Hallo,
ich habe mir die Firmware genauer angeschaut:
Was kann man sonst noch so herauslesen:
- Falls es UART Anschlüsse gibt, sollten die auf 9600baud laufen
- die Cam hat eine Config um einen NFS Server zu mounten
- es gibt eine Autoupdate Konfiguration auf camlight-upgrade.steinel.de:9083
- passwd Datei: root:$1$RYIwEiRA$d5iRRVQ5ZeRTrJwGjRy.B0:0:0:root:/:/bin/sh
- telnetd, sh und busybox sind im ROM enthalten
Das Firmwarefile ist ein ZIP.
Darin befinden sich .img Dateien.
user-x.cramfs.img
/bin
/bin/BurnHWID
/bin/ProductDefinition
/bin/Sofia
/bin/Squirrel
/bin/Squirrel/comm
/bin/Squirrel/comm/CommBase
/bin/Squirrel/comm/MainComm
/bin/Squirrel/comm/Transparent.nut
/bin/Squirrel/ptz
/bin/Squirrel/ptz/MainPtz
/bin/Squirrel/ptz/PELCOD.nut
/bin/Squirrel/ptz/PELCOP.nut
/bin/Squirrel/ptz/PtzBase
/bin/Squirrel/rs485
/bin/Squirrel/rs485/GPS.nut
/bin/Squirrel/rs485/InteractCmd.nut
/bin/Squirrel/rs485/MainRS485
/bin/Squirrel/rs485/RS485Base
/bin/Squirrel/rs485/Transparent.nut
/bin/armbenv
/bin/cgi
/bin/dvrHelper
/bin/dvrbox
/bin/netinit
/bin/searchIp
/etc
/etc/Wireless
/etc/cgi
/etc/loadmod
/etc/loadpublic
/lib
/lib/libXMcrypto.so
/lib/libdnvqe.so
/lib/libdvr.so
/lib/libhive_AEC.so
/lib/libhive_AGC.so
/lib/libhive_ANR.so
/lib/libhive_EQ.so
/lib/libhive_GAIN.so
/lib/libhive_HDR.so
/lib/libhive_HPF.so
/lib/libhive_MBC.so
/lib/libhive_RES.so
/lib/libhive_RNR.so
/lib/libhive_common.so
/lib/libiconv.so
/lib/libslice_trans.so
/lib/libupvqe.so
/lib/modules
/lib/modules/8188eu.ko
/lib/modules/acodec.ko
/lib/modules/at24c.ko
/lib/modules/clkcfg_hi3518e.sh
/lib/modules/demo_config.sh
/lib/modules/extdrv
/lib/modules/extdrv/adv_7179.ko
/lib/modules/extdrv/piris.ko
/lib/modules/extdrv/pwm.ko
/lib/modules/extdrv/sample_ist.ko
/lib/modules/extdrv/sensor_i2c.ko
/lib/modules/extdrv/sensor_spi.ko
/lib/modules/extdrv/ssp_ili9341v_6bit.ko
/lib/modules/extdrv/ssp_ili9342h_6bit.ko
/lib/modules/extdrv/ssp_ota5182.ko
/lib/modules/extdrv/tlv_320aic31.ko
/lib/modules/hi3518e_adec.ko
/lib/modules/hi3518e_aenc.ko
/lib/modules/hi3518e_ai.ko
/lib/modules/hi3518e_aio.ko
/lib/modules/hi3518e_ao.ko
/lib/modules/hi3518e_base.ko
/lib/modules/hi3518e_chnl.ko
/lib/modules/hi3518e_h264e.ko
/lib/modules/hi3518e_isp.ko
/lib/modules/hi3518e_ive.ko
/lib/modules/hi3518e_jpege.ko
/lib/modules/hi3518e_rc.ko
/lib/modules/hi3518e_region.ko
/lib/modules/hi3518e_sys.ko
/lib/modules/hi3518e_tde.ko
/lib/modules/hi3518e_venc.ko
/lib/modules/hi3518e_vgs.ko
/lib/modules/hi3518e_viu.ko
/lib/modules/hi3518e_vpss.ko
/lib/modules/hi_cipher.ko
/lib/modules/hi_media.ko
/lib/modules/hi_mipi.ko
/lib/modules/hifb.ko
/lib/modules/hiuser.ko
/lib/modules/hn_config.sh
/lib/modules/load3518e
/lib/modules/load3518ev201
/lib/modules/lowpower.sh
/lib/modules/mmz.ko
/lib/modules/pinmux_hi3518e.sh
/lib/modules/sysctl_hi3518e.sh
/lib/modules/wdt.ko
/sbin
/sbin/HWID
/sbin/mnt
/sbin/rtl_hostapd.conf
/sbin/run_loop
/sbin/udhcpc.script
/sbin/udhcpd.conf
/sbin/wep.conf
/sbin/wpa_hide_ssid.conf
/sbin/wpa_none.conf
/sbin/wpa_wpa2.conf
/sbin/wpa_wps.conf
/sbin/xmprop
/share
/share/fonts
/share/fonts/Font.bin
/share/music
/share/music/8407.pcm
/share/music/8858.pcm
/share/music/welcome.pcm
in web-x.cramfs.img
/1.jpg
/11.jpg
/16.jpg
/161.jpg
/25.jpg
/251.jpg
/36.jpg
/361.jpg
/4.jpg
/41.jpg
/64.jpg
/641.jpg
/9.jpg
/91.jpg
/DVR.htm
/English.js
/ForbitPlay.gif
/ForbitRecord.gif
/ForbitSubPlay.gif
/Login.htm
/SimpChinese.js
/Talk.gif
/addPreSet.jpg
/addPreSet1.jpg
/audio.jpg
/audio1.jpg
/back.GIF
/bg.jpg
/board.gif
/bt.gif
/config.js
/delPreSet.jpg
/delPreSet1.jpg
/dlr.jpg
/dm.jpg
/editCruise.jpg
/editCruise1.jpg
/err.htm
/err.jpg
/failed.htm
/full.jpg
/full1.jpg
/goCruise.jpg
/goCruise1.jpg
/goPreSet.jpg
/goPreSet1.jpg
/help.gif
/index.htm
/l_bgm.gif
/l_bgmd.gif
/labg.jpg
/lbt.jpg
/lib
/lib/libdvr.so
/lib/modules
/lib/modules/hi3518e_adec.ko
/lib/modules/hi3518e_aenc.ko
/lib/modules/hi3518e_ai.ko
/lib/modules/hi3518e_aio.ko
/lib/modules/hi3518e_ao.ko
/lib/modules/hi3518e_base.ko
/lib/modules/hi3518e_chnl.ko
/lib/modules/hi3518e_h264e.ko
/lib/modules/hi3518e_isp.ko
/lib/modules/hi3518e_ive.ko
/lib/modules/hi3518e_jpege.ko
/lib/modules/hi3518e_rc.ko
/lib/modules/hi3518e_region.ko
/lib/modules/hi3518e_sys.ko
/lib/modules/hi3518e_tde.ko
/lib/modules/hi3518e_venc.ko
/lib/modules/hi3518e_vgs.ko
/lib/modules/hi3518e_viu.ko
/lib/modules/hi3518e_vpss.ko
/lib/modules/hi_cipher.ko
/logOut.gif
/logo.gif
/lr.jpg
/m.css
/m.jsp
/m_dral.gif
/m_dral.jpg
/m_dram.gif
/m_dram.jpg
/m_drar.gif
/m_drar.jpg
/m_inTop.jpg
/m_top.jpg
/mb_bg.jpg
/mb_bg2.jpg
/mc.jpg
/md5.js
/ml.jpg
/mr.jpg
/mt.js
/noPlay.gif
/noRecord.gif
/noSubPlay.gif
/noTalk.gif
/play.gif
/plcb11.jpg
/plcbl.jpg
/plcbr.jpg
/record.gif
/recordAll.jpg
/recordAll1.jpg
/reminder.html
/result.html
/sal.gif
/sal1.gif
/sar.gif
/sar1.gif
/sas.gif
/sks.gif
/snap.jpg
/snap1.jpg
/startAll.jpg
/startAll1.jpg
/stopAll.jpg
/stopAll1.jpg
/stopCruise.jpg
/stopCruise1.jpg
/stopRecordAll.jpg
/stopRecordAll1.jpg
/subPlay.gif
/t.jpg
/t1t.jpg
/t2t.jpg
/top.jpg
/tx1.jpg
/tx2.jpg
/tx3.jpg
/tx4.jpg
/yt+.gif
/yt+1.gif
/yt-.gif
/yt-1.gif
/yt1.jpg
/yt11.jpg
/yt2.jpg
/yt21.jpg
/yt3.jpg
/yt31.jpg
/yt4.jpg
/yt41.jpg
/yt5.jpg
/yt51.jpg
/yt51a.jpg
/yt51b.jpg
/yt5a.jpg
/yt5b.jpg
/yt6.jpg
/yt61.jpg
/yt7.jpg
/yt71.jpg
/yt8.jpg
/yt81.jpg
/yt9.jpg
/yt91.jpg
/yta1.jpg
/yta11.jpg
/ytabg.jpg
/yy1.jpg
/yy11.jpg
custom-x.cramfs.img
/CustomConfig
/CustomConfig/9530Disable
/CustomConfig/AVEnc.custom
/CustomConfig/Alarm.custom
/CustomConfig/Camera.custom
/CustomConfig/Detect.custom
/CustomConfig/ExtDevIDConfig.custom
/CustomConfig/General.custom
/CustomConfig/NetWork.custom
/CustomConfig/OEMcfg.custom
/CustomConfig/Record.custom
/CustomConfig/Uart.custom
/Dot
/Dot/0.dot
/FirmwareInfo
/ProductDefinition
/data
/data/Fonts
/data/Strings
/data/Strings/Arabic
/data/Strings/Brazilian
/data/Strings/Bulgarian
/data/Strings/ChineseEnglish
/data/Strings/Czech
/data/Strings/Dutch
/data/Strings/English
/data/Strings/Farsi
/data/Strings/Finnish
/data/Strings/French
/data/Strings/German
/data/Strings/Greek
/data/Strings/Hebrew
/data/Strings/Hungarian
/data/Strings/Indonesian
/data/Strings/Italian
/data/Strings/Japanese
/data/Strings/Poland
/data/Strings/Portugal
/data/Strings/Romanian
/data/Strings/Russian
/data/Strings/SimpChinese
/data/Strings/Slovakia
/data/Strings/Spanish
/data/Strings/Swedish
/data/Strings/Thai
/data/Strings/TradChinese
/data/Strings/Turkey
/sbin
/sbin/hostapd
/sbin/libhive_RES.so
Interessant ist der inhalt von /sbin/mnt:
#!/bin/sh
if [ $# == 0 ] ; then
mount -t nfs 10.2.5.100:/home/share /home -o nolock
echo "mount -t nfs 10.2.5.100:/home/share /home -o nolock"
else
mount -t nfs 10.2.$1.100:/home/share /home -o nolock
echo "mount -t nfs 10.2.$1.100:/home/share /home -o nolock"
fi
OEMcfg.custom:
"Correspondent":
{
"BrandInfo":"H264",
"RevSpace":"NVT",
"FirmwareVersion":"V100",
"HardwareId":"00001",
"Port":8899,
"Scope":[
"onvif://www.onvif.org/type/video_encoder",
"onvif://www.onvif.org/type/audio_encoder",
"onvif://www.onvif.org/hardware/IPC-model",
"onvif://www.onvif.org/location/country/china",
"onvif://www.onvif.org/name/NVT"
]
}
}
NetWork.custom:
{
"AlarmServer": [
{
"Alarm": true,
"Enable": false,
"Log": false,
"Protocol": "GENERAL",
"Server": {
"Address": "0x00000000",
"Anonymity": false,
"Name": "AlarmServer",
"Password": "",
"Port": 15002,
"UserName": ""
}
},
{
"Alarm": true,
"Enable": false,
"Log": false,
"Protocol": "NONE",
"Server": {
"Address": "0x00000000",
"Anonymity": false,
"Name": "AlarmServer",
"Password": "",
"Port": 15002,
"UserName": ""
}
},
{
"Alarm": true,
"Enable": false,
"Log": false,
"Protocol": "NONE",
"Server": {
"Address": "0x00000000",
"Anonymity": false,
"Name": "AlarmServer",
"Password": "",
"Port": 15002,
"UserName": ""
}
},
{
"Alarm": true,
"Enable": false,
"Log": false,
"Protocol": "NONE",
"Server": {
"Address": "0x00000000",
"Anonymity": false,
"Name": "AlarmServer",
"Password": "",
"Port": 15002,
"UserName": ""
}
},
{
"Alarm": true,
"Enable": false,
"Log": false,
"Protocol": "NONE",
"Server": {
"Address": "0x00000000",
"Anonymity": false,
"Name": "AlarmServer",
"Password": "",
"Port": 15002,
"UserName": ""
}
}
],
"DAS": {
"DeviceID": "123456",
"Enable": false,
"Password": "",
"Port": 9400,
"ServerAddr": "10.2.1.58",
"UserName": "admin"
},
"LocalSdkPlatform": null,
"Nat": {
"Addr": "52.29.63.113",
"DnsServer1": "0x713F1D34",
"DnsServer2": "0x713F1D34",
"NatEnable": true,
"Port": 8765,
"XMeyeMTU": 1280
},
"Net3G": {
"APN": "ChinaNet",
"DialNum": "#777",
"Enable": false,
"NetType": "EVDO",
"OperatorsValue": "AIRTEL",
"Password": "vnet.mobi",
"UserName": "ctnet@mycdma.cn"
},
"NetARSP": [
{
"ARSPKey": "DNS",
"Enable": false,
"HttpPort": 8080,
"Interval": 5,
"Server": {
"Address": "",
"Anonymity": false,
"Name": "",
"Password": "",
"Port": 15000,
"UserName": "None"
},
"URL": ""
},
{
"ARSPKey": "None",
"Enable": false,
"HttpPort": 8080,
"Interval": 5,
"Server": {
"Address": "",
"Anonymity": false,
"Name": "None",
"Password": "",
"Port": 80,
"UserName": "None"
},
"URL": ""
},
{
"ARSPKey": "None",
"Enable": false,
"HttpPort": 8080,
"Interval": 5,
"Server": {
"Address": "",
"Anonymity": false,
"Name": "None",
"Password": "",
"Port": 80,
"UserName": "None"
},
"URL": ""
},
{
"ARSPKey": "None",
"Enable": false,
"HttpPort": 8080,
"Interval": 5,
"Server": {
"Address": "",
"Anonymity": false,
"Name": "None",
"Password": "",
"Port": 80,
"UserName": "None"
},
"URL": ""
},
{
"ARSPKey": "None",
"Enable": false,
"HttpPort": 8080,
"Interval": 5,
"Server": {
"Address": "",
"Anonymity": false,
"Name": "None",
"Password": "",
"Port": 80,
"UserName": "None"
},
"URL": ""
}
],
"NetCommon": {
"GateWay": "0x0101A8C0",
"HostIP": "0x0A01A8C0",
"HostName": "LocalHost",
"HttpPort": 80,
"MAC": "00:12:16:??:??:??",
"MaxBps": 0,
"MonMode": "TCP",
"SSLPort": 8443,
"Submask": "0x00FFFFFF",
"TCPMaxConn": 10,
"TCPPort": 34567,
"TransferPlan": "Quality",
"UDPPort": 34568,
"UseHSDownLoad": false
},
"NetDDNS": [
{
"DDNSKey": "CN99",
"Enable": false,
"HostName": "your.3322.org",
"Server": {
"Address": "0x0100060A",
"Anonymity": false,
"Name": "members.3322.org",
"Password": "",
"Port": 80,
"UserName": ""
}
},
{
"DDNSKey": "DynDns",
"Enable": false,
"HostName": "your.dyndns.org",
"Server": {
"Address": "0x0100060A",
"Anonymity": false,
"Name": "members.dyndns.org",
"Password": "",
"Port": 80,
"UserName": ""
}
},
{
"DDNSKey": "Oray",
"Enable": false,
"HostName": "your.gicp.net",
"Server": {
"Address": "0x0100060A",
"Anonymity": false,
"Name": "hphwebservice.oray.net",
"Password": "",
"Port": 80,
"UserName": ""
}
},
{
"DDNSKey": "NO-IP",
"Enable": false,
"HostName": "your.no-ip.com",
"Server": {
"Address": "0x0100060A",
"Anonymity": false,
"Name": "dynupdate.no-ip.com",
"Password": "",
"Port": 80,
"UserName": ""
}
},
{
"DDNSKey": "MYQ-SEE",
"Enable": false,
"HostName": "your.myq-see.com",
"Server": {
"Address": "0x0100060A",
"Anonymity": false,
"Name": "myq-see.com",
"Password": "",
"Port": 80,
"UserName": ""
}
}
],
"NetDHCP": [
{
"Enable": false,
"Interface": "eth0"
},
{
"Enable": false,
"Interface": "eth1"
},
{
"Enable": false,
"Interface": "eth2"
},
{
"Enable": false,
"Interface": "eth3"
},
{
"Enable": false,
"Interface": "bond0"
}
],
"NetDNS": {
"Address": "0x5045C854",
"SpareAddress": "0x2846C854"
},
"NetEmail": {
"Enable": false,
"MailServer": {
"Address": "0x00000000",
"Anonymity": false,
"Name": "Your SMTP Server",
"Password": "",
"Port": 25,
"UserName": ""
},
"Port": 25,
"Recievers": [
"none",
"none",
"none",
"none",
"none"
],
"Schedule": [
"0 00:00:00-24:00:00",
"0 00:00:00-24:00:00"
],
"SendAddr": "",
"Title": "Alarm Message",
"UseSSL": false
},
"NetFTP": {
"Directory": "",
"Enable": false,
"MaxFileLen": 128,
"Server": {
"Address": "0x00000000",
"Anonymity": false,
"Name": "FTP",
"Password": "",
"Port": 21,
"UserName": ""
}
},
"NetIPFilter": {
"Banned": [
"0x00000000",
"0x00000000",
"0x00000000",
"0x00000000",
"0x00000000",
"0x00000000",
"0x00000000",
],
"Enable": false,
"Trusted": [
"0x00000000",
"0x00000000",
"0x00000000",
"0x00000000",
"0x00000000",
"0x00000000",
]
},
"NetKeyboard": {
"Enable": false,
"ListenPort": 0,
"ParserProtocol": "NONE",
"TransProtocol": "",
"deviceAddr": 0
},
"NetMobile": null,
"NetNTP": {
"Enable": true,
"Server": {
"Address": "0x00000000",
"Anonymity": false,
"Name": "de.pool.ntp.org",
"Password": "",
"Port": 123,
"UserName": ""
},
"TimeZone": 13,
"UpdatePeriod": 60
},
"NetPPPoE": {
"Enable": null
},
"OnlineUpgrade": {
"AutoCheck": true,
"AutoUpgradeImp": true,
"Enable": true,
"IgnoreAllVersion": true,
"IgnoreCurVersion": false,
"JustImpVersion": false,
"ServerAddr": "camlight-upgrade.steinel.de",
"ServerPort": 9083
},
"PMS": {
"BoxID": "",
"Enable": true,
"Port": 80,
"PushInterval": 10,
"ServName": "push.umeye.cn"
},
"Upnp": {
"Enable": false,
"HTTPPort": 80,
"MediaPort": 34567,
"MobilePort": 34599,
"State": false
},
"Wifi": {
"Auth": "OPEN",
"Channel": 0,
"Enable": false,
"EncrypType": "NONE",
"GateWay": "0x0101A8C0",
"HostIP": "0x0C01A8C0",
"KeyType": 0,
"Keys": "&&&&&&&&",
"NetType": "Infra",
"SSID": "any",
"Submask": "0x00FFFFFF"
},
"WifiMode": {
"AutoSwitchAPMode": false
}
}
romfs-x.cramfs_stripped.img:
bin
bin/[
bin/[[
bin/ash
bin/awk
bin/beep
bin/btools
bin/busybox
bin/cat
bin/chmod
bin/chpst
bin/cp
bin/crontab
bin/cttyhack
bin/date
bin/dd
bin/dmesg
bin/dumpleases
bin/echo
bin/env
bin/envdir
bin/envuidgid
bin/false
bin/hiddrs
bin/hier
bin/hiew
bin/hil2s
bin/himc
bin/himd
bin/himd.l
bin/himm
bin/hush
bin/i2c_read
bin/i2c_write
bin/ip
bin/ipaddr
bin/iplink
bin/iproute
bin/iprule
bin/iptunnel
bin/kill
bin/killall
bin/linux32
bin/linux64
bin/ln
bin/logger
bin/login
bin/ls
bin/lzcat
bin/lzma
bin/mesg
bin/mkdir
bin/mkfifo
bin/mknod
bin/mount
bin/msh
bin/mv
bin/netstat
bin/ping
bin/pkill
bin/printenv
bin/ps
bin/pwd
bin/rm
bin/rmdir
bin/rtcwake
bin/runsv
bin/runsvdir
bin/script
bin/scriptreplay
bin/sed
bin/seq
bin/setarch
bin/setuidgid
bin/sh
bin/sleep
bin/softlimit
bin/ssp_read
bin/ssp_write
bin/stat
bin/sv
bin/sync
bin/tar
bin/test
bin/tftp
bin/top
bin/touch
bin/true
bin/tty
bin/udevadm
bin/udevd
bin/udpsvd
bin/umount
bin/uname
bin/unlzma
bin/xargs
boot
boot/uImage
dev
etc
etc/fs-version
etc/fstab
etc/group
etc/init.d
etc/init.d/dnode
etc/init.d/rcS
etc/inittab
etc/mtab
etc/passwd
etc/passwd-
etc/ppp
etc/ppp/peers
etc/ppp/pppoe-options
etc/ppp/pppoe-start
etc/profile
etc/protocols
etc/resolv.conf
etc/services
etc/udev
etc/udev/disk-hotplug.sh
etc/udev/firmware.sh
etc/udev/rules.d
etc/udev/rules.d/11-usb-hotplug.rules
etc/udev/rules.d/50-firmware.rules
etc/udev/rules.d/54-gphoto.rules
etc/udev/rules.d/60-pcmcia.rules
etc/udev/rules.d/75-cd-aliases-generator.rules.optional
etc/udev/rules.d/75-persistent-net-generator.rules.optional
etc/udev/rules.d/90-hal.rules
etc/udev/rules.d/97-bluetooth-serial.rules
etc/udev/rules.d/99-fuse.rules
etc/udev/rules.d/device-mapper.rules
etc/udev/udev.conf
etc/udev/usbdev-hotplug.sh
etc/xmtelnetdpw
home
lib
lib/hi_media.ko
lib/hi_mipi.ko
lib/ld-uClibc-0.9.33.2.so
lib/ld-uClibc.so.0
lib/libc.so.0
lib/libcrypt-0.9.33.2.so
lib/libcrypt.so.0
lib/libdl-0.9.33.2.so
lib/libdl.so.0
lib/libgcc_s.so
lib/libgcc_s.so.1
lib/libiw.so.29
lib/libm-0.9.33.2.so
lib/libm.so.0
lib/libnsl-0.9.33.2.so
lib/libnsl.so.0
lib/libpthread-0.9.33.2.so
lib/libpthread.so.0
lib/libresolv-0.9.33.2.so
lib/libresolv.so.0
lib/librt-0.9.33.2.so
lib/librt.so.0
lib/libstdc++.so
lib/libstdc++.so.6
lib/libstdc++.so.6.0.19
lib/libstdc++.so.6.0.19-gdb.py
lib/libthread_db-0.9.33.2.so
lib/libthread_db.so.1
lib/libuClibc-0.9.33.2.so
lib/libutil-0.9.33.2.so
lib/libutil.so.0
linuxrc
mnt
mnt/custom
mnt/logo
mnt/mtd
mnt/web
opt
proc
root
sbin
sbin/arp
sbin/blockdev
sbin/bootchartd
sbin/crond
sbin/depmod
sbin/dhcprelay
sbin/envext
sbin/flash_eraseall
sbin/getty
sbin/halt
sbin/hostapd
sbin/ifconfig
sbin/ifdown
sbin/ifup
sbin/init
sbin/insmod
sbin/iwconfig
sbin/iwlist
sbin/iwpriv
sbin/klogd
sbin/logread
sbin/lsmod
sbin/makedevs
sbin/modinfo
sbin/modprobe
sbin/pivot_root
sbin/poweroff
sbin/rdate
sbin/rdev
sbin/readprofile
sbin/reboot
sbin/rmmod
sbin/route
sbin/setfont
sbin/svlogd
sbin/syslogd
sbin/telnetd
sbin/udhcpc
sbin/udhcpd
sbin/wlandaemon
sbin/wpa_supplicant
sys
tmp
usr
usr/lib
usr/share
utils
var
var/run
var/run/utmp
var/tmp
