Issues with DG-M1X HD 960P

[DavidVentura]

Hey I bought a DG-M1X HD 960P but am having issues getting a shell. I just set up a dhcp server on my notebook to isolate this device from the internet while setting it up. I get connection refused if I try to ssh or telnet to the camera; but I can watch the rtsp streams (even though they are quite low quality and onvif2 seems to lag >10sec)

Any ideas? If I curl to the camera at port 5000 I get some xml back.. How did you get the shell originally? Simply telnet?

[felixsteghofer]

Hey, Yes over telnet. I simply plugged it into a DHCP enabled switch and made the wifi settings over telnet. Is telnet running in your firmware (scan port 23)?

DavidVentura [email protected] schrieb am Do., 20. Sep. 2018, 18:32:

Hey I bought a DG-M1X HD 960P but am having issues getting a shell. I just set up a dhcp server on my notebook to isolate this device from the internet while setting it up. I get connection refused if I try to ssh or telnet to the camera; but I can watch the rtsp streams (even though they are quite low quality and onvif2 seems to lag >10sec)

Any ideas? If I curl to the camera at port 5000 I get some xml back.. How did you get the shell originally? Simply telnet?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/felixsteghofer/digoo-m1x_hacks/issues/1, or mute the thread https://github.com/notifications/unsubscribe-auth/ABMNtFe0XwwZQTdSbm1y-lggmF6mMurvks5uc8D_gaJpZM4Wye55 .

[DavidVentura]

I commented a bit hastily. I ordered 2 cameras and one of them works as described here - the other one doesn't seem to be running telnet.

But! The one that works said something via the speaker ("Setting up device" or something similar) while the other one doesn't say anything

[DavidVentura]

I opened the camera that did not offer telnet, connected via serial and started up telnetd. I found a few differences between the cameras, I'll tag as working the one that came with telnetd.

cat /npc/version.txt working

22.00.00.17
P4=4871

not working

22.00.00.20
P4 = 5230
Release - Thu Aug 2 08:13:00 UTC 2007

cat /rom/custom_setting_gk.ini working

SensorType = 7  //S815CH
CustomSetPasswd = 20160404
misc_config0 = 2147483700
net_time_sync = 1
defence_led_gpio=1018
alarm_led_gpio=1016
ircut_with_adc_support=1
adc_setting_val=150150
cmos_dir_reverse_support=0
RtspAuthentication=1
IRLedTurnOffSupport = 1
SoundPromptOpt = 1

not working

# cat custom_setting_gk.ini 
net_time_sync = 1  //S815CH
SensorType = 7
CustomSetPasswd = 20160404
misc_config0 = 3221225524
ircut_with_adc_support=1
adc_setting_val=150150
RtspAuthentication=1
IRLedTurnOffSupport = 1
SoundPromptOpt = 1

find /npc/config working

/npc/config
/npc/config/video_sc2135.xml
/npc/config/video_sc1135.xml
/npc/config/video_h42.xml
/npc/config/image_sc2135.xml
/npc/config/video_sc1135_bak2.xml
/npc/config/video_ar0130.xml
/npc/config/image_sc1135.xml
/npc/config/video_sc1135_bak.xml
/npc/config/image_h42.xml
/npc/config/image_ar0130.xml

non working

/npc/config/
/npc/config/video_sc2135.xml
/npc/config/video_sc1135.xml
/npc/config/video_h42.xml
/npc/config/image_sc2135.xml
/npc/config/image_sc1135.xml
/npc/config/image_h42.xml

and if i diff /npc/config/video_sc1135.xml (which I assume based on kernel logs is the config for the correct sensor)

diff -wW 200 --suppress-common-lines -y working_npc_config.xml non_working_npc_config.xml 
<vi_framerate>25</vi_framerate>                                            |                            <vi_framerate>15</vi_framerate>
    <fps>25</fps>                                                      |                                    <fps>15</fps>
    <h264_cbr_avg_bps>2000000</h264_cbr_avg_bps>                       |                                    <h264_cbr_avg_bps>1600000</h264_cbr_avg_bps>
    <h264_vbr_max_bps>2000000</h264_vbr_max_bps>                       |                                    <h264_vbr_max_bps>1600000</h264_vbr_max_bps>
    <h264_cbr_avg_bps>1000000</h264_cbr_avg_bps>                       |                                    <h264_cbr_avg_bps>800000</h264_cbr_avg_bps>
    <h264_vbr_max_bps>1000000</h264_vbr_max_bps>                       |                                    <h264_vbr_max_bps>800000</h264_vbr_max_bps>
    <h264_vbr_max_bps>100000</h264_vbr_max_bps>                        |                                    <h264_vbr_max_bps>80000</h264_vbr_max_bps>

Shows that the non working has lower framerate and bps.. (I can see this on the video quality, which prompted me to start investigating)

Also the non working will always rotate to the left when I send any command for it to rotate..

[DavidVentura]

Increasing fps on the second camera yields this on dmesg

[   26.890000] fps is 25, support max shutter time is 20480000 curr shutter_time 0
[   27.050000] mirror_patter 3
[   28.720000] win_height:0 win_width:0
[   28.720000] win_height:0 win_width:0
[   29.480000] delay mod0 ret 12
[   29.480000] delay mod0 ret 16
[   30.410000] fps is 15, support max shutter time is 34133333 curr shutter_time 20525920
[   30.570000] delay mod0 ret 64

and the stream is 15fps

but on the good camera I get

[   26.990000] fps is 25, support max shutter time is 20480000 curr shutter_time 0

[Kobbe1]

@DavidVentura How did you actually log into the camera that had no telnet then? Is there a way through serial port? Asking because I have sort of bricked my camera by carelessly modifying /npc/boot.sh, and now it does not boot.

I can connect to the cam through serial, even got into the uboot shell - but now I have no way to actually modify the file though serial?

[DavidVentura]

if i remember correctly, i either got a root shell directly from the serial connection or it had a silly user/pwd (like admin/admin or root/root)