Diary of a Dericam S2 madman

WooHoo4me

n3wb
Joined
Nov 21, 2022
Messages
4
Reaction score
9
Location
wichita, ks
My first post for help here...
I'm a bit new to IP camera internals so please forgive my ignorance.
I have a Dericam S2-32G I bought about 5 years ago -for my mom's house.

I ended up owning it, and it has been a good PTZ camera. Then about 2 years ago it's pan/tilt quit working.
On power-up it runs its normal pan/tilt/zoom sweeps as it initializes, but then the only thing that works
on command is optical ZOOM and autofocus.
Inside, the servos are in like-new condition and the gearing still has clean fish grease.
I have reason to suspect the problem is controller firmware NOT hardware since the thing will pan/tilt
and zoom upon initialization.

I run Blue Iris 5 (been using BI since V3) and the Dericam client, and ODM, but none of these cause
the camera to respond [via wifi or ethernet] to pan or tilt commands, so I have reason to believe that
just a firmware reprogram may cause the cam to re-awaken and allow for use as an intended PTZ imager.
Numerous hard resets and factory defaults did not correct. I have yet to try telnet or my bus pirate...

At one time I had a network IP address conflict that caused two of my PTZ cams to quit pan/tilt, but once
resolved the problem went away. Such has not been the case with this dericam.

Yeah, I know some of you have low regard for dericam...me too, but I've been inside several cameras and the
dericam is flimsy plastic and moderately funky electronics in comparison. On a 1-10 scale I give it a 4.
Anyway, I have it and it has reasonably good imagery and it's sacrificial free to play with.

I have been in contact with dericam and their response is typical of the far east biz. <knuckleheads>
So, I'm left with a learning curve.
Does GitHub have anything open-source for the HI3516?

This model S2 Dericam uses the HI3516 CRBCV200 (CV200) SOC mounted to pcb 16VC2_38M_2.0
The pan/tilt servos are 5 volt Maintex 24byj 20 and 28
Imager: IMX323
PTZ controller: PTZ_12V_V1.2
Device type: C6F0SgZ3N0P0L0
Software Version: V10.3.21.1.8 (presently installed)
Software Client: 0

There is, however an overriding issue:
Vulnerability.
CVE-2019-11560 sez firmware V11.3.8.1.12 and below is a level 10 Critcal Severity to buffer overflow attack
that can accomplish total compromise of the attached host. I shudder to think this is actually going on.
This is not unique to dericam alone...foscam, FDT and Tenvis among others affected, since the firmware is
targeted for the HISense 3516 SOC and any camera brand/model using this chip.

Is there any IPC firmware for this chip that has a corrective patch?

Thanks!
 

Flintstone61

Known around here
Joined
Feb 4, 2020
Messages
6,624
Reaction score
10,954
Location
Minnesota USA
So are you aware of a numerical limit setup in some PTZ's shutting down the cam movement after so many reps? And that factory resets don't change it?
 
Top