Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - Mnemonic

Pages: [1]
Hacking & Modding / Re: Telnet password and username for IPC
« on: April 09, 2015, 06:57:48 pm »

If you still need the password for that hash here it is: xmhdipc

Hacking & Modding / Re: [Info] new firmware for FI9821W V2 (FI9821A)
« on: March 15, 2014, 04:06:31 pm »
FI9821W V2-

This time again firmware arrives with two files:

File name                               Version       Content                    Password
FI9821A_app_ver1.11.0.40_OneToAll.bin     Intermediate binary        WT8Nk*
FosIPC_A_app_ver2.x.1.6.bin         Actual firmware   WT8Nk*v2

...but now in FosIPC_A_app_ver2.x.1.6.bin you will find only jffs2 partition image, update binary, update config and md5 file.

If anyone want to take a look into files in mtd.jffs2 I have them extracted and you can download package here

Happy hacking

Upgrade only from

Relase notes:
System firmware version:
App firmware version:
Plug-in version:

New features:
1) Support ONVIF;
2) Support uploading snapshots to FTP server in fixed time interval;

1) Enhace the SD card management feature;
2) Fixed the bug cannot set preset and cruise on IE8;
3) Fixed the issue cannot do manual snapshot if the added multi-device is a MJPEG camera;
4) Fixed the issue cannot stop manual record if the added multi-device is a MJPEG camera;
5) Fixed the issue plug-in will crash if you turnning the IR on/off;
6) Improve the stability of plug-in on safari;
7) Fixed the issue cannot revise the port nember and account settigns after choosing one of the 2nd~9th cameras in the multi-device windows;
8 )Fixed the issue not able to login when switching to Hungarian;
9) More friendly web UI.

Link to firmware(16.0 MB):

To decrypt HI3518A_ddr256M_sys_ver1.4.1.8.bin:
Code: [Select]
openssl enc -d -aes-128-cbc -k Wxift* -in HI3518A_ddr256M_sys_ver1.4.1.8.bin > HI3518A_ddr256M_sys_ver1.4.1.8.tar.gz
To decrypt FI9821A_app_ver1.11.0.26.bin:
Code: [Select]
openssl enc -d -aes-128-cbc -k Wxift* -in FI9821A_app_ver1.11.0.26.bin > FI9821A_app_ver1.11.0.26.tar.gz
To decrypt FI9821A_app_ver1.11.1.18.bin:
Code: [Select]
openssl enc -d -aes-128-cbc -k WT8Nk* -in FI9821A_app_ver1.11.1.18.bin > FI9821A_app_ver1.11.1.18.tar.gz

Hacking & Modding / [Info] General info about FI9821W V2 (FI9821A)
« on: August 29, 2013, 03:59:52 pm »

Code: [Select]
2 - RX
3 - GND
4 - TX

Boot log

Code: [Select]
U-Boot 2010.06 (Jan 25 2013 - 10:58:11)

DRAM:  256 MiB
NAND:  Special Nand id table Version 1.35
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found!!!
0 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128XX"
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot: 0
16384 KiB hi_sfc at 0:0 is now current device

## Starting application at 0x82000000 ...
Uncompressing Linux... done, booting the kernel.
Linux version 3.0.8 (foscam@ubuntu) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #5 Wed Mar 13 15:15:07 CST 2013
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518
Memory policy: ECC disabled, Data cache writeback
AXI bus clock 200000000.
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 48768
Kernel command line: mem=192M console=ttyAMA0,115200 mtdparts=hi_sfc:1M(boot),4M(kernel),11M(jffs2)
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 192MB = 192MB total
Memory: 185076k/185076k available, 11532k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xcc800000 - 0xfe000000   ( 792 MB)
    lowmem  : 0xc0000000 - 0xcc000000   ( 192 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0500000   (5088 kB)
      .text : 0xc0500000 - 0xc0958000   (4448 kB)
      .data : 0xc0958000 - 0xc0974460   ( 114 kB)
       .bss : 0xc0974484 - 0xc0987c0c   (  78 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32 nr_irqs:32 32
sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms
Console: colour dummy device 80x30
Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource timer1
cfg80211: Calling CRDA to update world regulatory domain
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Installing knfsd (copyright (C) 1996
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.16)
msgmni has been set to 361
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
brd: module loaded
Spi id table Version 1.22
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
SPI FLASH start_up_mode is 3 Bytes
spi size: 0x16777216
chip num: 1
3 cmdlinepart partitions found on MTD device hi_sfc
Creating 3 MTD partitions on "hi_sfc":
0x000000000000-0x000000100000 : "boot"
0x000000100000-0x000000500000 : "kernel"
0x000000500000-0x000001000000 : "jffs2"
Fixed MDIO Bus: probed
himii: probed
Invalid HW-MAC Address: 00:00:00:00:00:00
Set Random MAC address: F6:66:D3:BE:26:9E
PPP generic driver version 2.4.2
SLIP: version 0.8.4-NET3.019-NEWTTY (dynamic channels, max=256).
CSLIP: code copyright 1989 Regents of the University of California.
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP cubic registered
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
usb 1-1: new high speed USB device number 2 using hiusb-ehci
registered taskstats version 1
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
řFreeing init memory: 5088K
mmc0: new SDHC card at address 7d05
mmcblk0: mmc0:7d05 SD08G 7.42 GiB
 mmcblk0: p1
mount: mounting tmpfs on /dev failed: Invalid argument

            _ _ _ _ _ _ _ _ _ _ _ _
            \  _  _   _  _ _ ___
            / /__/ \ |_/
           / __   /  -  _ ___
          / /  / /  / /
  _ _ _ _/ /  /  \_/  \_ ______

[RCS]: /etc/init.d/S00devs
mknod: /dev/console: File exists
mknod: /dev/null: File exists
[RCS]: /etc/init.d/S01udev
udevd (433): /proc/433/oom_adj is deprecated, please use /proc/433/oom_score_adj instead.
[RCS]: /etc/init.d/S80network
[RCS]: /etc/init.d/S90init
Hisilicon Media Memory Zone Manager
hi3518_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Hisilicon UMAP device driver interface: v3.00
pa:8c000000, va:cc9c0000
load sys.ko for Hi3518...OK!
load viu.ko for Hi3518...OK!
ISP Mod init!
load vpss.ko ....OK!
load venc.ko for Hi3518...OK!
load group.ko for Hi3518...OK!
load chnl.ko for Hi3518...OK!
load h264e.ko for Hi3518...OK!
load jpege.ko for Hi3518...OK!
load rc.ko for Hi3518...OK!
load region.ko ....OK!
load vda.ko ....OK!
hi_i2c init is ok!
sha204 [sha204_init ,291]: sha204 driver init successful!
==== Your input Sensor type is ov9715 ====
*** Board tools : ver0.0.1_20120501  ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20030030: 0x00000000 --> 0x00000001
acodec inited!
insert audio
==== Your input Wifi type is rt3070 ====
rtusb init rt3070STA --->

=== pAd = ccde0000, size = 527720 ===

<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
usbcore: registered new interface driver rt3070STA
ptz_init start ptz_state[1],HorPos[0],VerPos[0]
setup ptz gpio success
setup zoom gpio success
ptz_init end ptz_state[1],HorPos[-1],VerPos[-1],flag[0]
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=5 sec (nowayout= 0, nodeamon= 0)
hwclock: can't open '/dev/misc/rtc': No such file or directory
set rtc time to system time
Auto login as root ...
Aug 25 18:40:36 login[757]: root login on 'ttyS000'
You are welcomed by FOSCAM R&D.
None of nfsroot found in cmdline.
# Vertical self test complete,horizen_phase[5],flag[0]
killall: devMng: no process killed
killall: codec: no process killed
killall: UDTMediaServer: no process killed
killall: webService: no process killed
killall: storage: no process killed
killall: FirmwareUpgrade: no process killed
killall: RtspServer: no process killed
[Storage     ] log file doesn't exist, now create it                            ------../log/CLog.cpp,26
[DEV_MNG     ] setSystemTime: 2013.8.25-18:40:39, timeZone:-7200, dst:0, result:0------../SystemTime/CSystemTime.cpp,145
[COMMON_LIB  ] Enter cpu tick thread                                            ------../CAppTimer.cpp,187
set time
[COMMON_LIB  ] Enter cpu tick thread                                            ------../CAppTimer.cpp,187
[MEDIA_SERVER] ######bind p2p port:23543                                        ------../CUDTMediaServer.cpp,297
[COMMON_LIB  ] Enter cpu tick thread                                            ------../CAppTimer.cpp,187
[DEV_MNG     ] setSystemTimeNTP                                                 ------../SystemTime/CSystemTime.cpp,183
[DEV_MNG     ] Auto mode                                                        ------../LED/CLed.cpp,52
[DEV_MNG     ] Start light detect thread                                        ------../LED/CLed.cpp,290
[DEV_MNG     ] All reset detect thread start run                                ------../AllReset/CAllReset.cpp,90 Unknown host
[DEV_MNG     ] get time from fail                                 ------../SystemTime/CSystemTime.cpp,197
[DEV_MNG     ] Enter NTP update thread                                          ------../SystemTime/CSystemTime.cpp,296
[WEB_SERVICE ] Enter DDNS update thread                                         ------../DDNS/CDdns.cpp,385
LIVE555 Media Server
version 0.77 (LIVE555 Streaming Media library version 2013.01.25).
Play streams from this server using the URL
where <filename> is a file present in the current directory.
Each file's type is inferred from its name suffix:
".264" => a H.264 Video Elementary Stream file
".aac" => an AAC Audio (ADTS format) file
".ac3" => an AC-3 Audio file
".amr" => an AMR Audio file
".dv" => a DV Video file
".m4e" => a MPEG-4 Video Elementary Stream file
".mkv" => a Matroska audio+video+(optional)subtitles file
".mp3" => a MPEG-1 or 2 Audio file
".mpg" => a MPEG-1 or 2 Program Stream (audio+video) file
".ts" => a MPEG Transport Stream file
(a ".tsx" index file - if present - provides server 'trick play' support)
".vob" => a VOB (MPEG-2 video with AC-3 audio) file
".wav" => a WAV Audio file
".webm" => a WebM audio(Vorbis)+video(VP8) file
See for additional documentation.

*if you want to get H264 video Stream real-time from IPCam
*<filename> is one of a follow value:
"videoMain" => Main code stream of IP Camera Video
"videoSub" => Sub code stream of IP Camera Video
"audio" => Sub code stream of IP Camera Audio
"*.avi" => IP Camera Record[WEB_SERVICE ] Enter UPnP thread                                                ------../UPnp/UPnP.cpp,1009
mkdir: can't create directory '/usr/local/pureftpd': File exists
mkdir: can't create directory '/usr/local/pureftpd/etc': File exists
Changing password for ftpuser1
New password:
Bad password: too short
Retype password:
passwd: password for ftpuser1 is unchanged
Enter it again:
Check that [admin] doesn't already exist,
and that [/usr/local/pureftpd/etc/pureftpd.passwd.tmp] can be written.
killall: CGIProxy.fcgi: no process killed
killall: lighttpd: no process killed
[Storage     ] mount sd card                                                    ------../sdcard/CSdCard.cpp,115
mkdir: can't create directory '/mnt/sd/IPCamera': File exists
[Storage     ] pre-record cache file not exist, create it                       ------../record/CRecord.cpp,1583
[Storage     ] enter recordThreadFunc                                           ------../record/CRecord.cpp,2216
[Storage     ] clear record stream buffer success                               ------../record/CRecord.cpp,2238
2013-08-25 18:40:41: (log.c.166) server started foscam
[WEB_SERVICE ] OnRtspServerMsgGetUsrInfo                                        ------../src/RtspServerMsg.cpp,19
[RTSP_SERVER ] Usr:admin, password:admin                                        ------../src/RtspServerMsg.cpp,29
Horizen selftest complete,vertical_phase[8],flag[0]
[DEV_MNG     ] No cable is connected, now try to use wifi                       ------../Network/CNetworkService.cpp,153
killall: wpa_supplicant: no process killed
(Efuse for 3062/3562/3572) Size=0x2d [2d0-2fc]
[CODEC       ] CVideo::init ok                                                  ------../Video/CVideoCodec.cpp,2863
[CODEC       ] enter video MDThread                                             ------../Video/CVideoCodec.cpp,4123
[CODEC       ] ADCL_VOL.vol_ctrl=20 ADCL_VOL.vol_ctrl_mute=0                    ------../Audio/CAudioCodec.cpp,181
[CODEC       ] ADCR_VOL.vol_ctrl=20 ADCR_VOL.vol_ctrl_mute=0                    ------../Audio/CAudioCodec.cpp,184
[CODEC       ] DACL_VOL.vol_ctrl=00 DACL_VOL.vol_ctrl_mute=0                    ------../Audio/CAudioCodec.cpp,189
[CODEC       ] DACR_VOL.vol_ctrl=00 DACR_VOL.vol_ctrl_mute=0                    ------../Audio/CAudioCodec.cpp,192
[CODEC       ] enter video encThread                                            ------../Video/CVideoCodec.cpp,4361
RTMP_TimerListAdd: add timer obj cce2a598!
RTMP_TimerListAdd: add timer obj cce2a5b0!
RTMP_TimerListAdd: add timer obj cce2a5c8!
RTMP_TimerListAdd: add timer obj cce2a580!
RTMP_TimerListAdd: add timer obj cce2a538!
RTMP_TimerListAdd: add timer obj cce2a550!
RTMP_TimerListAdd: add timer obj ccdf4fcc!
RTMP_TimerListAdd: add timer obj ccde1ddc!
RTMP_TimerListAdd: add timer obj ccde1dfc!
RTMP_TimerListAdd: add timer obj ccdf5028!
RTMP_TimerListAdd: add timer obj ccde4710!
RTMP_TimerListAdd: add timer obj ccde3f80!
RTMP_TimerListAdd: add timer obj ccde46f4!
RTMP_TimerListAdd: add timer obj ccde4930!
RTMP_TimerListAdd: add timer obj ccde472c!
RTMP_TimerListAdd: add timer obj ccde4748!
RTMP_TimerListAdd: add timer obj ccde4764!
RTMP_TimerListAdd: add timer obj ccdf4f9c!
RTMP_TimerListAdd: add timer obj ccdf500c!
[CODEC       ] init audio stream ok!                                            ------../Audio/CAudioCodec.cpp,289
[CODEC       ] enter audioDecThread        [CODEC       ] enter audioEncThread                                             ------../Audio/CAudioCodec.cpp,617
[CODEC       ] Load font error.                                                 ------../osd/COsd.cpp,130
Invalid mode setting
[CODEC       ] HI_MPI_ISP_SetAntiFlickerAttr err:0xa00a8003                     ------../Video/CVideoCodec.cpp,3168
[CODEC       ] HI_MPI_VDA_StopRecvPic failed with 0xa0098005!                   ------../Video/CVideoCodec.cpp,3926
[CODEC       ] HI_MPI_VDA_DestroyChn failed with 0xa0098005!                    ------../Video/CVideoCodec.cpp,3947
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 5
2. Phy Mode = 5
NVM is Efuse and its size =2d[2d0-2fc]
phy mode> Error! The chip does not support 5G band 8!
RTMPSetPhyMode: channel is out of range, use first channel=1
(Efuse for 3062/3562/3572) Size=0x2d [2d0-2fc]
3. Phy Mode = 9
AntCfgInit: primary/secondary ant 0/1
MCS Set = ff ff 00 00 01
<==== rt28xx_init, Status=0
0x1300 = 00064300
killall: wpa_supplicant: no process killed
wpa_supplicant v1.1----wpa_supplicant.c(2680)
random: Trying to read entropy from /dev/random----../src/crypto/random.c(413)
Initializing interface 'ra0' conf '/tmp/.wpa.conf' driver 'ralink' ctrl_interface 'N/A' bridge 'N/A'----wpa_supplicant.c(2210)
Configuration file '/tmp/.wpa.conf' -> '/tmp/.wpa.conf'----wpa_supplicant.c(2222)
Reading configuration file '/tmp/.wpa.conf'----config_file.c(317)
Priority group 1----config.c(2327)
   id=0 ssid='AP_DLINK'----config.c(2331)
ra0: Own MAC address: e8:ab:fa:09:26:27----wpa_supplicant.c(2113)
wpa_driver_ralink_set_countermeasures: enabled=0----../src/drivers/driver_ralink.c(1552)
ra0: RSN: flushing PMKID list in the driver----wpa_supplicant.c(2158)
ra0: Setting scan request: 0 sec 100000 usec----scan.c(660)
WPS: Set UUID for interface ra0----wps_supplicant.c(1106)
WPS: UUID based on MAC address - hexdump(len=16): ef ee 2e f0 a5 76 57 fa ad c2 2d 0b 71 d1 b6 42
EAPOL: SUPP_PAE entering state DISCONNECTED----../src/eapol_supp/eapol_supp_sm.c(261)
EAPOL: Supplicant port status: Unauthorized----wpas_glue.c(716)
EAPOL: KEY_RX entering state NO_KEY_RECEIVE----../src/eapol_supp/eapol_supp_sm.c(449)
EAPOL: SUPP_BE entering state INITIALIZE----../src/eapol_supp/eapol_supp_sm.c(535)
EAP: EAP entering state DISABLED----../src/eap_peer/eap.c(182)
EAPOL: Supplicant port status: Unauthorized----wpas_glue.c(716)
EAPOL: Supplicant port status: Unauthorized----wpas_glue.c(716)
ra0: Added interface ra0----wpa_supplicant.c(2516)
killall: udhcpc: no process killed
RTMP_TimerListAdd: add timer obj cce5bbc8!
udhcpc (v1.16.1) started
Sending discover...
Sending discover...
Sending select for
Sending select for
Lease of obtained, lease time 86400
deleting routers
route: SIOCDELRT: No such process
adding dns
Rcv Wcid(1) AddBAReq
Start Seq = 00000000
RTMP_TimerListAdd: add timer obj cce5cfdc!


Code: [Select]
# cat /proc/cpuinfo
Processor : ARM926EJ-S rev 5 (v5l)
BogoMIPS : 218.72
Features : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant : 0x0
CPU part : 0x926
CPU revision : 5

Hardware : hi3518
Revision : 0000
Serial : 0000000000000000


Code: [Select]
# ps
    1 root      1588 S    init
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 SW   [kworker/0:0]
    5 root         0 SW   [kworker/u:0]
    6 root         0 SW   [rcu_kthread]
    7 root         0 SW<  [khelper]
    8 root         0 SW   [kworker/u:1]
  114 root         0 SW   [sync_supers]
  116 root         0 SW   [bdi-default]
  118 root         0 SW<  [kblockd]
  130 root         0 SW   [khubd]
  141 root         0 SW<  [cfg80211]
  142 root         0 SW   [kworker/0:1]
  224 root         0 SW<  [rpciod]
  227 root         0 SW   [kswapd0]
  278 root         0 SW   [fsnotify_mark]
  284 root         0 SW<  [nfsiod]
  295 root         0 SW<  [crypto]
  358 root         0 SW   [mtdblock0]
  363 root         0 SW   [mtdblock1]
  368 root         0 SW   [mtdblock2]
  397 root         0 SW   [kworker/u:2]
  408 root         0 SW   [mmcqd/0]
  428 root         0 SWN  [jffs2_gcd_mtd2]
  433 root       872 S <  udevd --daemon
  728 root         0 SW   [hidog]
  754 root      2924 S    MsgServer
  756 root      2888 S    /mnt/mtd/app/bin/watchdog
  757 root      1612 S    -sh
  775 root      4212 S    devMng
  776 root     62076 S    UDTMediaServer
  777 root      5760 S    webService
  778 root     14504 S    storage
  779 root      2852 S    FirmwareUpgrade
  780 root      3640 S    RtspServer
  852 root      3612 S    lighttpd -f /usr/local/lighttpd-1.4.31-hi/config/lig
  853 root      3812 S    /tmp/www/cgi-bin/CGIProxy.fcgi
  854 root      1108 S    pure-ftpd (SERVER)
  862 root     30616 S    codec
  873 root         0 SW   [RtmpTimerTask]
  874 root         0 SW   [RtmpMlmeTask]
  875 root         0 SW   [RtmpCmdQTask]
  876 root         0 SW   [RtmpWscTask]
  886 root         0 SW   [flush-179:0]
  887 root      1476 S    wpa_supplicant -Dralink -ira0 -c /tmp/.wpa.conf -d -
  914 root      1600 S    udhcpc -b -i ra0 -p /var/run/
  934 root      1584 S    sh -c ntpclient -h -c 3 -s
  935 root      1036 S    ntpclient -h -c 3 -s
  936 root      1588 R    ps


Code: [Select]
# free
              total         used         free       shared      buffers
  Mem:       190164        52480       137684            0         1024
 Swap:            0            0            0
Total:       190164        52480       137684

Open ports

Code: [Select]
# netstat -lnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name   
tcp        0      0 *               LISTEN      854/pure-ftpd (SERV
tcp        0      0 *               LISTEN      776/UDTMediaServer
tcp        0      0    *               LISTEN      852/lighttpd
tcp        0      0   *               LISTEN      852/lighttpd
tcp        0      0 *               LISTEN      780/RtspServer
udp        0      0 *                           775/devMng
udp        0      0 *                           775/devMng
udp        0      0 *                           776/UDTMediaServer
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING       1622 776/UDTMediaServer  /tmp/unix_local
unix  2      [ ACC ]     STREAM     LISTENING       1643 780/RtspServer      /tmp/unix_local_rtsp
unix  2      [ ACC ]     STREAM     LISTENING       1427 754/MsgServer       /tmp/.MsgServerSocket
unix  2      [ ACC ]     STREAM     LISTENING       1716 853/CGIProxy.fcgi   /tmp/CGIProxy.fcgi.socket-0

PCB / chips pictures

To unpack last firmware ( for FI9821W you have to use openssl and password Wxift*:

Code: [Select]
$ openssl enc -d -aes-128-cbc -k Wxift* -in FI9821A_app_ver1.11.1.16.bin > FI9821A.tar.gz
If you want to unpack configuration backup then use Pxift*:

Code: [Select]
$ openssl enc -d -aes-128-cbc -k Pxift* -in configs.bin > configs.tar.gz

Pages: [1]