Cat5 or Cat5e is plenty fine.

None of the camera's will use (or support) anything higher anyway.  30 camera's seems a bit overkill - is this a factory sized place? 
Get a decent PoE switch that will support at least 150W.

I'd probably lean towards 2 x 24 ports just to make sure there is sufficient power per camera. 
Budget at least 10W per camera, they'll use much less daytime (3-5W), and more at night when the IR comes on.

30 x 10 = 300W needed (likely more on startup or reboot or nighttime), so go for something with more headroom. - i.e. 4-500W total.

The Unifi series are good, and have decent management software - eg
https://store.ui.com/collections/unifi-network-switching/products/unifiswitch-24-250w

I don't suggest the Unifi camera's or NVR, they're overpriced and underpar in terms of quality/bang per buck.

Camera's - 1080p is a little low res, so should be cheap.  Just make sure they support ONVIF.
HIKVision, Dahua etc make plenty of options.

As for VMS - I haven't really looked into that side in much detail.

Will really depend on your requirements, i.e. what other things than basic recording are needed.

SPK+ - will most probably be for speaker.
DM, BOOT0 maybe interesting, not really sure offhand unless you take a look and see what signals are coming out of either..  GND will be ground.

Whats on the other side of the board?
What SoC is it using under the heatsink? (the big block above PZ1)

My usual method will be to check what the SoC is, and try see where the UART pins lead.


This camera - right?

https://www.eufylife.com/products/variant/indoor-cam-2k/T84001W1

See if you can find some firmware that we can look at also.  That will give more clues.  It's probably ARM based.

What does the flash branding say?  I think its a Winbond, but not 100% from the photo. (its left, above the TEAN E120339 writing)
At a guess, its likely SPI flash, as I only see 8 pins,  but a better shot of the model number would help.

If you've nuked the uboot, will need an spi flasher or similar to reflash.

Have a look at the forums for routers eg (dd/open)wrt, as people do that a lot, and its described in more detail than I'm willing to type

HiSilicon media processing platform (HiMPP) is part of the SDK.

You'll need to either have bought a dev kit, or trawl the internet to find the SDK.

Maybe check this blog -
https://mark4h.blogspot.com

This post talks about it in
https://mark4h.blogspot.com/2017/07/hi3518-camera-module-part-1-replacing.html
and this has a link

https://github.com/shadow-1/yi-hack-v3/issues/23
From that Link - https://app.box.com/s/cibs7n1mgvhqaqjlidtveegu1uajt5yr
Note - Finding a specific version is probably impossible unless you have legit access, so you'll have to make do with whatever has been previously uploaded.

Interesting.

There's a series here too that I wrote many years ago - https://www.computersolutions.cn/blog/category/ip-cam/
9 years ago! 

have had a quick look, but github loads terribly slowly in china., if you're referring to j3.jpg 左右 that means left right

gm8126 for bt mining? hah, woefully underpowered

wpa_supplicant version 2.4 and above is affected, so replace that.

That said I'm not actually sure that the version on the camera is vulnerable, it might actually be too old.