This is an old revision of the document!
CCTV видеонаблюдение
- frigate - free cctv ai object https://www.youtube.com/watch?v=iO584g5c0DY
- Hacking Reolink reverse engineering , gdb, hydra https://www.thirtythreeforty.net/posts/2020/05/hacking-reolink-cameras-for-fun-and-profit/
Shinobi
- shinobi onvif event https://hub.shinobi.video/articles/view/FT2LAfGk5VrMHZC
- shinobi onvif motion https://www.reddit.com/r/ShinobiCCTV/comments/prpdk5/onvif_motion_events_v2/
CCTV Onvif
- onvif description - https://securityrussia.com/blog/onvif.html
- onvif device manager ODM https://sourceforge.net/projects/onvifdm/
- onvif javascript node js https://www.npmjs.com/package/onvif (examples event https://github.com/agsh/onvif/blob/master/examples/example6.js)
- test package of nodejs https://npm.runkit.com/onvif
- conversation api - trigered motion https://www.reddit.com/r/ShinobiCCTV/comments/ehodxy/api_triggered_motion_events_not_showing_up/
Supported cameras
- synology supported camera https://www.synology.com/en-eu/compatibility/camera?query=reolink
- shinobi supported camera
NVR
- регистратор за 1000 руб https://www.youtube.com/watch?v=9TI1gHuVNDs
Camera cpu hi3518ev100 + sensor ov9712_i2c + nor
 |  |
Camera OpenIPC
#C-kermit for windows # cat /proc/mtd #dev: size erasesize name #mtd0: 00080000 00010000 "boot" #mtd1: 00280000 00010000 "kernel" #mtd2: 00d00000 00010000 "rootfs" #0x0 0x80000 #0x80000 0x280000 #0x300000 0xD00000 # BOOT mw.b 0x82000000 0xff 0x80000 loady 0x82000000 115200 sf probe 0; sf erase 0x0 0x80000; sf write 0x82000000 0x0 0x80000 #KERNEL #0x80000 0x280000 mw.b 0x82000000 0xff 0x280000 loady 0x82000000 115200 sf probe 0; sf erase 0x80000 0x280000; sf write 0x82000000 0x80000 0x280000 #ROOTFS #0x300000 0xD00000 mw.b 0x82000000 0xff 0xD00000 loady 0x82000000 115200 sf probe 0; sf erase 0x300000 0xD00000; sf write 0x82000000 0x300000 0xD00000
https://github.com/OpenIPC WIKI pdf https://themactep.com/tools/firmware-partitions-calculation
прошивка get root Uboot MII example firmware
# Params of camera cpu hi3518ev100 sensor ov9712_i2c nor # read flash to ram sf read <addr> <offset>|<partition> <len> ;sf read 0x82000000 0x80000 0x280000 printenv bootdelay=1 baudrate=115200 bootfile="uImage" phyaddru=0 phyaddrd=1 mdio_intf=rmii bootcmd=sf probe 0;sf read 0x82000000 0x80000 0x280000;bootm 0x82000000 ethaddr=00:ab:e3:f6:89:02 filesize=A1CF04 fileaddr=82000000 bootargs=mem=44M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=hi_sfc:512K(boot),2560K(kernel),13M(rootfs) ipaddr=192.168.114.20 netmask=255.255.255.0 gatewayip=192.168.114.1 serverip=192.168.114.112 stdin=serial stdout=serial stderr=serial verify=n ver=U-Boot 2010.06 (Mar 18 2014 - 03:42:32) Environment size: 532/262140 bytes #backup #https://felipe.astroza.cl/hacking-hi3815-based-ip-camera/ # dd if=/dev/mtd0 of=/mnt/mtd/ipc/tmpfs/sd/boot.mtd bs=65536 8+0 records in 8+0 records out 524288 bytes (512.0KB) copied, 0.220300 seconds, 2.3MB/s # dd if=/dev/mtd1 of=/mnt/mtd/ipc/tmpfs/sd/kernel.mtd bs=65536 40+0 records in 40+0 records out 2621440 bytes (2.5MB) copied, 0.678152 seconds, 3.7MB/s # dd if=/dev/mtd2 of=/mnt/mtd/ipc/tmpfs/sd/rootfs.mtd bs=65536 208+0 records in 208+0 records out 13631488 bytes (13.0MB) copied, 4.859616 seconds, 2.7MB/s setenv ipaddr 192.168.114.20 setenv netmask 255.255.255.0 setenv gatewayip 192.168.114.1 setenv serverip 192.168.114.112 saveenv sf probe [[[<bus>:]<cs>] [<hz> [<mode>]]] sf read <addr> <offset>|<partition> <len> sf write <addr> <offset>|<partition> <len> sf erase <offset>|<partition> <len> sf update <addr> <offset>|<partition> <len> sf protect lock|unlock <sector> <len> sf test <offset>|<partition> <len> sf read 0x82000000 0x80000 0x500000 flash1 sf read 0x82000000 0x300000 0x280000 flash2 hisilicon # sf read 0x82000000 0x80000 0xF80000 tftp 0x82000000 flash.bin 0xF80000 # get shell #https://forum.videon.spb.ru/viewtopic.php?f=24&t=7550 uboot hisilicon # setenv bootargs mem=43M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=hi_sfc:512K(boot),2560K(kernel),13M(rootfs) init=/bin/sh hisilicon # sf probe 0 16384 KiB hi_sfc at 0:0 is now current device hisilicon # sf read 0x82000000 0x80000 0x280000 hisilicon # bootm 0x82000000
# Uboot and loading kernel U-Boot 2010.06 (Mar 18 2014 - 03:42:32) Check spi flash controller v350... Found Spi(cs1) ID: 0xEF 0x40 0x18 0x00 0x00 0x00 Spi(cs1): Block:64KB Chip:16MB Name:"W25Q128B" In: serial Out: serial Err: serial Hit any key to stop autoboot: 0 16384 KiB hi_sfc at 0:0 is now current device ## Booting kernel from Legacy Image at 82000000 ... Image Name: Linux-3.0.8 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 2598364 Bytes = 2.5 MiB Load Address: 80008000 Entry Point: 80008000 Loading Kernel Image ... OK OK Starting kernel ... Uncompressing Linux... done, booting the kernel. Linux version 3.0.8 (root@localhost.localdomain) (gcc version 4.4.1 (Hisilicon_v 100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #1 Tue Mar 18 03:54:42 HKT 2014 CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177 CPU: VIVT data cache, VIVT instruction cache Machine: hi3518 Memory policy: ECC disabled, Data cache writeback AXI bus clock 200000000. Built 1 zonelists in Zone order, mobility grouping on. Total pages: 11176 Kernel command line: mem=44M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfsty pe=jffs2 mtdparts=hi_sfc:512K(boot),2560K(kernel),13M(rootfs) PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 44MB = 44MB total Memory: 39732k/39732k available, 5324k reserved, 0K highmem Virtual kernel memory layout: vector : 0xffff0000 - 0xffff1000 ( 4 kB) fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB) DMA : 0xffc00000 - 0xffe00000 ( 2 MB) vmalloc : 0xc3000000 - 0xfe000000 ( 944 MB) lowmem : 0xc0000000 - 0xc2c00000 ( 44 MB) modules : 0xbf000000 - 0xc0000000 ( 16 MB) .init : 0xc0008000 - 0xc0022000 ( 104 kB) .text : 0xc0022000 - 0xc0491000 (4540 kB) .data : 0xc0492000 - 0xc04b0e00 ( 124 kB) .bss : 0xc04b0e24 - 0xc04c4170 ( 77 kB) SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 NR_IRQS:32 nr_irqs:32 32 sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms Console: colour dummy device 80x30 Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok NET: Registered protocol family 16 Serial: AMBA PL011 UART driver uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2 console [ttyAMA0] enabled uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2 bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb cfg80211: Calling CRDA to update world regulatory domain Switching to clocksource timer1 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 RPC: Registered named UNIX socket transport module. RPC: Registered udp transport module. RPC: Registered tcp transport module. RPC: Registered tcp NFSv4.1 backchannel transport module. JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc. fuse init (API version 7.16) msgmni has been set to 77 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) io scheduler noop registered io scheduler deadline registered (default) io scheduler cfq registered Spi id table Version 1.22 Spi(cs1) ID: 0xEF 0x40 0x18 0x00 0x00 0x00 SPI FLASH start_up_mode is 3 Bytes Spi(cs1): Block:64KB Chip:16MB Name:"W25Q128B" spi size: 16MB chip num: 1 3 cmdlinepart partitions found on MTD device hi_sfc Creating 3 MTD partitions on "hi_sfc": 0x000000000000-0x000000080000 : "boot" 0x000000080000-0x000000300000 : "kernel" 0x000000300000-0x000001000000 : "rootfs" Fixed MDIO Bus: probed himii: probed ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver hiusb-ehci hiusb-ehci.0: HIUSB EHCI hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1 hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000 hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver hiusb-ohci hiusb-ohci.0: HIUSB OHCI hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2 hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000 hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected usbcore: registered new interface driver usbhid usbhid: USB HID core driver TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 10 NET: Registered protocol family 17 NET: Registered protocol family 15 lib80211: common routines for IEEE802.11 drivers Registering the dns_resolver key type drivers/rtc/hctosys.c: unable to open rtc device (rtc0) ▒usb 1-1: new high speed USB device number 2 using hiusb-ehci VFS: Mounted root (jffs2 filesystem) on device 31:2. Freeing init memory: 104K _ _ _ _ _ _ _ _ _ _ _ _ \ _ _ _ _ _ ___ / /__/ \ |_/ / __ / - _ ___ / / / / / / _ _ _ _/ / / \_/ \_ ______ ___________\___\__________________ [RCS]: /etc/init.d/S00devs [RCS]: /etc/init.d/S01udev udevd (412): /proc/412/oom_adj is deprecated, please use /proc/412/oom_score_adj instead. [RCS]: /etc/init.d/S80network ADDRCONF(NETDEV_UP): eth0: link is not ready sd sd infrared driver init successful! sinit driver init successful! (none) login: mt7601Usta: module license 'unspecified' taints kernel. Disabling lock debugging due to kernel taint rtusb init rtusbSTA ---> === pAd = c32b4000, size = 860120 === <-- RTMPAllocTxRxRingMemory, Status=0 <-- RTMPAllocAdapterBlock, Status=0 RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x8 RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x4 RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x5 RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x6 RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x7 RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x9 NVM is EFUSE Endpoint(8) is for In-band Command Endpoint(4) is for WMM0 AC0 Endpoint(5) is for WMM0 AC1 Endpoint(6) is for WMM0 AC2 Endpoint(7) is for WMM0 AC3 Endpoint(9) is for WMM1 AC0 Endpoint(84) is for Data-In Endpoint(85) is for Command Rsp usbcore: registered new interface driver rtusbSTA extalarm driver init successful ! Hisilicon Watchdog Timer: 0.01 initialized. default_margin=60 sec (nowayout= 0, nodeamon= 0) encript driver init successful! relay driver init successful! reset driver init successful! rsignal driver init successful! wifikey driver init successful! light driver init successful ! audioin driver init successful! Hisilicon Media Memory Zone Manager Hisilicon UMAP device driver interface: v3.00 pa:82c00000, va:c3440000 load sys.ko for Hi3518...OK! load viu.ko for Hi3518...OK! ISP Mod init! load vpss.ko ....OK! load venc.ko for Hi3518...OK! load group.ko for Hi3518...OK! load chnl.ko for Hi3518...OK! load h264e.ko for Hi3518...OK! load jpege.ko for Hi3518...OK! load rc.ko for Hi3518...OK! load region.ko ....OK! load vda.ko ....OK! hi_i2c init is ok! Kernel: ssp initial ok! acodec inited! insert audio ==== Your input Sensor type is icx692 ==== 1. LDO_CTR0(6c) = a64799, PMU_OCLEVEL c 2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6 FW Version:0.1.00 Build:7640 Build Time:201308222153____ ILM Length = 47000(bytes) DLM Length = 0(bytes) Loading FW.... # RTMP_TimerListAdd: add timer obj c33347ec! RTMP_TimerListAdd: add timer obj c3334804! RTMP_TimerListAdd: add timer obj c333481c! RTMP_TimerListAdd: add timer obj c33347d4! RTMP_TimerListAdd: add timer obj c333478c! RTMP_TimerListAdd: add timer obj c33347a4! RTMP_TimerListAdd: add timer obj c32c9624! RTMP_TimerListAdd: add timer obj c32b61e0! RTMP_TimerListAdd: add timer obj c32b61fc! RTMP_TimerListAdd: add timer obj c32c967c! RTMP_TimerListAdd: add timer obj c32b8bb4! RTMP_TimerListAdd: add timer obj c32b8264! RTMP_TimerListAdd: add timer obj c32b8b98! RTMP_TimerListAdd: add timer obj c32b8dd8! RTMP_TimerListAdd: add timer obj c32b8bd0! RTMP_TimerListAdd: add timer obj c32b8bec! RTMP_TimerListAdd: add timer obj c32b8c08! RTMP_TimerListAdd: add timer obj c32c95f4! RTMP_TimerListAdd: add timer obj c32c9664! RTMP_TimerListAdd: add timer obj c32b8e08! RTMP_TimerListAdd: add timer obj c32b8e20! RTMP_TimerListAdd: add timer obj c32b8e38! RTMP_TimerListAdd: add timer obj c32b8e50! cfg_mode=9 wmode_band_equal(): Band Equal! Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 14 2. Phy Mode = 14 NVM is Efuse and its size =1d[1e0-1fc] 3. Phy Mode = 14 AntCfgInit: primary/secondary ant 0/1 ---> InitFrequencyCalibration InitFrequencyCalibrationMode:Unknow mode = 3 InitFrequencyCalibration: frequency offset in the EEPROM = 100(0x64) <--- InitFrequencyCalibration RTMPSetPhyMode: channel is out of range, use first channel=1 MCS Set = ff 00 00 00 00 <==== rt28xx_init, Status=0 0x1300 = 00064300 RTMPDrvOpen(1):Check if PDMA is idle! RTMPDrvOpen(2):Check if PDMA is idle! motor driver init successful! ADDRCONF(NETDEV_UP): eth0: link is not ready killall: udhcpc: no process killed udhcpc (v1.16.1) started dhcp failed. set eth0 to default ip: 192.168.1.88 killall: runarp: no process killed Sending discover... killall: arping: no process killed Sending discover... Sending discover... dhcp failed. set eth0 to default ip: 192.168.1.88 route: SIOCADDRT: File exists No lease, forking to background 1 2 RTC time 1970-01-01 00:00:00 Set system time as date -s 1970.01.01-00:00:00 date: can't set date: Invalid argument Thu Jan 1 00:00:00 STD 1970 umount: can't forcibly umount /mnt/mtd/ipc/tmpfs/sd: Invalid argument killall: gerddns: no process killed killall: upnp_map: no process killed killall: arping: no process killed killall: upnp_map: no process killed killall: ddns_update: no process killed workthread: log init succeed. libs_initnettype(Lan): succeed. macflag: 0 videocomm(0): 6 1280 720 videocomm(1): 7 640 352 videocomm(2): 8 320 176 TimeZone: -5 workthread: init ini succeed. workthread: ntpsvr init succeed. sLightInfo.s32Enable=1 workthread: reset init succeed. HI_WifiKey_Init: apmode=0 workthread: wifikey init succeed. workthread: timerreboot init succeed. ptz type: motor HI_Ntp_Proc: enable=1, svr=10.59.5.1, interval=1 timerreboot: enable=0,reboot time=00:00:00 workthread: ptz init succeed. HI_Media_SDKInit: efreq=50,maxchn=2,resolution=31,maxresolution=6,maxwidth=1280, maxheight=720 HI_Media_SDKInit: HI_SDK_Init() error! HI_Media_Init: init sdk failed! HI_Websvr_Init: init media failed! workthread: websvr start failed! ipc_server stop: 1970-01-01 05:00:31 onvif: TZ: STD-5:0:0 onvif: TZInterval: 18000 onvif: login dev failed! handle=0 objp2p: start: 1970-01-01 05:00:36 HI_ObjLink_Svr_Start pGLCfg->szUID = HZD-023351-DBEFA login dev failed! handle[0]=0 objp2p: sdk login failed! objp2p: stop: 1970-01-01 05:00:36 objp2p: start: 1970-01-01 05:00:36 HI_ObjLink_Svr_Start pGLCfg->szUID = HZD-023351-DBEFA login dev failed! handle[0]=0
root@ipcam1:/mnt/mmcblk0p1/ipc# ./ipctool
mdio busy
mdio busy
Error: unexpected value for SOI == 0x9711
---
chip:
vendor: HiSilicon
model: 3518EV100
board:
vendor: OpenIPC
version: 2.3.12.15
ethernet:
u-mdio-phyaddr: 0
phy-id: 0x00000000
d-mdio-phyaddr: 0
phy-mode: mii
rom:
- type: nor
block: 64K
partitions:
- name: boot
size: 0x40000
sha1: 42f2bad9
- name: env
size: 0x10000
sha1: e14d8313
contains:
- name: uboot-env
offset: 0x0
- name: kernel
size: 0x300000
sha1: c6e96ceb
- name: rootfs
size: 0xa00000
path: /,squashfs
sha1: cdbf09f2
- name: rootfs_data
size: 0x2b0000
path: /overlay,jffs2,rw
size: 16M
addr-mode: 3-byte
ram:
total: 64M
media: 32M
firmware:
u-boot: "2010.06 (Nov 14 2022 - 19:25:39)"
kernel: "3.0.8 (Fri Dec 15 16:15:50 UTC 2023)"
toolchain: buildroot-gcc-12.2.0
sdk: "Hi3518_MPP_V1.0.B.0 (Nov 19 2015, 16:37:04)"
sensors:
- vendor: OmniVision
model: OV9712
control:
bus: 0
type: i2c
addr: 0x60
data:
type: DC
clock: 24MHz