Anran AR-24NB-IP partial funtion after FW update

G33RT

G33RT

n3wb
Apr 15, 2017
24
1
Belgium
Hi to all,

After I update the firmware of a Anran AR-24NB-IP this camera only partial funtion afterwards.
It works very slow when login to web-if and no video anymore only black video window.
Also it display two available video channels I never had that before.

I downloaded the firmware 00001532 = IPC_HI3516C_53H20L
As 1532 was what I saw when I checked the camera current version.

This is the firmware I flashed:
General_HZXM__IPC_HI3516C_53H20L_RT3070_V4.02.R11.Nat.OnvifS.20160615_ALL.bin

Now at the moment I even have no web-if access anymore, don't now why.

At the serial output I see the the board is bootting two or sometimes three times but no response at port 80 or 34567, only TCP port 9527 is available.

Code: 
U-Boot 2010.06-svn (Oct 14 2015 - 15:02:08)

DRAM:  256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128"
envcrc 0xc9686887
ENV_SIZE = 0x3fffc
In:    serial
Out:   serial
Err:   serial
Press Ctrl+C to stop autoboot
CFG_BOOT_ADDR:0x58080000
16384 KiB hi_sfc at 0:0 is now current device

### boot load complete: 1973968 bytes loaded to 0x82000000
### SAVE TO 80008000 !
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   linux
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1973904 Bytes = 1.9 MiB
   Load Address: 80008000
   Entry Point:  80008000


load=0x80008000,_bss_end=80829860,image_end=801e9e90,boot_sp=80797168
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.


Can I somehow reflash or repair the firmware with the bootloader?
The firmware contains these files:
Code: 
Install
u-boot.bin.img
u-boot.env.img
web-x.cramfs.img
custom-x.cramfs.img
user-x.cramfs.img
romfs-x.cramfs.img
InstallDesc

Any help is welcome.
 
@ port 9527 I connect PuTTY as Telnet and receive continious this debug message:

Code: 
[DEBUG]: Libfvideo:  Mpp!
[DEBUG]: Product_Info: 0
[DEBUG]: Product_SubInfo : LAN
LIBDVR : will save NID = 000000, g_fd = 9
LIBDVR : Save environment to flash ,Please wait ......
LIBDVR : Note!! don't power off
LIBDVR : Save Ok

LIBDVR : will save NID = 000000, g_fd = 9
LIBDVR : Save environment to flash ,Please wait ......
LIBDVR : Note!! don't power off
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
Video - CaptureSetTitleV2: HI_MPI_RGN_GetAttr (0) failed with 0xa0128005!
LIBDVR : Save Ok
 
G33RT said:
Can I somehow reflash or repair the firmware with the bootloader?
Click to expand...
Very likely - if you can find the correct firmware for the device.
Where did you obtain the firmware that you flashed, and how do you know for sure that it is the correct one for the camera?

Suggestion :
Interrupt the bootloader and see what commands there are that can update the flash.
Use 'help' then 'help <command>' to get info.
But don't try any speculatively - they can be destructive with no way back.
 
  • Like
Reactions: G33RT
alastairstevenson said:
Very likely - if you can find the correct firmware for the device.
Where did you obtain the firmware that you flashed, and how do you know for sure that it is the correct one for the camera?

Suggestion :
Interrupt the bootloader and see what commands there are that can update the flash.
Use 'help' then 'help <command>' to get info.
But don't try any speculatively - they can be destructive with no way back.
Click to expand...

Okay, I admid I could made have flashed a wrong firmware as I'm not 100% sure it was the right one.
Thought if you accedently flash the wrong firmware you would be notify by some error, apparently NOT...

The firmware I got is from: www.xiongmaitech.com (thought these are refference firmwares for all IPC boards).
Normaly I go here for new firmware but these links do not work anymore: Chinese IP camera configuration & firmware | Technology News

I was able to interrupt the bootloader.
Look below what the 'help' command spits out:

Code: 
U-Boot 2010.06-svn (Oct 14 2015 - 15:02:08)

DRAM:  256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128"
*** Warning - bad CRC, using default environment

Erasing SPI flash, offset 0x00040000 size 256K ...done
Writing to SPI flash, offset 0x00040000 size 256K ...done
In:    serial
Out:   serial
Err:   serial
Press Ctrl+C to stop autoboot
hisilicon #
hisilicon # help
?       - alias for 'help'
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
fload   - fload  - load binary file from a filesystem image for system boot

flwrite - SPI flash sub-system
getinfo - print hardware information
go      - start application at address 'addr'
help    - print command description/usage
lip     - lip      - set local ip address but not save to flash

loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
mac     - mac      - set mac address and save to flash

md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
sip     - sip      - set server ip address but not save to flash

tftp    - tftp  - download or upload image via network using TFTP protocol
version - print monitor version
hisilicon #

printenv command output:
Code: 
hisilicon # printenv
bootargs=mem=${osmem} console=ttyAMA0,115200 root=/dev/mtdblock1 rootfstype=cramfs mtdparts=hi_sfc:512K(boot),5M(romfs),7424K(user),1536K(web),256K(custom),256K(logo),1280K(mtd)
bootcmd=setenv setargs setenv bootargs ${bootargs};run setargs;fload;bootm 0x82000000
bootdelay=1
baudrate=115200
ipaddr=192.168.1.10
serverip=192.168.1.107
netmask=255.255.255.0
bootfile="uImage"
da=tftp 0x82000000 u-boot.bin.img;sf probe 0;flwrite
du=tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwrite
dr=tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwrite
dw=tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwrite
dl=tftp 0x82000000 logo-x.cramfs.img;sf probe 0;flwrite
dc=tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwrite
up=tftp 0x82000000 update.img;sf probe 0;flwrite
ua=mw.b 0x82000000 ff 1000000;tftp 0x82000000 upall_verify.img;sf probe 0;flwrite
tk=tftp 0x82000000 uImage; bootm 0x82000000
dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwrite
osmem=64M
ethaddr=ed:1a:40:2f:00:00
HWID=8043420000030000
NID=000000
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-svn (Oct 14 2015 - 15:02:08)

Environment size: 1133/262140 bytes
hisilicon #
 
Last edited:
G33RT said:
printenv command output:
Click to expand...
That's good - I was going to suggest dumping the environment variables to see if there were any clues for the model number.
They are certainly similar to how Dahua have these organised.
What you can see is that there should be no problem using the bootloader to write the flash, given suitable firmware files. That's the key.
But avoiding touching u-boot, as a bad choice there could really kill the camera.

Try also the devinfo command to see if it gives anything useful.
There might be a match with the contents of the Install and InstallDesc files in the firmware, take a look at these, they will be text.

What would be helpful would be finding the command or variable value to maintain the serial console through the whole boot process, to see why the camera does not function normally.
With the firmware being similar to that being explored by @divx118 I'm wondering if he found the way to do that.
I've seen 'dh_keyboard' being set to 0 on Dahua firmware, and 'ptzsupport' being set to 0 on some Chinese firmware to enable a persistent serial console.
But both of those were already defined - there is nothing obvious in your list.
 
Unfortunately the command 'devinfo' is not recognized.

Code: 
hisilicon # devinfo
Unknown command 'devinfo' - try 'help'

What about that hardware ID ?
Code: 
HWID=8043420000030000
 
Last edited:
Also the command 'getinfo' gives me nothing about the hardware:
Code: 
hisilicon # getinfo
getinfo - print hardware information

hisilicon #
 
I have managed to get Telnet access with the tool called OpenTelnet, login: root passw: xmhdipc

Code: 
LocalHost login: root
Password:
Welcome to Monitor Tech.
#
# ls
bin      etc      linuxrc  proc     share    tmp      var
boot     home     mnt      root     slv      usr
dev      lib      opt      sbin     sys      utils
#
#

I'm trying to get some hardware information and it says Hi3518 as I'm 100% sure its a Hi3516 CRBCV100 SoC.

Code: 
# cat /proc/cpuinfo
Processor       : ARM926EJ-S rev 5 (v5l)
BogoMIPS        : 218.72
Features        : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant     : 0x0
CPU part        : 0x926
CPU revision    : 5

Hardware        : hi3518
Revision        : 0000
Serial          : 0000000000000000

Code: 
# cat /proc/partitions
major minor  #blocks  name

  31        0        512 mtdblock0
  31        1       5120 mtdblock1
  31        2       7424 mtdblock2
  31        3       1536 mtdblock3
  31        4        256 mtdblock4
  31        5        256 mtdblock5
  31        6       1280 mtdblock6
#

Where do we go from here ?
 
Last edited:
I found some more information on the camera:

SoC Chip: Hi3516C V100
Camera module: 53H20L
Image sensor: OV9712


Code: 
# cd utils
# ls
upgraded
# upgraded
LibCrypto : g_cryptotype = 0
**********************************************************************
|                      SYSTEM INFO
|                 ID:           8043420000030000
|       product type:           unknow: 0
|            product:           53H20L
|      video channel:           32
|      audio channel:           32
|           alarm in:           6
|          alarm out:           0
| forward video chip:           OV9712
|           DSP chip:           unknow: 0
|  analog audio mode:           voice codec
|           talkback:           voice codec
|    back video chip:           no chip
|    store interface:           SDIO
|    matrix surpport:           No
| wireless interface:           USB
|    hardware encode:           encode chip
|   hardware version:           1
|    video_interface:           BNC
|      net_interface:           Ethernet
|  hardware info len:           8
**********************************************************************
LIBDVR: Complied at Apr 29 2016 15:11:58 SVN:1379
00:27:44|info  upgrade:V1.11(FLASH_8M)@20130626Start Program, SIGPIPE
Socket Bind     Error
Unexpect Error
#

Now I have the correct firmware to flash but I need this to do via the bootloader, is there some step-by-step manual on this?
 
G33RT said:
I found some more information on the camera:
Click to expand...
That looks useful but as it doesn't have any individual-camera-specific info such as a serial number or MAC address - is there a chance the origin is from the apparently incorrect firmware that has been applied?
The product code matches what you've listed for the firmware that was applied that's caused the problem.
Just being devils's advocate.
 
Since I never done this via serial console can you give me an example of the commands I have to use?
I can transfer the file or files via bootloader "loady 0x8?000000" command and sent binaries via Y-modem protocol.

I also seen somewhere that whole firmware is flashed via this way but I can't find it anymore, any ideas?
 
G33RT said:
Since I never done this via serial console can you give me an example of the commands I have to use?
Click to expand...

You've already got the ipaddr and serverip IP addresses set.
You'd need a tftp server at the serverip address, with the split down files in it's directory.
All the activity would be done at the bootloader prompt.

Suggestion, what I would do :

Split down the firmware into its components.
Check the contents of Install and InstallDesc - they are likely to be text files - to see if there are any clues.
Try updating - one at a time then reboot -
the rootfs with the 'run dr' command
the web server files with the 'run dw' command.

Good luck!
 
Seems that I still have the wrong firmware.
The manufacturer does not have the firmware anymore (don't want to do some effort) to help me.
So close but no cigar.

I update this threat if I succeed.
 
I another strange thing.

The bootloader report a (Macronix) MX25L128 flash chip but there is no such chip on the PCB.
The flash chip on the PCB is actually a (Atmel) AT88SC0104CA

Could this be Pro-programmed in the bootloader or some config?

Code: 
U-Boot 2010.06-svn (Oct 14 2015 - 15:02:08)

DRAM:  256 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128"
*** Warning - bad CRC, using default environment

Erasing SPI flash, offset 0x00040000 size 256K ...done
Writing to SPI flash, offset 0x00040000 size 256K ...done
 

Attachments

You must log in or register to reply here.
Top Bottom