Re-organized the forum to more cleanly delineate the development section, as the end user support side appears to have taken a life of its own!

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - mbirth

Pages: [1]
Just for future people ending up here from Google (like me):

To dump or flash a new firmware via U-Boot, you need a TFTP server. Connect the camera via Ethernet cable and then, in the U-Boot, set the following parameters (modify to accommodate your network):
Code: [Select]
setenv ipaddr
setenv netmask
setenv serverip
ipaddr = IP address of the camera
serverip = IP address of the host running the TFTP server

The 16M memory is located at 0x34000000 until 0x34ffffff and partitioned like this:
  • 0x34000000 - 0x341fffff = boot area
  • 0x34200000 - 0x34efffff = JFFS2 root filesystem
  • 0x34f00000 - 0x34ffffff = settings
0x34000000 is the U-Boot start area
0x34100000 is the linux kernel

In those pkg files is only the root filesystem. The kernel doesn't get updated, it seems. You can cut the first 144 bytes from the pkg file to get the JFFS2 file. That can be flashed to the camera.

Now, to dump something, use the tftp command. Syntax is:

tftp address filename [length]

Without length specified, it will DOWNLOAD the filename from the TFTP server and flash that to the location. If you specify a length, it will UPLOAD the flash contents from the specified address up until length to the TFTP.

So to make a complete 16M backup, use:

tftp 0x34000000 recovery.bin 0x1000000

This will push it right onto your TFTP server in no time.

And now the important part: Never forget to erase the area before you're flashing new data to it. Reason is that flashing only changes bits to 0. If they are already 0, they're left alone even though the firmware file might have a 1 at that location. I tried to flash a new JFFS2 (tftp 0x34200000 root.jffs2) without erasing the area first (erase 0x34200000 +0xd00000) and got hundreds of error messages about a corrupted JFFS2 file system. After erasing the area and flashing again, everything was fine.

General Discussion / Re: FI9831W - Linux-compatible WebUI?
« on: October 20, 2016, 12:40:17 pm »
Please see this.

I'm sorry but this is not what I need. I just wanted an easier way to configure the camera from Linux. Things like schedules, alarm zones and such. Currently, I have to fire up a Windows VM and do everything from there.

@mbirth did you try Wxift*v2  for the app firmware?  Worked for me here

Yes, tried that, too. Without success.

General Discussion / FI9831W - Linux-compatible WebUI?
« on: October 18, 2016, 08:26:03 pm »
I've got a FI9831W here ready to be played with. Recovery image is available and, of course, the serial console is connected to my trusty USB-TTL-adapter.

My biggest gripe with the camera is the WebUI - which ONLY lets you log in with the stupid IPC plugin installed. And that's only available for Windows and Mac - no Linux.

So what alternative WebUIs are there? I'd LOVE to get something like the INSTAR WebUI which works without any stupid browser plugin on any modern browser. But I've already checked and the INSTAR devices run mostly on Grainmedia SoCs and have a different partition layout. And their recovery manual only talks about partition 6 and 7. No word about the other 5. The only real candidate would be the IN-6011HD firmware, which is a HiSilicon, too. But I assume they use the OEM WebUI for that, not their own one. And I know that from a Wansview NCH-536MW already.

Any other hints?

EDIT: So from poking around in the uBoot, this thing has a 16MB SPI Flash memory and 192MB RAM. Partition layout is: hi_sfc:1M(boot),4M(kernel),11M(jffs2). SoC is a HiSilicon Hi3518. (IN-6011HD is a Hi3511.)

I've found one password in the vmlinux image, in the /usr/sbin/recovertool. If you search for "openssl" in that one, you'll find the line:

Code: [Select]
openssl enc -d -aes-128-cbc -k WT8Nk*v2 -in %s > %s

But I can't find the password for the app firmware. (The password changed for the FI9831W with the 2.x.1.119 update.)

Pages: [1]