Skip to content

Instantly share code, notes, and snippets.

@matiaspl

matiaspl/hi3521a_console_output.txt

Last active December 25, 2024 14:52
Show Gist options
  • Save matiaspl/1649da91f7132d526a47c42e865cd879 to your computer and use it in GitHub Desktop.
Save matiaspl/1649da91f7132d526a47c42e865cd879 to your computer and use it in GitHub Desktop.
Download ZIP
Hacking a Hi3521 ARBCV100 AYS41 V13C 4x1 multiviewer / seamless switcher (see comments!)
Raw
hi3521a_console_output.txt
U-Boot 2010.06 (Aug 11 2018 - 18:47:37)
Check Flash Memory Controller v100 ... Found
SPI Nor(cs 0) ID: 0xc2 0x20 0x17
Block:64KB Chip:8MB Name:"MX25L6436F"
SPI Nor total size: 8MB
Cannot found a valid SPI Nand Device
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 1 ··· 0
dev 0 set background color!
jpeg decoding ...
ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ ˇ cmd = ˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇ
<<addr=0x7e0000, size=0xd12a, vobuf=0x8ac00000>>
spi_flash 8084d920
[FILE = jpegd.c LINE = 147] logo flag = 0
mmu_enable
<<imgwidth=1280, imgheight=720, linebytes=2560>>
decode success!!!!
decode jpeg!
OpenDev vo:0 intf_type:36 out_sync:8
dev 0 opened!
graphic layer 0 opened!
upgrade flag = 0
8192 KiB hi_fmc at 0:0 is now current device
## Booting kernel from Legacy Image at 82000000 ...
Image Name: Linux-3.10.0
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4568424 Bytes = 4.4 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Linux version 3.10.0 (root@visual digital-virtual-machine) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v400) ) #3 Sat Aug 4 14:13:59 CST 2018
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: bigfish
Memory policy: ECC disabled, Data cache writeback
CPU: All CPU(s) started in SVC mode.
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
Kernel command line: mem=128M console=ttyAMA0,115200 mtdparts=hi_sfc:384k(uboot),4608K(core),2560K(app),512k(para)
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 116328k/116328k available, 14744k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
vmalloc : 0xc8800000 - 0xff000000 ( 872 MB)
lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.text : 0xc0008000 - 0xc052ba9c (5263 kB)
.init : 0xc052c000 - 0xc0ce89f4 (7923 kB)
.data : 0xc0cea000 - 0xc0d1e320 ( 209 kB)
.bss : 0xc0d1e320 - 0xc0d3fee8 ( 135 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128
GIC CPU mask not found - kernel will fail to boot.
GIC CPU mask not found - kernel will fail to boot.
sched_clock: 32 bits at 62MHz, resolution 16ns, wraps every 68719ms
Console: colour dummy device 80x30
Calibrating delay loop... 2190.54 BogoMIPS (lpj=10952704)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0xc03d0f98 - 0xc03d0ff0
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
hw-breakpoint: maximum watchpoint size is 8 bytes.
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x12080000 (irq = 38) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x12090000 (irq = 39) is a PL011 rev2
uart:2: ttyAMA2 at MMIO 0x120a0000 (irq = 40) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
hi-spi-master hi-spi-master.0: with 2 chip select slaves attached
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource timer0
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
CPU PMU: probing PMU on CPU 0
hw perfevents: enabled with ARMv7 Cortex-A7 PMU driver, 5 counters available
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.22)
SGI XFS with ACLs, security attributes, realtime, large block/inode numbers, no debug enabled
msgmni has been set to 227
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
loop: module loaded
hiahci: initializing
ahci ahci.0: can't get clock
ahci: SSS flag set, parallel bus scan disabled
ahci ahci.0: AHCI 0001.0300 32 slots 2 ports 6 Gbps 0x3 impl platform mode
ahci ahci.0: flags: ncq sntf stag pm led clo only pmp fbs slum part ccc sxs boh
scsi0 : ahci_platform
scsi1 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x11010000-0x1101ffff] port 0x100 irq 49
ata2: SATA max UDMA/133 mmio [mem 0x11010000-0x1101ffff] port 0x180 irq 49
Check Flash Memory Controller v100 ... Found.
SPI Nor(cs 0) ID: 0xc2 0x20 0x17
Block:64KB Chip:8MB Name:"MX25L6436F"
SPI Nor total size: 8MB
4 cmdlinepart partitions found on MTD device hi_sfc
4 cmdlinepart partitions found on MTD device hi_sfc
Creating 4 MTD partitions on "hi_sfc":
0x000000000000-0x000000060000 : "uboot"
0x000000060000-0x0000004e0000 : "core"
0x0000004e0000-0x000000760000 : "app"
0x000000760000-0x0000007e0000 : "para"
SPI Nand ID Table Version 2.2
Cannot found a valid SPI Nand Device
Higmac dma_sg_phy: 0x86f00000
libphy: higmac_mdio_bus: probed
PHY mdio0:01 not found
ETH0: rmii, phy_addr=1, mii_name=mdio0
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
before uhci_hcd and ohci_hcd, not after
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 51, io mem 0x10040000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 50, io mem 0x10030000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver usb-storage
mousedev: PS/2 mouse device common for all mice
ata1: SATA link down (SStatus 0 SControl 300)
i2c /dev entries driver
hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed!
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
oprofile: using timer interrupt.
TCP: cubic registered
NET: Registered protocol family 17
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
ˇata2: SATA link down (SStatus 0 SControl 300)
Freeing unused kernel memory: 7920K (c052c000 - c0ce8000)
[RCS]: /etc/init.d/S00devs
[RCS]: /etc/init.d/S01udev
udevd (644): /proc/644/oom_adj is deprecated, please use /proc/644/oom_score_adj instead.
[RCS]: /etc/init.d/S80network
[RCS]: /etc/init.d/S90init
modules/
modules/hi3521a_chnl.ko
modules/hi3521a_ai.ko
modules/hi_rtc.ko
modules/hiuser.ko
modules/hi3521a_jpege.ko
modules/hi3521a_venc.ko
modules/hi3521a_region.ko
modules/pinmux_hi3521a_vga_hdmi_spi.sh
modules/hi3521a_aenc.ko
modules/hi_media.ko
modules/hi3521a_adec.ko
modules/hi3521a_vfmw.ko
modules/hi3521a_ao.ko
modules/pinmux_hi3521a_vicap.sh
modules/load3521a
modules/extdrv/
modules/extdrv/sii1i2c.ko
modules/extdrv/i2c_phys.ko
modules/extdrv/gpio.ko
modules/extdrv/hi_ir.ko
modules/extdrv/sii0i2c.ko
modules/extdrv/sii3i2c.ko
modules/extdrv/sii2i2c.ko
modules/extdrv/hdmii2c.ko
modules/hi3521a_vdec.ko
modules/sysctl_hi3521a_asic.sh
modules/hi3521a_vou.ko
modules/hi3521a_ive.ko
modules/hi3521a_rc.ko
modules/crgctrl_hi3521a.sh
modules/hi3521a_hdmi.ko
modules/hi3521a_vpss.ko
modules/hi3521a_aio.ko
modules/hi3521a_jpegd.ko
modules/hi3521a_viu.ko
modules/hi3521a_h264e.ko
modules/hi3521a_vgs.ko
modules/hifb.ko
modules/hi3521a_tde.ko
modules/hi3521a_vda.ko
modules/pinmux_hi3521a_i2s.sh
modules/hi3521a_base.ko
modules/hi3521a_sys.ko
modules/mmz.ko
Hisilicon Media Memory Zone Manager
Module himedia: init ok
hi3521a_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
load sys.ko for Hi3521A...OK!
load vdec.ko ....OK
load vhd firmware.ko OK
Load hi_jpegdec.ko success.·(SDK_VERSION:[SDK_VERSION] Build Time:[Jan 13 2017, 18:19:19])
Load hi_tde.ko success.··(SDK_VERSION:[SDK_VERSION] Build Time:[Jan 13 2017, 18:19:06])
load region.ko ....OK!
load vgs.ko for Hi3521A...OK!
load viu.ko ...OK!
load vpss.ko ....OK!
load vou.ko ....OK!
load hdmi.ko ....OK!
load rc.ko for Hi3521A...OK!
load venc.ko for Hi3521A...OK!
load chnl.ko for Hi3521A...OK!
load h264e.ko for Hi3521A...OK!
load jpege.ko for Hi3521A...OK!
load vda.ko ....OK!
load ive.ko ... OK!
KERN_INFO OSDRV_MODULE_VERSION_STRING
HISI_IRDA-MF @Hi3518v100R001
hiir: init ok. ver=Aug 3 2018, 23:11:54.
KERN_INFO OSDRV_MODULE_VERSION_STRING
KERN_INFO OSDRV_MODULE_VERSION_STRING
KERN_INFO OSDRV_MODULE_VERSION_STRING
KERN_INFO OSDRV_MODULE_VERSION_STRING
load ai.ko for Hi3521A...OK!
load ao.ko for Hi3521A...OK!
load aenc.ko for Hi3521A...OK!
load adec.ko for Hi3521A...OK!
www/
www/Reboot.html
www/Reset.html
www/SystemUpdate.html
www/images/
www/images/b.png
www/images/bg-login-top.png
www/images/exclamation.png
www/images/bg-button-green.gif
www/images/cross.png
www/images/bg-body.gif
www/images/jquery_wysiwyg.gif
www/images/bg-sidebar.gif
www/images/tick_circle.png
www/images/bg-form-field.gif
www/images/br.png
www/images/bl.png
www/images/Thumbs.db
www/images/bullet_black.png
www/images/bg-login.gif
www/images/cross_circle.png
www/images/bg-radial-gradient.gif
www/images/tl.png
www/images/shortcut-button-bg.gif
www/images/hammer_screwdriver.png
www/images/bg-menu-item-green.gif
www/images/bg-menu-item-current.gif
www/images/loading.gif
www/images/bg-content-box.gif
www/images/information.png
www/images/tr.png
www/images/cross_grey_small.png
www/images/logo.png
www/images/menu-current-arrow.gif
www/css/
www/css/jquery.percentageloader-0.1.css
www/css/reset.css
www/css/style.css
www/css/invalid.css
www/connect.html
www/SetPassword.html
www/SetNet.html
www/index.html
www/setBaudRate.html
www/js/
www/js/jquery.percentageloader-0.1.js
www/js/simpla.jquery.configuration.js
www/js/jquery-1.4.1.min.js
www/js/ajaxfileupload.js
www/js/jquery-1.3.2.min.js
www/js/getagain.js
www/js/jquery.wysiwyg.js
www/OutputP1Main.html
lib/
lib/libcommonlib.so
lib/libAPI.so
lib/libLRCF.so
bin/
bin/webserver
bin/SII9293A1
bin/FWUpgrade
bin/IFrameVieoNet.h264
bin/SII9293A2
bin/lighttpd
bin/SII9293A0
bin/DevMsg
bin/MediaServer
bin/ddnsclient
bin/DisPlay
bin/IFrameVieoLoss.h264
bin/WatchDog
bin/SII9293A3
*** Board tools : ver0.0.1_20130123 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x120f0184: 0x00000001 --> 0x00000000
[END]
*** Board tools : ver0.0.1_20130123 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x120f0188: 0x00000001 --> 0x00000000
[END]
*** Board tools : ver0.0.1_20130123 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x120f00e0: 0x00000001 --> 0x00000000
[END]
*** Board tools : ver0.0.1_20130123 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x120f00e4: 0x00000001 --> 0x00000000
[END]
*** Board tools : ver0.0.1_20130123 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x120f017c: 0x00000001 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20130123 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x120f0180: 0x00000001 --> 0x00000001
[END]
*** Board tools : ver0.0.1_20130123 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x120f00ac: 0x00000002 --> 0x00000001
[END]
Please press Enter to activate this console. 1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:56]get msg qeue msgid:0
1970-01-01 00:00:03.000 [WATCH_DOG main.cpp:50]wang wang wang !
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdogConfig.cpp:91]read name is TX
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdogConfig.cpp:100]Product is Tx
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:77]get process:SII9293A0
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:77]get process:SII9293A1
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:77]get process:SII9293A2
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:77]get process:SII9293A3
1970-01-01 00:00:03.000 [WATCH_DOG CWatchdog.cpp:77]get process:DisPlay
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:369]kill sub process:SII9293A0 fail
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:371]killed sub process:SII9293A0, pid:54188
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:270][ startSubProcess name:/var/bin/SII9293A0, param:(null) ]
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:279]Create child:1008
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:369]kill sub process:SII9293A1 fail
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:371]killed sub process:SII9293A1, pid:54188
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:270][ startSubProcess name:/var/bin/SII9293A1, param:(null) ]
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:279]Create child:1009
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:369]kill sub process:SII9293A2 fail
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:371]killed sub process:SII9293A2, pid:54188
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:270][ startSubProcess name:/var/bin/SII9293A2, param:(null) ]
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:279]Create child:1010
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:369]kill sub process:SII9293A3 fail
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:371]killed sub process:SII9293A3, pid:54188
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:270][ startSubProcess name:/var/bin/SII9293A3, param:(null) ]
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:279]Create child:1011
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:369]kill sub process:DisPlay fail
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:371]killed sub process:DisPlay, pid:54188
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:270][ startSubProcess name:/var/bin/DisPlay, param:(null) ]
1970-01-01 00:00:05.000 [WATCH_DOG CWatchdog.cpp:279]Create child:1012
sii9293drv driver starting!
Version: CP5293-v1.00.00
Build: 16:34:53-Aug 21 2018
register_chrdev 9293 addr = 1
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:201]Get Video Index = 0
write head info error or more of User count = 0datasize = 1024 dataoffset = 4096
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:76]Starting sii-9293
sii9293drv driver starting!
Version: CP5293-v1.00.00
Build: 16:35:04-Aug 21 2018
register_chrdev 9293 addr = 2
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:201]Get Video Index = 0
write head info error or more of User count = 0datasize = 1024 dataoffset = 4096
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:76]Starting sii-9293
sii9293drv driver starting!
Version: CP5293-v1.00.00
Build: 16:35:15-Aug 21 2018
register_chrdev 9293 addr = 3
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:201]Get Video Index = 0
write head info error or more of User count = 0datasize = 1024 dataoffset = 4096
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:76]Starting sii-9293
sii9293drv driver starting!
Version: CP5293-v1.00.00
Build: 16:34:42-Aug 21 2018
register_chrdev 9293 addr = 0
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:201]Get Video Index = 0
write head info error or more of User count = 0datasize = 1024 dataoffset = 4096
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:76]Starting sii-9293
1970-01-01 00:00:05.000 [DISPLAY main.cpp:52]feed dog now!!!
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:123]Device ID: 9293
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:124]Device Revision: 01
1970-01-01 00:00:05.000 [DISPLAY si_drv_evita.c:77]#################read 4A = 0x0 60 = 0xff
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:123]Device ID: 9293
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:124]Device Revision: 01
1970-01-01 00:00:05.000 [DISPLAY si_drv_evita.c:77]#################read 4A = 0x0 60 = 0xff
=======================================id= 10
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:123]Device ID: 9293
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:124]Device Revision: 01
1970-01-01 00:00:05.000 [DISPLAY si_drv_evita.c:77]#################read 4A = 0x0 60 = 0xff
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:123]Device ID: 9293
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:124]Device Revision: 01
1970-01-01 00:00:05.000 [DISPLAY si_drv_evita.c:77]#################read 4A = 0x0 60 = 0xff
1970-01-01 00:00:05.000 [DISPLAY si_drv_rx.c:248]SII9293 OUT sysn mode = 0xf0
1970-01-01 00:00:05.000 [DISPLAY si_drv_rx.c:248]SII9293 OUT sysn mode = 0xf0
1970-01-01 00:00:05.000 [DISPLAY si_drv_rx.c:248]SII9293 OUT sysn mode = 0xf0
1970-01-01 00:00:05.000 [DISPLAY si_drv_rx.c:248]SII9293 OUT sysn mode = 0xf0
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:287]RX Audio: Fs code = 01
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:287]RX Audio: Fs code = 01
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:287]RX Audio: Fs code = 01
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:287]RX Audio: Fs code = 01
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:351]update audio info restart now
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:351]update audio info restart now
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:351]update audio info restart now
1970-01-01 00:00:05.000 [DISPLAY si_rx_audio.c:351]update audio info restart now
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:354]state is not chage ID: 1
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:354]state is not chage ID: 2
1970-01-01 00:00:05.000 [LRCF · LRcfServerT.hpp:209]setTask NOW !!! MaxTask = 5 StackSize = 51200
1970-01-01 00:00:05.000 [LRCF · LRcfServerT.hpp:228]Start LRCF NOW !!! Link = /tmp/.LRCFCodec
1970-01-01 00:00:05.000 [LRCF · LRcfServer.cpp:36]setTask NOW !!! MaxTask = 5 StackSize = 51200
1970-01-01 00:00:05.000 [LRCF · LRcfServer.cpp:54]Start LRCF NOW !!! Link = /tmp/.LRCFCodec
1970-01-01 00:00:05.000 [LRCF · Sock.cpp:123]Start SetServer NOW !!! Link = /tmp/.LRCFCodec
1970-01-01 00:00:05.000 [LRCF · Sock.cpp:217]SERVER link = /tmp/.LRCFCodec CLicet link = sock = 6
1970-01-01 00:00:05.000 [LRCF · Sock.cpp:217]SERVER link = /tmp/.LRCFCodec CLicet link = sock = 6
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:24]ThreadPool Num:5, stack:51200
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:254]PIC LEN = 14429
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:266]PIC LEN = 10204
1970-01-01 00:00:05.000 [DISPLAY Dconfig.cpp:61]load config from /mnt/mtd/app/config/DisPlayConfig.ini
datasize = 1024 dataoffset = 4096
datasize = 1024 dataoffset = 4096
datasize = 1024 dataoffset = 4096
datasize = 1024 dataoffset = 4096
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:421]can not get input0 res Use Default
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:421]can not get input0 res Use Default
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:421]can not get input0 res Use Default
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:421]can not get input0 res Use Default
1970-01-01 00:00:05.000 [DISPLAY CDisPlay.cpp:544]init 0x1f663b0
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:354]state is not chage ID: 0
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:354]state is not chage ID: 3
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:65]Start worker thread tid:-1238885280
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:65]Start worker thread tid:-1238832032
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:65]Start worker thread tid:-1238778784
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:65]Start worker thread tid:-1238725536
1970-01-01 00:00:05.000 [LRCF · ThreadPool.cpp:65]Start worker thread tid:-1238672288
1970-01-01 00:00:05.000 [DISPLAY hAudio.cpp:271]Ai(0,0) bind to AencChn:0 ok!
1970-01-01 00:00:05.000 [DISPLAY hAudio.cpp:271]Ai(0,1) bind to AencChn:1 ok!
1970-01-01 00:00:05.000 [CODEC hAVi.cpp:205]create VI success!!!
1970-01-01 00:00:05.000 [CODEC hAVi.cpp:205]create VI success!!!
1970-01-01 00:00:05.000 [CODEC hAVi.cpp:205]create VI success!!!
1970-01-01 00:00:05.000 [CODEC hAVi.cpp:205]create VI success!!!
1970-01-01 00:00:05.000 [DISPLAY hSys.cpp:41]SysBind[16-0-0]:[7-3-2]
1970-01-01 00:00:05.000 [DISPLAY hSys.cpp:41]SysBind[16-1-4]:[7-2-2]
1970-01-01 00:00:05.000 [DISPLAY hSys.cpp:41]SysBind[16-2-8]:[7-1-2]
1970-01-01 00:00:05.000 [DISPLAY hSys.cpp:41]SysBind[16-3-12]:[7-0-2]
1970-01-01 00:00:05.000 [DISPLAY hWnd.cpp:158]DisableHdmi err ret = 0xa0288004
1970-01-01 00:00:05.000 [DISPLAY hWnd.cpp:691]enIntfSync = 12
1970-01-01 00:00:05.000 [DISPLAY hWnd.cpp:72]InitDev >>><<< w:1920 h:1080 frmt = 60
1970-01-01 00:00:05.000 [DISPLAY hWnd.cpp:123]EnableHdmi ......
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:403]state is no source connected
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:316]Cable connection change: cable out
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:403]state is no source connected
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:316]Cable connection change: cable out
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:403]state is no source connected
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:316]Cable connection change: cable out
1970-01-01 00:00:05.000 [DISPLAY mhl_linuxdrv_main.c:403]state is no source connected
1970-01-01 00:00:05.000 [DISPLAY si_drv_device.c:316]Cable connection change: cable out
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:339]display RGB flag = 0
1970-01-01 00:00:06.000 [DISPLAY hAudio.cpp:648]bind is ok ao ch = 0 adchn = 0 AoDev = 1
1970-01-01 00:00:06.000 [DISPLAY CDisPlay.cpp:606]clear uboot buf
1970-01-01 00:00:06.000 [DISPLAY hAudio.cpp:119]enSample rate = 48000
1970-01-01 00:00:06.000 [DISPLAY hAudio.cpp:393]clk = 2
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:691]enIntfSync = 12
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1026]vo display x = 0 y = 0 w = 1920 h = 1080 mode = 5 i = 0
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1227]^_^ @ ^_^ [x-0, y-0, w-1440, h-1080] [dev:0 ch:0]
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:1295]SetChnFrameRate Dev:0 Chn:0 frmt:30 err ret = 0xa00f804a
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1026]vo display x = 0 y = 0 w = 1920 h = 1080 mode = 5 i = 1
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1227]^_^ @ ^_^ [x-1440, y-0, w-480, h-360] [dev:0 ch:1]
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:1295]SetChnFrameRate Dev:0 Chn:1 frmt:30 err ret = 0xa00f804a
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1026]vo display x = 0 y = 0 w = 1920 h = 1080 mode = 5 i = 2
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1227]^_^ @ ^_^ [x-1440, y-360, w-480, h-360] [dev:0 ch:2]
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:1295]SetChnFrameRate Dev:0 Chn:2 frmt:30 err ret = 0xa00f804a
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1026]vo display x = 0 y = 0 w = 1920 h = 1080 mode = 5 i = 3
1970-01-01 00:00:06.000 [CODEC hWnd.cpp:1227]^_^ @ ^_^ [x-1440, y-720, w-480, h-360] [dev:0 ch:3]
1970-01-01 00:00:06.000 [DISPLAY hWnd.cpp:1295]SetChnFrameRate Dev:0 Chn:3 frmt:30 err ret = 0xa00f804a
1970-01-01 00:00:06.000 [DISPLAY hSys.cpp:41]SysBind[7-1-3]:[15-0-0]
1970-01-01 00:00:06.000 [DISPLAY hSys.cpp:41]SysBind[7-2-3]:[15-0-1]
1970-01-01 00:00:06.000 [DISPLAY hSys.cpp:41]SysBind[7-3-3]:[15-0-2]
1970-01-01 00:00:06.000 [DISPLAY hSys.cpp:41]SysBind[7-0-3]:[15-0-3]
1970-01-01 00:00:06.000 [DISPLAY CDisPlay.cpp:1233]SET VOIDE MODE IS 14
1970-01-01 00:00:06.000 [DISPLAY hAudio.cpp:119]enSample rate = 44100
1970-01-01 00:00:06.000 [DISPLAY hAudio.cpp:393]clk = 1
1970-01-01 00:00:07.000 [DISPLAY hWnd.cpp:339]display RGB flag = 0
1970-01-01 00:00:07.000 [DISPLAY CDisPlay.cpp:1270]open /dev/ttyAMA1 is ok fd = 58
(none) login:
@wes1993
Copy link

wes1993 commented Nov 14, 2020

Hello!! :-D
Thanks a lot for your guide, i have seen your guide but i don't know how can i put my payload.
My device is HI
some info from ny busybox in single user mode:

/etc/init.d # busybox
BusyBox v1.26.2 (2019-07-15 17:52:17 CST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
   or: busybox --list[-full]
   or: busybox --install [-s] [DIR]
   or: function [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as.

Currently defined functions:
        [, [[, arp, arping, ash, awk, base64, basename, blkdiscard, blkid,
        blockdev, brctl, cal, cat, catv, chat, chgrp, chmod, chown, chroot,
        cksum, clear, comm, cp, crond, crontab, cttyhack, cut, date, dc, dd,
        deallocvt, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd,
        dnsdomainname, dos2unix, du, dumpleases, echo, env, ether-wake, expand,
        expr, fakeidentd, false, fatattr, fdflush, fdisk, find, fold, free,
        fsync, fuser, getopt, getty, grep, groups, gzip, halt, hdparm, head,
        hexdump, hostid, hostname, hush, hwclock, id, ifconfig, ifdown,
        ifenslave, ifup, inetd, init, insmod, ionice, iostat, ip, ipaddr,
        ipcalc, iplink, ipneigh, iproute, iprule, iptunnel, kill, killall,
        last, less, linux32, linuxrc, ln, login, logname, losetup, ls, lsmod,
        lsof, lsusb, makedevs, md5sum, mdev, mkdir, mkfifo, mknod, mkswap,
        mktemp, more, mount, mountpoint, mpstat, mt, mv, nameif, nbd-client,
        nc, netstat, nice, nmeter, nohup, nslookup, ntpd, od, pidof, ping,
        pkill, poweroff, printenv, printf, ps, pscan, pstree, pwd, pwdx,
        readlink, realpath, reboot, renice, reset, resize, rm, rmdir, rmmod,
        route, runlevel, runsv, sed, seq, sh, sha1sum, sha256sum, sha3sum,
        sha512sum, shuf, slattach, sleep, smemcap, sort, split, stat, strings,
        stty, sum, swapoff, swapon, sysctl, tac, tail, tar, tcpsvd, tee,
        telnet, telnetd, test, tftp, time, timeout, top, touch, tr, traceroute,
        true, truncate, tty, ttysize, tunctl, udhcpc, udhcpd, udpsvd, uevent,
        umount, uname, unexpand, uniq, unlink, uptime, users, usleep, uudecode,
        uuencode, vconfig, watch, wc, wget, which, who, whoami, whois, xargs,
        yes, zcip

Filesystem                Size      Used Available Use% Mounted on
/dev/root.old             1.0M      1.0M         0 100% /
tmpfs                    54.3M         0     54.3M   0% /dev
tmpfs                    54.3M         0     54.3M   0% /tmp
tmpfs                    54.3M         0     54.3M   0% /media
tmpfs                    54.3M         0     54.3M   0% /var/run
tmpfs                    54.3M         0     54.3M   0% /var/lock

image

NO apparently text editor:
image

How can i decrypt this pass?

/etc # more passwd
root:x:0:0:root:/root:/bin/sh
stb:x:1000:1000:Linux User,,,:/home/stb:/bin/sh

/etc # more passwd-
root:$1$$64lU4r1qa6icjzK/sBmQo.:0:0::/root:/bin/sh

Or do you know how can i flash an old FW (the old FW have a backdoor) via tftp or some else?

Thanks a lot for all your help
Stefano

@wes1993
Copy link

wes1993 commented Nov 14, 2020

I think i have found an entrypoint can you help me only to decrypt the user passord?

/etc # more passwd-
root:$1$$64lU4r1qa6icjzK/sBmQo.:0:0::/root:/bin/sh

@matiaspl
Copy link
Author

matiaspl commented Jan 7, 2021

Hi @wes1993, I somehow missed your message.
The ❌'es in your /etc/passwd file suggests that there's also an /etc/shadow present, so you might check if there's a known hash there.

The hash in your passwd- file (md5crypt type hash) has been seen online: https://forums.hak5.org/topic/38353-embedded-device-password-cracking/ so it's likely the camera uses a more or less known password.

Even if it's not, feel free to use my hash and known password and try to fin a way to alter the contents of the passwd (hopfully you will find a script ran on startup on a writable - or remountable as rw - filesystem as I did. And changing the password is as easy as rewriting the contents of /etc/passwd or/etc/shadow. You can use echo for that purpose.

@wes1993
Copy link

wes1993 commented Jan 7, 2021

Thanks a lot for your reply matiaspl,
finally i have find a way to mount my passwd so i have root access :-D
I doesen't have find a way to stream the video for now but i have telnet access :-D
Best Regards
Stefano

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment