PTZ camera from Aliexpress continous spining

S

subzerocz

n3wb
Aug 5, 2019
9
5
Czech Republic
Hi guys,

I bought a these PTZ camera from Aliexpress.
After switching on it made selftest and started to spin itself and watch after 5 seconds 3 preset positions.
Using CMS software, I tried to bring up the OSD menu, with no result. Reset via WEB management does not work (only the hi3516drbcv100 chip settings are reset, but the camera continues to rotate).
I try to connect to the camera by Telnet, unfortunately it shows me strange characters and no possibility to enter a login etc.

Code: 
***********FrameNum:  13715*****************
***************FrameNum:  13716*****************
***************FrameNum:  13717*****************
***************FrameNum:  13718*****************
***************FrameNum:  13719*****************
***************FrameNum:  13720*****************
***************FrameNum:  13721*****************
***************FrameNum:  13722*****************
***************FrameNum:  13723*****************
***************FrameNum:  13724*****************
***************FrameNum:  13725*****************
***************FrameNum:  13726*****************
***************FrameNum:  13727*****************
***************FrameNum:  13728*****************
***************FrameNum:  13729*****************
***************FrameNum:  13730*****************
***************FrameNum:  13731*****************
***************FrameNum:  13732*****************
***************FrameNum:  13733*****************
***************FrameNum:  13734*****************
***************FrameNum:  13735*****************
***************FrameNum:  13736*****************
***************FrameNum:  13737*****************
ObjID 1228<88>: TR 0 LT 1 DT 0 ISP 0 CPU 0 [276 0 304 48]
***************FrameNum:  13738*****************
ObjID 1228<88>: TR 0 LT 2 DT 0 ISP 0 CPU 0 [276 0 302 44]
***************FrameNum:  13739*****************
ObjID 1228<88>: TR 0 LT 3 DT 0 ISP 0 CPU 0 [278 0 298 40]
ObjID 1229<90>: TR 0 LT 1 DT 0 ISP 0 CPU 0 [318 0 374 180]
***************FrameNum:  13740*****************
ObjID 1228<88>: TR 0 LT 4 DT 0 ISP 0 CPU 0 [280 0 296 34]
ObjID 1229<90>: TR 0 LT 2 DT 0 ISP 0 CPU 0 [318 0 374 178]
ObjID 1230<90>: TR 0 LT 1 DT 0 ISP 0 CPU 0 [144 0 206 182]
ObjID 1231<90>: TR 0 LT 1 DT 0 ISP 0 CPU 0 [50 28 128 200]
ObjID 1232<88>: TR 0 LT 1 DT 0 ISP 0 CPU 0 [38 166 60 192]
***************FrameNum:  13741*****************
ObjID 1229<89>: TR 0 LT 3 DT 0 ISP 0 CPU 0 [320 0 346 178]
ObjID 1230<90>: TR 0 LT 2 DT 0 ISP 0 CPU 0 [148 0 192 182]
ObjID 1231<88>: TR 0 LT 2 DT 0 ISP 0 CPU 0 [74 110 126 172]
ObjID 1232<86>: TR 0 LT 2 DT 0 ISP 0 CPU 0 [52 176 90 196]
ObjID 1233<88>: TR 0 LT 1 DT 0 ISP 0 CPU 0 [82 40 112 50]
***************FrameNum:  13742*****************
ObjID 1229<91>: TR 0 LT 4 DT 0 ISP 0 CPU 0 [320 14 340 174]
ObjID 1230<90>: TR 0 LT 3 DT 0 ISP 0 CPU 0 [148 0 190 182]
ObjID 1232<85>: TR 0 LT 3 DT 0 ISP 0 CPU 0 [54 178 86 194]
ObjID 1234<90>: TR 0 LT 1 DT 0 ISP

I used nmap to find out the available open ports, but neither of them is able to perform a classic login. Once the camera is in that state, no control works (from web browser, CMS, or from Hik NVR)

Code: 
Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-07 09:00 Stoední Evropa (letní eas)

NSE: Loaded 148 scripts for scanning.

NSE: Script Pre-scanning.

Initiating NSE at 09:01

Completed NSE at 09:01, 0.01s elapsed

Initiating NSE at 09:01

Completed NSE at 09:01, 0.00s elapsed

Initiating Ping Scan at 09:01

Scanning 192.168.12.2 [4 ports]

Completed Ping Scan at 09:01, 1.79s elapsed (1 total hosts)

Initiating Parallel DNS resolution of 1 host. at 09:01

Completed Parallel DNS resolution of 1 host. at 09:01, 5.51s elapsed

Initiating SYN Stealth Scan at 09:01

Scanning 192.168.12.2 [65535 ports]

Discovered open port 80/tcp on 192.168.12.2

Discovered open port 554/tcp on 192.168.12.2

Discovered open port 8899/tcp on 192.168.12.2

Discovered open port 9570/tcp on 192.168.12.2

Discovered open port 8000/tcp on 192.168.12.2

Discovered open port 34567/tcp on 192.168.12.2

Discovered open port 9530/tcp on 192.168.12.2

Completed SYN Stealth Scan at 09:01, 5.69s elapsed (65535 total ports)

Initiating Service scan at 09:01

Scanning 7 services on 192.168.12.2

Service scan Timing: About 71.43% done; ETC: 09:04 (0:01:00 remaining)

Completed Service scan at 09:04, 161.07s elapsed (7 services on 1 host)

Initiating OS detection (try #1) against 192.168.12.2

Initiating Traceroute at 09:04

Completed Traceroute at 09:04, 3.01s elapsed

Initiating Parallel DNS resolution of 2 hosts. at 09:04

Completed Parallel DNS resolution of 2 hosts. at 09:04, 5.50s elapsed

NSE: Script scanning 192.168.12.2.

Initiating NSE at 09:04

Completed NSE at 09:05, 81.58s elapsed

Initiating NSE at 09:05

Completed NSE at 09:05, 1.12s elapsed

Nmap scan report for 192.168.12.2

Host is up (0.0011s latency).

Not shown: 65528 closed ports

PORT      STATE SERVICE       VERSION

80/tcp    open  http          uc-httpd 1.0.0

|_http-favicon: Unknown favicon MD5: EC9D1C872C50DD7DA7D826D9C85FC158

|_http-title: NETSurveillance WEB

554/tcp   open  rtsp?

8000/tcp  open  http-alt?

8899/tcp  open  soap          gSOAP 2.7

|_http-title: Site doesn't have a title (text/xml; charset=utf-8).

9530/tcp  open  tcpwrapped

9570/tcp  open  unknown

| fingerprint-strings:

|   GenericLines, NULL:

|     HTTPD: fd: 143, IP: 0xa4016ac

|     RTP: onClientConnect enginedId 0 , clientId 0 , ip:port 172.22.64.10:3489

|     ***************FrameNum: 1044501*****************

|     ***************FrameNum: 1044502*****************

|     ***************FrameNum: 1044503*****************

|     ***************FrameNum: 1044504*****************

|     ***************FrameNum: 1044505*****************

|     ***************FrameNum: 1044506*****************

|     ***************FrameNum: 1044507*****************

|     Transprot: New Connect ID[8]@[172.22.64.10:3494]___!!!___

|     ===>Connect :[objID=1] [client=8] ip[172.22.64.10:3494]

|     ***************FrameNum: 1044508*****************

|     ***************FrameNum: 1044509*****************

|     ***************FrameNum: 1044510*****************

|     ***************FrameNum: 1044511*****************

|     ***************FrameNum: 1044512*****************

|     ***************FrameNum: 1044513*****************

|_    ***************Fra

34567/tcp open  dhanalakshmi?

1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :

SF-Port9570-TCP:V=7.70%I=7%D=8/7%Time=5D4A7746%P=i686-pc-windows-windows%r

SF:(NULL,1068,"HTTPD:\x20fd:\x20143,\x20IP:\x200xa4016ac\nRTP:\x20onClient

SF:Connect\x20enginedId\x200\x20,\x20clientId\x200\x20,\x20ip:port\x20172\

SF:.22\.64\.10:3489\x20\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x2010

SF:44501\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

SF:FrameNum:\x20\x201044502\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\

SF:*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044503\*\*\*\*\*\*\*\*\*\*\*\*\*\*

SF:\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044504\*\*\*\*\

SF:*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\

SF:x201044505\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\

SF:*\*\*FrameNum:\x20\x201044506\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*

SF:\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044507\*\*\*\*\*\*\*\*\*\*\*\

SF:*\*\*\*\*\*\nTransprot:\x20New\x20Connect\x20ID\[8\]@\[172\.22\.64\.10:

SF:3494\]___!!!___\n===>Connect\x20:\[objID=1\]\x20\[client=8\]\x20ip\[172

SF:\.22\.64\.10:3494\]\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x20104

SF:4508\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*F

SF:rameNum:\x20\x201044509\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*

SF:\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044510\*\*\*\*\*\*\*\*\*\*\*\*\*\*\

SF:*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044511\*\*\*\*\*

SF:\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x

SF:201044512\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*

SF:\*\*FrameNum:\x20\x201044513\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\

SF:*\*\*\*\*\*\*\*\*\*\*\*Fra")%r(GenericLines,107A,"HTTPD:\x20fd:\x20143,

SF:\x20IP:\x200xa4016ac\nRTP:\x20onClientConnect\x20enginedId\x200\x20,\x2

SF:0clientId\x200\x20,\x20ip:port\x20172\.22\.64\.10:3489\x20\n\*\*\*\*\*\

SF:*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044501\*\*\*\*\*\*\*\*\*\*\*\*\*\*

SF:\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044502\*\*\*\*\

SF:*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\

SF:x201044503\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\

SF:*\*\*FrameNum:\x20\x201044504\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*

SF:\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044505\*\*\*\*\*\*\*\*\*\*\*\

SF:*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044506\*\*

SF:\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:

SF:\x20\x201044507\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\nTransprot:\x20New\x2

SF:0Connect\x20ID\[8\]@\[172\.22\.64\.10:3494\]___!!!___\n===>Connect\x20:

SF:\[objID=1\]\x20\[client=8\]\x20ip\[172\.22\.64\.10:3494\]\n\*\*\*\*\*\*

SF:\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044508\*\*\*\*\*\*\*\*\*\*\*\*\*\*\

SF:*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044509\*\*\*\*\*

SF:\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x

SF:201044510\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*

SF:\*\*FrameNum:\x20\x201044511\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\

SF:*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044512\*\*\*\*\*\*\*\*\*\*\*\*

SF:\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*FrameNum:\x20\x201044513\*\*\

SF:*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*Fra");

Device type: general purpose

Running: Linux 2.6.X|3.X

OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3

OS details: Linux 2.6.32 - 3.10

Uptime guess: 0.488 days (since Tue Aug 06 21:22:39 2019)

Network Distance: 3 hops

TCP Sequence Prediction: Difficulty=259 (Good luck!)

IP ID Sequence Generation: All zeros



TRACEROUTE (using port 53/tcp)

HOP RTT     ADDRESS

1   ...

2   1.00 ms 172.22.64.4

3   2.00 ms 192.168.12.2



NSE: Script Post-scanning.

Initiating NSE at 09:05

Completed NSE at 09:05, 0.00s elapsed

Initiating NSE at 09:05

Completed NSE at 09:05, 0.00s elapsed

Read data files from: C:\Program Files (x86)\Nmap

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 277.85 seconds

           Raw packets sent: 65574 (2.886MB) | Rcvd: 65612 (2.626MB)

Is there any way to bring up the OSD menu and try to reset the camera? Otherwise repair?

Thanks for your help!

Jirka
 

Attachments

  • cam1.jpg
    cam1.jpg
    21.8 KB · Views: 20
Code: 
src/imp.c(492) [ImpCreate]: init sucesseful!!!
driver time sections:
 ------------------------------------------------------------------------
|dev part |start_clus| end_clus |    start_time     |   end_time        |
 ------------------------------------------------------------------------

CMedia::start() $Rev: 972 $>>>>>
sched set 98, 2
=============COMM_VI_SetMipiAttr enWDRMode: 0
------------- SC5239 3M 25fps  init ok![16DV100] by gjj  --------2017.11-2018.5.                                                                                                           16upPPP-------
record[0]=6903
record[255]=8097
count = 254, count1=2
count 0 val 0xf82c2c
record[0]=14928
record[255]=72
count = 254, count1=2
CTime::setCurrentTime SystemTimeToRtcTimeSet to 2000-11-30 00:00:30
Save SysTime to Flash:2000-11-30 00:00:30, Time:2 Min, Trail:2 Min
count 1 val 0xfa2c2c
record[0]=14955
record[255]=45
count = 254, count1=2
onVerifyAudioInFormat() ../../Manager/VerifyConfig.cpp 1503
onVerifyTour() ../../Manager/VerifyConfig.cpp 1417
CSnapManager::start()...
onVerifyNetEmail() ../../Manager/VerifyConfig.cpp 1142
 Public_SearchString : can not find string _8188
Product:        30
DSP:            6
Sensor:         89
IRcut:          15
../../Media/VideoEnc.cpp,AppEncodeConfig(3347):
fps:25  bitrate:6656
AVenc.c(12246) [CaptureForceIFrame]: viChn = 0; type = 0
../../Media/VideoEnc.cpp,AppEncodeConfig(3347):
fps:22  bitrate:223
AVenc.c(12246) [CaptureForceIFrame]: viChn = 0; type = 1
../../Media/VideoEnc.cpp,AppEncodeConfig(3347):
fps:1  bitrate:512
*******>>>>>> setOsdTitle  chn 0, intde 1, len: 232, w: 72, h:24
AVenc.c(12246) [CaptureForceIFrame]: viChn = 0; type = 0
AVenc.c(12246) [CaptureForceIFrame]: viChn = 0; type = 1
setChannelTitleDot 24, 72
CConfigManager::setConfig(AVEnc.Encode, )
../../Media/VideoEnc.cpp,setJpegTagInfo(4517): pInfo (nil),len 0
*******>>>>>> setOsdTitle  chn 0, intde 1, len: 232, w: 72, h:24
setChannelTitleDot 24, 72
VIDEOENC: UpperEnable[1] SetToLib >>>>> ch[0] Stream[0] +[0] ++[0]
AVenc.c(13250) [CaptureStartH264PlusPlusV2]: g_motionstate_forRoi:1
AVenc.c(12246) [CaptureForceIFrame]: viChn = 0; type = 0
VIDEOENC: UpperEnable[1] SetToLib >>>>> ch[0] Stream[1] +[0] ++[0]
AVenc.c(13250) [CaptureStartH264PlusPlusV2]: g_motionstate_forRoi:1
AVenc.c(12246) [CaptureForceIFrame]: viChn = 0; type = 1
CRecordManager::start()>>>>>>>>>


Comm: $base Dir Trunk, $Source svn: 32953, $Include svn: 2777, $Build in:Sep  5                                                                                                            2018, 20:11:35
sPadName :General
sRemoteName :General
CFrontBoardProtocol::start()......
KeyMap OK .............
onVerifyComm() ../../Manager/VerifyConfig.cpp 1401
CNutParser::Init()>>>>>>>>>
CComm::start()>>>>>>>>>
The thread create..........
onVerifyComm() ../../Manager/VerifyConfig.cpp 1401
CPtz::CPtz()>>>>>>>>>
onVerifyPTZ() ../../Manager/VerifyConfig.cpp 1406
CConfigManager::getConfig 'Uart.PTZTour', but default config is not set yet!
CConfigManager::getConfig 'Uart.PTZPreset', but default config is not set yet!
CConfigManager::getConfig 'Uart.PTZPattern', but default config is not set yet!
onVerifyPTZ() ../../Manager/VerifyConfig.cpp 1406
CPtz::Init()>>>>>>>>>
CRS485::CRS485()>>>>>>>>>
CConfigManager::getConfig 'NetWork.NetKeyboard', but default config is not set y                                                                                                           et!
CNutParser::Init()>>>>>>>>>
CNutParser::Init()>>>>>>>>>
CConfigManager::getConfig 'NetWork.NetKeyboard', but default config is not set y                                                                                                           et!
CRS485Protocol start...
onVerifyPTZAlarmProtocol() ../../Manager/VerifyConfig.cpp 938
CAlarmManager::instance()->start()...
CAlarm::CAlarm()>>>>>>>>>
CAlarm::Start()>>>>>>>>>
src/imp.c(2033) [SetPEDConfig]: <Enter> channel:0
XM_IA_PedDect_Init
The warning time is: Thu Nov 30 00:00:33 2000

src/imp.c(2056) [SetPEDConfig]: Pedinit: ImpCreate succeed
src/imp.c(2105) [SetPEDConfig]: OSC: XM_IA_PedDect_Config succeed.
src/imp.c(2000) [PedStart]: VpssExtChn already created !
***************FrameNum:  0*****************
SIOCGIFHWADDR = eth0


NetIP: $Rev: 1055 $, $Author: chencb $, Build in:Apr 28 2019, 19:20:03
CNetService::start()>>>>>>>>>>
SIOCGIFHWADDR = eth0
onVerifyNetDDNS() ../../Manager/VerifyConfig.cpp 1137
CConfigManager::getConfig 'NetWork.NetMobile', but default config is not set yet                                                                                                           !
DHCPPROTO: DhcpInitCtxt fail! eth name(eth1) not valid!
DHCPPROTO: DhcpInitCtxt fail! eth name(eth2) not valid!
DHCPPROTO: DhcpInitCtxt fail! eth name(eth3) not valid!
DHCPPROTO: DhcpInitCtxt fail! eth name(bond0) not valid!
DHCPC: start...
AUTOSEARCH: setSerialNo(3207) m_statusSerialNo[1] m_SerialNo[f4f88d6ec6ff5603]
AUTOSEARCH: start(118) Start ...
RTP: CRtspSvrApp start ok
DHCP: [2]send cmd: DHCP_DISCOVER
DHCP: [2]send cmd: DHCP_REQUEST
DHCP: [2]ulLease: 86400, ulRenewTime: 0, ulReBindTime: 0
DHCPC: [eth0]Get: IP[192.168.12.2], Mask[255.255.255.0], GateWay[192.168.12.1],                                                                                                            DNS[62.209.208.14][62.209.208.15]
ONVIFEXCH: onConfigNetCommon(2082) IP[192.168.12.2]_Gateway[255.255.255.0]_Subma                                                                                                           sk[192.168.12.1]_Port[80]_Mac[00:12:31:37:ca:40]_Host[LocalHost]
ONVIFS: Run InterVideoONVIF... ChNum[1] randnum[-2110832310]
ONVIFS: SetDeviceServiceDefaultConfig DevScopes.pScopes[0].scopes=onvif://www.on                                                                                                           vif.org/type/video_encoder
ONVIFS: SetDeviceServiceDefaultConfig DevScopes.pScopes[1].scopes=onvif://www.on                                                                                                           vif.org/type/audio_encoder
ONVIFS: SetDeviceServiceDefaultConfig DevScopes.pScopes[2].scopes=onvif://www.on                                                                                                           vif.org/hardware/IPC-model
ONVIFS: SetDeviceServiceDefaultConfig DevScopes.pScopes[3].scopes=onvif://www.on                                                                                                           vif.org/location/country/china
ONVIFS: SetDeviceServiceDefaultConfig DevScopes.pScopes[4].scopes=onvif://www.on                                                                                                           vif.org/name/NVT
ONVIFS: SetDeviceServiceDefaultConfig DevScopes.pScopes[5].scopes=onvif://www.on                                                                                                           vif.org/Profile/Streaming
ONVIFS: SetDefaultProfiesInfomation name[VideoE_000][VideoE_000] paddr[0xfa8290]                                                                                                           [0xfa8290]
ONVIFS: SetDefaultProfiesInfomation name[VideoE_000][VideoE_000] paddr[0xfa8290]                                                                                                           [0xfa8290]
ONVIFS: SetDefaultProfiesInfomation name[VideoE_000][VideoE_000] paddr[0xfa8290]                                                                                                           [0xfa8290]
ONVIFS: SetDefaultProfiesInfomation ExProfiles.num[0]
ONVIFS: Mainimgsize[2592*1944]
ONVIFS: Eximgsize[352*288]
ONVIFS: Snapimgsize[704*576]
ONVIFS: ch[0] g_iMaxFps[25][25] MaxEncPower[160381440] SnapEncPower[405504] ExEn                                                                                                           cPower[2230272] mainEncPower[125971200]
ONVIFS: MainResolutions[0] Width=[1920] Height=[1080]
ONVIFS: MainResolutions[1] Width=[2592] Height=[1944]
ONVIFS: MainResolutions[2] Width=[2560] Height=[1440]
ONVIFS: ExtraResolutions[0] Width=[704] Height=[576]
ONVIFS: ExtraResolutions[1] Width=[352] Height=[288]
ONVIFS: ExtraResolutions[0] Width=[704] Height=[576]
ONVIFS: ExtraResolutions[1] Width=[352] Height=[288]
ONVIFS: send hello ipaddr[192.168.12.2]
ONVIFS: scopes[onvif://www.onvif.org/type/video_encoder onvif://www.onvif.org/ty                                                                                                           pe/audio_encoder onvif://www.onvif.org/hardware/IPC-model onvif://www.onvif.org/                                                                                                           location/country/china onvif://www.onvif.org/name/NVT onvif://www.onvif.org/Prof                                                                                                           ile/Streaming ]
SOAP: Start thread[onvif_search], TID=[1111]
SOAP: Start thread[onvif_normal], TID=[1111], port[8899]
ONVIFS: uuid[822f414a-5566-7788-99aa-00123137ca40]
***************FrameNum:  0*****************
SIOCGIFHWADDR = eth0
NETSTATED: start ...
SMTPD: >>>>>>>>>>>>>Start


LIBNETSERVICE_SMTP: $Version_fix: V0.01, $Svn: XXX, Build in:Apr 28 2019, 19:20:                                                                                                           09, 0
DDNS: Start ....
***************FrameNum:  1*****************
AlarmCenter: Start ....
CRtpApp start ok
ver ---- V4.03.R12.00014927, [000 14 927]


LIBWEB: $Version_fix: V0.01, $Svn: 103, Build in:Dec  7 2018, 14:39:30, 0
****************************************************************************http                                                                                                           d  1.00 Dec  7 2018, Status: NOK
***** http port = 80, tcp port = 34567, udp port = 34568, language = 0, file nam                                                                                                           e: /mnt/web
****************************************************************************szUr                                                                                                           l: http://:8080/ocx/Active.exe
SIOCGIFHWADDR = eth0
UPNP: start ...
ARSP: Start ....
CConfigManager::getConfig 'IPAdaptive.LastLoginDeviceIP', but default config is                                                                                                            not set yet!


NetIP: $Rev: 1055 $, $Author: chencb $, Build in:Apr 28 2019, 19:20:00
CNetIP::start()>>>>>>>>>>
SIOCGIFHWADDR = eth0
WritePortInfo begin ==>>
WritePortInfo begin11 ==>>
WritePortInfo len=128
WritePortInfo begin22 ==>>
***************FrameNum:  2*****************
Transport: CServerIOThread start OK
Transport: CServerIOThread start OK
cfgNetCommon.UDPPort=[34568]
s_DeviceMac=[f4f88d6ec6ff5603]
msgID====1e
s_DevInfo.msgID====fe00001e
ver ---- V4.03.R12.00014927, [000 14 927]
SIOCGIFHWADDR = eth0
-----------OnEncode----------->
<-----------OnEncode-----------
CNetManager start ok
SIOCGIFHWADDR = eth0
***************FrameNum:  3*****************
CLocalSDKManager start ok
s_DeviceMac=[f4f88d6ec6ff5603]
>>>>>>>>CXmCloud: Start>>>>>>>>
CHikVisionServer start ok
CNetIPConflict start ok
ver ---- V4.03.R12.00014927, [000 14 927]
***************FrameNum:  4*****************
SIOCGIFHWADDR = eth0
onVerifyNetDHCP() ../../Manager/VerifyConfig.cpp 1132
SIOCGIFHWADDR = eth0
SIOCGIFHWADDR = eth0
SIOCGIFHWADDR = eth0
SIOCGIFHWADDR = eth0
SIOCGIFHWADDR = eth0
***************FrameNum:  5*****************
SIOCGIFHWADDR = eth0
SIOCGIFHWADDR = eth0

#### onvif_probe_process eth0 : 0, eth2 : -1

####onvif_normal_process  eth0 : 0, eth2 : -1
ver ---- V4.03.R12.00014927, [000 14 927]
GetDssconfig===>send
[{ "CfgProtocol" : { "Body" : { "AuthCode" : "f4f88d6ec6ff5603", "OemID" : "Gene                                                                                                           ral", "OtherInfo" : "V4.03.R12.00014927.12012.148900.00200", "ProductID" : "HI35                                                                                                           16D_83H50N", "SerialNumber" : "f4f88d6ec6ff5603" }, "Header" : { "CSeq" : "1", "                                                                                                           MessageType" : "MSG_DSS_CFG_QUERY_REQ", "Version" : "1.0" } } }
]
***************FrameNum:  6*****************
FrontboardWrite failed[writted:0  errRet:0]!
===================1==================================================
===================2==================================================
Threads:
               Name            PID  Prior State
_______________________________________________________
                    Main       1111   64  Normal
            TimerManager       1112   50  Normal
              SnapAnalog       1113   50  Normal
                 Console       1114   50  Normal
           DevFrontboard       1131   50  Normal
                               1116   50  Normal
           DriverManager       1118   50  Normal
          CaptureManager       1119   98  Normal
                CXmCloud       1167   50  Normal
       HikVisionSearchIP       1168   50  Normal
    HikVisionMacSearchIP       1169   50  Normal
         HikVisionAccept       1170   50  Normal
                  RTPAPP       1159   50  Normal
           RecordManager       1127   50  Normal
                    Comm       1132   50  Normal
                  DevPtz       1133   50  Normal
              UDP_Server       1164   50  Normal
                   Alarm       1135   50  Normal
         HikVisionServer       1171   50  Normal
              TCP_Server       1163   50  Normal
                  Pooled       1173   50  Normal
                     FTP       1138   50  Normal
                 RTSPSvr       1158   50  Normal
         CNetStateReport       1136   50  Normal
                    SMTP       1137   50  Normal
          CNetIPConflict       1172   50  Normal
                  Pooled       1174   50  Normal
                CUpnpCli       1161   50  Normal
              DHCPClient       1155   50  Normal
       CAutoSearchDevice       1156   50  Normal
          NetAlarmCenter       1157   50  Normal
                    ARSP       1162   50  Normal
            NetIPManager       1165   50  Normal
                LocalSDK       1166   50  Normal
Timers: ( 14900 Milli-Seconds Elapsed )
_________________________________________
        SaveTime       14940 Idel
                       14980 Idel
        LockUser       15250 Idel
     BitrateStat       15480 Idel
     DetectTimer       15550 Idel
IPA_StateNetLink       15700 Idel
                       15720 Idel
                       15720 Idel
    EventManager       15820 Idel
    StorageAlarm       15840 Idel
        WatchDog       16230 Idel
     LogSaveFile       16230 Idel
    AutoMaintain       16250 Idel
                       16720 Idel
                       16780 Idel
                       23300 Idel
          Encode       23550 Idel
CheckNetStateipv4       26640 Idel
  OnlineCheckNew       44840 Idel
                       74820 Idel
                     3614580 Idel
 
I bought a similar camera on eBay 2mp 18x zoom and had problems with that moving on its own. After much time I eventually found it was doing a 'Cruise'. The only way to stop it was to set the different positions in the Cruise to the same point. The camera then did an online firmware update and now it won't respond to any PTZ control. The motors etc work as every 24hrs it goes through a 'test' procedure. I can't find anywhere to turn that off. The seller was useless/obstructive and so was the manufacturer. Thankfully because it was eBay I got a full refund.

Have you tried different browsers? I find internet explorer is the only one that works.
 
Tinbum said:
I bought a similar camera on eBay 2mp 18x zoom and had problems with that moving on its own. After much time I eventually found it was doing a 'Cruise'. The only way to stop it was to set the different positions in the Cruise to the same point. The camera then did an online firmware update and now it won't respond to any PTZ control. The motors etc work as every 24hrs it goes through a 'test' procedure. I can't find anywhere to turn that off. The seller was useless/obstructive and so was the manufacturer. Thankfully because it was eBay I got a full refund.

Have you tried different browsers? I find internet explorer is the only one that works.
Click to expand...

Yes, i tried diferent browser.. but only IE works (because activex is required). Also I tried different software (CMS, EagleEye, HikVison etc). Now, seller send me a new firmware called New_XM5MP_IPC_XM550_V5.00.R02.20190730_all.bin but upgrade fail.
 
No, I haven't tried it ... but in my opinion - this firmware is only for the CCTV chip and has nothing to do with the PTZ control and OSD menu display .. or am I wrong? We tried to activate preset 96 on the advice of the seller, which should be a complete reset of the camera, but as I wrote above .. the camera absolutely does not respond to the instructions .. and it does not matter if I try it from a web client or some software
I managed to upload these two versions:
General_HZXM_IPC_HI3516D_83H50N_V4.03.R12.Nat.OnvifS.HIK.20190428_ALL.bin
General_HZXM_IPC_HI3516D_83H50N_V4.02.R12.Nat.OnvifS.HIK.20180825_ALL.bin
 
I found mine didn't like long file names. I managed to get a firmware file for mine but it made no difference, but then they sent me the same file as was already on. I'd asked for the old firmware and gave them the version number but they were just totally unhelpful. I sometime find with these that trying to access it from a different computer gives different results!!
 
I tried everything :(
The chip board is a 3516DV100 and the motor control board something with an ARM processor. If I disconnect the CCTV board from the ARM board, the camera does not rotate and normally displays. It's strange...
I think to connect the serial interface directly to the board and try to fix it somehow .. but ??
The seller is not communicating ..
 
unfortunately I did not take the pictures of chip board, but I took the name of the board for PTZ drive - but I found nothing on Google ..
 

Attachments

  • 20190805_192554769_iOS.jpg
    20190805_192554769_iOS.jpg
    1.4 MB · Views: 16
Tinbum said:
That ARM chip looks very similar.
Click to expand...

yes, it's exactly the same type as I have.

So I have no choice but to open the dispute and try to return the camera. I opened the camera several times and the screws show that they were being manipulated. I have no idea how the seller will handle this.
I was hoping there would be an expert and advise me on how to revive it. I do not believe it would be irreversibly damaged ..
 
I'm not sure how it works on Aliexpress but on eBay I got to keep the camera as the camera was located in the UK but the seller expected me to send it back to China which is against eBays rules.
 
Guys,
so seller sent me a new firmware, I uploaded it and... YES! The camera started working correctly!

But...so I tried to log traffic to our backbone firewall and it sends pictures every 1 minute to random servers in China and Amazon AWS !! So I set up a separate network (VLAN) that has no access to the Internet and placed it in the camera. I believe it will be okay.
Thank you all.
 
  • Like
Reactions: sebastiantombs, looney2ns, mat200 and 1 other person
Hi.

long ago, but could you please share the working firmware-file here? I ran into same trouble and can only find FW without PTZ-control. My seller is very slow, he send one, but is was not working.
Thanks!
 
but could you please share the working firmware-file here? I ran into same trouble and can only find FW without PTZ-control.
Thanks!
 
You must log in or register to reply here.
Top Bottom