IPCamera

Post by **admin** » 16 Aug 2014, 21:25

By ebay bought a nice turnable (IR) webcam:

/DGWP01/?page_id=779

Smart ppl check the URL inside, its from Zoneminder: http://dolfgeerdink.nl:91/zm/cgi-bin/np ... s=leidek01

Ahaa, a username and password? Yes, and especially created for this purpose, you can check: http://dolfgeerdink.nl:92
(But that does NOT work anymore...)

DG.

Post by **admin** » 18 Sep 2023, 00:00

Very late update?
On some other cameras the following telnet is working: root:cxlinux
as descibed here:
https://www.use-ip.co.uk/forum/threads/ ... post-15498

I've 5 of the following chinese Y2A-ZA PTZ-(Cloud-)cameras

One was broken and replaced for free.
The only info on the camera is:

We now need to further investigate?
Already found:

Code: Select all

# cat /proc/version
Linux version 3.4.43-gk (rd@ubuntu) (gcc version 4.6.1 (crosstool-NG 1.18.0) ) #46 PREEMPT Wed Jun 26 13:47:34 CT 2019

# cat /proc/cpuinfo
Processor       : ARMv6-compatible processor rev 7 (v6l)
BogoMIPS        : 597.60
Features        : swp half fastmult vfp edsp java tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xb76
CPU revision    : 7

Hardware        : Goke IPC Board
Revision        : 0000
Serial          : 0000000000000000

# free
             total         used         free       shared      buffers
Mem:         31844        30800         1044            0         1536
-/+ buffers:              29264         2580
Swap:            0            0            0

# cat /proc/meminfo
MemTotal:          31844 kB
MemFree:            1028 kB
Buffers:            1536 kB
Cached:             7648 kB
SwapCached:            0 kB
Active:            12136 kB
Inactive:           5616 kB
Active(anon):       8640 kB
Inactive(anon):      108 kB
Active(file):       3496 kB
Inactive(file):     5508 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          8584 kB
Mapped:             3996 kB
Shmem:               180 kB
Slab:               9284 kB
SReclaimable:       1372 kB
SUnreclaim:         7912 kB
KernelStack:         696 kB
PageTables:          384 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       15920 kB
Committed_AS:     174200 kB
VmallocTotal:    2039808 kB
VmallocUsed:       63408 kB
VmallocChunk:    1005336 kB

# cat /ID
chip = gk7102s

# ls -la /
drwxr-xr-x   18 500      500            274 Jun 26  2019 .
drwxr-xr-x   18 500      500            274 Jun 26  2019 ..
-rw-rw-r--    1 500      500             15 Jun 26  2019 ID
drwxrwxr-x    2 500      500            774 Jan 17  2019 bin
drwxrwxrwt    4 root     root          2960 Jan  1  1970 dev
drwxr-xr-x    4 500      500            364 Jan 15  2019 etc
drwxr-xr-x    9 root     root             0 Sep 14 02:57 home
-rwxrwxrwx    1 500      500            281 Nov  7  2017 init
drwxrwxr-x    2 500      500              3 Jan  5  2019 ipc
drwxr-xr-x    4 500      500            661 Jun 20  2019 lib
lrwxrwxrwx    1 500      500             11 Nov  7  2017 linuxrc -> bin/busybox
drwxr-xr-x    2 500      500              3 May 31  2013 media
lrwxrwxrwx    1 500      500              8 Nov  7  2017 mnt -> /tmp/mnt
drwxr-xr-x    2 500      500              3 Jan 22  2017 nfsroot
drwxr-xr-x    2 500      500              3 Jan 22  2017 opt
drwxr-xr-x    2 default  default         79 Sep 24  2019 p2pcam
dr-xr-xr-x   50 root     root             0 Jan  1  1970 proc
drwxr-xr-x    2 500      500              3 Nov  7  2017 root
lrwxrwxrwx    1 500      500              3 Nov  7  2017 run -> tmp
drwxrwxr-x    2 500      500            282 Jun 26  2019 sbin
dr-xr-xr-x   11 root     root             0 Jan  1  1970 sys
drwxrwxrwt    5 root     root           400 Sep 14 02:57 tmp
drwxrwxr-x    7 500      500             75 Nov  7  2017 usr
lrwxrwxrwx    1 500      500              8 Nov  7  2017 var -> /tmp/var

nmap logs:

Code: Select all

Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-17 17:31 CEST
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 17:31
Completed NSE at 17:31, 0.00s elapsed
Initiating NSE at 17:31
Completed NSE at 17:31, 0.00s elapsed
Initiating NSE at 17:31
Completed NSE at 17:31, 0.00s elapsed
Initiating Ping Scan at 17:31
Scanning 192.168.117.155 [6 ports]
Completed Ping Scan at 17:31, 0.03s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 17:31
Completed Parallel DNS resolution of 1 host. at 17:31, 0.00s elapsed
Initiating Connect Scan at 17:31
Scanning Mkip01.fritz.box (192.168.117.155) [1000 ports]
Discovered open port 80/tcp on 192.168.117.155
Discovered open port 23/tcp on 192.168.117.155
Discovered open port 554/tcp on 192.168.117.155
Discovered open port 7103/tcp on 192.168.117.155
Discovered open port 5050/tcp on 192.168.117.155
Discovered open port 843/tcp on 192.168.117.155
Discovered open port 8001/tcp on 192.168.117.155
Completed Connect Scan at 17:31, 0.35s elapsed (1000 total ports)
Initiating Service scan at 17:31
Scanning 7 services on Mkip01.fritz.box (192.168.117.155)
Completed Service scan at 17:33, 91.68s elapsed (7 services on 1 host)
NSE: Script scanning 192.168.117.155.
Initiating NSE at 17:33
Completed NSE at 17:33, 10.82s elapsed
Initiating NSE at 17:33
Completed NSE at 17:33, 1.02s elapsed
Initiating NSE at 17:33
Completed NSE at 17:33, 0.00s elapsed
Nmap scan report for Mkip01.fritz.box (192.168.117.155)
Host is up (0.026s latency).
Not shown: 993 closed ports
PORT     STATE SERVICE    VERSION
23/tcp   open  telnet     BusyBox telnetd
80/tcp   open  http       Ginatex-HTTPServer
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.1 401 Unauthorized
|     Server: Ginatex-HTTPServer
|     Date: Sun Sep 17 17:31:46 2023
|     WWW-Authenticate: Basic realm="Onvif"
|     Pragma: no-cache
|     Cache-Control: no-cache
|     Content-Type: text/html
|     <?xml version="1.0" encoding="UTF-8" ?>
|     <ResponseStatus version="1.0" xmlns="http://www.ginatex.com/ver10/XMLSchema">
|     <requestURL>/nice%20ports%2C/Tri%6Eity.txt%2ebak</requestURL>
|     <statusCode>4</statusCode>
|     <statusString>Invalid Operation - Unauthorized</statusString>
|     </ResponseStatus>
|   GetRequest: 
|     HTTP/1.0 302 Redirect
|     Server: Ginatex-HTTPServer
|     Date: Sun Sep 17 17:31:41 2023
|     Pragma: no-cache
|     Cache-Control: no-cache
|     Content-Type: text/html
|     Location: http://IPCamera/index.asp
|     <html><head></head><body>
|     This document has moved to a new <a href="http://IPCamera/index.asp">location</a>.
|     Please update your documents to reflect the new location.
|     </body></html>
|   HTTPOptions, RTSPRequest: 
|     HTTP/1.1 400 Page not found
|     Server: Ginatex-HTTPServer
|     Date: Sun Sep 17 17:31:41 2023
|     Pragma: no-cache
|     Cache-Control: no-cache
|     Content-Type: text/html
|     <html><head><title>Document Error: Page not found</title></head>
|     <body><h2>Access Error: Page not found</h2>
|     <p>Bad request type</p></body></html>
|   Help: 
|     HTTP/1.1 400 Page not found
|     Server: Ginatex-HTTPServer
|     Date: Sun Sep 17 17:32:06 2023
|     Pragma: no-cache
|     Cache-Control: no-cache
|     Content-Type: text/html
|     <html><head><title>Document Error: Page not found</title></head>
|     <body><h2>Access Error: Page not found</h2>
|_    <p>Bad request type</p></body></html>
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-server-header: Ginatex-HTTPServer
554/tcp  open  rtsp
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.1 404 Not Found
|     Server: TAS-Tech IPCam
|     Date: Mon, 17 Sep 123 15:31:56 GMT
|     Content-Length: 9
|     Cache-Control: no-cache
|     Found
|   GetRequest: 
|     HTTP/1.1 404 Not Found
|     Server: TAS-Tech IPCam
|     Date: Mon, 17 Sep 123 15:31:41 GMT
|     Content-Length: 9
|     Cache-Control: no-cache
|     Found
|   HTTPOptions: 
|     HTTP/1.1 405 Method Not Allowed
|     Server: TAS-Tech IPCam
|     Date: Mon, 17 Sep 123 15:31:51 GMT
|     Content-Length: 18
|     Cache-Control: no-cache
|     Method Not Allowed
|   RTSPRequest: 
|     RTSP/1.0 200 OK
|     CSeq: 0
|     Server: TAS-Tech Streaming Server V100R001
|_    Public: DESCRIBE, SET_PARAMETER, SETUP, TEARDOWN, PAUSE, PLAY
|_rtsp-methods: ERROR: Script execution failed (use -d to debug)
843/tcp  open  unknown
| fingerprint-strings: 
|   DNSStatusRequestTCP, GenericLines, GetRequest, HTTPOptions, Help, JavaRMI, LANDesk-RC, LDAPBindReq, LPDString, NCP, RTSPRequest, TerminalServer, X11Probe, afp: 
|_    <cross-domain-policy> <allow-access-from domain="*" to-ports="*" /> </cross-domain-policy>
5050/tcp open  mmcc?
| fingerprint-strings: 
|   SMBProgNeg: 
|     "errcode" : 10006,
|_    "errstr" : "web client count reach to maximal"
7103/tcp open  tcpwrapped
8001/tcp open  rtsp
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.1 404 Not Found
|     Server: TAS-Tech IPCam
|     Date: Mon, 17 Sep 123 15:31:46 GMT
|     Content-Length: 9
|     Cache-Control: no-cache
|     Found
|   GetRequest: 
|     HTTP/1.1 404 Not Found
|     Server: TAS-Tech IPCam
|     Date: Mon, 17 Sep 123 15:31:41 GMT
|     Content-Length: 9
|     Cache-Control: no-cache
|     Found
|   HTTPOptions: 
|     HTTP/1.1 405 Method Not Allowed
|     Server: TAS-Tech IPCam
|     Date: Mon, 17 Sep 123 15:31:51 GMT
|     Content-Length: 18
|     Cache-Control: no-cache
|     Method Not Allowed
|   RTSPRequest: 
|     RTSP/1.0 200 OK
|     CSeq: 0
|     Server: TAS-Tech Streaming Server V100R001
|_    Public: DESCRIBE, SET_PARAMETER, SETUP, TEARDOWN, PAUSE, PLAY
|_rtsp-methods: ERROR: Script execution failed (use -d to debug)
5 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port80-TCP:V=7.80%I=7%D=9/17%Time=65071BDA%P=x86_64-pc-linux-gnu%r(GetR
SF:equest,180,"HTTP/1\.0\x20302\x20Redirect\r\nServer:\x20Ginatex-HTTPServ
SF:er\r\nDate:\x20Sun\x20Sep\x2017\x2017:31:41\x202023\r\nPragma:\x20no-ca
SF:che\r\nCache-Control:\x20no-cache\r\nContent-Type:\x20text/html\r\nLoca
SF:tion:\x20http://IPCamera/index\.asp\r\n\r\n<html><head></head><body>\r\
SF:n\t\tThis\x20document\x20has\x20moved\x20to\x20a\x20new\x20<a\x20href=\
SF:"http://IPCamera/index\.asp\">location</a>\.\r\n\t\tPlease\x20update\x2
SF:0your\x20documents\x20to\x20reflect\x20the\x20new\x20location\.\r\n\t\t
SF:</body></html>\r\n\r\n")%r(HTTPOptions,13B,"HTTP/1\.1\x20400\x20Page\x2
SF:0not\x20found\r\nServer:\x20Ginatex-HTTPServer\r\nDate:\x20Sun\x20Sep\x
SF:2017\x2017:31:41\x202023\r\nPragma:\x20no-cache\r\nCache-Control:\x20no
SF:-cache\r\nContent-Type:\x20text/html\r\n\r\n<html><head><title>Document
SF:\x20Error:\x20Page\x20not\x20found</title></head>\r\n\t\t<body><h2>Acce
SF:ss\x20Error:\x20Page\x20not\x20found</h2>\r\n\t\t<p>Bad\x20request\x20t
SF:ype</p></body></html>\r\n\r\n")%r(RTSPRequest,13B,"HTTP/1\.1\x20400\x20
SF:Page\x20not\x20found\r\nServer:\x20Ginatex-HTTPServer\r\nDate:\x20Sun\x
SF:20Sep\x2017\x2017:31:41\x202023\r\nPragma:\x20no-cache\r\nCache-Control
SF::\x20no-cache\r\nContent-Type:\x20text/html\r\n\r\n<html><head><title>D
SF:ocument\x20Error:\x20Page\x20not\x20found</title></head>\r\n\t\t<body><
SF:h2>Access\x20Error:\x20Page\x20not\x20found</h2>\r\n\t\t<p>Bad\x20reque
SF:st\x20type</p></body></html>\r\n\r\n")%r(FourOhFourRequest,1E5,"HTTP/1\
SF:.1\x20401\x20Unauthorized\r\nServer:\x20Ginatex-HTTPServer\r\nDate:\x20
SF:Sun\x20Sep\x2017\x2017:31:46\x202023\r\nWWW-Authenticate:\x20Basic\x20r
SF:ealm=\"Onvif\"\r\nPragma:\x20no-cache\r\nCache-Control:\x20no-cache\r\n
SF:Content-Type:\x20text/html\r\n\r\n<\?xml\x20version=\"1\.0\"\x20encodin
SF:g=\"UTF-8\"\x20\?>\n<ResponseStatus\x20version=\"1\.0\"\x20xmlns=\"http
SF:://www\.ginatex\.com/ver10/XMLSchema\">\n<requestURL>/nice%20ports%2C/T
SF:ri%6Eity\.txt%2ebak</requestURL>\n<statusCode>4</statusCode>\n<statusSt
SF:ring>Invalid\x20Operation\x20-\x20Unauthorized</statusString>\n</Respon
SF:seStatus>\n\r\n")%r(Help,13B,"HTTP/1\.1\x20400\x20Page\x20not\x20found\
SF:r\nServer:\x20Ginatex-HTTPServer\r\nDate:\x20Sun\x20Sep\x2017\x2017:32:
SF:06\x202023\r\nPragma:\x20no-cache\r\nCache-Control:\x20no-cache\r\nCont
SF:ent-Type:\x20text/html\r\n\r\n<html><head><title>Document\x20Error:\x20
SF:Page\x20not\x20found</title></head>\r\n\t\t<body><h2>Access\x20Error:\x
SF:20Page\x20not\x20found</h2>\r\n\t\t<p>Bad\x20request\x20type</p></body>
SF:</html>\r\n\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port554-TCP:V=7.80%I=7%D=9/17%Time=65071BDF%P=x86_64-pc-linux-gnu%r(Get
SF:Request,8B,"HTTP/1\.1\x20404\x20Not\x20Found\r\nServer:\x20TAS-Tech\x20
SF:IPCam\r\nDate:\x20Mon,\x2017\x20Sep\x20123\x2015:31:41\x20GMT\r\nConten
SF:t-Length:\x209\r\nCache-Control:\x20no-cache\r\n\r\nNot\x20Found")%r(RT
SF:SPRequest,87,"RTSP/1\.0\x20200\x20OK\r\nCSeq:\x200\r\nServer:\x20TAS-Te
SF:ch\x20Streaming\x20Server\x20V100R001\r\nPublic:\x20DESCRIBE,\x20SET_PA
SF:RAMETER,\x20SETUP,\x20TEARDOWN,\x20PAUSE,\x20PLAY\r\n\r\n")%r(HTTPOptio
SF:ns,9E,"HTTP/1\.1\x20405\x20Method\x20Not\x20Allowed\r\nServer:\x20TAS-T
SF:ech\x20IPCam\r\nDate:\x20Mon,\x2017\x20Sep\x20123\x2015:31:51\x20GMT\r\
SF:nContent-Length:\x2018\r\nCache-Control:\x20no-cache\r\n\r\nMethod\x20N
SF:ot\x20Allowed")%r(FourOhFourRequest,8B,"HTTP/1\.1\x20404\x20Not\x20Foun
SF:d\r\nServer:\x20TAS-Tech\x20IPCam\r\nDate:\x20Mon,\x2017\x20Sep\x20123\
SF:x2015:31:56\x20GMT\r\nContent-Length:\x209\r\nCache-Control:\x20no-cach
SF:e\r\n\r\nNot\x20Found");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port843-TCP:V=7.80%I=7%D=9/17%Time=65071BDA%P=x86_64-pc-linux-gnu%r(Gen
SF:ericLines,5B,"<cross-domain-policy>\x20<allow-access-from\x20domain=\"\
SF:*\"\x20to-ports=\"\*\"\x20/>\x20</cross-domain-policy>\0")%r(GetRequest
SF:,5B,"<cross-domain-policy>\x20<allow-access-from\x20domain=\"\*\"\x20to
SF:-ports=\"\*\"\x20/>\x20</cross-domain-policy>\0")%r(HTTPOptions,5B,"<cr
SF:oss-domain-policy>\x20<allow-access-from\x20domain=\"\*\"\x20to-ports=\
SF:"\*\"\x20/>\x20</cross-domain-policy>\0")%r(RTSPRequest,5B,"<cross-doma
SF:in-policy>\x20<allow-access-from\x20domain=\"\*\"\x20to-ports=\"\*\"\x2
SF:0/>\x20</cross-domain-policy>\0")%r(DNSStatusRequestTCP,5B,"<cross-doma
SF:in-policy>\x20<allow-access-from\x20domain=\"\*\"\x20to-ports=\"\*\"\x2
SF:0/>\x20</cross-domain-policy>\0")%r(Help,5B,"<cross-domain-policy>\x20<
SF:allow-access-from\x20domain=\"\*\"\x20to-ports=\"\*\"\x20/>\x20</cross-
SF:domain-policy>\0")%r(X11Probe,5B,"<cross-domain-policy>\x20<allow-acces
SF:s-from\x20domain=\"\*\"\x20to-ports=\"\*\"\x20/>\x20</cross-domain-poli
SF:cy>\0")%r(LPDString,5B,"<cross-domain-policy>\x20<allow-access-from\x20
SF:domain=\"\*\"\x20to-ports=\"\*\"\x20/>\x20</cross-domain-policy>\0")%r(
SF:LDAPBindReq,5B,"<cross-domain-policy>\x20<allow-access-from\x20domain=\
SF:"\*\"\x20to-ports=\"\*\"\x20/>\x20</cross-domain-policy>\0")%r(LANDesk-
SF:RC,5B,"<cross-domain-policy>\x20<allow-access-from\x20domain=\"\*\"\x20
SF:to-ports=\"\*\"\x20/>\x20</cross-domain-policy>\0")%r(TerminalServer,5B
SF:,"<cross-domain-policy>\x20<allow-access-from\x20domain=\"\*\"\x20to-po
SF:rts=\"\*\"\x20/>\x20</cross-domain-policy>\0")%r(NCP,5B,"<cross-domain-
SF:policy>\x20<allow-access-from\x20domain=\"\*\"\x20to-ports=\"\*\"\x20/>
SF:\x20</cross-domain-policy>\0")%r(JavaRMI,5B,"<cross-domain-policy>\x20<
SF:allow-access-from\x20domain=\"\*\"\x20to-ports=\"\*\"\x20/>\x20</cross-
SF:domain-policy>\0")%r(afp,5B,"<cross-domain-policy>\x20<allow-access-fro
SF:m\x20domain=\"\*\"\x20to-ports=\"\*\"\x20/>\x20</cross-domain-policy>\0
SF:");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port5050-TCP:V=7.80%I=7%D=9/17%Time=65071BE2%P=x86_64-pc-linux-gnu%r(SM
SF:BProgNeg,58,"\0\0\0T\x08\nZP\x08d\x12L{\n\x20\x20\x20\"errcode\"\x20:\x
SF:2010006,\n\x20\x20\x20\"errstr\"\x20:\x20\"web\x20client\x20count\x20re
SF:ach\x20to\x20maximal\"\n}\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port8001-TCP:V=7.80%I=7%D=9/17%Time=65071BDF%P=x86_64-pc-linux-gnu%r(Ge
SF:tRequest,8B,"HTTP/1\.1\x20404\x20Not\x20Found\r\nServer:\x20TAS-Tech\x2
SF:0IPCam\r\nDate:\x20Mon,\x2017\x20Sep\x20123\x2015:31:41\x20GMT\r\nConte
SF:nt-Length:\x209\r\nCache-Control:\x20no-cache\r\n\r\nNot\x20Found")%r(F
SF:ourOhFourRequest,8B,"HTTP/1\.1\x20404\x20Not\x20Found\r\nServer:\x20TAS
SF:-Tech\x20IPCam\r\nDate:\x20Mon,\x2017\x20Sep\x20123\x2015:31:46\x20GMT\
SF:r\nContent-Length:\x209\r\nCache-Control:\x20no-cache\r\n\r\nNot\x20Fou
SF:nd")%r(HTTPOptions,9E,"HTTP/1\.1\x20405\x20Method\x20Not\x20Allowed\r\n
SF:Server:\x20TAS-Tech\x20IPCam\r\nDate:\x20Mon,\x2017\x20Sep\x20123\x2015
SF::31:51\x20GMT\r\nContent-Length:\x2018\r\nCache-Control:\x20no-cache\r\
SF:n\r\nMethod\x20Not\x20Allowed")%r(RTSPRequest,87,"RTSP/1\.0\x20200\x20O
SF:K\r\nCSeq:\x200\r\nServer:\x20TAS-Tech\x20Streaming\x20Server\x20V100R0
SF:01\r\nPublic:\x20DESCRIBE,\x20SET_PARAMETER,\x20SETUP,\x20TEARDOWN,\x20
SF:PAUSE,\x20PLAY\r\n\r\n");
Service Info: Host: localhost
NSE: Script Post-scanning.
Initiating NSE at 17:33
Completed NSE at 17:33, 0.00s elapsed
Initiating NSE at 17:33
Completed NSE at 17:33, 0.00s elapsed
Initiating NSE at 17:33
Completed NSE at 17:33, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 104.44 seconds

Photos
Click on them to view original size.

PCB bottom, most connector, CPU and SD-card holder side:

PCB up, camera side:
Here is also written:

Code: Select all

20190918X
CHW GK7102 1034 V5
2008

CPU (GK7102S SoC, has 512MB DDR? memory onboard):

ROM: 64Mbit SPI NOR 3.3V QUAD IO Serial Flash XT25F64B-S:

WIFI chip. S9083H:

Serial connection? With even 2 (open) jumper connections:

Not yet tested this serial connection, but with an SD-card we got a log (ipc.log.0) on it back with no WLAN activity, so that seems to be broken.
All other parts look working fine, although I swapped the 2 2-pin connectors once, there was some smoke coming from PCB.
Afterwards it still looks working fine, as you press the reset button the only speaking text is "Reset successful", and the device does reboot
but no further steps are presented from the device. Ther e should be spoken: "Configure the device by app or hotspot".
Here the ipc.log.0 file with the missing WLAN:

Code: Select all

--------------------- dump of ps ----------------------------
PID   USER     TIME   COMMAND
    1 root       0:01 {linuxrc} init
    2 root       0:00 [kthreadd]
    3 root       0:00 [ksoftirqd/0]
    5 root       0:00 [kworker/u:0]
    6 root       0:00 [khelper]
    7 root       0:00 [netns]
    8 root       0:00 [sync_supers]
    9 root       0:00 [bdi-default]
   10 root       0:00 [kblockd]
   11 root       0:00 [khubd]
   12 root       0:00 [kworker/0:1]
   13 root       0:00 [cfg80211]
   14 root       0:00 [kworker/u:1]
   15 root       0:00 [rpciod]
   16 root       0:00 [kswapd0]
   17 root       0:00 [ksmd]
   18 root       0:00 [fsnotify_mark]
   19 root       0:00 [nfsiod]
   20 root       0:00 [crypto]
   33 root       0:00 [mtdblock0]
   34 root       0:00 [mtdblock1]
   35 root       0:00 [mtdblock2]
   36 root       0:00 [mtdblock3]
   39 root       0:00 [mmcqd/0]
   40 root       0:00 [deferwq]
   73 root       0:00 [jffs2_gcd_mtd3]
  100 root       0:00 [gk_debug]
  101 root       0:00 [encoder]
  154 root       0:00 /home/busybox/httpd -p 8080 -h /media/hack/www
  156 root       0:00 /media/hack/dropbearmulti dropbear -r /media/hack/dropbear_ecdsa_host_key -B
  157 root       0:00 /home/busybox/tcpsvd -E 0.0.0.0 21 /home/busybox/ftpd -w /
  161 root       0:00 tees -s -v -b 20 -e ps -e ifconfig; route -n -e wpa_cli status -e mount -e uptime -e df -e netstat -napt -e free -a /tmp/closelicamera.log -o /mnt/mmc01/0/ipc.log
  195 root       0:00 [flush-179:0]
  220 root       0:00 /home/rsyscall.goke
  222 root       0:00 [loop0]
  223 root       0:00 {start.sh} /bin/sh /home/start.sh
  226 root       0:55 /p2pcam/p2pcam
  228 root       0:00 /usr/sbin/telnetd
  247 root       0:00 [kworker/0:2]
 8100 root       0:00 /bin/login --
 8513 root       0:00 sh -c ps
 8514 root       0:00 ps

--------------------- dump of ifconfig; route -n ----------------------------
eth0      Link encap:Ethernet  HWaddr 02:11:22:A3:A0:00  
          UP BROADCAST MULTICAST  MTU:1450  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:1 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:550 errors:0 dropped:0 overruns:0 frame:0
          TX packets:550 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:28154 (27.4 KiB)  TX bytes:28154 (27.4 KiB)

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

--------------------- dump of wpa_cli status ----------------------------

--------------------- dump of mount ----------------------------
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
tmpfs on /dev type tmpfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock3 on /home type jffs2 (rw,relatime)
/dev/mmcblk0p1 on /media type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mmcblk0p1 on /bin/busybox type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mmcblk0p1 on /etc/profile type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mmcblk0p1 on /etc/group type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mmcblk0p1 on /etc/passwd type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mmcblk0p1 on /etc/shadow type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mmcblk0p1 on /etc/hosts type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/loop0 on /p2pcam type squashfs (ro,relatime)
/dev/mmcblk0p1 on /tmp/mnt/mmc01/0 type vfat (rw,noatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)

--------------------- dump of uptime ----------------------------
 01:17:02 up 17 min,  0 users,  load average: 0.89, 0.88, 0.59

--------------------- dump of df ----------------------------
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/root                 1152      1152         0 100% /
tmpfs                    15920         0     15920   0% /dev
tmpfs                    15920       332     15588   2% /tmp
tmpfs                    15920       332     15588   2% /tmp
/dev/mtdblock3            5056      4316       740  85% /home
/dev/mmcblk0p1        32744416      3504  32740912   0% /media
/dev/mmcblk0p1        32744416      3504  32740912   0% /bin/busybox
/dev/mmcblk0p1        32744416      3504  32740912   0% /etc/profile
/dev/mmcblk0p1        32744416      3504  32740912   0% /etc/group
/dev/mmcblk0p1        32744416      3504  32740912   0% /etc/passwd
/dev/mmcblk0p1        32744416      3504  32740912   0% /etc/shadow
/dev/mmcblk0p1        32744416      3504  32740912   0% /etc/hosts
/dev/loop0                2048      2048         0 100% /p2pcam
/dev/mmcblk0p1        32744416      3504  32740912   0% /tmp/mnt/mmc01/0

--------------------- dump of netstat -napt ----------------------------
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:7101            0.0.0.0:*               LISTEN      226/p2pcam
tcp        0      0 0.0.0.0:7103            0.0.0.0:*               LISTEN      226/p2pcam
tcp        0      0 0.0.0.0:8001            0.0.0.0:*               LISTEN      226/p2pcam
tcp        0      0 0.0.0.0:3201            0.0.0.0:*               LISTEN      161/tees
tcp        0      0 0.0.0.0:554             0.0.0.0:*               LISTEN      226/p2pcam
tcp        0      0 0.0.0.0:6670            0.0.0.0:*               LISTEN      226/p2pcam
tcp        0      0 127.0.0.1:9008          0.0.0.0:*               LISTEN      226/p2pcam
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      226/p2pcam
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN      157/tcpsvd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      156/dropbearmulti
tcp        0      0 :::8080                 :::*                    LISTEN      154/httpd
tcp        0      0 :::22                   :::*                    LISTEN      156/dropbearmulti
tcp        0      0 :::23                   :::*                    LISTEN      228/telnetd

--------------------- dump of free ----------------------------
             total         used         free       shared      buffers
Mem:         31844        31004          840            0         7260
-/+ buffers:              23744         8100
Swap:            0            0            0

---------------------------- Dump of log -----------------------------
n ok 424S
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip:
eye+ : wait for lan ok 428S
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
eye+ : wait for lan ok 432S
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
eye+ : wait for lan ok 436S
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip: 
not valid ip:

The (following) tests below are done on a fully working device.

DG.

Post by **admin** » 18 Sep 2023, 11:32

We found more, before we copy the whole image to an SD-card?

Code: Select all

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00050000 00010000 "U"
mtd1: 001a0000 00010000 "K"
mtd2: 00120000 00010000 "R"
mtd3: 004f0000 00010000 "A"

# mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
tmpfs on /dev type tmpfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000)
/dev/mtdblock3 on /home type jffs2 (rw,relatime)
/dev/loop0 on /p2pcam type squashfs (ro,relatime)

Some links:
https://github.com/bolshevik/goke-GK7102-customizer
https://github.com/e1z0/Goke_GK7102
https://gist.github.com/brianpow/d8eeae ... ae04799f49
https://awesomeopensource.com/project/d ... k7102-hack
https://awesomeopensource.com/project/a ... zsgx1hacks
https://github.com/cspwcspw/CloudCameraGK7102
https://github.com/zzerrg/gmfwtools
https://4pda.to/forum/index.php?showtop ... 41&st=2980
https://dalpix.com/reverse-engineering-ip-camera-part-1
https://openipc.org/
https://herrfeder.github.io/embeddedsec ... Part1.html
https://honeylab.hatenablog.jp/entry/2019/05/10/102209
https://pierrekim.github.io/blog/2017-0 ... -0day.html
https://github.com/OpenIPC/ipctool
https://paper.seebug.org/993/
https://github.com/dc35956/gk7102-hack

DG.

Post by **admin** » 20 Sep 2023, 11:04

Made a backup of default device (4 mtd partitions).

Running from SD-card as written on: https://github.com/ant-thomas/zsgx1hacks
We still have telnet working and with the following commands we can PTZ the camera.
Only up, down, left and right do work normally.
Diagonal and IR functions do not work on my camera. Needs other g(p)io pins?

When we're in the right path (/media/hack):

Code: Select all

# ./ptz 0x6e 0x07 && sleep 0.5 && ./ptz 0x64 0x07
ioctl(fh, 0x6e, 0x7) = 0
done
ioctl(fh, 0x64, 0x7) = 0
done

Nmap (quick scan) now shows:

Code: Select all

Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-20 11:17 CEST
Nmap scan report for 192.168.117.166
Host is up (0.022s latency).
Not shown: 990 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
23/tcp   open  telnet
80/tcp   open  http
554/tcp  open  rtsp
843/tcp  open  unknown
5050/tcp open  mmcc
7103/tcp open  unknown
8001/tcp open  vcom-tunnel
8080/tcp open  http-proxy
Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds

As this 'hack', it's just adjusting default settings and adding some other options, is real ok!
I found an old 32MB (yes, MB!) MicroSD card, formatted it (FAT) and put the code on it.
It does its job perfect:

Code: Select all

# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 1.1M      1.1M         0 100% /
tmpfs                    15.5M         0     15.5M   0% /dev
tmpfs                    15.5M    444.0K     15.1M   3% /tmp
tmpfs                    15.5M    444.0K     15.1M   3% /tmp
/dev/mtdblock3            4.9M      4.2M    736.0K  85% /home
/dev/mmcblk0p1           29.1M      3.1M     26.0M  10% /media
/dev/mmcblk0p1           29.1M      3.1M     26.0M  10% /bin/busybox
/dev/mmcblk0p1           29.1M      3.1M     26.0M  10% /etc/profile
/dev/mmcblk0p1           29.1M      3.1M     26.0M  10% /etc/group
/dev/mmcblk0p1           29.1M      3.1M     26.0M  10% /etc/passwd
/dev/mmcblk0p1           29.1M      3.1M     26.0M  10% /etc/shadow
/dev/mmcblk0p1           29.1M      3.1M     26.0M  10% /etc/hosts
/dev/loop0                2.0M      2.0M         0 100% /p2pcam
/dev/mmcblk0p1           29.1M      3.1M     26.0M  10% /tmp/mnt/mmc01/0

On: https://github.com/e1z0/Goke_GK7102
we find the following http commands that DO work for the IR LED's.
Those do even work on some cameras without the 'hack'.

Code: Select all

http://camera_ip:8001/ircut?mode=night
http://camera_ip:8001/ircut?mode=day

We found also:

Code: Select all

http://camera_ip:8001/ircut?mode=auto

Next would be to check the audio of the camera(s).
To play a sound we test from any browser:

Code: Select all

http://camera_ip:8001/playaudio?file=/tmp/VOICE/alarm.wav

Also that works fine.

With this 'hack' we also have command printenv to view uboot startup environment parameters:
Although they look already adjusted? Would be weird for a read-only hack

Code: Select all

# printenv
HISTFILESIZE=1000
INPUTRC=/etc/inputrc
USER=root
HOSTNAME=localhost
OLDPWD=/root
HOME=/root/
PAGER=/bin/more 
PS1=# 
LOGNAME=root
TERM=vt102
PATH=/home/busybox:/media/hack/hackenv:/bin:/sbin:/usr/bin:/usr/sbin:/usr/bin/X11:/usr/local/bin
DMALLOC_OPTIONS=debug=0x34f47d83,inter=100,log=logfile
HISTSIZE=1000
SHELL=/bin/sh
PWD=/
EDITOR=/bin/vi

More info:

Code: Select all

# pstree
linuxrc-+-dropbearmulti
        |-httpd
        |-login
        |-rsyscall.goke
        |-start.sh---p2pcam-+-{AudioTalk}
        |                   |-{CLP2P_MAIN_THR}
        |                   |-{CLP2P_WORK_THR}
        |                   |-{ConfigSaver}
        |                   |-{CtpThread}
        |                   |-{EventFilter}
        |                   |-{FullrelayMsg}
        |                   |-{LeCamCore}
        |                   |-2*[{MediaStream}]
        |                   |-{P2PPlay}
        |                   |-2*[{SCH_DEVICE_STA}]
        |                   |-{STREAMMGR0}
        |                   |-2*[{TimerQueue}]
        |                   |-{Upgrader}
        |                   |-{WebListen}
        |                   |-{cmdServer}
        |                   |-{gatherwifi}
        |                   |-{hardWdDaemon}
        |                   |-{httpredirect}
        |                   |-{icrCtrlThd}
        |                   |-{iot}
        |                   |-{isp0}
        |                   |-{isp1}
        |                   |-{isp2}
        |                   |-{isp3}
        |                   |-{motDetThd}
        |                   |-2*[{netmgr}]
        |                   |-7*[{p2pcam}]
        |                   |-{pdaThd}
        |                   |-{preview_proc}
        |                   |-{sdRecordTask}
        |                   |-{softWdDaemon}
        |                   |-{speakerCtrl}
        |                   |-{statusCtrl}
        |                   |-{tuning_process}
        |                   `-{}
        |-tcpsvd
        |-tees
        |-telnetd---sh---pstree
        `-wpa_supplicant

So far we found most available functions for any PTZ camera.
Move, Zoom, Focus, Iris, White Bal, Presets, Reboot, Reload Config, Audio out, Audio in, IR mode, Lights (LED),

With the default app: YCC365 Plus my Cameras only have function:
Move, time zone, device switch, rotate 180, IR mode, Anti-flicker, Audio in, Audio out.
Some settings are purely software, like device switch [on/off] the camera or recordings (to the Cloud).

What we do need is: Move, IR mode, audio and eventually if possible some presets?
Strange is that we still don't have the 'hacked' video working on VLC, although on Zoneminder it is working fine.
(Update: VLC does not support rtsp anymore ... ) Use MPlayer or any other.

What we have found so far:
System runs on GK7102S SoC.
WiFi has S9083H (or 'C') chip (1 out of 5 is not working).
Telnet access is with root:cxlinux
The 'hack' does work, only the camera-time is not adjusted anymore (adjust ntpd settings to 192.168.117.1 in /media/debug_cmd.sh)
Left - right movement has 24 steps with current settings (0.5 seconds run).

With CLI command gio -g 12 we 'read out' gpio pins.
gpio[1_4] is changing on: http://192.168.117.166:8001/ircut?mode=night, day or auto.
value is 1 if IR-LEDS are on.
Setting this gpio pin does NOT switch them ON.

Number 12 [1_4] is the light-detector to switch IR-LEDs ON.

Code: Select all

# gio -g 12
gpio[1_4] value is 1  # if camera is covered so IR -LEDs go ON
# gio -g 12
gpio[1_4] value is 0  # if camera in daylight

Gpio numbers 39 [4_7] and 44 [5_4] do set the IR-LEDs:

Code: Select all

# gio -s 39 0 && gio -s 44 0    # Set IR-LEDs to AUTO (starting off)
set gpio[4_7] to 0
set gpio[5_4] to 0
# gio -s 39 1 && gio -s 44 0    # Set IR-LEDs to ON
set gpio[4_7] to 1
set gpio[5_4] to 0
# gio -s 39 0 && gio -s 44 1    # Set IR-LEDs to OFF
set gpio[4_7] to 0
set gpio[5_4] to 1
# gio -s 39 1 && gio -s 44 1    # Set IR-LEDs to AUTO (starting on)
set gpio[4_7] to 1
set gpio[5_4] to 1

To disable display OSD-time, change 1 to 0 for string: show_osd_time = 0
in file: hwcfg.ini in folder /home/ and reboot the device.

With Zoneminder probe profiles we now get:

Code: Select all

$ zmonvif-probe.pl -v profiles http://192.168.117.166/onvif/device_service
Have results from GetServices
Got device service http://192.168.117.166/onvif/Device
Got media service http://192.168.117.166/onvif/Media
Got events service http://192.168.117.166/onvif/Events
Got imaging service http://192.168.117.166/onvif/Imaging
Got deviceio service http://192.168.117.166/onvif/DeviceIO
Got analytics service http://192.168.117.166/onvif/Analytics
Have results from GetCapabilities: 
<GetCapabilitiesResponse xmlns="http://www.onvif.org/ver10/device/wsdl">
	<Capabilities>
		<Device xmlns="http://www.onvif.org/ver10/schema">
			<XAddr>http://192.168.117.166/onvif/Device</XAddr>
			<Network></Network>
			<System></System>
			<IO>
				<InputConnectors>0</InputConnectors>
				<RelayOutputs>0</RelayOutputs>
			</IO>
			<Security></Security>
		</Device>
		<Events xmlns="http://www.onvif.org/ver10/schema">
			<XAddr>http://192.168.117.166/onvif/Events</XAddr>
			<WSSubscriptionPolicySupport>true</WSSubscriptionPolicySupport>
			<WSPullPointSupport>true</WSPullPointSupport>
			<WSPausableSubscriptionManagerInterfaceSupport>false</WSPausableSubscriptionManagerInterfaceSupport>
		</Events>
		<Imaging xmlns="http://www.onvif.org/ver10/schema">
			<XAddr>http://192.168.117.166/onvif/Imaging</XAddr>
		</Imaging>
		<Media xmlns="http://www.onvif.org/ver10/schema">
			<XAddr>http://192.168.117.166/onvif/Media</XAddr>
			<StreamingCapabilities>
				<RTPMulticast>true</RTPMulticast>
				<RTP_TCP>true</RTP_TCP>
				<RTP_RTSP_TCP>true</RTP_RTSP_TCP>
			</StreamingCapabilities>
			<Extension>
				<ProfileCapabilities>
					<MaximumNumberOfProfiles>3</MaximumNumberOfProfiles>
				</ProfileCapabilities>
			</Extension>
		</Media>
		<PTZ xmlns="http://www.onvif.org/ver10/schema">
			<XAddr>http://192.168.117.166/onvif/PTZ</XAddr>
		</PTZ>
		<Extension xmlns="http://www.onvif.org/ver10/schema">
			<DeviceIO>
				<XAddr>http://192.168.117.166/onvif/DeviceIO</XAddr>
				<VideoSources>1</VideoSources>
				<VideoOutputs>0</VideoOutputs>
				<AudioSources>1</AudioSources>
				<AudioOutputs>1</AudioOutputs>
				<RelayOutputs>1</RelayOutputs>
			</DeviceIO>
		</Extension>
	</Capabilities>
</GetCapabilitiesResponse>
Received message:
<?xml version="1.0"?>
<GetProfilesResponse xmlns="http://www.onvif.org/ver10/media/wsdl">
  <Profiles token="Profile_1" fixed="true">
    <Name xmlns="http://www.onvif.org/ver10/schema">mainStream</Name>
    <VideoSourceConfiguration xmlns="http://www.onvif.org/ver10/schema">
      <Name>VideoSourceConfig</Name>
      <UseCount>2</UseCount>
      <SourceToken>VideoSource_1</SourceToken>
      <Bounds x="0" y="0" width="1280" height="720"/>
    </VideoSourceConfiguration>
    <AudioSourceConfiguration xmlns="http://www.onvif.org/ver10/schema">
      <Name>AudioSourceConfig</Name>
      <UseCount>2</UseCount>
      <SourceToken>AudioSourceChannel1</SourceToken>
    </AudioSourceConfiguration>
    <VideoEncoderConfiguration xmlns="http://www.onvif.org/ver10/schema">
      <Name>VideoEncoder_1</Name>
      <UseCount>1</UseCount>
      <Encoding>H264</Encoding>
      <Resolution>
        <Width>1280</Width>
        <Height>720</Height>
      </Resolution>
      <Quality>10.000000</Quality>
      <RateControl>
        <FrameRateLimit>0</FrameRateLimit>
        <EncodingInterval>1</EncodingInterval>
        <BitrateLimit>0</BitrateLimit>
      </RateControl>
      <H264>
        <GovLength>100</GovLength>
        <H264Profile>Baseline</H264Profile>
      </H264>
      <Multicast>
        <Address>
          <Type>IPv4</Type>
          <IPv4Address>224.1.2.3</IPv4Address>
        </Address>
        <Port>10000</Port>
        <TTL>1</TTL>
        <AutoStart>false</AutoStart>
      </Multicast>
      <SessionTimeout>PT5S</SessionTimeout>
    </VideoEncoderConfiguration>
    <PTZConfiguration xmlns="http://www.onvif.org/ver10/schema">
      <Name>PTZ</Name>
      <UseCount>2</UseCount>
      <NodeToken>PTZNODETOKEN</NodeToken>
      <DefaultAbsolutePantTiltPositionSpace>http://www.onvif.org/ver10/tptz/PanTiltSpaces/PositionGenericSpace</DefaultAbsolutePantTiltPositionSpace>
      <DefaultAbsoluteZoomPositionSpace>http://www.onvif.org/ver10/tptz/ZoomSpaces/PositionGenericSpace</DefaultAbsoluteZoomPositionSpace>
      <DefaultRelativePanTiltTranslationSpace>http://www.onvif.org/ver10/tptz/PanTiltSpaces/TranslationGenericSpace</DefaultRelativePanTiltTranslationSpace>
      <DefaultRelativeZoomTranslationSpace>http://www.onvif.org/ver10/tptz/ZoomSpaces/TranslationGenericSpace</DefaultRelativeZoomTranslationSpace>
      <DefaultContinuousPanTiltVelocitySpace>http://www.onvif.org/ver10/tptz/PanTiltSpaces/VelocityGenericSpace</DefaultContinuousPanTiltVelocitySpace>
      <DefaultContinuousZoomVelocitySpace>http://www.onvif.org/ver10/tptz/ZoomSpaces/VelocityGenericSpace</DefaultContinuousZoomVelocitySpace>
      <DefaultPTZSpeed>
        <PanTilt x="0.100000" y="0.100000" space="http://www.onvif.org/ver10/tptz/PanTiltSpaces/GenericSpeedSpace"/>
        <Zoom x="1.000000" space="http://www.onvif.org/ver10/tptz/ZoomSpaces/ZoomGenericSpeedSpace"/>
      </DefaultPTZSpeed>
      <DefaultPTZTimeout>PT1S</DefaultPTZTimeout>
      <PanTiltLimits>
        <Range>
          <URI>http://www.onvif.org/ver10/tptz/PanTiltSpaces/PositionGenericSpace</URI>
          <XRange>
            <Min>-INF</Min>
            <Max>INF</Max>
          </XRange>
          <YRange>
            <Min>-INF</Min>
            <Max>INF</Max>
          </YRange>
        </Range>
      </PanTiltLimits>
      <ZoomLimits>
        <Range>
          <URI>http://www.onvif.org/ver10/tptz/ZoomSpaces/PositionGenericSpace</URI>
          <XRange>
            <Min>-INF</Min>
            <Max>INF</Max>
          </XRange>
        </Range>
      </ZoomLimits>
    </PTZConfiguration>
    <MetadataConfiguration xmlns="http://www.onvif.org/ver10/schema">
      <Name>metaData</Name>
      <UseCount>2</UseCount>
      <PTZStatus>
        <Status>true</Status>
        <Position>true</Position>
      </PTZStatus>
      <Analytics>false</Analytics>
      <Multicast>
        <Address>
          <Type>IPv4</Type>
          <IPv4Address>224.1.2.3</IPv4Address>
        </Address>
        <Port>10000</Port>
        <TTL>1</TTL>
        <AutoStart>false</AutoStart>
      </Multicast>
      <SessionTimeout>PT0S</SessionTimeout>
    </MetadataConfiguration>
  </Profiles>
  <Profiles token="Profile_2" fixed="true">
    <Name xmlns="http://www.onvif.org/ver10/schema">subStream</Name>
    <VideoSourceConfiguration xmlns="http://www.onvif.org/ver10/schema">
      <Name>VideoSourceConfig</Name>
      <UseCount>2</UseCount>
      <SourceToken>VideoSource_1</SourceToken>
      <Bounds x="0" y="0" width="1280" height="720"/>
    </VideoSourceConfiguration>
    <AudioSourceConfiguration xmlns="http://www.onvif.org/ver10/schema">
      <Name>AudioSourceConfig</Name>
      <UseCount>2</UseCount>
      <SourceToken>AudioSourceChannel1</SourceToken>
    </AudioSourceConfiguration>
    <VideoEncoderConfiguration xmlns="http://www.onvif.org/ver10/schema">
      <Name>VideoEncoder_2</Name>
      <UseCount>1</UseCount>
      <Encoding>H264</Encoding>
      <Resolution>
        <Width>640</Width>
        <Height>352</Height>
      </Resolution>
      <Quality>10.000000</Quality>
      <RateControl>
        <FrameRateLimit>0</FrameRateLimit>
        <EncodingInterval>1</EncodingInterval>
        <BitrateLimit>0</BitrateLimit>
      </RateControl>
      <H264>
        <GovLength>100</GovLength>
        <H264Profile>Baseline</H264Profile>
      </H264>
      <Multicast>
        <Address>
          <Type>IPv4</Type>
          <IPv4Address>224.1.2.3</IPv4Address>
        </Address>
        <Port>10000</Port>
        <TTL>1</TTL>
        <AutoStart>false</AutoStart>
      </Multicast>
      <SessionTimeout>PT5S</SessionTimeout>
    </VideoEncoderConfiguration>
    <PTZConfiguration xmlns="http://www.onvif.org/ver10/schema">
      <Name>PTZ</Name>
      <UseCount>2</UseCount>
      <NodeToken>PTZNODETOKEN</NodeToken>
      <DefaultAbsolutePantTiltPositionSpace>http://www.onvif.org/ver10/tptz/PanTiltSpaces/PositionGenericSpace</DefaultAbsolutePantTiltPositionSpace>
      <DefaultAbsoluteZoomPositionSpace>http://www.onvif.org/ver10/tptz/ZoomSpaces/PositionGenericSpace</DefaultAbsoluteZoomPositionSpace>
      <DefaultRelativePanTiltTranslationSpace>http://www.onvif.org/ver10/tptz/PanTiltSpaces/TranslationGenericSpace</DefaultRelativePanTiltTranslationSpace>
      <DefaultRelativeZoomTranslationSpace>http://www.onvif.org/ver10/tptz/ZoomSpaces/TranslationGenericSpace</DefaultRelativeZoomTranslationSpace>
      <DefaultContinuousPanTiltVelocitySpace>http://www.onvif.org/ver10/tptz/PanTiltSpaces/VelocityGenericSpace</DefaultContinuousPanTiltVelocitySpace>
      <DefaultContinuousZoomVelocitySpace>http://www.onvif.org/ver10/tptz/ZoomSpaces/VelocityGenericSpace</DefaultContinuousZoomVelocitySpace>
      <DefaultPTZSpeed>
        <PanTilt x="0.100000" y="0.100000" space="http://www.onvif.org/ver10/tptz/PanTiltSpaces/GenericSpeedSpace"/>
        <Zoom x="1.000000" space="http://www.onvif.org/ver10/tptz/ZoomSpaces/ZoomGenericSpeedSpace"/>
      </DefaultPTZSpeed>
      <DefaultPTZTimeout>PT1S</DefaultPTZTimeout>
      <PanTiltLimits>
        <Range>
          <URI>http://www.onvif.org/ver10/tptz/PanTiltSpaces/PositionGenericSpace</URI>
          <XRange>
            <Min>-INF</Min>
            <Max>INF</Max>
          </XRange>
          <YRange>
            <Min>-INF</Min>
            <Max>INF</Max>
          </YRange>
        </Range>
      </PanTiltLimits>
      <ZoomLimits>
        <Range>
          <URI>http://www.onvif.org/ver10/tptz/ZoomSpaces/PositionGenericSpace</URI>
          <XRange>
            <Min>-INF</Min>
            <Max>INF</Max>
          </XRange>
        </Range>
      </ZoomLimits>
    </PTZConfiguration>
    <MetadataConfiguration xmlns="http://www.onvif.org/ver10/schema">
      <Name>metaData</Name>
      <UseCount>2</UseCount>
      <PTZStatus>
        <Status>true</Status>
        <Position>true</Position>
      </PTZStatus>
      <Analytics>false</Analytics>
      <Multicast>
        <Address>
          <Type>IPv4</Type>
          <IPv4Address>224.1.2.3</IPv4Address>
        </Address>
        <Port>10000</Port>
        <TTL>1</TTL>
        <AutoStart>false</AutoStart>
      </Multicast>
      <SessionTimeout>PT0S</SessionTimeout>
    </MetadataConfiguration>
  </Profiles>
</GetProfilesResponse>

Number of profiles found: 2
No StreamUri or no MediaUri on profile mainStream of type RTP_unicast
Received message:
<?xml version="1.0"?>
<GetStreamUriResponse xmlns="http://www.onvif.org/ver10/media/wsdl">
  <MediaUri>
    <Uri xmlns="http://www.onvif.org/ver10/schema">rtsp://192.168.117.166:554</Uri>
    <InvalidAfterConnect xmlns="http://www.onvif.org/ver10/schema">false</InvalidAfterConnect>
    <InvalidAfterReboot xmlns="http://www.onvif.org/ver10/schema">false</InvalidAfterReboot>
    <Timeout xmlns="http://www.onvif.org/ver10/schema">PT0S</Timeout>
  </MediaUri>
</GetStreamUriResponse>

No StreamUri or no MediaUri on profile mainStream of type RTP-multicast
Received message:
<?xml version="1.0"?>
<GetStreamUriResponse xmlns="http://www.onvif.org/ver10/media/wsdl">
  <MediaUri>
    <Uri xmlns="http://www.onvif.org/ver10/schema">rtsp://192.168.117.166:554</Uri>
    <InvalidAfterConnect xmlns="http://www.onvif.org/ver10/schema">false</InvalidAfterConnect>
    <InvalidAfterReboot xmlns="http://www.onvif.org/ver10/schema">false</InvalidAfterReboot>
    <Timeout xmlns="http://www.onvif.org/ver10/schema">PT0S</Timeout>
  </MediaUri>
</GetStreamUriResponse>

No StreamUri or no MediaUri on profile subStream of type RTP_unicast
Received message:
<?xml version="1.0"?>
<GetStreamUriResponse xmlns="http://www.onvif.org/ver10/media/wsdl">
  <MediaUri>
    <Uri xmlns="http://www.onvif.org/ver10/schema">rtsp://192.168.117.166:554/0/av1</Uri>
    <InvalidAfterConnect xmlns="http://www.onvif.org/ver10/schema">false</InvalidAfterConnect>
    <InvalidAfterReboot xmlns="http://www.onvif.org/ver10/schema">false</InvalidAfterReboot>
    <Timeout xmlns="http://www.onvif.org/ver10/schema">PT0S</Timeout>
  </MediaUri>
</GetStreamUriResponse>

No StreamUri or no MediaUri on profile subStream of type RTP-multicast
Received message:
<?xml version="1.0"?>
<GetStreamUriResponse xmlns="http://www.onvif.org/ver10/media/wsdl">
  <MediaUri>
    <Uri xmlns="http://www.onvif.org/ver10/schema">rtsp://192.168.117.166:554/0/av1</Uri>
    <InvalidAfterConnect xmlns="http://www.onvif.org/ver10/schema">false</InvalidAfterConnect>
    <InvalidAfterReboot xmlns="http://www.onvif.org/ver10/schema">false</InvalidAfterReboot>
    <Timeout xmlns="http://www.onvif.org/ver10/schema">PT0S</Timeout>
  </MediaUri>
</GetStreamUriResponse>

Profile_1, mainStream, H264, 1280, 720, 0, RTP-Unicast, rtsp://192.168.117.166:554
Profile_1, mainStream, H264, 1280, 720, 0, RTP-Multicast, rtsp://192.168.117.166:554
Profile_2, subStream, H264, 640, 352, 0, RTP-Unicast, rtsp://192.168.117.166:554/0/av1
Profile_2, subStream, H264, 640, 352, 0, RTP-Multicast, rtsp://192.168.117.166:554/0/av1

Zoneminder probe metadata returns:

Code: Select all

$ zmonvif-probe.pl -v metadata http://192.168.117.166/onvif/device_service
Have results from GetServices
Got device service http://192.168.117.166/onvif/Device
Got media service http://192.168.117.166/onvif/Media
Got events service http://192.168.117.166/onvif/Events
Got imaging service http://192.168.117.166/onvif/Imaging
Got deviceio service http://192.168.117.166/onvif/DeviceIO
Got analytics service http://192.168.117.166/onvif/Analytics
Have results from GetCapabilities: 

<GetCapabilitiesResponse xmlns="http://www.onvif.org/ver10/device/wsdl">
  <Capabilities>
    <Device xmlns="http://www.onvif.org/ver10/schema">
      <XAddr>http://192.168.117.166/onvif/Device</XAddr>
      <Network></Network>
      <System></System>
      <IO><InputConnectors>0</InputConnectors><RelayOutputs>0</RelayOutputs></IO>
      <Security></Security>
    </Device>
    <Events xmlns="http://www.onvif.org/ver10/schema">
      <XAddr>http://192.168.117.166/onvif/Events</XAddr>
      <WSSubscriptionPolicySupport>true</WSSubscriptionPolicySupport>
      <WSPullPointSupport>true</WSPullPointSupport>
      <WSPausableSubscriptionManagerInterfaceSupport>false</WSPausableSubscriptionManagerInterfaceSupport>
    </Events>
    <Imaging xmlns="http://www.onvif.org/ver10/schema">
      <XAddr>http://192.168.117.166/onvif/Imaging</XAddr>
    </Imaging>
    <Media xmlns="http://www.onvif.org/ver10/schema">
      <XAddr>http://192.168.117.166/onvif/Media</XAddr>
      <StreamingCapabilities>
        <RTPMulticast>true</RTPMulticast>
        <RTP_TCP>true</RTP_TCP>
        <RTP_RTSP_TCP>true</RTP_RTSP_TCP>
      </StreamingCapabilities>
      <Extension>
        <ProfileCapabilities><MaximumNumberOfProfiles>3</MaximumNumberOfProfiles></ProfileCapabilities>
      </Extension>
    </Media>
    <PTZ xmlns="http://www.onvif.org/ver10/schema">
      <XAddr>http://192.168.117.166/onvif/PTZ</XAddr>
    </PTZ>
    <Extension xmlns="http://www.onvif.org/ver10/schema">
      <DeviceIO>
        <XAddr>http://192.168.117.166/onvif/DeviceIO</XAddr>
        <VideoSources>1</VideoSources>
        <VideoOutputs>0</VideoOutputs>
        <AudioSources>1</AudioSources>
        <AudioOutputs>1</AudioOutputs>
        <RelayOutputs>1</RelayOutputs>
      </DeviceIO>
    </Extension>
  </Capabilities>
</GetCapabilitiesResponse>

<GetMetadataConfigurationsResponse xmlns="http://www.onvif.org/ver10/media/wsdl">
  <Configurations>
    <Name xmlns="http://www.onvif.org/ver10/schema">metaData</Name>
    <UseCount xmlns="http://www.onvif.org/ver10/schema">2</UseCount>
    <PTZStatus xmlns="http://www.onvif.org/ver10/schema">
      <Status>true</Status>
      <Position>true</Position>
    </PTZStatus>
    <Analytics xmlns="http://www.onvif.org/ver10/schema">false</Analytics>
    <Multicast xmlns="http://www.onvif.org/ver10/schema">
      <Address>
        <Type>IPv4</Type>
        <IPv4Address>224.1.2.3</IPv4Address>
      </Address>
      <Port>10000</Port>
      <TTL>1</TTL>
      <AutoStart>false</AutoStart>
    </Multicast>
    <SessionTimeout xmlns="http://www.onvif.org/ver10/schema">PT0S</SessionTimeout>
  </Configurations>
</GetMetadataConfigurationsResponse>

No VideoAnalyticsConfigurations

DG.

Post by **admin** » 24 Sep 2023, 01:35

Adjusted so far for my Y2A-ZA cameras:

In file: debug_cmd.sh
Adjust the correct time settings (for my network):

Code: Select all

# sync the time
#(sleep 20 && /home/busybox/ntpd -q -p 0.uk.pool.ntp.org ) &
# DG adjusted to own time server
(sleep 20 && /home/busybox/ntpd -q -p 192.168.117.1 ) &

In file: /hack/www/cgi-bin/webui
Added the following just after: <a href="https://github.com/ant-thomas/zsgx1hacks" target="_blank">ZS-GX1 Hacks - Github</a>

Code: Select all

<br />
Adjusted for chinese Y2A-ZA cameras by DG.

Added an IR-Auto button:
(Although not fully working correctly)

Code: Select all

<br />
<button onclick="window.location.href='webui?command=irauto'" id="irledsauto">IR LEDs Auto</button>

And changed the following, according /home/hardinfo.bin and /home/hwcfg.ini:

Code: Select all

# Rewrote the following lines for chinese Y2A-ZA Camera:
# if [ "$command" = "iron" ]; then
#  gio -s 46 1 > /dev/null
# fi
# if [ "$command" = "iroff" ]; then
#  gio -s 46 0 > /dev/null
# fi
 if [ "$command" = "iron" ]; then
  gio -s 39 1 >/dev/null && gio -s 44 0 > /dev/null
 fi
 if [ "$command" = "iroff" ]; then
  gio -s 39 0 >/dev/null && gio -s 44 1 > /dev/null
 fi
  if [ "$command" = "irauto" ]; then
  gio -s 39 0 >/dev/null && gio -s 44 0 > /dev/null
 fi

And switched off the diagonal buttons:

Code: Select all

# These last lines do not work with Y2A-ZA cameras
# if [ "$command" = "ptzlu" ]; then                                                           
#  $ptzfolder/ptz-ctrl lu > /dev/null                                                         
# fi 
# if [ "$command" = "ptzld" ]; then                                                           
#  $ptzfolder/ptz-ctrl ld > /dev/null                                                         
# fi 
# if [ "$command" = "ptzru" ]; then                                                           
#  $ptzfolder/ptz-ctrl ru > /dev/null                                                         
# fi 
# if [ "$command" = "ptzrd" ]; then                                                           
#  $ptzfolder/ptz-ctrl rd > /dev/null                                                         
# fi

okt 2023
Adjusted ip-address and some layout:

Code: Select all

ipadd=`ifconfig wlan0|grep "inet addr" | sed -r 's/:/ /g' | awk '{print $3}'`
uptime=`uptime`
uptime=${uptime:12}
..
<a href="/phpbb/viewtopic.php?p=447#p447" target="_blank"> Adjusted for chinese Y2A-ZA cameras by DG.</a>

All used files (with the 'hack' installed):

/home/hardinfo.bin:

Code: Select all

<?xml version="1.0" encoding="UTF-8"?>
<DeviceInfo version="1.0">
<DeviceClass>0</DeviceClass>
<OemCode>0</OemCode>
<BoardType>1007</BoardType>
<FirmwareIdent>eyeplus_ipc_gks_001</FirmwareIdent>
<Manufacturer>RS</Manufacturer>
<Model>GK7102</Model>
<GPIO>
<BlueLed>15_0x00000000_0_1</BlueLed>
<ReLed>15_0x00000000_0_1</ReLed>
<BoardReset>53_0x00000000_0_0</BoardReset>
<SpeakerCtrl>33_0x00000000_0_0</SpeakerCtrl>
<IrCtrl>12_0x00000000_0_1</IrCtrl>
<IrCut1B>44_0x00000000_0_1</IrCut1B>
<IrCut2B>39_0x00000000_0_1</IrCut2B>
</GPIO>

/home/hwcfg.ini:

Code: Select all

[config]
model = CloudCam
sensor_position = 1
support_eth = 1
ir_detect_type = 2
adc_setting_max = -300
adc_setting_min = 800
support_ptz = 1
support_mp4record = 1
support_ap_mode = 1
support_onvif = 1
standard_definition = 1
show_osd_time = 1
autotrackingoff = 1
support_ymv = 1
support_mdzone = 1
ptz_mic_mode = 1
ptz_no_selfck = 1

/home/ptz.cfg:

Code: Select all

motor_pins = 46,47,42,43,40,41,37,38
xchg_dir = 2
other_flags = 288
hmotor_upbound = 496
vmotor_upbound = 169
max_pps = 1000

/home/image.ini:

Code: Select all

[isp_gc2053_day]
wdr_mode = 0
ae.gainMax = 18

[isp_gc2053_night]
wdr_mode = 30
ae.gainMax = 14

[isp_gc2053_day.wl]
wdr_mode = 0
ae.gainMax = 24


[isp_gc1034_day]
ae.gainMax = 18

[isp_gc1034_night]
ae.gainMax = 24

[isp_gc1034_day.wl]
ae.gainMax = 32

[isp_mis2003_day]
wdr_mode = 80
ae.gainMax = 18

[isp_mis2003_night]
wdr_mode = 72
ae.gainMax = 18

[isp_mis2003_day.wl]
wdr_mode = 0
ae.gainMax = 24

[isp_ov2735_day]
wdr_mode = 0
ae.gainMax = 18

[isp_ov2735_night]
wdr_mode = 80
ae.gainMax = 24

[isp_ov2735_day.wl]
wdr_mdoe = 0
ae.gainMax = 24

/home/model.ini:

Code: Select all

[updimg]
pubtime = 0x5D516127

dmesg

Code: Select all

[    0.000000] Booting Linux on physical CPU 0
[    0.000000] Linux version 3.4.43-gk (rd@ubuntu) (gcc version 4.6.1 (crosstool-NG 1.18.0) ) #46 PREEMPT Wed Jun 26 13:47:34 CST 2019
[    0.000000] CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), cr=00c5387d
[    0.000000] CPU: VIPT aliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Goke IPC Board
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] AHB: 0x90000000  0xf2000000  -- 0x1000000
[    0.000000] APB: 0xa0000000  0xf3000000  -- 0x1000000
[    0.000000] PPM: 0xc0000000  0xc0000000  -- 0x200000
[    0.000000] BSB: 0xc2600000  0xf5000000  -- 0x100000
[    0.000000] DSP: 0xc2700000  0xf6000000  -- 0x18f0000
[    0.000000] USR: 0xc3ff0000  0xfe000000  -- 0x10000
[    0.000000] hal version = 20160804 
[    0.000000] On node 0 totalpages: 9216
[    0.000000] free_area_init_node: node 0, pgdat 8046ba7c, node_mem_map 804a3000
[    0.000000]   Normal zone: 72 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 9144 pages, LIFO batch:1
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 9144
[    0.000000] Kernel command line: console=ttySGK0,115200 mem=36M rootfstype=squashfs root=/dev/mtdblock2 init=linuxrc mtdparts=gk_flash:320K(U),1664K(K),1152K(R),-(A)
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 36MB = 36MB total
[    0.000000] Memory: 31712k/31712k available, 5152k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xff600000 - 0xffe00000   (   8 MB)
[    0.000000]     vmalloc : 0x82800000 - 0xff000000   (1992 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x82400000   (  36 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x80008000 - 0x80422000   (4200 kB)
[    0.000000]       .init : 0x80422000 - 0x80443000   ( 132 kB)
[    0.000000]       .data : 0x80444000 - 0x8046c340   ( 161 kB)
[    0.000000]        .bss : 0x8046c364 - 0x8049ed58   ( 203 kB)
[    0.000000] NR_IRQS:128
[    0.000000] >> gk init irq vic1...
[    0.000000] >> gk init irq vic2...
[    0.000000] gk init vic...
[    0.000000] mach gk init timer...
[    0.000000] sched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps every 4294967286ms
[    0.000000] Console: colour dummy device 80x30
[    0.000000] console [ttySGK0] enabled
[    0.020000] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 512
[    0.090000] CPU: Testing write buffer coherency: ok
[    0.100000] Setting up static identity map for 0xc054d470 - 0xc054d4a8
[    0.110000] NET: Registered protocol family 16
[    0.110000] init timer...
[    0.120000] Init HW timer for DSP communication
[    0.120000] init gpio...
[    0.130000] ###################################
[    0.130000] [BOOT VERSION] GK7102S rb-sc1045-v2.0 v2.0 
[    0.140000] [NET  INT_CLK] Internal PHY clock 
[    0.140000] [GPIO]#############################
[    0.150000] [GPIO] gpio map get from uboot
[    0.150000] [GPIO CFG] gpio   count = 59
[    0.160000] [GPIO CFG] intphy count = 3
[    0.160000] [GPIO CFG] extphy count = 3
[    0.160000] [GPIO CFG] IR LED CTL    (55)
[    0.170000] [GPIO CFG] IR CUT1       (55)
[    0.170000] [GPIO CFG] IR CUT2       (55)
[    0.180000] [GPIO CFG] SENSOR Reset  (27)
[    0.180000] [GPIO CFG] PHY Reset     (55)
[    0.190000] [GPIO CFG] PHY Speed Led (51)
[    0.190000] [GPIO CFG] SPI0 EN       (55)
[    0.190000] [GPIO CFG] SPI1 EN       (55)
[    0.200000] [GPIO CFG] USB HOST      (55)
[    0.200000] [GPIO CFG] SD Detect     (32)
[    0.210000] [GPIO CFG] SD Power      (55)
[    0.210000] [GPIO CFG] SD1 Detect    (63)
[    0.220000] [GPIO CFG] SD1 Power     (63)
[    0.220000] [GPIO]#############################
[    0.230000] gpiochip_add: registered GPIOs 0 to 63 on device: gk-gpio0
[    0.230000] create proc dir
[    0.240000] gk register devices 10
[    0.240000] gk register I2C
[    0.250000] bio: create slab <bio-0> at 0
[    0.260000] spi spi.0: gk SPI Controller 0 created 
[    0.270000] spi spi.0: master is unqueued, this is deprecated
[    0.270000] spi spi.1: gk SPI Controller 1 created 
[    0.280000] spi spi.1: master is unqueued, this is deprecated
[    0.290000] usbcore: registered new interface driver usbfs
[    0.290000] usbcore: registered new interface driver hub
[    0.300000] usbcore: registered new device driver usb
[    0.300000] i2c regbase: 0xf3003000 
[    0.310000] i2c i2c.0: i2c irq:registers 9
[    0.310000] i2c i2c.0: GK I2C[0] adapter[i2c-0] probed!
[    0.320000] i2c regbase: 0xf3004000 
[    0.320000] i2c i2c.1: i2c irq:registers 58
[    0.330000] i2c i2c.1: GK I2C[1] adapter[i2c-1] probed!
[    0.340000] FS-Cache: Loaded
[    0.340000] CacheFiles: Loaded
[    0.350000] cfg80211: Calling CRDA to update world regulatory domain
[    0.360000] gk-sd gk-sd.0: Slot0 req_size=0x00010000, segs=16, seg_size=0x00010000
[    0.390000] gk-sd gk-sd.0: GK SD/MMC[0] has 1 slots @ 50181818Hz, [0x09e130b0:0x00000000]
[    0.400000] NET: Registered protocol family 2
[    0.400000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.410000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.420000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.430000] TCP: Hash tables configured (established 2048 bind 2048)
[    0.430000] TCP: reno registered
[    0.440000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.440000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.450000] NET: Registered protocol family 1
[    0.460000] RPC: Registered named UNIX socket transport module.
[    0.460000] RPC: Registered udp transport module.
[    0.470000] RPC: Registered tcp transport module.
[    0.470000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.490000] mdma init...
[    0.490000] mdma request irq: 54 
[    0.500000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.510000] NFS: Registering the id_resolver key type
[    0.510000] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    0.520000] msgmni has been set to 61
[    0.540000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
[    0.540000] io scheduler noop registered
[    0.550000] io scheduler deadline registered
[    0.550000] io scheduler cfq registered (default)
[    0.560000] Serial: gk_uart driver
[    0.560000] serial_gk_probe: entry
[    0.560000] uart.0: ttySGK0 at MMIO 0xa0005000 (irq = 31) is a gkuart
[    0.570000] serial_gk_probe: succeed!
[    0.570000] serial_gk_probe: entry
[    0.570000] uart.1: ttySGK1 at MMIO 0xa001f000 (irq = 15) is a gkuart
[    0.580000] serial_gk_probe: succeed!
[    0.580000] serial_gk_probe: entry
[    0.580000] uart.2: ttySGK2 at MMIO 0xa001e000 (irq = 27) is a gkuart
[    0.580000] serial_gk_probe: succeed!
[    0.590000] mmc0: new high speed SDHC card at address 0001
[    0.600000] brd: module loaded
[    0.610000] loop: module loaded
[    0.610000] adc initialized (10:11)
[    0.620000] speed_mod is 0
[    0.620000] USE 1X mode read and 1X mode write
[    0.620000] gk_flash gk_flash.0: XT25F64B (8192 Kbytes)
[    0.630000] 4 cmdlinepart partitions found on MTD device gk_flash
[    0.640000] Creating 4 MTD partitions on "gk_flash":
[    0.640000] 0x000000000000-0x000000050000 : "U"
[    0.650000] 0x000000050000-0x0000001f0000 : "K"
[    0.660000] 0x0000001f0000-0x000000310000 : "R"
[    0.660000] 0x000000310000-0x000000800000 : "A"
[    0.670000] slram: not enough parameters.
[    0.670000] GKETH_init
[    0.680000] [GKETH_drv_probe] eth_base = 0xf200e000
[    0.680000] mii id = 0 
[    0.690000] ###### PHY Reset.1.0.2
[    0.800000] mdiobus_register: PHY[0] whose id 0x00000000 
[    0.810000] goke MII Bus: probed
[    0.810000] gk-eth gk-eth.0: MAC Address[02:11:22:a3:a0:00].
[    0.820000] usbcore: registered new interface driver cdc_ether
[    0.830000] usbcore: registered new interface driver cdc_wdm
[    0.830000] usbcore: registered new interface driver usbserial
[    0.840000] usbcore: registered new interface driver usbserial_generic
[    0.850000] USB Serial support registered for generic
[    0.850000] usbserial: USB Serial Driver core
[    0.860000] usbcore: registered new interface driver option
[    0.860000] USB Serial support registered for GSM modem (1-port)
[    0.870000] musb-hdrc: version 6.0, ?dma?, otg (peripheral+host)
[    0.880000] musb phy Begin initial sequence ...
[    0.900000] val=0x20
[    1.180000] gk musb init end...
[    1.190000] dma_controller_create_non_init ok
[    1.190000] musb-hdrc: ConfigData=0x03 (UTMI-16, SoftConn)
[    1.190000] musb-hdrc: MHDRC RTL version 2.0 
[    1.190000] musb-hdrc musb-hdrc: MUSB HDRC host driver
[    1.200000] musb-hdrc musb-hdrc: new USB bus registered, assigned bus number 1
[    1.210000] hub 1-0:1.0: USB hub found
[    1.210000] hub 1-0:1.0: 1 port detected
[    1.220000] musb-hdrc musb-hdrc: USB Host mode controller at f2006000 using DMA, IRQ 26
[    1.230000] platform add gk musb...
[    1.230000] mousedev: PS/2 mouse device common for all mice
[    1.240000] input: GKInput as /devices/virtual/input/input0
[    1.240000] evbug: Connected device: input0 (GKInput at gk/input0)
[    1.240000] Protocol NEC[0]
[    1.250000] ir request irq: 62 
[    1.250000] IR Host Controller probed!
[    1.250000] gk rtc init...
[    1.260000] rtc base: 0xf2080000 
[    1.260000] os read tm: t=0 
[    1.270000] gk-rtc: dev (254:0)
[    1.270000] gk-rtc gk-rtc: rtc core: registered gk-rtc as rtc0
[    1.270000] i2c /dev entries driver
[    1.280000] gk_wdt_v1_00: GK Watchdog Timer, (c) 2014 Goke Microelectronics
[    1.280000] [gk_wdt_init]: init
[    1.290000] [gk_wdt_probe]: probe
[    1.290000] [gk_wdt_probe]: probe mapped wdt_base=f3006000
[    1.300000] watchdog inactive, reset disabled, irq disabled
[    1.300000] mmcblk0: mmc0:0001  31.2 GiB 
[    1.310000]  mmcblk0: p1
[    1.320000] IPv4 over IPv4 tunneling driver
[    1.320000] gre: GRE over IPv4 demultiplexor driver
[    1.330000] ip_gre: GRE over IPv4 tunneling driver
[    1.330000] TCP: cubic registered
[    1.340000] Initializing XFRM netlink socket
[    1.340000] NET: Registered protocol family 10
[    1.350000] IPv6 over IPv4 tunneling driver
[    1.360000] NET: Registered protocol family 17
[    1.360000] NET: Registered protocol family 15
[    1.370000] Registering the dns_resolver key type
[    1.370000] VFP support v0.3: implementor 41 architecture 1 part 20 variant b rev 5
[    1.380000] os read tm: t=0 
[    1.390000] gk-rtc gk-rtc: setting system clock to 1970-01-01 00:00:00 UTC (0)
[    1.400000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    1.410000] Freeing init memory: 132K
[    1.670000] usb 1-1: new high-speed USB device number 2 using musb-hdrc
[    5.260000] gpio_dev init suc
[    5.350000] exFAT: Version 1.2.9
[    5.930000] hal: module license 'Proprietary' taints kernel.
[    5.940000] Disabling lock debugging due to kernel taint
[    5.970000] crypto initialized (10:11)
Media driver version (gcc version 4.6.1 (crosstool-NG 1.18.0) (uClibc)) v2.0.0 #svn r11887 Thu Apr 27 14:04:15 CST 2017
[    6.260000]  request_irq...24 ok-- video_sync
[    6.260000]  request_irq...59 ok-- video_frame_last_pixel
[    6.270000]  request_irq...61 ok-- video_frame
[    6.270000] Init software HR timer for DSP communication
[    6.510000] sensor board reset...
[    6.780000] detect:gc1034 at 0x42
[    6.790000] gc1034 i2c read 0x000000f0 is 0x00000010
[    6.790000] gc1034 i2c read 0x000000f1 is 0x00000034
[    6.800000] ===================================================
[    6.810000] ================find:gc1034 at 0x42================
[    6.810000] ===================================================
[    7.980000] initlializing ptz...
[    7.980000] 
[    7.980000] Parameters of PTZ driver:
[    7.990000] 	test_max_pos = 0
[    7.990000] 	max_pps = 1000
[    8.000000] 		pulse interval: 100/1000 = 0
[    8.000000] 	xchg_dir = 2
[    8.000000] 	hspd_slfck = 60
[    8.010000] 	vspd_slfck = 40
[    8.010000] 	hspd_normal = 0
[    8.010000] 	vspd_normal = 0
[    8.020000] 	hspd_reloc = 30
[    8.020000] 	vspd_reloc = 10
[    8.020000] 	spd_zoom = 3
[    8.030000] 	hmotor_upbound = 496
[    8.030000] 	vmotor_upbound = 169
[    8.030000] 	zmotor_upbound = 130
[    8.040000] 	no_selfck = 1
[    8.040000] 	other_flags = 288
[    8.040000] 	hmotor_center = 0
[    8.050000] 	vmotor_center = 0
[    8.050000] 		other_flags: 
[    8.050000] 			0x0001  --- Return to center when power on
[    8.050000] 			0x0002  --- Z-Motor only
[    8.050000] 			0x0004  --- No self-check
[    8.050000] 			0x0008  --- Ignore position
[    8.050000] 			0x0010  --- Respect spd_slfck
[    8.050000] 			0x0020  --- No posotion-switch detection
[    8.060000] 	motor pins: 46,47,42,43,40,41,37,38
[    8.070000] orig position: <496, 58, 0>
[    8.070000] GK710X gpio ptz(goke timer) device driver[2018.12.14] initialized.
[    9.000000]  Driver version : v2.1.1_201903061600
[    9.010000]  Fw version : v1.2.2_201902270940
[    9.010000] 
[    9.010000] usb_endpoint_descriptor(0):
[    9.020000] bLength=7
[    9.020000] bDescriptorType=5
[    9.030000] bEndpointAddress=81
[    9.030000] wMaxPacketSize=512
[    9.030000] bInterval=0
[    9.040000] Func_Of_Usb_Endpoint_Is_Bulk_In = 1
[    9.040000] 
[    9.040000] usb_endpoint_descriptor(1):
[    9.050000] bLength=7
[    9.050000] bDescriptorType=5
[    9.050000] bEndpointAddress=2
[    9.060000] wMaxPacketSize=512
[    9.060000] bInterval=0
[    9.060000] Func_Of_Usb_Endpoint_Is_Bulk_Out = 2
[    9.070000] 
[    9.070000] usb_endpoint_descriptor(2):
[    9.070000] bLength=7
[    9.080000] bDescriptorType=5
[    9.080000] bEndpointAddress=3
[    9.080000] wMaxPacketSize=512
[    9.090000] bInterval=0
[    9.090000] Func_Of_Usb_Endpoint_Is_Bulk_Out = 3
[    9.090000] nr_endpoint=3, in_num=1, out_num=2
[    9.090000] 
[    9.100000] USB_SPEED_HIGH
[    9.340000] ===>passtime:  220 ms
[    9.490000] Func_Of_Proc_Chip_Hw_Config_Rftype RF_Type is 3 TotalTxPath is 1 
[    9.490000] Func_Config_Chip_Outep_Process OutEpQueueSel(0x05), OutEpNumber(2)
[    9.520000] EEPROM type is E-FUSE
[    9.530000] [MC]==> eeValue = 32
[    9.530000] Boot from EFUSE, Autoload OK !
[    9.720000] EEPROM VID = 0x2310
[    9.720000] EEPROM PID = 0x9086
[    9.720000] drv running in normal mode
[    9.740000] Func_Chip_Hw_Efuseparsepowersavingmode_Process...bHWPwrPindetect(0)-bHWPowerdown(0) ,bSupportRemoteWakeup(1)
[    9.750000] ### PS params=>  power_mgnt(0),usbss_enable(0) ###
[    9.780000] kfree Pwr Trim flag:0
[   10.030000] fw go sucess!
[   10.030000] Func_Chip_Hw_Read_Mac_Hidden_Rpt OK! (1, 0ms), fwdl:1, id:0x19
[   10.050000] Func_Initwadptdatavariablesbyprom_Process(): REPLACEMENT = 0
[   10.050000] Func_Of_Proc_Chip_Hw_Read_Chip_Info in 550 ms
[   10.060000] proc_chan_init_func((null)) ChannelPlan ID:0x20, ch num:13
[   10.070000] NR_RECVBUFF: 16
[   10.070000] MAX_RECVBUF_SZ: 16384
[   10.070000] NR_PREALLOC_RECV_SKB: 16
[   10.080000] wl_new_macid((null)) if1, hwaddr:ff:ff:ff:ff:ff:ff macid:1
[   10.120000] proc_macaddr_cfg_func mac addr:44:ef:bf:7c:62:8c
[   10.120000] bDriverStopped:True, bSurpriseRemoved:False, bup:0, hw_init_completed:0
[   10.150000] usbcore: registered new interface driver wll9086xu
[   10.670000] +908621x_drv - drv_open, bup=0
[   11.920000] MAC Address = 44:ef:bf:7c:62:8c
[   11.920000] -908621x_drv - drv_open, bup=1
[   11.930000] ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   11.950000] net eth0: ###### GKETH_start_hw
[   11.960000] net eth0: ###### GKETH_phy_start_aneg...
[   11.960000] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   14.520000] net eth0: ###### GKETH_phy_stop
[   14.520000] net eth0: ###### GKETH_start_hw
[   14.530000] net eth0: ###### GKETH_phy_start_aneg...
[   14.540000] device eth0 entered promiscuous mode
[   14.540000] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   14.880000] ===================================================
[   14.890000] =====gc1034 drv create at 20170801 ver:20170210====
[   14.890000] ===================================================
[   14.900000] [sensor_get_dev_id 276]find sensor id: 00001034
[   14.920000] sensor board reset...
[   16.220000] sensor board reset...
[   16.510000] win_height:0 win_width:0
[   16.520000] win_height:0 win_width:0
[   22.380000] [Func_Of_Proc_Wx_Set_Pmkid] IW_PMKSA_FLUSH!
[   22.390000] left_aps.....
[   22.390000] set_mode = IW_MODE_INFRA
[   22.400000] left_aps.....
[   22.410000] [Func_Of_Proc_Wx_Set_Pmkid] IW_PMKSA_FLUSH!
[   22.520000] left_aps.....
[   22.520000] IW_SCAN_THIS_ESSID, ssid=Zy_private_RRE477, len=17
[   24.780000] survey done event(6d) band:0 for wlan0
[   25.180000] Func_Wpa_Set_Auth_Algs, AUTH_ALG_OPEN_SYSTEM
[   25.200000] left_aps.....
[   25.200000] set_mode = IW_MODE_INFRA
[   25.200000] 
[   25.200000]  wpa_ie(length:22):
[   25.230000] 0x30 0x14 0x01 0x00 0x00 0x0f 0xac 0x04 
[   25.230000] 0x01 0x00 0x00 0x0f 0xac 0x04 0x01 0x00 
[   25.240000] 0x00 0x0f 0xac 0x02 0x00 0x00 0x04 0x80 
[   25.260000] Func_Of_Proc_Wx_Set_Freq: set to channel 1
[   25.300000] left_aps.....
[   25.300000] =>Func_Of_Proc_Wx_Set_Essid
[   25.310000] ssid=Zy_private_RRE477, len=17
[   25.310000] Set SSID under fw_state=0x00000008
[   25.320000] [by_bssid:0][assoc_ssid:Zy_private_RRE477][to_roam:0] new candidate: Zy_private_RRE477(cc:5d:4e:9d:dc:84, ch1) rssi:-37
[   25.330000] do_chose_and_join_from_scanlist: candidate: Zy_private_RRE477(cc:5d:4e:9d:dc:84, ch:1)
[   25.340000] link to new AP
[   25.340000] [HT] HAL Support STBC = 0x01
[   25.350000] [HT] Declare supporting RX STBC = 1
[   25.350000] do_rebuild_ht_ie IEEE80211_HT_CAP_MAX_AMSDU is set
[   25.370000] <=Func_Of_Proc_Wx_Set_Essid, ret 0
[   25.370000] check_start_clnt_join_func(wlan0) req: 1,0,0
[   25.380000] check_start_clnt_join_func(wlan0) union: 1,0,0
[   25.390000] left_aps.....
[   25.390000] Set BSSID under fw_state=0x00000088
[   25.410000] type[0] = 0x0,type[1] = 0x0
[   25.530000] proc_prepare_auth_func: beacon keys ready
[   25.530000] link to new AP
[   25.540000] auth_to_issue_func
[   25.550000] proc_doAuthClient_func
[   25.550000] network.SupportedRates[0]=8C
[   25.560000] network.SupportedRates[1]=12
[   25.560000] network.SupportedRates[2]=98
[   25.570000] network.SupportedRates[3]=24
[   25.570000] network.SupportedRates[4]=B0
[   25.570000] network.SupportedRates[5]=48
[   25.580000] network.SupportedRates[6]=60
[   25.580000] network.SupportedRates[7]=6C
[   25.590000] bssrate_len = 8
[   25.590000] proc_doAssocRsp_func
[   25.600000] join_res_to_report_func(1)
[   25.600000] do_joinbss_renew_network
[   25.610000] +do_ht_cap_renew()
[   25.610000] wl_new_macid(wlan0) if1, hwaddr:cc:5d:4e:9d:dc:84 macid:0
[   25.620000] do_joinbss_renew_stainfo
[   25.620000] supp_mcs_set = ff, 00, 00, rf_type=3, tx_ra_bitmap=00000000000ffff0
[   25.630000] do_query_tx_nss: 1 SS, rf_type=3
[   25.650000] ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   25.690000] ### Set STA_(0) info ###
[   25.710000] HW_VAR_BASIC_RATE: 0x150 -> 0x15f -> 0x15f
[   25.730000]  ~~~~set sta key:unicastkey
[   25.750000]  ~~~~set sta key:groupkey
[   25.750000] ==> wl_set_key algorithm(4),keyid(1),key_mask(0)
[   25.760000] WMM(0): 0, a42b
[   25.770000] WMM(1): 0, a44f
[   25.780000] WMM(2): 0, 5e4322
[   25.800000] WMM(3): 0, 2f3222
[   25.800000] wmm_para_seq(0): 0
[   25.800000] wmm_para_seq(1): 1
[   25.820000] wmm_para_seq(2): 2
[   25.820000] wmm_para_seq(3): 3
[   25.840000] do_Htassocrsp_work
[   25.880000] Func_Update_Hal_Ra_Mask_Process => mac_id:0, networkType:0x0a, mask:0x000ffff0
[   25.880000] 	 ==> rssi_level:0, rate_bitmap:0x000ff000
[   25.900000] Func_Of_Set_Fwmacidconfig_Cmd(): mac_id=0 raid=0x5 bw=0 mask=0xff000
[   25.950000] Func_Update_Hal_Ra_Mask_Process(): mac_id=0 raid=0x5 bw=0 mask=0xff000 init_rate=0x13
[   25.980000] type[0] = 0x2,type[1] = 0x0
[   26.030000] =>callback_of_mlmeext_joinbss_event_func - End to Connection without 4-way
[   29.110000] proc_doAction_back_func
[   29.110000] proc_doAction_back_func, action=0
[   29.150000] proc_xmit_ack_poll_func success!
[   29.150000]  addba_rsp_wait_ack_to_issue_func(wlan0) ra=cc:5d:4e:9d:dc:84 tid=0, acked, 1/3 in 30 ms
[   36.090000] wlan0: no IPv6 routers present
[   55.940000] proc_xmit_ack_poll_func success!
[   55.940000]  proc_xmit_ack_poll_func success!
[   71.940000]  proc_xmit_ack_poll_func success!
[   87.940000]  proc_xmit_ack_poll_func success!
[  103.940000]  proc_xmit_ack_poll_func success!
[  119.940000]  proc_xmit_ack_poll_func success!
[  135.940000]  proc_xmit_ack_poll_func success!
[  151.940000]  proc_xmit_ack_poll_func success!
[  167.940000]  proc_xmit_ack_poll_func wait timeout  1020
[  184.940000]  proc_xmit_ack_poll_func success!
[  184.980000]  wlan0 cmd=57,2,0 process_time=1120
[  199.940000] proc_xmit_ack_poll_func success!
[  199.940000]  proc_xmit_ack_poll_func success!
[  215.940000]  proc_xmit_ack_poll_func success!
[  231.940000]  proc_xmit_ack_poll_func success!
[  247.940000]  proc_xmit_ack_poll_func success!
[  263.940000]  proc_xmit_ack_poll_func success!
[  279.940000]  proc_xmit_ack_poll_func success!
[  295.940000]  proc_xmit_ack_poll_func success!
[  311.940000]  proc_xmit_ack_poll_func success!
[  327.940000]  proc_doAction_back_func
[  327.970000] proc_doAction_back_func, action=0
[  328.030000] proc_xmit_ack_poll_func success!
[  328.030000]  addba_rsp_wait_ack_to_issue_func(wlan0) ra=cc:5d:4e:9d:dc:84 tid=3, acked, 1/3 in 20 ms
[  345.940000] proc_xmit_ack_poll_func success!
[  345.940000]  proc_xmit_ack_poll_func success!
[  361.940000]  proc_xmit_ack_poll_func success!
[  391.940000]  proc_xmit_ack_poll_func success!
[  407.940000]  proc_xmit_ack_poll_func success!
[  423.940000]  proc_xmit_ack_poll_func success!
[  439.940000]  proc_xmit_ack_poll_func success!
[  455.940000]  proc_xmit_ack_poll_func success!
[  471.940000]  proc_xmit_ack_poll_func success!
[  487.940000]  proc_xmit_ack_poll_func success!
[  503.940000]  proc_xmit_ack_poll_func success!
[  525.950000]  proc_xmit_ack_poll_func success!
[  541.940000]  proc_xmit_ack_poll_func success!
[  557.940000]  proc_xmit_ack_poll_func success!
[  573.940000]  proc_xmit_ack_poll_func success!
[  607.950000]  proc_xmit_ack_poll_func success!
[  623.940000]  proc_xmit_ack_poll_func success!
[  639.940000]  proc_xmit_ack_poll_func success!
[  655.940000]  proc_xmit_ack_poll_func success!
[  679.940000]  proc_xmit_ack_poll_func success!
[  695.940000]  proc_xmit_ack_poll_func success!
[  711.940000]  proc_xmit_ack_poll_func success!
[  727.940000]  proc_xmit_ack_poll_func success!
[  743.940000]  proc_xmit_ack_poll_func success!
[  759.940000]  proc_xmit_ack_poll_func success!
[  789.950000]  proc_xmit_ack_poll_func success!
[  805.940000]  proc_xmit_ack_poll_func success!
[  821.940000]  proc_xmit_ack_poll_func success!
[  837.940000]  proc_xmit_ack_poll_func success!
[  895.940000]  proc_xmit_ack_poll_func success!
[  911.940000]  proc_xmit_ack_poll_func success!
[  937.940000]  proc_xmit_ack_poll_func success!
[  953.940000]  proc_xmit_ack_poll_func success!
[  969.940000]  proc_xmit_ack_poll_func success!
[  985.940000]  proc_xmit_ack_poll_func success!
[ 1001.940000]  proc_xmit_ack_poll_func success!
[ 1017.940000]  proc_xmit_ack_poll_func success!
[ 1033.940000]  proc_xmit_ack_poll_func success!
[ 1049.940000]  proc_xmit_ack_poll_func success!
[ 1065.950000]  proc_xmit_ack_poll_func success!
[ 1123.940000]  proc_xmit_ack_poll_func success!
[ 1139.940000]  proc_xmit_ack_poll_func success!
[ 1155.940000]  proc_xmit_ack_poll_func success!
[ 1171.940000]  proc_xmit_ack_poll_func success!
[ 1227.940000]  proc_xmit_ack_poll_func success!
[ 1247.940000]  proc_xmit_ack_poll_func wait timeout  1000
[ 1264.920000]  proc_xmit_ack_poll_func success!
[ 1264.950000]  wlan0 cmd=57,2,0 process_time=1080
[ 1273.870000] hmotor: nStep:4, curCmd{act:2,speed:2,t_pos:0}, newCmd{1:2:0}, counter:4, iStep:2, upbound:496, pos:517, pos_save:0
[ 1273.880000] vmotor: nStep:4, curCmd{act:0,speed:0,t_pos:0}, newCmd{1:0:0}, counter:0, iStep:0, upbound:169, pos:58, pos_save:0
[ 1273.890000] other_flags: 0x120, max_pps=1000, motor_pulse_interval=5, psp0:496,58
[ 1381.940000] proc_xmit_ack_poll_func success!
[ 1381.940000]  proc_xmit_ack_poll_func success!
[ 1397.940000]  proc_xmit_ack_poll_func success!
[ 1421.940000]  proc_xmit_ack_poll_func success!
[ 1437.940000]  proc_xmit_ack_poll_func success!
[ 1453.940000]  proc_xmit_ack_poll_func success!
[ 1487.940000]  proc_xmit_ack_poll_func success!
[ 1503.940000]  proc_xmit_ack_poll_func success!
[ 1519.940000]  proc_xmit_ack_poll_func success!

Found 1 weird issue, I did reset 1 device with the SD-card inserted.
The first boot returned the camera with 'follow' function ON ?
The camera did follow any movement on camera.
Could not reproduce this behavior (yet).

DG.

Post by **admin** » 06 Oct 2023, 02:04

The first try to get UART to these chinese devices did not work.
I soldered the 2 small jumpers and 3 wires to the PCB but still not found working serial.

Have to test other speed than 115200? Or it is SPI?
Not figured out yet.

On the other side of PCB:

1 - Unknown connector
2 - UART serial (other side) ??
3 - Unknown connector (connected to IR-LED's and the light detector on the IR-LED-ring)

The black 2x4 female connector block between 2 and 3 is for IR lights PCB ring (around the camera lens).
There are other (lookalike) PCB's on the internet with even more 3 pins connector possibilities:

Close to the Wifi-module (1924) is a 3pin connector which seems to be the working UART, not known what the other 3pin connector is for.
My camera does not have a 3pin connector close to Wifi, and Wifi is not working. Together with no UART, this device seems to be really 'broken'.
My 3pin connector is also not connected to the 1 or 3 connector-pads in the picture above.
There is no way to connect to this device, only an SD-card can be inserted which will log the ipc.log.0 mentioned above.
SD-card only afterwards readable on PC.

DG.

DG's Hardware board

IPCamera

IPCamera

Re: IPCamera, root access

Re: IPCamera

Re: IPCamera

Re: IPCamera, Adjustments and info

Re: IPCamera, UART serial on defect device