ivorh

if you have a ttl-serial interface and don't mind opening the box, you can get access: http://www.cctvforum.com/viewtopic.php?p=207973#p207973 although it looks like the footage is stored on the unmounted part of the partition in a proprietary way (dvrfs) so extracting that will be a little tricky. The main dvr process is a single executable application looks like it's statically linked so limited options for interacting with that too.... oh and the chipset (hi3515) only has binary kernel libraries installed, documentation and source code seems limited. having said that once you have a login onto the box there's bound to be something interesting you can get it to do. just haven't decided what yet!

if it's the same internals as the swann dvr (I suspect it might be since those password hashes match the ones in the swann firmware) I have a method to get a login, albeit relying on opening the box:- https://twitter.com/velotester/status/282308635139395584 The swann dvr has a ttl-serial interface (115200-8-n) on the board (see above). I connected up to this and you are able to break into the boot process with ctrl-c as soon as it starts. From there you can invoke runlevel one by: setenv bootargs mem=68M console=ttyAMA0,115200 root=1f01 rootfstype=jffs2 mtdparts=physmap-flash.0:4M(boot),12M(rootfs),14M(app),2M(para) busclk=220000000 1 and then boot with bootm 0x80100000 you might need to check those two lines for different boxes, if you issue the command printenv you'll see the bootargs and the boot address. You'll now have a root login. From here you can either call passwd to change the password, or if you want to retain the old one you can copy passwd to passwd~ and rename passwd- to passwd which will leave you with the weak broken password "helpme" You can now reboot and ssh in!