Обновил прошивку на регистраторе до крайней, попробовал подцепить имеющиеся под рукой и что-то ни как.
- 00_UpBQc-LM0x0.jpg (306.39 КБ) 10738 просмотров
Запросил ту, которая не пишет и ему принесли D-Link DCS-7110.
- 11_LpvZZ89WnPo_.jpg (67 КБ) 10738 просмотров
Попробовал подключить и что-то не получается. Глянул на прошивку, стоит 1.10 версия.
Скачал максимально доступную для данной ревизии DCS-7110_A3_FW_v2_10.rar и обновил.
Камера ушла в себя и не поднялась
Вообщем добавил он себе работы на ровном месте, о чем и пишет. Чего делать?
Рисую план, подключиться к TTL, и снять дамп с камеры возможными способами, другого все равно пока нет, а это он точно сделал в легкую!
Зная, что у Dlink все не так как у других, готовимся к худшему.
- 01_LlzqDkAHPdo_.jpg (107.62 КБ) 10738 просмотров
- 02_Pfz7vDe9Stk_.jpg (110.25 КБ) 10738 просмотров
- 03_U1fHtO7P4JY_.jpg (140.97 КБ) 10738 просмотров
- 04_Kb1y1XIeFHY_.jpg (171.79 КБ) 10738 просмотров
- 05_ssw8oBwG4Jg_.jpg (142 КБ) 10738 просмотров
- 06_ydU953hNTgQ_.jpg (238.81 КБ) 10738 просмотров
- 07_rjUsHmjf6AE_.jpg (516.42 КБ) 10738 просмотров
- 10_lFoc0RVsOMw_.jpg (63.74 КБ) 10738 просмотров
Флеш NAND 128MiB 3,3V 8-bit, дамп на TNT500 снялся со служебкой, которую, уже удалил подправленной программулиной после манипуляций с недавней камерой AXIS.
Разложив дамп на части и разобрав их выяснил:
00000000-007FFFFF - загрузчик + переменные
00800000-00BFFFFF - ядро
00C00000-00FFFFFF - копия ядра
01000000-02FFFFFF - initrd
03000000-07FFFFFF - частичная копия initrd в формате JFFS2
Ядро и копия ядра отличались, но в логе загрузке было вот такое
Код: Выделить всё
[07/02/18 - 13:05:54:110] DM36x initialization passed!
TI UBL Version: 1.0.4.0 (PSP_02_10_00_14)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
DONE
Jumping to entry point at 0x81080000.
U-Boot 1.3.4-svn74851 (Apr 2 2010 - 16:39:35)
I2C: ready
DRAM: 256 MB
NAND: NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
128 MiB
*** Warning - bad CRC or NAND, using default environment
In: serial
Out: serial
Err: serial
Reset IC
EEPROM @ 0x50 read FAILED!!!
Ethernet PHY: GENERIC @ 0x01
iJ
Hit any key to stop autoboot: 0
Magic number=a1aced01 at offset=0x200000
Flash status = 255
Loading from NAND 128MiB 3,3V 8-bit, offset 0x800000
Image Name: Linux-2.6.18_pro500-davinci_evm-
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1787400 Bytes = 1.7 MB
Load Address: 80008000
Entry Point: 80008000
## Booting kernel from Legacy Image at 80700000 ...
Image Name: Linux-2.6.18_pro500-davinci_evm-
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1787400 Bytes = 1.7 MB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux.............................................................
............................................................. done, booting the
kernel.
Linux version 2.6.18_pro500-davinci_evm-arm_v5t_le (wayne.lin@rd1-2.vivotek.tw)
(gcc version 4.2.0 (MontaVista 4.2.0-16.0.32.0801914 2008-08-30)) #1 PREEMPT Wed
Aug 10 11:25:12 CST 2011
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
Machine: DaVinci DM365 EVM
Memory policy: ECC disabled, Data cache writeback
DaVinci DM0365 variant 0x8
PLL0: fixedrate: 24000000, commonrate: 135000000, vpssrate: 270000000
PLL0: vencrate_sd: 27000000, ddrrate: 270000000 mmcsdrate: 135000000
PLL1: armrate: 297000000, voicerate: 20482758, vencrate_hd: 27000000
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 8192 bytes, associativity 4, 32 byte lines, 64 sets
Built 1 zonelists. Total pages: 40960
Kernel command line: mem=160M console=ttyS0,115200n8 root=/dev/mtdblock1 ro root
fstype=jffs2 user_debug=31 davinci_capture.channel0_bufsize=2048000
PID hash table entries: 1024 (order: 10, 4096 bytes)
Clock event device timer0_0 configured with caps set: 07
Console: colour dummy device 80x30
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 160MB = 160MB total
Memory: 158336KB available (3121K code, 639K data, 176K init)
Security Framework v1.0.0 initialized
Capability LSM initialized
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
MUX: initialized SPI3_SCLK
MUX: initialized SPI3_SDI
MUX: initialized SPI3_SDO
MUX: initialized SPI3_SDENA0
DaVinci: 104 gpio irqs
MUX: initialized GPIO20
MUX: initialized I2C_SCL
DM365 IPIPE initialized in Single Shot mode
Generic PHY: Registered new driver
ch0 default output "COMPOSITE", mode "NTSC"
VPBE Encoder Initialized
LogicPD encoder initialized
Avnetlcd encoder initialized
dm365_afew_hw_init
MUX: initialized GPIO20
MUX: initialized GPIO21
i2c_davinci i2c_davinci.1: configure I2C as GPIO mode
SCSI subsystem initialized
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 8192 bind 4096)
TCP reno registered
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
Initializing Cryptographic API
io scheduler noop registered
io scheduler anticipatory registered (default)
davincifb davincifb.0: dm_osd0_fb: 720x480x16@0,0 with framebuffer size 675KB
davincifb davincifb.0: dm_vid0_fb: 0x0x16@0,0 with framebuffer size 1020KB
davincifb davincifb.0: dm_osd1_fb: 720x480x4@0,0 with framebuffer size 675KB
davincifb davincifb.0: dm_vid1_fb: 0x0x16@0,0 with framebuffer size 1020KB
DAVINCI-WDT: DaVinci Watchdog Timer: heartbeat 60 sec
MUX: initialized PWM1
MUX: initialized PWM2_G87
MUX: initialized PWM2_G88
MUX: initialized PWM2_G89
MUX: initialized PWM2_G90
MUX: initialized PWM3_G80
MUX: initialized PWM3_G81
MUX: initialized PWM3_G85
MUX: initialized PWM3_G86
davinci_ldc initialized
imp serializer initialized
davinci_previewer initialized
davinci_resizer initialized
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO map 0x1c20000 mem 0xfbc20000 (irq = 40) is a 16550A
serial8250.0: ttyS1 at MMIO map 0x1d06000 mem 0xfbd06000 (irq = 41) is a 16550A
RAMDISK driver initialized: 1 RAM disks of 40960K size 1024 blocksize
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
Davinci EMAC MII Bus: probed
DaVinci EMAC: unable to read MAC address from EEPROM, no I2C support in kernel.
MAC address is deadbeaf
TI DaVinci EMAC Linux version updated 4.0
netconsole: not configured, aborting
Linux video capture interface: v2.00
vpfe_init
Pin VIN_YIN_EN already used for ???.
starting ccdc_reset...<7>
End of ccdc_reset...<5>vpfe_probe
Trying to register davinci display video device.
layer=c921f400,layer->video_dev=c921f560
Trying to register davinci display video device.
layer=c921f200,layer->video_dev=c921f360
davinci_init:DaVinci V4L2 Display Driver V1.0 loaded
af major#: 249, minor# 0
AF Driver initialized!
aew major#: 248, minor# 0
AEW Driver initialized!
i2c /dev entries driver
nand_davinci nand_davinci.0: Using 4-bit hardware ECC
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
Creating 4 MTD partitions on "nand_davinci.0":
0x00000000-0x08000000 : "Boot"
0x02000000-0x03800000 : "Rootfs"
0x03800000-0x04000000 : "Flashfs"
0x04000000-0x08000000 : "Flashfs2"
nand_davinci nand_davinci.0: hardware revision: 2.3
[Bill0428] GPIOI2C_SCL:40 GPIOI2C_SDA:39!
[Bill0428] In dm365_rtc_probe!
rtc_davinci_dm365 rtc_davinci_dm365.0: rtc intf: proc
rtc_davinci_dm365 rtc_davinci_dm365.0: rtc intf: dev (254:0)
rtc_davinci_dm365 rtc_davinci_dm365.0: rtc core: registered rtc_davinci_dm365 as
rtc0
set 0x0 to addr 0x10
set 0x0 to addr 0x14
set 0x3 to addr 0x14
set 0x0 to addr 0x8
set 0x10010 to addr 0x4
set 0x3 to addr 0x14
set 0x0 to addr 0x8
set 0x10014 to addr 0x4
set 0x3 to addr 0x10
DAVINCI-MMC: DaVinci MMC driver 1.0.0.1, Mon Jun 13 20:57:21 CST 2011
davinci-mmc davinci-mmc.0: Supporting 4-bit mode
davinci-mmc davinci-mmc.0: Using DMA mode
Advanced Linux Sound Architecture Driver Version 1.0.12rc1 (Thu Jun 22 13:55:50
2006 UTC).
ASoC version 0.13.1
AIC3X Audio Codec 0.2
VVTK gpio_i2c ERROR: No ACK from device 0x30
VVTK gpio_i2c ERROR: No ACK from device 0x30
i2c_davinci i2c_davinci.1: retried 1 times fail!
ALSA device list:
No soundcards found.
IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP bic registered
Initializing XFRM netlink socket
NET: Registered protocol family 1
NET: Registered protocol family 10
6WIND/LSIIT IPv6 multicast forwarding 0.1 plus PIM-SM/SSM with *BSD API
lo: Disabled Privacy Extensions
IPv6 over IPv4 tunneling driver
Mobile IPv6
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
rtc_davinci_dm365 rtc_davinci_dm365.0: setting the system clock to 2000-01-01 01
:36:11 (946690571)
Time: timer0_1 clocksource has been installed.
Clock event device timer0_0 configured with caps set: 08
Switched to high resolution mode on CPU 0
VFS: Mounted root (jffs2 filesystem) readonly.
Freeing init memory: 176K
init started: BusyBox v1.12.4 (2010-09-21 14:56:54 CST)
/etc/init.d/rcS: line 58: sysparam: not found
sh: 255: unknown operand
Empty flash at 0x00146840 ends at 0x00147000
jffs2_scan_inode_node(): CRC failed on node at 0x001497c0: Read 0xffffffff, calc
ulated 0xde649f8a
Empty flash at 0x00149804 ends at 0x0014a000
jffs2_scan_inode_node(): CRC failed on node at 0x0014c7d4: Read 0xffffffff, calc
ulated 0x1af41765
Empty flash at 0x0014c818 ends at 0x0014d000
jffs2_scan_eraseblock(): Node at 0x0014f7fc {0x1985, 0xe002, 0xe0021985) has inv
alid CRC 0x00000044 (calculated 0xd7cd6a7b)
Empty flash at 0x00206824 ends at 0x00207000
jffs2_scan_dirent_node(): Name CRC failed on node at 0x0078e7d8: Read 0x16103e00
, calculated 0x44660075
Empty flash at 0x0078e808 ends at 0x0078f000
Empty flash at 0x00792014 ends at 0x00792800
JFFS2 notice: (264) read_dnode: node CRC failed on dnode at 0x211fe8: read 0xfff
fffff, calculated 0x4d274c2b
JFFS2 notice: (264) read_dnode: node CRC failed on dnode at 0x791fd0: read 0xfff
fffff, calculated 0x2dfdeb4c
ioremap_nocache(0x8a000000, 100663296)=0xcb000000
/etc/init.d/rcS: line 61: /usr/ballocated heap buffer 0xcb000000 of size 0xa4500
0
in/socinst: not cmem initialized 7 pools between 0x8a000000 and 0x90000000
found
EDMAK module: built on Jun 12 2009 at 18:23:04
Reference Linux version 2.6.18
File /home/yenchun/project/DM365/dvsdk_2_10_00_13/linuxutils_2_24_02/packages/
ti/sdo/linuxutils/edma/src/module/edmak.c
IRQK module: built on Jun 12 2009 at 18:23:13
Reference Linux version 2.6.18
File /home/yenchun/project/DM365/dvsdk_2_10_00_13/linuxutils_2_24_02/packages/
ti/sdo/linuxutils/irq/src/module/irqk.c
irqk initialized
vpfe ccdc capture vpfe ccdc capture.1: vpif_register_decoder: decoder = RAW3-Sen
sor
GPIO Device Driver version 1.0.0.0.
GPIO Major Number = 244
make node with 'mknod /dev/gpio(0~7) c 244 (0~7)'
DM365MMAP module: built on Jun 12 2009 at 11:46:08
Reference Linux version 2.6.18
File /home/yenchun/project/DM365/dvsdk_2_10_00_13/dm365mm/module/dm365mmap.c
MMAP from 0x1c40000 to 0x1c40fff
Read [r] or Write [w]: r
Please enter addr(hex):
Please enter mask & value:
write from 0xfd00aa to 0xfd005a
Read [r] or Write [w]: w
Please enter addr(hex):
Please enter mask & value:
write from 0xfd005a to 0xfd005a
Read [r] or Write [w]: w
leave
/etc/init.d/rcS: line 74: mkfifo: not found
/etc/init.d/rcS: line 76: mkfifo: not found
/etc/init.d/rcS: line 77: mkfifo: not found
Starting led: GPIO module open 244/23
GPIO module open success
GPIO module open 244/24
GPIO module open success
/etc/rcS.d/S03led: line 54: /usr/bin/update_ledoff: not found
.
Starting restore: /etc/rcS.d/S04restore: line 1: read-reset-button: not found
.
Starting swatchdog: .
run-parts: /etc/rcS.d/S06shmalloc exited with code 1
Starting configer: .
Starting synctime: .
Starting chronos: .
/etc/rcS.d/S10venc: line 16: gpioutil: not found
/etc/rcS.d/S10venc: line 16: cut: not found
/etc/rcS.d/S10venc: line 63: /usr/bin/tinyxmlparser: not found
Starting venc: [venc]: Venc_GetOption() option:pf with args raw
[venc]: Venc_GetOption() option:vo with args ntsc
.
pgd = c99d0000
[00000000] *pgd=89201031, *pte=00000000, *ppte=00000000
Pid: 329, comm: venc
CPU: 0
PC is at 0x62dd0
LR is at 0x62dc0
pc : [<00062dd0>] lr : [<00062dc0>] Not tainted
sp : bed33438 ip : 4028b000 fp : 001436d0
r10: bed33984 r9 : 00143724 r8 : 00ff00ff
r7 : 000e7448 r6 : 00143724 r5 : 00143730 r4 : 00143730
r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : 00000031
Flags: nzCv IRQs on FIQs on Mode USER_32 Segment user
Control: 5317F
Table: 899D0000 DAC: 00000015
[<c00364d4>] (show_regs+0x0/0x50) from [<c003b6bc>] (__do_user_fault+0x5c/0xa4)
Starting radvdump: r4 = C918D2E0 /etc/rcS.d/S11ra
dvdump: line 59:[<c003b660>] /usr/bin/tinyxm(__do_user_fault+0x0/0xa4) lparser:
not foufrom [<c003b978>] nd
(do_page_fault+0x1f8/0x228)
r7 = C98EFA18 r6 = C918D2E0 r5 = C0348A68 r4 = FFFFFFEC
[<c003b780>] (do_page_fault+0x0/0x228) from [<c003bb38>] (do_DataAbort+0x3c/0xa0
)
[<c003bafc>] (do_DataAbort+0x0/0xa0) from [<c0034d88>] (ret_from_exception+0x0/0
x10)
r8 = 00FF00FF r7 = 000E7448 r6 = 00143724 r5 = 00143730
r4 = FFFFFFFF
Starting network: /etc/rcS.d/S12network: line 228: ledctrl: not found
/etc/rcS.d/S12network: line 228: /usr/bin/tinyxmlparser: not found
/etc/rcS.d/S12network: line 228: /usr/bin/tinyxmlparser: not found
/etc/rcS.d/S12network: line 228: /usr/bin/tinyxmlparser: not found
/etc/rcS.d/S12network: line 228: /usr/bin/tinADDRCONF(NETDEV_UP): eth0: link is
not ready
yxmlparser: not found
/etc/rcS.d/S12network: line 228: /usr/bin/tinyxmlparser: not found
ifup: can't open '/var/run/ifstate': No such file or directory
/etc/rcS.d/S12network: line 228: sysparam: not found
BusyBox v1.12.4 (2010-09-21 14:56:54 CST) multi-call binary
Usage: ifconfig [-a] interface [address]
Configure a network interface
Options:
[add ADDRESS[/PREFIXLEN]]
[del ADDRESS[/PREFIXLEN]]
[[-]broadcast [ADDRESS]] [[-]pointopoint [ADDRESS]]
[netmask ADDRESS] [dstaddr ADDRESS]
[outfill NN] [keepalive NN]
[hw ether|infiniband ADDRESS] [metric NN] [mtu NN]
[[-]trailers] [[-]arp] [[-]allmulti]
[multicast] [[-]promisc] [txqueuelen NN] [[-]dynamic]
[mem_start NN] [io_addr NN] [irq NN]
[up|down] ...
/etc/rcS.d/S12network: line 228: sysparam: not found
/etc/rcS.d/S12network: line 228: sysparam: not found
/etc/rcS.d/S12network: line 228: cut: not found
/etc/rcS.d/S12network: line 228: tr: not found
ifconfig: bad address 'Auto'
/usr/sbin/dumpnetif: line 8: can't create /var/run/netstatus: nonexistent direct
ory
/usr/sbin/dumpnetif: line 9: can't create /var/run/netstatus: nonexistent direct
ory
/usr/sbin/dumpnetif: line 11: can't create /var/run/netstatus: nonexistent direc
tory
/usr/sbin/dumpnetif: line 12: awk: not found
/usr/sbin/dumpnetif: line 13: can't create /var/run/netstatus: nonexistent direc
tory
/usr/sbin/dumpnetif: line 14: awk: not found
/usr/sbin/dumpnetif: line 15: can't create /var/run/netstatus: nonexistent direc
tory
/usr/sbin/dumpnetif: line 16: awk: not found
/usr/sbin/dumpnetif: line 17: can't create /var/run/netstatus: nonexistent direc
tory
/usr/sbin/dumpnetif: line 18: awk: not found
/usr/sbin/dumpnetif: line 19: awk: not found
/usr/sbin/dumpnetif: line 20: can't create /var/run/netstatus: nonexistent direc
tory
/usr/sbin/dumpnetif: line 21: can't create /var/run/netstatus: nonexistent direc
tory
network_ipaddress=0.0.0.0
network_subnet=
network_router=
network_dns1=
network_dns2=
network_wins1=
network_wins2=
/etc/rcS.d/S12network: line 228: can't create /var/run/netstatus: nonexistent di
rectory
ifup: ignoring unknown interface ppp0
.
* Starting ip filter with iptables...
iptables/ip6tables disabled
[07/02/18 - 13:06:17:507] [07/02/18 - 13:06:17:507] [07/02/18 - 13:06:17:507] [07/02/18 - 13:06:17:508] [07/02/18 - 13:06:17:508] [07/02/18 - 13:06:17:508] [07/02/18 - 13:06:17:508] [07/02/18 - 13:06:17:508] [ ok ]
Starting syslogd: .
/etc/rcS.d/S15dhcp6c: line 96: /usr/bin/tinyxmlparser: not found
/etc/rcS.d/S16upnpigdcp: /etc/sysconf: line 2: /usr/bin/sysparam: not found
/etc/rcS.d/S16upnpigdcp: /etc/sysconf: line 31: uuidapp: not found
Anubis architecture
/etc/rcS.d/S16upnpigdcp: line 719: can't create /var/run/init.d/S16upnpigdcp: no
nexistent directory
router=
UPnP CP disabled
/etc/rcS.d/S17httpd: line 64: can't create /var/run/init.d/S17httpd: nonexistent
directory
Starting httpd: .
Starting recorder: .
Starting ectun: pgd = c9bb4000
[00003bb4] *pgd=89bb2031, *pte=00000000, *ppte=00000000
Pid: 506, comm: ectun
.
Starting eventmgr: CPU: 0
Starting eventmgPC is at 0xbe34
r with support fLR is at 0x40106e24
or EcTun
cannotpc : [<0000be34>] lr : [<40106e24>] Not tainted
sp : be9fe0f8 ip : 00000001 fp : 000004ac
create /var/runr10: ffffffff r9 : be9fece4 r8 : 401c1008
/eventmgr/emsockr7 : 0002a484 r6 : 00003bb4 r5 : 00021e2c r4 : 401c1008
et (2).No such fr3 : 00021ddc r2 : 00000000 r1 : 00000000 r0 : 00000000
ile or directoryFlags: nZCv
Create UNIX so IRQs on FIQs on Mode USER_32 Segment user
cket /var/run/evControl: 5317F
entmgr/emsocket Table: 89BB4000 DAC: 00000015
failed!
.
Star[<c00364d4>] ting inetd: (show_regs+0x0/0x50) from [<c003b6bc>] (__do_user_f
ault+0x5c/0xa4)
r4 = C90492E0
[<c003b660>] (__do_user_fault+0x0/0xa4) from [<c003b978>] (do_page_fault+0x1f8/0
x228)
r7 = C98EFAC8 r6 = C90492E0 r5 = C0348A68 r4 = FFFFFFEC
[<c003b780>] (do_page_fault+0x0/0x228) from [<c003bb38>] (do_DataAbort+0x3c/0xa0
)
[<c003bafc>] (do_DataAbort+0x0/0xa0) from [<c0034d88>] (ret_from_exception+0x0/0
x10)
r8 = 401C1008 r7 = 0002A484 r6 = 00003BB4 r5 = 00021E2C
r4 = FFFFFFFF .
/etc/rcS.d/S28drmd: line 61: can't create /var/run/init.d/S28drmd: nonexistent d
irectory
Starting drmd: /etc/rcS.d/S28drmd: /etc/sysconf: line 2: /usr/bin/sysparam: not
found
/etc/rcS.d/S28drmd: /etc/sysconf: line 31: uuidapp: not found
.
/etc/rcS.d/S31upnpdd: line 77: can't create /var/run/init.d/S31upnpdd: nonexiste
nt directory
Starting upnpdd: /etc/rcS.d/S31upnpdd: /etc/sysconf: line 2: /usr/bin/sysparam:
not found
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
/etc/rcS.d/S31upnpdd: /etc/sysconf: line 31: uuidapp: not found
enable 1
.
Starting iod: .
Starting uartd: .
/etc/rcS.d/S70rtsps: line 101: can't create /var/run/init.d/S70rtsps: nonexisten
t directory
Starting rtsps: run as daemon mode
.
/etc/rcS.d/S70rtsps: line 101: /usr/bin/fifocmd: not found
Starting serverpush: .
Starting ircutctrl: .
Starting snapshotd: Total stream num: 4, default stream ID: 3
Entering daemon mode...
.
Starting ptzmanager:
Driver not found
.
Starting stormgr:
sendto() error 2
.
test network status...
Эту конструкцию ниже сразу проигнорировали
Код: Выделить всё
EEPROM @ 0x50 read FAILED!!!
Ethernet PHY: GENERIC @ 0x01
, а вот на эту обратил внимание и стал искать в раскрытом initrd что это такое может быть, но об этом чуть позже.
Код: Выделить всё
Flash status = 255
Естественно, ни кнопка сброса в разных комбинациях 30-30-30, ни чего другого не позволяло в данной ситуации автоматически сбросить
область 03000000-07FFFFFF, пересоздать её и все бы сразу встало на свои места.
В других камерах dlink , по найденным мануалам в интернете такой трюк возможен, но только не с этой моделью.
К счатью набор команд в загрузчике был достаточным, чтобы манипулировать данными
Код: Выделить всё
DM365 EVM :>printenv
bootargs=
bootcmd=nboot 0x80700000 0 0x800000; bootm
bootinitrdcmd=setenv bootargs 'mem=128M console=ttyS0,115200n8 root=/dev/ram0 rw
initrd=0x82000000,32M';nboot 0x81FFFFC0 0 0x1000000;nboot 0x80700000 0 0xC00000
;bootm
bootsdcmd=setenv bootargs 'bootmode=sdboot mem=128M console=ttyS0,115200n8 root=
/dev/ram0 rw initrd=0x82000000,32M';bootm
bootdelay=0
baudrate=115200
bootfile="uImage"
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.3.4-svn74851 (Apr 2 2010 - 16:39:35)
Environment size: 480/131068 bytes
DM365 EVM :>help
? - alias for 'help'
autoscr - run script from memory
base - print or set address offset
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp- boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
echo - echo args to console
go - start application at address 'addr'
help - print online help
icrc32 - checksum calculation
iloop - infinite loop on address range
imd - i2c memory display
iminfo - print header information for application image
imm - i2c memory modify (auto-incrementing)
imw - memory write (fill)
imxtract- extract a part of a multi-image
inm - memory modify (constant address)
iprobe - probe to discover valid I2C chip addresses
itest- return true/false on integer compare
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nm - memory modify (constant address)
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor version
Попытки поменять переменные не приносили успеха, чтобы остановить загрузку, ругалось на превышение количества параметров либо обрезало вводимую строку. Да, если бы это удалось, то можно было бы исполнить часть скрипта из \etc\init.d\rcS, где описан процесс
Код: Выделить всё
#! /bin/sh
if dmesg | grep "bootmode=sdboot" > /dev/null
then
mount /mnt/ramdisk/
mount /proc
mkdir /mnt/mmc
mount -t vfat /dev/mmcblk0p1 /mnt/mmc/
cd /mnt/ramdisk/
facmode setfac
firmunpack /mnt/mmc/*.pkg
tar xzvf setup.tar.gz
setup/install
exit 0
fi
if ! dmesg | grep "jffs2 filesystem" > /dev/null
then
flash_eraseall /dev/mtd1
mkdir /mtdblock1
mount -t jffs2 /dev/mtdblock1 /mtdblock1
cp -a `ls / | grep mtdblock1 -v | grep lost+found -v` /mtdblock1
mount /proc/
until flashmgr recoverKernel
do
echo "retry recover kernel"
done
facmode setfac
sysparam set flashstatus 0
fi
#mount /etc and /tmpfs as tmpfs
mount /mnt/ramdisk
cp -a /etc /tmpfs /mnt/ramdisk/
mount /tmpfs
mount /etc
cp -a /mnt/ramdisk/* /
rm -rf /mnt/ramdisk/*
mount /proc/
if [ `sysparam get flashstatus` != "255" ]; then
echo "update system configuration..."
update_etc upgrade
facmode setfac
sysparam set flashstatus 255
reboot
else
mount /mnt/flash
if [ "$?" != "0" ]; then
update_etc restore
fi
mount /mnt/flash2
if [ "$?" != "0" ]; then
umount /mnt/flash2
flashmgr eraseJFFS2
fi
mount -a
fi
/bin/hostname Network-Camera
/usr/bin/socinst
DRIVER_DIR=/drivers
/sbin/insmod $DRIVER_DIR/cmemk.ko phys_start=0x8a000000 phys_end=0x90000000 pools=1x54525952,5x6334464,5x81920,12x61440,10x20480,10x8192,550x4096
#/usr/bin/mapdmaq
/sbin/insmod $DRIVER_DIR/edmak.ko
/sbin/insmod $DRIVER_DIR/irqk.ko
/sbin/insmod $DRIVER_DIR/rawsensor.ko
/sbin/insmod $DRIVER_DIR/gpio.ko
/sbin/insmod $DRIVER_DIR/dm365mmap.ko
/usr/sbin/iommap 0x01c40000 4k < /etc/iommap.conf
mkdir /mnt/ramdisk/imgbufmgr
mkfifo /var/run/aenc/s0/controlfifo
mkfifo /var/run/recorder/controlfifo
mkfifo /var/run/ss/controlfifo
automount /mnt/auto file /etc/auto.conf
# Avoid CIFS to hang recorder when network link is broken
echo 0 > /proc/fs/cifs/OplockEnabled
# apply patch
test -f /mnt/flash2/patch/apply_patch_before && /mnt/flash2/patch/apply_patch_before
# Start daemons
run-parts -a start /etc/rcS.d
# apply patch
test -f /mnt/flash2/patch/apply_patch_after && /mnt/flash2/patch/apply_patch_after
# nipca daemon
/usr/bin/nipca -d /var/run/http/nipca /var/run/nipca.pid
Принудительная зачистка области 03000000-07FFFFFF и старт камеры приводил загрузку в состояние
Код: Выделить всё
Kernel panic - not syncing: No init found. Try passing init= option to kernel.Камера упорно не хотела самостоятельно пересоздать этот раздел и сделать все как надо.
Изучив скрипты загрузки в initrd, а это ext2 файловая система со всеми каталогами, которая завернута в gz и данный раздел не меняется,
и не затрагивается кроме как обновлением прошивки.
Пришлось дизассемблировать загрузчик, чтобы выяснить откуда берется этот Flash status, ведь при другом значении, как раз таки в скриптах идет инициализация нужной области.
В итоге, изменив нужные байты в повторяющихся структурах данных и после записи измененной области во флеш из загрузчика, камера, после перезагрузки выполнила нужные скрипты, т.к. flash status изменился создав все необходимое загрузилась нормально.
Оказалось, что камера обновлена прошивкой 2.10, как раз таки той которой обновлялась, но до момента обновления на разделе JFFS2 были проблемы, которые не позволили нормально загрузится.
Проблема решилась, а камера не такая и свежая, чтобы метать молнии в производителя, за его такое архитектурное решение
Была конечно мысль взять дамп с доноров, которые были у заказчика, но, чтобы не упасть в грязь лицом, пришлось всем выкручиваться .
В любом случае это новый опыт, интересная задача к решению и готовым быть к такой ситуации сложно, но главное не опускать руки.
Конечно, можно было поработать с autoscr, но время поджимало и надо было вернуть к жизни то, что вроде бы работало, но как....
#dlink #восстановление_dlink #dlink_recovery