Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at

Recent Posts

Pages: 1 ... 8 9 [10]
General Discussion / How To Log Contacam Into a Foscam Clone?
« Last post by abrogard on November 19, 2017, 05:06:58 am »

 My Contacam won't log in to my foscam clone and I think it probably because of that second menu thing that it throws up - asking what mode you want, for IE or Firefox or Mobile.

 Is there any way to deal with this and use Contacam with a clone?
Hacking & Modding / uclinux and toolchain
« Last post by drforbin on November 12, 2017, 05:44:01 pm »
Can anyone point in in a direction to get started making custom firmware.
I know most of the cameras use uclinux and arm. how do I go about compiling and packing for the bflt abi.
any advice...

uCLinux / compiling bflt arm development
« Last post by drforbin on November 11, 2017, 01:58:16 am »

I need to compile some bflt bins, arm arch. It will of course be used in a bflt env.
How do you all suggest I got about doing this.

Thank you.
Hacking & Modding / hi3518 ip cam reset! I've tried everything.
« Last post by ghert21 on November 08, 2017, 02:32:44 am »
I have an hi3518 ip cam. After changing the default password I cannot login anymore. I have tried a few tools like "reset configinfo" but nothing. I also noticed that it exists a user othe than admin, named default I cannot login to it neither.

Guys can you please suggest me a way to reset my cam or at least gain access?
Thank you!
Help / Help identify Chinese IP Camera
« Last post by Alacard on November 06, 2017, 01:08:24 pm »
I got a spy camera off ebay ( to keep a eye on my kids when im not home but the firmware is so buggy that i have to restart the camera about 4-5 times a day. Im hoping someone can tell me who makes the camera or a firmware that compatible that i can use. this is what im able to pull from telnet

Code: [Select]
RT-IPC login: root
Welcome to HiLinux.
None of nfsroot found in cmdline.
# dmesg
Booting Linux on physical CPU 0
Linux version 3.4.35 (bt@btvmhost) (gcc version 4.8.3 20131202 (prerelease) (Hisilicon_v300) ) #1 Fri Jul 14 05:01:20 CST 2017
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518ev200
Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 10240
free_area_init_node: node 0, pgdat c04193c8, node_mem_map c0455000
  Normal zone: 80 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 10160 pages, LIFO batch:1
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 10160
Kernel command line: mem=40M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=hi_sfc:256K(boot),2560K(kernel),12544K(rootfs),64K(key),960K(config) init=/linuxrc
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 40MB = 40MB total
Memory: 36108k/36108k available, 4852k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xc3000000 - 0xff000000   ( 960 MB)
    lowmem  : 0xc0000000 - 0xc2800000   (  40 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc03d5000   (3892 kB)
      .init : 0xc03d5000 - 0xc03f114c   ( 113 kB)
      .data : 0xc03f2000 - 0xc0419ae0   ( 159 kB)
       .bss : 0xc0419b04 - 0xc0454418   ( 235 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
VIC @fe0d0000: id 0x00641190, vendor 0x41
sched_clock: 32 bits at 49MHz, resolution 20ns, wraps every 86767ms
Console: colour dummy device 80x30
Calibrating delay loop... 269.10 BogoMIPS (lpj=1345536)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x802f8bb8 - 0x802f8c10
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 30) is a PL011 rev2
uart:2: ttyAMA2 at MMIO 0x200a0000 (irq = 25) is a PL011 rev2
bio: create slab <bio-0> at 0
hi-spi-master hi-spi-master.0: with 1 chip select slaves attached
hi-spi-master hi-spi-master.1: with 2 chip select slaves attached
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.18)
yaffs: yaffs built Jul 14 2017 04:59:07 Installing.
msgmni has been set to 70
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
Check Flash Memory Controller v100 ...  Found.
SPI Nor(cs 0) ID: 0xc2 0x20 0x18
Block:64KB Chip:16MB Name:"MX25L128XX"
SPI Nor total size: 16MB
5 cmdlinepart partitions found on MTD device hi_sfc
5 cmdlinepart partitions found on MTD device hi_sfc
Creating 5 MTD partitions on "hi_sfc":
0x000000000000-0x000000040000 : "boot"
0x000000040000-0x0000002c0000 : "kernel"
0x0000002c0000-0x000000f00000 : "rootfs"
0x000000f00000-0x000000f10000 : "key"
0x000000f10000-0x000001000000 : "config"
SPI Nand ID Table Version 2.2
Cannot found a valid SPI Nand Device
himii: probed
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
i2c /dev entries driver
hisi_i2c hisi_i2c.0: Hisilicon [i2c-0] probed!
hisi_i2c hisi_i2c.1: Hisilicon [i2c-1] probed!
hisi_i2c hisi_i2c.2: Hisilicon [i2c-2] probed!
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
lib80211_crypt: registered algorithm 'NULL'
lib80211_crypt: registered algorithm 'WEP'
lib80211_crypt: registered algorithm 'CCMP'
lib80211_crypt: registered algorithm 'TKIP'
usb 1-1: new high-speed USB device number 2 using hiusb-ehci
VFS: Mounted root (jffs2 filesystem) on device 31:2.
Freeing init memory: 112K
mmc1: new high speed SDHC card at address aaaa
mmcblk0: mmc1:aaaa SS16G 14.8 GiB
 mmcblk0: p1
PHY: himii:01 - Link is Up - 10/Half
abort! int_raw_status: 0x550!

tx_abrt_src is 1.

abort! int_raw_status: 0x550!

tx_abrt_src is 1.

Hisilicon Media Memory Zone Manager
Module himedia: init ok
hi3518e_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
load sys.ko for Hi3518EV200...OK!
load tde.ko ...OK!
load region.ko ....OK!
-----ModuleParam: max_vgs_job 10 is less than 20, it will be set to 20!
-----ModuleParam: max_vgs_task 16 is less than 20, it will be set to 20!
-----ModuleParam: max_vgs_node 16 is less than 20, it will be set to 20!
load vgs.ko for Hi3518EV200...OK!
ISP Mod init!
load viu.ko for Hi3518EV200...OK!
load vpss.ko ....OK!
load rc.ko for Hi3518EV200...OK!
load venc.ko for Hi3518EV200...OK!
load chnl.ko for Hi3518EV200...OK!
load h264e.ko for Hi3518EV200...OK!
load jpege.ko for Hi3518EV200...OK!
load ive.ko for Hi3518EV200...OK!
acodec inited!
exFAT: Version 1.2.9
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=60 sec (nowayout= 0, nodeamon= 0)
init phy power successful!
load hi_mipi driver successful!
BTLED- board---222000. v20131213
Iniit led ko OK
<RTE>rtErom init raw:0, intf_type 0
<RTK>rtrom init is ok!
***link down status changed***.
PHY: himii:01 - Link is Down
led ioctl :30725
--drvled_flash :(0,1,10,1,3,3,1)
install prealloc ok
PHY: himii:01 - Link is Up - 10/Half
rtusb init rt2870 --->
==>WaitForAsicReady MAC_CSR0=0x76010500
==>WaitForAsicReady MAC_CSR0=0x76010500
NumOfChan ===> 58
MSC msc_proc_create: c34cf000
usbcore: registered new interface driver rt2870
BTDrv init 7601 Runtop. V1.6.1 - 0714
BTDrv init 7601
1. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
==>WaitForAsicReady MAC_CSR0=0x76010500
==>WaitForAsicReady MAC_CSR0=0x76010500
RT RtmpOSFileOpen:/etc/Wireless/RT2870STA/MT7601USTA.datd
elevator: type anticipatory not found
elevator: switch to anticipatory
NumOfChan ===> 14
0x1300 = 00064300
unlink cmd rsp urb
BTDrv init 7601 Runtop. V1.6.1 - 0714
BTDrv init 7601
1. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
==>WaitForAsicReady MAC_CSR0=0x76010500
==>WaitForAsicReady MAC_CSR0=0x76010500
RT RtmpOSFileOpen:/etc/Wireless/RT2870STA/MT7601USTA.datdNumOfChan ===> 14
0x1300 = 00064300
led ioctl :30725
--drvled_flash :(0,1,10,1,3,3,1)
led ioctl :30723
led ioctl :30725
--drvled_flash :(0,1,3,1,1,3,1)
led ioctl :30725
--drvled_flash :(0,1,3,1,1,3,1)
Help / Re: BB-1000 IP Camera
« Last post by ocpaul20 on November 06, 2017, 12:53:33 am »
There is a fairly generic RTSP program written in Python which might help. The RTSP control port is 554 usually.
Firmware / Re: Apexis APM-J0233-V1.1 2010.8.10 Firmeware Files
« Last post by inspectorelectro on November 04, 2017, 07:19:43 am »
Hello all.
Does anyone have , or would you blink the contents of 25Q64B/V memory to IP Camera
Apexis APM-JP6235? Please help. I need a load.
General Discussion / Re: IP Cam - 03
« Last post by ocpaul20 on November 04, 2017, 06:55:44 am »
I have also bought a Chinese camera. If you bought it through Aliexpress or similar website, most of the suppliers can speak English and will probably help you to a certain extent. Ok, so they might not know some of the more technical details but they will know URLs to get you going. It is worth a try.

As other have said, it is not advisable to update firmware unless you are 200% certain that your camera matches the firmware update. Else, you might easily brick the camera.
Hacking & Modding / SIP client for Hi3518 based devices
« Last post by sithyoda on November 04, 2017, 05:44:46 am »
I am working on reverse engineering a IP doorbell based on Hisilicon Hi3518E chip. The device runs HiLinux on kernel 3.0.8, which is quite ok. All I want, is to remove the manufacturers P2P software and install a SIP client on it. GPIO's have to be polled as well, to grab the doorbell button and activate the door opener.
I'm already able to cross-compile little c-programs with the Hi3518 SDK, but to get alsa and e.g. linphone my linux/compiler knowledge is not sufficient yet.
So I thought of taking a SIP implementation of any other device, that is Hi3518 based. There are some (ITS Telecom Pantel IP, Fanvil i30,...) but I cannot get rootfs of them.
Any idea where to start?
Firmware / IPS Eye01W Firmware - Serial Connection Points Needed
« Last post by manix on October 27, 2017, 08:04:17 am »
I have two (IPSmart) IPS EYE01W Pan Tilt 2 MP Cameras.
I found most recent available firmware from and upgraded (FW rev.1812F (29.05.2015)).

I would like to explore Serial Communication/Debugging/Flashing firmware possibilities.
Can you please tell me if Serial Pinouts are available with this Camera and where they are?
I have added Images of PCB and Camera. Kindly help.
Pages: 1 ... 8 9 [10]