Author Topic: Swann DVR (security camera recorder) bricked after firmware update (Fixed)  (Read 9874 times)

0 Members and 1 Guest are viewing this topic.

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #25 on: April 20, 2021, 03:01:40 am »
Very strange it's trying to load a ubifs from mtd6, I'm not sure what to make of that. Those missing files are in the second cramfs image in the .pak file in the ti814x directory.
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #26 on: April 20, 2021, 03:05:46 am »
I think the issue is from how I loaded it from RAM as the u-boot appears to send extra configuration commands when it is run normally (I stopped the auto boot so that I could load my correct kernel into RAM instead of the incorrect one that u-boot would try and load).  Based on your previous post would I have to trim my kernel file to be 2662480 bytes in total size?
« Last Edit: April 20, 2021, 03:07:39 am by poot36 »
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #27 on: April 20, 2021, 03:16:23 am »
It's worth a shot. You are correct, if you take the offset of the first cramfs image (3095760) and subtract the offset of the uImage header (433280) from it, you will get 2662480 which is the size of the kernel reported by the Linux file command + the 64 byte uImage header.

Code: [Select]
user@femto:~/re_projs/dvr4000$ binwalk DVR4-4000_GA1.9_1025.pak

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
78648         0x13338         CRC32 polynomial table, little endian
255164        0x3E4BC         CRC32 polynomial table, little endian
433280        0x69C80         uImage header, header size: 64 bytes, header CRC: 0x4918710A, created: 2012-09-21 03:11:57, image size: 2662416 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x343FB2FF, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-2.6.37"
449983        0x6DDBF         gzip compressed data, maximum compression, from Unix, last modified: 2012-09-21 03:11:56
3095760       0x2F3CD0        CramFS filesystem, little endian, size: 8011776 version 2 sorted_dirs CRC 0xD8777123, edition 0, 4491 blocks, 1405 files
11107536      0xA97CD0        CramFS filesystem, little endian, size: 8957952 version 2 sorted_dirs CRC 0x3CE298E8, edition 0, 6640 blocks, 746 files
20065488      0x1322CD0       PC bitmap, Windows 3.x format,, 684 x 456 x 24
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #28 on: April 21, 2021, 03:34:39 am »
Well I think I successfully flashed the kernel to the NAND at the correct address because it did boot further then with the incorrect kernel.  However it is still not loading fully, I think it is something to do with the cramfs being incorrect.  The video gets initilized and I have a thin line at the bottom of the screen with green and purple colors on it.  Here is the boot log:

TI-MIN#go 0x81000000
## Starting application at 0x81000000 ...


U-Boot 2010.06 (Jun 07 2012 - 16:12:09)

TI8148-GP rev 2.1

ARM clk: 720MHz
DDR clk: 400MHz
IVA clk: 321MHz
ISS clk: 400MHz
DSS clk: 200MHz
DSP clk: 600MHz

I2C:   ready
DRAM:  1 GiB
NAND:  HW ECC Hamming Code selected
128 MiB
*** Warning - bad CRC or NAND, using default environment

 _____       ___   _   _____   _   _   _   _       ___   __   _
|  _  \     /   | | | /  ___| | | | | | | | |     /   | |  \ | |
| |_| |    / /| | | | | |     | |_| | | | | |    / /| | |   \| |
|  _  {   / / | | | | | |     |  _  | | | | |   / / | | | |\   |
| |_| |  / /  | | | | | |___  | | | | | |_| |  / /  | | | | \  |
|_____/ /_/   |_| |_| \_____| |_| |_| \_____/ /_/   |_| |_|  \_|

MMC:   OMAP SD/MMC: 0
Net:   <ethaddr> not set. Reading from E-fuse
Detected MACID:0:17:eb:ed:11:5a
cpsw
Hit any key to stop autoboot:  0

NAND read: device 0 offset 0x1ee0000, size 0x200000
 2097152 bytes read: OK
change to 400K for i2c
NAND read: device 0 offset 0x280000, size 0x300000
 3145728 bytes read: OK
## Booting kernel from Legacy Image at 81000000 ...
   Image Name:   Linux-2.6.37
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2662416 Bytes = 2.5 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #4 Fri Sep 21 11:11:53 CST 2012
CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: ti8148evm
reserved size = 52428800 at 0x0
FB: Reserving 52428800 bytes SDRAM for VRAM
Memory policy: ECC disabled, Data cache writeback
OMAP chip is TI8148 2.0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 19712
Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 78MB = 78MB total
Memory: 73032k/73032k available, 58040k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xc8800000 - 0xf8000000   ( 760 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
    modules : 0xbf000000 - 0xbfe00000   (  14 MB)
      .init : 0xc0008000 - 0xc003a000   ( 200 kB)
      .text : 0xc003a000 - 0xc0506000   (4912 kB)
      .data : 0xc0506000 - 0xc0547f80   ( 264 kB)
SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:375
omap_hwmod: gpio1: softreset failed (waited 10000 usec)
omap_hwmod: gpio2: softreset failed (waited 10000 usec)
omap_hwmod: gpio3: softreset failed (waited 10000 usec)
omap_hwmod: gpio4: softreset failed (waited 10000 usec)
IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interrupts
Total of 128 interrupts on 1 active controller
GPMC revision 6.0
Trying to install interrupt handler for IRQ368
Trying to install interrupt handler for IRQ369
Trying to install interrupt handler for IRQ370
Trying to install interrupt handler for IRQ371
Trying to install interrupt handler for IRQ372
Trying to install interrupt handler for IRQ373
Trying to install interrupt handler for IRQ374
Trying to install type control for IRQ375
Trying to set irq flags for IRQ375
OMAP clockevent source: GPTIMER1 at 20000000 Hz
Console: colour dummy device 80x30
Calibrating delay loop... 719.25 BogoMIPS (lpj=3596288)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
devtmpfs: initialized
omap_voltage_early_init: voltage driver support not added
regulator: core version 0.5
regulator: dummy:
NET: Registered protocol family 16
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
omap_mux_init: Add partition: #1: core, flags: 4
registered ti814x_vpss device
registered TI814x on-chip HDMI device
clk get on i2c3 fck failed
registered ti81xx_vidout device
Debugfs: Only enabling/disabling deep sleep and wakeup timer is supported now
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
registerd cppi-dma Intr @ IRQ 17
Cppi41 Init Done
omap_i2c omap_i2c.1: bus 1 rev4.0 at 100 kHz
pcf857x: probe of 1-0021 failed with error -121
omap_i2c omap_i2c.3: bus 3 rev4.0 at 400 kHz
Advanced Linux Sound Architecture Driver Version 1.0.23.
Switching to clocksource gp timer
musb-hdrc: version 6.0, host, debug=0
musb-hdrc musb-hdrc.0: dma type: dma-cppi41
musb-hdrc musb-hdrc.0: MUSB HDRC host driver
musb-hdrc musb-hdrc.0: new USB bus registered, assigned bus number 1
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: MUSB HDRC host driver
usb usb1: Manufacturer: Linux 2.6.37 musb-hcd
usb usb1: SerialNumber: musb-hdrc.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
musb-hdrc musb-hdrc.0: USB Host mode controller at c881e000 using DMA, IRQ 18
musb-hdrc musb-hdrc.1: dma type: dma-cppi41
musb-hdrc musb-hdrc.1: MUSB HDRC host driver
musb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 2
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: MUSB HDRC host driver
usb usb2: Manufacturer: Linux 2.6.37 musb-hcd
usb usb2: SerialNumber: musb-hdrc.1
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
musb-hdrc musb-hdrc.1: USB Host mode controller at c8828800 using DMA, IRQ 19
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
PMU: registered new PMU device of type 0
omap-iommu omap-iommu.0: ducati registered
omap-iommu omap-iommu.1: sys registered
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.15)
msgmni has been set to 142
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
omap_uart.0: ttyO0 at MMIO 0x48020000 (irq = 72) is a OMAP UART0
console [ttyO0] enabled
omap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1
omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2
omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3
omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4
omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5
brd: module loaded
loop: module loaded
ahci ahci.0: forcing PORTS_IMPL to 0x1
ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform mode
ahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apst
scsi0 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x100 irq 16
omap2-nand driver initializing
ONFI flash detected
ONFI param page 0 valid
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
Creating 11 MTD partitions on "omap2-nand.0":
0x000000000000-0x000000020000 : "U-Boot-min"
0x000000020000-0x000000260000 : "U-Boot"
0x000000260000-0x000000280000 : "U-Boot Env"
0x000000280000-0x0000006c0000 : "Kernel"
0x0000006c0000-0x000000ec0000 : "File System"
0x000000ec0000-0x000001ac0000 : "Application"
0x000001ac0000-0x000001ec0000 : "Param"
0x000001ec0000-0x000001ee0000 : "Version"
0x000001ee0000-0x0000020e0000 : "Logo"
0x000000000000-0x000004000000 : "Whole"
0x0000020e0000-0x000008000000 : "Reserved"
usb 1-1: new high speed USB device using musb-hdrc and address 2
davinci_mdio davinci_mdio.0: davinci mdio revision 1.6
davinci_mdio davinci_mdio.0: detected phy mask fffffffd
davinci_mdio.0: probed
davinci_mdio davinci_mdio.0: phy[1]: device 0:01, driver unknown
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver dm9601
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
qt602240_ts 1-004a: __qt602240_read_reg: i2c transfer failed
qt602240_ts: probe of 1-004a failed with error -5
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
Linux video capture interface: v2.00
usbcore: registered new interface driver uvcvideo
USB Video Class driver (v1.0.0)
OMAP Watchdog Timer Rev 0x00: initial timeout 60 sec
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
notify_init : notify drivercreated  for  remote proc id 2 at physical Address 0xbfd00000
function cs4334_modinit,line:219
function cs4334_codec_probe,line:192
function hdmi_dai_init,line:276
function davinci_hdmi_probe,line:238
function cs4334_probe,line:164
function cs4334_init,line:158
asoc: cs4334 <-> davinci-mcasp.2 mapping ok
asoc: HDMI-DAI-CODEC <-> hdmi-dai mapping ok
asoc: tvp5158-hifi <-> davinci-mcasp.0 mapping ok
ALSA device list:
  #0: TI81XX EVM
  #1: TI81XX EVM {TVP5158}
TCP cubic registered
NET: Registered protocol family 17
Registering the dns_resolver key type
VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3
omap_voltage_late_init: Voltage driver support not added
Power Management for TI81XX.
Detected MACID=0:17:eb:ed:11:5a
usb 1-1: New USB device found, idVendor=05e3, idProduct=0608
usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
usb 1-1: Product: USB2.0 Hub
rtc-isl1208 1-006f: setting system clock to 2011-12-20 14:32:57 UTC (1324391577)
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
usb 2-1: new high speed USB device using musb-hdrc and address 2
usb 2-1: New USB device found, idVendor=05e3, idProduct=0718
usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=2
usb 2-1: Product: USB Storage
usb 2-1: SerialNumber: 000000000033
scsi1 : usb-storage 2-1:1.0
scsi 1:0:0:0: Direct-Access     USB TO I DE/SATA Device   0016 PQ: 0 ANSI: 4
sd 1:0:0:0: Attached scsi generic sg0 type 0
sd 1:0:0:0: [sda] Attached SCSI disk
ata1: SATA link down (SStatus 0 SControl 300)
cramfs_fill_nand blocks is 64
VFS: Mounted root (cramfs filesystem) readonly on device 31:4.
devtmpfs: mounted
Freeing init memory: 200K
INIT: version 2.86 booting
Please wait: booting...
Error opening /dev/fb0: No such file or directory
Starting udev
udevd (85): /proc/85/oom_adj is deprecated, please use /proc/85/oom_score_adj instead.
Remounting root file system...
Caching udev devnodes
ALSA: Restoring mixer settings...
Configuring network interfaces... PHY 0:00 not found

CPSW phy found : id is : 0x2430c54
done.
Setting up IP spoofing protection: rp_filter.
mount nfs...
INIT: Entering runlevel: 5
Starting telnet daemon.
Starting syslogd/klogd: done
usb is not ready for autoexec
cramfs_fill_nand blocks is 96
UBI: attaching mtd6 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    129024 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          512 (aligned 512)
UBI: data offset:                2048
UBI: max. sequence number:       0
UBI error: ubi_read_volume_table: the layout volume was not found
ubiattach: error!: cannot attach "/dev/mtd6"
           error 22 (Invalid argument)
mount: unknown filesystem type 'ubifs'
/etc/rc5.d/S81appinit: cd: line 21: can't cd to /mnt/app/ti810x/
/etc/rc5.d/S81appinit: line 22: ./init.sh: not found
/etc/rc5.d/S81appinit: line 23: ./load.sh: not found
/etc/rc5.d/S81appinit: line 19: ./logo: not found
insmod: can't read './kermod/ti_gpio.ko': No such file or directory
insmod: can't read './kermod/at88sc.ko': No such file or directory
SCREEN_MOD_4
            SCREEN_MOD_4
                        SCREEN_MOD_4
                                    SCREEN_MOD_4
                                                init is :0,max is:10
                                                                    umount2: Invalid argument
             umount: /mnt/para/: not mounted
Erasing 128 Kibyte @ 100000 -- 25 % completyaffs: dev is 32505862 name is "mtdblock6" rw
Erasing 128 Kyaffs: passed flags ""
Erasing 128 Kibyte @ 400000 -- 100 % complete.
                                              --------dvr configure start--------
 board_type:TNMB01
                  frontboard_type:S300
                                      display_type_info:DVR4-4000
                                                                 detail_machine_type:5804S300
             cfg_ptz_dev:/dev/ttyO1
                                   cfg_test_mail_content:If you receive this e-mail you have successfully setup and tested the e-mail alert from your Swann DVR
                                                                               default_norm:1
             default_output_reso:5
                                  default_time_zone:28800
                                                         default_language:1
                                                                           default_playbacknum:4
                default_alarmin_num:0
                                     default_alarmout_num:0
                                                           default_enable_485:1
                                                                               default_audio_num:4
                  default_osd_fmt:0
                                   default_disk_num:4
                                                     default_esata_port:-1
                                                                          default_record_type:1
               support_avi_backup:1
                                   support_chn_switch:1
                                                       support_swann_ddns:1
                                                                           support_dyndns_ddns:1
                support_3322_ddns:0
                                   http_port:85
                                               support_ntsc:1
                                                             support_pal:1
                                                                          need_reduce_fps:0
           --------dvr configure end--------
                                            watchdog not enabled!

dm814x-evm login: [FUN]:scan_key_wt5700_init [LINE]370   Open /dev/ti_gpio Dev error, Init scan key fail!
                         ERROR: Module ti_cir does not exist in /proc/modules
                                                                             cramfs: bad compressed blocksize 3642924313
cramfs: bad compressed blocksize 3719287697
cramfs: bad compressed blocksize 2922450229
cramfs: bad compressed blocksize 3642924313
insmod: can't read '/mnt/app/ti814x/kermod/ti_cir.ko': Input/output error
                                                                         [FUN]:misc_ir_open_s [LINE]853   /dev/ti_cir
                                     [FUN]:misc_led_open_s [LINE]987   open gpio err!
     [FUN]:misc_buzzer_open [LINE]951   open gpio err!
                                                      Open /dev/at88sc0104 error!
 VSYS_USECASE_MULTICHN_PROGRESSIVE_VCAP_VDIS_VENC_VDEC_4CH
                                                          Venc_init complete:1
                                                                              vdec_init complete
                type_init_vdis_param vodev :0 resolution:13
                                                           SCREEN_MOD_4
                                                                       window 0 start x,y=0,0; w,h=960.540
                          window 1 start x,y=960,0; w,h=960.540
                                                               window 2 start x,y=0,540; w,h=960.540
                    window 3 start x,y=960,540; w,h=960.540
                                                           VoDev :0 width is:1920,height is :1080
                  [FUN]:Device_ths8200Init  [LINE]:28  =======>>  Global semaphore create !!!!!!
 [FUN]:Device_ths8200Create  [LINE]:97  =======>>  Device_ths8200Create !!!!!!
 [FUN]:Device_ths8200Create  [LINE]:121  =======>>  Device_ths8200Create !!!!!! done
 [FUN]:Device_ths8200Control  [LINE]:178  =======>>  Device_ths8200Control !!!!!!
standard is :13
                [FUN]:Device_ths8200Control  [LINE]:214  =======>>  Device_ths8200Control !!!!!!done
Vdis_init complete
                  Venc_registerCallback complete
                                                 0: SYSTEM: IPC init in progress !!!
    OsalDrv driver open: /dev/syslinkipc_Osal: No such file or directory
                                                                        OsalDrv driver close: /dev/syslinkipc_Osal: Bad file descriptor
                                                       /dev/syslinkipc_MultiProc: No such file or directory
                           MultiProc driver close: : Bad file descriptor
                                                                        SharedRegion driver open: : No such file or directory
                                             SharedRegion driver close: : Bad file descriptor
             /dev/syslinkipc_GateMP: No such file or directory
                                                              /dev/syslinkipc_MessageQ: No such file or directory
                                 MessageQ driver close: : Bad file descriptor
                                                                             Notify driver open: /dev/syslinkipc_Notify: No such file or directory
                                                                  Notify driver close: /dev/syslinkipc_Notify: Bad file descriptor
                                                  ProcMgr driver open: /dev/syslinkipc_ProcMgr: No such file or directory
                                         ProcMgr driver close: /dev/syslinkipc_ProcMgr: Bad file descriptor
                           /dev/syslinkipc_HeapBufMP: No such file or directory
                                                                               /dev/syslinkipc_HeapMemMP: No such file or directory
                                                   /dev/syslinkipc_ListMP: No such file or directory
                    /dev/syslinkipc_RingIO: No such file or directory
                                                                     RingIO driver close: : Bad file descriptor
                               /dev/syslinkipc_RingIOShm: No such file or directory
   RingIO driver close: : Bad file descriptor
                                             /dev/syslinkipc_ClientNotifyMgr: No such file or directory
                       ClientNotifyMgr driver close: : Bad file descriptor
                                                                          /dev/syslinkipc_FrameQBufMgr: No such file or directory
                                                 FrameQBufMgr driver close: : Bad file descriptor
                 /dev/syslinkipc_FrameQ: No such file or directory
                                                                  FrameQ driver close: : Bad file descriptor
                            /dev/syslinkipc_Ipc: No such file or directory
                                                                           15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                 15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                       15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                                             15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                   15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                         15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                                               15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                     15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                           15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                                                 15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                       ASSERT (system_ipc_msgq.c|System_ipcMsgQHeapCreate|46)
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #29 on: April 22, 2021, 10:32:48 pm »
It's strange that it's still trying to load a ubifs partition:
Code: [Select]
Starting syslogd/klogd: done
usb is not ready for autoexec
cramfs_fill_nand blocks is 96
UBI: attaching mtd6 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    129024 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          512 (aligned 512)
UBI: data offset:                2048
UBI: max. sequence number:       0
UBI error: ubi_read_volume_table: the layout volume was not found
ubiattach: error!: cannot attach "/dev/mtd6"
           error 22 (Invalid argument)
mount: unknown filesystem type 'ubifs'
/etc/rc5.d/S81appinit: cd: line 21: can't cd to /mnt/app/ti810x/
/etc/rc5.d/S81appinit: line 22: ./init.sh: not found
/etc/rc5.d/S81appinit: line 23: ./load.sh: not found
/etc/rc5.d/S81appinit: line 19: ./logo: not found
insmod: can't read './kermod/ti_gpio.ko': No such file or directory
insmod: can't read './kermod/at88sc.ko': No such file or directory
I wonder if this was something that was part of the other firmware that you loaded the first time? I'm going to look at the other firmware image you linked and see what is in that one. I haven't found any mention of ubifs in the correct firmware image, which makes me wonder if the root partition contains startup/boot procedures for a different model device.

Cheers
-Tim
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #30 on: April 23, 2021, 12:11:37 am »
I found the same model as yours on eBay for dirt cheap so I picked it up. It should get here some time next week.

Once it shows up I can start digging into it and we can get to the bottom of this mystery! This is going to be fun, I love reverse engineering embedded systems.

Cheers
-Tim
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #31 on: April 23, 2021, 01:29:32 am »
If you are interested the processor for the incorrect firmware is a DM8107, if that helps you figure out what is going on with the file system.
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #32 on: April 23, 2021, 02:39:47 am »
Well I have confirmed that the File System partition has the data from the incorrect firmware in it.  The good news is that the Application partition still has the correct data in it.  I have also found out that using ymodem is way faster then kermet to transfer the files (almost 4 times as fast when using TeraTerm version 4.103 on Win 10 X64 using an old Arduino Uno board (around 2012 or so) as the serial converter chip).  Going to attempt to flash the correct File System partition that I extracted out of the correct firmware to the unit and see where that gets me.
« Last Edit: April 23, 2021, 02:44:05 am by poot36 »
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #33 on: April 23, 2021, 03:21:13 am »
Well I flashed the File System to the correct partition location and then tried to boot it with the boot command and it just crashed at the same point that it had before.  I then power cycled the unit loaded the 1st and 2nd stage boot loaders and then tried the boot command again and this time it dropped me to a login prompt.  Tried root and that got me to this prompt root@dm814x-evm:~# not really sure what I can do from there though.  Here is a copy of that boot:

TI8148_EVM#boot

NAND read: device 0 offset 0x1ee0000, size 0x200000
 2097152 bytes read: OK
change to 400K for i2c
NAND read: device 0 offset 0x280000, size 0x300000
 3145728 bytes read: OK
## Booting kernel from Legacy Image at 81000000 ...
   Image Name:   Linux-2.6.37
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2662416 Bytes = 2.5 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #4 Fri Sep 21 11:11:53 CST 2012
CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: ti8148evm
reserved size = 52428800 at 0x0
FB: Reserving 52428800 bytes SDRAM for VRAM
Memory policy: ECC disabled, Data cache writeback
OMAP chip is TI8148 2.0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 19712
Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 78MB = 78MB total
Memory: 73032k/73032k available, 58040k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xc8800000 - 0xf8000000   ( 760 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
    modules : 0xbf000000 - 0xbfe00000   (  14 MB)
      .init : 0xc0008000 - 0xc003a000   ( 200 kB)
      .text : 0xc003a000 - 0xc0506000   (4912 kB)
      .data : 0xc0506000 - 0xc0547f80   ( 264 kB)
SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:375
omap_hwmod: gpio1: softreset failed (waited 10000 usec)
omap_hwmod: gpio2: softreset failed (waited 10000 usec)
omap_hwmod: gpio3: softreset failed (waited 10000 usec)
omap_hwmod: gpio4: softreset failed (waited 10000 usec)
IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interrupts
Total of 128 interrupts on 1 active controller
GPMC revision 6.0
Trying to install interrupt handler for IRQ368
Trying to install interrupt handler for IRQ369
Trying to install interrupt handler for IRQ370
Trying to install interrupt handler for IRQ371
Trying to install interrupt handler for IRQ372
Trying to install interrupt handler for IRQ373
Trying to install interrupt handler for IRQ374
Trying to install type control for IRQ375
Trying to set irq flags for IRQ375
OMAP clockevent source: GPTIMER1 at 20000000 Hz
Console: colour dummy device 80x30
Calibrating delay loop... 719.25 BogoMIPS (lpj=3596288)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
devtmpfs: initialized
omap_voltage_early_init: voltage driver support not added
regulator: core version 0.5
regulator: dummy:
NET: Registered protocol family 16
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
OMAP GPIO hardware version 0.1
omap_mux_init: Add partition: #1: core, flags: 4
registered ti814x_vpss device
registered TI814x on-chip HDMI device
clk get on i2c3 fck failed
registered ti81xx_vidout device
Debugfs: Only enabling/disabling deep sleep and wakeup timer is supported now
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
registerd cppi-dma Intr @ IRQ 17
Cppi41 Init Done
omap_i2c omap_i2c.1: bus 1 rev4.0 at 100 kHz
pcf857x: probe of 1-0021 failed with error -121
omap_i2c omap_i2c.3: bus 3 rev4.0 at 400 kHz
Advanced Linux Sound Architecture Driver Version 1.0.23.
Switching to clocksource gp timer
musb-hdrc: version 6.0, host, debug=0
musb-hdrc musb-hdrc.0: dma type: dma-cppi41
musb-hdrc musb-hdrc.0: MUSB HDRC host driver
musb-hdrc musb-hdrc.0: new USB bus registered, assigned bus number 1
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: MUSB HDRC host driver
usb usb1: Manufacturer: Linux 2.6.37 musb-hcd
usb usb1: SerialNumber: musb-hdrc.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
musb-hdrc musb-hdrc.0: USB Host mode controller at c881e000 using DMA, IRQ 18
musb-hdrc musb-hdrc.1: dma type: dma-cppi41
musb-hdrc musb-hdrc.1: MUSB HDRC host driver
musb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 2
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: MUSB HDRC host driver
usb usb2: Manufacturer: Linux 2.6.37 musb-hcd
usb usb2: SerialNumber: musb-hdrc.1
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
musb-hdrc musb-hdrc.1: USB Host mode controller at c8828800 using DMA, IRQ 19
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
NetWinder Floating Point Emulator V0.97 (double precision)
PMU: registered new PMU device of type 0
omap-iommu omap-iommu.0: ducati registered
omap-iommu omap-iommu.1: sys registered
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.15)
msgmni has been set to 142
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
omap_uart.0: ttyO0 at MMIO 0x48020000 (irq = 72) is a OMAP UART0
console [ttyO0] enabled
omap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1
omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2
omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3
omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4
omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5
brd: module loaded
loop: module loaded
ahci ahci.0: forcing PORTS_IMPL to 0x1
ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform mode
ahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apst
scsi0 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x100 irq 16
omap2-nand driver initializing
ONFI flash detected
ONFI param page 0 valid
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
Creating 11 MTD partitions on "omap2-nand.0":
0x000000000000-0x000000020000 : "U-Boot-min"
0x000000020000-0x000000260000 : "U-Boot"
0x000000260000-0x000000280000 : "U-Boot Env"
0x000000280000-0x0000006c0000 : "Kernel"
0x0000006c0000-0x000000ec0000 : "File System"
0x000000ec0000-0x000001ac0000 : "Application"
0x000001ac0000-0x000001ec0000 : "Param"
0x000001ec0000-0x000001ee0000 : "Version"
0x000001ee0000-0x0000020e0000 : "Logo"
0x000000000000-0x000004000000 : "Whole"
0x0000020e0000-0x000008000000 : "Reserved"
usb 1-1: new high speed USB device using musb-hdrc and address 2
davinci_mdio davinci_mdio.0: davinci mdio revision 1.6
davinci_mdio davinci_mdio.0: detected phy mask fffffffd
davinci_mdio.0: probed
davinci_mdio davinci_mdio.0: phy[1]: device 0:01, driver unknown
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver dm9601
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
qt602240_ts 1-004a: __qt602240_read_reg: i2c transfer failed
qt602240_ts: probe of 1-004a failed with error -5
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
Linux video capture interface: v2.00
usbcore: registered new interface driver uvcvideo
USB Video Class driver (v1.0.0)
OMAP Watchdog Timer Rev 0x00: initial timeout 60 sec
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
notify_init : notify drivercreated  for  remote proc id 2 at physical Address 0xbfd00000
function cs4334_modinit,line:219
function cs4334_codec_probe,line:192
function hdmi_dai_init,line:276
function davinci_hdmi_probe,line:238
function cs4334_probe,line:164
function cs4334_init,line:158
asoc: cs4334 <-> davinci-mcasp.2 mapping ok
asoc: HDMI-DAI-CODEC <-> hdmi-dai mapping ok
asoc: tvp5158-hifi <-> davinci-mcasp.0 mapping ok
ALSA device list:
  #0: TI81XX EVM
  #1: TI81XX EVM {TVP5158}
TCP cubic registered
NET: Registered protocol family 17
Registering the dns_resolver key type
VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3
omap_voltage_late_init: Voltage driver support not added
Power Management for TI81XX.
Detected MACID=0:17:eb:ed:11:5a
usb 1-1: New USB device found, idVendor=05e3, idProduct=0608
usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
usb 1-1: Product: USB2.0 Hub
rtc-isl1208 1-006f: setting system clock to 2011-12-22 14:20:38 UTC (1324563638)
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
usb 2-1: new high speed USB device using musb-hdrc and address 2
usb 2-1: New USB device found, idVendor=05e3, idProduct=0718
usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=2
usb 2-1: Product: USB Storage
usb 2-1: SerialNumber: 000000000033
scsi1 : usb-storage 2-1:1.0
scsi 1:0:0:0: Direct-Access     USB TO I DE/SATA Device   0016 PQ: 0 ANSI: 4
sd 1:0:0:0: Attached scsi generic sg0 type 0
sd 1:0:0:0: [sda] Attached SCSI disk
ata1: SATA link down (SStatus 0 SControl 300)
cramfs_fill_nand blocks is 64
VFS: Mounted root (cramfs filesystem) readonly on device 31:4.
devtmpfs: mounted
Freeing init memory: 200K
INIT: version 2.86 booting
Please wait: booting...
Error opening /dev/fb0: No such file or directory
Starting udev
udevd (85): /proc/85/oom_adj is deprecated, please use /proc/85/oom_score_adj instead.
Remounting root file system...
Caching udev devnodes
ALSA: Restoring mixer settings...
Configuring network interfaces... PHY 0:00 not found

CPSW phy found : id is : 0x2430c54
done.
Setting up IP spoofing protection: rp_filter.
mount nfs...
INIT: Entering runlevel: 5
Starting telnet daemon.
Starting syslogd/klogd: done
usb is not ready for autoexec
cramfs_fill_nand blocks is 96
yaffs: dev is 32505862 name is "mtdblock6" rw
yaffs: passed flags ""
cramfs: bad compressed blocksize 2688251248
cramfs: bad compressed blocksize 2688251248
/etc/rc5.d/S81appinit: line 18: ./logo: not found
/etc/rc5.d/S81appinit: line 21: ./init.sh: Input/output error
cramfs: bad compressed blocksize 3786985870
cramfs: bad compressed blocksize 3786985870
/etc/rc5.d/S81appinit: line 22: ./load.sh: Input/output error
SCREEN_MOD_4
            SCREEN_MOD_4
                        SCREEN_MOD_4
                                    SCREEN_MOD_4
                                                init is :0,max is:10
                                                                    --------dvr configure start--------
                       board_type:TNMB01
                                        frontboard_type:S300
                                                            display_type_info:DVR4-4000
       detail_machine_type:5804S300
                                   cfg_ptz_dev:/dev/ttyO1
                                                         cfg_test_mail_content:If you receive this e-mail you have successfully setup and tested the e-mail alert from your Swann DVR
                     default_norm:1
                                   default_output_reso:5
                                                        default_time_zone:28800
                                                                               default_language:1
                 default_playbacknum:4
                                      default_alarmin_num:0
                                                           default_alarmout_num:0
 default_enable_485:1
                     default_audio_num:4
                                        default_osd_fmt:0
                                                         default_disk_num:4
                                                                           default_esata_port:-1
                default_record_type:1
                                     support_avi_backup:1
                                                         support_chn_switch:1
                                                                             support_swann_ddns:1
                 support_dyndns_ddns:1
                                      support_3322_ddns:0
                                                         http_port:85
                                                                     support_ntsc:1
   support_pal:1
                need_reduce_fps:0
                                 --------dvr configure end--------
                                                                  watchdog not enabled!
       [FUN]:scan_key_wt5700_init [LINE]370   Open /dev/ti_gpio Dev error, Init scan key fail!
              ERROR: Module ti_cir does not exist in /proc/modules
                                                                  cramfs: bad compressed blocksize 3642924313
cramfs: bad compressed blocksize 3719287697
cramfs: bad compressed blocksize 2922450229
cramfs: bad compressed blocksize 3642924313
insmod: can't read '/mnt/app/ti814x/kermod/ti_cir.ko': Input/output error
                                                                         [FUN]:misc_ir_open_s [LINE]853   /dev/ti_cir
                                     [FUN]:misc_led_open_s [LINE]987   open gpio err!
     [FUN]:misc_buzzer_open [LINE]951   open gpio err!
                                                      Open /dev/at88sc0104 error!
 VSYS_USECASE_MULTICHN_PROGRESSIVE_VCAP_VDIS_VENC_VDEC_4CH
                                                          Venc_init complete:1
                                                                              vdec_init complete
                type_init_vdis_param vodev :0 resolution:13
                                                           SCREEN_MOD_4
                                                                       window 0 start x,y=0,0; w,h=960.540
                          window 1 start x,y=960,0; w,h=960.540
                                                               window 2 start x,y=0,540; w,h=960.540
                    window 3 start x,y=960,540; w,h=960.540
                                                           VoDev :0 width is:1920,height is :1080
                  [FUN]:Device_ths8200Init  [LINE]:28  =======>>  Global semaphore create !!!!!!
 [FUN]:Device_ths8200Create  [LINE]:97  =======>>  Device_ths8200Create !!!!!!
 [FUN]:Device_ths8200Create  [LINE]:121  =======>>  Device_ths8200Create !!!!!! done
 [FUN]:Device_ths8200Control  [LINE]:178  =======>>  Device_ths8200Control !!!!!!
standard is :13
                [FUN]:Device_ths8200Control  [LINE]:214  =======>>  Device_ths8200Control !!!!!!done
Vdis_init complete
                  Venc_registerCallback complete
                                                 0: SYSTEM: IPC init in progress !!!
    OsalDrv driver open: /dev/syslinkipc_Osal: No such file or directory
                                                                        OsalDrv driver close: /dev/syslinkipc_Osal: Bad file descriptor
                                                       /dev/syslinkipc_MultiProc: No such file or directory
                           MultiProc driver close: : Bad file descriptor
                                                                        SharedRegion driver open: : No such file or directory
                                             SharedRegion driver close: : Bad file descriptor
             /dev/syslinkipc_GateMP: No such file or directory
                                                              /dev/syslinkipc_MessageQ: No such file or directory
                                 MessageQ driver close: : Bad file descriptor
                                                                             Notify driver open: /dev/syslinkipc_Notify: No such file or directory
                                                                  Notify driver close: /dev/syslinkipc_Notify: Bad file descriptor
                                                  ProcMgr driver open: /dev/syslinkipc_ProcMgr: No such file or directory
                                         ProcMgr driver close: /dev/syslinkipc_ProcMgr: Bad file descriptor
                           /dev/syslinkipc_HeapBufMP: No such file or directory
                                                                               /dev/syslinkipc_HeapMemMP: No such file or directory
                                                   /dev/syslinkipc_ListMP: No such file or directory
                    /dev/syslinkipc_RingIO: No such file or directory
                                                                     RingIO driver close: : Bad file descriptor
                               /dev/syslinkipc_RingIOShm: No such file or directory
   RingIO driver close: : Bad file descriptor
                                             /dev/syslinkipc_ClientNotifyMgr: No such file or directory
                       ClientNotifyMgr driver close: : Bad file descriptor
                                                                          /dev/syslinkipc_FrameQBufMgr: No such file or directory
                                                 FrameQBufMgr driver close: : Bad file descriptor
                 /dev/syslinkipc_FrameQ: No such file or directory
                                                                  FrameQ driver close: : Bad file descriptor
                            /dev/syslinkipc_Ipc: No such file or directory
                                                                           15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                 15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                       15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                                             15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                   15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                         15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                                               15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                     15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                           15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                                                 15: SYSTEM: Opening MsgQ Heap [IPC_MSGQ_MSG_HEAP] ...
                                                       ASSERT (system_ipc_msgq.c|System_ipcMsgQHeapCreate|46)

dm814x-evm login:
« Last Edit: April 23, 2021, 03:23:25 am by poot36 »
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #34 on: April 23, 2021, 04:02:01 am »
Well that definitely looks better than prior attempts! Still seems to be a lot of missing files though. Can you look in /mnt/app and see if there's anything in there? From looking at the bootlog /mnt/app should contain the contents of the ti814x folder from the 2nd cramfs image from the firmware.

As you discovered there's no root password. You can run df -h and cat /proc/mtd on your DVR and check the output.

Cheers
-Tim
« Last Edit: April 23, 2021, 04:03:37 am by dc101 »
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #35 on: April 24, 2021, 03:06:09 am »
Here is the output of df -h:

root@dm814x-evm:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                17.5M     17.5M         0 100% /
devtmpfs                  1.0M     52.0K    972.0K   5% /dev
tmpfs                    40.0K         0     40.0K   0% /mnt/.splash
none                      1.0M     52.0K    972.0K   5% /dev
tmpfs                    16.0M     20.0K     16.0M   0% /var/volatile
tmpfs                    35.8M         0     35.8M   0% /dev/shm
tmpfs                    16.0M         0     16.0M   0% /media/ram
/dev/mtdblock5           25.9M     25.9M         0 100% /mnt/app
/dev/mtdblock6            4.0M    788.0K      3.2M  19% /mnt/para

and here is the output of cat /proc/mtd:

root@dm814x-evm:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00020000 "U-Boot-min"
mtd1: 00240000 00020000 "U-Boot"
mtd2: 00020000 00020000 "U-Boot Env"
mtd3: 00440000 00020000 "Kernel"
mtd4: 00800000 00020000 "File System"
mtd5: 00c00000 00020000 "Application"
mtd6: 00400000 00020000 "Param"
mtd7: 00020000 00020000 "Version"
mtd8: 00200000 00020000 "Logo"
mtd9: 04000000 00020000 "Whole"
mtd10: 05f20000 00020000 "Reserved"

Any other commands you want me to try running?
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8240
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #36 on: April 24, 2021, 05:51:28 am »
Shenzhen Baichuan was the company that made it, and that company is now known as Reolink. Worth asking them?
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #37 on: April 24, 2021, 06:29:26 pm »
Can you list the contents of /mnt/app? ls -alF /mnt/app
It is complaining about not being able to find several files that are supposed to be in that directory. The /mnt/app directory should contain all the files in the 2nd cramfs image from the firmware image.

Cheers
-Tim
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #38 on: April 24, 2021, 10:35:20 pm »
@amyk I had a look at their websight and found that the oldest firmware they have listed is from 2018 and is not for my device however the interface shown in the screen shots looks very similar to what I was working with before I bricked the unit.  May have to contact them if I can not get any further with what I am doing right now.

@dc101 Here is the output of ls -alF /mnt/app:

root@dm814x-evm:~# ls -alF /mnt/app
-rwxr-xr-x    1 1002     234          7632 Jan  1  1970 armbase64*
-rwxr-xr-x    1 1002     234          4096 Jan  1  1970 asc16*
-rwxr-xr-x    1 1002     234         12438 Jan  1  1970 daemon*
-rwxr-xr-x    1 1002     234       2832088 Jan  1  1970 dvr*
-rwxr-xr-x    1 1002     234           761 Jan  1  1970 dvr.xml*
-rwxr-xr-x    1 1002     234        261696 Jan  1  1970 hzk16*
-rwxr-xr-x    1 1002     234        981292 Jan  1  1970 msmtp*
-rwxr-xr-x    1 1002     234        631940 Jan  1  1970 parted*
-rwxr-xr-x    1 1002     234        574408 Jan  1  1970 partprobe*
drwxr-xr-x    1 1002     234            32 Jan  1  1970 res/
drwxr-xr-x    1 1002     234           204 Jan  1  1970 ti814x/
-rwxr-xr-x    1 1002     234        486640 Jan  1  1970 update*
-rwxr-xr-x    1 1002     234         49350 Jan  1  1970 upnpc*
drwxr-xr-x    1 1002     234            48 Jan  1  1970 www/

At least there is files in it.
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #39 on: April 24, 2021, 10:53:24 pm »
Can you cat /etc/rc5.d/S81appinit
And also ls -alF /mnt/app/ti814x

Also, how did you conduct the firmware update initially? Was it through the GUI, or was it some other method?
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #40 on: April 24, 2021, 11:04:58 pm »
Output of cat /etc/rc5.d/S81appinit:

root@dm814x-evm:~# cat /etc/rc5.d/S81appinit
if [ -r /dev/usb/usbhd1 ];then
        mount -t vfat /dev/usb/usbhd1 /mnt/usb
        if [ -r /mnt/usb/autoexec.sh ];then
                chmod +x /mnt/usb/autoexec.sh
                /mnt/usb/autoexec.sh
        else
                echo "autoexec is not ready for running"
        fi
        umount -f /mnt/usb
else
        echo "usb is not ready for autoexec"
fi

mount -t cramfs /dev/mtdblock5 /mnt/app
mount -t yaffs2 /dev/mtdblock6 /mnt/para

cd /mnt/app
./logo&

cd /mnt/app/ti814x/
./init.sh
./load.sh

cd /mnt/app
./daemon ./dvr &

Output of ls -alF /mnt/app/ti814x:

root@dm814x-evm:~# ls -alF /mnt/app/ti814x
drwxr-xr-x    1 1002     234           132 Jan  1  1970 bin/
-rwxr-xr-x    1 1002     234          1039 Jan  1  1970 env.sh*
drwxr-xr-x    1 1002     234           108 Jan  1  1970 firmware/
-rwxr-xr-x    1 1002     234          1593 Jan  1  1970 init.sh*
drwxr-xr-x    1 1002     234           200 Jan  1  1970 kermod/
-rwxr-xr-x    1 1002     234           646 Jan  1  1970 load.sh*
-rwxr-xr-x    1 1002     234            32 Jan  1  1970 run.sh*
drwxr-xr-x    1 1002     234           220 Jan  1  1970 scripts/
-rwxr-xr-x    1 1002     234           522 Jan  1  1970 unload.sh*
-rwxr-xr-x    1 1002     234           568 Jan  1  1970 validate.sh*

I updated it through the GUI, the interesting thing is that the original firmware saw one of my flash drives but not another one and once I updated to the newer firmware (that was the working one) it did not see my original flash drive but did see the other one and then I tired the what I thought was even later firmware that resulted in the brick I have now.  Odd behavior with the flash drives don't you think?  They were formatted with the same filesystem as far as I can remember.  I have also extracted the 2nd cramfs file system from the .pak file if I need it (I think it is the Application partition but I am not sure).
« Last Edit: April 25, 2021, 04:35:47 am by poot36 »
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #41 on: April 25, 2021, 03:32:40 pm »
It take the GUI doesn't come up on the screen at this point?

Might not be a bad idea to try and flash the 2nd cramfs image (application) to mtd5.

Code: [Select]
cramfs: bad compressed blocksize 2688251248
cramfs: bad compressed blocksize 2688251248
/etc/rc5.d/S81appinit: line 18: ./logo: not found
/etc/rc5.d/S81appinit: line 21: ./init.sh: Input/output error
cramfs: bad compressed blocksize 3786985870
cramfs: bad compressed blocksize 3786985870
/etc/rc5.d/S81appinit: line 22: ./load.sh: Input/output error
I did some searching on these error messages and that Input/output error generally means some sort of disk/ram issue.
You could try running fsck on /dev/mtdblock5 before you flash it again:
umount /dev/mtdblock5; /usr/sbin/fsck.cramfs -v /dev/mtdblock5

Cheers
-Tim
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #42 on: April 25, 2021, 04:04:10 pm »
The GUI does not come up, I get video output but it is just a thin line on the bottom of the screen.  It is giving me this error when I run that command:

umount: /mnt/app: device is busy.
        (In some cases useful info about processes that use
         the device is found by lsof(8) or fuser(1))
cramfs endianness is little
warning: file extends past end of filesystem
/usr/sbin/fsck.cramfs: crc error

I am going to try it on mtdblock6 and see what happens.  I am also going to try and mount a USB flash drive and see if I can dump the partitions.
« Last Edit: April 25, 2021, 04:20:00 pm by poot36 »
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #43 on: April 25, 2021, 04:06:57 pm »
When I try that command on mtdblock6 I get this error:

/usr/sbin/fsck.cramfs: superblock magic not found

I get the feeling that mtdblock6 is somehow corrupted.
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #44 on: April 25, 2021, 04:49:24 pm »
Well I have managed to dump all the partitions off the DVR using dd and am in the process of comparing them to the content of the .pak file.
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #45 on: April 25, 2021, 05:12:55 pm »
I have compared mtdblock5 (which is the Application partition) and have found it to be good up to a point at which it does not match the original file what so ever, the dump even includes more data then the original file so I think the incorrect firmware may have added to it in some way as well.  I think the mtdblock6 is actually fine (it is completely blank according to my dump).  I will flash the Application partition to the system and see what happens.
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #46 on: April 25, 2021, 05:44:26 pm »
For whatever reason, the vendor decided to make mtdblock6 yaffs2 and not cramfs, so it makes sense that the super block is not found. If you look in /etc/rc5.d/S81appinit you will see the line where it mounts mtdblock6

When I try that command on mtdblock6 I get this error:

/usr/sbin/fsck.cramfs: superblock magic not found

I get the feeling that mtdblock6 is somehow corrupted.
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #47 on: April 25, 2021, 05:49:06 pm »
Take care that the application cramfs image you flash to mtdblock5 doesn't contain any extra information. There is a BMP file after it in the .pak file. You can run fsck.cramfs on the actual cramfs file to check it.
Code: [Select]
user@femto:~/re_projs/swan/DVR4-4000_GA1.9_1025$ fsck.cramfs -v cramfs2.bin
cramfs endianness is little
cramfs2.bin: OK

If your cramfs image contains extra data you will see something like this:
Code: [Select]
user@femto:~/re_projs/swan/DVR4-4000_GA1.9_1025$ fsck.cramfs ./cramfs2.bin
fsck.cramfs: file extends past end of filesystem

I have compared mtdblock5 (which is the Application partition) and have found it to be good up to a point at which it does not match the original file what so ever, the dump even includes more data then the original file so I think the incorrect firmware may have added to it in some way as well.  I think the mtdblock6 is actually fine (it is completely blank according to my dump).  I will flash the Application partition to the system and see what happens.
« Last Edit: April 25, 2021, 05:50:51 pm by dc101 »
 

Offline poot36Topic starter

  • Frequent Contributor
  • **
  • Posts: 678
  • Country: ca
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #48 on: April 25, 2021, 05:50:22 pm »
I have attached the output of the boot log to this post as it is too long for the forum once I flashed the Application partition using dd.  It is now booted and I went through the initial setup wizard but now it is asking for a password to let me in that I did not set in the setup wizard so I will have to figure that out as well.  Not sure if the extra data that was in the Application partition is still there or not.
 

Offline dc101

  • Regular Contributor
  • *
  • Posts: 220
  • Country: us
Re: Swann DVR (security camera recorder) bricked after firmware update
« Reply #49 on: April 25, 2021, 05:53:42 pm »
I have compared mtdblock5 (which is the Application partition) and have found it to be good up to a point at which it does not match the original file what so ever, the dump even includes more data then the original file so I think the incorrect firmware may have added to it in some way as well.  I think the mtdblock6 is actually fine (it is completely blank according to my dump).  I will flash the Application partition to the system and see what happens.

This makes sense, if you recall the other kernel had a different mtd partition layout. So it probably overwrote part of what the correct kernel considers the application partition.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf