Rooting around in the Longse / Cantonk S2L33M/IMX322 vari-focal camera.

alastairstevenson

alastairstevenson

Staff member
Oct 28, 2014
16,230
7,006
Scotland
OK, so here is a quick root around the S2L33M_IMX322_PTZ_X_6.1.17.5 firmware in the Longse / Cantonk S2L33M/IMX322 vari-focal.

This camera is connected to a PoE port on my Hikvision 7816N-E2/8P NVR.
Code: 
alastair@PC-I5 ~ $ telnet 192.168.254.17
Trying 192.168.254.17...
Connected to 192.168.254.17.
Escape character is '^]'.

Ipcamera login: root
Password:
The familiar ARMv7 32 bit CPU clocked at 600MHz, running a fairly current version of Linux.
The CPU working quite hard with only 50% idle, providing video streams to 2 Hikvision NVRs.
Code: 
# pwd
/root
# cat /proc/cpuinfo
processor       : 0
model name      : ARMv7 Processor rev 1 (v7l)
BogoMIPS        : 597.60
Features        : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x4
CPU part        : 0xc09
CPU revision    : 1

Hardware        : Ambarella S2L (Flattened Device Tree)
Revision        : 0000
Serial          : 0000000000000000
# uname -a
Linux Ipcamera 3.10.73 #3 PREEMPT Sat Mar 26 10:54:13 CST 2016 armv7l GNU/Linux

top - 03:59:37 up 16:56,  1 user,  load average: 1.80, 2.27, 2.28
Tasks:  44 total,   1 running,  43 sleeping,   0 stopped,   0 zombie
%Cpu(s): 29.5 us, 16.4 sy,  0.0 ni, 49.7 id,  0.0 wa,  0.0 hi,  4.4 si,  0.0 st
KiB Mem:    106488 total,    80660 used,    25828 free,        0 buffers
KiB Swap:        0 total,        0 used,        0 free,    32904 cached

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND            
  292 root      20   0  331784  19328   6500 S 37.09 18.15 368:59.28 AVServer           
  320 root      20   0  297412  28020   7600 S 6.236 26.31  61:03.89 boa                
  297 root      20   0  119156   1948   1172 S 2.297 1.829  22:16.54 SystemServer       
22352 root      20   0    2808   1140    824 R 0.656 1.071   0:00.52 top                
   22 root      20   0       0      0      0 S 0.328 0.000   0:20.58 kworker/0:1        
    1 root      20   0    2648    656    584 S 0.000 0.616   0:00.15 linuxrc            
    2 root      20   0       0      0      0 S 0.000 0.000   0:00.02 kthreadd           
    3 root      20   0       0      0      0 S 0.000 0.000   1:07.49 ksoftirqd/0        
    4 root      20   0       0      0      0 S 0.000 0.000   0:00.00 kworker/0:0        
    5 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 kworker/0:0H       
    7 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 khelper            
    8 root      20   0       0      0      0 S 0.000 0.000   0:00.00 kdevtmpfs          
    9 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 writeback          
   10 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 bioset             
   11 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 crypto             
   12 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 kblockd            
   23 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 cfg80211           
   24 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 rpciod             
   25 root      20   0       0      0      0 S 0.000 0.000   0:00.15 kswapd0            
   26 root      20   0       0      0      0 S 0.000 0.000   0:00.00 fsnotify_mark      
   27 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 nfsiod             
   28 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 cifsiod            
   41 root      20   0       0      0      0 S 0.000 0.000   0:00.13 spi0               
   49 root       0 -20       0      0      0 S 0.000 0.000   0:00.00 deferwq            
   50 root      20   0       0      0      0 S 0.000 0.000   0:00.01 ubi_bgt0d          
   51 root      20   0       0      0      0 S 0.000 0.000   0:00.00 ubifs_bgt0_0       
  189 root      20   0    2788   1096    804 S 0.000 1.029   0:00.12 udevd              
  217 root      20   0    3844    660    396 S 0.000 0.620   0:00.00 dbus-daemon        
  230 pulse      9 -11   47936   2320   1844 S 0.000 2.179   0:00.10 pulseaudio         
  232 root      20   0       0      0      0 S 0.000 0.000   0:06.02 ubi_bgt1d          
  234 root      20   0       0      0      0 S 0.000 0.000   0:00.00 ubifs_bgt1_1       
  236 root      20   0       0      0      0 S 0.000 0.000   0:00.00 ubifs_bgt1_0       
  238 root      20   0       0      0      0 S 0.000 0.000   0:01.25 ubi_bgt2d          
#

Very generous RAM and flash memory sizes at 128MB. Look at the size of the 'lnx' partition - massive - I wonder what's in there?
Code: 
# free
             total       used       free     shared    buffers     cached
Mem:        106488      66396      40092          0          0      19032
-/+ buffers/cache:      47364      59124
Swap:            0          0          0
# df -h
Filesystem                Size      Used Available Use% Mounted on
ubi0:rootfs              42.0M     37.2M      4.8M  89% /
devtmpfs                 51.9M         0     51.9M   0% /dev
tmpfs                    52.0M     60.0K     51.9M   0% /tmp
tmpfs                    52.0M     72.0K     51.9M   0% /dev/shm
tmpfs                    52.0M     92.0K     51.9M   0% /run
ubi1:upgrade             20.3M     24.0K     20.2M   0% /hs/upgrade
ubi1:param                5.7M    108.0K      5.6M   2% /hs/param
ubi2:user                18.8M     10.0M      8.8M  53% /hs/user
# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00020000 "bst"
mtd1: 00140000 00020000 "bld"
mtd2: 00140000 00020000 "ptb"
mtd3: 00800000 00020000 "pri"
mtd4: 03400000 00020000 "lnx"
mtd5: 01a00000 00020000 "add"
mtd6: 02400000 00020000 "adc"

What's in the file system?

Code: 
# mount
rootfs on / type rootfs (rw)
ubi0:rootfs on / type ubifs (rw,sync,relatime)
devtmpfs on /dev type devtmpfs (rw,relatime,size=53172k,nr_inodes=13293,mode=755)
proc on /proc type proc (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw,relatime)
tmpfs on /run type tmpfs (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
ubi1:upgrade on /hs/upgrade type ubifs (rw,relatime)
ubi1:param on /hs/param type ubifs (rw,relatime)
ubi2:user on /hs/user type ubifs (rw,relatime)
# ls -al /
total 0
drwxr-xr-x   21 root     root          1440 Nov 16  2015 .
drwxr-xr-x   21 root     root          1440 Nov 16  2015 ..
drwxr-xr-x    2 root     root          5480 Apr 22 18:11 bin
drwxr-xr-x    2 root     root           160 Nov 16  2015 debug
drwxr-xr-x    7 root     root          3020 Jan  7  1970 dev
drwxr-xr-x   24 root     root          3784 Jan  7  1970 etc
drwxr-xr-x    3 root     root           224 Nov 16  2015 home
drwxr-xr-x    6 root     root           416 Jun 26 06:41 hs
drwxr-xr-x    3 root     root           448 Nov 16  2015 include
drwxr-xr-x    5 root     root          5592 Apr 22 18:11 lib
lrwxrwxrwx    1 root     root            11 Sep 18  2015 linuxrc -> bin/busybox
drwxr-xr-x    2 root     root           160 Jun 25 23:23 mnt
drwxr-xr-x    2 root     root           160 Nov 16  2015 opt
dr-xr-xr-x   55 root     root             0 Jan  1  1970 proc
drwxr-xr-x    2 root     root           232 Jun 25 16:51 root
drwxrwxrwt    7 root     root           220 Jan  7  1970 run
drwxr-xr-x    2 root     root          5928 Apr 22 18:11 sbin
dr-xr-xr-x   12 root     root             0 Jan  7  1970 sys
drwxrwxrwt    4 root     root           180 Jan  7  1970 tmp
drwxr-xr-x    8 root     root           544 Nov 16  2015 usr
drwxr-xr-x    3 root     root           672 Sep 19  2015 var
drwxr-xr-x    4 root     root           288 Nov 16  2015 webSvr

Let's add some external storage and extract some items for analysis.
Code: 
# ls -al /mnt
total 0
drwxr-xr-x    2 root     root           160 Jun 25 23:23 .
drwxr-xr-x   21 root     root          1440 Nov 16  2015 ..
# mount -t nfs -o nolock 192.168.1.21:/home/alastair/tftp_root /mnt
# ls -al /mnt
total 16
drwxrwxrwx    5 1000     1000          4096 Jul  4 02:46 .
drwxr-xr-x   21 root     root          1440 Nov 16  2015 ..
drwxrwxrwx    2 1000     1000          4096 Jul  2 22:38 imx178
drwxrwxrwx    2 1000     1000          4096 Jul  3 19:56 imx322
drwxrwxrwx    2 1000     1000          4096 Jun 30 02:33 tmp
# cd /mnt/imx322
# ls -al
total 8
drwxrwxrwx    2 1000     1000          4096 Jul  3 19:56 .
drwxrwxrwx    5 1000     1000          4096 Jul  4 02:46 ..
# dd if=/dev/mtd0 of=mtd0
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.111739 seconds, 1.1MB/s
# dd if=/dev/mtd1 of=mtd1
2560+0 records in
2560+0 records out
1310720 bytes (1.3MB) copied, 0.723095 seconds, 1.7MB/s
# dd if=/dev/mtd2 of=mtd2
2560+0 records in
2560+0 records out
1310720 bytes (1.3MB) copied, 0.720175 seconds, 1.7MB/s
# dd if=/dev/mtd3 of=mtd3
16384+0 records in
16384+0 records out
8388608 bytes (8.0MB) copied, 4.565555 seconds, 1.8MB/s
# dd if=/dev/mtd4 of=mtd4
106496+0 records in
106496+0 records out
54525952 bytes (52.0MB) copied, 29.094679 seconds, 1.8MB/s
# dd if=/dev/mtd5 of=mtd5
53248+0 records in
53248+0 records out
27262976 bytes (26.0MB) copied, 14.852834 seconds, 1.8MB/s
# dd if=/dev/mtd6 of=mtd6
73728+0 records in
73728+0 records out
37748736 bytes (36.0MB) copied, 19.389349 seconds, 1.9MB/s
# ls -al
total 127632
drwxrwxrwx    2 1000     1000          4096 Jul  4 02:54 .
drwxrwxrwx    5 1000     1000          4096 Jul  4 02:46 ..
-rw-r--r--    1 root     root        131072 Jul  4 02:53 mtd0
-rw-r--r--    1 root     root       1310720 Jul  4 02:53 mtd1
-rw-r--r--    1 root     root       1310720 Jul  4 02:53 mtd2
-rw-r--r--    1 root     root       8388608 Jul  4 02:53 mtd3
-rw-r--r--    1 root     root      54525952 Jul  4 02:54 mtd4
-rw-r--r--    1 root     root      27262976 Jul  4 02:54 mtd5
-rw-r--r--    1 root     root      37748736 Jul  4 02:55 mtd6

This looks like an interesting folder.
It appears to have the same type of configuration files as the H3516a/IMX178 camera.
Code: 
# cd /hs
# ls -al
total 0
drwxr-xr-x    6 root     root           416 Jun 26 06:41 .
drwxr-xr-x   21 root     root          1440 Nov 16  2015 ..
drwxr-xr-x    2 root     root           600 Jan  7  1970 param
drwxr-xr-x    2 root     root           160 Jun 26 06:41 tmp
drwxr-xr-x    2 root     root           160 Jun 25 23:26 upgrade
drwxr-xr-x    5 root     root           352 Mar 26 16:08 user
# cd param
# ls -al
total 88
drwxr-xr-x    2 root     root           600 Jan  7  1970 .
drwxr-xr-x    6 root     root           416 Jun 26 06:41 ..
-rw-------    1 root     root           528 Jul  4 03:55 cloud_storage.cfg
-rwxr-xr-x    1 root     root           189 Jan  1  1970 interfaces
-rw-r--r--    1 root     root         57604 Jul  4 03:55 logfile.log
-rw-r--r--    1 root     root            45 Jul  4 03:55 net.conf
-rw-r--r--    1 root     root          8000 Jul  4 03:55 sysenv.cfg
-rw-r--r--    1 root     root          8000 Jan  7  1970 sysenvcopy.cfg
# cp * /mnt/imx322
# cd ../user
# ls -al
total 0
drwxr-xr-x    5 root     root           352 Mar 26 16:08 .
drwxr-xr-x    6 root     root           416 Jun 26 06:41 ..
drwxr-xr-x    3 root     root          1480 May  9 20:50 bin
drwxr-xr-x    2 root     root           440 Jan  1  1970 etc
drwxr-xr-x    3 root     root           584 Apr 19 17:43 www
# ls -al bin
total 16476
drwxr-xr-x    3 root     root          1480 May  9 20:50 .
drwxr-xr-x    5 root     root           352 Mar 26 16:08 ..
-rwxr-xr-x    1 root     root       5669020 Apr 22 17:19 AVServer
-rwxr--r--    1 root     root         27184 Apr 22 17:19 CustomTools
-rwxr-xr-x    1 root     root           133 Mar 30 14:42 CustomTools.cfg
-rwxr--r--    1 root     root         36827 Apr 22 17:19 DebugInfo
-rwxr-xr-x    1 root     root        903653 Apr 22 17:19 DeviceSearch
-rwxr-xr-x    1 root     root        909510 Apr 22 17:19 SystemServer
-rwxr--r--    1 root     root            46 Apr 22 18:11 Ver.ini
-rwxr-xr-x    1 root     root        129657 Apr 22 17:19 WatchDog
drwxr-xr-x    2 root     root           160 Jan  1  1970 aaa
-rwxr-xr-x    1 root     root       7886392 Apr 22 17:19 boa
-rwxr-xr-x    1 root     root          1075 Apr 22 17:19 default.script
-rwxr-xr-x    1 root     root          2741 Apr 22 18:11 demo.sh
-rwxr-xr-x    1 root     root        515690 Apr 22 17:19 freep2p_server
-rwxr-xr-x    1 root     root         20846 Feb 25 04:02 i2cget
-rw-r--r--    1 root     root           463 May 10 06:50 jacklog.txt
-rwxr-xr-x    1 root     root        503883 Apr 22 17:19 libserversdk.so
-rwxrwxrwx    1 root     root        211710 Mar 16 03:26 mini_server
-rw-r--r--    1 root     root             0 Jan  1  1970 softdog.log
-rwxr--r--    1 root     root         10450 Feb 25 04:02 zoom.ko
# ls -al etc
total 36
drwxr-xr-x    2 root     root           440 Jan  1  1970 .
drwxr-xr-x    5 root     root           352 Mar 26 16:08 ..
-rwxr-xr-x    1 root     root          1785 Feb 25 04:02 boa.conf
-rwxr-xr-x    1 root     root         14154 Feb 25 04:02 mime.types
-rw-------    1 root     root         10284 Jul  4 03:56 onvif.cfg
-rwxr-xr-x    1 root     root           354 Apr 22 18:11 shadow
# ls -al www
total 124
drwxr-xr-x    3 root     root           584 Apr 19 17:43 .
drwxr-xr-x    5 root     root           352 Mar 26 16:08 ..
-rwxrw-rw-    1 root     root        103391 Jul 14  2015 download.jpg
-rwxrw-rw-    1 root     root          9662 Jul 14  2015 favicon.ico
-rwxrw-rw-    1 root     root          2358 Apr 18 11:02 index.htm
drwxr-xr-x    2 root     root           232 Apr 19 17:42 install
-rwxrw-rw-    1 root     root           737 Jul 14  2015 live.html
lrwxrwxrwx    1 root     root            13 Feb 25 04:02 snap.jpg -> /tmp/snap.jpg
# ls -al www/install
total 2904
drwxr-xr-x    2 root     root           232 Apr 19 17:42 .
drwxr-xr-x    3 root     root           584 Apr 19 17:43 ..
-rwxrw-rw-    1 root     root       2970864 Apr 18 11:00 IPCOCX_PX.exe
#

That's all for now.
 
Hello!
Sorry about my English...
I have similar cameras and several of them have already stopped working. I can't solve this problem yet. Google found this forum and I registered for help.
I have questions to you.
1. Whether prompt to me algorithm of removal of a firmware from a similar camera on tftp the server (Windows)
2. On this Board there are USB contacts, but I tried to connect the drive through the adapter and it is not visible.
all my cameras broke, no download, network RG45 and works only Uart/. The loader Amboot I can get. I can get Root access too (boot console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init= / bin/sh)
3. If it is possible to remove successfully a firmware from the working camera how it then can be put in non-working if on it the network does not work?
4. What function does the USB port perform in this camera, if it does not see the flash drive, and the connection to the computer does not work?

Thank you, alastairstevenson, for your support and for helping people like me!
 

Attachments

The log shows that the NAND flash is failing, it has grown bad blocks and giving ECC errors in active areas.
I don't think it's likely that an erase/rewrite of the flash would help much.

maks1978 said:
no download, network RG45
Click to expand...
If you mean that the ethernet interface is not working at all (eg no Link detect light at the switch / router, error when trying 'ping <some_IP_address> at the bootloader) then I don't see a way to load any data to apply to the flash.
Have you tried a ping at the bootloader prompt?
 
I Hear you. Thank you for such a quick response!
I will try to answer in order...
1. There are bad blocks in memory, but there is a NAND rclm command. I was planning on using it.
2. Even if I can't do it, I think the camera can work for a while.
3. the ethernet interface does not work on the computer (I connected the camera directly with a patch cord to it). Through the switch I have not tried. I'll do it if you need me.
4. Ping didn't try as the computer doesn't see network connection and it didn't occur to me.
5. USB connector on the Board - do you have an understanding for what it is? I tried the universal ambausb and DirectUSB tools, but it didn't help me. Also I wanted to connect a USB drive but couldn't.
6.I have no SD connector on the Board. I wanted to do the trick like you did here:
Unbricking the Mini PTZ V2
here
Another 'How to unbrick' a Huisun Mini PTZ V2 ...,
but I have failed...
Very interesting team
nand prog PAGE [PAGES] [no_ecc] [BITFLIP], but I haven't learned how to use it yet. I'm doing a nand dump PAGE and keep a log. But how to fix the data-I do not know.

Sorry for so many questions, but I really want to deal with this problem until the end and close this issue.
Thank you!
 
maks1978 said:
USB connector on the Board - do you have an understanding for what it is? I tried the universal ambausb and DirectUSB tools, but it didn't help me. Also I wanted to connect a USB drive but couldn't.
Click to expand...
I tried this on a couple of boards without success.
The Mini PTZ had one fitted as standard, which was pretty useful.
 
Hello!
Thank you very much for your answers. I have news on these cameras.
I was able to connect the USB port to the computer and he saw this camera (it is necessary to use a short and thick USB wire).
But now I have a problem-to use Ambausb program I have to specify the firmware in format.bin. I have pieces from mtdblock0-mtdblock6 working camera. How can I convert them to a file *.bin ?
I also have upgrade_hs.tar.gzip with working video camera.
How do I apply all this?
 
maks1978 said:
But now I have a problem-to use Ambausb program I have to specify the firmware in format.bin. I have pieces from mtdblock0-mtdblock6 working camera.
Click to expand...
maks1978 said:
How can I convert them to a file *.bin ?
Click to expand...
If you are saying that the AmbUSB program requires a full flash image in format.bin then if you definitely have a good export of all the flash partitions you can combine them all together, in the correct order, using the 'cat' command.
But maybe the program is looking for individual files for each flash partition?
But you would need to be very sure about what was needed.

Also - all camera-specific data such as serial number, model, MAC address etc would be duplicated.
A duplicate MAC address will cause network issues.
 
Thanks for your reply!
I can change the MAC address using the setenv command.
The archive copy blocks. I can't merge these files on Windows...
Can you help?
 

Attachments

maks1978 said:
I can't merge these files on Windows...
Click to expand...
The merged files are attached.
But - be very sure this is what should be done.
If not correct - there is a good chance you will permanently damage the camera.
Code: 
alastair@PC-I5 ~/Downloads $ ll mtdblock*
-rw-rw-r-- 1 alastair alastair   131072 Nov 23 18:12 mtdblock0
-rw-rw-r-- 1 alastair alastair  1310720 Nov 23 18:12 mtdblock1
-rw-rw-r-- 1 alastair alastair  1310720 Nov 23 18:12 mtdblock2
-rw-rw-r-- 1 alastair alastair  8388608 Nov 23 18:12 mtdblock3
-rw-rw-r-- 1 alastair alastair 54525952 Nov 23 18:14 mtdblock4
-rw-rw-r-- 1 alastair alastair 27262976 Nov 23 18:15 mtdblock5
-rw-rw-r-- 1 alastair alastair 37748736 Nov 23 18:15 mtdblock6
alastair@PC-I5 ~/Downloads $ cat mtdblock0 mtdblock1 mtdblock2 mtdblock3 mtdblock4 mtdblock5 mtdblock6 > mtdblock_all
alastair@PC-I5 ~/Downloads $ ll mtdblock*
-rw-rw-r-- 1 alastair alastair    131072 Nov 23 18:12 mtdblock0
-rw-rw-r-- 1 alastair alastair   1310720 Nov 23 18:12 mtdblock1
-rw-rw-r-- 1 alastair alastair   1310720 Nov 23 18:12 mtdblock2
-rw-rw-r-- 1 alastair alastair   8388608 Nov 23 18:12 mtdblock3
-rw-rw-r-- 1 alastair alastair  54525952 Nov 23 18:14 mtdblock4
-rw-rw-r-- 1 alastair alastair  27262976 Nov 23 18:15 mtdblock5
-rw-rw-r-- 1 alastair alastair  37748736 Nov 23 18:15 mtdblock6
-rw-r--r-- 1 alastair alastair 130678784 Nov 26 16:37 mtdblock_all
alastair@PC-I5 ~/Downloads $
 

Attachments

That looks like a UBIFS image file. Probably not a full flash image, maybe a partition.
I'm away for a couple of days, I'll try and look at it when I'm back.
 
I don't think it will be of any help, but attached is the extract of the files in the upgrade_hs.tar file you attached.
From the contents, it looks like a UBIFS image of an app partition of the camera from this firmware
Code: 
[VERSION]
sofvar=S2L33M_IMX322_X_5.1.34.5
 

Attachments

Thank you!
I understood. I don't know what to do...
How to raise the Internet on a brick? Toda probably enough to fill with the replacement of files mtdblock0 - 6
 
I don't really understand how can I store the data in any cell...
I am trying to make IP camera settings, but the Internet does not appear.
Logs from one camera attach.
 

Attachments

Managed to set up the Internet on one of the cameras. But he only works at Amboot.
But now I do not understand how I upload files mtdblock0 - 6 back to the camera. How to register it?
 

Attachments

I'm not sure how the nand commands in that Amboot would work.
They probably can be used - but I'm not familiar with them, and they are probably quite risky.

I'm not sure if you have tried this:
In Amboot, set the bootargs to boot to the ash shell, as you have already done
console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init=/bin/sh

When it boots to the ash # prompt, and complains
/bin/sh: can't access tty; job control turned off

try this to see if the environment will initialise and return to a # prompt that can be used.
/etc/init.d/rcS

If that gives errors, try executing some of the S** scripts in /etc/init.d such as S01udev.sh and S12udev to get to a working environment.
cd /etc/init.d
./S01udev.sh

Then see if you can bring up the ethernet interface, something like
ifconfig eth0 <camera_IP_address> up

Confirm with
ping <your_PC_IP_address>

Then at the # prompt, see if tftp is available, if so try
cd /
tftp -g -r mtdblock6 <tftp_server_IP_address>

If that works - you should be able to re-write mtdblock6 which seems to be the partition with the flash errors.
Best not to touch the bootloader and the system partitions mtdblock0, 1,2 and 3

Do you have an NFS share on the LAN?
If there is no tftp program in the camera, it may be possible to mount an nfs share.
Something like, assuming there is a /tmp folder

mkdir /tmp/NFS
mount -t nfs -o nolock <NFS_share_IP_address:/<sharename> /tmp/NFS

Then
ls -al /tmp/NFS to confirm it works.
 
You must log in or register to reply here.
Top Bottom