HiSilicon 'cheapy' camera, unencrypted firmware

[Purduephotog]

I have a cheapie IMX291 from Ali that I've been playing with, and the firmware (which kindly is online) is un-encrypted. Appears to be a number of squash-fs systems, and all IMG files to boot.

Binwalk does a pretty good job tearing it down though there is one archive that doesn't seem to decompress (7z from the header, but keeps spitting out the same file). I'll work on that later.

Specifically though I'm looking for anyone with familiarity with this- I can't access via the standard configs the gain parameters. I know there are more out there, as another package that doesn't respect the settings gives me options for sharpness. The gain is there as well but it's grey'd out.

Anyone work with the HiSilicon chipsets that could give me a pointer to start from? It's got Sofia on it (and Squirrel. I love this).

Thanks!

40520

1/26/2018

HP201NY / HP203NY​

Hi3516E V100 + IMX323 / IMX291​

8.3Mb​

http://hasecurity.com/HL_DownloadTheFirmware.aspx?EyDDBL7ZvmQ&

 

[alastairstevenson]

Anyone work with the HiSilicon chipsets that could give me a pointer to start from? It's got Sofia on it (and Squirrel. I love this).

This may - or may not - help :
I unpacked the firmware, had a look around, and targeted what might be a pointer to what you are looking for.
But this is a cramfs (ie read-only) file, this will be the 'reset to defaults' values in the stock firmware, and your running configuration will be held in a user-writable configuration partition on the camera, perhaps a same-named file.

alastair@PC-I5 ~/cctv/other/HP201NY $ ll
total 8476
drwxrwxr-x  2 alastair alastair    4096 May 17 21:29 ./
drwxr-xr-x 44 alastair alastair    4096 May 17 21:07 ../
-rw-rw-r--  1 alastair alastair 8668815 May 17 21:03 40520_HI3516E_V100_20180126.bin
alastair@PC-I5 ~/cctv/other/HP201NY $ unzip *.bin
Archive:  40520_HI3516E_V100_20180126.bin
  inflating: custom-x.cramfs.img     
  inflating: Install                 
  inflating: InstallDesc             
  inflating: romfs-x.cramfs.img     
  inflating: u-boot.bin.img         
  inflating: u-boot.env.img         
  inflating: user-x.cramfs.img       
  inflating: web-x.cramfs.img       
alastair@PC-I5 ~/cctv/other/HP201NY $
alastair@PC-I5 ~/cctv/other/HP201NY $ dumpimage custom-x.cramfs.img -o custom.cramfs.img
alastair@PC-I5 ~/cctv/other/HP201NY $ file custom.cramfs.img
custom.cramfs.img: Linux Compressed ROM File System data, little endian size 28672 version #2 sorted_dirs CRC 0xbdba30a8, edition 0, 35 blocks, 122 files
alastair@PC-I5 ~/cctv/other/HP201NY $ sudo mount -t cramfs custom.cramfs.img ~/tmp
alastair@PC-I5 ~/cctv/other/HP201NY $ ll ~/tmp
total 3
drwxrwxrwx 1 root root 116 Jan  1  1970 CustomConfig/
drwxrwxrwx 1 root root  40 Jan  1  1970 data/
drwxrwxrwx 1 root root  44 Jan  1  1970 Dot/
-rwxrwxrwx 1 root root 597 Jan  1  1970 ProductDefinition*
alastair@PC-I5 ~/cctv/other/HP201NY $
alastair@PC-I5 ~/cctv/other/HP201NY $ ll ~/tmp/CustomConfig
total 4
-rwxrwxrwx 1 root root 2454 Jan  1  1970 AVEnc.custom*
-rwxrwxrwx 1 root root  352 Jan  1  1970 Camera.custom*
-rwxrwxrwx 1 root root  176 Jan  1  1970 ExtDevIDConfig.custom*
-rwxrwxrwx 1 root root  410 Jan  1  1970 OEMcfg.custom*
alastair@PC-I5 ~/cctv/other/HP201NY $ cat ~/tmp/CustomConfig/Camera.custom
{
    "Param": [
        {
            "RejectFlicker": 0,
            "Day_nfLevel": 3,
            "Night_nfLevel": 3,
            "DncThr": 30
        }
    ],
    "ParamEx": [
        {
            "BroadTrends": {
                "AutoGain": 0,
                "Gain": 50
            },
            "Style": "type1"
        }
    ] 
}alastair@PC-I5 ~/cctv/other/HP201NY $

 

[Purduephotog]

This may - or may not - help :
I unpacked the firmware, had a look around, and targeted what might be a pointer to what you are looking for.
But this is a cramfs (ie read-only) file, this will be the 'reset to defaults' values in the stock firmware, and your running configuration will be held in a user-writable configuration partition on the camera, perhaps a same-named file.

I thank you, good Sir.

Packaging it back up though- is there a good tutorial/example there? Unfortunately I only have the one piece of hardware. I'd be removing all the other .img s from the flash (as they're listed in the install.desc) and only patch the one that's needed.

Ideally I'd like to figure out how the GUI is generated and add the content. I'm sure it's there, it's just a matter of finding a HiSilicon camera with the right configuration file. Fundamentally the chips are the same so they ought to work.

I've been a bit slower lately. Little problem with a blood clot where they shouldn't be. Just got back from the heart surgery to 'make it so it doesn't happen again' and oh dear GOD how much pain that made. So I'll turn to something more distracting....

 

[alastairstevenson]

Packaging it back up though- is there a good tutorial/example there? Unfortunately I only have the one piece of hardware. I'd be removing all the other .img s from the flash (as they're listed in the install.desc) and only patch the one that's needed.

You'd probably find it more interesting, and maybe more useful even, to hook up to the serial console.

I've been a bit slower lately.

Not good for the reason.
But good for the forum to be able to distract you from it.