Skip to content

hi3815 IP Camera

hi3815 IP Camera

https://felipe.astroza.cl/hacking-hi3815-based-ip-camera/

Getting the Memory Map

  1. Get the info from the Kernel Boot log.
  2. Get the info from dmesg
  3. Get the info from /proc/mtd

Copying the Data

  1. Try mounting a NFS
  2. Try connecting to a TFTP Server
    • Check that you can put a file to it
    • You might need to split files with split -b 5242880 mtdblock2

Mount a NFS:

mkdir /mnt/nfs
mount -t nfs -o nolock [SERVER_IP_ADDRESS]:/hicam /mnt/nfs

#To avoid data corruption, remount / as a read-only file system.
mount -o remount,ro /

Copy the Directories:

dd if=/dev/mtdblock0 of=/mnt/nfs/mtdblock0 bs=65536
dd if=/dev/mtdblock1 of=/mnt/nfs/mtdblock1 bs=65536
dd if=/dev/mtdblock2 of=/mnt/nfs/mtdblock2 bs=65536
dd if=/dev/mtdblock3 of=/mnt/nfs/mtdblock3 bs=65536
dd if=/dev/mtdblock4 of=/mnt/nfs/mtdblock4 bs=65536

#Remount the root dir as RW
mount -o remount,rw /

SPI Read and Write

Setup SPI:

set ipaddr [ANY_AVAILABLE_IP_ADDRESS]
set serverip [TFTP_SERVER_IP_ADDRESS]

#Setup Flash device
sf probe 0

Read Files and transfer them to a server:

#sf read [addr] [offset] [len]
sf read 0x82000000 0x40000 0x370000

tftp 0x82000000 romfs.cramfs 0x370000

Erase Flash:

sf erase 0 0x100000

Write Flash:

sf write 0x80008000 0 0x100000