v380-ipcam-firmware-patch
v380-ipcam-firmware-patch copied to clipboard
bcaller
I think i bricked my camera, what can i do?
I think I just bricked my camera by installing an old firmware I downloaded from a forum. the startup process ends with a segmentation fault. And it seems like it doesn't load the updates from the sd card anymore. is this camera just fully bricked now? are there any possible way to recover it? the firmware originally was V380E12_WF8_PTZ_20180628 (as reported by the mobile app) and then i installed an update called AK3918E-V200_V.2.5.9.5 and now it wont start at all :( any recommendation on what i should do? or is it just screwed? Does anyone have the latest firmware files for this camera?
You can not install early patches on these cameras, because each update is not a firmware, but a patch that fixes something in the previous firmware. If you have done so, then it is very difficult to fix the camera. Probably need to use the serial port. Solder and disassemble. And you can't do it with a simple soldering iron.
Yeah, i think i really screwed up. I already have serial port access. But I still don't know the root password so I cant try to fix it this way. I don't think there is a way for me to fix this apart from just taking the flash out and flashing the correct firmware on it, so basically impossible...
I found information from someone who knows how to restore cameras. He writes that the program and the CH341A programmer are needed. At the same time, it attaches this file. But it is not known whether it is suitable for all or only for certain models. win25q64jvs10_my_dump_reset.zip
I'm guessing ill have to desolder the flash for this? also is there any info for what camera that dump is from?
okay i think that is the exact same camera as mine. I guess ill have to buy the ch341a programmer first... edit: I think mine is actually V380E2_C2, I don't know if it has the same hardware or not... hopefully yes...
My camera is V380E2_C2. But I do not know how to make a dump. I have telnet. I can copy something. If you publish the firmware that you installed. I can tell you exactly what your model is.
My camera is V380E2_C2. But I do not know how to make a dump.
Yeah, I think it requires you to desolder the flash and dumping the entire contents with a programmer. So its very difficult. I'm gonna try it with that dump anyways. maybe by some miracle it just works with my camera and I can get it to work again. if that doesn't work I might try modifying the current firmware by dumping it first.
i think I'm sure the model is V380E2_C2 because its in the patch headers. if you can, maybe try dumping all the partitions to a microsd card. not exactly sure how to do that tho...
I read that the dump is received like this:
tar -cvf dump_V380E2_C2 /mnt/
Do it?
I'm not sure, i think that command basically dumps the /mnt/ folder, what is in it?
~ # ls
bin dev etc ext init lib mnt mvs proc sbin sys tmp usr var
~ #
~ # cd /mnt
/mnt # ls
mtd nand sdcard
/mnt # cd mtd
/mnt/mtd # ls
DDNSClient.ini dns_last_serverips.ini mvconf recorde.ini vg_boot.sh
ResetBind.ini h265_1920x1080.cfg mvsound recorder vsipbroadcast
as9ipcwatchdog idcheck.sh network_Info.ini resolv.conf wificonf
as9nvserver inet.conf nvconfig.ini stopallapp.sh
as9updatednsip ipsourceserver.ini nvipcstart.sh styleId
audiofile_player isp_gc1054.conf patchrule.sh user_info.ini
authority.ini mtd_remount.sh prerun venc.cfg
hmm, maybe try dumping files in /dev/ instead? i think that would have the partitions. can you list /dev/?
hmm it looks like using tar might not be the way to go, all the devices are 0 bytes. i think you'd have to manually read each devices using cat and save it to the microsd, for example "cat /dev/mtd0 > /mnt/sdcard/mtd0" which will read from the mtd0 device and write it to the sdcard. But i dont even have a plan on how i would write these files to the camera flash, so it might end up being useless.
But, can you show me the output of "df"? to show the partition list
~ # df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 1280 1280 0 100% /
tmpfs 1536 832 704 54% /mnt/mtd
/dev/mtdblock5 1536 1536 0 100% /usr
/dev/mtdblock6 1152 1152 0 100% /mvs
/dev/mtdblock7 384 384 0 100% /ext
/dev/mtdblock8 1536 832 704 54% /mnt/mtd
/dev/loop0 95 1 95 1% /tmp/ramdisk
/dev/mmcblk0p1 65501952 1183392 64318560 2% /mnt/sdcard
~ #
okay thanks. im still not 100% sure what to do next... Im currently in the process of bruteforcing the password but i doubt ill get anywhere with that. I guess My plan is going to be trying the V380E2_C on my camera and hoping it works (after dumping my current flash)
If it works, write it. Then I'll make you an installer for the web server.
Okay, i already ordered the programmer. hopefully, i can get the firmware to work. it looks like it uses the same cpu (or at least brand of cpu) so hopefully it will be mostly compatible
I just bought the camera too! i was excited, but a series of bad decision brought me here
I looked at the board and I think I found the flash. A 64mbit 8MB flash 25l6436f. I also found someone else's thread with a camera that uses the same flash and they had success but with a second camera to dump the flash image. so hopefully I can get it to work too...
i wish I didn't make a hole for the serial pins on the camera, I probably could've just returned it haha
I have received the programmer and flashed the V380E2_C dump but unfortunately it failed to initialize everything. So its not compatible at all. But I am currently waiting for another camera from the same seller and hopefully it's the exact same model...
I have received my second camera, and unfortunately it's a different model... only slightly different but different enough to make the firmware incompatible. the first one I noticed is that the SPI Flash and wifi modules are different.
I still tried dumping it and flashing it to the first camera and it does not work. But it is a different error, I uploaded a full log here: https://pastebin.com/J820nCSJ and it looks kinda similar to the logs of the camera before I installed the old problematic patch files. So there is some hope to maybe patching it somehow, but I don't know... Another thing that gave me hope is that the speakers and motors are working, and it looks like there is no compatibility error like when I tried the V380E2_C dump.
The booting process is basically stuck at this part, it just continuously loops at this and doesn't continue. While I do not have the boot logs before i corrupted the old camera, it does looks very similar. Especially the "DNS parsing error", i remember seeing that on the original not yet fully corrupted firmware. looping part of the log:
=============================================================
as9updatednsip ver: 8.5.9.1_20190413_9d4b238[build:Mar 30 2020_15:30:49]
=============================================================
Check encrypt calculate ID:147895838 MACID:-1 IPCID:45342452 incorrect!
[0:01:12][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:01:12][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:01:12][1m[33m[WRN][ulog]Upload device base information failed ! retcode=[-23][0m
updatednsip gethostbyname_r err.
updnsGetHost success
gethost by name fail Domain:
time:312768054,Domain:47.107.163.76
base64:JirpJYL8u9d3QstCXL4eGw==
before md5:encrypt=JirpJYL8u9d3QstCXL4eGw==×tamp=312768054hsshop2016
{"encrypt":"JirpJYL8u9d3QstCXL4eGw==","timestamp":312768054,"sign":"cd4e55e3d1fb8326abf100791eb51102"}
http form post error= connect:: Network is unreachable
47.107.163.76:8002timestamp:0
usb 1-1: device descriptor read/64, error -110
[0:01:14][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:01:14][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:01:14][1m[33m[WRN][ulog]Upload device base information failed ! retcode=[-23][0m
updatednsip gethostbyname_r err.
updatednsip gethostbyname_r err.
[0:01:16][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:01:16][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:01:16][1m[33m[WRN][ulog]Upload device base information failed ! retcode=[-23][0m
exited, status=255
updatednsip_r Child PID is 577
So at this point, I think I'm gonna have to put this first camera on the shelf for now. Until someone with the exact same V380E2_C2 camera and a CH341A programmer can do a dump and upload them. At least I do have one working camera now...
I won't close this issue as this repo is one of the first search results you see when looking up the v380 patch so hopefully someone sees this and can help with providing a dump.
*Also, another thing I forgot to mention in this issue thread is that the camera was already boot looping even before I installed the old problematic patch, and I installed the patch with the hopes that it will somehow reset the entire board and fix everything. But instead, it made everything worse
I also just realized this might be the perfect opportunity to learn embedded Linux. I can try to compile my own Linux and make my own image for the board, and maybe figure out the drivers for video, USB, wifi, and everything. But that is definitely not going to be a quick project lol
Also, Arkady23. Maybe if you're not busy and have some time and are comfortable with doing this, you can get the programmer and do a dump for me :). You don't need to desolder the flash, you can get the ch341a programmer and sop8 ic clip for less than $10. Of course, you don't have to do it if you don't want to, it's not very urgent haha
Do you know the HwName/Soft_id of the new camera? If you are lucky enough to see a screen with information that there is a new firmware, then make sure to take a screenshot of this screen. It displays some of the information from the camera's HwName.
Oh yeah, I was going to do that and forgot. the new camera currently has V380E12_WF6_PTZ_E2_C2_v2.6.5.9, and the old one has the exact same firmware name!!! so maybe the hardware differences didn't matter and it runs the same firmware. but that kinda made it even weirder because now it's probably not a firmware problem, but something else...
I guess now ill have to figure that out...
after a long email conversation with the v380 email, they actually sent a firmware patch. so maybe it'll help
edit: It did not. but it think i might have figured out what the problem is:
check encrypt calculate ID:147895838 MACID:-1 IPCID:45342452 incorrect!
the IPCID is the number on the bottom of the camera and i have a feeling its what is being stored in the eeprom
You have V380E2_C2. Then install the web server https://github.com/Arkady23/V380-Web httpd_V380E2_C2_v20210530.zip
they actually sent a firmware patch
it would be useful not only for you. You can post it to anyone who has a broken camera.
unfortunately, the camera can't connect to the wifi, so I don't think I would be able to access the webserver. As for the new camera, I am afraid to do any mods to it as I actually need to use the camera, so I'm not taking any risks with the new one
here is the firmware patch they gave me AK_3918E-V200__(for new sdk version above V2.6.2.0)_V2.6.6.6_universal_upgrade_patch_2021-03-25.zip
the web server is installed absolutely safely on the sd-card.
unfortunately, the camera can't connect to the wifi
You tell them that. Perhaps they will make a more global patch that will help you. If they send you more, put it here!
Yeah, I have sent a reply to it saying the patch did not work and that I'm still unable to do the wifi setup.
These, error messages are bizarre, why is it trying to do DNS stuff and connect to servers even though it hasn't even set up wifi yet... its getting very frustrating
=============================================================
as9updatednsip ver: 8.5.9.1_20190413_9d4b238[build:Mar 30 2020_15:30:49]
=============================================================
Check encrypt calculate ID:147895838 MACID:-1 IPCID:45342452 incorrect!
[929]check wifi module (lsusb)
[0:15:28][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:15:28][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:15:28][1m[33m[WRN][ulog]Upload device base information failed ! retcode=[-23][0m
updatednsip gethostbyname_r err.
updnsGetHost success
gethost by name fail Domain:
time:312768910,Domain:47.107.163.76
base64:JirpJYL8u9d3QstCXL4eGw==
before md5:encrypt=JirpJYL8u9d3QstCXL4eGw==×tamp=312768910hsshop2016
{"encrypt":"JirpJYL8u9d3QstCXL4eGw==","timestamp":312768910,"sign":"9121d3c4ff1be9ab30377f6f5833ea90"}
http form post error= connect:: Network is unreachable
47.107.163.76:8002timestamp:0
[0:15:30][1m[33m[WRN][push][TCP]DNS parsing error, retcode=[-23][0m
[0:15:30][1m[33m[WRN][push]Get alarm servers list from[alarmserverlist.av380.net:8888] failed, retcode=[-23][0m
[0:15:30][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:15:30][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:15:30][1m[33m[WRN][ulog]Upload device base information failed ! retcode=[-23][0m
[0:15:30][1m[33m[WRN][urec][TCP]DNS parsing error, retcode=[-23][0m
[0:15:30][1m[33m[WRN][urec]Connect [rapi.av380.net:8002] failed, retcode=[-23][0m
[0:15:30][1m[33m[WRN][urec][TCP]Connect erron=[101][0m
[0:15:30][1m[33m[WRN][urec][TCP]Connect [47.107.163.76:8002] failed !![0m
[0:15:30][1m[33m[WRN][urec]Connect [47.107.163.76:8002] failed, retcode=[-17][0m
[0:15:30][1m[33m[WRN][urec]Connect server failed[0m
updatednsip gethostbyname_r err.
updatednsip gethostbyname_r err.
[932]check wifi module (lsusb)
[0:15:32][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:15:32][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
[0:15:32][1m[33m[WRN][ulog]Upload device base information failed ! retcode=[-23][0m
exited, status=255
[0:15:34][1m[33m[WRN][ulog][TCP]DNS parsing error, retcode=[-23][0m
updatednsip_r Child PID is 2481
maybe i need to try running my own scripts on it again and maybe i could find something there...
You need to look at your network_Info.ini file. If you can't do it. I can make you a patch that will copy to the sd-card folder /mnt/mtd, where this file is located and then it will be clear what you have there is corrupted. Camera data, its hwname, username, passwords, and other information. Everything is recorded in this folder. Most likely, some of your data is corrupted.