- Dec 13, 2017
- 1
- 0
Hi,
I have 2 chinese 2M IP cam based on Hi3516c and Imx122 Sony cmos and few days ago I tried to tune low light image through its web interface (activeX). Due to very bad translation (open/close was translated to open/near ...) I also changed the langauge into English, saved the configuration and was offer the option to reboot yes or yes. I did it and was the end... the camera entered into a 30sec boot loop sequence.
I've been browsing, reading and testing every single advice on the web without result.
- The camera has not reset boton out or inside.
- Opening the camera does not show any serial pads to connect an USB/Serial console
- I found a Windows Camera Reset Tool that does not work, nor VMS, CMS, or Device Manager found it.
- It does ping during 10sec of the 30sec loop cycle.
- I managed with nmap to find that port 9527 is open during those 10s, but not port 23
PORT STATE SERVICE
9527/tcp open unknown
9530/tcp open unknown
34561/tcp open unknown
- I manage to connect to 9527 and while booting read a log on that port that start with:
**********************************************************************
| SYSTEM INFO
| ID: 8043420003410427
| product type: 53H20L
| product: 53H20L_S39
| video channel: 1
| audio channel: 1
| alarm in: 2
| alarm out: 0
| forward video chip: IMX122
| DSP chip: HI3516C
| analog audio mode: voice codec
| talkback: voice codec
| back video chip: no chip
| store interface: SDIO
| matrix surpport: No
| wireless interface: USB
| hardware encode: encode chip
| hardware version: 1
| video_interface: BNC
| net_interface: Ethernet
| hardware info len: 8
**********************************************************************
and follows with a long file available here:
In the other camera unit I have, I manage to connect to port 9527, login with user:admin/pass:"" and run a shell, and within there I can run "telnetd -f" so in another session I can telnet on port 23 and access the shell..
I cannot do that on the bricked unit, although I'm still trying by creating a except script that try to log with admin/"" during the initial 10s, but in the log I obtain user invalid.
So, no way to restore "factory setting" on this camera, that was almost new.
Do anyone knows another way to recover this camera?
Thanks
Agustin
I have 2 chinese 2M IP cam based on Hi3516c and Imx122 Sony cmos and few days ago I tried to tune low light image through its web interface (activeX). Due to very bad translation (open/close was translated to open/near ...) I also changed the langauge into English, saved the configuration and was offer the option to reboot yes or yes. I did it and was the end... the camera entered into a 30sec boot loop sequence.
I've been browsing, reading and testing every single advice on the web without result.
- The camera has not reset boton out or inside.
- Opening the camera does not show any serial pads to connect an USB/Serial console
- I found a Windows Camera Reset Tool that does not work, nor VMS, CMS, or Device Manager found it.
- It does ping during 10sec of the 30sec loop cycle.
- I managed with nmap to find that port 9527 is open during those 10s, but not port 23
PORT STATE SERVICE
9527/tcp open unknown
9530/tcp open unknown
34561/tcp open unknown
- I manage to connect to 9527 and while booting read a log on that port that start with:
**********************************************************************
| SYSTEM INFO
| ID: 8043420003410427
| product type: 53H20L
| product: 53H20L_S39
| video channel: 1
| audio channel: 1
| alarm in: 2
| alarm out: 0
| forward video chip: IMX122
| DSP chip: HI3516C
| analog audio mode: voice codec
| talkback: voice codec
| back video chip: no chip
| store interface: SDIO
| matrix surpport: No
| wireless interface: USB
| hardware encode: encode chip
| hardware version: 1
| video_interface: BNC
| net_interface: Ethernet
| hardware info len: 8
**********************************************************************
and follows with a long file available here:
In the other camera unit I have, I manage to connect to port 9527, login with user:admin/pass:"" and run a shell, and within there I can run "telnetd -f" so in another session I can telnet on port 23 and access the shell..
I cannot do that on the bricked unit, although I'm still trying by creating a except script that try to log with admin/"" during the initial 10s, but in the log I obtain user invalid.
So, no way to restore "factory setting" on this camera, that was almost new.
Do anyone knows another way to recover this camera?
Thanks
Agustin
