We bought this IP Camera from Alibaba:
http://www.alibaba.com/product-detail/Low-Lux-1-3-Megapixel-HD_1498636656.html
Although the camera module they sent me is not exactly the same from this link’s picture it appears a new version. Doing some debug I discovered that the serial TX/RX pins are connected to pins 15 and 16 respectively from a 20-pin flexible cable connector:
Connecting these pins to USB/Serial adapter and configuring a serial console terminal to 115200 8n1 I got this bootloader/kernel log:
U-Boot 2010.06 (Feb 26 2013 - 17:14:54)
DRAM: 128 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xEF 0x40 0x18 0x00 0x00 0x00
Spi(cs1): Block:64KB Chip:16MB Name:"W25Q128B"
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
16384 KiB hi_sfc at 0:0 is now current device
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.0.8
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1795784 Bytes = 1.7 MiB
Load Address: 80008000
Entry Point: 80008000
## Loading init Ramdisk from Legacy Image at 83000000 ...
Image Name: JUAN filesystem
Image Type: ARM Linux RAMDisk Image (gzip compressed)
Data Size: 6557696 Bytes = 6.3 MiB
Load Address: 83000000
Entry Point: 83000000
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Linux version 3.0.8 (root@ubuntu) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #2 Fri Jan 4 15:10:00 HKT 2013
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518
Memory policy: ECC disabled, Data cache writeback
AXI bus clock 200000000.
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 20320
Kernel command line: mem=80M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:256K(uboot),128K(env),128K(user),256K(config),3328K(kernel),12M(rootfs) ramdisk_size=0XC00000
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 80MB = 80MB total
Memory: 69828k/69828k available, 12092k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
vmalloc : 0xc5800000 - 0xfe000000 ( 904 MB)
lowmem : 0xc0000000 - 0xc5000000 ( 80 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.init : 0xc0008000 - 0xc0028000 ( 128 kB)
.text : 0xc0028000 - 0xc0486000 (4472 kB)
.data : 0xc0486000 - 0xc04ad9e0 ( 159 kB)
.bss : 0xc04ada04 - 0xc04ca620 ( 116 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32 nr_irqs:32 32
sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms
Console: colour dummy device 80x30
Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2
bio: create slab at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (junk in compressed archive); looks like an initrd
Freeing initrd memory: 6404K
NetWinder Floating Point Emulator V0.97 (double precision)
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2. (NAND) �é 2001-2006 Red Hat, Inc.
fuse init (API version 7.16)
msgmni has been set to 148
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
loop: module loaded
Spi id table Version 1.22
Spi(cs1) ID: 0xEF 0x40 0x18 0x00 0x00 0x00
SPI FLASH start_up_mode is 3 Bytes
Spi(cs1):
Block:64KB
Chip:16MB
Name:"W25Q128B"
spi size: 0x16777216
chip num: 1
6 cmdlinepart partitions found on MTD device hi_sfc
Creating 6 MTD partitions on "hi_sfc":
0x000000000000-0x000000040000 : "uboot"
0x000000040000-0x000000060000 : "env"
0x000000060000-0x000000080000 : "user"
0x000000080000-0x0000000c0000 : "config"
0x0000000c0000-0x000000400000 : "kernel"
0x000000400000-0x000001000000 : "rootfs"
Special nand id table Version 1.35
Hisilicon Nand Flash Controller V301 Device Driver, Version 1.10
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found.
Fixed MDIO Bus: probed
himii: probed
usbcore: registered new interface driver rt2500usb
usbcore: registered new interface driver rt73usb
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver cdc_wdm
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver ums-alauda
usbcore: registered new interface driver ums-datafab
usbcore: registered new interface driver ums-freecom
usbcore: registered new interface driver ums-isd200
usbcore: registered new interface driver ums-jumpshot
usbcore: registered new interface driver ums-sddr09
usbcore: registered new interface driver ums-sddr55
usbcore: registered new interface driver mdc800
mdc800: v0.7.5 (30/10/2000):USB Driver for Mustek MDC800 Digital Camera
mousedev: PS/2 mouse device common for all mice
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
Registering the dns_resolver key type
registered taskstats version 1
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
�RAMDISK: squashfs filesystem found at block 0
RAMDISK: Loading 6403KiB [1 disk] into ram disk... done.
VFS: Mounted root (squashfs filesystem) readonly on device 1:0.
Freeing init memory: 128K
_ _ _ _ _ _ _ _ _ _ _ _
\ _ _ _ _ _ ___
/ /__/ \ |_/
/ __ / - _ ___
/ / / / / /
_ _ _ _/ / / \_/ \_ ______
___________\___\__________________
[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01udev
udevd (509): /proc/509/oom_adj is deprecated, please use /proc/509/oom_score_adj instead.
[RCS]: /etc/init.d/S10mpp
ADDRCONF(NETDEV_UP): eth0: link is not ready
[RCS]: /etc/init.d/S80network
Hisilicon Media Memory Zone Manager
hi3518_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Hisilicon UMAP device driver interface: v3.00
pa:85000000, va:c5a00000
load sys.ko for Hi3518...OK!
load viu.ko for Hi3518...OK!
load vpss.ko ....OK!
load vou.ko ....OK!
load venc.ko for Hi3518...OK!
load group.ko for Hi3518...OK!
load chnl.ko for Hi3518...OK!
load h264e.ko for Hi3518...OK!
load jpege.ko for Hi3518...OK!
load rc.ko for Hi3518...OK!
load region.ko ....OK!
load vda.ko ....OK!
hi_i2c init is ok!
I2C->[i2cm_init]:588 I2C master for HI3518a @ 14:11:12 Jan 9 2013
WATCHDOG->[watchdog_init]:244 Watchdog register succeed!
Kernel: ssp initial ok!
ISP Mod init!
acodec inited!
insert audio
*** Board tools : ver0.0.1_20120501 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x200f0124: 0x00000000 --> 0x00000000
[END]
*** Board tools : ver0.0.1_20120501 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20140400: 0x00000020 --> 0x00000022
[END]
*** Board tools : ver0.0.1_20120501 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20140008: 0x00000000 --> 0x00000002
[END]
*** Board tools : ver0.0.1_20120501 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20140008: 0x00000002 --> 0x00000000
[END]
*** Board tools : ver0.0.1_20120501 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20140008: 0x00000000 --> 0x00000002
[END]
do you want to run app.out(y or n)?
Application Trigger!
hwclock: can't open '/dev/misc/rtc': No such file or directory
enter main application
[ sysconf.c: 385] SOC = HI3518C model = hi3518c-inception
[ sysconf.c: 270] Load sysconf success! verion: 1.1.3.1569B10, build:2013-10-25 11:11:2
device sn:C23C0234902512
[ sysconf.c: 338] Build CRC32 72b74581
Device Name: ip-camera
Device Model: IPC
Device ID: C23C0234902512
Device Software Version: 1.1.3 1569B10
Camera: 1
Audio: 0
Sensor: 1
Alarm: 0
Hard Disk Driver: 0
Series Code: C2
[ usrm.c: 210] MD5 "3b1a09a78a862d5c731ed6b5604ded0a"
WATCHDOG->[WATCHDOG_init]:297 get watchdog timeout:10
hi3518c-inception
0x3000 0xffff
0xa 0x97
0xb 0x11
OV9712 sensor 720P30fps init success!
daylight mode!
saturation:128
[ media_buf.c: 42] media buf init success
[media_pool.c: 222] create media buf ch0_0.264
!!!!fps:25
TIMERTASK->[/root/nfs/git_ipc_1.1.x/path_trunk/ipcam/ipc_v1.1.x.1569/app_rebulid_release/src/timertask/timertask.c]:104 add a task @ 0 interval 1
id:660
APP_OVERLAY_id_display :ID:234902512
0 684 --IPCAM
TIMERTASK->[/root/nfs/git_ipc_1.1.x/path_trunk/ipcam/ipc_v1.1.x.1569/app_rebulid_release/src/timertask/timertask.c]:120 remove a task @ 0
TIMERTASK->[/root/nfs/git_ipc_1.1.x/path_trunk/ipcam/ipc_v1.1.x.1569/app_rebulid_release/src/timertask/timertask.c]:104 add a task @ 0 interval 1
0 342 --IPCAM
[media_pool.c: 222] create media buf ch0_1.264
!!!!fps:25
0_0/1_2 title
overlay:0x6e6d78
0_0/1_2 id
overlay:0x6e6d40
0_0/1_2 clock
overlay:0x6e6d08
TIMERTASK->[/root/nfs/git_ipc_1.1.x/path_trunk/ipcam/ipc_v1.1.x.1569/app_rebulid_release/src/timertask/timertask.c]:120 remove a task @ 0
TIMERTASK->[/root/nfs/git_ipc_1.1.x/path_trunk/ipcam/ipc_v1.1.x.1569/app_rebulid_release/src/timertask/timertask.c]:104 add a task @ 0 interval 1
id:660
APP_OVERLAY_id_display :ID:234902512
isp_ircut_control_daylight
0 684 --IPCAM
0_1/1_2 title
overlay:0x6e6f00
0_1/1_2 clock
overlay:0x6e6ec8
TIMERTASK->[/root/nfs/git_ipc_1.1.x/path_trunk/ipcam/ipc_v1.1.x.1569/app_rebulid_release/src/timertask/timertask.c]:120 remove a task @ 0
TIMERTASK->[/root/nfs/git_ipc_1.1.x/path_trunk/ipcam/ipc_v1.1.x.1569/app_rebulid_release/src/timertask/timertask.c]:104 add a task @ 0 interval 1
0 342 --IPCAM
CH: 0
MODE: bitmap
THRESHOLD: 0.500
SIZE: 20x15
MASK:
####################
####################
####################
####################
####################
####################
####################
####################
####################
####################
####################
####################
####################
####################
####################
saturation set:50
contrast set:50
hue set:50
brightness set:50
SDK_ISP_set_scene_mode:0
pstAntiflicker.bEnable = 0
SDK_ISP_sensor_flicker---0:255 mode:1
SDK_ISP_set_WB_mode:0
SDK_ISP_set_ircut_control_mode:0
SDK_ISP_set_ircut_mode:0
SDK_ISP_set_WDR_enable:1
SDK_ISP_set_exposure_mode:0
SDK_ISP_set_denoise_enable:1
SDK_ISP_set_advance_anti_fog_enable:0
[ sysconf.c: 338] Build CRC32 72b74581
TIMERTASK->[/root/nfs/git_ipc_1.1.x/path_trunk/ipcam/ipc_v1.1.x.1569/app_rebulid_release/src/timertask/timertask.c]:104 add a task @ 1 interval 5
TIMERTASK->[/root/nfs/git_ipc_1.1.x/path_trunk/ipcam/ipc_v1.1.x.1569/app_rebulid_release/src/timertask/timertask.c]:104 add a task @ 2 interval 5
cmd:ifconfig eth0:1 192.168.3.33 netmask 255.255.255.0
cmd:ifconfig eth0:2 192.168.168.168 netmask 255.255.255.0
IPCAM_network_init:GMT-8
[ httpd.c: 43] Add a new cgi "/livestream/11"
[ httpd.c: 43] Add a new cgi "/livestream/12"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/getidentify.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/param.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/getvdisplayattr.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/getvencattr.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/ptzctrl.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/preset.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/ptzup.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/ptzdown.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/ptzleft.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/ptzright.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/ptzzoomin.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/hi3510/ptzzoomout.cgi"
[ httpd.c: 43] Add a new cgi "/user/user_list.xml"
[ httpd.c: 43] Add a new cgi "/user/add_user.xml"
[ httpd.c: 43] Add a new cgi "/user/del_user.xml"
[ httpd.c: 43] Add a new cgi "/user/edit_user.xml"
[ httpd.c: 43] Add a new cgi "/user/set_pass.xml"
[ httpd.c: 43] Add a new cgi "/cgi-bin/gw2.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/upload.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/upgrade_rate.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/view.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin//view.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/flv.cgi"
[ httpd.c: 43] Add a new cgi "/cgi-bin/today.jpg"
[ httpd.c: 43] Add a new cgi "/moo"
[ httpd.c: 43] Add a new cgi "/whoami"
[ httpd.c: 43] Add a new cgi "/shell"
[ httpd.c: 43] Add a new cgi "/snapshot"
[ httpd.c: 43] Add a new cgi "/mjpeg"
[ httpd.c: 43] Add a new cgi "/mjpeg.html"
[ httpd.c: 43] Add a new cgi "/email"
[ httpd.c: 43] Add a new cgi "/hls.html"
[ httpd.c: 43] Add a new cgi "/m3u8"
[ httpd.c: 43] Add a new cgi "/hls/live.ts"
[ httpd.c: 43] Add a new cgi "/reg"
[ httpd.c: 43] Add a new cgi "/bubble/live"
reflesh arp:ping 192.168.1.1 -c 2
[ spook.c: 217] pid=766 tid=425aa4c0 begin
[ spook.c: 322] "minirtsp" got a spook vocation @ 0!
[ spook.c: 322] "owsp" got a spook vocation @ 1!
[ spook.c: 322] "bubble" got a spook vocation @ 2!
[ spook.c: 322] "onvif" got a spook vocation @ 3!
[ spook.c: 322] "httpd" got a spook vocation @ 4!
[ spook.c: 322] "rtmp" got a spook vocation @ 5!
[ spook.c: 322] "regRW" got a spook vocation @ 6!
PING 192.168.1.1 (192.168.1.1): 56 data bytes
device_id:IP_cameradf9690a02d179a6buozxfFc
generate device id: IP_cameradf9690a02d179a6buozxfFc
gw 192.168.1.1
me 192.168.1.168
[RUDPA |rudpa.c:473:RUDPA_init ]Rudpa start
ESEE DEVICE ID:JAC23C0234902512
send buf=12000000
[ ants_lib.c:2652] [IPC][ants_lib.c:00002652:ANTSLIB_init] Initialize Begin
get para type:ANTS_MID_GET_DEVICECFG -513
[ ants_lib.c:2654] [IPC][ants_lib.c:00002654:ANTSLIB_init] Initialize
[ ants_lib.c:2655] [IPC][ants_lib.c:00002655:ANTSLIB_init] Initialize End
[media_pool.c: 117] Media Pool(ch0_0.264) user changed(1/5)
[media_pool.c: 117] Media Pool(ch0_1.264) user changed(1/8)
--- 192.168.1.1 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
[RUDPA |esee.c:413:GetEseePlatInfo ]
Cant Get the EseePlatInfo
Alan C. Assis 
I recommend that you check out http://www.openipcam.com
Hi Celem,
Thank you for your suggestion. Yes, I know openipcam, but that site didn’t help me much!
I already did “gnireenigne” for other camera, take a look:
https://acassis.wordpress.com/category/ipcam/
Hi,
please can you tell me password for telnet access?
Did you see my previous comment?
It doesn’t have password, just root as login.
Source: http://hardenedgentoo.blogspot.com.br/2012/07/fun-with-vstarcam-ip-camera.html
Hi, can you post the picture of the back of the camera with the TX/RX pins?
I have a similar (hi3516c) based camera, I would like to modify the firmware to get hi quality JPEG images (at lower frame rates) for a project that I am working on.
Thanks in advance.
-Nithin
Hi Nithin,
I just updated the post and put a picture with TX and RX resistors identified.
Did you find the Linux kernel source code of your camera?
[]’s, Alan
Thanks Alan,
Yes, I did find a generic HiSilicon toolchain and sample sdk for 3516.
But unfortunately my camera module uses different layout with heatsink on the CPU.
It is using 3516c and seems to use multi-layer PCB with no traces visible on the board from the CPU. I am not sure if I can track the pinout for the RS232 ports on the board.
-Nithin
Hi Nithin,
Could you please share the link for 3516 toolchain and sdk sample? I want to compile it and put in the github. I did it for other chinese camera powered by Solomon SSD1935 processor: https://github.com/acassis/linux_kernel_ssd1935
[] Alan
You can google
for 3516 – Hi3516_SDK_V1.0.6.0.tgz
for 3518 – Hi3516_SDK_V1.0.7.0.tgz
Let me know.if that does not work.
-Nithin
3518 – Hi3518_SDK_V1.0.7.0.tgz
good luck
Thank you Nithin! I’m downloading it!
Hi Nithin,
I got another Camera module, see: https://acassis.wordpress.com/2014/08/10/i-got-a-new-hi3518-ip-camera-modules/
Is this the same model you have?
I don’t have Username and Password to access its camera Web Interface.
Do you know what is the default user/password?
[]’s
Alan
I can’t find the Hi3516_SDK_V1.0.7.0.tgz. Even with google.
Where i can download it?
Hi Thomas,
I don’t have this file. It is strange I noticed that inside Hi3518_SDK_V1.0.7.0.tgz there is a binary for Hi3516C but inside osdrv kernel 3.0.x the source code has onlu Hi3518 reference.
Search for Hi3516 and Hi3518 differences, maybe they are very software compatible.
[]s, Alan
Dear Alan,
i am so happy that i found your site with all your valuable information about the Hi3518 module
which i could use for my 3516 ones.
Do you have a telnet prompt for the Hi3518 module? If yes i could provide you
the default login and username of my one which should also be good for yours.
Since i’d are starting a project with these modules: could you please drop me a mail to exchange
some information about the hardware and toolchain kits?
Thanks in advance!
Best regards,
Daniel
Hi Alan, I am starting to play around one of the Hi3518 cameras… I also discovered this page http://nemon.org/ipcam-ipr1631x/#Firmware while browsing the internet. Was very useful for me… although nmap wasn’t actually able to detect the OS… Its mesage was
Starting Nmap 5.21 ( http://nmap.org ) at 2014-10-29 13:19 MSK
Nmap scan report for 192.168.1.200
Host is up (0.00053s latency).
Not shown: 994 closed ports
PORT STATE SERVICE
23/tcp open telnet
80/tcp open http
554/tcp open rtsp
3322/tcp open unknown
3323/tcp open unknown
8000/tcp open http-alt
MAC Address: E0:3C:5B:23:23:33 (Unknown)
No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=5.21%D=10/29%OT=23%CT=1%CU=33902%PV=Y%DS=1%DC=D%G=Y%M=E03C5B%TM=5
OS:450BF47%P=i686-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=7
OS:)OPS(O1=M5B4ST11NW1%O2=M5B4ST11NW1%O3=M5B4NNT11NW1%O4=M5B4ST11NW1%O5=M5B
OS:4ST11NW1%O6=M5B4ST11)WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890
OS:)ECN(R=Y%DF=Y%T=40%W=3908%O=M5B4NNSNW1%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+
OS:%F=AS%RD=0%Q=)T2(R=N)T3(R=Y%DF=Y%T=40%W=3890%S=O%A=S+%F=AS%O=M5B4ST11NW1
OS:%RD=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=
OS:0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T
OS:7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN
OS:=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 1 hop
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.70 seconds
I will be trying to get U-boot log soon… Did you have any recent progres with the firmware for Hi3518? Thank you for your page again!
Hi Teed,
Thank you for your comment and for this nice link.
Unfortunately I’m not working on Hi3518 recently. I hope to return my tests to it soon.
I think the most important thing is rev. eng. the camera and video decoder/encoder drivers from these camera. This way we could get an completely open environment. []’s, Alan
For this platform (Juan) access to telnet: login/password – root/juantech
I managed to get into several cameras to exctract their telnet passwords but this 3518 board is harder to crack… in the end of the U-boot the session becomes dumb… I can type commands in my gtkterminal but it seems that the session gets locked… yet if I interrupt the U-boot beofre the kernel gets extracted and loaded I get into command prompt of the U-boot, but I am kinda got stuck in there… the problem is that I need this board really bad, while the others were just to play around :)) And root/juantech doesn’t work…
Hi Teed, did you try to pass init=/sbin/init to u-boot command line in order to avoid login asking for password? []’s, Alan
Hi Acassis. You mean when it gets interrupted in the beginning? What I get is…
U-Boot 2010.06 (Oct 22 2013 – 11:17:09)
NAND: Special Nand id table Version 1.35
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found!!!
0 MiB
Check spi flash controller v350… Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:”MX25L128″
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot:
==========
Here I press a key and get the following command prompt
jxj_3518a#
after asking for help I get this
jxj_3518a# help
? – alias for ‘help’
base – print or set address offset
bootm – boot application image from memory
bootp – boot image via network using BOOTP/TFTP protocol
cmp – memory compare
cp – memory copy
crc32 – checksum calculation
ext2load- load binary file from a Ext2 filesystem
ext2ls – list files in a directory (default /)
fatinfo – print information about filesystem
fatload – load binary file from a dos filesystem
fatls – list files in a directory (default /)
getinfo – print hardware information
go – start application at address ‘addr’
help – print command description/usage
loadb – load binary file over serial line (kermit mode)
loady – load binary file over serial line (ymodem mode)
loop – infinite loop on address range
md – memory display
mii – MII utility commands
mm – memory modify (auto-incrementing address)
mtest – simple RAM read/write test
mw – memory write (fill)
nand – NAND sub-system
nboot – boot from NAND device
nm – memory modify (constant address)
ping – send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset – Perform RESET of the CPU
saveenv – save environment variables to persistent storage
setenv – set environment variables
sf – SPI flash sub-system
tftp – tftp – download or upload image via network using TFTP protocol
usb – USB sub-system
usbboot – boot from USB device
version – print monitor version
————————
So I guess I need to study all features of the U-boot in order to continue… or?
Just to have a logical summary on this. Well… I had to study U-boot and JFFS2 and they way it works from the beginning. And although my had is about to explode… now I have it all in my hands. 1) Changed the U-boot configuration, 2) got into the RFS 3) Copied psswd hash 4) Recovered the hash… Jesus the steam is rushing out of my ears but it was all worth it. Now I rebuild the web on this camera, changed weird scripts and about to start building my own kernel edition/rfs using the SDK for Hi35xx (16,18) chips. Thank you for all! If you want to know some details, please e-mail me. Cheers! Teed
So it looks like the “original” U-boot has been changed in some ways…
Hi Teed, yes you need to setup U-Boot’s bootargs to pass “init=” to ignore login. []’s, Alan
And that is just to type init=/sbin/init in the common prompt after I interrupt it? I did that and all it says is that it doesn’t know init… try help prompts it to me instead 🙂
Just to have a logical summary on this. Well… I had to study U-boot and JFFS2 and they way it works from the beginning. And although my had is about to explode… now I have it all in my hands. 1) Changed the U-boot configuration, 2) got into the RFS 3) Copied psswd hash 4) Recovered the hash… Jesus the steam is rushing out of my ears but it was all worth it. Now I rebuild the web on this camera, changed weird scripts and about to start building my own kernel edition/rfs using the SDK for Hi35xx (16,18) chips. Thank you for all! If you want to know some details, please e-mail me. Cheers! Teed
Maybe I miss something but…
jxj_3518a# init=/sbin/init
Unknown command ‘init=/sbin/init’ – try ‘help’
jxj_3518a#
Hi Teed,
Could you share how you changing the GUI on the SDK ?
Thanks
I have this IP Camera:
Image Sensor 1/3″ 1.3MP CMOS Sensor Aptina 0130S, Main processor HI3518C(Hisilicon)
I’m not able to set the gateway via web interface o software: it always shows 0.0.0.0.
Can you help me?
I tried to connect via telnet but with admi/ 123456 doesn’t work.
Do you have the telnet credentials?
Then I wish to set it with Zoneminder: what is the streaming URL?
Thanks!
Hi Giacomo,
Try to connect to telnet using “root” user instead of “admin”. Each camera model use to have a different credential, first try root and no password (just press enter when asked for password). Otherwise you need to search for it in the Internet.
[]’s, Alan
Hello,
I have a camera based on HI3518, but it is blocked. I seek a linux.img and rootfs.img that I will transfer TFTP. Do you have that?
Thank you.
Hi ddeep,
Search for the SDK file: Hi3518_SDK_V1.0.7.0.tgz
More some info: http://nemon.org/ipcam-ipr1631x/
I didn’t compile this SDK, then I couldn’t help you.
BR,
Alan
Maybe you can help me understand the architecture behind these modules as there isn’t a lot of information online that makes sense to me.
I am not from a linux background, which also makes things difficult.
Most of the Chinese cameras use a flavor of this module and all have very similar features.
I would really like to use this module and add functionality to it but I have no idea how to go about it.
My assumptions lead me to believe that there is a core firmware that runs on this chip that has all the common features like web browser/motion detection alarms/email/ftp etc.
Has this core been adapted by various developers from open source to meet different requirements, or does each development on the chip start from scratch?
Any assistance is greatly appreciated.
Hi Clive,
I don’t know how to help you. It should be similar to ask an airplane’s pilot how to pilot it.
Well, all I can say is: you need to learn Linux and Embedded Linux to understand how it is done.
Many chinese companies use the some base code. They think different from us, they share things and then all win. It is similar to Free and Open Source Software idea.
If you really want to learn it you need to start studying, all you need is available in the Internet and for free!