CBX

Cheers. I've been looking at the code for the DVR control app as I don't have one to test. Looks like the gen code is indeed different, but I think I can figure it out without debugging on the device. I'll send a code based on the IPcam algo which should be wrong and a code based on what i think the DVR app expects. We'll see if it works

Actually if you are concerned about PM'ing me your full serial - feel free to exclude the last 2 digits, and I'll generate 100 combinations and you can just pick yours without me knowing which it is.

DS-2CD8153F-E20110629BBWR---s/n--- Nope, that one is also 34 characters, so not all IP cams have odd length. Thanks for the help MindTwist. Finally had a chance to look at this and code adjusted to work with even length device strings (had to add a digit to mine to test!) No idea if this works for DVR stuff or not as don't have one. If anyone wants to know if this is the same algo or not, but all means PM me your full device string and I'll PM you back the secure code to test.

Bummer. OK thanks - means I have to figure out the algo abit more to work with even numbered strings

Thanks for checking that. Do you know if the unlock for a DVR is the same mechanism? The odd length device string might be IPcams only?

Sorry for the confusion - I meant the entire device string length. E.g: DS-2CD2732F-IS20121226CCCH546641810 is 33 characters long.

I've realised my code only works for serial numbers which have an odd number of characters. I'm not sure if Hikvision cams only have an odd length? Does anyone have an even length serial number?

You're welcome I certainly don't mind the info I've posted being reproduced though it would be nice to get a credit Well I feel I've done my bit by identifying what I think are the language flag locations Good luck!

I agree - it doesn't touch those areas and is why there is no point flashing a different region firmware. These partitions do indeed contain serial and MAC info, as well as device specific data. I would only advise anyone who is planning to write to flash to change the 2 language flags I've already identified, nothing else though I could be wrong (if Hikvision decide to compare serial code region to language flag for example). I've said this also - the risk of bricking is real. Access to the bootloader and nand dumps of your flash areas beforehand should be considered prerequisites. It's also worth noting there is at least one CRC relating to the flash though I've not looked into which areas it covers. Me either It's 192.0.0.0/24 but I know what you mean. I always just added a virtual interface on the 192.0.0.0/24 subnet and configured from there - but whatever works. I never really understood why they used a public IP of 192.0.0.64 rather than the RFC 1918 private 192.168.0.0/16 range.

It certainly helps with my goal to modify my cameras to suit my network and requirements. I've noticed that there's lots of free space in the 2 kernel partitions in the flash, so compiling a kernel with more functionality is appealing. The 1 server partition per share issue is annoying (and poorly implemented by Hikvision). It's not something I'm looking into though as I use the camera's SD card as the NAS for the other camera. I was also under the impression that there was a 5.1 patch by someone else for this?

They have now provided the kernel source. Well done Hikvision! viewtopic.php?f=19&t=39874&p=242667#p242667

Hikvision kernel source I made a GPL request for the kernel sources used on the camera in early January. After some initial confusion (they didn't seem to know what GPL was) I've now been provided with them, and I've now compiled my own kernel. Well done to Hikvision for working with me on this. I hope that in the future you will also include the GPL license text with your product (in the manual, on the web interface etc) which you are required to by the licensing conditions. To anyone who wishes to make a similar request, I would advise being patient, explaining what GPL is if asked, making it clear you are not asking for Hikvision owned code and not mentioning legal issues Please tread gently in order to encourage Hikvision to keep a positive attitude towards GPL requests and open source in general. They also asked me who I was, my company details, what I needed it for. Under GPL I wasn't obligated to answer but I did in order the grease the wheels. Maybe one day they'll even just put GPL sources on their website so you don't have to ask. I did have to comment out the below in arch/arm/mach-ambarella/init-coconut.c to get the kernel to compile. Seems silly it was even needed as "CONFIG_TOUCH_AMBARELLA_CHACHA_MT4D is not set" in the .config anyway. /* ambarella_chacha_mt4d_board_info.irq = ambarella_board_generic.touch_panel_irq.irq_line; ambarella_chacha_mt4d_board_info.flags = 0; i2c_register_board_info(0, &ambarella_chacha_mt4d_board_info, 1);*/

Yes you could write to the relevant areas of the flash from u-boot. You might need to recaculate the CRC though or it may fail to boot (depending on whether the CRC covers those areas of flash or not). And as I've said there may be other ramifications which anyone who attempts this should think about. You could probably also do this from within booted linux on the camera, but probably safer from the bootloader.

Bootloader On my 2732, there is a 4 pin header named JP1 which gives rs-232 access to the UART - i.e. so you can access the bootloader and the console. Taking where JP1 is printed as pin 4, pin out is: 1 - GND 2 - RX 3 - TX 4 - VCC 3.3V Some of the below formatting isn't quite right. U-Boot 1.3.4-57424 (Nov 14 2013 - 11:56:46) ARM Clock: 480MHz DDR Clock: 336MHz Hit Ctrl+u to stop autoboot: 2 HKVS # help The following commands are supported: boot help bios diag mtest dump erase go exec ping r8 r16 r32 reset saveenv printenv setenv show usbdl w8 w16 w32 tftpboot boot mreadoob killb crc nandread nandwrite ups upm format update upf upa upr upk updateb ubi bapi Use 'help' to get help on a specific command HKVS # show logo ___ ___ _________ _ / _ \ | \/ || ___ \ | | / /_\ \| . . || |_/ / ___ ___ | |_ | _ || |\/| || ___ \ / _ \ / _ \ | __| | | | || | | || |_/ /| (_) || (_) || |_ \_| |_/\_| |_/\____/ \___/ \___/ \__| ---------------------------------------------------------- Amboot(R) Ambarella(R) Copyright (C) 2004-2007 HKVS # help upk Help for 'upk': Usage: update kernel to nand flash HKVS # help tftpboot Help for 'tftpboot':Usage: tftpboot [address] [filename] Load images from TFTP server to memory Boot image via network using TFTP protocol HKVS # print ipaddr=192.0.0.64 serverip=192.0.0.128 gatewayip=0.0.0.0 netmask=255.255.255.0 ethaddr=<removed> loadaddr=0xc2000000 bootfile=digicap.dav bootcmd=nullbootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0bootdelay=2 HKVS # show flash RCT configured to NAND mode main size: 2048 pages per block: 64 bst partition blocks: 0 - 1 ptb partition blocks: 1 - 9 bld partition blocks: 9 - 17 hal partition blocks: 17 - 25 ano_ptb partition blocks: 25 - 33 env partition blocks: 33 - 37 param partition blocks: 37 - 41 dpt partition blocks: 41 - 49 rcvy partition blocks: 49 - 129 krn_pri partition blocks: 129 - 193 krn_sec partition blocks: 193 - 257 rmd_pri partition blocks: 257 - 289 rmd_sec partition blocks: 289 - 321 app_pri partition blocks: 321 - 513 app_sec partition blocks: 513 - 705 cfg_pri partition blocks: 705 - 737 cfg_sec partition blocks: 737 - 769 dbg partition blocks: 769 - 897 HKVS # show ptb bst: 0xc8577d60 1.3 (2013/8/27)0x00000000 0x00000001 (2048) bld: 0xcdd6116b 1.3 (2013/11/14)0xc0000000 0x00000000 (235748) hal: 0x3407bf3c 5.1 (2013/11/14)0xc00a0000 0x00000000 (59144) S/N: usbdl_mode: 0 auto_boot: 1 cmdline: "console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0" HKVS # show bb No bad blocks HKVS # show bbt HKVS # show meta bst sblk: 0 nblk: 1 on: NAND ptb sblk: 1 nblk: 8 on: NAND bld sblk: 9 nblk: 8 on: NAND hal sblk: 17 nblk: 8 on: NAND ano_ptb sblk: 25 nblk: 8 on: NAND env sblk: 33 nblk: 4 on: NAND param sblk: 37 nblk: 4 on: NANDd pt sblk: 41 nblk: 8 on: NAND rcvy sblk: 49 nblk: 80 on: NAND krn_pri sblk: 129 nblk: 64 on: NAND krn_sec sblk: 193 nblk: 64 on: NAND rmd_pri sblk: 257 nblk: 32 on: NAND rmd_sec sblk: 289 nblk: 32 on: NAND app_pri sblk: 321 nblk: 192 on: NAND app_sec sblk: 513 nblk: 192 on: NAND cfg_pri sblk: 705 nblk: 32 on: NAND cfg_sec sblk: 737 nblk: 32 on: NAND dbg sblk: 769 nblk: 128 on: NAND sblk: 0 nblk: 0 on: DEFAULT sblk: 0 nblk: 0 on: DEFAULT sm_stg[0] sblk: 0 nblk: 0 sm_stg[1] sblk: 0 nblk: 0 model name: crc32:0x9d57e812 Booting: U-Boot 1.3.4-57424 (Nov 14 2013 - 11:56:46)ARM Clock: 480MHzDDR Clock: 336MHzHit Ctrl+u to stop autoboot: 2 Hit Ctrl+u to stop autoboot: 1 Hit Ctrl+u to stop autoboot: 0|BIND err|Unknown command:null nand booting ...load kernel...load ramdisk... init started: BusyBox v1.19.3 (2013-11-01 10:10:26 CST) starting pid 377, tty '': '/etc/init.d/rcS' Starting udev: [ OK ] starting pid 608, tty '': '/sbin/iptables -A INPUT -p tcp --dport 23 -j DROP' starting pid 609, tty '': '/sbin/iptables -A INPUT -p tcp --dport 21 -j DROP' starting pid 610, tty '': '/sbin/inetd -f -e /etc/inetd.conf' starting pid 611, tty '': '-/bin/sh' BusyBox v1.19.3 (2013-11-01 10:10:26 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. UBI device number 1, total 192 LEBs (24772608 bytes, 23.6 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB) waiting for /dev/ubi1_0. Check dir /dav ok! (0) UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB) waiting for /dev/ubi3_0. Check dir /davinci ok! (0) UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB) waiting for /dev/ubi4_0. Check dir /config ok! (0) Hit Ctrl+c to stop and exec /home/initrun.sh to continue route: ioctl 0x890c failed: No such process map_size = 0x300000 nr_item = 3 addr_offset = 0x0 filename = orccode.bin addr_offset = 0x200000 filename = orcme.bin addr_offset = 0x2a0000 filename = default_binary.bin mmap returns 0x40281000 loading ./orccode.bin...addr = 0x40281000, size = 0x19f02d loading ./orcme.bin...addr = 0x40481000, size = 0x36374 loading ./default_binary.bin...addr = 0x40521000, size = 0x40000 =============================== u_code version = 2013/10/24 3.0 ===============================

Good As I say, I think there is a patch someone else did for that. I don't need it myself so won't be looking into it. No, the SD card is partitioned (like a hard disk) to give the cameras separate areas to write to. You're welcome.

I don't know why that doesn't work for you to be honest - I've tried copy and pasting that and it runs fine on my camera. You could try this instead? for FUNC in `/dav/opt/busybox --list-functions` do ln -s /dav/opt/busybox /"$FUNC" done Actually I wonder if you are saving the script in MSDOS/Windows format instead of one compatible with linux. http://en.wikipedia.org/wiki/Newline#Common_problems

I've been asked to post my custom busybox, which I'm happy to do. Note that you use this at your own risk. If you want to use syslogd/klogd you'll need to create /var/log before running them (unless you tell them to put logs somewhere else). /mnt/server # md5sum busybox c58ae7c6c47c969cb276a51d67879ca5 busybox NOTE The attachment is really busybox.7z but I had to rename it for the forum to accept it.

If that's true then fair enough. Actually I wouldn't expect a code needed for that at all if you need to have physical access to that device. The Hikvision one is much more of an issue as tcp 7001, ONVIF, SDK port, sadp can all be used to reset the password if I am not mistaken. You can ask, but I've already said I won't publish It might be misused by people to get access to cameras that aren't theirs. I don't think Hikvision perform any checks when you ask for a code - but that's their responsiblity not mine.

As things stand you need to only have one server share per server partition (which sucks). Don't know if that's possible with your product. But yes - you could patch davinci - specifically the value returned by the server to something fixed. Then see how it responds to having a server reported free space > total space. If it doesn't like that you'll need to patch returned free space too. Or simply patch out the error checking. I think there's already a patch going around (which is nothing to do with me and may work another way) - you might want to try that.

Yes.

Turn camera into NFS/NAS server, and share internal SD card with other cameras. Complicated and low level as you would expect. Cross compile kernel modules, user space programs. Alter various system files on boot. Cross compile ext4 for use on SD card instead of vfat. Tunefs. Jiggery pokery with SD card partitioning, losetup etc. Patch davinci. Change NFS mount options for bigger write and read windows, and no sync. /dav/opt/nfsd # cat ../nfsd.sh cd /dav/opt/nfsd insmod exportfs.ko insmod nfsd.ko mkdir -p /var/lib/nfs #mount -n -t rpc_pipefs none /var/lib/nfs/rpc_pipefs ./portmap cp exports /etc cp services /etc touch /var/lib/nfs/rmtab exportfs -ra statd --no-notify mount -t nfsd nfsd /proc/fs/nfsd rpc.mountd --nfs-version 3 --no-nfs-version 4.1 --no-nfs-version 4 rpc.nfsd --nfs-version 3 --no-nfs-version 4.1 --no-nfs-version 4 And on non SD card camera, add NFS share to SD camera. Now no need to keep main server on for NAS functions yay, saving power and in the event of a break in in which the server might be stolen I'll at least have the recordings from both cameras on the SD card.

ONVIF monitoring I want to know when motion is detected, preferably via my TV and an audio alert from my server (which is in my front room). I decided to do this via ONVIF with a script which runs on the server and subscribes to events on the camera, and then runs another script to take actions as apropriate (onscreen notice, pause video, audio alert from server etc). root@rl70:~/cam51/home# ipcam_monitor --help Usage: ipcam_monitor --user=<username> --pw=<password> --ip=<IP> [OPTION]... --help print this help IPcam ONVIF monitor - CBX v0.0.1 21-01-14 Basically you need to initialize things with the camera (sync time, get media event and device info, and do a event_CreatePullPointSubscriptionRequest() and listen to what the camera says when motion is detected and renew the Subscription periodically. i don't want alerts popping up all the time, so I use a different script to control the settings of what will happen when motion is detected. I also optionally enable a separate motion detection window if I want to know when someone is coming up the drive.

Video and picture extraction You can parse the video and picture indexes on your NAS or SD card, and extract videos and pictures. Of course, you can do this manually on your camera via the web interface, but I prefer for this to happen automatically so I extract from my SD card to my primary server which has 5Tb+ rather than 32Gb I then generate a playlist for xbmc with last nights motion detection recordings. root@rl70:/# /usr/local/bin/extract_hik_picindex.php --indexfile=/mnt/sd2/datadir0/index00p.bin --extract-pics=yes --extract-dir=/mnt/hdd/sd2pic Start Time: 24-02-14 19:17:55 End Time: 25-02-14 11:02:59 Number of extents: 1 Number of pics: 968 Total pic size: 135296848 Extracting to /mnt/hdd/sd2pic/25-02-14/11_00_58.jpg .... OK Extracting to /mnt/hdd/sd2pic/25-02-14/11_01_58.jpg .... OK Extracting to /mnt/hdd/sd2pic/25-02-14/11_02_58.jpg .... OK 3 pics extracted. Videos (the extracted filenames look user unfriendly but suit my needs!). root@rl70:/# /usr/local/bin/extract_hik_vidindex.php --indexfile=/mnt/sd2/datadir0/index00.bin --type=Motion --extract-videos=yes --extract-dir=/mnt/hdd/sd2 Number of videos: 5 Total video size: 10325437836 File /mnt/hdd/sd2/24-02-14/20_57___24-02-14_20_57_56_to_24-02-14_20_58_16.mp4 exists - skpping.... File /mnt/hdd/sd2/24-02-14/22_24___24-02-14_22_24_20_to_24-02-14_22_24_38.mp4 exists - skpping.... File /mnt/hdd/sd2/24-02-14/23_20___24-02-14_23_20_03_to_24-02-14_23_20_23.mp4 exists - skpping.... File /mnt/hdd/sd2/24-02-14/23_21___24-02-14_23_21_41_to_24-02-14_23_22_01.mp4 exists - skpping.... File /mnt/hdd/sd2/25-02-14/06_38___25-02-14_06_38_39_to_25-02-14_06_38_59.mp4 exists - skpping.... File /mnt/hdd/sd2/25-02-14/10_03___25-02-14_10_03_30_to_25-02-14_10_03_48.mp4 exists - skpping.... 0 videos extracted. Here's an example of a video extent and video object: [18] => HIK_EXTENT_INDEX Object ( [index_num] => 18 [video_count] => 2 [time_start] => 1393067869 [time_start_str] => 22-02-14 11:17:49 [time_end] => 1393090333 [time_end_str] => 22-02-14 17:32:13 [duration] => 22464 [data1] => 8308 [data2] => 17927 ) [21-02-14_16_38_14_to_21-02-14_17_05_51] => HIK_VIDEO_INDEX Object ( [video_id] => 21-02-14_16_38_14_to_21-02-14_17_05_51 [video_extent_filename] => /mnt/sd2/datadir0/hiv00032.mp4 [video_extract_filename] => /mnt/hdd/sd2/21-02-14/16_38___21-02-14 _16_38_14_to_21-02-14_17_05_51.mp4 [video_extent_id] => 32 [video_start_pos] => 00000000 [video_end_pos] => 0f873828 [video_start_pos_dec] => 0 [video_end_pos_dec] => 260519976 [video_size] => 260519976 [video_type_int] => 00 [video_type_str] => Continuous [video_time1] => 1393000694 [video_time2] => 1393002351 [video_time3] => 1393000694 [video_time4] => 1393000694 [video_time5] => 1393002351 [video_start_str] => 21-02-14 16:38:14 [video_end_str] => 21-02-14 17:05:51 [video_duration] => 1657 [video_data1] => 000c6f98 [video_data2] => 000399e0 [video_data3] => 000c6f98 [video_data4] => 26a9b673 [video_data5] => 2b1b1657 [video_data6] => 0000 [video_data7] => 4aa8 ) I'm still working on some of the extra data which is to do with frames etc.

One of the things that people ask is "is there no linux logging?" Well, you can enable debug mode with setDebug and outputOpen, and also get dmesg. You can also run davinci from the command line (handy if you are developing), but that involves making changes to the camera to stop it doing automatically, and if you don't know what you are doing you will lock yourself out of the camera. But it's possible to run syslogd and klogd (with a new busybox binary) and get /var/log/messages. Feb 24 14:58:02 ipcam1 user.notice kernel: [ 6.915789] UBI: image sequence number: 521241466 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 6.918819] UBI: background thread "ubi_bgt3d" started, PID 636 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.000659] UBIFS: recovery needed Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.045625] UBIFS: recovery completed Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.045673] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri" Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.045704] UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs) Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.045732] UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs) Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.045755] UBIFS: media format: w4/r0 (latest is w4/r0) Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.045773] UBIFS: default compressor: lzo Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.045790] UBIFS: reserved for root: 103599 bytes (101 KiB) Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.156860] UBI: attaching mtd16 to ubi4 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.156900] UBI: physical eraseblock size: 131072 bytes (128 KiB) Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.156923] UBI: logical eraseblock size: 129024 bytes Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.156941] UBI: smallest flash I/O unit: 2048 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.156958] UBI: sub-page size: 512 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.156976] UBI: VID header offset: 512 (aligned 512) Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.156996] UBI: data offset: 2048 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.166144] UBI: max. sequence number: 2165 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190498] UBI: attached mtd16 to ubi4 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190531] UBI: MTD device name: "cfg_sec" Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190553] UBI: MTD device size: 4 MiB Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190570] UBI: number of good PEBs: 32 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190585] UBI: number of bad PEBs: 0 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190601] UBI: number of corrupted PEBs: 0 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190618] UBI: max. allowed volumes: 128 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190635] UBI: wear-leveling threshold: 4096 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190650] UBI: number of internal volumes: 1 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190666] UBI: number of user volumes: 1 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190681] UBI: available PEBs: 0 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190696] UBI: total number of reserved PEBs: 32 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190713] UBI: number of PEBs reserved for bad PEB handling: 2 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190733] UBI: max/mean erase counter: 83/70 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.190749] UBI: image sequence number: 110853645 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.198933] UBI: background thread "ubi_bgt4d" started, PID 646 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.275619] UBIFS: recovery needed Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.321399] UBIFS: recovery completed Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.321448] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec" Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.321477] UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs) Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.321503] UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs) Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.321527] UBIFS: media format: w4/r0 (latest is w4/r0) Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.321546] UBIFS: default compressor: lzo Feb 24 14:58:02 ipcam1 user.notice kernel: [ 7.321564] UBIFS: reserved for root: 103599 bytes (101 KiB) Feb 24 14:58:02 ipcam1 user.notice kernel: [ 8.528841] net eth0: Could not find default PHY in 9. Feb 24 14:58:02 ipcam1 user.notice kernel: [ 8.528883] net eth0: Try PHY[9] whose id is 0x00008201! Feb 24 14:58:02 ipcam1 user.info kernel: [ 8.530082] ADDRCONF(NETDEV_UP): eth0: link is not ready Feb 24 14:58:02 ipcam1 user.info kernel: [ 10.529082] PHY: 0:09 - Link is Up - 100/Full Feb 24 14:58:02 ipcam1 user.info kernel: [ 10.529295] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready Feb 24 14:58:02 ipcam1 user.warn kernel: [ 12.575205] ========== SD Driver Build Date: Nov 14 2013, Time: 11:59:44 ========== Feb 24 14:58:02 ipcam1 user.info kernel: [ 12.575391] SD card slot0, card detect mode:soft poll Feb 24 14:58:02 ipcam1 user.notice kernel: [ 12.575649] ambarella-sd ambarella-sd.0: Slot0 use bounce buffer[0xc2f80000<->0xc3180000] Feb 24 14:58:02 ipcam1 user.notice kernel: [ 12.575692] ambarella-sd ambarella-sd.0: Slot0 req_size=131072, segs=32, seg_size=131072 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 12.575863] ambarella-sd ambarella-sd.0: Slot1 use bounce buffer[0xc2fa0000<->0xc31a0000] Feb 24 14:58:02 ipcam1 user.notice kernel: [ 12.575901] ambarella-sd ambarella-sd.0: Slot1 req_size=131072, segs=32, seg_size=131072 Feb 24 14:58:02 ipcam1 user.notice kernel: [ 12.658870] ambarella-sd ambarella-sd.0: Ambarella SD/MMC[0] probed 2 slots, 0x09e130b0! Feb 24 14:58:02 ipcam1 user.info kernel: [ 13.188946] mmc0: new high speed SDHC card at address aaaa Feb 24 14:58:02 ipcam1 user.info kernel: [ 13.200210] mmcblk0: mmc0:aaaa SU32G 29.7 GiB Feb 24 14:58:02 ipcam1 user.info kernel: [ 13.213705] mmcblk0: p1 p2 p3 Feb 24 14:58:02 ipcam1 user.warn kernel: [ 14.581040] EXT4-fs (mmcblk0p2): warning: mounting unchecked fs, running e2fsck is recommended Feb 24 14:58:02 ipcam1 user.info kernel: [ 14.589052] EXT4-fs (mmcblk0p2): mounted filesystem without journal. Opts: barrier=1,data=writeback Feb 24 14:58:02 ipcam1 user.warn kernel: [ 14.631995] EXT2-fs (mmcblk0p3): warning: mounting unchecked fs, running e2fsck is recommended Feb 24 14:58:02 ipcam1 user.info kernel: [ 15.068852] Installing knfsd (copyright (C) 1996 okir@monad.swb.de). Feb 24 14:58:02 ipcam1 user.warn kernel: [ 15.610003] svc: failed to register lockdv1 RPC service (errno 97). Feb 24 14:58:02 ipcam1 user.warn kernel: [ 16.053357] dsp: module license 'Proprietary' taints kernel. Feb 24 14:58:02 ipcam1 user.warn kernel: [ 16.053396] Disabling lock debugging due to kernel taint Feb 24 14:58:02 ipcam1 user.warn kernel: [ 16.212546] img: aaa_fifo2_base malloc c2ac0000 Feb 24 14:58:02 ipcam1 user.warn kernel: [ 17.014364] >>>>>> DSP LOG ADDR START PHY 0xc0080000 Feb 24 14:58:02 ipcam1 user.debug kernel: [ 17.014399] Init software HR timer for DSP communication Feb 24 14:58:02 ipcam1 user.info kernel: [ 17.148211] amba_debug_init 248:248. Feb 24 14:58:02 ipcam1 user.debug kernel: [ 21.478744] eth0: no IPv6 routers present Feb 24 14:58:12 ipcam1 user.warn kernel: [ 105.488909] ak4954 i2c probe Feb 24 14:58:12 ipcam1 user.warn kernel: [ 105.489160] ak4954 mode init Feb 24 14:58:12 ipcam1 user.info kernel: [ 105.527832] ak4954-codec 0-0012: AK4954 Audio Codec 0.1AK4954 probe Feb 24 14:58:12 ipcam1 user.warn kernel: [ 105.528034] ambarella-i2c ambarella-i2c.0: ambarella_i2c_stop[2] from 1 to 9 Feb 24 14:58:12 ipcam1 user.err kernel: [ 105.528199] ambarella-i2c ambarella-i2c.0: ambarella_i2c_irq in wrong state[0x9] Feb 24 14:58:12 ipcam1 user.err kernel: [ 105.528237] ambarella-i2c ambarella-i2c.0: status_reg[0x40] Feb 24 14:58:12 ipcam1 user.err kernel: [ 105.528261] ambarella-i2c ambarella-i2c.0: control_reg[0x3] Feb 24 14:58:13 ipcam1 user.err kernel: [ 106.518764] ambarella-i2c ambarella-i2c.0: No ACK from address 0x24, 0:0! Feb 24 14:58:13 ipcam1 user.err kernel: [ 106.518810] ambarella-i2c ambarella-i2c.0: I2C state 0x9, please check address 0x24! Feb 24 14:58:13 ipcam1 user.notice kernel: [ 106.626707] audio codec AK4954 initialized, 0! Feb 24 14:58:13 ipcam1 user.info kernel: [ 106.628264] asoc: ak4954-hifi <-> ambarella-i2s.0 mapping ok Feb 24 14:58:13 ipcam1 user.warn kernel: [ 106.899711] AK4954:set input volum 50 Feb 24 14:58:14 ipcam1 user.warn kernel: [ 107.589069] MT9T002 sensor ID is 0x2604 Feb 24 14:58:14 ipcam1 user.info kernel: [ 107.639019] CMEMK module: built on Aug 23 2012 at 17:05:43 Feb 24 14:58:14 ipcam1 user.info kernel: [ 107.639065] Reference Linux version 2.6.38 Feb 24 14:58:14 ipcam1 user.info kernel: [ 107.639083] File /mnt/data_bsp/data_yuhuanhuan/raptor/a5s_svn2/kernel/hik_drivers/cmem/src/module/cmemk.c Feb 24 14:58:14 ipcam1 user.info kernel: [ 107.646669] cmemk initialized Feb 24 14:58:16 ipcam1 user.debug kernel: [ 109.792261] set audio rates 8000Hz Feb 24 14:58:16 ipcam1 user.debug kernel: [ 109.866072] set audio rates 8000Hz Feb 24 14:58:20 ipcam1 user.warn kernel: [ 113.809752] EXT4-fs (mmcblk0p1): warning: mounting unchecked fs, running e2fsck is recommended Feb 24 14:58:20 ipcam1 user.info kernel: [ 113.843291] EXT4-fs (mmcblk0p1): mounted filesystem without journal. Opts: (null) Feb 24 14:58:29 ipcam1 user.info kernel: [ 121.633659] warning: process `ipc_sntptask' used the deprecated sysctl system call with 1.40. Feb 24 14:58:32 ipcam1 user.warn kernel: [ 125.354158] iav error: Failed to wait for completion! Feb 24 14:58:32 ipcam1 user.warn kernel: [ 125.424990] iav error: Failed to wait for completion! Feb 24 15:00:12 ipcam1 user.err kernel: [ 224.948902] ambarella-sd.0.0: ambarella_sd_send_cmd cmd18 timeout 2@1000, retries=0 Feb 24 15:00:12 ipcam1 user.warn kernel: [ 224.988909] mmcblk0: retrying using single block read Feb 24 15:03:05 ipcam1 auth.info login[1338]: root login on 'pts/1' Feb 24 16:12:55 ipcam1 user.notice kernel: [ 4587.910103] rpc-srv/tcp: nfsd: got error -32 when sending 140 bytes - shutting down socket Feb 24 17:47:33 ipcam1 auth.info login[1512]: root login on 'pts/1' Feb 24 20:52:23 ipcam1 auth.info login[1761]: root login on 'pts/1' Feb 24 23:17:45 ipcam1 daemon.notice rpc.mountd[754]: authenticated unmount request from 192.168.0.6:651 for /mnt/sd2 (/mnt/sd2) Feb 24 23:17:46 ipcam1 daemon.notice rpc.mountd[754]: authenticated unmount request from 192.168.0.6:652 for /mnt/mmc01 (/mnt/mmc01) Feb 25 09:37:46 ipcam1 daemon.notice rpc.mountd[754]: authenticated mount request from 192.168.0.6:956 for /mnt/mmc01 (/mnt/mmc01) Feb 25 09:37:46 ipcam1 daemon.notice rpc.mountd[754]: authenticated mount request from 192.168.0.6:699 for /mnt/sd2 (/mnt/sd2) Feb 25 10:35:10 ipcam1 auth.info login[2513]: root login on 'pts/1' Feb 25 10:58:07 ipcam1 auth.info login[2544]: root login on 'pts/1'

This will likely interest no one but me, but in the course of working on the camera, I've been annoyed by the lack of functionality with the installed tools (though in fairness to Hikvision they've put what's needed for most people). So I've cross compiled a new busybox to replace the old one. Original functions: Currently defined functions: ash, awk, bash, cat, chmod, cp, date, dd, df, dmesg, du, echo, env, false, fdisk, free, fsync, ftpget, ftpput, gunzip, gzip, halt, hwclock, ifconfig, inetd, init, insmod, iostat, kill, linuxrc, ln, login, ls, lsmod, mdev, mkdir, mkdosfs, mkfs.vfat, mknod, modprobe, mount, mpstat, mv, nanddump, nandwrite, netstat, ping, ping6, poweroff, ps, pwd, reboot, rm, rmmod, route, sed, sh, sleep, sync, tail, tar, telnetd, test, tftp, top, touch, true, umount, zcat My one with more tools: acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst, chroot, chrt, chvt, cksum, clear, cmp, comm, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, diff, dirname, dmesg, dnsd, dnsdomainname, dos2unix, du, dumpkmap, echo, ed, egrep, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flash_lock, flash_unlock, flashcp, flock, fold, free, freeramdisk, fsck, fsck.minix, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, hush, hwclock, id, init, insmod, install, ionice, iostat, ipcrm, ipcs, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln, loadfont, loadkmap, logger, login, logname, logread, losetup, ls, lsattr, lsmod, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs, mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nbd-client, nc, nice, nmeter, nohup, od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink, readprofile, realpath, reboot, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, seq, setarch, setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha512sum, showkey, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su, sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, test, time, timeout, top, touch, tr, traceroute, true, tty, ttysize, tunctl, tune2fs, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udpsvd, umount, uname, unexpand, uniq, unix2dos, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode, uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip I've put mine in /dav/opt and then run a script on boot to link functions which don't already exist: / # cat /dav/opt/busybox.sh for FUNC in `/dav/opt/busybox --list-functions`; do ln -s /dav/opt/busybox /"$FUNC" done This gives things like syslogd and klogd as well as things I use a lot like vi, grep, strings, less, md5sum etc. You can also use busybox to run a full http, smtp, pop server etc on the camera but i don't need those. Being about to telnet from the camera to other places has proved helpful though.