Добрый день! Сделали из IP камеры при прошивки кирпич, но решил не сдаваться и восстановить ее. Заводская прошивка есть. Нашел у нее UART подцепился к ней, вижу загрузку: C-Kermit> set line /dev/ttyUSB0
C-Kermit> set speed 115200
C-Kermit> set serial 8N1
C-Kermit> set carrier-watch off
C-Kermit> set flow-control none
C-Kermit> set prefixing all
C-Kermit> set modem none
C-Kermit> set file type bin
C-Kermit> set file name lit
C-Kermit> connect
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC8 0x40 0x17 0xC8 0x40 0x17
Spi(cs1): Block:64KB Chip:8MB Name:«GD25Q64»
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
8192 KiB hi_sfc at 0:0 is now current device
## Booting kernel from Legacy Image at 81000000 ...
Image Name: Linux-3.0.8
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1162812 Bytes = 1.1 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
Linux version 3.0.8 (root@localhost.localdomain) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #7 Tue Apr 29 09:48:55 CST 2014
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518
Memory policy: ECC disabled, Data cache writeback AXI bus clock 200000000. Built 1 zonelists in Zone order, mobility grouping on. Total pages: 18796
Kernel command line: mem=74M console=ttyAMA0,115200 root=/dev/mtdblock3 rootfstype=squashfs mtdparts=hi_sfc:256K(boot),1280k(kernel),512K(dataBlock),6144K(rootfs)
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 74MB = 74MB total
Memory: 72132k/72132k available, 3644k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
vmalloc : 0xc5000000 - 0xfe000000 ( 912 MB)
lowmem : 0xc0000000 - 0xc4a00000 ( 74 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.init : 0xc0008000 - 0xc001f000 ( 92 kB)
.text : 0xc001f000 - 0xc02b6000 (2652 kB)
.data : 0xc02b6000 - 0xc02c80a0 ( 73 kB)
.bss : 0xc02c80c4 - 0xc02d49f0 ( 51 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32 nr_irqs:32 32
sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms
Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
Switching to clocksource timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.16)
msgmni has been set to 140
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
TS82 driver for HI3518C
Can not pass authentication ... ...
Can not pass authentication ... ...
brd: module loaded
Spi id table Version 1.22
Spi(cs1) ID: 0xC8 0x40 0x17 0xC8 0x40 0x17
SPI FLASH start_up_mode is 3 Bytes
Spi(cs1):
Block:64KB
Chip:8MB
Name:«GD25Q64»
spi size: 8MB
chip num: 1
4 cmdlinepart partitions found on MTD device hi_sfc
Creating 4 MTD partitions on «hi_sfc»:
0x000000000000-0x000000040000 : «boot»
0x000000040000-0x000000180000 : «kernel»
0x000000180000-0x000000200000 : «dataBlock»
0x000000200000-0x000000800000 : «rootfs»
Fixed MDIO Bus: probed
himii: probed
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
TCP cubic registered
NET: Registered protocol family 17
registered taskstats version 1
�SQUASHFS error: Xattrs in filesystem, these will be ignored
SQUASHFS error: unable to read xattr id index table
SQUASHFS error: unable to read inode lookup table
List of all partitions:
1f00 256 mtdblock0 (driver?)
1f01 1280 mtdblock1 (driver?)
1f02 512 mtdblock2 (driver?)
1f03 6144 mtdblock3 (driver?)
f000 256 romblock0 (driver?)
f001 1280 romblock1 (driver?)
f002 512 romblock2 (driver?)
f003 6144 romblock3 (driver?)
No filesystem could mount root, tried: squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,3)
Backtrace: [<c00235a0>] (dump_backtrace+0x0/0x10c) from [<c022a7f4>] (dump_stack+0x18/0x1c)
r6:c001b4bc r5:c02c8370 r4:c02c8370 r3:0000000a
[<c022a7dc>] (dump_stack+0x0/0x1c) from [<c022a85c>] (panic+0x64/0x190) [<c022a7f8>] (panic+0x0/0x190) from [<c0008ed4>] (mount_block_root+0x26c/0x2bc) r3:c441ff2c r2:80000000 r1:c441ff60 r0:c028418c r7:00000009 [<c0008c68>] (mount_block_root+0x0/0x2bc) from [<c0008f78>] (mount_root+0x54/0x6c) [<c0008f24>] (mount_root+0x0/0x6c) from [<c00090f0>] (prepare_namespace+0x160/0x1b8) r5:c001b4d1 r4:c02c8140 [<c0008f90>] (prepare_namespace+0x0/0x1b8) from [<c0008458>] (kernel_init+0xe8/0x11c) r5:c001aca8 r4:c001aca8 [<c0008370>] (kernel_init+0x0/0x11c) from [<c003309c>] (do_exit+0x0/0x700) r5:c0008370 r4:00000000
Есть загрузчик: U-Boot 2010.06 (Jun 04 2014 - 14:06:51)
hisilicon # ? ? - alias for 'help'
base - print or set address offset
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
ext2load- load binary file from a Ext2 filesystem
ext2ls - list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
getinfo - print hardware information
go - start application at address 'addr'
help - print command description/usage
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
tftp - tftp - download or upload image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
А вот заводская прошивка: root@kali:~# file orig.bin
orig.bin: data
root@kali:~# binwalk orig.bin
DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 1556 0x614 uImage header, header size: 64 bytes, header CRC: 0x25C2417B, created: Tue Apr 29 05:48:58 2014, image size: 1162812 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0xD56C3525, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: «Linux-3.0.8» 1164432 0x11C490 Squashfs filesystem, little endian, version 4.0, compression:lzma (non-standard type definition), size: 6221278 bytes, 670 inodes, blocksize: 131072 bytes, created: Thu Dec 4 12:27:11 2014
На камеру закидываю ее вот так: hisilicon # loadb
## Ready for binary (kermit) download to 0x80008000 at 115200 bps...
(Back at kali)
----------------------------------------------------
(/root/) C-Kermit>send orig.bin
(/root/) C-Kermit>connect
Connecting to /dev/ttyUSB0, speed 115200
Escape character: Ctrl-\ (ASCII 28, FS): enabled
Type the escape character followed by C to get back,
or followed by ? to see other options. ----------------------------------------------------
## Total Size = 0x003ea37e = 4105086 Bytes
## Start Addr = 0x80008000
А вот дальше ума не приложу че делать, так как в linux не соображаю нифига. Пишите пожалуйста подробно. Спасибо!
