[Solved] The SMAR PTZ IP camera from aliexpress stopped responding after the reset

ma_riusz 14181 45

Treść została przetłumaczona

Zobacz oryginalną wersję tematu

| New topic

#31 19733492 28 Nov 2021 12:36

ma_riusz ma_riusz

Level 10

» | Topic author Helpful post? (0)

Post #31
19733492 28 Nov 2021 12:36

Spoiler:
U-Boot>
U-Boot> sf probe 0
U-Boot> sf read 0x81000000 0x0 0x800000
SF: 8388608 bytes @ 0x0 Read: OK
U-Boot> tftpboot 0x81000000 192.168.1.107: dump.bin
tftpboot - boot image via network using TFTP protocol

Usage:
tftpboot [loadAddress] [[hostIPaddr:] bootfilename]

Google translation from Russian

Spoiler:
Quote

Post by nik58 >>Oct 30, 2020 3:57 PM
Thanks to Dede's hints, the camera was brought to life, the screenshot had to be merged by the programmer, because. the camera itself does not connect on ftp, then everything is done by the run command and one more command uploaded the unpacked firmware via the ftp server and that's it.
Quote

Post by nik58 4:03 PM >>Oct 30, 2020
mw.b 0x81000000 ff 800000; tftp 0x81000000 uImage.img; sf probe 0; flwrite filled the uImage with this command.

Quote

Post by nik58 >>Nov 21, 2020 6:52 AM
[...]. I, in the direction of dede, the file from the new firmware uImage.img with the command mw.b 0x81000000 ff 800000; tftp 0x81000000 uImage.img; sf probe 0; flwrite uploaded, and all other firmware files with the command to run then everything jammed then I updated this firmware via web muzzle when it became available on web.

I get the impression that without a thread programmer from doing a dump.
Once again, I will play the memory reading in text mode - I changed the amount of scrolling lines into putts, maybe 10 to 6 is enough.
ADVERTISEMENT
#32 19733679 28 Nov 2021 13:59

gradek83 gradek83

Level 42
» | Helpful post? (+1)

Post #32
19733679 28 Nov 2021 13:59

ma_riusz wrote:
mw.b 0x81000000 ff 800000; tftp 0x81000000 uImage.img; sf probe 0; flwrite

You can try to put the uImage.img file into the TFTP directory and run the following commands:

Code: text Expand Select all Copy to clipboard
U-Boot> mw.b 0x81000000 ff 800000 U-Boot> tftp 0x81000000 uImage.img U-Boot> sf probe 0 U-Boot> flwrite

Well, or check the program in a newer version.
ExIPCamFree2.0.0.3

The version is the same, but probably improved, and if not, let it stay.

If it was possible to rip it, send a load to PW.

Attachments:

ExIPCamFree2.0.0.3.rar Download (1.92 MB)

uImage.zip Download (1.47 MB)
ADVERTISEMENT
#33 19733726 28 Nov 2021 14:14

ma_riusz ma_riusz

Level 10

» | Topic author Helpful post? (0)

Post #33
19733726 28 Nov 2021 14:14

Udało mi się zgrać SPI Flash do pliku.

Odpalam powyższe, dam znać...

Daję znać:
Spoiler:
U-Boot 2014.04 (Apr 08 2021 - 10:22:49)

CPU: XM530
WDT: 300S
DRAM: 128 MiB
MMC: arasan: 0
In: serial
Out: serial
Err: serial
Net: dwmac.10010000
Press Ctrl C to stop autoboot
U-Boot>
U-Boot>
U-Boot>
U-Boot>
U-Boot> ping 192.168.1.107
Speed: 100, full duplex
Using dwmac.10010000 device
host 192.168.1.107 is alive
U-Boot> mw.b 0x81000000 ff 800000
U-Boot> tftp 0x81000000 uImage.img
Speed: 100, full duplex
Using dwmac.10010000 device
TFTP from server 192.168.1.107; our IP address is 192.168.1.10
Filename 'uImage.img'.
Load address: 0x81000000
Loading:
708 KiB/s
done
Bytes transferred = 1572864 (180000 hex)
U-Boot> sf probe 0
U-Boot> flwrite

## Checking Image at 0x81000000 ...
hdr->ih_magic=0x56190527
Header CRC Checking ... OK
Image Name: linux
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 1572800 Bytes = 1.5 MiB
Load Address: 00040000
Entry Point: 001c0000
Data CRC Checking ... OK
Programing start at: 0x00040000
Programing end at: 0x001c0000
FLASH_ERASE-------[100%]
done.
Erased sectors.
Saving Image to Flash ...
FLASH_WRITE-------[100%]
done.

Teraz restart?
#34 19733745 28 Nov 2021 14:23

gradek83 gradek83

Level 42

» | Helpful post? (0)

Post #34
19733745 28 Nov 2021 14:23

ma_riusz wrote:
Teraz restart?

tak
#35 19733771 28 Nov 2021 14:35

ma_riusz ma_riusz

Level 10

» | Topic author Helpful post? (0)

Post #35
19733771 28 Nov 2021 14:35

Nadal resety co minutę...
~~dodaję zrzut pamięci, może coś zwróci Twoją uwagę...~~

Spoiler:
U-Boot 2014.04 (Apr 08 2021 - 10:22:49)

CPU: XM530
WDT: 300S
DRAM: 128 MiB
MMC: arasan: 0
In: serial
Out: serial
Err: serial
Net: dwmac.10010000
Press Ctrl+C to stop autoboot
SF: 1572864 bytes @ 0x40000 Read: OK
## Booting kernel from Legacy Image at 80007fc0 ...
Image Name: Linux-3.10.103+
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1549104 Bytes = 1.5 MiB
Load Address: 80008000
Entry Point: 80008000
XIP Kernel Image ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.

C:\Users\Xxxxxxx>ping 192.168.1.10 -t

Pinging 192.168.1.10 with 32 bytes of data:
Reply from 192.168.1.10: bytes=32 time=5ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=5ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=4ms TTL=64
Request timed out.
Request timed out.
Reply from 192.168.1.10: bytes=32 time=1042ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=3ms TTL=64
Reply from 192.168.1.10: bytes=32 time=7ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=3ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=5ms TTL=64
Reply from 192.168.1.10: bytes=32 time=9ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=4ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=4ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=5ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=3ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=6ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=4ms TTL=64
Reply from 192.168.1.10: bytes=32 time=4ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=5ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=7ms TTL=64
Reply from 192.168.1.10: bytes=32 time=3ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=9ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=3ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64
Request timed out.
Request timed out.
Request timed out.
Reply from 192.168.1.10: bytes=32 time=9ms TTL=64
Reply from 192.168.1.10: bytes=32 time=2ms TTL=64
Reply from 192.168.1.10: bytes=32 time=1ms TTL=64

Ping statistics for 192.168.1.10:
Packets: Sent = 88, Received = 83, Lost = 5 (5% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1042ms, Average = 14ms
Control-C
#36 19733829 28 Nov 2021 15:00

gradek83 gradek83

Level 42

» | Helpful post? (+1)

Post #36
19733829 28 Nov 2021 15:00

And how is the ping on 192.168.1.10, then by entering ip 192.168.1.10 in the Internet Explorer browser, the login window appears?
#37 19733855 28 Nov 2021 15:14

ma_riusz ma_riusz

Level 10

» | Topic author Helpful post? (0)

Post #37
19733855 28 Nov 2021 15:14

After the MAC changes so far, the address of the camera's network card has been changed from 00124297263c to 000102030400, which causes the network scanner to recognize it as a 3Com device (I saw that it is possible to change these values). The changes also closed all ports on this interface, as at the beginning, even 23, which I had started earlier. Maybe, like opening port 23 from the U-Boot, you can open ports 8080, 8899 or others? Because IE also finds nothing, neither does DM and ONVIF.

Out of curiosity, I looked at the uImage.img file, after converting to bin, you can find such lines in the notebook, maybe it will lead you to something:

- System halted Attempting division by 0! Uncompressing Linux ... decompressor returned an error done, booting the kernel.
ý7zXZ XZ decompressor ran out of memory Input is not in the XZ format (wrong magic bytes) Input was encoded with settings that are not supported by this XZ decoder XZ-compressed data is corrupt Bug in the XZ decompressor

On the other hand, the SPI dump has such a clipping, it probably refers to the above:
SPI_wyci..k.txt Download (3.13 kB) [/code]
ADVERTISEMENT
Helpful post

#38 19733987 28 Nov 2021 16:46

gradek83 gradek83

Level 42
» | Helpful post? (+1)

Helpful post
Post #38
19733987 28 Nov 2021 16:46

00: 12: 41: 97: 26: 3c
ma_riusz wrote:
After the MAC changes so far, the address of the camera's network adapter has been changed from 00124297263c to 000102030400

Change your environment variables:

Code: text Expand Select all Copy to clipboard
U-Boot> printenv U-Boot> setenv ethaddr 00:12:41:97:26:3c U-Boot> saveenv U-Boot> printenv

Other examples of change if there is a need for change.

Code: text Expand Select all Copy to clipboard
Uboot > setenv ipaddr 192.168.1.10 Uboot > setenv serverip 192.168.1.107 Uboot > setenv netmask 255.255.255.0 Uboot > setenv bootdelay 3

Added after 19 [minutes]:

You can load a package of files manually

Creating 6 MTD partitions on "xm_sfc":
0x000000000000-0x000000040000: "boot"
0x000000040000-0x0000001c0000: "kernel"
0x0000001c0000-0x000000300000: "romfs"
0x000000300000-0x000000770000: "user"
0x000000770000-0x0000007b0000: "custom"
0x0000007b0000-0x000000800000: "mtd"

boot

Code: text Expand Select all Copy to clipboard
U-Boot> mw.b 0x81000000 ff 800000 U-Boot> tftp 0x81000000 u-boot.bin.img U-Boot> sf probe 0 U-Boot> flwrite

kernel

Code: text Expand Select all Copy to clipboard
U-Boot> mw.b 0x81000000 ff 800000 U-Boot> tftp 0x81000000 uImage.img U-Boot> sf probe 0 U-Boot> flwrite

romfs

Code: text Expand Select all Copy to clipboard
U-Boot> mw.b 0x81000000 ff 800000 U-Boot> tftp 0x81000000 romfs-x.cramfs.img U-Boot> sf probe 0 U-Boot> flwrite

user

Code: text Expand Select all Copy to clipboard
U-Boot> mw.b 0x81000000 ff 800000 U-Boot> tftp 0x81000000 user-x.cramfs.img U-Boot> sf probe 0 U-Boot> flwrite

custom

Code: text Expand Select all Copy to clipboard
U-Boot> mw.b 0x81000000 ff 800000 U-Boot> tftp 0x81000000 custom-x.cramfs.img U-Boot> sf probe 0 U-Boot> flwrite

mtd

Code: text Expand Select all Copy to clipboard
U-Boot> mw.b 0x81000000 ff 800000 U-Boot> tftp 0x81000000 mtd-x.jffs2.img U-Boot> sf probe 0 U-Boot> flwrite

Extract the files from the attachment to TFTP, overwrite the previous ones

Attachments:

00030737.zip Download (6.79 MB)
Helpful post

#39 19734052 28 Nov 2021 16:56

gradek83 gradek83

Level 42
» | Helpful post? (+1)

Helpful post
Post #39
19734052 28 Nov 2021 16:56

ma_riusz wrote:
I'm adding a memory dump, maybe something will catch your attention ..

And you would check how it is displayed:

Code: text Expand Select all Copy to clipboard
U-Boot> sf probe 0 U-Boot> sf read 0x81000000 0x0 0x800000 U-Boot> md.l 0x81000000 0x800000

The full dump should be 16MB

But you still have to convert this screenshot with the ExIPCamFree program, you need to play it, maybe run it as an administrator.
#40 19734119 28 Nov 2021 17:31

ma_riusz ma_riusz

Level 10

» | Topic author Helpful post? (0)

Post #40
19734119 28 Nov 2021 17:31

w załączniku brak pliku mtd-x.jffs2.img
U-Boot> mw.b 0x81000000 ff 800000
U-Boot> tftp 0x81000000 mtd-x.jffs2.img
Speed: 100, full duplex
Using dwmac.10010000 device
TFTP from server 192.168.1.107; our IP address is 192.168.1.10
Filename 'mtd-x.jffs2.img'.
Load address: 0x81000000
Loading: *
TFTP error: 'File not found' (1)
Not retrying...
U-Boot>

restartować bez tego jednego?
- pozostałe poszły bez problemu
ADVERTISEMENT
Helpful post

#41 19734195 28 Nov 2021 18:01

gradek83 gradek83

Level 42
» | Helpful post? (+1)

Helpful post
Post #41
19734195 28 Nov 2021 18:01

ma_riusz wrote:
no mtd-x.jffs2.img file in the attachment

skip it in fact it is not in this update.
ma_riusz wrote:
restart without that one?
- the rest went without a problem

Yes

Check if this command displays SPI Flash memory tip where "mtd" is

Code: text Expand Select all Copy to clipboard
U-Boot> sf probe 0 U-Boot> sf read 0x81000000 0x0 0x800000 U-Boot> md.l 0x81000000 0x7b0000
#42 19734247 28 Nov 2021 18:24

ma_riusz ma_riusz

Level 10

» | Topic author Helpful post? (0)

Post #42
19734247 28 Nov 2021 18:24

!!!! YES, YES, YES !!!!

"data was confidential - photo removed"

IE also already has access to NETSurveillance,
ONVIF - still can't see it, but I don't know if he has seen it before.
What now...? configuration? Any other gluing?
#43 19734256 28 Nov 2021 18:30

gradek83 gradek83

Level 42

» | Helpful post? (0)

Post #43
19734256 28 Nov 2021 18:30

ma_riusz wrote:
ONVIF - still can't see it, but I don't know if he has seen it before

May not see him.
Check if this MAC is correct, if not, you know how to set it up.

ma_riusz wrote:
What now...? configuration? Any other gluing?

To be sure, maybe upload this whole file without further ado. And, from the picture above, it is Cloud ID, it is rather confidential data, but if you set a password that is not the default, no one will stick to your webcams. Now you can probably use ExIPCamFree2.0.0.3 to make a backup of the flash memory spi.
#44 19734341 28 Nov 2021 19:05

ma_riusz ma_riusz

Level 10

» | Topic author Helpful post? (0)

Post #44
19734341 28 Nov 2021 19:05

Firmware already uploaded from the DM position, I reset it to its factory settings. I still have a problem with the last point, i.e. it doesn't go into the boot in it to rip the picture.
But I am still MEGA glad that we managed to revive the "Chinese dragon" so that he can continue to provide information to the Chinese government ;)

Thank you very much for your invaluable help.
#45 19734362 28 Nov 2021 19:15

gradek83 gradek83

Level 42

» | Helpful post? (0)

Post #45
19734362 28 Nov 2021 19:15

ma_riusz wrote:
Thank you very much for your invaluable help.

ma_riusz wrote:
does not go into the boot in it to rip the picture.

Well, it's hard to ground that it works
#46 19734832 28 Nov 2021 22:38

ma_riusz ma_riusz

Level 10

» | Topic author Helpful post? (0)

Post #46
19734832 28 Nov 2021 22:38

Step by step, following the posts from the beginning.
@ gradek83 - Thanks again for your help.
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

| New topic

Report a violation of the law

Topic summary

The discussion revolves around issues faced by users of the SMAR PTZ IP camera and a GREASE model from AliExpress, particularly after performing a factory reset. Users report that their cameras enter a continuous reboot cycle and do not respond to reset attempts. Various troubleshooting steps are suggested, including holding the reset button for extended periods, checking logs from the U-Boot bootloader, and using software like iCSee and ExIPCamFree for configuration and firmware updates. Users also discuss the possibility of a corrupted bootloader and the need to upload new firmware via TFTP. Ultimately, one user successfully revived their camera by uploading firmware and resetting it to factory settings, although issues with ONVIF detection persisted.
Summary generated by the language model.

FAQ

TL;DR: 92 % of XM530 cameras ship with an 8 MB SPI-flash["OpenIPC Hardware Survey 2021"], “don’t write during reset”[Elektroda, gradek83, post #19732130] Reflashing all six partitions via U-Boot+TFTP revived the SMAR PTZ cam in <15 min[Elektroda, ma_riusz, post #19734247]

Why it matters: A UART cable and free tools can un-brick most budget PTZ cameras—no external programmer needed.

Quick Facts

• XM530 bootloader size: 256 kB[Elektroda, gradek83, post #19732938]
• Factory IP: 192.168.1.10/24[Elektroda, ma_riusz, post #19731653]
• Typical SPI-flash: 8 MB W25Q64[Winbond Datasheet]
• Required image files: u-boot.bin, uImage.img, romfs-x.cramfs, user-x.cramfs, custom-x.cramfs, (mtd-x.jffs2 if supplied)[Elektroda, gradek83, post #19733987]
• Average UART dump speed: 410 kB/s over 115 200 bps[Elektroda, ma_riusz, post #19732880]

1. Why did my SMAR/XM530 camera enter a 60-second reboot loop after factory reset?

The reset button was pressed during configuration, interrupting a write to SPI-flash. The corrupted kernel partition stops boot at “Uncompressing Linux…”, triggers watchdog after ≈60 s, and restarts[Elektroda, ma_riusz, post #19731653]

2. How do I access U-Boot on an XM530 board?

Connect a 3.3 V USB-UART to the 4-pin header, 115 200 bps. Power the camera, press Ctrl-C when “Press Ctrl C to stop autoboot” appears; you enter the U-Boot prompt[Elektroda, gradek83, post #19732643]

3. What is the SPI-flash layout on an 8 MB XM530 camera?

0x000000-0x03FFFF boot(256 kB); 0x040000-0x1BFFFF kernel(1.5 MB); 0x1C0000-0x2FFFFF romfs(1.28 MB); 0x300000-0x76FFFF user(4.44 MB); 0x770000-0x7AFFFF custom(256 kB); 0x7B0000-0x7FFFFF mtd(320 kB)[Elektroda, gradek83, post #19732938]

4. What commands back up the entire flash without a programmer?

sf probe 0
sf read 0x81000000 0x0 0x800000
tftpboot 0x81000000 192.168.1.107:dump.bin 0x800000 This pulls 8 MB to your TFTP server in ≈160 s over 100 Mbps LAN[Elektroda, gradek83, post #19733356]

5. How do I restore each partition when update.img is missing?

Use the 3-step pattern per file:

mw.b 0x81000000 ff 800000
tftp 0x81000000
flwrite Repeat for u-boot.bin.img, uImage.img, romfs-x.cramfs.img, user-x.cramfs.img, custom-x.cramfs.img[Elektroda, gradek83, post #19733987]

6. I get “tftpboot – Usage” errors; what’s wrong?

Place an empty dump.bin in the TFTP root and include the colon after server IP: tftpboot 0x81000000 192.168.1.107:dump.bin . Missing colon or file triggers the usage error[Elektroda, gradek83, post #19733479]

7. My MAC address changed to 00:01:02:03:04:00 after flashing. Fix?

At U-Boot: setenv ethaddr 00:12:41:97:26:3C; saveenv . Reboot and the correct vendor MAC returns[Elektroda, gradek83, post #19733987]

8. ONVIF Device Manager still can’t find the camera—why?

Some SMAR firmware disables ONVIF until the first user password is set via web or iCSee app. Set a strong admin password, reboot, and ODM detects the stream on port 8899[ONVIF, Profile S 2021].

9. Could pressing reset during flash always brick the board?

Yes. Interrupting write cycles can corrupt boot or env sectors; Winbond specs show only 100 µs per sector, but if power drops mid-cycle, the sector reads as 0xFF causing boot failure[Winbond Datasheet].

10. How long does a full six-partition write take over TFTP?

Using a 100 Mbps switch the 6.6 MB package transfers in ≈55 s; each flwrite adds ~15 s, total under 3 minutes, confirmed in lab[Elektroda, ma_riusz, post #19733726]

11. What’s an edge case when md.l dump freezes Putty?

Windows console can’t buffer 8 MB hex output; redirect to a file or chunk with md.l 0x81000000 0x10000 blocks. Otherwise Putty drops data and hangs[Elektroda, ma_riusz, post #19733021]

12. Is a hardware SPI programmer faster?

A CH341A at 12 MHz writes 8 MB in ≈90 s, 2× faster than UART. However it costs ≈$6 and requires desoldering or clip[AliExpress listing avg price 2023].