SC002 WA2 Rev 3.0.0

[slenderman-poon]

greetings master, I'm hoping you can help me to get this running on my kogan branded camera also :) main and MCU versions in the app both show V2.2.4 have tried formatting the sdcard using the app however it doesn't seem to even kick off anything from the card, no backup folder is created and no telnet is available.

the camera does create the DCIM folder.

not sure if any of the boot log is useful but will include a bit here just in case.

many thanks :)

U-Boot 2014.01-v1.2 (May 11 2019 - 16:41:46)

Board: IPCAM RTS3903 CPU: 500M :rx5281 prid=0xdc02 force spi nor mode DRAM: 64 MiB @ 1066 MHz Skipping flash_init Flash: 0 Bytes flash status is 0, 0, 0 SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiB Using default environment

In: serial Out: serial Err: serial MMC: rtsmmc: 0 Net: Realtek PCIe GBE Family Controller mcfg = 0024 no hw config header new_ethaddr = 00:00:00:00:00:00 r8168#0 no hw config header flash status is 0, 0, 0 SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiB ROOTFS IS OK KERNEL & DRV IS OK USER IS OK boot kernel flash status is 0, 0, 0 SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiB SF: 1507328 bytes @ 0x100000 Read: OK

Booting kernel from Legacy Image at 80100000 ...

get header OKimage_get_kernel check hcrc image_get_kernel print contents Image Name: linux_3.10 Created: 2019-05-11 8:41:43 UTC Image Type: MIPS Linux Kernel Image (uncompressed) Data Size: 1349581 Bytes = 1.3 MiB Load Address: 80401510 Entry Point: 80401510 Verifying Checksum ... OK Loading Kernel Image ... OK

Starting kernel ...

Linux version 3.10.27 (wenhe@embed) (gcc version 4.8.5 20150209 (prerelease) (Realtek RSDK-4.8.5p1 Build 2521) ) #2 PREEMPT Sat May 11 15:40:25 CST 2019 prom cpufreq = 500000000 prom memsize = 67108864 hw_ver: 0x2, hw_rev: 0x1, isp_ver: 0x1 prom eth mac = 00:00:00:00:00:00 bootconsole [early0] enabled CPU revision is: 0000dc02 FPU revision is: 01730001 Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Reserved contiguous memory at 0x423000(0x1618000) Zone ranges: Normal [mem 0x00000000-0x03ffffff] Movable zone start for each node Early memory node ranges node 0: [mem 0x00000000-0x03ffffff] icache: 32kB/32B, dcache: 16kB/32B, scache: 0kB/0B Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS1,57600 root=/dev/mtdblock2 rts_hconf.hconf_mtd_idx=1 rts-quadspi.channels=dual mtdparts=m25p80:8192k@0(global),128k@0k(boot),896k@128k(rootfs),1472k@1024k(kernel),704k@2496k(drv),2304k@3200k(user),2304k@5504k(backup),320k@7808k(mtd),64k@8128k(factory) PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 38072k/65536k available (3321k kernel code, 27464k reserved, 581k data, 192k init, 0k highmem) SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 Preemptible hierarchical RCU implementation. NR_IRQS:57 Calibrating delay loop... 497.66 BogoMIPS (lpj=995328) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 pinctrl core: initialized pinctrl subsystem NET: Registered protocol family 16 Init force reset registers rtsxb2 registered with IRQs INFO: initializing ISP memory ... INFO: initializing ISP device ... ISP camera platform devices added INFO: initializing SD controller ... INFO: initializing snd device ... snd resvd mem size : 1048576 INFO: initializing USB host ... INFO: initializing spi host ...0 spi platform id is ffffffff INFO: initializing I2C master ... INFO: initializing DMA controller ... INFO: initializing pinctrl device ... pinctrl_platform rts3903-pinctrl: rtspc registered with IRQs INFO: initializing ethernet devices ... INFO: initializing USB phy ... INFO: initializing watchdog controller ... INFO: initializing crypto device ... INFO: initializing cpu dvfs device ... bio: create slab at 0 rts_dmac rts3903-dmac: DesignWare DMA Controller, 4 channels INFO: realtek DMA engine inited usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb usbphy-platform usbphy-platform: Initialized Realtek IPCam USB Phy module Linux video capture interface: v2.00 Advanced Linux Sound Architecture Driver Initialized. NET: Registered protocol family 2 TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP: reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 RPC: Registered named UNIX socket transport module. RPC: Registered udp transport module. RPC: Registered tcp transport module. RPC: Registered tcp NFSv4.1 backchannel transport module. squashfs: version 4.0 (2009/01/31) Phillip Lougher NFS: Registering the id_resolver key type Key type id_resolver registered Key type id_legacy registered jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. msgmni has been set to 74 NET: Registered protocol family 38 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) io scheduler noop registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x18810000 (irq = 6) is a 16550A console [ttyS1] enabled, bootconsole disabled console [ttyS1] enabled, bootconsole disabled serial8250: ttyS1 at MMIO 0x18810100 (irq = 6) is a 16550A serial8250: ttyS2 at MMIO 0x18810200 (irq = 6) is a 16550A dbg_iomem initialized! rts-quadspi rts3903-qspi: force to set channels from quad mode to dual mode rts-quadspi rts3903-qspi: request 60000000 Hz, force to set 41666666 Hz rts-quadspi rts3903-qspi: found gd25q64c, expected mx25l12835f rts-quadspi rts3903-qspi: gd25q64c (8192 Kbytes) 9 cmdlinepart partitions found on MTD device m25p80 Creating 9 MTD partitions on "m25p80": 0x000000000000-0x000000800000 : "global" 0x000000000000-0x000000020000 : "boot" 0x000000020000-0x000000100000 : "rootfs" 0x000000100000-0x000000270000 : "kernel" 0x000000270000-0x000000320000 : "drv" 0x000000320000-0x000000560000 : "user" 0x000000560000-0x0000007a0000 : "backup" 0x0000007a0000-0x0000007f0000 : "mtd" 0x0000007f0000-0x000000800000 : "factory" rts-quadspi rts3903-qspi: Realtek QSPI Controller at 0x18030000 (irq 5) rtl8168 Gigabit Ethernet driver 8.038.00-NAPI loaded rtl8168 rts3903-r8168 (unregistered net_device): Get invalid MAC address from flash! eth%d: 0xb8400000, 00:00:00:00:00:00, IRQ 10 ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver ehci-rts: ehci-rts platform driver ehci-platform ehci-platform: EHCI Host Controller ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 ehci-platform ehci-platform: irq 11, io mem 0x18100000 ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00 usb usb1: New USB device found, idVendor=1d6b, idProduct=0002 usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb1: Product: EHCI Host Controller usb usb1: Manufacturer: Linux 3.10.27 ehci_hcd usb usb1: SerialNumber: ehci-platform hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver ohci-platform ohci-platform: Generic Platform OHCI Controller ohci-platform ohci-platform: new USB bus registered, assigned bus number 2 ohci-platform ohci-platform: irq 11, io mem 0x18180000 usb usb2: New USB device found, idVendor=1d6b, idProduct=0001 usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 usb usb2: Product: Generic Platform OHCI Controller usb usb2: Manufacturer: Linux 3.10.27 ohci_hcd usb usb2: SerialNumber: ohci-platform hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected i2c /dev entries driver Stopped watchdog timer timer margin: 8 sec TCP: cubic registered NET: Registered protocol family 17 Key type dns_resolver registered mtd1 name is boot hconf init failed ALSA device list: No soundcards found. VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 192K (803e0000 - 80410000) usb 1-1: new high-speed USB device number 2 using ehci-platform usb 1-1: New USB device found, idVendor=0bda, idProduct=f179 usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 1-1: Product: 802.11n usb 1-1: Manufacturer: Realtek usb 1-1: SerialNumber: 68572D7B977E Sat Oct 24 10:24:00 UTC 2015

---

| | | | | | | | _ | |_ | |_ | | / | ' \/ | / \ '| | || () | |) __ \ || / | |_____/|_._/|/____||

ntpclient: can't load library 'libsysconf.so' jffs2: notice: (267) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. rlx snd internal codec init soc-audio soc-audio.0.auto: ASoC: machine RLX_INTERN_CARD should use snd_soc_register_card() soc-audio soc-audio.0.auto: rlx-codec-digital <-> pcm-platform mapping ok soc-audio soc-audio.0.auto: rlx-codec-analog <-> pcm-platform mapping ok RTW: module init start RTW: rtl8188fu v5.3.0.1_28034.20180525 RTW: build time: May 11 2019 15:41:23 RTW: HW EFUSE RTW: 0x000: 29 81 00 FC 0B 00 00 00 00 0C 04 4C 10 07 00 00 RTW: 0x010: 29 27 25 22 20 1E 32 30 2E 2C 2A 02 FF FF FF FF RTW: 0x020: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x030: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x040: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x050: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x060: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x070: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x0A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x0B0: FF FF FF FF FF FF FF FF 20 2D 1D 00 00 00 00 FF RTW: 0x0C0: FF 12 00 10 00 FF 00 FF 00 00 FF FF FF FF FF FF RTW: 0x0D0: DA 0B 79 F1 42 66 40 68 57 2D 7B 97 7E 09 03 52 RTW: 0x0E0: 65 61 6C 74 65 6B 09 03 38 30 32 2E 31 31 6E 00 RTW: 0x0F0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x130: C1 B6 FF FF FF FF FF FF FF FF 00 11 FF FF FF FF RTW: 0x140: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x150: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1B0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1C0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1D0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1E0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: 0x1F0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF RTW: hal_com_config_channel_plan chplan:0x20 RTW: rtw_regsty_chk_target_tx_power_valid return _FALSE for band:0, path:0, rs:0, t:-1 RTW: rtw_ndev_init(wlan0) if1 mac_addr=68:57:2d:7b:97:7e RTW: rtw_ndev_init(wlan1) if2 mac_addr=6a:57:2d:7b:97:7e usbcore: registered new interface driver rtl8188fu RTW: module init ret=0 rtscam:isp resvd mem addr : 0x00523000, size : 0x1518000 rtscam:rtscam_mem_init v:0xa0523000 p:0x00523000 s:0x00001518 rtscam:rtscam_lock_init rtscam:rtscam_soc_probe rtscam:rtscam_hx280_probe rtscam:hx280enc:HW at base <0x18060000> with ID <0x48317011> rtscam:rtscam_jpgenc_probe rtscam:rtscam_osd2_probe rtscam:rtstream_init (none) login: status: active CC: /opt/skyeye/script/app/ty_monirtscam:begin to load fw from isp.fw tor.sh: line 30: set_wifi_country_code: not found excute rts3903 platform script... rtscam:Load firmware size : 131024. rtscam:Found ISP 1.011 device rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1473 rtscam:+++++rtscam_video_device_probe 1477, streamnum: 3, 3 rtscam:video device registered rtscam:rts3903-isp initialized kill telnetd begin___, action: 0Started watchdog timer

Started watchdog timer mmc0: new high speed SDHC card at address 0001 mmcblk0: mmc0:0001 00000 3.62 GiB mmcblk0: p1 /dev/mmcblk0 /dev/mmcblk0p1 /dev/mmcblk0 /dev/mmcblk0p1 FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. /opt/skyeye/script/app/ty_monitobw_mode=0x20 r.sh: line 164: set_wifi_country_code: not found [2015-10-24 10:24:9.854 tid(507) main.c main(69) Debug] begin [2015-10-24 10:24:9.855 tid(507) tycam_devcom_inf.c tycam_devcom_start(210) Debug] begin___ [2015-10-24 10:24:9.920 tid(507) ty_wifi.c ty_hwl_wifiinit(634) Debug] bigin [2015-10-24 10:24:9.921 tid(507) ty_wifi.c ty_hwl_wifi_init(648) Debug] end___ [2015-10-24 10:24:9.921 tid(507) tuya_ipc_mgr_utils.c TUYA_IPC_SDK_INIT(138) Debug] SDK Version: < TUYA IOT SDK V:4.1.1 BS:30.01_PT:2.2_LAN:3.3_CAD:1.0.1_CD:1.0.0 > IPC DEFS < ENABLE_ECHO_SHOW:1 ENABLE_CHROMECAST:1 ENABLE_CLOUD_STORAGE:1 >' < BUILD AT:2019_06_03_14_38_25 BY chenjing FOR tuya_wifi_ipc AT rts3903 >

[2015-10-24 10:24:10.214 tid(507) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(80) Debug] init ring buffer Channel:0 Enable:1

[cjj25]

I have this exact camera as a dev board.

Can you check to see if the payload has enabled telnet?

Follow the instructions here

[slenderman-poon]

the telnet line has been uncommented in the ty_sdcard_upgrade.sh trying to connect though i get "connection refused" I don't suppose we know the user/pass for the console to kick the script off manually?

[cjj25]

I've not cracked the hash yet but if you've got the GPU power spare, it's here: $1$dVhFuDGx$YrOKRgTcjTCqEK75.z277/

[cjj25]

There is also this file I recently found (not checked any of them), check these.

[slenderman-poon]

alas i have not the hardware to brute a whatever that is (MD5???), i wish i did though :) none of those user/pass combos worked :(

in theory should this be working on my board? if its working for you with the same Rev and firmware i'll start back at square 1 incase i've missed something simple.

[slenderman-poon]

master, I have new hardware arriving tomorrow. was doing some testing on the above hash before it gets here. are you able to verify that is the complete hash? none of the regular tools are able to ID it, its been suggested it may be missing characters?

many thanks

[cjj25]

Apologies, it's missing the final '/' so its $1$dVhFuDGx$YrOKRgTcjTCqEK75.z277/

[slenderman-poon]

master, so far there have been no happyness with brute forcing the above hash but it is still running and will let you know if I have joy. in the meantime I have pulled the flash memory and dumped it to a bin file, using binwalk i can see the filesystems and using dd have extracted and unsquashed them. if they are of any assistance to you please let me know and i can send you what you need.

much gratitude