Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SC002 WA2 Rev 3.0.0 #7

Open
slenderman-poon opened this issue Jan 6, 2023 · 8 comments
Open

SC002 WA2 Rev 3.0.0 #7

slenderman-poon opened this issue Jan 6, 2023 · 8 comments

Comments

@slenderman-poon
Copy link

greetings master,
I'm hoping you can help me to get this running on my kogan branded camera also :)
main and MCU versions in the app both show V2.2.4
have tried formatting the sdcard using the app however it doesn't seem to even kick off anything from the card, no backup folder is created and no telnet is available.

the camera does create the DCIM folder.

not sure if any of the boot log is useful but will include a bit here just in case.

many thanks :)

U-Boot 2014.01-v1.2 (May 11 2019 - 16:41:46)

Board: IPCAM RTS3903 CPU: 500M :rx5281 prid=0xdc02
force spi nor mode
DRAM: 64 MiB @ 1066 MHz
Skipping flash_init
Flash: 0 Bytes
flash status is 0, 0, 0
SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiB
Using default environment

In: serial
Out: serial
Err: serial
MMC: rtsmmc: 0
Net: Realtek PCIe GBE Family Controller mcfg = 0024
no hw config header
new_ethaddr = 00:00:00:00:00:00
r8168#0
no hw config header
flash status is 0, 0, 0
SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiB
ROOTFS IS OK
KERNEL & DRV IS OK
USER IS OK
boot kernel
flash status is 0, 0, 0
SF: Detected GD25Q64C with page size 256 Bytes, erase size 64 KiB, total 8 MiB
SF: 1507328 bytes @ 0x100000 Read: OK

Booting kernel from Legacy Image at 80100000 ...

get header OKimage_get_kernel check hcrc
image_get_kernel print contents
Image Name: linux_3.10
Created: 2019-05-11 8:41:43 UTC
Image Type: MIPS Linux Kernel Image (uncompressed)
Data Size: 1349581 Bytes = 1.3 MiB
Load Address: 80401510
Entry Point: 80401510
Verifying Checksum ... OK
Loading Kernel Image ... OK

Starting kernel ...

Linux version 3.10.27 (wenhe@embed) (gcc version 4.8.5 20150209 (prerelease) (Realtek RSDK-4.8.5p1 Build 2521) ) #2 PREEMPT Sat May 11 15:40:25 CST 2019
prom cpufreq = 500000000
prom memsize = 67108864
hw_ver: 0x2, hw_rev: 0x1, isp_ver: 0x1
prom eth mac = 00:00:00:00:00:00
bootconsole [early0] enabled
CPU revision is: 0000dc02
FPU revision is: 01730001
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Reserved contiguous memory at 0x423000(0x1618000)
Zone ranges:
Normal [mem 0x00000000-0x03ffffff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x00000000-0x03ffffff]
icache: 32kB/32B, dcache: 16kB/32B, scache: 0kB/0B
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS1,57600 root=/dev/mtdblock2 rts_hconf.hconf_mtd_idx=1 rts-quadspi.channels=dual mtdparts=m25p80:8192k@0(global),128k@0k(boot),896k@128k(rootfs),1472k@1024k(kernel),704k@2496k(drv),2304k@3200k(user),2304k@5504k(backup),320k@7808k(mtd),64k@8128k(factory)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 38072k/65536k available (3321k kernel code, 27464k reserved, 581k data, 192k init, 0k highmem)
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Preemptible hierarchical RCU implementation.
NR_IRQS:57
Calibrating delay loop... 497.66 BogoMIPS (lpj=995328)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
Init force reset registers
rtsxb2 registered with IRQs
INFO: initializing ISP memory ...
INFO: initializing ISP device ...
ISP camera platform devices added
INFO: initializing SD controller ...
INFO: initializing snd device ...
snd resvd mem size : 1048576
INFO: initializing USB host ...
INFO: initializing spi host ...0
spi platform id is ffffffff
INFO: initializing I2C master ...
INFO: initializing DMA controller ...
INFO: initializing pinctrl device ...
pinctrl_platform rts3903-pinctrl: rtspc registered with IRQs
INFO: initializing ethernet devices ...
INFO: initializing USB phy ...
INFO: initializing watchdog controller ...
INFO: initializing crypto device ...
INFO: initializing cpu dvfs device ...
bio: create slab at 0
rts_dmac rts3903-dmac: DesignWare DMA Controller, 4 channels
INFO: realtek DMA engine inited
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
usbphy-platform usbphy-platform: Initialized Realtek IPCam USB Phy module
Linux video capture interface: v2.00
Advanced Linux Sound Architecture Driver Initialized.
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NFS: Registering the id_resolver key type
Key type id_resolver registered
Key type id_legacy registered
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
msgmni has been set to 74
NET: Registered protocol family 38
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x18810000 (irq = 6) is a 16550A
console [ttyS1] enabled, bootconsole disabled
console [ttyS1] enabled, bootconsole disabled
serial8250: ttyS1 at MMIO 0x18810100 (irq = 6) is a 16550A
serial8250: ttyS2 at MMIO 0x18810200 (irq = 6) is a 16550A
dbg_iomem initialized!
rts-quadspi rts3903-qspi: force to set channels from quad mode to dual mode
rts-quadspi rts3903-qspi: request 60000000 Hz, force to set 41666666 Hz
rts-quadspi rts3903-qspi: found gd25q64c, expected mx25l12835f
rts-quadspi rts3903-qspi: gd25q64c (8192 Kbytes)
9 cmdlinepart partitions found on MTD device m25p80
Creating 9 MTD partitions on "m25p80":
0x000000000000-0x000000800000 : "global"
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000100000 : "rootfs"
0x000000100000-0x000000270000 : "kernel"
0x000000270000-0x000000320000 : "drv"
0x000000320000-0x000000560000 : "user"
0x000000560000-0x0000007a0000 : "backup"
0x0000007a0000-0x0000007f0000 : "mtd"
0x0000007f0000-0x000000800000 : "factory"
rts-quadspi rts3903-qspi: Realtek QSPI Controller at 0x18030000 (irq 5)
rtl8168 Gigabit Ethernet driver 8.038.00-NAPI loaded
rtl8168 rts3903-r8168 (unregistered net_device): Get invalid MAC address from flash!
eth%d: 0xb8400000, 00:00:00:00:00:00, IRQ 10
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci-rts: ehci-rts platform driver
ehci-platform ehci-platform: EHCI Host Controller
ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
ehci-platform ehci-platform: irq 11, io mem 0x18100000
ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: EHCI Host Controller
usb usb1: Manufacturer: Linux 3.10.27 ehci_hcd
usb usb1: SerialNumber: ehci-platform
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
ohci-platform ohci-platform: Generic Platform OHCI Controller
ohci-platform ohci-platform: new USB bus registered, assigned bus number 2
ohci-platform ohci-platform: irq 11, io mem 0x18180000
usb usb2: New USB device found, idVendor=1d6b, idProduct=0001
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: Generic Platform OHCI Controller
usb usb2: Manufacturer: Linux 3.10.27 ohci_hcd
usb usb2: SerialNumber: ohci-platform
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
i2c /dev entries driver
Stopped watchdog timer
timer margin: 8 sec
TCP: cubic registered
NET: Registered protocol family 17
Key type dns_resolver registered
mtd1 name is boot
hconf init failed
ALSA device list:
No soundcards found.
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 192K (803e0000 - 80410000)
usb 1-1: new high-speed USB device number 2 using ehci-platform
usb 1-1: New USB device found, idVendor=0bda, idProduct=f179
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: 802.11n
usb 1-1: Manufacturer: Realtek
usb 1-1: SerialNumber: 68572D7B977E
Sat Oct 24 10:24:00 UTC 2015


| | | | | |
| | ___ | |__ | | ___ _ __
| | / _ | '
/ | / _ \ '|
| |
| () | |) __ \ || / |
|
_/|./|/___|_|

ntpclient: can't load library 'libsysconf.so'
jffs2: notice: (267) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
rlx snd internal codec init
soc-audio soc-audio.0.auto: ASoC: machine RLX_INTERN_CARD should use snd_soc_register_card()
soc-audio soc-audio.0.auto: rlx-codec-digital <-> pcm-platform mapping ok
soc-audio soc-audio.0.auto: rlx-codec-analog <-> pcm-platform mapping ok
RTW: module init start
RTW: rtl8188fu v5.3.0.1_28034.20180525
RTW: build time: May 11 2019 15:41:23
RTW: HW EFUSE
RTW: 0x000: 29 81 00 FC 0B 00 00 00 00 0C 04 4C 10 07 00 00
RTW: 0x010: 29 27 25 22 20 1E 32 30 2E 2C 2A 02 FF FF FF FF
RTW: 0x020: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x030: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x040: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x050: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x060: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x070: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x090: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x0A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x0B0: FF FF FF FF FF FF FF FF 20 2D 1D 00 00 00 00 FF
RTW: 0x0C0: FF 12 00 10 00 FF 00 FF 00 00 FF FF FF FF FF FF
RTW: 0x0D0: DA 0B 79 F1 42 66 40 68 57 2D 7B 97 7E 09 03 52
RTW: 0x0E0: 65 61 6C 74 65 6B 09 03 38 30 32 2E 31 31 6E 00
RTW: 0x0F0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x100: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x110: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x120: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x130: C1 B6 FF FF FF FF FF FF FF FF 00 11 FF FF FF FF
RTW: 0x140: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x150: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x160: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x170: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x180: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x190: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1A0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1B0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1C0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1D0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1E0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: 0x1F0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
RTW: hal_com_config_channel_plan chplan:0x20
RTW: rtw_regsty_chk_target_tx_power_valid return FALSE for band:0, path:0, rs:0, t:-1
RTW: rtw_ndev_init(wlan0) if1 mac_addr=68:57:2d:7b:97:7e
RTW: rtw_ndev_init(wlan1) if2 mac_addr=6a:57:2d:7b:97:7e
usbcore: registered new interface driver rtl8188fu
RTW: module init ret=0
rtscam:isp resvd mem addr : 0x00523000, size : 0x1518000
rtscam:rtscam_mem_init v:0xa0523000 p:0x00523000 s:0x00001518
rtscam:rtscam_lock_init
rtscam:rtscam_soc_probe
rtscam:rtscam_hx280_probe
rtscam:hx280enc:HW at base <0x18060000> with ID <0x48317011>
rtscam:rtscam_jpgenc_probe
rtscam:rtscam_osd2_probe
rtscam:rtstream_init
(none) login: status: active CC:
/opt/skyeye/script/app/ty_monirtscam:begin to load fw from isp.fw
tor.sh: line 30: set_wifi_country_code: not found
excute rts3903 platform script...
rtscam:Load firmware size : 131024.
rtscam:Found ISP 1.011 device
rtscam:+++++rtscam_video_device_probe 1473
rtscam:+++++rtscam_video_device_probe 1473
rtscam:+++++rtscam_video_device_probe 1473
rtscam:+++++rtscam_video_device_probe 1477, streamnum: 3, 3
rtscam:video device registered
rtscam:rts3903-isp initialized
kill telnetd
begin
__, action: 0Started watchdog timer

Started watchdog timer
mmc0: new high speed SDHC card at address 0001
mmcblk0: mmc0:0001 00000 3.62 GiB
mmcblk0: p1
/dev/mmcblk0 /dev/mmcblk0p1
/dev/mmcblk0 /dev/mmcblk0p1
FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
/opt/skyeye/script/app/ty_monitobw_mode=0x20
r.sh: line 164: set_wifi_country_code: not found
[2015-10-24 10:24:9.854 tid(507) main.c main(69) Debug] begin__
[2015-10-24 10:24:9.855 tid(507) tycam_devcom_inf.c tycam_devcom_start(210) Debug] begin___
[2015-10-24 10:24:9.920 tid(507) ty_wifi.c ty_hwl_wifi_init(634) Debug] bigin___
[2015-10-24 10:24:9.921 tid(507) ty_wifi.c ty_hwl_wifi_init(648) Debug] end___
[2015-10-24 10:24:9.921 tid(507) tuya_ipc_mgr_utils.c TUYA_IPC_SDK_INIT(138) Debug] SDK Version:
< TUYA IOT SDK V:4.1.1 BS:30.01_PT:2.2_LAN:3.3_CAD:1.0.1_CD:1.0.0 >
IPC DEFS < ENABLE_ECHO_SHOW:1 ENABLE_CHROMECAST:1 ENABLE_CLOUD_STORAGE:1 >'
< BUILD AT:2019_06_03_14_38_25 BY chenjing FOR tuya_wifi_ipc AT rts3903 >

[2015-10-24 10:24:10.214 tid(507) tuya_ipc_media_utils.c TUYA_APP_Init_Ring_Buffer(80) Debug] init ring buffer Channel:0 Enable:1
20230106_181141

@cjj25
Copy link
Owner

cjj25 commented Jan 6, 2023

I have this exact camera as a dev board.

Can you check to see if the payload has enabled telnet?

Follow the instructions here

@slenderman-poon
Copy link
Author

the telnet line has been uncommented in the ty_sdcard_upgrade.sh
trying to connect though i get "connection refused"
I don't suppose we know the user/pass for the console to kick the script off manually?

@cjj25
Copy link
Owner

cjj25 commented Jan 6, 2023

I've not cracked the hash yet but if you've got the GPU power spare, it's here:
$1$dVhFuDGx$YrOKRgTcjTCqEK75.z277/

@cjj25
Copy link
Owner

cjj25 commented Jan 6, 2023

There is also this file I recently found (not checked any of them), check these.

@slenderman-poon
Copy link
Author

alas i have not the hardware to brute a whatever that is (MD5???), i wish i did though :)
none of those user/pass combos worked :(

in theory should this be working on my board? if its working for you with the same Rev and firmware i'll start back at square 1 incase i've missed something simple.

@slenderman-poon
Copy link
Author

master,
I have new hardware arriving tomorrow. was doing some testing on the above hash before it gets here.
are you able to verify that is the complete hash? none of the regular tools are able to ID it, its been suggested it may be missing characters?

many thanks

@cjj25
Copy link
Owner

cjj25 commented Jan 23, 2023

Apologies, it's missing the final '/' so its $1$dVhFuDGx$YrOKRgTcjTCqEK75.z277/

@slenderman-poon
Copy link
Author

master,
so far there have been no happyness with brute forcing the above hash but it is still running and will let you know if I have joy.
in the meantime I have pulled the flash memory and dumped it to a bin file, using binwalk i can see the filesystems and using dd have extracted and unsquashed them. if they are of any assistance to you please let me know and i can send you what you need.

much gratitude

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants