Hi, I've tested upgrade / restore functunality of the tool and it fails on my devices I have some devices to test and can flash ofw back, how should I debug the flash process?

Also, should i upload a dump somewhere? I did not see the hunter streamer binary anywhere

/tmp # ./ipctool
---
chip:
  vendor: HiSilicon
  model: 3516CV300
ethernet:
  mac: "e0:61:b2:4e:a6:ff"
  u-mdio-phyaddr: 1
  phy-id: 0x001cc816
  d-mdio-phyaddr: 0
rom:
  - type: nor
    block: 64K
    partitions:
      - name: boot
        size: 0x40000
        sha1: 48195e9b
        contains:
          - name: uboot-env
            offset: 0x20000
      - name: defcfg
        size: 0x10000
        sha1: 67d9fc96
      - name: kernel
        size: 0x1f0000
        sha1: 7625fbaa
      - name: root
        size: 0x960000
        path: /,squashfs
        sha1: cb44f590
      - name: custom
        size: 0x400000
        sha1: f427120a
      - name: config
        size: 0x60000
        sha1: 928813b9
    size: 16M
    addr-mode: 3-byte
ram:
  total: 256M
  media: 144M
firmware:
  kernel: "3.18.20 (Wed Apr 4 14:46:18 CST 2018)"
  toolchain: gcc version 4.9.4 20150629 (prerelease) (Hisilicon_v500_20150831)
  libc: uClibc 0.9.33.2
  sdk: "Hi3516CV300_MPP_V1.0.1.0 B070 Release (Feb 13 2017, 20:42:49)"
  main-app: hunter
sensors:
- vendor: Sony
  model: IMX323
  control:
    bus: 0
    type: i2c
    addr: 0x34
  data:
    type: DC
  clock: 37.125MHz

~ # cat /proc/partitions
major minor  #blocks  name

  31        0        256 mtdblock0
  31        1         64 mtdblock1
  31        2       1984 mtdblock2
  31        3       9600 mtdblock3
  31        4       4096 mtdblock4
  31        5        384 mtdblock5
~ # cat /proc/mounts
rootfs / rootfs rw 0 0
/dev/root / squashfs ro,relatime 0 0
devtmpfs /dev devtmpfs rw,relatime,size=53760k,nr_inodes=13440,mode=755 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /tmp tmpfs rw,relatime 0 0
tmpfs /var tmpfs rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
/dev/mtdblock4 /mnt/special squashfs ro,relatime 0 0
/dev/mtdblock5 /mnt/mtd jffs2 rw,sync,relatime 0 0

~ # dmesg | grep hisi_spi_nor.0
hisi-sfc hisi_spi_nor.0: all blocks is unlocked.
hisi-sfc hisi_spi_nor.0: gd25q128 (16384 Kbytes)

/tmp # ./ipctool upgrade upgrade.cv300
There was no Sofia process detected
Use --force switch to skip the check
aborting...
/tmp # ./ipctool upgrade upgrade.cv300 --force
There was no Sofia process detected
Unmounting /mnt/special
Unmounting /mnt/mtd
Using 'upgrade.cv300' as upgrade bundle
        boot    0xb68d4010, size: 262144 bytes
        env     0x63010, size: 65536 bytes
        kernel  0xb66f3010, size: 1966080 bytes
        rootfs  0xb6272010, size: 4718592 bytes
Analyzing boot
Analyzing env
Analyzing kernel
Analyzing rootfs
Upgrading boot
Flashing [wwww]
Upgrading env
Flashing [w]
Upgrading kernel
Flashing [wwwwwwwwwwwwwwwwwwwwwwwwwwwwww]
Upgrading rootfs
Could not open mtd device: 46.....................................................]

Something went wrong, aborting...
Early exit, check the logs

/tmp # ./ipctool restore bak
Restoring the backup

Loading backup from file bak...
Are you sure to proceed? (y/n)? y
Checking boot...
[0] 0x00000000  0x00040000      48195e9b        48195e9b
Checking defcfg...
[1] 0x00040000  0x00010000      67d9fc96        67d9fc96
Checking kernel...
[2] 0x00050000  0x001f0000      7625fbaa        7625fbaa
Checking root...
[3] 0x00240000  0x00960000      cb44f590        cb44f590
Checking custom...
[4] 0x00ba0000  0x00400000      f427120a        f427120a
Not checked (no SHA1)
[5] 0x00fa0000  0x00060000           n/a
Backups were checked
Analyzing boot
Analyzing defcfg
Analyzing kernel
Analyzing root
Analyzing custom
Analyzing config
Restoring boot
Flashing [wwww]
Restoring defcfg
Flashing [w]
Restoring kernel
Fail to erase +0x40000...................]

Something went wrong, aborting...

Hi all, First, thanks for the wonderful work done on ipctool. I have a vanilla Goke GK7205V300 SoC with http admin access and would like to install ipctool. From the ipctool installation instructions, it seems I need to have some kind of terminal connection to the SoC. I did a nmap, and port 23 is open, so I should be able to telnet and install ipctool, but when asked for login/password, I don't know what to put.

Is there any other way to install ipctool, or do you know how we can telnet to this SoC? I do have admin access through http.

Thanks in advance for your help. Best, Jérôme.

FYI nmap results:

nmap -v -sV -sT -p- -oA nmap_full 192.168.8.130
Starting Nmap 7.80 ( https://nmap.org/ ) at 2022-11-04 12:47 CET
NSE: Loaded 45 scripts for scanning.
Initiating ARP Ping Scan at 12:47
Scanning 192.168.8.130 [1 port]
Completed ARP Ping Scan at 12:47, 0.06s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:47
Completed Parallel DNS resolution of 1 host. at 12:47, 0.00s elapsed
Initiating Connect Scan at 12:47
Scanning e0:3c:5b:95:ac:06 (192.168.8.130) [65535 ports]
Discovered open port 23/tcp on 192.168.8.130
Discovered open port 80/tcp on 192.168.8.130
Discovered open port 8080/tcp on 192.168.8.130
Discovered open port 554/tcp on 192.168.8.130
Discovered open port 3210/tcp on 192.168.8.130
Discovered open port 8554/tcp on 192.168.8.130
Discovered open port 13452/tcp on 192.168.8.130
Discovered open port 1935/tcp on 192.168.8.130
Completed Connect Scan at 12:47, 9.53s elapsed (65535 total ports)
Initiating Service scan at 12:47
Scanning 8 services on e0:3c:5b:95:ac:06 (192.168.8.130)

Hello!

Using openipc 2.1 firmware for xm530. ipctool does not detect any sensor. Majestic only works in hls h265 mode, mp4, jpg, rtsp does not work... Only some i2c_write timeout is shown in the kernel log.

[email protected]:~# ipctool --sensor_id
[email protected]:~# dmesg -c
i2c_write timeout 0x2
i2c_write timeout 0x2
i2c_write timeout 0x2
i2c_write timeout 0x2
i2c_write timeout 0x2

This is the setting file from the original firmware:

[email protected]:~# cat /mnt/mtd/Config/SensorType.bat
snsType:55

Can I provide some more info from /proc/* ?

Executing ipc_chip_info produces an error "Error: unexpected value for SmartSens == 0x1145" for the --sensor_id part. It is run in a camera doorbell device

# cat /proc/cpuinfo 
Processor       : ARM926EJ-S rev 5 (v5l)
BogoMIPS        : 269.10
Features        : swp half fastmult edsp java 
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant     : 0x0
CPU part        : 0x926
CPU revision    : 5

Hardware        : hi3518ev200

Full ipc_chip_info output:

# ./ipc_chip_info 
---
chip:
  vendor: HiSilicon
  model: 3518EV200
ethernet:
  mac: "*****"
rom:
  - type: nor
    size: 8M
    block: 64K
    partitions:
      - name: boot
        size: 0x60000
      - name: kernel
        size: 0x200000
      - name: rootfs
        size: 0x280000
      - name: rom
        size: 0x50000
      - name: app
        size: 0x2d0000
Error: unexpected value for SmartSens == 0x1145

Does it mean, that this type of sensor is not supported by OpenIPC?

Прошу добавить в утилиту возможность получения и отображения ID SPI чипа и его производителя. Примеры описания и кода приведены по ссылками ниже. Спасибо.

https://www.emcraft.com/stm32f769i-discovery-board/accessing-spi-devices-in-linux https://armbedded.taskit.de/node/318

My MIPS-based camera has a tftp binary and no NFS support on mount, therefore:

On a desktop machine

$ pip install ptftpd
$ ptftpd -p 6969 en0 /Users/rvalls/Downloads

On the embedded device (camera)

# tftp -r /Users/rvalls/Downloads/ipctool-mips32 -g 192.168.1.107 6969

/Users/rvalls/Downlo  46% |**************                 | 61952   0:00:01 ETA
/Users/rvalls/Downlo  97% |****************************** |   126k  0:00:00 ETA
/Users/rvalls/Downlo 100% |*******************************|   129k  0:00:00 ETA
/Users/rvalls/Downlo 100% |*******************************|   129k  0:00:00 ETA

Then the resulting YAML file for this camera with this bootlog looks like this:

/tmp # ./ipctool-mips32 
---
chip:
  vendor: Ingenic
  model: T10
ethernet:
  mac: "40:ffaa:56:32:13:ff"
rom:
  - type: nor
    block: 32K
    partitions:
      - name: boot
        size: 0x40000
        sha1: 3ed97345
      - name: kernel
        size: 0x190000
        sha1: 5e503445
      - name: root
        size: 0x300000
        sha1: c67bd327
      - name: appfs
        size: 0x330000
        path: /system,jffs2,rw
    size: 8M
ram:
  total: 64M
  media: 0M
firmware:
  kernel: "3.10.14 (PREEMPT Tue Oct 30 18:55:41 PDT 2018)"
  toolchain: gcc version 4.7.2 (Ingenic r2.3.3 2016.12) 
  libc: uClibc 0.9.33.2

It didn't really collect any information about the sensor, UBoot version, etc... like the example on the README.md though :/

Thanks @ZigFisher for your assistance over Gitter!

This code allows us to get excellent information about the processors of the first group

for hieth in $(ls -l /sys/module/hieth/parameters | awk '{print $9}'); do echo ${hieth}=$(cat /sys/module/hieth/parameters/${hieth}); done

mdioifd=1 mdioifu=1 phyaddrd=1 phyaddru=0

Please add the information in some other order, see the example.

---
chip:
  vendor: HiSilicon
  model: 3518EV100
ethernet:
  mac: "00:00:23:34:45:66"
  mdioifu: 1
  mdioifd: 1
  phyaddru: 1
  phyaddrd: 0
......

Note: mdioifX 0=mii, 1=rmii

TNX !

P.S. It would be very good to find the same data for other processor groups, but I haven't been able to do it yet..

172.17.32.51# ./ipc_chip_info 
Chip: HiSilicon 3516cv300
Sensor: Sony IMX323

172.17.32.52# ./ipc_chip_info 
Chip: HiSilicon 3516cv300
Sensor: Sony IMX323

cat /proc/umap/sys on both shows ar0237 type but Sofia detects as SC2235:

[DEBUG]: mirror=0
[DEBUG]: Flip=0
[DEBUG]: ~~~~~~~~~~SC2235_init  JJ ~~~~~~~~~
[DEBUG]: Denoise level:  Day[3]      Night[3]
[DEBUG]: Denoise level:  Day[3]      Night[3]
[DEBUG]: IR: 65

Reported by @Bertrand_dHerouville in OpenIPC.org (EN) telegram channel.

[email protected]_HI35xx:/tmp# ./ipc_chip_info
Chip: HiSilicon 3518?v100
Open /dev/i2c-0 error!
CMD_SET_DEV error!
CMD_SET_DEV error!
CMD_SET_DEV error!
CMD_SET_DEV error!

It seems it's a different chip:

By the way it also reported in kernel logs as:

[    0.000000] Machine: hi3518
[    0.000000] Ignoring unrecognised tag 0x54410010

Sample output for OpenWRT:

[email protected]:/mnt/sd/mpp/ko# cat /etc/os-release 
NAME="OpenWrt"
VERSION="SNAPSHOT"
ID="openwrt"
ID_LIKE="lede openwrt"
PRETTY_NAME="OpenWrt SNAPSHOT"
VERSION_ID="snapshot"
HOME_URL="https://openwrt.org/"
BUG_URL="https://bugs.openwrt.org/"
SUPPORT_URL="https://forum.openwrt.org/"
BUILD_ID="r13272+2-367a30389d"
OPENWRT_BOARD="hi35xx/18ev200"
OPENWRT_ARCH="arm_arm926ej-s"
OPENWRT_TAINTS="no-all busybox"
OPENWRT_DEVICE_MANUFACTURER="OpenWrt"
OPENWRT_DEVICE_MANUFACTURER_URL="https://openwrt.org/"
OPENWRT_DEVICE_PRODUCT="Generic"
OPENWRT_DEVICE_REVISION="v0"
OPENWRT_RELEASE="OpenWrt SNAPSHOT r13272+2-367a30389d"

172.17.32.53# ./ipc_chip_info 
Chip: HiSilicon 3518?v100
Open /dev/i2c-0 error!
CMD_SET_DEV error!
CMD_SET_DEV error!
CMD_SET_DEV error!
# ls -l /dev|grep i2c
crw-rw----    1 root     root       10,  47 Jan  1  1970 hi_i2c

# cat /var/cfg/Ver.ini
[VERSION]
sofvar=RV1109_IMX335NAND_BVH0L0A0T0Q0_W_21.1.36.6

it could be sofvar=3516CV500_IMX307_B1T1A1M0C0P1_W_9.1.53.1 as well

Since NFS (perm error), bin2sh and other methods did not work I came up with another (automated) method to upload ipctool. busybox with uudecode needed on target

Proof-of-concept:

#!/usr/bin/env python

#encode file with uuencode -m ipctool ipctool > ipctoolu
#run script with  python sender.py --host IP ipctoolu

import argparse
import telnetlib
from tqdm import tqdm


argparser = argparse.ArgumentParser()
argparser.add_argument('--host', required=True)
argparser.add_argument('--port', type=int, default=23)
argparser.add_argument('--user', type=str, default="root")
argparser.add_argument('--password', type=str, default="ivideo")
argparser.add_argument('src')
args = argparser.parse_args()

# Connect to the cam
t = telnetlib.Telnet(args.host, args.port)
#t.set_debuglevel(4)

# handle login prompt
t.read_until(b'(none) login: ', timeout=1)
t.write(args.user + b'\n')

t.read_until(b'Password: ', timeout=1)
t.write(args.password + b'\n')

#bad test if we are logged in
print("If this takes 10+ secs something is wrong...")
expected_sh = b'~ # '
t.read_until(expected_sh, timeout=10)
t.write(b'echo "test" > /tmp/testf\n')
t.read_until(expected_sh, timeout=10)
print("Did it? I am too lazy to implement a check xD")

#load file
payload = open(args.src, 'r')
Payload_Lines = payload.readlines()

expected_sh_2 = b"/tmp # "

print("If this takes 10 secs something is wrong...")
t.write(b'cd /tmp;F=payload;true>$F;chmod +x $F\n')
r = t.read_until(expected_sh_2, timeout=10)

print("Pushing file, go and grab a coffee :)")
for line in tqdm(Payload_Lines):
    t.write(b'echo "' + line.strip() + '" >> $F' + b'\n')
    r = t.read_until(expected_sh_2, timeout=10)

print("Captain speaking: File arrived at destination, we are now going to convert it back. hehe")
#decode on target
t.write(b'busybox uudecode payload\n')
r = t.read_until(expected_sh_2, timeout=5)
#make executable on target
t.write(b'chmod +x ipctool\n')
r = t.read_until(expected_sh_2, timeout=5)

print("Done :)")

Hi, any chance of some instructions on how to run ipctool from an sdcard, serial connection or from micro USB? Im having trouble setting up a tftp connection.

The data is obtained on the original firmware

| Engraving |/sys/class/mstar/msys/CHIP_ID|/sys/devices/soc0/soc_id |/sys/devices/soc0/machine | |--- |--- |--- |--- | | SSC337DE | 0xF2 | 242 | INFINITY6B0 SSC009B-S01A QFN128 |

Recently I found this output of information. Perhaps it will be useful when researching the original firmware.

[email protected]:~# cat /sys/devices/soc0/machine

INFINITY6B0 SSC009A-S01A QFN88