Unsuccessful root of CW-036/CW-236

[bi-os-050]

I have tried a lot here, I really do not know what is wrong with this setup.

Essentially, I have either model CW-036 (According to the mobile app) or CW-236 (According to the sticker). No matter what I try, it won't open any more ports (stuck on the service port / 6668) or create the "hack" file.

I connected to the UART pads:

U-Boot 2013.10.0-V3.1.28_bchV1.0.03 (Jan 05 2023 - 22:14:50)

DRAM:  64 MiB
efuse_read:0x00000002
8 MiB
sd detect gpio mode:47!
mmc_sd: 0
In:    serial
Out:   serial
Err:   serial
Net:   eth-0

Hit any key to stop autoboot: 1

KERNEL: size:0x00184000, offset:0x0003f000

SF: 1589248 bytes @ 0x3f000 Read: OK
## Booting kernel from Legacy Image at 80008000 ...
   Image Name:   Linux-4.4.192V2.1
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1519216 Bytes = 1.4 MiB
   Load Address: 80008000
   Entry Point:  80008040
   Verifying Checksum ... OK
   XIP Kernel Image ... OK
   kernel loaded at 0x80008000, end = 0x8017ae70
using: FDT

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 4.4.192V2.1 (root@ubuntu) (gcc version 4.9.4 (Buildroot 2018.02.7_V1.0.03-g9ff3371) ) #2 Fri Jan 6 00:48:26 PST 2023
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=0005317f
CPU: VIVT data cache, VIVT instruction cache
Machine model: ak3918ev330 dev board
Memory policy: Data cache writeback
ANYKA CPU AK39XXEV330 (ID 0x20160101)
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttySAK0,115200n8 root=/dev/mtdblock5 rootfstype=squashfs init=/sbin/init mtdparts=spi0.0:200K@0x0(UBOOT),4K@0x32000(ENV),4K@0x33000(ENVBK),44K@0x34000(DTB),1552K@0x3f000(KERNEL),1984K@0x1C3000(ROOTFS),156K@0x3B3000(CONFIG),4248K@0x3DA000(APP) mem=64M memsize=64M
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 33696K/65536K available (2962K kernel code, 113K rwdata, 944K rodata, 132K init, 188K bss, 31840K reserved, 0K cma-reserved)
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
    vmalloc : 0xc4800000 - 0xff800000   ( 944 MB)
    lowmem  : 0xc0000000 - 0xc4000000   (  64 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc03d8d44   (3908 kB)
      .init : 0xc03d9000 - 0xc03fa000   ( 132 kB)
      .data : 0xc03fa000 - 0xc0416670   ( 114 kB)
       .bss : 0xc0416670 - 0xc04457fc   ( 189 kB)
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:126
ak39ev330_clk: CPU(JCLK): 708(Mhz) 
ak39ev330_clk: MEMDDR2(DPHY): 354(Mhz) 
ak39ev330_clk: VCLK: 320(Mhz)
ak-timer: ak_timer_init
clocksource: ak_cs_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 159271703898 ns
sched_clock: 32 bits at 12MHz, resolution 83ns, wraps every 178956970966ns
Calibrating delay loop... 351.43 BogoMIPS (lpj=1757184)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x80008400 - 0x8000843c
devtmpfs: initialized
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 256 (order: -1, 3072 bytes)
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 16 KiB pool for atomic coherent allocations
On-chip L2 memory initialized
ak-pinctrl 20170000.gpio: ak_pinctrl_probe 1958
ak_ev330_pinctrl: ak_pinctrl_probe irq: 15
media: Linux media interface: v0.10
Linux video capture interface: v2.00
clocksource: Switched to clocksource ak_cs_timer
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
jitterentropy: Initialization failed with host not compliant with requirements: 2
io scheduler noop registered (default)
AKxx uart driver init, (c) 2013 ANYKA
20130000.uart0: ttySAK0 at MMIO 0x20130000 (irq = 10, base_baud = 10000000) is a AK
console [ttySAK0] enabled
20138000.uart1: ttySAK1 at MMIO 0x20138000 (irq = 11, base_baud = 10000000) is a AK
zram: Added device: zram0
Start to init Anyka SPI Flash...
init Anyka SPI Nand Flash driver
spi0 new hz is 40000000, div is 2(change).
ak spiflash probe enter.
akspi flash ID: 0x00c84017
ak-spiflash spi0.0: gd25q64 (8192 Kbytes)
8 cmdlinepart partitions found on MTD device spi0.0
Creating 8 MTD partitions on "spi0.0":
0x000000000000-0x000000032000 : "UBOOT"
0x000000032000-0x000000033000 : "ENV"
0x000000033000-0x000000034000 : "ENVBK"
0x000000034000-0x00000003f000 : "DTB"
0x00000003f000-0x0000001c3000 : "KERNEL"
0x0000001c3000-0x0000003b3000 : "ROOTFS"
0x0000003b3000-0x0000003da000 : "CONFIG"
0x0000003da000-0x000000800000 : "APP"
Init AK SPI Flash finish.
akspi master SPI0 initialize success, use for PIO mode.
i2c /dev entries driver
ak_wdt_init: watchdog register...
NET: Registered protocol family 17

VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
devtmpfs: mounted
Freeing unused kernel memory: 132K
mount all file system...
**************************
    Love Linux ! ! ! 
**************************
/bin/mount -t squashfs /dev/mtdblock7 /usr
/bin/mount -t jffs2 /dev/mtdblock6 /etc/config

anyka login: ak_mci: loading out-of-tree module taints kernel.
AK MCI Driver  Module_init
akmci 20100000.mmc0: host->gpio_cd=47
akmci 20100000.mmc0: akmci_probe : MCI
card_status@probe =0.(1=CARD_PLUGED, 0=CARD_UNPLUGED)
akmci 20100000.mmc0: gclk = 160000000 Hz. div_l=199, div_h=199
akmci 20100000.mmc0: ios->clock = 400000 Hz. host->bus_clock = 400000 Hz
akmci 20100000.mmc0: Mci0 Interface.using l2dma. detect mode:gpio detect.
'/dev/root' -> '/dev/mtdblock5'
                     __                     
            _   ____ \/ ____  __            
     /\    | \ | |\ \  / /| |/ /    /\      
    /  \   |  \| | \ \/ / | ' /    /  \     
   / /\ \  | . ' |  \  /  |  <    / /\ \    
  / ____ \ | |\  |  |  |  | . \  / ____ \   
 /_/    \_\|_| \_|  |__|  |_|\_\/_/    \_\  

Setting up swapspace version 1, size = 18870272 bytes
UUID=5254f766-2fb7-4571-86f9-de72e401b6a7
ak_motor_probe
ak_motor_probe
ak_uio: register uio device successfully with irq: 2!
install sensor driver
/usr/modules/sensor_mis2006.ko
mis2006_probe Aug  5 2021 16:34:31
mis2006_read client:c39e7d00, addr:30
mis2006_read client:c39e7d00, addr:30
id:2006
i2c i2c-0: mis2006 Probed success, subdev:c300f214
install /tmp/sensor OK...match isp config
sensor_id=2006
install /usr/local/H3b_mis2006_mipi_1117_1_xg.conf....OK!
/etc/config/bak exit!!
/etc/config/bak/anyka_cfg.ini is exists!
/etc/config/anyka_cfg.ini is exists!
/etc/config/ipc_property.cjson is exists!
/etc/config/config.xml is exists!
cp wifi_info.ini to tmp
led_type= 1
wled_level=1
led mode:on
wled_level=1
led mode:bledon
irled_level=1
tf card not insert!
The Version Path "/mnt" Is Not Exist *.bin
      Current FileName: 

No F/W in TF-Card for Update.
The /usr/bin/update_entry has exited, start_update!!!
uart= 0

Saw a different load address too, modifying the "env" and "ppsMmcTool.txt" files with that one didn't change anything?

ppsMmcTool.txt

style=upgrade,,writeAddr=0,,password=nothing,,writeLen=0,,fileName=env;env import 80008000;saveenv,,

env

hack=setenv bootargs ${bootargs} '- ip=30;/mnt/mmc01/initrun.sh)&:::::;date>/tmp/hack;(sleep
ipaddr=0;run hack;bootm 0x80008000;

And here is my SD card contents: mmc.zip

In the app, it says my camera's firmware version is "V33.50.30", sounds off.

Tried 2 different SD cards, a 32GB and a 16GB, both MBR/FAT32.

[guino]

@bi-os-050 are you able to 'pause' the boot process by pressing any key when it shows Hit any key to stop autoboot: 1 at the beginning of the log ? if so, send me an email (my email is on my github profile) and I can try to give you some pointers for the boot loader.

Looking at this log this appears to be a whole new camera (different from the ones we have seen before) with a new boot loader (dated Jan 5th 2023) which likely has different scripts + settings so it it's understandable it may not be compatible with the process we've made for older devices.

One question: was the log above done booting with the reset button pressed (to initiate the parsing of ppsMmcTool.txt + env file ? I'm asking because it looks like a normal boot and a log with the reset button pressed would likely give more insight as to how it tried to process the files.

If you can't pause the boot to go into the boot loader the only way to move forward would be getting a dump of the firmware which requires a hardware programmer, removing the chip, etc -- I don't expect you to risk breaking the device but if you do get a firmware dump let me know and I'll take a look when I have a chance.

[WhoDunDidIt]

I have a CW248 with the same firmware version. I'm having no luck (to the best of my knowledge) getting it to boot properly, but I have NOT opened the camera up yet, as I'd rather just return them rather than risk being forced to keep a pair of cameras I can't disable cloud and disable recording on.

I'm open to suggestions as to how to move forward.

[guino]

@WhoDunDidIt that's what I usually say: If you can get a device that has RTSP out of the box (at comparable prices) you're better of doing that than spending a lot of time/effort in trying to add RTSP to it. Some people like tinkering with this stuff and/or like the challenge OR already have a device sitting around, but otherwise if doesn't suit your needs you should return it if you have that option.

[javierferwolf]

CW-036/CW-236 Hello everyone, does anyone have the dump of this camera?