H.264 Hi3507 Hi3510 Hi3512 IPCAMERA WANSVIEW NCH-536MW

Hello,

WANSVIEW NCH-536MW = DERICAM H501w [HD-PT-WIFI-IRcut-SDcard] (Only the webui changes)

could you help me and explain me

•How to dump the existing firmware file (in the flash memory) through RS232 ?
•How to dump "boot" / "rootfs" / "setting" ?
•is it possible to create "boot" / "rootfs" / "setting" files with the original firmware (firmware.pkg) ?
•How to upgrade the firmware file through RS232 ?
•How to flash the firmware file through RS232 ?

i just want to try to test and, flash a new firmware in my NCH-536MW ipcamera

i'm able to enter in the bootloader of the mainboard, but after, i don't know how re-flash the firmware ?


Here is the bootloader process

==========================================================================================

U-Boot 1.1.4 (Apr  8 2009 - 11:41:01)
U-Boot code: E0500000 -> E0517540  BSS: -> E051E2BC
 HI_VERSION=U_BOOT_1_1_4-M08C0305B0301 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:44:35
RAM Configuration:
Bank #0: e0000000 128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
MAC:   00-25-07-00-00-3B
Hit any key to stop autoboot:  0

hilinux # help

?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
loadb   - load binary file over serial line (kermit mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
tftp    - download or upload image via network using TFTP protocol
version - print monitor version

hilinux # bdinfo

arch_number = 0x00000183
env_t       = 0x00000000
boot_params = 0xE0000100
DRAM bank   = 0x00000000
-> start    = 0xE0000000
-> size     = 0x08000000
ethaddr     = 00:25:07:00:00:3B
ip_addr     = 192.168.8.88
baudrate    = 115200 bps

hilinux # flinfo

Bank # 1: CFI conformant FLASH (8 x   Size: 16 MB in 128 Sectors
AMD Standard command set, Manufacturer ID: 0x12, Device ID: 0x00
Erase timeout: 4096 ms, write timeout: 1 ms
Buffer write timeout: 3 ms, buffer size: 64 bytes
Sector Start Addresses:
   34000000        34020000        34040000   RO   34060000        34080000

  340A0000        340C0000        340E0000        34100000        34120000

  34140000        34160000        34180000        341A0000        341C0000
 
  341E0000        34200000        34220000        34240000        34260000

  34280000        342A0000        342C0000        342E0000        34300000

  34320000        34340000        34360000        34380000        343A0000
 
  343C0000        343E0000        34400000        34420000        34440000

  34460000        34480000        344A0000        344C0000        344E0000

  34500000        34520000        34540000        34560000        34580000
 
  345A0000        345C0000        345E0000        34600000        34620000

  34640000        34660000        34680000        346A0000        346C0000

  346E0000        34700000        34720000        34740000        34760000
 
  34780000        347A0000        347C0000        347E0000        34800000

  34820000        34840000        34860000        34880000        348A0000

  348C0000        348E0000        34900000        34920000        34940000
 
  34960000        34980000        349A0000        349C0000        349E0000

  34A00000        34A20000        34A40000        34A60000        34A80000

  34AA0000        34AC0000        34AE0000        34B00000        34B20000
 
  34B40000        34B60000        34B80000        34BA0000        34BC0000

  34BE0000        34C00000        34C20000        34C40000        34C60000

  34C80000        34CA0000        34CC0000        34CE0000        34D00000
 
  34D20000        34D40000        34D60000        34D80000        34DA0000

  34DC0000        34DE0000        34E00000        34E20000        34E40000

  34E60000        34E80000        34EA0000        34EC0000        34EE0000
 
  34F00000        34F20000        34F40000        34F60000        34F80000

  34FA0000        34FC0000        34FE0000

hilinux # printenv

bootdelay=1
baudrate=115200
netmask=255.255.255.0
bootfile="uImage"
ethaddr=00:25:07:00:00:3b
serverip=192.168.8.8
ipaddr=192.168.8.88
bootcmd=bootm 0x34100000
bootargs=mem=72M console=ttyAMA0,115200 root=1f01 rootfstype=jffs2 mtdparts=phys_mapped_flash:2M(boot),13M(rootfs),1M(setting)
stdin=serial
stdout=serial
stderr=serial
verify=n
Environment size: 337/131068 bytes
hilinux # version

U-Boot 1.1.4 (Apr  8 2009 - 11:41:01)
hilinux #

==========================================================================================

THANK YOU VERY MUCH FOR HELP

Here is the complet boot process of the ipcam


=====================================================================================================

Here is the complet boot process

Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Built 1 zonelists
Kernel command line: mem=72M console=ttyAMA0,115200 root=1f01 rootfstype=jffs2 mtdparts=phys_mapped_flash:2M(boot),13M(rootfs),1M(setting)
PID hash table entries: 512 (order: 9, 8192 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 72MB = 72MB total
Memory: 71168KB available (1461K code, 175K data, 76K init)
Mount-cache hash table entries: 512
HI_VERSION=LINUX_2_6_14-M06C0303B0103 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:50:52
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Hisilicon clock system V0.01
Hisilicon PCI work at slave mode.
NetWinder Floating Point Emulator V0.97 (double precision)
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x0
JFFS2 version 2.2. (NAND) (C) 2001-2003 Red Hat, Inc.
Initializing Cryptographic API
Serial: AMBA PL011 UART driver
ttyAMA0 at MMIO 0x101f1000 (irq = 12) is a AMBA/PL011
ttyAMA1 at MMIO 0x101f2000 (irq = 13) is a AMBA/PL011
ttyAMA2 at MMIO 0x101f3000 (irq = 14) is a AMBA/PL011
io scheduler noop registered
RAMDISK driver initialized: 4 RAM disks of 8192K size 1024 blocksize
physmap flash device: 4000000 at 34000000
phys_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
phys_mapped_flash: CFI does not contain boot bank location. Assuming top.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
3 cmdlinepart partitions found on MTD device phys_mapped_flash
Creating 3 MTD partitions on "phys_mapped_flash":
0x00000000-0x00200000 : "boot"
0x00200000-0x00f00000 : "rootfs"
0x00f00000-0x01000000 : "setting"
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
TCP bic registered
VFS: Mounted root (jffs2 filesystem).
Freeing init memory: 76K
Hisilicon Media Memory Zone Manager
Generic PHY: Registered new driver
HIETHV100-M03C0301 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:53:51
Hisilicon ETHv100 net controler.
Hisilicon ETHv100 MDIO Bus: probed
delayed to setup 512 skb queue items.
NET: Registered protocol family 1
NET: Registered protocol family 17
Auto login as root ...
Jan  1 00:00:03 login[164]: root login  on `<NULL>0'



BusyBox v1.1.2 (2009.04.24-06:05+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

Welcome to HiLinux.
killall: syslogd: no process killed
killall: sd_detect: no process killed
killall: msgproc: no process killed
killall: vs_auto.sh: no process killed
killall: vs_server: no process killed
encript driver init successful!
GPIO_I2C-MDC030001 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:53:17
HIDMAC-MDC030003 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:52:37
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=60 sec (nowayout= 0, nodeamon= 0)
HISI_WDT-MDC030001 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:53:26<6>HISI_WDT-MDC030001 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:53:26
read Prodect ID Number MSB is ff
read Prodect ID Number LSB is ff
check mt9d131 ID error.
mt9v131 driver init fail for device init error!
insmod: cannot insert `/komod/mt9d131.ko': Operation not permitted (-1): Operation not permitted
ov2643 driver init successful!
HI3512 Real Time Clock Driver v0.1
aic31 driver init successful!
infrared driver init successful!
reset driver init successful!
extalarm driver init successful!
relay driver init successful!
Init watchdog delay
PHY: 0:01 - Link is Up - 100/Full
SDIO-M05C0302 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:52:44
Card stack initializing, please wait ................................

******tCurrCmdInfo.dwCurrErrorSts is 0x100
ver = May 15 2009 17:39:55
******tCurrCmdInfo.dwCurrErrorSts is 0x100
SDIO-M05C0302 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:52:44
detect SD2.0 card
io scheduler anticipatory registered
usbcore: registered new driver usbfs
usbcore: registered new driver hub
USB1_1-M0001C030002 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:52:41
Clock to USB host has been enabled
hisilicon-ohci hisilicon-ohci.0: hisilicon OHCI
hisilicon-ohci hisilicon-ohci.0: new USB bus registered, assigned bus number 1
hisilicon-ohci hisilicon-ohci.0: irq 20, io mem 0xa0000000
Enumerate_card successful for card in slot 0
Check card stack end,now you can do your job......................
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
Card stack checking, please wait ................................

******tCurrCmdInfo.dwCurrErrorSts is 0x100
******tCurrCmdInfo.dwCurrErrorSts is 0x100
detect SD2.0 card
Enumerate_card successful for card in slot 0
Check card stack end,now you can your job......................
usbcore: registered new driver rt73
[boottab]sync time from RTC
RTC time 112-06-16 14:27:01
Set system time as date 06161427112.01.
******tCurrCmdInfo.dwCurrErrorSts is 0x100
******tCurrCmdInfo.dwCurrErrorSts is 0x100
******tCurrCmdInfo.dwCurrErrorSts is 0x100
******tCurrCmdInfo.dwCurrErrorSts is 0x100
******tCurrCmdInfo.dwCurrErrorSts is 0x100
mmcblk0: mmc0:e5e0 SU02G 1886MB
 /dev/mmc/blk0:/var/log/accesslog.txt not exist,then will creat this file!
 p1
register card!
/bin/vs/netconfig ipcamera
delayed to setup 512 skb queue items.
killall: udhcpc: no process killed
killall: arping: no process killed
killall: runarp: no process killed
[boottab]start sdcard detecter
killall: gerddns: no process killed
Plug in new SD card: /dev/mmc/blk0/part1. part num: 1
/bin/vs
umount: Couldn't umount /bin/vs/sd: Invalid argument
New SD card insert. start fsck anyway.
dosfsck 2.11 (12 Mar 2005)
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Checking we can access the last sector of the filesystem
Boot sector contents:
System ID "mkdosfs"
Media byte 0xf8 (hard disk)
       512 bytes per logical sector
      4096 bytes per cluster
        32 reserved sectors
First FAT starts at byte 16384 (sector 32)
         2 FATs, 32 bit entries
   1925632 bytes per FAT (= 3761 sectors)
Root directory start at cluster 2 (arbitrary size)
Data area starts at byte 3867648 (sector 7554)
    481366 data clusters (1971675136 bytes)
16 sectors/track, 4 heads
         0 hidden sectors
   3858488 sectors total
Starting check/repair pass.
Reclaiming unconnected clusters.
Checking free cluster summary.
Starting verification pass.
[proc_log]^^^^msg_proc.c:321("VTOP_MSG_Main"): (0x0, "MSGProc V1.0.0.3(R) Start PHY: 0:01 - Link is Upsuccess!!")
 - 100/Full
Checking for unused clusters.
/dev/mmc/blk0/part1: 90 files, 26792/481366 clusters

mount -t vfat /dev/mmc/blk0/part1 /bin/vs/sd
rm -rf /bin/vs/sd/fsck*.rec
log path=mkdir -p /var/log
log path=mkdir -p /bin/vs/tmpfs
hi3511_base: module license 'Proprietary' taints kernel.
Hisilicon UMAP device driver interface: v1.00
Chip Version: Hi35110110
TDE_MAIN_VERSION[v1.0.0.1] Build Time[Mar 20 2009, 14:53:48]
TDE_ADP_VERSION[hi3511 adp v1.0.0.3] Build Time[Mar 20 2009, 14:53:48]
load vpp.ko ....OK!
load vdec.ko ....OK
load md.ko....OK!
load hi3511_h264d.ko ....OK
open
g_IrcMode: 1
open
open
run nalu set in ioctrol
libmt version: v0.4build20090319-1732
Mbuf Init cfg chnid 11 , max connect num 5, bufsize 1152000
 Mbuf Init cfg chnid 12 , max connect num 6, bufsize 307200
 MBUF_Init vschn 11 , mbuf chn 0
MBUF_Init vschn 12 , mbuf chn 1
vschn 11 (mbufchn 0) user 0: pheader 4159e008 header size 40
pheader 4159e048
vschn 11 (mbufchn 0) user 1: pheader 416b7448 header size 40
pheader 416b7488
vschn 11 (mbufchn 0) user 2: pheader 417d0888 header size 40
pheader 417d08c8
vschn 11 (mbufchn 0) user 3: pheader 418e9cc8 header size 40
pheader 418e9d08
vschn 11 (mbufchn 0) user 4: pheader 41a03108 header size 40
pheader 41a03148
vschn 12 (mbufchn 1) user 0: pheader 41b1c548 header size 40
pheader 41b1c588
vschn 12 (mbufchn 1) user 1: pheader 41b67588 header size 40
pheader 41b675c8
vschn 12 (mbufchn 1) user 2: pheader 41bb25c8 header size 40
pheader 41bb2608
vschn 12 (mbufchn 1) user 3: pheader 41bfd608 header size 40
pheader 41bfd648
vschn 12 (mbufchn 1) user 4: pheader 41c48648 header size 40
pheader 41c48688
vschn 12 (mbufchn 1) user 5: pheader 41c93688 header size 40
pheader 41c936c8
Start HI_VOD_Init.vod Successed.
http Live svr Init ok.
Start MediaTrans.http_streamsvr Successed.
RTSP Live svr Init ok.
Start MediaTrans.rtsp_streamsvr Successed.
rtsp_o_http Live svr Init ok.
Start rtspOhttp svr Successedopen
.
MOBILE Live svr Init ok.
Start mobile svr Successed.
[REC]the 12 chn is not Rec
<hi_system>parentprocess,pid: 440
<hi_system>parent wait child pid: 441 to end
<hi_system>subprocess create,pid: 441
<hi_system>subprocess,pid: 441, to excute
Looking for host time.nist.gov and service ntp
===================================
           Start Success!
===================================
web_port:80
platform_params:   12105 0 5
user_passwd:********
Transmit proxy svr start...
platform disable,exit...
Error : Name or service not known
<THTTPD> sigchld.
<THTTPD> wait for any child end.
<hi_system>parent wait child pid: 441 ended
ntpdate host return value:1

=====================================================================================================

The original firmware is an *.PKG file

http://www.netge.org/attachments/article/9/B12SE_V1.4.0.1.5_536mP2En.zip

is it possible to decompile the firmware B12SE_V1.4.0.1.5_536mP2En.pkg file ?
is it possible to retreive the boot / rootfs / setting files and webui in the firmware B12SE_V1.4.0.1.5_536mP2En.pkg file ?

INFORMATIONS:
WANSVIEW original firmware => B12SE_V1.4.0.1.5_536mP2En.pkg (SE = SmartEye)

FRENCH FORUM TOPIC
http://goo.gl/eHJkn

THANKS TO EVERYONE for help

I am not able to dump the firmware directly from the chip, in the camera, yet... 

but

I found how to create the firmware binary file from PKG file (original firmware) 



I've got the binary firmware file [16MB] for WANSVIEW NCH536MW in order to flash through RS232 serial line

http://forum.hardware.fr/hfr/HardwarePeripheriques/webcam-camera-ip/unique-wansview-camera-sujet_56652_1.htm

If you have rs232 access, just dump off the MTD device.

eg something like

 cat /dev/mtd0 > /tmp/somefile


Then copy to the SD card and off..

n'est pas?

in the bootloader, there is no function to dump... or i don't know how...
i've successfully flash the chip with the "tftp" (from computer => to ipcamera) function
but how to retreive/download the internal flash datas (from ipcamera => to computer)

don't know...

the internal NCH536MW bootloader gives that:

==================================================================================================

U-Boot 1.1.4 (Apr  8 2009 - 11:41:01)

U-Boot code: E0500000 -> E0517540  BSS: -> E051E2BC
HI_VERSION=U_BOOT_1_1_4-M08C0305B0301 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:44:35
RAM Configuration:
Bank #0: e0000000 128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
MAC:   00-25-07-00-00-3B
Hit any key to stop autoboot:  0
hilinux # help
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
loadb   - load binary file over serial line (kermit mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
tftp    - download or upload image via network using TFTP protocol
version - print monitor version
hilinux # bdinfo
arch_number = 0x00000183
env_t       = 0x00000000
boot_params = 0xE0000100
DRAM bank   = 0x00000000
-> start    = 0xE0000000
-> size     = 0x08000000
ethaddr     = 00:25:07:00:00:3B
ip_addr     = 192.168.8.88
baudrate    = 115200 bps
hilinux # flinfo

Bank # 1: CFI conformant FLASH (8 x   Size: 16 MB in 128 Sectors
  AMD Standard command set, Manufacturer ID: 0x12, Device ID: 0x00
  Erase timeout: 4096 ms, write timeout: 1 ms
  Buffer write timeout: 3 ms, buffer size: 64 bytes

  Sector Start Addresses:
  34000000        34020000        34040000   RO   34060000        34080000
  340A0000        340C0000        340E0000        34100000        34120000
  34140000        34160000        34180000        341A0000        341C0000
  341E0000        34200000        34220000        34240000        34260000
  34280000        342A0000        342C0000        342E0000        34300000
  34320000        34340000        34360000        34380000        343A0000
  343C0000        343E0000        34400000        34420000        34440000
  34460000        34480000        344A0000        344C0000        344E0000
  34500000        34520000        34540000        34560000        34580000
  345A0000        345C0000        345E0000        34600000        34620000
  34640000        34660000        34680000        346A0000        346C0000
  346E0000        34700000        34720000        34740000        34760000
  34780000        347A0000        347C0000        347E0000        34800000
  34820000        34840000        34860000        34880000        348A0000
  348C0000        348E0000        34900000        34920000        34940000
  34960000        34980000        349A0000        349C0000        349E0000
  34A00000        34A20000        34A40000        34A60000        34A80000
  34AA0000        34AC0000        34AE0000        34B00000        34B20000
  34B40000        34B60000        34B80000        34BA0000        34BC0000
  34BE0000        34C00000        34C20000        34C40000        34C60000
  34C80000        34CA0000        34CC0000        34CE0000        34D00000
  34D20000        34D40000        34D60000        34D80000        34DA0000
  34DC0000        34DE0000        34E00000        34E20000        34E40000
  34E60000        34E80000        34EA0000        34EC0000        34EE0000
  34F00000        34F20000        34F40000        34F60000        34F80000
  34FA0000        34FC0000        34FE0000
hilinux # printenv
bootdelay=1
baudrate=115200
netmask=255.255.255.0
bootfile="uImage"
ethaddr=00:25:07:00:00:3b
serverip=192.168.8.8
ipaddr=192.168.8.88
bootcmd=bootm 0x34100000
bootargs=mem=72M console=ttyAMA0,115200 root=1f01 rootfstype=jffs2 mtdparts=phys_mapped_flash:2M(boot),13M(rootfs),1M(setting)
stdin=serial
stdout=serial
stderr=serial
verify=n

Environment size: 337/131068 bytes
hilinux # version

U-Boot 1.1.4 (Apr  8 2009 - 11:41:01)
hilinux #
==================================================================================================

i don't know how dump

The md - memory display looks like it would dump. You would have to modify the code used by Firmware Recovery - method #2