Help identify bricked PTZ camera

[vmsguy]

Hello,
First post here, but have been actively reading ipcamtalk forums for past few weeks.

I applied what I thought was a new version of firmware for this camera, but the firmware bricked the camera.
I've tried reaching out to the vendor on Amazon to get a copy of the original firmware but have not had any luck yet.

The camera still boots, and is listening on ports 23, and 20203. The default IP address before and after errant firmware is 192.168.1.110.
When I putty to port 23, I get "ipc login:" as the prompt, but none of the passwords I have tried for root will work. When I putty to 20203, the camera just echos back whatever is typed.

I have tinkered around in the past flashing devices with an rs-232 interface, so I feel fairly confident I can recover this camera if I can identify its origins
and find some firmware that will work with it.

Thanks for any help,

Brent

Here are some pictures: (i still need to take camera module apart to get more details)

 

[vmsguy]

Also, here is the orginal Amazon listing: https://www.amazon.com/gp/product/B01DT3RMJQ/ref=oh_aui_detailpage_o01_s00?ie=UTF8&psc=1

Brent

 

[nayr]

wow you dont even know what who makes the camera, yet you did a firmware update anyhow..

 

[klasipca]

I have seen this ui in a generic cam. Even Longse had it I believe

 

[vmsguy]

wow you dont even know what who makes the camera, yet you did a firmware update anyhow..

Probably a little of both.

 

[VorlonFrog]

Is that 'vms' the Digital/Compaq/HP operating system, or like multiple virtual machines?
If it's the o/s, howdy from a long-time VMS user/operator/manager.
If it's a bunch of virtual machines, sorry to have bothered you.

 

[alastairstevenson]

@vmsguy

I applied what I thought was a new version of firmware for this camera

I wonder if the eLinux now running is the original or from that firmware.
A link to the firmware and we'll see what's in it.

 

[klasipca]

Longse PTZ with the same UI:
http://www.aliexpress.com/item/7-Inch-2MP-High-Speed-Dome-PTZ-IP-Camera-1080P-22X-Optical-Zoom-IR-120M-Day/32602762844.html?spm=2114.01010208.3.1.Ryhip6&ws_ab_test=searchweb201556_0,searchweb201602_5_10057_10056_10037_10055_10054_301_10059_10033_10058_10032_10017_10060_10061_10052_414_10062_10053_413_10050_10051,searchweb201603_9&btsid=7c3c7e5a-9b23-46ca-a3ba-75d336fe0648


Longse firmware site:
http://www.herospeed.net/en/index.php?m=content&c=index&a=lists&catid=9

 

[VorlonFrog]

I'd guess the console serial port is that small 4-pin connection, next to the QC sticker. The right-most pin appears to be GND, but that's just a guess. A meter could tell you for certain. The other three pins would be TX, RX, and probably a 3.3VDC input. All you need are GND, TX, and RX.

 

[vmsguy]

Is that 'vms' the Digital/Compaq/HP operating system, or like multiple virtual machines?
If it's the o/s, howdy from a long-time VMS user/operator/manager.
If it's a bunch of virtual machines, sorry to have bothered you.

yes, worked for DEC from '84 to '94 in software services, great time to work there, left just after Palmer took over and theCompaq deal.

brent

 

[alastairstevenson]

The PTZ 3rd from the bottom has descriptive text matching the Amazon product info.
Of course it could just be a copy/paste job - but maybe not:
http://www.sanan-cctv.com/product.php?id=96
Unfortunately no firmware download links, but there is contact info here : http://sanan-cctv.en.made-in-china.com/

 

[vmsguy]

Thanks for the replies so far, I'll check out some of the links to see what I can find.
Brent

 

[vmsguy]

@vmsguy

I wonder if the eLinux now running is the original or from that firmware.
A link to the firmware and we'll see what's in it.

I put a copy of the firmware here: http://webpages.marshall.edu/~maynard169/firmware/app.ifu

Found this firmware by searching for the model number I found in the GUI prior to bricking.

 

[klasipca]

The PTZ 3rd from the bottom has descriptive text matching the Amazon product info.
Of course it could just be a copy/paste job - but maybe not:
http://www.sanan-cctv.com/product.php?id=96
Unfortunately no firmware download links, but there is contact info here : http://sanan-cctv.en.made-in-china.com/

Longse PTZ with the same UI:
http://www.aliexpress.com/item/7-Inc...a-75d336fe0648


Longse firmware site:
http://www.herospeed.net/en/index.ph...=lists&catid=9

 

[klasipca]

Actually here exactly same Longse camera

http://longse.com/Info/View_pro.asp?id=1077

 

[alastairstevenson]

I put a copy of the firmware here: http://webpages.marshall.edu/~maynar...rmware/app.ifu

That's a weird link - I just get a page of apparent HTML that messes with the browser.
Looks like @klasipca has nailed it.

 

[VorlonFrog]

username/password: admin/123456

At least that's what's embedded in the /SERVER/Linux/hiapp binary.
You might also try HANKVISION/HANKVISION just for grins.

Here's someone else's investigation into similar firmware.

 

[VorlonFrog]

(duplicate post deleted)

 

[vmsguy]

Sorry about that, that was the actual firmware file, here is the folder

http://webpages.marshall.edu/~maynard169/firmware

 

[alastairstevenson]

Still an HTML file for me.
Maybe you have an app installed that handles '.ifu' files, whatever they are.
I need to disappear off to bed now - I'd been going to see what passwd hashes there were in the firmware you loaded, so maybe you could get root shell access.
But I see that a certain @VorlonFrog beat me to it by some devious method.