search

bmork / defogger

D-Link DCS-8000LH usage info and defogging tools
267 stars 37 forks source link

Some reflections when stuck on 2.0.7.x #34

Open jonerikandersen opened 1 year ago

jonerikandersen commented 1 year ago

Background

So, after about 20 hours of messing about with the Bluetooth hack on Mac and Linux, I have found a way to get it working. My background is not coding, but more of a tech-savvy kind of guy. The idea is to spread more knowledge on issues and kind of small items in the wiki / guide, that a newbe like myself struggled a bit to find out.

Spoiler - you need a USB2Serial. And it is actually not that easy to get going - if you have not done it before. First off, it is not possible to use a USB2Serial(U2S from now on) on Mac OS 13 and above. Don't ask why, but it is not possible. There is also an issue with bluepy(the python script that uses the BT-method). So my recommendation after a lot of testing:

Download Kali Linux or another live distro and boot your Mac from USB. But, remember to enable BT on that live distro, otherwise the upload won't work.

Learnings

Step 1. First things first, get yourself a USB2Serial, wire it like shown in the guide.

Note: Also add the USB power of the camera to let it get power from the power supply. When connecting the Tx, Rx, Gnd - make sure to have Rx and Tx switched. So data is Tx(transferred) from the U2S device, to Rx(receiver) on the camera. And visa-versa, Rx on U2S to Tx on the Camera Step 2. Get the U2S working on the Linux distro. Learnings:

  1. Run the following command to get a list of connected USB devices and make sure that the U2S shows up. lsusb
  2. Make sure you identify where the device is accessible. This can be done by checking the '/dev' folder and checking the content starting with 'tty' related to USB. cd /dev && ls In my case, the name was 'ttyUSB0'

Step 3 Set up a working connection to be ready to do the U-Boot magic, and there are a couple of tricks here that helped me.

  1. There are a lot of tools to use, like Putty, minicom etc, but a simple solution working for me was screen. In the guide it says that the band was 57600 and it used 8N1. As a noob, I needed some time to understand that. However, I got this working. That means that the setup I used was: screen /dev/ttyUSB0 57600 cs8

Step 4 How to get in. You have 3 seconds before the boot starts, so make sure the camera is disconnected and start your screen.

  1. Get your copy/paste in order and make sure you have this copied for entering in the boot field. alpha168 When you see: Press ESC to abort autoboot in 3 seconds

So that sum's up part 1. As of now I have some issues with the firmware and the admin password not matching my pin. This happened after flashing with DCS-8000LH_Ax_v2.02.02_3014.bin- but still working on it. I also got it to upload a custom fw.tar, so once complete I am planning to show what and how I did it. Because there are parts of the guide that does need to come in another order, than the one in the guide. So if people are interested in that, let me know.

jonerikandersen commented 1 year ago

@bmork Any idea of how to retrieve the pin again? The printed pin does not work as the bluetooth pin when trying the script to run the local script.

bmork commented 1 year ago

Been a very long time since I looked at this, but it looks like the factory default PIN is stored as ascii text at offset 0x00d10 in /dev/mtd1 (the "pib" partition).

It's also stored as "AdminPasswd" in db/db.xml in /dev/mtd3 (the "db" partition). The contents of this partition can be unpacked with "tar zxvf". Not sure if it's there because I've set it though, or if that also is a default.