The SMAR PTZ IP camera from aliexpress stopped responding after the reset

Name: The SMAR PTZ IP camera from aliexpress stopped responding after the reset
Uploaded: 2021-11-27T01:43:44+01:00
Description: @ gradek83 I want to connect to the above topic, because I also have a problem with the camera. Mine is the GREASE from aliexpress: buildTime: 2021-06-08 17:00:09, version: V5.00.R02.00030737.10010.349f17.0000000, type: 7, isAPModel: 0, ChnCount: 1, LoginEncType: 0, HardWare: XM530_R80X50-PQ_8M,...

Question

@ gradek83 I want to connect to the above topic, because I also have a problem with the camera. Mine is the GREASE from aliexpress: buildTime: 2021-06-08 17:00:09, version: V5.00.R02.00030737.10010.349f17.0000000, type: 7, isAPModel: 0, ChnCount: 1, LoginEncType: 0, HardWare: XM530_R80X50-PQ_8M,...

gradek83 · Answer

Send a photo of the camera. In addition, the photo from the inside should be a wifi module

Added after 14 [minutes]:

ma_riusz wrote:
I have the impression that the fault could be caused by recalling the factory settings in the field (headlining at home), where when loading the settings again, I pressed the reset button again

It may have damaged something during the firmware update, but not during the reset anyway.

Power off the camera. Press and hold the reset, connect the power supply and hold down the reset for 30-60s.
The camera should reset unless I'm mistaken and you should hear voice prompts from the camera. The camera lights up the control LEDs at the start and then it should rotate and calibrate the position.

ma_riusz wrote:
I connected to it via USB UART, I was able to enter the U-boo

Show startup log from terminal.
And the output of the commands in u-boot:
: help
: printenv

The camera, if it has a LAN cable connected, usually tries to connect via DHCP to e.g. a router. When you run it without a LAN cable, if it is not configured, it will want to connect to wi-fi. The application that supports the camera is probably iCSee

Added after 5 [minutes]:

ma_riusz wrote:
but unfortunately the root password from the passwords that the internet prompts you to do - does not work.

have you tried this

Spoiler:

xmhdipc

ma_riusz · Answer

U-Boot log file:
U-Boot.txt Download (3.38 kB)
Photo of the module with WiFi:

Spoiler:

From the reset, until the "switch" popped - there is now a jumper

which I keep even longer than a minute and unfortunately the effect is not as expected. Still resets.

I tried the password, of course - to no avail.
A consultant from the SMAR Official Store on Ali says he doesn't have a root password, but that doesn't come in either.
I do not go either - as he claimed, the password I put on ICSee and the login admin.

I would like to add that the 3x reset goes into the AP mode in the camera as Robot_624e - it is then available at 192.168.10.1 - it can give the connecting phone or laptop from ubuntu 20.04 the correct address from its range. The port scan in this mode also shows available telnet at 23, I can enter the command line. but here again the struggle with the time before the reset by testing the next passwords.

gradek83 · Answer

He probably didn't know what you were asking about, don't write to the guy because he won't help you. This is a log from the entire boot without entering u-boot and u-boot with the command: : bdinfo : version When you connect the camera and the ping will respond, then run ONVIF Device Manager, log in to admin admin and scan and when it finds this camera, select this camera and send a screenshot from the Identification tab. Added after 7 [minutes]: There is a Russian ExIPCamFree program in this post I more or less described its operation. With its help, it might be possible to do a BACKUP of what you have already uploaded there and, if necessary, upload the new firmware to what you have downloaded.

ma_riusz · Answer

Log from U-Boot: U-Boot..txt Download (1.34 kB) ONVIF - unfortunately finds nothing (except the Dahua recorder, which works normally)

gradek83 · Answer

And DeviceManager detects? If so, it may be able to upload the firmware.

ma_riusz · Answer

Unfortunately, DeviceManager also sees nothing. However, in ExIPCamFree I have a problem with breaking through CTRL C. But with a memory read error after trying to run Definition

gradek83 · Answer

Probably the boot loader has crashed. Send a photo of the other side of this board, there should be SPI FLASH memory, but to be sure, I want to make sure it is really there.

ma_riusz · Answer

Pictures: Spoiler: Show There is no such thing as the best system in the world chkdsk /f from the bootloader?

gradek83 · Answer

Przy połączeniu UART. Ping na 192.168.1.10 powinien przechodzić. ipaddr=192.168.1.10 sf read 80007fc0 40000 180000 U-Boot> bootm 80007fc0 I podeślij log z tego jeśli normalnie ponownie U-Boot wystartuje wtedy wpisz: Spoiler: Show Code: text Expand Select all Copy to clipboardU-Boot> da=mw.b 0x81000000 ff 800000 U-Boot> tftp 0x81000000 u-boot.bin.img U-Boot> sf probe 0 U-Boot> flwrite I podeślij log. Dodano po 4 [minuty]: Czyli pewnie reszta elektroniki siedzi głębiej przy przetworniku obrazu. Nie ma takiej komendy jak widać z poziomu U-Boot Spoiler: Show U-Boot> help ? - alias for 'help' base - print or set address offset bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootm - boot application image from memory bootp - boot image via network using BOOTP/TFTP protocol cmp - memory compare coninfo - print console devices and information cp - memory copy cramfsload- load binary file from a filesystem image cramfsls- list files in a directory (default /) crc32 - checksum calculation dhcp - boot image via network using DHCP/TFTP protocol echo - echo args to console editenv - edit environment variable env - environment handling commands fatinfo - print information about filesystem fatload - load binary file from a dos filesystem fatls - list files in a directory (default /) flwrite - SPI flash sub-system go - start application at address 'addr' help - print command description/usage imxtract- extract a part of a multi-image itest - return true/false on integer compare loadb - load binary file over serial line (kermit mode) loadx - load binary file over serial line (xmodem mode) loady - load binary file over serial line (ymodem mode) loop - infinite loop on address range md - memory display mm - memory modify (auto-incrementing address) mmc - MMC sub system mmcinfo - display MMC info mw - memory write (fill) nfs - boot image via network using NFS protocol nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables setexpr - set environment variable as the result of eval expression sf - SPI flash sub-system sleep - delay execution for some time source - run script from memory tftpboot- boot image via network using TFTP protocol version - print monitor, compiler and linker version

ma_riusz · Answer

log z pierwszego:

U-Boot> sf probe 0
U-Boot> sf read 80007fc0 40000 180000
SF: 1572864 bytes @ 0x40000 Read: OK
U-Boot> bootm 80007fc0
## Booting kernel from Legacy Image at 80007fc0 ...
Image Name: Linux-3.10.103+
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1549104 Bytes = 1.5 MiB
Load Address: 80008000
Entry Point: 80008000
XIP Kernel Image ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
U-Boot> printenv bootcmd
bootcmd=sf probe 0;sf read 80007fc0 40000 180000;bootm 80007fc0
U-Boot>

Po restarcie próba wpisu "da..." kończy się nierozpoznaniem komendy:
U-Boot>
U-Boot> da=mw.b 0x81000000 ff 800000
Unknown command 'da=mw.b' - try 'help'

gradek83 · Answer

Check it like this: Spoiler: Show Code: text Expand Select all Copy to clipboardU-Boot> mw.b 0x81000000 ff 800000 U-Boot> tftp 0x81000000 u-boot.bin.img U-Boot> sf probe 0 U-Boot> flwrite U-Boot> sf probe 0 U-Boot> sf read 80007fc0 40000 180000 U-Boot> bootm 80007fc0

ma_riusz · Answer

Plik loga z wcześniejszej walki:
U-Boot..txt Download (7.06 kB)

U-Boot> mw.b 0x81000000 ff 800000
U-Boot> tftp 0x81000000 u-boot.bin.img
Speed: 100, full duplex
Using dwmac.10010000 device
TFTP from server 192.168.1.217; our IP address is 192.168.1.10
Filename 'u-boot.bin.img'.
Load address: 0x81000000
Loading: ##################################################
410.2 KiB/s
done
Bytes transferred = 194496 (2f7c0 hex)
U-Boot> sf probe 0
U-Boot> flwrite
DestAddr invalid!
DestAddr: 0x00000000~0x4000000
U-Boot> flwrite
DestAddr invalid!
DestAddr: 0x00000000~0x4000000
U-Boot>

gradek83 · Answer

Start the camera and send the startup log.

ma_riusz · Answer

log: Spoiler: Show U-Boot 2014.04 (Apr 08 2021 - 10:22:49) CPU: XM530 WDT: 300S DRAM: 128 MiB MMC: arasan: 0 In: serial Out: serial Err: serial Net: dwmac.10010000 Press Ctrl C to stop autoboot SF: 1572864 bytes @ 0x40000 Read: OK ## Booting kernel from Legacy Image at 80007fc0 ... Image Name: Linux-3.10.103 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1549104 Bytes = 1.5 MiB Load Address: 80008000 Entry Point: 80008000 XIP Kernel Image ... OK Starting kernel ... Uncompressing Linux... done, booting the kernel. ▒ U-Boot> printenv appCloudExAbility=l7PdKrbjTMM= appNetIP=0x0A01A8C00x00FFFFFF0x0101A8C0 appProducerID=A37 baudrate=115200 bootargs=mem=65M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=xm_sfc:256K(boot),1536K(kernel),1280K(romfs),4544K(user),256K(custom),320K(mtd) bootcmd=sf probe 0;sf read 80007fc0 40000 180000;bootm 80007fc0 bootdelay=1 cramfsaddr=0x60040000 da=mw.b 0x81000000 ff 800000;tftp 0x81000000 u-boot.bin.img;sf probe 0;flwrite dc=mw.b 0x81000000 ff 800000;tftp 0x81000000 custom-x.cramfs.img;sf probe 0;flwrite dd=mw.b 0x81000000 ff 800000;tftp 0x81000000 mtd-x.jffs2.img;sf probe 0;flwrite dr=mw.b 0x81000000 ff 800000;tftp 0x81000000 romfs-x.cramfs.img;sf probe 0;flwrite du=mw.b 0x81000000 ff 800000;tftp 0x81000000 user-x.cramfs.img;sf probe 0;flwrite dw=mw.b 0x81000000 ff 800000;tftp 0x81000000 web-x.cramfs.img;sf probe 0;flwrite ethact=dwmac.10010000 ethaddr=00:12:41:97:26:3c ipaddr=192.168.1.10 netmask=255.255.255.0 serverip=192.168.1.217 stderr=serial stdin=serial stdout=serial telnetctrl=1 tk=mw.b 0x81000000 ff 800000;tftp 0x81000000 uImage; bootm 0x81000000 ua=mw.b 0x81000000 ff 800000;tftp 0x81000000 upall_verify.img;sf probe 0;flwrite up=mw.b 0x81000000 ff 800000;tftp 0x81000000 update.img;sf probe 0;flwrite verify=n Environment size: 1316/65532 bytes U-Boot>

gradek83 · Answer

Zawaliłem tak powinno ruszyć: Spoiler: Show Code: text Expand Select all Copy to clipboardU-Boot> mw.b 0x81000000 ff 0x40000 U-Boot> tftp 0x81000000 u-boot.bin.img U-Boot> sf probe 0 U-Boot> sf erase 0x0 0x40000 U-Boot> sf write 0x81000000 0x0 0x40000 U-Boot> flwrite

ma_riusz · Answer

Spoiler: Show U-Boot> U-Boot> mw.b 0x81000000 ff 0x40000 U-Boot> tftp 0x81000000 u-boot.bin.img Speed: 100, full duplex Using dwmac.10010000 device TFTP from server 192.168.1.217; our IP address is 192.168.1.10 Filename 'u-boot.bin.img'. Load address: 0x81000000 Loading: ################################################## 687.5 KiB/s done Bytes transferred = 194496 (2f7c0 hex) U-Boot> sf probe 0 U-Boot> sf erase 0x0 0x40000 FLASH_ERASE-------[100%] SF: 262144 bytes @ 0x0 Erased: OK U-Boot> sf write 0x81000000 0x0 0x40000 FLASH_WRITE-------[100%] SF: 262144 bytes @ 0x0 Written: OK U-Boot> flwrite DestAddr invalid! DestAddr: 0x00000000~0x4000000 U-Boot> U-Boot>

gradek83 · Answer

Reboot the camera and enter the boot log.

ma_riusz · Answer

Spoiler: Show U-Boot 2014.04 (Apr 08 2021 - 10:22:49) CPU: XM530 WDT: 300S DRAM: 128 MiB MMC: arasan: 0 using backup environment FLASH_ERASE-------[100%] FLASH_WRITE-------[100%] In: serial Out: serial Err: serial Net: dwmac.10010000 Press Ctrl C to stop autoboot SF: 1572864 bytes @ 0x40000 Read: OK ## Booting kernel from Legacy Image at 80007fc0 ... Image Name: Linux-3.10.103 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1549104 Bytes = 1.5 MiB Load Address: 80008000 Entry Point: 80008000 XIP Kernel Image ... OK Starting kernel ... Uncompressing Linux... done, booting the kernel. U-Boot 2014.04 (Apr 08 2021 - 10:22:49) CPU: XM530 WDT: 300S DRAM: 128 MiB MMC: arasan: 0 In: serial Out: serial Err: serial Net: dwmac.10010000 Press Ctrl C to stop autoboot SF: 1572864 bytes @ 0x40000 Read: OK ## Booting kernel from Legacy Image at 80007fc0 ... Image Name: Linux-3.10.103 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1549104 Bytes = 1.5 MiB Load Address: 80008000 Entry Point: 80008000 XIP Kernel Image ... OK Starting kernel ... Uncompressing Linux... done, booting the kernel.

gradek83 · Answer

Your memory S. PI F. LASH has 8MB of memory or 8192kB and this gives us 8388608 Bytes in DEC (Decimals) -> HEX (Hexadecimal) 800000
The environment variables show that the partitions in flash memory are divided like this:
256K (boot),
1536K (kernel),
1280K (romfs),
4544K (user),
256K (custom),
320K (mtd)

The logs show that the boot starts and stops at "booting the kernel."

ma_riusz · Answer

Unfortunately, only UART.So is it possible and will something change the upload of the entire new firmware from the manufacturer's website?

gradek83 · Answer

We will try to rip SPI Flash memory by UART without a programmer. Code: text Expand Select all Copy to clipboardU-Boot> sf read 80008000 0 800000 U-Boot> md.l 80008000 200000 THIS may take up to an hour. I read that these cameras with this chip after starting the kernel: AS YOU CAN SEE: Spoiler: Show Code: text Expand Select all Copy to clipboardSF: 1572864 bytes @ 0x40000 Read: OK ## Booting kernel from Legacy Image at 80007fc0 ...    Image Name:   Linux-3.10.103+    Image Type:   ARM Linux Kernel Image (uncompressed)    Data Size:    1549104 Bytes = 1.5 MiB    Load Address: 80008000    Entry Point:  80008000    XIP Kernel Image ... OK Starting kernel ... Uncompressing Linux... done, booting the kernel. still nothing is displayed in the console there are no kernel boot messages usually something is still displayed there, but not anymore, but the program continues to go ../ it probably confused me from what they write in the environment variables, it was somehow turned off. Source

ma_riusz · Answer

flies .... What to do with it when it ends? I also came across The Source earlier, but without knowing what would happen if it happened, I didn't do it this way.

gradek83 · Answer

md is a memory display, ie it shows you the contents of the memory live. When it's finished, you can write it down. Added after 10 [minutes]: Or check if this speed-up method should copy a copy of SF memory to the TFTP directory Code: text Expand Select all Copy to clipboard U-Boot> sf probe 0 U-Boot> sf read 80008000 0 800000 U-Boot> tftp 80008000 dump.bin 800000

ma_riusz · Answer

Unfortunately, putty cut a large part of the logo - you probably need another way to dump this memory, because this does not work:

80807ff0: ffffffff ffffffff ffffffff ffffffff ................
U-Boot> tftp 80008000 dump.bin 800000
Unknown command 'tftp' - try 'help'
U-Boot> sf probe 0
U-Boot> sf read 80008000 0 800000
SF: 8388608 bytes @ 0x0 Read: OK
U-Boot> tftp 80008000 dump.bin 800000
tftpboot - boot image via network using TFTP protocol

Usage:
tftpboot [loadAddress] [[hostIPaddr:] bootfilename]
U-Boot>

Here I found a similar issue regarding the DUMPA record, but I don't know if I can go this way in my case.

Spoiler:

https://www.google.com/url?sa=t&rct=j&...0AhUGlIsKHayRD1YQFnoECAwQAQ%on%topic2.v%3%tum .php% 3Ft% 3D14470 & usg = AOvVaw311IQM_YZmuTGkrrDFLmir " target="_blank" rel="nofollow noopener ugc" class="postlink inline" title="" > https://www.google.com/url?sa=t&rct=j&...0AhUGlIsKHayRD1YQFnoECAwQAQ%on%topic2.v%3%tum .php% 3Ft% 3D14470 & usg = AOvVaw311IQM_YZmuTGkrrDFLmir

gradek83 · Answer

In the TFTP folder create an empty text file .txt and rename it to dump.bin (your system must have show extensions of known files enabled)

U-Boot> sf probe 0
U-Boot> sf read 0x81000000 0x0 0x800000
U-Boot> tftpboot 0x81000000 dump.bin 0x800000

If it does not work above, it will not work out at the bottom

U-Boot> sf probe 0
U-Boot> sf read 0x81000000 0x0 0x800000
U-Boot> tftpboot 0x81000000 192.168.1.107 dump.bin

ma_riusz · Answer

in the quoted forum there was a log ... maybe the syntax should also be like this?
U-Boot> sf probe: 0
U-Boot> sf read 0x81000000 0x0 0x800000
SF: 8388608 bytes @ 0x0 Read: OK
U-Boot> tftpboot 0x81000000: 192.168.1.107 dump.bin
Speed: 100, full duplex
Using dwmac.10010000 device
TFTP from server 192.168.1.107; our IP address is 192.168.1.10
Filename 'dump.bin'.
Load address: 0x81000000
Loading: # [Connected]

0 Bytes / s
done

In the first case it does not recognize the TFTP command, in the second case it is identical to the above log.

gradek83 · Answer

I corrected two entries, check both. TFTP is to be enabled.

ma_riusz · Answer

Spoiler: Show U-Boot 2014.04 (Apr 08 2021 - 10:22:49) CPU: XM530 WDT: 300S DRAM: 128 MiB MMC: arasan: 0 In: serial Out: serial Err: serial Net: dwmac.10010000 Press Ctrl C to stop autoboot U-Boot> U-Boot> U-Boot> U-Boot> U-Boot> U-Boot> U-Boot> ping 192.168.1.107 Speed: 100, full duplex Using dwmac.10010000 device host 192.168.1.107 is alive U-Boot> sf probe 0 U-Boot> sf read 0x81000000 0x0 0x800000 SF: 8388608 bytes @ 0x0 Read: OK U-Boot> tftpboot 0x81000000 dump.bin 0x800000 tftpboot - boot image via network using TFTP protocol Usage: tftpboot [loadAddress] [[hostIPaddr:]bootfilename] U-Boot> tftpboot 0x81000000 192.168.1.107 dump.bin tftpboot - boot image via network using TFTP protocol Usage: tftpboot [loadAddress] [[hostIPaddr:]bootfilename] U-Boot> tftpboot 0x81000000:192.168.1.107 dump.bin Speed: 100, full duplex Using dwmac.10010000 device TFTP from server 192.168.1.107; our IP address is 192.168.1.10 Filename 'dump.bin'. Load address: 0x81000000 Loading: # [ Connected ] 0 Bytes/s done U-Boot> rzuciło mi się w oczy, iż obecnie MAC karty się zmienił na 000102030400 - czyli coś zaczyna się zmieniać w tym obrazie. Spoiler: Show U-Boot> U-Boot> printenv appCloudExAbility=l7PdKrbjTMM= appProducerID=A37 baudrate=115200 bootargs=mem=65M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=xm_sfc:256K(boot),1536K(kernel),1280K(romfs),4544K(user),256K(custom),320K(mtd) bootcmd=sf probe 0;sf read 80007fc0 40000 180000;bootm 80007fc0 bootdelay=1 cramfsaddr=0x60040000 da=mw.b 0x81000000 ff 800000;tftp 0x81000000 u-boot.bin.img;sf probe 0;flwrite dc=mw.b 0x81000000 ff 800000;tftp 0x81000000 custom-x.cramfs.img;sf probe 0;flwrite dd=mw.b 0x81000000 ff 800000;tftp 0x81000000 mtd-x.jffs2.img;sf probe 0;flwrite dr=mw.b 0x81000000 ff 800000;tftp 0x81000000 romfs-x.cramfs.img;sf probe 0;flwrite du=mw.b 0x81000000 ff 800000;tftp 0x81000000 user-x.cramfs.img;sf probe 0;flwrite dw=mw.b 0x81000000 ff 800000;tftp 0x81000000 web-x.cramfs.img;sf probe 0;flwrite ethact=dwmac.10010000 ethaddr=00:01:02:03:04:00 ipaddr=192.168.1.10 netmask=255.255.255.0 serverip=192.168.1.107 stderr=serial stdin=serial stdout=serial tk=mw.b 0x81000000 ff 800000;tftp 0x81000000 uImage; bootm 0x81000000 ua=mw.b 0x81000000 ff 800000;tftp 0x81000000 upall_verify.img;sf probe 0;flwrite up=mw.b 0x81000000 ff 800000;tftp 0x81000000 update.img;sf probe 0;flwrite verify=n Environment size: 1259/65532 bytes

gradek83 · Answer

And with a colon at the end of 107

U-Boot> sf probe 0
U-Boot> sf read 0x81000000 0x0 0x800000
U-Boot> tftpboot 0x81000000 192.168.1.107: dump.bin

[Solved] The SMAR PTZ IP camera from aliexpress stopped responding after the reset

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Post #27

Post #28

Post #29

Post #30

Topic summary