├── README.md ├── cpuinfo ├── dmesg ├── filesystems ├── free ├── fw_dump_orig ├── custom ├── logo ├── mtd ├── romfs ├── uboot ├── usr └── web ├── ifconfig ├── lsmod ├── mount ├── mtd ├── u-boot-env_orig └── uart.png /README.md: -------------------------------------------------------------------------------- 1 | # HI3536DV100 SoC 2 | 3 | I have Techage N6708G5 8 Channel PoE NVR which uses HI3536DV100 SoC. I'm publishing any information I have about this device. 4 | 5 | # Specifications 6 | 7 | * CPU - HI3536DV100 single core ARM Cortex-A7 850MHz; 8 | * RAM - 128MB DDR3, although original firmware boots with 83M; 9 | * FLASH - Winbond w25q128 SPI-NOR 16MB; 10 | * Switch - 8+1 Channel PoE switch 11 | 12 | # Original firmware 13 | 14 | I have dumped the original firmware. You can find mtd block sizes in here as well. 15 | 16 | # SDK 17 | 18 | Due some miracle, I was able to retrieve the SDK for this device. It contains kernel, uboot and a few kernel modules sources, many development tutorials regarding the board and it's peripherals and H265/264 library development. 19 | 20 | https://mega.nz/folder/FE8SnRKD#ZYj_m1jq-uLmPPWvfRpNbw 21 | 22 | # Obtaining root 23 | 24 | It seems that manufacturer patched the available backdoors so the only way to obtain root at the moment is through UART and flashing modified rootfs. On my device, EARLY_PRINTK kernel option is disabled so I don't get any bootup messages after kernel has been started nor received tty console over UART. 25 | 26 | In order to modify rootfs, you need to extract `romfs` with `unsquashfs` which contains kernel and basic rootfs with busybox. Then modify `squashfs_romfs/etc/init.d/rcS` file to comment out/remove the following line: 27 | 28 | `dvrHelper /lib/modules /usr/bin/Sofia 127.0.0.1 9578 1` 29 | 30 | Then make squashfs image with `mksquashfs` and flash through u-boot. 31 | 32 | It is needed to remove because `Sofia` application is a daemon and blocks inittab startup once it's launched. The tty console is already defined in `squashfs_romfs/etc/inittab`, but because `Sofia` blocks, tty is never launched. 33 | 34 | For UART, you need to do some soldering. I have added the similar picture of my board (will update with my real one soon) in `uart.png`. Baudrate is default - 115200. 35 | 36 | # Security 37 | 38 | Once root has been obtained I have found out that the switch ports are not isolated, meaning I can't cut off IP camera's traffic even if I install clean linux image on the NVR. It's possible to do some VLAN tagging/isolating, but it needs external re-wiring from PHY device to the HiSi CPU through I2C and writing driver for it. I doubt I will ever tinker with this. One solution I could see is using usb-to-ethernet adapter. 39 | 40 | Overall there's nothing much to say about security, it's Chinese software, it's full of bloat/possible malware and unwanted traffic back to homeland (that's why I want to isolate the IP camera's traffic). The NVR runs on 4.9.37 kernel which isn't that old, but still. 41 | 42 | # Custom Linux firmware 43 | 44 | Most of the work is done for OpenWrt 18.06 Hisilicon HI3536DV100 CPU support. Please see https://github.com/ubis/openwrt/tree/feature/add-hisi35xx-target/target/linux/hisilicon and https://github.com/ubis/openwrt/pull/1 45 | 46 | Most hardware is supported and working: Ethernet, SATA, USB, SPI NAND, GPIO(untested), except D-SUB/HDMI/Audio Out. Latter ones are enabled by probing proprietary linux kernel 4.9.37 modules. I do not have sources for them, and OpenWrt 18.06 (as of now 2019-12-28) is using 4.9.207 kernel. 47 | 48 | I had plans to fully replace NVR software with OpenWrt & some open source solution, but that seems to be not ideal solution for now. 49 | 50 | The reason behind that is mostly motion detection. It requires a right amount of hardware to do, if done on software side. However, these Hisilicon IP Cameras have dedicated hardware for that to reduce CPU usage when doing motion detection. At first I thought that motion detection is configured with ONVIF, since it is supported. Unfortunately once I dig into it further, detection is configured using proprietary protocol and only alarms/triggers are sent by ONVIF messages. 51 | 52 | As of now, I see this solution suitable: hook up small ARM board(RPI-like) with dual Ethernet support(could use even usb-ethernet). Fully isolate NVR and it's cameras. Then build rtsp-http streaming service on that ARM board and expose it for further uses. This prevents anything from going out of NVR stuff and only stream is passed. 53 | I could even build a ONVIF client reader on the ARM board and configure it to send email/do something else on trigger event. 54 | 55 | # 2021 Update 56 | 57 | So I have been running the NVR with 4 cams for a while now, with stock software. I do have a Debian server with Wireguard client in the middle between internet gateway and NVR/CAMs network. NVR/CAMs network doesn't have access to the internet. I have configured to record on motion, however, I noticed that motion detection doesn't always work and I had to switch to 24/7 recording. 58 | 59 | I would like to save records 24/7 to my NAS, however, stock sofware (Sofia) allows records to upload only via FTP server and when motion is detected. There is no option for continous record uploading. I haven't figured out what i'm gonna do about it. 60 | 61 | Recently I have found 0day vulnerability: https://habr.com/en/post/486856/ and it affected my NVR and CAMs too. I can get root access now without modifying rootfs. 62 | -------------------------------------------------------------------------------- /cpuinfo: -------------------------------------------------------------------------------- 1 | processor : 0 2 | model name : ARMv7 Processor rev 5 (v7l) 3 | BogoMIPS : 1699.02 4 | Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae 5 | CPU implementer : 0x41 6 | CPU architecture: 7 7 | CPU variant : 0x0 8 | CPU part : 0xc07 9 | CPU revision : 5 10 | 11 | Hardware : Hisilicon Hi3536DV100 (Flattened Device Tree) 12 | Revision : 0000 13 | Serial : 0000000000000000 14 | -------------------------------------------------------------------------------- /dmesg: -------------------------------------------------------------------------------- 1 | Booting Linux on physical CPU 0x0 2 | Linux version 4.9.37 (chenwenrong@xm-5) (gcc version 6.2.1 20161016 (Hisilicon_v510_20171111) ) #2 Sat Feb 24 11:23:01 CST 2018 3 | CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d 4 | CPU: div instructions available: patching division code 5 | CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache 6 | OF: fdt:Machine model: Hisilicon HI3536DV100 DEMO Board 7 | Memory policy: Data cache writeback 8 | On node 0 totalpages: 21248 9 | free_area_init_node: node 0, pgdat c0709828, node_mem_map c524f000 10 | Normal zone: 166 pages used for memmap 11 | Normal zone: 0 pages reserved 12 | Normal zone: 21248 pages, LIFO batch:3 13 | CPU: All CPU(s) started in SVC mode. 14 | pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 15 | pcpu-alloc: [0] 0 16 | Built 1 zonelists in Zone order, mobility grouping on. Total pages: 21082 17 | Kernel command line: mem=83M console=ttyAMA0,115200 root=/dev/mtdblock1 rootfstype=squashfs mtdparts=hi_sfc:320K(boot),3968K(romfs),7040K(usr),1600K(web),2816K(custom),128K(logo),512K(mtd) coherent_pool=2M 18 | PID hash table entries: 512 (order: -1, 2048 bytes) 19 | Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) 20 | Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) 21 | Memory: 76640K/84992K available (5552K kernel code, 167K rwdata, 1260K rodata, 188K init, 272K bss, 8352K reserved, 0K cma-reserved) 22 | Virtual kernel memory layout: 23 | vector : 0xffff0000 - 0xffff1000 ( 4 kB) 24 | fixmap : 0xffc00000 - 0xfff00000 (3072 kB) 25 | vmalloc : 0xc5800000 - 0xff800000 ( 928 MB) 26 | lowmem : 0xc0000000 - 0xc5300000 ( 83 MB) 27 | modules : 0xbf000000 - 0xc0000000 ( 16 MB) 28 | .text : 0xc0008000 - 0xc0574288 (5553 kB) 29 | .init : 0xc06b1000 - 0xc06e0000 ( 188 kB) 30 | .data : 0xc06e0000 - 0xc0709ee0 ( 168 kB) 31 | .bss : 0xc070b000 - 0xc074f040 ( 273 kB) 32 | SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 33 | NR_IRQS:16 nr_irqs:16 16 34 | clocksource: arm,sp804: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 637086815595 ns 35 | sched_clock: 32 bits at 3000kHz, resolution 333ns, wraps every 715827882841ns 36 | Console: colour dummy device 80x30 37 | Calibrating delay loop... 1699.02 BogoMIPS (lpj=8495104) 38 | pid_max: default: 32768 minimum: 301 39 | Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) 40 | Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) 41 | CPU: Testing write buffer coherency: ok 42 | Setting up static identity map for 0x80008200 - 0x80008258 43 | VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5 44 | clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns 45 | futex hash table entries: 256 (order: -1, 3072 bytes) 46 | pinctrl core: initialized pinctrl subsystem 47 | NET: Registered protocol family 16 48 | DMA: preallocated 2048 KiB pool for atomic coherent allocations 49 | Serial: AMBA PL011 UART driver 50 | 12080000.uart: ttyAMA0 at MMIO 0x12080000 (irq = 18, base_baud = 0) is a PL011 rev2 51 | uart-pl011 12090000.uart: aliased and non-aliased serial devices found in device tree. Serial port enumeration may be unpredictable. 52 | 12090000.uart: ttyAMA1 at MMIO 0x12090000 (irq = 19, base_baud = 0) is a PL011 rev2 53 | SCSI subsystem initialized 54 | libata version 3.00 loaded. 55 | usbcore: registered new interface driver usbfs 56 | usbcore: registered new interface driver hub 57 | usbcore: registered new device driver usb 58 | clocksource: Switched to clocksource arm,sp804 59 | NET: Registered protocol family 2 60 | TCP established hash table entries: 1024 (order: 0, 4096 bytes) 61 | TCP bind hash table entries: 1024 (order: 0, 4096 bytes) 62 | TCP: Hash tables configured (established 1024 bind 1024) 63 | UDP hash table entries: 256 (order: 0, 4096 bytes) 64 | UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) 65 | NET: Registered protocol family 1 66 | RPC: Registered named UNIX socket transport module. 67 | RPC: Registered udp transport module. 68 | RPC: Registered tcp transport module. 69 | RPC: Registered tcp NFSv4.1 backchannel transport module. 70 | workingset: timestamp_bits=30 max_order=15 bucket_order=0 71 | squashfs: version 4.0 (2009/01/31) Phillip Lougher 72 | NFS: Registering the id_resolver key type 73 | Key type id_resolver registered 74 | Key type id_legacy registered 75 | ntfs: driver 2.1.32 [Flags: R/O]. 76 | jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. 77 | fuse init (API version 7.26) 78 | Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) 79 | io scheduler noop registered 80 | io scheduler deadline registered (default) 81 | io scheduler cfq registered 82 | pinctrl-single 120f0000.pinmux: 234 pins at pa fe1f0000 size 936 83 | brd: module loaded 84 | ahci 10030000.sata: SSS flag set, parallel bus scan disabled 85 | ahci 10030000.sata: AHCI 0001.0300 32 slots 1 ports 6 Gbps 0x1 impl platform mode 86 | ahci 10030000.sata: flags: ncq sntf stag pm led clo only pmp fbs slum part ccc sxs boh 87 | scsi host0: ahci 88 | ata1: SATA max UDMA/133 mmio [mem 0x10030000-0x10030fff] port 0x100 irq 20 89 | at xm_select_FlashProtMgr() index:0x1,name:Winbond,chipSize:0x1000000.<> 90 | at xm_setTB() g_SpiNorMFR:0xef,chipsize:0x1000000 . 91 | hisi-sfc hisi_spi_nor.0: lk=>6, 0x800000. 92 | hisi-sfc hisi_spi_nor.0: w25q128 (16384 Kbytes) 93 | 7 cmdlinepart partitions found on MTD device hi_sfc 94 | at XMMtd_RegisterProtFreeRgn() index:0,offset:0xf80000,size:0x80000. 95 | Creating 7 MTD partitions on "hi_sfc": 96 | 0x000000000000-0x000000050000 : "boot" 97 | 0x000000050000-0x000000430000 : "romfs" 98 | 0x000000430000-0x000000b10000 : "usr" 99 | 0x000000b10000-0x000000ca0000 : "web" 100 | 0x000000ca0000-0x000000f60000 : "custom" 101 | 0x000000f60000-0x000000f80000 : "logo" 102 | 0x000000f80000-0x000001000000 : "mtd" 103 | FEPHY:addr=1, la_am=0xd, ldo_am=0x4, r_tuning=0x1b 104 | libphy: hisi_femac_mii_bus: probed 105 | libphy: Fixed MDIO Bus: probed 106 | ata1: SATA link down (SStatus 0 SControl 300) 107 | Generic PHY 10011100.mdio:01: attached PHY driver [Generic PHY] (mii_bus:phy_addr=10011100.mdio:01, irq=-1) 108 | phy_id=0x20669901, phy_mode=mii 109 | hisi-femac 10010000.ethernet: using random MAC address 1e:c2:92:26:10:20 110 | PPP generic driver version 2.4.2 111 | PPP BSD Compression module registered 112 | PPP Deflate Compression module registered 113 | PPP MPPE Compression module registered 114 | NET: Registered protocol family 24 115 | usbcore: registered new interface driver zd1201 116 | usbcore: registered new interface driver asix 117 | usbcore: registered new interface driver ax88179_178a 118 | usbcore: registered new interface driver cdc_ether 119 | usbcore: registered new interface driver net1080 120 | usbcore: registered new interface driver cdc_subset 121 | usbcore: registered new interface driver zaurus 122 | usbcore: registered new interface driver cdc_ncm 123 | ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver 124 | ehci-platform: EHCI generic platform driver 125 | ehci-platform 11010000.ehci: EHCI Host Controller 126 | ehci-platform 11010000.ehci: new USB bus registered, assigned bus number 1 127 | ehci-platform 11010000.ehci: irq 22, io mem 0x11010000 128 | ehci-platform 11010000.ehci: USB 2.0 started, EHCI 1.00 129 | hub 1-0:1.0: USB hub found 130 | hub 1-0:1.0: 2 ports detected 131 | ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver 132 | ohci-platform: OHCI generic platform driver 133 | ohci-platform 11000000.ohci: Generic Platform OHCI controller 134 | ohci-platform 11000000.ohci: new USB bus registered, assigned bus number 2 135 | ohci-platform 11000000.ohci: irq 23, io mem 0x11000000 136 | hub 2-0:1.0: USB hub found 137 | hub 2-0:1.0: 2 ports detected 138 | mousedev: PS/2 mouse device common for all mice 139 | hibvt_rtc 120b0000.rtc: rtc core: registered 120b0000.rtc as rtc0 140 | hibvt_rtc 120b0000.rtc: RTC driver for hibvt enabled 141 | usbcore: registered new interface driver usbhid 142 | usbhid: USB HID core driver 143 | Initializing XFRM netlink socket 144 | NET: Registered protocol family 10 145 | sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver 146 | NET: Registered protocol family 17 147 | NET: Registered protocol family 15 148 | Key type dns_resolver registered 149 | PM: Hibernation image not present or could not be loaded. 150 | Warning: unable to open an initial console. 151 | VFS: Mounted root (squashfs filesystem) readonly on device 31:1. 152 | Freeing unused kernel memory: 188K (c06b1000 - c06e0000) 153 | This architecture does not have kernel memory protection. 154 | random: sleep: uninitialized urandom read (4 bytes read) 155 | random: fast init done 156 | sys_config: loading out-of-tree module taints kernel. 157 | load sys_config.ko for ...OK! 158 | Module himedia: init ok 159 | Hisilicon Media Memory Zone Manager 160 | hi_osal 1.0 init success! 161 | hi3536dv100_base: module license 'Proprietary' taints kernel. 162 | Disabling lock debugging due to kernel taint 163 | load base.ko ... OK! 164 | load sys.ko ...OK! 165 | load vdec.ko ....OK! 166 | load vdh firmware.ko OK 167 | load vgs.ko ...OK! 168 | load vpss.ko ...OK! 169 | load vou.ko OK! 170 | load hifb.ko OK! 171 | load hdmi.ko OK! 172 | load chnl.ko ...OK! 173 | at24c16 174 | : 175 | ======================================================== 176 | at24c16 177 | : 178 | Driver Version=20150126 DateTime=Oct 26 2017-18:57:07. 179 | at24c16 180 | : 181 | Driver for HISI3535 Linux 4.9.37 . 182 | =============================================================== 183 | | AT24C16: SVN:54,Compiled by shaoweidong at Oct 26 2017 18:57:07 | 184 | =============================================================== 185 | gpio_i2c_wread_24c16 0x33:d2 186 | gpio_i2c_read_24c16 0x34:d4 187 | at24c16 driver init start ... 188 | fvideo driver init successful! 189 | Hisilicon Watchdog Timer: 0.01 initialized. default_margin=60 sec (nowayout= 0, nodeamon= 1) 190 | =============================================================== 191 | | HIWDT: SVN:43,Compiled by shaoweidong at Feb 23 2018 18:57:44 | 192 | =============================================================== 193 | HISI_IRDA-MF @Hi3520Dv100R00 194 | =============================================================== 195 | | HIIR: SVN:49,Compiled by shaoweidong at Oct 23 2017 19:09:01 | 196 | =============================================================== 197 | hiir: init ok. ver=Oct 23 2017, 19:09:01. 198 | usbcore: registered new interface driver usb-storage 199 | load aio.ko OK! 200 | load ao.ko OK! 201 | load adec.ko OK! 202 | load acodec.ko OK! -------------------------------------------------------------------------------- /filesystems: -------------------------------------------------------------------------------- 1 | nodev sysfs 2 | nodev rootfs 3 | nodev ramfs 4 | nodev bdev 5 | nodev proc 6 | nodev cgroup 7 | nodev cgroup2 8 | nodev tmpfs 9 | nodev sockfs 10 | nodev pipefs 11 | nodev rpc_pipefs 12 | nodev devpts 13 | ext3 14 | ext4 15 | ext2 16 | cramfs 17 | squashfs 18 | vfat 19 | msdos 20 | iso9660 21 | nodev nfs 22 | nodev nfs4 23 | ntfs 24 | nodev jffs2 25 | fuseblk 26 | nodev fuse 27 | nodev fusectl 28 | nodev ubifs 29 | -------------------------------------------------------------------------------- /free: -------------------------------------------------------------------------------- 1 | MemTotal: 76828 kB 2 | MemFree: 55660 kB 3 | MemAvailable: 52748 kB 4 | Buffers: 1760 kB 5 | Cached: 3808 kB 6 | SwapCached: 0 kB 7 | Active: 4500 kB 8 | Inactive: 1772 kB 9 | Active(anon): 704 kB 10 | Inactive(anon): 4 kB 11 | Active(file): 3796 kB 12 | Inactive(file): 1768 kB 13 | Unevictable: 0 kB 14 | Mlocked: 0 kB 15 | SwapTotal: 0 kB 16 | SwapFree: 0 kB 17 | Dirty: 0 kB 18 | Writeback: 0 kB 19 | AnonPages: 728 kB 20 | Mapped: 1980 kB 21 | Shmem: 4 kB 22 | Slab: 6480 kB 23 | SReclaimable: 892 kB 24 | SUnreclaim: 5588 kB 25 | KernelStack: 464 kB 26 | PageTables: 100 kB 27 | NFS_Unstable: 0 kB 28 | Bounce: 0 kB 29 | WritebackTmp: 0 kB 30 | CommitLimit: 38412 kB 31 | Committed_AS: 2160 kB 32 | VmallocTotal: 950272 kB 33 | VmallocUsed: 0 kB 34 | VmallocChunk: 0 kB 35 | 36 | total used free shared buffers 37 | Mem: 76828 21160 55668 4 1760 38 | -/+ buffers: 19400 57428 39 | Swap: 0 0 0 40 | -------------------------------------------------------------------------------- /fw_dump_orig/custom: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ubis/HI3536DV100/957eba203110b59cff7449824d6d4c534f994324/fw_dump_orig/custom -------------------------------------------------------------------------------- /fw_dump_orig/logo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ubis/HI3536DV100/957eba203110b59cff7449824d6d4c534f994324/fw_dump_orig/logo -------------------------------------------------------------------------------- /fw_dump_orig/mtd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ubis/HI3536DV100/957eba203110b59cff7449824d6d4c534f994324/fw_dump_orig/mtd -------------------------------------------------------------------------------- /fw_dump_orig/romfs: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ubis/HI3536DV100/957eba203110b59cff7449824d6d4c534f994324/fw_dump_orig/romfs -------------------------------------------------------------------------------- /fw_dump_orig/uboot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ubis/HI3536DV100/957eba203110b59cff7449824d6d4c534f994324/fw_dump_orig/uboot -------------------------------------------------------------------------------- /fw_dump_orig/usr: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ubis/HI3536DV100/957eba203110b59cff7449824d6d4c534f994324/fw_dump_orig/usr -------------------------------------------------------------------------------- /fw_dump_orig/web: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ubis/HI3536DV100/957eba203110b59cff7449824d6d4c534f994324/fw_dump_orig/web -------------------------------------------------------------------------------- /ifconfig: -------------------------------------------------------------------------------- 1 | ifconfig -a 2 | eth0 Link encap:Ethernet HWaddr 00:12:17:BB:C3:6C 3 | inet addr:192.168.1.9 Bcast:192.168.1.255 Mask:255.255.255.0 4 | UP BROADCAST MULTICAST MTU:1500 Metric:1 5 | RX packets:0 errors:0 dropped:0 overruns:0 frame:0 6 | TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 7 | collisions:0 txqueuelen:1000 8 | RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) 9 | Interrupt:21 10 | 11 | lo Link encap:Local Loopback 12 | inet addr:127.0.0.1 Mask:255.0.0.0 13 | inet6 addr: ::1/128 Scope:Host 14 | UP LOOPBACK RUNNING MTU:65536 Metric:1 15 | RX packets:0 errors:0 dropped:0 overruns:0 frame:0 16 | TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 17 | collisions:0 txqueuelen:1 18 | RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) 19 | 20 | sit0 Link encap:IPv6-in-IPv4 21 | NOARP MTU:1480 Metric:1 22 | RX packets:0 errors:0 dropped:0 overruns:0 frame:0 23 | TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 24 | collisions:0 txqueuelen:1 25 | RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) 26 | -------------------------------------------------------------------------------- /lsmod: -------------------------------------------------------------------------------- 1 | hi_acodec 4019 0 - Live 0xbf31b000 (PO) 2 | hi3536dv100_adec 6231 0 - Live 0xbf316000 (PO) 3 | hi3536dv100_ao 88924 0 - Live 0xbf2fa000 (PO) 4 | hi3536dv100_aio 25672 1 hi_acodec, Live 0xbf2ee000 (PO) 5 | usb_storage 44919 0 - Live 0xbf2da000 6 | hi_ir 10101 0 - Live 0xbf2d4000 (O) 7 | hiwdt 4168 0 - Live 0xbf2cf000 (O) 8 | at24c 5578 0 - Live 0xbf2ca000 (O) 9 | hi3536dv100_chnl 36010 0 - Live 0xbf2bc000 (PO) 10 | hi3536dv100_hdmi 290903 0 - Live 0xbf262000 (PO) 11 | hifb 77156 0 - Live 0xbf247000 (PO) 12 | hi3536dv100_vou 298360 0 - Live 0xbf1ea000 (PO) 13 | hi3536dv100_vpss 123268 0 - Live 0xbf1c1000 (PO) 14 | hi3536dv100_vgs 166491 0 - Live 0xbf18d000 (PO) 15 | hi3536dv100_vfmw 1059627 0 - Live 0xbf078000 (PO) 16 | hi3536dv100_vdec 166698 0 - Live 0xbf047000 (PO) 17 | hi3536dv100_sys 53927 1 hi3536dv100_aio, Live 0xbf033000 (PO) 18 | hi3536dv100_base 47318 12 hi3536dv100_adec,hi3536dv100_ao,hi3536dv100_aio,hi3536dv100_chnl,hi3536dv100_hdmi,hifb,hi3536dv100_vou,hi3536dv100_vpss,hi3536dv100_vgs,hi3536dv100_vfmw,hi3536dv100_vdec,hi3536dv100_sys, Live 0xbf021000 (PO) 19 | hi_osal 60174 14 hi_acodec,hi3536dv100_adec,hi3536dv100_ao,hi3536dv100_aio,hi3536dv100_chnl,hi3536dv100_hdmi,hifb,hi3536dv100_vou,hi3536dv100_vpss,hi3536dv100_vgs,hi3536dv100_vfmw,hi3536dv100_vdec,hi3536dv100_sys,hi3536dv100_base, Live 0xbf004000 (O) 20 | sys_config 2841 0 - Live 0xbf000000 (O) 21 | -------------------------------------------------------------------------------- /mount: -------------------------------------------------------------------------------- 1 | /dev/root on / type squashfs (ro,relatime) 2 | proc on /proc type proc (rw,relatime) 3 | sysfs on /sys type sysfs (rw,relatime) 4 | tmpfs on /dev type tmpfs (rw,relatime) 5 | devpts on /dev/pts type devpts (rw,relatime,mode=600,ptmxmode=000) 6 | /dev/mtdblock2 on /usr type squashfs (ro,relatime) 7 | /dev/mtdblock3 on /mnt/web type squashfs (ro,relatime) 8 | /dev/mtdblock4 on /mnt/custom type squashfs (ro,relatime) 9 | /dev/mtdblock5 on /mnt/logo type cramfs (ro,relatime) 10 | /dev/mtdblock6 on /mnt/mtd type jffs2 (rw,relatime) 11 | /dev/mem on /var type ramfs (rw,relatime) 12 | none on /mnt/usb type ramfs (rw,relatime,codepage=936,iocharset=gb2312,usefree) 13 | -------------------------------------------------------------------------------- /mtd: -------------------------------------------------------------------------------- 1 | dev: size erasesize name 2 | mtd0: 00050000 00010000 "boot" 3 | mtd1: 003e0000 00010000 "romfs" 4 | mtd2: 006e0000 00010000 "usr" 5 | mtd3: 00190000 00010000 "web" 6 | mtd4: 002c0000 00010000 "custom" 7 | mtd5: 00020000 00010000 "logo" 8 | mtd6: 00080000 00010000 "mtd" 9 | -------------------------------------------------------------------------------- /u-boot-env_orig: -------------------------------------------------------------------------------- 1 | silicon # printenv 2 | bootcmd=sf probe 0;sf read 0x84000000 0xf60000 0x20000;logoload 0x84000000;decjpg;sf read 0x82000000 0x50000 0x500000;squashfsload 82000000;bootm 0x81000000 3 | bootdelay=1 4 | baudrate=115200 5 | ethaddr=00:0b:3f:00:00:01 6 | bootfile="uImage" 7 | da=mw.b 0x82000000 ff 1000000;tftp 0x82000000 u-boot.bin.img;sf probe 0;flwrite 8 | du=mw.b 0x82000000 ff 1000000;tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwrite 9 | dr=mw.b 0x82000000 ff 1000000;tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwrite 10 | dw=mw.b 0x82000000 ff 1000000;tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwrite 11 | dl=mw.b 0x82000000 ff 1000000;tftp 0x82000000 logo-x.cramfs.img;sf probe 0;flwrite 12 | dc=mw.b 0x82000000 ff 1000000;tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwrite 13 | up=mw.b 0x82000000 ff 1000000;tftp 0x82000000 update.img;sf probe 0;flwrite 14 | tk=mw.b 0x82000000 ff 1000000;tftp 0x82000000 zImage.img; bootm 0x82000000 15 | dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwrite 16 | appVideoStandard=PAL 17 | appSystemLanguage=English 18 | bootargs=mem=83M console=ttyAMA0,115200 root=/dev/mtdblock1 rootfstype=squashfs mtdparts=hi_sfc:320K(boot),3968K(romfs),7040K(usr),1600K(web),2816K(custom),128K(logo),512K(mtd) coherent_pool=2M 19 | stdin=serial 20 | stdout=serial 21 | stderr=serial 22 | verify=n 23 | ver=U-Boot 2010.06-svn880 (Mar 22 2018 - 10:21:19) 24 | filesize=11A9CA 25 | fileaddr=82000000 26 | gatewayip=192.168.0.1 27 | netmask=255.255.255.0 28 | ipaddr=192.168.1.10 29 | serverip=192.168.1.183 30 | 31 | Environment size: 1423/65532 bytes 32 | -------------------------------------------------------------------------------- /uart.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ubis/HI3536DV100/957eba203110b59cff7449824d6d4c534f994324/uart.png --------------------------------------------------------------------------------