Hikvision cleverly incorporated a very accurate FFC shutter design that is used as a calibration reference for the microbolometer measurement process. The standard DS-2TP31 camera uses a conventional “free air” open FFC flag that is vulnerable to temperature errors at the point of flag temperature measurement. Image stacking also appears to have been employed but I do not know the exact purpose of this except to create an average sample for measurement.
I totally agree that the use of thermal imaging cameras was a mixture of science and ‘wishful thinking’ It is very difficult to accurately measure a human's core temperature at a distance, using a thermal camera.That is a topic that has been covered before on this forum though. What impressed me with ten DC-2TP31B was that the design had been enhanced in hardware and firmware to provide meaningful non contact measurements of good accuracy. How accurate the camera is over the full range of ambient temperature, I have not tested. Like some thermal camera manufacturers, Hikvision realised that a weakness in many modern budget thermal cameras was the thermal differential between the FFC flag and the temperature sensor used to enter mine it’s surface temperature. An error in this measurement is transferred to ten measurement system and introduces that error into it. Hikvision positioned a small temperature sensor in a ‘garage’ that reps the FFC shutter at a stable temperature away from air currents. The sensor obtains a reasonable measurement of the shutters surface temperature as a result. Nice idea
As the the accuracy of any master reference for temperature….. that is not known to me at this time. I can say that my test DS-2TP31B easily met the stated specification of measurement accuracy when tested against a Professional Blackbody of known accuracy and emissivity. The permitted error was +/-0.3C between 30C and 45C. My sample unit had an error of +0.1C at 40C in an ambient of 21C and this level of error starts to challenge the accuracy of the Blackbody so an error can be in the cameras measurement, or the Blackbody control loop/deviation etc.
Before you open up your UTi260B watch this first
https://youtu.be/1yYN5GsLT3wThis morning my UTi260B overheated during charging. I always monitor my USB charging and it went to something like 3.5A! That's what trigger my interest.
After disconnecting the charger, I placed the unit in a safer location (outdoors) as a precaution against any possibility of the unit going up in flames. Some spots are hot to the touch. The hottest spot is near the (finger) trigger switch is in excess of 54°C, measurement done with an IR Thermometer about 20 min after disconnection. It took me a bit of time to recompose myself after moving the unit.
5 hours latter after letting the unit to cool down, as expected that unit wouldn't startup.
I would now recommend everyone to exercise caution when charging thier UTi260Bs. It may be sensible to place the unit in some place where any fire dammage can be controlled in case the battery chargging goes wrong.
I will attempt opening the unit up very soon.
Meanwhile I am open to any advice.
Hello. Found this menu, maybe it will help. Back button three times, up once.
Some folks selling it 600€
The 31B model 🤣🤣
The DS-2TP31B model was a higher priced version of the DS-2TP31 aka E1 camera. The cost was likely due to the “COVID-19” effect on pricing and also the specialist nature of the camera. Whilst it is true that I bought several brand new DS2TP31B cameras at only £60 each, that was just one of those bargains that I stumbled across as the Pandemic began to recede and also people realised that thermal cameras were not the panacea to COVID-19 detection that they once thought they were. I have not seen that great price repeated. I believe it was a surplus dealer who had bought a large number of units and was just dumping them onto the market. He said as much to me and claimed I would never find a lower price.
It is true that the DS-2TP31B has a limited temperature measurement range but thankfully it still offers the full high sensitivity range for the actually imaging that it produces. It is still perfect for things like PCB repair where you are looking for the hot component when injecting a voltage. For £60 they were an absolute bargain. Added to that, they are very accurate for measurements between +20C and +50C which is still a useful range. They also lend themselves to spotting wildlife in the garden. I would think that they would be great for VET work as well as VETS are looking for soft tissue issues that fall within the cameras measurement capabilities.
It does not surprise me that some of these DS-2TP31B cameras are still for sale at high prices. They were not cheap to buy into stock and some dealers are trying to recover their investment so advertise them at cost of higher. They likely hope for another peak in Covid-19 events that might stimulate sales again. I will not knock someone for trying to recover their investment. Some sellers on eBay may have seen the original RRP and are thinking the cameras are still worth that sort of money. The market price of this specialist version of the DS-2TP31 is highly unstable and there are bargains to be had
I just bought the DS-2TP21B which is the bigger brother to the 31B. It is the COVID-19 fever detection version of the HikMicro M10 camera. Still 160 x 120 pixels, but a more capable camera with manual focus, touch screen, Wireless connectivity, video recording, many measurement functions, decent IFOV and it actually measures from 0C to +100C (tested by me). That has turned out to be a really nice thermal camera that is perfect for PCB work etc. I bought it, new in its hard case with two batteries, a desk charger and power supply for only £220. There is another of these cameras on eBay UK at the moment for £300. Still not a bad price for what it offers the user. The RRP on the DS-2TP21B was over 7000 Euros
It can now be bought from UK dealers for prices ranging from just over £1.5K to £3K. The prices were highly inflated during the Pandemic.
https://www.conrad.com/p/hikvision-ds-2tp21b-6avfw-ir-camera-30-up-to-45-c-160-x-120-pixel-wi-fi-fever-detection-2251776Fraser
I am not going to defend the RRP of COVID-19 fever detection versions of thermal cameras but there may be some justification in the higher prices beyond just the specialist nature of the camera version and market demand at a time of crisis.
I recently saw a comment on a UK thermal camera dealers site detailing the two available purchase options…… Ex Factory and Calibration Checked. The comment stated that thermal cameras come out of the factory without a calibration certificate as the factory production processes normally provide a camera that makes measurements that fall within its stated tolerances. It was stated that this was a belief of compliance and accuracy, rather than a proven fact….. just like CE marking ! The dealer stated that where the measurements of a cameras measurements need to be of known, proven accuracy, a calibration check and associated certificate is available at additional cost.
With the above in mind, it is plausible that the Covid-19 fever detection cameras with their claimed enhanced measurement accuracy of +/- 0.5 Celsius (+/- 0.3 Celsius if a Blackbody is used) tolerance may have undergone enhanced calibration at the time of production to ensure accuracy. Such calibration can be time consuming so additional cost of production may result. I have no insight into the production of the fever detection versions of cameras beyond noting the hardware enhancements that were employed to improve measurement accuracy.
As a side note, the DS-2TP21B provides a measurement calibration enhancement option in the menu. The camera is pointed at a known accurate Blackbody with Emissivity, distance and temperature known, and a measurement calibration correction is stored. A nice feature to have and one not offered on the DS-2TP31B camera. Such a user accessible feature would be great on all thermal imaging cameras that are capable of taking temperature measurements.
To show how times have changed….I was watching an auction for a Guide IR T120H COVID-19 fever detection camera as the priced dropped over time. The camera is from the guide IR entry level series so is pretty basic. The resolution is 120 x 90 pixels provided by the Guide Sensmart TIM120 core. The “H” version firmware is heavily modified and offers two modes of operation to detect Fever in humans….. Portrait mode and bulk surveillance mode (my terms, not Guide’s). The portrait mode provides the outline of a face that the user must align with the person being tested. The bulk surveillance mode is more like a normal thermal camera and the measurement function highlights hottest target in view. The temperature measurement range is restricted to improve accuracy. Sadly only one colour palette is available and it is tuned fir fever detection
I saw that the T120H that I was watching had dropped to £80 on eBay. Some years ago I would have bought that in the blink of an eye…. But not any more. My analysis of that camera was that it’s 120 x 90 pixels was a serious restriction on its usefulness when the wide FOV lens was also considered. The fact that there was only the one colour pallet was a real downer for me, and this was a very basic camera that may be purchased from China for around £200 in its normal T120 general use format. I considered £80 too much to pay for a thermal camera with such limitations. The market has virtually exploded with affordable thermal imaging cameras so we can afford to be picky when it comes to hunting for bargains
Someone bought the £80 T120H camera after it being listed for many weeks. Their use case may mean that it was an excellent buy for them. I certainly hope so. That camera could be used for PCB work if a close up lens were fitted. £80 is not much to pay for the benefit that a thermal camera provides when examining faulty laptops etc. Absolute temperature measurements are less important than seeing hot spots worthy of further investigation.
https://www.ebay.co.uk/itm/295942607142Some may recall that I bought two camera modules from Dahua fever detection tablet kiosks. The seller did not know what they were and I took a risk that the cores within the metal casings might be useful. It turned out that the two metal camera cases contained the Guide IR MobIR AIR USB C thermal camera Dongles. They contain the same TIMO 120 core as the T120H camera. The cameras work with a mobile phone but are the fever detection model so need the fever detection APP for accurate temperature measurements. They work with the standard MobIR AIR APP but measurements are incorrect. Each of those Dahua camera modules cost me only £18.
As a warning though….. I have investigated other Fever Detection kiosk solutions and determined that they use sensors like the Melexis MLX series that provide resolutions of only 32 x 24 pixels, or even less, with a slow response time. Be careful what you buy …. Do your research !
Fraser
Thanks for info Fraser 👍
But i still wanna find 17um hikvision for less than 80€ 😁
It's kind of fun, négociations etc.
Just got brandnew 31B for 80€ + 7€ (delivery & insurance).
Well, lets see next week if it's match the description, online is always risky 😁
Well, even if it display 25-45 range in UI it saves full range.
On last picture it's a tea from Tefal's teapot (w/ green tea inside).
89.7°C could be pretty close to real.
All pictures i took w/ default settings
Yes, I noticed that the saved images are fully radiometric and contain the full temperature range rather than the limited one shown on the display. As Bill-W commented, it is likely that the firmware was just changed to only show the Fever Scanning range of temperatures and I hoped to modify the firmware to eliminate that restriction on measurement. Sadly Hikvision firmware updates are encrypted so I have not been able to dig into them. With regard to accuracy, I believe much of the accuracy gains come from the use of a better FFC flag as a temperature reference and likely a factory calibration that is targeted at the fever detection temperature range to achieve greatest accuracy. Such a limited range calibration sill locks the Radiance to Temperature unit curve to the values that came out of ten microbolometer ROIC at time of calibration. The accuracy at temperatures higher and lower than that restricted range will still be pretty accurate
I really like the DS-2TP31 camera. It is well built and produces very good images co side ring it’s 160 x 120 pixel resolution. Hikvision chose wiseLy when it came to the lens FOV. From memory, the IFOV is similar to one of my 320 x 240 pixel cameras that are fitted with much wider angle lenses. I have used my camera for PCB thermal imaging and it does benefit from a close up lens and produces good imagery. That said, I recently bought the DS-2TP21B (basically a modified HikMicro M10) for £220. The 21B is also 160 x 120 pixel resolution but it has the advantage of a manual focus lens and large touch screen display
The close focus capability of the 21B lens means I do not need a close up lens for PCB work
The 21B and 31B are well worth considering if found at a good price, as was the case for me and you Nikitasius
I used the DS-2TP21B to diagnose a shorted MLCC in a £5000 rugged laptop this week. It makes life soooo easy
I own a FLIR E40 (upgraded to E60+) but would not hesitate to pick up the 21B, or even the 31B for a PCB repair. As a side note, it is interesting that the 21B allows the display of temperatures outside the fever detection range, yet the 31B does not.
Fraser
I've seen the forum you posted where folks discuss about modding hikvision firmwares. There almost 50+ pages to read lol 🤓
I will read next week to see where we are and is there are any progress to do w/ that firmware.
Btw here is mine (S/N photoshopped).
Aren't updated yet:
• maybe there are exploits for the old firmwares
• maybe i can make telnet working, there are option in settings but i see no telnet, ever no com via usb (like i have w/ chinese walkietalkies).
The time and date settings are lost. Can you tell me what battery is installed?
I just checked my image archives for this camera and the cell is a "ML" series rechargeable LiMnO2 type. You just need the cells dimensions to match it to the correct cell in the series (dimensions form the part number as with non-rechargeable Lithium button cells). Useful details are provided in the Wiki page for button cells.
https://en.wikipedia.org/wiki/Button_cellThe cell should not have failed this soon so it would be worth checking that it is not just discharged due to a lack of use. Also check that the cells very low current trickle charging circuit is working to keep it charged whilst the camera is in use.
Hi together,
Fraser, thanks for your awesome teardown. I am following you already with the FLIR E4 hack and now also tried to play around with the Hikvision.
Some insights from me:
- next to the UART port that looks like a port for ethernet, not sure how useful this is, but potentially can be used to play around more
- the things you can do with UART are pretty limited. Hikvision asks for a password pretty soon if you want to go into the "debug" mode (similar to here:
https://ipcamtalk.com/threads/hikvision-ds-7816nb-how-to-enter-debug-mode.55472/)
These are the supported commands:
help
Support Commands:
printPart prtHardInfo setIp
setV6ip setGateway dspStatus
getDebug setDebug getIp
ifconfig netstat ping
cpup task free
help debug Iterating through the commands:printPart
printPart:command not foundprtHardInfo
Start at 1970-01-01 00:11:00
Serial NO :DS-2TP31B-3AUF20200515AAWRE42106159
V5.4.22 build 200325
NetProcess Version:
Db Encrypt Version: 131072
hardwareVersion = 0x0
hardWareExtVersion = 0x0
encodeChans = 1
decodeChans = 1
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 0
flashChipNums = 0
ramSize = 0x40
networksNums = 1
language = 1
devType = 0xa41402
net reboot count = 0
Path: /Camera/Thermography/Software/Branches/Thermal_develop_branch/LiteOS_for_temp_baseline
Last Changed Rev: 787287
Last Changed Date: 2020-03-25 16:08:12 +0800 (Wed, 25 Mar 2020)dspStatus
[armlib]get_dsp_status: buf=8113eb94, len=20480, arg0=0, arg1=0
<lib>dsp_build_time: Day(2020-3-5),Time(21:8:46)
************************************** DSP status ************************************
*** ENC Chan info.
----------------------------------------------------------------------------------------------------------------
Chan Enc EncV EncA EncV EncA VI Signal Video
Num Bps Bps Bps Fps Fps Fps Status Standard
0: 1411 1411 0 25 0 0 FALSE VS_PAL
----------------------------------------------------------------------------------------
Chan VI EncV EncA Sub Pre0 Pre1 Pre2 Data VIP CD FD
Num Lost Lost Lost Lost Lost Lost Lost Lost Reset Status Status
0: 0 0 0 0 0 0 0 0 0 FALSE FALSEifconfig
lo ip:127.0.0.1 netmask:255.0.0.0 gateway:127.0.0.1
HWaddr 00 MTU:0 Runing Link Down
# # netstat
========== total sockets 128 ====== unused sockets 122 ==========
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:554 0.0.0.0:0 LISTEN
tcp 0 0 0.0.0.0:8000 0.0.0.0:0 LISTEN
tcp 0 0 127.0.0.1:443 0.0.0.0:0 LISTEN
tcp 0 0 127.0.0.1:80 0.0.0.0:0 LISTEN
Proto Recv-Q Send-Q Local Address Foreign Address
udp 0 0 0.0.0.0:13724 0.0.0.0:0
udp 0 0 127.0.0.1:9473 0.0.0.0:0
# #
I was not able to access the webservers yet...
ping 127.0.0.1
[0]Reply from 127.0.0.1: time=1ms TTL=255
[1]Reply from 127.0.0.1: time<1ms TTL=255
[2]Reply from 127.0.0.1: time=1ms TTL=255
[3]Reply from 127.0.0.1: time<1ms TTL=255
--- 127.0.0.1 ping statistics ---
4 packets transmitted, 4 received, 0 loss
# # cpup
SysCpuUsage in 10s: 74.2
# # task
Name TID Priority Status StackSize WaterLine StackPoint TopOfStack EventMask SemID CPUUSE CPUUSE10s CPUUSE1s MEMUSE
---- --- -------- -------- --------- ---------- ---------- ---------- --------- ----- ------- --------- --------- -------
Swt_Task 0x0 0 QueuePend 0x6000 0x3a0 0x81121d50 0x8111bde0 0x0 0xffff 1.8 1.7 1.7 0
IdleCore000 0x1 31 Ready 0x800 0x5c 0x811225a4 0x81121e00 0x0 0xffff 24.7 26.0 26.5 0
system_wq 0x2 1 Pend 0x6000 0x130 0x81129658 0x811236e8 0x1 0xffff 0.0 0.0 0.0 0
app_Task 0x3 10 Delay 0x6000 0xa58 0x8112f650 0x81129700 0x1 0xffff 0.0 0.0 0.0 1247160
USB_FMASS_Task 0x4 10 Pend 0x6000 0x370 0x814432a8 0x8143d358 0x1 0xffff 0.0 0.0 0.0 2507464
ipc_watchdog 0x5 3 Delay 0x5000 0x138 0x815435e0 0x8153e678 0x0 0xffff 0.0 0.0 0.0 104
himci_Task 0x6 10 Ready 0x1800 0x150 0x81144310 0x81142ba8 0x0 0xffff 0.0 0.0 0.0 0
jffs2_gc_thread 0x7 10 Pend 0x1000 0x128 0x81156730 0x811557b8 0x3 0xffff 0.0 0.0 0.0 0
jffs2_gc_thread 0x8 10 Pend 0x1000 0x340 0x8115e5d0 0x8115d658 0x3 0xffff 0.0 0.0 0.0 -4044
jffs2_gc_thread 0x9 10 Pend 0x1000 0x128 0x81167cc8 0x81166d50 0x3 0xffff 0.0 0.0 0.0 0
jffs2_gc_thread 0xa 10 Pend 0x1000 0x128 0x8116fe68 0x8116eef0 0x3 0xffff 0.0 0.0 0.0 0
power_button_task 0xb 1 Pend 0x6000 0x130 0x81175e78 0x8116ff08 0x1 0xffff 0.0 0.0 0.0 0
tcpip_thread 0xc 5 PendTimeOut 0x6000 0x310 0x8117c720 0x81176828 0xf 0xffff 0.1 0.1 0.1 2880
shellTask 0xd 9 Running 0x3000 0xba0 0x81185a24 0x81182e08 0xfff 0xffff 0.0 0.0 0.0 2100356
cmdParesTask 0xe 9 Pend 0x1000 0x170 0x81186d50 0x81185e20 0x1 0xffff 0.1 0.0 0.0 476
mmc_data_thread 0xf 6 PendTimeOut 0x800 0x1c0 0x8120f320 0x8120ebe0 0x4 0xffff 0.0 0.0 0.0 0
bcache_async_task 0x10 12 Pend 0x3000 0x1f0 0x81432938 0x8142f9e0 0xf 0xffff 0.0 0.0 0.0 0
USB_GIANT_Task 0x11 5 Pend 0x6000 0x150 0x814492c0 0x81443370 0xf 0xffff 0.0 0.0 0.0 0
USB_NGIAN_Task 0x12 2 Pend 0x6000 0x150 0x8144f2
e0 0x81449390 0xf 0xffff 0.0 0.0 0.0 0
USB_EXPLR_Task 0x13 5 Pend 0x6000 0x4c8 0x814552f8 0x8144f3a8 0xf 0xffff 0.0 0.0 0.0 2008
USB_CXFER_Task 0x14 5 Pend 0x6000 0x150 0x8145b318 0x814553c8 0xf 0xffff 0.0 0.0 0.0 0
USB_SWTCH_Task 0x15 10 Ready 0x6000 0x110 0x81461370 0x8145b3e0 0x0 0xffff 0.0 0.0 0.0 0
ipc_reboot 0x17 3 Delay 0x5000 0x1c0 0x81548570 0x81543690 0x0 0xffff 0.0 0.0 0.0 0
ipc_dsp_init 0x18 0 Delay 0x20000 0xa38 0x815c6ab8 0x815a6b50 0x0 0xffff 0.0 0.0 0.0 3487296
ifr_source 0x19 2 PendTimeOut 0x20000 0xbe0 0x81927020 0x81907490 0x1 0xffff 63.6 64.0 64.0 188
Dsp_Encode 0x1a 2 PendTimeOut 0x20000 0xd98 0x81947148 0x819274b0 0x0 0x11f 1.3 1.3 1.3 1484
Dsp_OsdRefresh 0x1b 5 Delay 0x20000 0xa80 0x81967408 0x819474c8 0x1 0xffff 1.5 1.2 1.1 0
TSK_ViSignal 0x1c 10 Delay 0x20000 0x658 0x81987450 0x819674e8 0x0 0xffff 0.0 0.0 0.0 0
Dsp_Timer 0x1d 2 Delay 0x20000 0x1f8 0x819a7478 0x81987500 0x0 0xffff 0.3 0.3 0.3 0
Shutter_Process 0x1e 10 Ready 0x20000 0x930 0x819c7460 0x819a7520 0x0 0xffff 0.2 0.1 0.1 120
K_MatrikProcess 0x1f 10 Ready 0x20000 0x158 0x819e7490 0x819c7538 0x0 0xffff 0.0 0.0 0.0 0
K_MatrikProcess 0x20 10 Ready 0x20000 0x160 0x81a074a8 0x819e7558 0x0 0xffff 0.0 0.0 0.0 0
TSK_BPC_Process 0x21 10 Ready 0x20000 0x160 0x81a274c0 0x81a07570 0x0 0xffff 0.0 0.0 0.0 0
TSK_PCC_Process 0x22 10 Ready 0x20000 0x168 0x81a474d8 0x81a27590 0x0 0xffff 0.0 0.0 0.0 0
TM_Process 0x23 10 Ready 0x20000 0x2890 0x81a673e0 0x81a475a8 0xf 0xffff 3.9 3.7 3.5 832
TSK_RawDataProcess 0x24 10 Ready 0x20000 0x6b8 0x81a87520 0x81a675c8 0x0 0xffff 0.1 0.1 0.0 604
Dsp_SaveRawData 0x25 5 Delay 0x20000 0x140 0x81aa7550 0x81a875e0 0x0 0xffff 0.0 0.0 0.0 0
Dsp_EncRoi 0x26 5 Delay 0x20000 0x678 0x81ac7550 0x81aa7600 0x0 0xffff 0.0 0.0 0.0 0
ipc_appweb 0x27 7 Delay 0x8000 0xd58 0x81acf558 0x81ac7618 0x0 0xffff 0.0 0.0 0.0 85880
menu_logo_thd 0x28 7 QueuePend 0x8000 0xa38 0x81b03210 0x81afb3e8 0x0 0xffff 0.4 0.3 0.2 54472
thm_cameralib_send 0x29 16 QueuePend 0x5000 0x390 0x81b09b58 0x81b04ca8 0x0 0xffff 0.0 0.0 0.0 0
ipc_blueled 0x2a 13 Ready 0x5000 0x128 0x81b0ec38 0x81b09cc0 0x0 0xffff 0.0 0.0 0.0 0
ipc_usrSucurty 0x2b 16 Delay 0x5000 0x150 0x81b98478 0x81b93528 0x0 0xffff 0.0 0.0 0.0 0
ipc_hdtaskctrl 0x2c 10 QueuePend 0x5000 0xb00 0x81b9f868 0x81b9b128 0x0 0xffff 0.0 0.0 0.0 1148
ipc_sdctrl 0x2d 16 Delay 0x5000 0x968 0x81ba4ff8 0x81ba0140 0x0 0xffff 0.0 0.0 0.0 11648
ipc_dvrNetServ 0x2e 7 Pend 0x5000 0x260 0x81bad820 0x81ba89e0 0xf 0xffff 0.0 0.0 0.0 700
streamRecv 0x2f 16 Ready 0x5000 0x1740 0x81bc5048 0x81bc0e10 0x0 0xffff 0.2 0.2 0.3 107648
events 0x31 7 PendTimeOut 0x10000 0x6fc 0x81adf410 0x81acf638 0x0 0xeb 0.0 0.0 0.0 -19856
key_event_interface 0x32 7 QueuePend 0x8000 0x638 0x81bde120 0x81bd6278 0x0 0xffff 0.0 0.0 0.0 1136
key_listen 0x33 7 Pend 0x8000 0x698 0x81be60b8 0x81bde290 0x0 0xed 0.0 0.0 0.0 916
monitor_eth0 0x34 16 Ready 0x5000 0x8d8 0x81c1ba90 0x81c16bb0 0x0 0xffff 0.3 0.0 0.0 21908
is_multi_eth 0x35 16 Ready 0x8000 0x1220 0x81c23168 0x81c1bbd0 0x0 0xffff 0.3 0.0 0.0 0
ipc_svchandler 0x36 7 PendTimeOut 0x5000 0x6a0 0x81c28a28 0x81c23be8 0x0 0x12b 0.0 0.0 0.0 868
# # free
total used free
Mem: 15792896 13836396 1956500
text data rodata bss
Mem: 6914048 220572 2064384 8488164
# # Getting more powerful access requires a password (see link above). This is impossible to get, without the private key of hikvision, as it uses RSA.
debug
CQAAAAAAAAAAAASFlkI=
Password: abc
HI_MPI_CIPHER_RsaPublicDec,3037: Error, u32InLen != u32KeyLen.
HI_UNF_CIPHER_RsaPublicDec failed
Incorrect Password. 2 Times Left
# # Increasing the log levelsetDebug -h
setDebug : Set debug parm. module name is nessary
e.g. setDebug -l 2 -m rtsp -d 111
-l, --level range is 0~7:
0:NON
1:SYS_ERROR
2:RT_ERROR
3:KEY_WARN
4:NORMAL_WARN
5:DEBUG_NOTICE
6:DEBUG_INFO
7:DEBUG_ALL_DAV
-d, --display from right to left:
first bit'1' is show 'line';
second bit'1' is show 'function name';
third bit'1' is show 'file name'
-m --module moudule name. below is all modules name
ALL
module class NETPRO_CLASS:
RTSP WEBSERVER ONVIF PSIA CGI SDKCMD UNI_IF RTCP GENETEC EHOME EZVIZ
module class SYSFUN_CLASS:
SYSINIT RECORD SYSLOG ALARM_EXP HDMANAGER SD NAS MOTDETECT FTP CAPA PIC PLAYBACK PREVIEW CLOUD BUTTON GUI
module class NETFUN_CLASS:
SADP ARP SNTP DDNS EMAIL PPP 8021X GB28181 TSOCKS MOBILE
module class HW_CLASS:
HW_IF DSP FPGA RTC SENSOR PTZ MOTION DOME STRM_ANLS
module class OTHER:
OTHER
module class IPC:
IPC IPC_UNIX SDK_SECURITY DB
# # [01-01 00:46:07] Default is "2":
getDebug
modulename level display(FILENAME,FUNCTION,LINE)
IPZOOM 2 111
IPZOOM_AF 2 111
IPZOOM_AE 2 111
RTSP 2 111
WEBSERVER 2 111
ONVIF 2 111
PSIA 2 111
CGI 2 111
SDKCMD 2 111
UNI_IF 2 111
RTCP 2 111
GENETEC 2 111
EHOME 2 111
EZVIZ 2 111
SYSINIT 2 111
RECORD 2 111
SYSLOG 2 111
ALARM_EXP 2 111
HDMANAGER 2 111
SD 2 111
NAS 2 111
MOTDETECT 2 111
FTP 2 111
CAPA 2 111
PIC 2 111
PLAYBACK 2 111
PREVIEW 2 111
CLOUD 2 111
BUTTON 2 111
GUI 2 111
SADP 2 111
ARP 2 111
SNTP 2 111
DDNS 2 111
EMAIL 2 111
PPP 2 111
8021X 2 111
GB28181 2 111
TSOCKS 2 111
MOBILE 2 111
HW_IF 2 111
DSP 2 111
FPGA 2 111
RTC 2 111
SENSOR 2 111
PTZ 2 111
MOTION 2 111
DOME 2 111
STRM_ANLS 2 111
OTHER 2 111
IPC 2 111
IPC_UNIX 2 111
SDK_SECURITY 2 111
DB 2 111
has open debug module nums is : 54
# # [01-01 00:45:44] Increasing all to 7 gives the following debug messages:
[pid:0][OTHER][ERROR][netconfig.c 569][get_ipaddr]get_ipaddr failed. p_interface_name:eth0
[pid:0][SYSINIT][WARNING][mainCtrl/usrMainApp.c 2177][monitor_eth0]eth0 disconnet...
[pid:0][SADP][DEBUG][multicast/is_discovery_do.c 262][wait_net_available]eth0: wait_net_available
[pid:0][DSP][WARNING][hardwareif/e2l/dsp/streamRecv.c 2743][streamRecv]chan 1: Unsupport type = 560, len = 8540
[pid:0][SD][DEBUG][hardwareif/e2l/sdcard.c 61][is_sd_ok]sd_status.name = mmc0
[pid:0][SD][DEBUG][hardwareif/e2l/sdcard.c 65][is_sd_ok]sd status = 1
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 8942][get_hdisk_space]ctrl 0, drive 0: total_space 7648.
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 8958][get_hdisk_space]partition [/dev/mmcblk0p0] exist.
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 8953][get_hdisk_space]partition [/dev/mmcblk0p1] don't exist and errno = 2.
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 8962][get_hdisk_space]partition numbers:[1].
[pid:0][SD][DEBUG][hdCtrl/sd_check.c 176][get_disksize] stfs.f_bfree=244944, stfs.f_bavail=244944, stfs.f_bsize=32768 .
[pid:0][SD][DEBUG][hdCtrl/sd_check.c 188][get_disksize] freesize=239, blocksize=32,*getsize=7648 .
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 8977][get_hdisk_space][/mnt/mmc01] get_disksize sucess!
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 16789][get_free_record_space_percent]freespace=7648, totalspace=7648, percent=100 .
[pid:0][GUI][DEBUG][menu/menu.c 2709][menu_logo_thread] logo_sd_idx=16,last_logo_sd_idx=16,sd_usb_window = 0
[pid:0][GUI][DEBUG][menu/menu.c 2735][menu_logo_thread]no need to display window!
[pid:0][OTHER][DEBUG][net_base_operate.c 622][socket_accept_with_timeout]time out.
hi_i2c_wait_rxfifo_notempty->344: transmit error, int_raw_status: 0x750!
hi_i2c_wait_rxfifo_notempty->346: tx_abrt_cause is 1.
hi_i2c_abortprocess->73: tx_src: 0x1!
<3>fuel_gague_i2c_read failed!
<3>fuel_gauge_ioctl-118 i2c read err!
[pid:0][BUTTON][ERROR][button/button_operation.c 943][get_battery_quantity_percent]get_battery_info HAL_FUEL_GAUGE_SOC failed
[pid:0][BUTTON][DEBUG][button/button_operation.c 966][get_battery_quantity_percent]last_value = 0,battery_value = -1
[pid:0][GUI][DEBUG][menu/menu.c 2820][menu_logo_thread] logo_battery_idx=19,last_logo_battery_idx=19
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:0, time:6192s 160986us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2175][is_key_press]E_KEY_STATE_DOWN!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2225][is_key_press]E_KEY_STATE_DOWN! NOT KEY COMBINATION!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2334][init_key_time]init_time = 6192s 160986us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2320][is_key_press]ret: 0!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 408][key_listen]key5: 11!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 449][key_listen]send -2118386504 msg success, ret = 0,key_statuts=11
[pid:0][NAS][DEBUG][keying/key_event_e2.c 1174][key_action]S_KEY_TRIGGER_DOWN
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:1, time:6192s 241034us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 1214][key_action]main_status = 1,fouce_index = 1
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2236][is_key_press]E_KEY_STATE_UP!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 519][key_event_interface]flag_respond = 0!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2239][is_key_press]E_KEY_STATE_UP! NOT KEY COMBINATION!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 80048us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2320][is_key_press]ret: 1!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 408][key_listen]key5: 12!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 449][key_listen]send -2118386504 msg success, ret = 0,key_statuts=12
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:0, time:6192s 290966us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 1202][key_action]S_KEY_TRIGGER_UP,L1202
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2083][get_main_status]main_status: 157!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2334][init_key_time]init_time = 6192s 290966us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 528][key_event_interface]main_status = 157!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:1, time:6192s 502092us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 1214][key_action]main_status = 157,fouce_index = 1
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 211126us
[pid:0][GUI][DEBUG][menu/menu.c 1828][menu_logo_thread]type=157
[pid:0][GUI][DEBUG][menu/menu.c 6503][draw_logo_bg] width = 140 height = 108
[pid:0][GUI][DEBUG][menu/menu.c 6730][draw_string]str:Disconnect the
[pid:0][GUI][DEBUG][menu/menu.c 6750][draw_string] str:Disconnect the ,osd_config.charCnt, 15,b_selected=0
[pid:0][GUI][DEBUG][menu/menu.c 6730][draw_string]str:device from USB
[pid:0][GUI][DEBUG][menu/menu.c 6750][draw_string] str:device from USB ,osd_config.charCnt, 16,b_selected=0
[pid:0][GUI][DEBUG][menu/menu.c 6730][draw_string]str:and try again.
[pid:0][GUI][DEBUG][menu/menu.c 6750][draw_string] str:and try again.,osd_config.charCnt, 14,b_selected=0
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:0, time:6193s 881001us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2334][init_key_time]init_time = 6193s 881001us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 1214][key_action]main_status = 164,fouce_index = 1
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6194s 130876us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2275][is_key_press]E_KEY_STATE_DOWN_REPEATE!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 249875us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 408][key_listen]key5: 0!!
[pid:0][GUI][DEBUG][menu/menu.c 5779][pic_win_timer]main_status = 164!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6194s 230871us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 349870us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6194s 330872us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 449871us
[pid:0][DSP][DEBUG][hardwareif/e2l/dsp/dsp.c 461][get_vomenu_state]Waiting dsp to finish reading menu!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6194s 430867us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 549866us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6194s 530876us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 649875us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:1, time:6194s 591209us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 710208us
[pid:0][GUI][DEBUG][menu/menu.c 6852][draw_string_main]str::0.98
[pid:0][GUI][DEBUG][menu/menu.c 6872][draw_string_main] str::0.98,osd_config.charCnt, 5,b_selected=1
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:0, time:6198s 591238us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2334][init_key_time]init_time = 6198s 591238us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6198s 840884us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 249646us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6198s 941786us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 350548us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 40887us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 449649us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 141883us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 550645us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 240884us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 649646us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 341708us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 750470us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 440888us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 849650us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 541824us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 950586us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 640882us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 1049644us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2296][is_key_press]is_long_press = TRUE!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2320][is_key_press]ret: 2!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 741885us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 1150647us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:1, time:6199s 801003us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 1209765usPixar
Hi Pixar,
Excellent work
I have not had time to dig deeply into the cameras operating system and see that Hikvision have protected the more sensitive areas of the build with a decent encryption method
It would appear to be a significant challenge to change this cameras configuration from a “Health screening” mode to the general use mode.
As a side note, the superior DS-2TP21B series cameras are selling for very reasonable prices on eBay UK at the moment. A brand new kit sold for £225 in the last week. The DS-2TP21B model retains most of the functionality of its general-use stable mate and has a measurement range that extends well beyond the health screening range. Combined with the manual focus, desktop charger, two batteries and hard case, it is a very nice package
I find it strange that the DS-2TP31B model was so heavily restricted in terms of temperature measurement range, yet the DS-2TP21B was far less restricted in this respect. It could be due to different development teams working in the firmware during the technical response to the Pandemic.
Fraser
Thanks Fraser, also for the great tip!
With UART you can also control the boot loader. After pressing CTRL + U (\x15) you are able to open the uboot console:
System startup
U-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)
SPI Nor:"W25M512JV", Block:64KB, Chip:64MB
wait timeout, auto_satatus: 0xd0b00000!
###read error, int_raw_satatus: 0x750!
tx_abrt_cause is 0x1.
iptp_thermo_poweroff: hi_i2c_read error!
Hit Ctrl+u to stop autoboot: 0
Net: USB: scanning bus for devices...
1 USB Device(s) found
No asix device found!
Initializ AX88772B usb-net device failed !
asix usb net initialize err.
No ethernet found.
HKVS #
version
U-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)
HKVS #
help
? - alias for 'help'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
ddr - ddr training function
ext2load- load binary file from a Ext2 filesystem
ext2ls - list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
getinfo - print hardware information
help - print command description/usage
hwdec - hw decompress
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
mii - MII utility commands
mmc - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
HKVS #
AX88772B is the installed USB Ethernet adapter (which could not be loaded from the boot loader, so booting via LAN may be impossible).
ping 127.0.0.1
No ethernet found.
ping failed; host 127.0.0.1 is not alive
HKVS #
printenv
bootcmd=loadk
bootdelay=0
baudrate=115200
netmask=255.255.255.0
bootfile="uImage"
bootargs=console=ttyAMA0,115200 KRN_PRT=pri mac=00:00:23:34:45:66 bld_rev=788427 hardware_id=0x1
ethact=AX88772C
ipaddr=192.168.1.77
serverip=192.168.1.128
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)
hardwareID=0x01(iptp_v0)
ethaddr=58:50:ed:91:64:9f
Environment size: 390/65480 bytes
HKVS #
mmcinfo
Manufacturer ID: 0
OEM: fd00
Name: Tran Speed: 537067740
Rd Block Len: 18
MMC version 0.0
High Capacity: Yes
Capacity: 2306688413412950016
Bus Width: 537067520-bit
HKVS #
You can then boot from the flash memory using the (undocumented) command
loadk
booting from pri part...
Load kernel to 0x81800000 ... Done!
## Booting kernel from Legacy Image at 81800000 ...
Image Name: LiteOS-0.1.0-e2
Image Type: ARM Linux Kernel Image (lzma compressed)
Data Size: 4990000 Bytes = 4.8 MiB
Load Address: 80008000
Entry Point: 80008000
Uncompressing Kernel Image ... OK
