE hardware version 8.4.0.6 complete !!
Install VMA_DCE device driver version 1.0.0.1 on VMA_DCE hardware version 5.0.0.4 complete !!
Install VPL_VIC device driver version 5.0.0.0 on VPL_VIC hardware version 7.0.0.12 complete !!
usb 1-1: new high-speed USB device number 2 using dwc_otg
Indeed it is in host mode hprt0 = 00001101
[PS5230]: driver version 1.0.0.4 for device 1 (width=1920 height=1080) insmod success.
[PS5230]: PS5230 I2C detect port:1 addr:0x90 (Usr set : port:1 1 addr:0x90 0x90)
Install autoexposure driver version 8.0.0.0 complete !!
Install autowhitebalance driver version 5.0.0.0 complete !!
RTW: module init start
RTW: rtl8188eu v5.2.2.3_24783.20171030
RTW: build time: Aug  7 2020 14:19:30
bFWReady == _FALSE call reset 8051...
RTW: 0x000: 29 81 00 6C 0B 00 00 00    00 0C 00 00 00 00 00 00
RTW: 0x010: 2B 2B 2B 29 29 29 2E 2E    2E 2C 2C 01 FF FF FF FF
RTW: 0x020: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x030: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x040: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x050: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x060: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x070: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x080: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x090: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x0a0: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x0b0: FF FF FF FF FF FF FF FF    20 20 1A 00 00 00 00 00
RTW: 0x0c0: 00 00 00 10 00 00 00 00    00 03 FF FF FF FF FF FF
RTW: 0x0d0: DA 0B 79 01 42 66 00 C0    21 0D A1 D4 20 09 03 52
RTW: 0x0e0: 65 61 6C 74 65 6B 0D 03    38 30 32 2E 31 31 6E 20
RTW: 0x0f0: 4E 49 43 00 FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x100: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x110: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x120: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x130: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x140: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x150: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x160: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x170: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x180: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x190: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x1a0: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x1b0: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x1c0: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x1d0: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x1e0: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF
RTW: 0x1f0: FF FF FF FF FF FF FF FF    FF FF FF FF FF FF FF FF

RTW: hal_com_config_channel_plan country code:"FR" with chplan:0x26
RTW: rtw_regsty_chk_target_tx_power_valid return _FALSE for band:0, path:0, rs:0, t:-1
RTW: rtw_ndev_init(wlan0) if1 mac_addr=b0:c5:54:47:ef:37
usbcore: registered new interface driver rtl8188eu
RTW: module init ret=0
Setup db... ok.
Starting dbd... set /etc/TZ from db
ok.
We have to reset BLE operation mode.
ok.
set the date to default:
Fri Aug  7 12:00:00 AEST 2020
FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
Device setup complete
Loading PSKEY_BDADDR ... done
Loading PSKEY_ANA_FTRIM ... done
Loading PSKEY_ANA_FREQ ... done
Loading 0x01ea ... done
Loading PSKEY_HQ_HOST_TIMEOUT ... done
Loading 0x2175 ... done
Device setup complete
Startting dbus-daemon... ok.
Startting bluetoothd... rc.sysinit start ok.
wpa_supplicant v2.0-devel_rtw_r24640.20171025
define REALTEK_WIFI_VENDOR

Successfully initialized wpa_supplicant
rfkill: Cannot open RFKILL control device
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
nl80211: no Using driver-based off-channel TX
rc.sysextra start ok.
Starting syslogd... ok.
Starting watchdog... ok.
==> rtl8188e_iol_efuse_patch
RTW: wlan0- hw port(0) mac_addr =b0:c5:54:47:ef:37
IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
device wlan0 entered promiscuous mode
br0: port 1(wlan0) entered forwarding state
br0: port 1(wlan0) entered forwarding state
Before `hciconfig hci0 up`.
Before `hciconfig hci0 noleadv`.
Selected interface 'wlan0'
FAIL
Selected interface 'wlan0'
OK
Selected interface 'wlan0'
0
Selected interface 'wlan0'
OK
Selected interface 'wlan0'
OK
Selected interface 'wlan0'
OK
Selected interface 'wlan0'
OK
Selected interface 'wlan0'
OK
Before `hciconfig hci0 noscan`.
Before `hciconfig hci0 pscan'.
Before send scan response.
Before set advertisement interval.
Before send advertising data.
br0: port 1(wlan0) entered forwarding state
Selected interface 'wlan0'
OK
Selected interface 'wlan0'
OK
RTW: rtw_set_802_11_connect(wlan0)  fw_state=0x00000000
1069
udhcpc: option -h NAME is deprecated, use -x hostname:NAME
udhcpc (v1.20.2) started
RTW: start auth
RTW: auth success, start assoc
Sending discover...
zcip is not running.
portForwarder is not running.
Starting rtspd... ok.
Startting mDNSResponder... Starting Apple Darwin Multicast DNS / DNS Service Discovery daemon: mdnsd.
Starting ntpd... disabled.
starting create_certificate...RTW: rtw_set_802_11_connect(wlan0)  fw_state=0x00000008
get server.pem... ok.
RTW: start auth
RTW: auth success, start assoc
RTW: assoc success
Sending discover...
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
RTW: recv eapol packet
RTW: send eapol packet
RTW: recv eapol packet
RTW: send eapol packet
RTW: set pairwise key camid:4, addr:38:6b:1c:27:26:5d, kid:0, type:AES
RTW: set group key camid:5, addr:38:6b:1c:27:26:5d, kid:1, type:AES
Starting lighttpd... Password for 'root' changed
Starting lighttpd_ssl... Sending discover...
Sending select for 192.168.1.21...
get Byte failed: group:HTTPServer key:WebAccess2 , ret = -1
Lease of 192.168.1.21 obtained, lease time 268435455
deleting routers
route: ioctl 0x890c failed: No such process
adding dns 192.168.1.1
mDNSResponder is not running.
Start to use memory manager library version 4.1.0.0 !!
Open EDMC device driver version 6.1.0.6 successful !!
signal is strong in stage 1.
ok.

use hardware ssl.
Engine not found
load ssl lib is done.
mDNSResponder(1557) is already running.
ok.
normal mode, disable web
Starting vcd... ok.
Starting acd... ok.
Startting db_analysis... ok.
Starting firewall...ok.
PLL Unlock....
Startting myDlinkEvent... ok.
2020-08-07 12:00:29 | INFO    | tcp_listen               |  176| listening 127.0.0.1:7000
2020-08-07 12:00:29 | INFO    | http_listen              |   40| waiting new connections ...
Startting mydlink_watchdog.sh...
[PS5230]: Open device 1 done
[VIC] : open success!!
rtspd(1145) is already running.
[VIC] : open success!!
Starting portForwarder... ok.
Password for 'root' changed
rc.extra start ok.
Enter stage 2.
start agent
rc.local start ok.
reloading /etc/inittab
starting pid 1732, tty '': '/bin/busybox getty -L ttyS2 38400 vt100'

DCS-8100LH login:
iddys commented 3 years ago

I'm in the same boat as you. I have a 8100lh and soldered wires onto the uart and connected at 38400. I don't get dropped into root. It's almost as if they have changed it to so you can't type in the password with the "press any key" option rather than press 'esc'

smd100 commented 3 years ago

I'm in the same boat as you. I have a 8100lh and soldered wires onto the uart and connected at 38400. I don't get dropped into root. It's almost as if they have changed it to so you can't type in the password with the "press any key" option rather than press 'esc'

What is your fw version? Has port 80 been closed?

Also, something that seems weird to me is that the version of U-Boot for the latest 8100LH FW (2.07) is from Jun 2009, yet in Bjørn's serial output for the 8000LH, the U-Boot version is from Jan 2014. Why is the latest 8100LH FW using such an old version of U-Boot?

iddys commented 3 years ago

yup, port 80 has been blocked for me as well. I'm considering running a brute force over telnet to get root access

smd100 commented 3 years ago

yup, port 80 has been blocked for me as well. I'm considering running a brute force over telnet to get root access

Good luck. Let me know if you have any joy...

shulogsm commented 2 years ago

Tested with alpha168 password and all was done OK, but i need to manually activate http light server on each reboot using serial dongle. It doesn't auto start on boot. Note that correct baudrate for me was 57600.

fozter commented 2 years ago

Tested with alpha168 password and all was done OK, but i need to manually activate http light server on each reboot using serial dongle. It doesn't auto start on boot. Note that correct baudrate for me was 57600.

Did you have any success on getting the http server to auto boot?

shulogsm commented 2 years ago

Yes, finally its working now after some testing with configuration (i had to reflash several time until it worked). It was a memory problem so try to play with config parameters and finally mine is working and perfectly configured with Home Assistant.

alexkutsan commented 2 years ago

Have the same situation, Port 80 is blocked. I don't have Serial2USB dongle. Is there any other option to enable rtsp without serial console?

shulogsm commented 2 years ago

I didn´t find other solution, sorry. A Serial2USB dongle is really cheap, i suggest you to adquire one.

FS1961 commented 1 year ago

I have a DCS-8000LH with f/w 2.07.01. Only need rtsp. Is the only way now with the serial2usb dongle?

shulogsm commented 1 year ago

FS1961

I only get it working using serial2usb. It´s pretty easy to do but need the dongle.

FS1961 commented 1 year ago

Okay, I'll order the dongle. Can I use any host (Win/Mac/VM?)

shulogsm commented 1 year ago

Okay, I'll order the dongle. Can I use any host (Win/Mac/VM?)

I have tested only on Mac and Windows. Both working.

FS1961 commented 1 year ago

Let me rephrase. Can I flash from Win/Mac host? Just trying to be clear. Not the viewing.

I’ve ordered the dongle. I hope to do this over the weekend.

shulogsm commented 1 year ago

Let me rephrase. Can I flash from Win/Mac host? Just trying to be clear. Not the viewing.

I’ve ordered the dongle. I hope to do this over the weekend.

Correct! I have successfully flashed devices from MacOs and from Windows host machines.

FS1961 commented 1 year ago

Let me rephrase. Can I flash from Win/Mac host? Just trying to be clear. Not the viewing. I’ve ordered the dongle. I hope to do this over the weekend.

Correct! I have succefully flashed devices from MacOs and from Windows host machines.

Okay, perfect! Thanks!

gysmo38 commented 1 year ago

@shulogsm

Yes, finally its working now after some testing with configuration (i had to reflash several time until it worked). It was a memory problem so try to play with config parameters and finally mine is working and perfectly configured with Home Assistant.

I failed to downgrade the camera. I follow steps to curl command withoout problem. When I use curl command, it process for some seconds and the camera reboot with same firmware. Can you explain how and witch parameters do you play with?

shulogsm commented 1 year ago

@shulogsm

Yes, finally its working now after some testing with configuration (i had to reflash several time until it worked). It was a memory problem so try to play with config parameters and finally mine is working and perfectly configured with Home Assistant.

I failed to downgrade the camera. I follow steps to curl command withoout problem. When I use curl command, it process for some seconds and the camera reboot with same firmware. Can you explain how and witch parameters do you play with?

Too many time since i flashed my devive, but my problems where after flashing and not for flashing. Camera has low memory, so if you activate too much options, software will restart.

gysmo38 commented 1 year ago

@shulogsm Thank you for the answer :) I manage to flash but when the camera reboot, I have No filesystem could mount root, tried: squashfs vfat msdos Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,8)

gysmo38 commented 1 year ago

Hello, After sending 2.02 firmware I get this error

List of all partitions:
1f00             256 mtdblock0  (driver?)
1f01             128 mtdblock1  (driver?)
1f02            1024 mtdblock2  (driver?)
1f03             128 mtdblock3  (driver?)
1f04             128 mtdblock4  (driver?)
usb 1-1: New USB device found, idVendor=0bda, idProduct=b720
1f05             128 mtdblock5 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
 (driver?)
1f06             128 mtdblock6 usb 1-1: Product: 802.11n WLAN Adapter
usb 1-1: Manufacturer: Realtek
 (driver?)
1f07            3072 mtdblock7 usb 1-1: SerialNumber: 00e04c000001
 (driver?)
1f08           11264 mtdblock8  (driver?)
No filesystem could mount root, tried:  squashfs vfat msdos
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,8)

Is there a solution to fix this? I try send again the firmware with serial, but same issue.

FS1961 commented 6 months ago

FS1961

I only get it working using serial2usb. It´s pretty easy to do but need the dongle.

@shulogsm - how about I send this to you? This is more complicated than my abilities. Current f/w is 2.07.01.

shulogsm commented 6 months ago

FS1961

I only get it working using serial2usb. It´s pretty easy to do but need the dongle.

@shulogsm - how about I send this to you? This is more complicated than my abilities. Current f/w is 2.07.01.

@FS1961 - I think delivery costs will be higher than buy a new one in Aliexpress, but if you want send, i can try ;-)

FS1961 commented 6 months ago

FS1961

I only get it working using serial2usb. It´s pretty easy to do but need the dongle.

@shulogsm - how about I send this to you? This is more complicated than my abilities. Current f/w is 2.07.01.

@FS1961 - I think delivery costs will be higher than buy a new one in Aliexpress, but if you want send, i can try ;-)

Where are you located? I'm in Germany.

shulogsm commented 6 months ago

@FS1961 - Spain

FS1961 commented 6 months ago

@shulogsm - I pulled the sticker back and found the holes are quite small. I think I'll try and remove the bottom panel but I think it's going to be like the other person who had to solder the pins in.

If I can get the pins in, do I use Putty to interface with the serial console?

shulogsm commented 6 months ago

Yes, of course, you can use putty if you are using Windows.

FS1961 commented 6 months ago

Yes, of course, you can use putty if you are using Windows.

What about for Mac?

shulogsm commented 6 months ago

Take a look here. You can use screen, minicom or search for a Gui App. Hope this info could help you.

FS1961 commented 6 months ago

So I pulled the label back and the 4 pin holes are way too small. I tried opening the case but the screw instantly stripped. I give up. Just gonna buy a new camera.

bmork commented 6 months ago

So I pulled the label back and the 4 pin holes are way too small.

Not sure I understand the issue. If this is like the pictures on https://github.com/bmork/defogger?tab=readme-ov-file#serial-console then there is no need to unscrew or solder anything. There's a female pin header already in place behind those holes. Just insert suitable pins or wires into the TX, RX and GND holes.

Unless they changed the hardware from my very old camera, of course...

FS1961 commented 6 months ago

So I pulled the label back and the 4 pin holes are way too small.

Not sure I understand the issue. If this is like the pictures on https://github.com/bmork/defogger?tab=readme-ov-file#serial-console then there is no need to unscrew or solder anything. There's a female pin header already in place behind those holes. Just insert suitable pins or wires into the TX, RX and GND holes.

Unless they changed the hardware from my very old camera, of course...

Okay, I pulled the pins out of the header block and they fit now. I'll keep trying.

FS1961 commented 6 months ago

Okay, I connected the camera to the USB TTL but my Mac doesn't recognize it. I only see the bluetooth device. I have the TX and RX crossed but nothing. I've tried with the camera plugged into mains and unplugged. Nothing. Suggestions?

dad@MBP ~ % ls /dev/cu.* /dev/cu.Bluetooth-Incoming-Port dad@MBP ~ % I have two lights on the USB device. tempImageTBUS2Z tempImageULUJZN tempImageJ8aXjp

shulogsm commented 6 months ago

Have you installed the correct drivers for USB-Serial adapter?

FS1961 commented 6 months ago

No, looking for it now. Running macOS Monterey.

FS1961 commented 6 months ago

Tried a couple of different ones but I think they are too old.

shulogsm commented 6 months ago

Are you using ARM or Intel mac? I have only tested on intel one.

FS1961 commented 6 months ago

Intel Mac. What did you use? On Feb 15, 2024, at 2:20 PM, shulogsm @.***> wrote: Are you using ARM or Intel mac? I have only tested on intel one.

—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: @.***>

FS1961 commented 6 months ago

Okay, @bmork @shulgsm - I was successful moving to another Mac. I connected and got passed the password prompt.

I'm at a '>' prompt now but I feel like that's wrong.

# grep -Eq ^admin: /etc/passwd || echo admin:x:0:0::/:/bin/sh >>/etc/passwd' '# grep -Eq ^admin:x: /etc/passwd && echo "admin:$(pibinfo Pincode)" | chpasswd' 'Password for 'admin' changed' '# tdb set HTTPServer Enable_byte=1"' '> tdb set HTTPAccount AdminPasswd_ss="$(pibinfo Pincode)"' '> /etc/rc.d/init.d/extra_lighttpd.sh start' '>

I feel like there is a " missing prior to the Enable_byte=1 somewhere. What am I missing here?

I used the Mydlink app to get it connected to the my wifi, but how do I get the fw backed up?