Jump to content
CBX

Hikvision Raptor Tech Notes

Recommended Posts

Hi all

 

I've been playing with my Hikvisions cameras to get them to do what I need, but found it more fun than I expected so I have continued to look into different aspects.

 

Up till now I've been making a different thread for each investigation, but it might make more sense to just have one and not deluge everyone with threads they likely have no interest it This is primarily for my reference as it's helpful to remember what I've done.

 

Chinese day of week patch:

 

viewtopic.php?f=19&t=39693

 

How to put camera in debug mode &

How to enable FTP:

 

viewtopic.php?f=19&t=39417

 

Hikvision secure code:

 

viewtopic.php?f=19&t=39846

 

I know people want a permemant fix for the chinese day of week issue. I modify my cameras anyway so I've no need for this, but if you are interested the locations I think the language flag is set are detailed in this thread:

 

viewtopic.php?f=19&t=39646

 

If no one minds, I'll just post new things here rather than new thread each time, unless it seems particularly called for.

 

As far as I know you can't edit posts after a certain time, so I can't update this post with new info, so will just be added to the end

Edited by Guest

Share this post


Link to post
Share on other sites

This will likely interest no one but me, but in the course of working on the camera, I've been annoyed by the lack of functionality with the installed tools (though in fairness to Hikvision they've put what's needed for most people).

 

So I've cross compiled a new busybox to replace the old one.

 

Original functions:

 

Currently defined functions:
       ash, awk, bash, cat, chmod, cp, date, dd, df, dmesg, du, echo,
       env, false, fdisk, free, fsync, ftpget, ftpput, gunzip, gzip, halt,
       hwclock, ifconfig, inetd, init, insmod, iostat, kill, linuxrc, ln,
       login, ls, lsmod, mdev, mkdir, mkdosfs, mkfs.vfat, mknod, modprobe,
       mount, mpstat, mv, nanddump, nandwrite, netstat, ping, ping6, poweroff,
       ps, pwd, reboot, rm, rmmod, route, sed, sh, sleep, sync, tail, tar,
       telnetd, test, tftp, top, touch, true, umount, zcat

 

My one with more tools:

 

        acpid, add-shell, addgroup, adduser, adjtimex, arp, arping,
       ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl,
       bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod,
       chown, chpasswd, chpst, chroot, chrt, chvt, cksum, clear, cmp, comm,
       cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd,
       deallocvt, delgroup, deluser, depmod, devmem, df, diff, dirname,
       dmesg, dnsd, dnsdomainname, dos2unix, du, dumpkmap, echo, ed, egrep,
       env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false,
       fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find,
       findfs, flash_lock, flash_unlock, flashcp, flock, fold, free,
       freeramdisk, fsck, fsck.minix, fsync, ftpd, ftpget, ftpput, fuser,
       getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head,
       hexdump, hostid, hostname, hush, hwclock, id, init, insmod, install,
       ionice, iostat, ipcrm, ipcs, kbd_mode, kill, killall, killall5,
       klogd, last, less, linux32, linux64, linuxrc, ln, loadfont, loadkmap,
       logger, login, logname, logread, losetup, ls, lsattr, lsmod, lspci,
       lsusb, lzcat, lzma, lzop, lzopcat, makedevs, man, md5sum, mdev, mesg,
       microcom, mkdir, mkdosfs, mke2fs, mkfifo, mkfs.ext2, mkfs.minix,
       mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more,
       mount, mountpoint, mpstat, mt, mv, nameif, nbd-client, nc, nice,
       nmeter, nohup, od, openvt, passwd, patch, pgrep, pidof, ping, ping6,
       pipe_progress, pivot_root, pkill, pmap, poweroff, powertop, printenv,
       printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev,
       readahead, readlink, readprofile, realpath, reboot, remove-shell,
       renice, reset, resize, rev, rm, rmdir, rmmod, rpm, rpm2cpio, rtcwake,
       run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed,
       seq, setarch, setconsole, setfont, setkeycodes, setlogcons,
       setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha512sum,
       showkey, slattach, sleep, smemcap, softlimit, sort, split,
       start-stop-daemon, stat, strings, stty, su, sulogin, sum, sv, svlogd,
       swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar,
       tcpsvd, tee, telnet, test, time, timeout, top, touch, tr, traceroute,
       true, tty, ttysize, tunctl, tune2fs, ubiattach, ubidetach, ubimkvol,
       ubirmvol, ubirsvol, ubiupdatevol, udpsvd, umount, uname, unexpand,
       uniq, unix2dos, unlzma, unlzop, unxz, unzip, uptime, users, usleep,
       uudecode, uuencode, vconfig, vi, vlock, volname, wall, watch,
       watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes,
       zcat, zcip

 

I've put mine in /dav/opt and then run a script on boot to link functions which don't already exist:

 

/ # cat /dav/opt/busybox.sh
for FUNC in `/dav/opt/busybox --list-functions`; do
 ln -s /dav/opt/busybox /"$FUNC"
done

 

This gives things like syslogd and klogd as well as things I use a lot like vi, grep, strings, less, md5sum etc.

 

You can also use busybox to run a full http, smtp, pop server etc on the camera but i don't need those. Being about to telnet from the camera to other places has proved helpful though.

Edited by Guest

Share this post


Link to post
Share on other sites

One of the things that people ask is "is there no linux logging?"

 

Well, you can enable debug mode with setDebug and outputOpen, and also get dmesg. You can also run davinci from the command line (handy if you are developing), but that involves making changes to the camera to stop it doing automatically, and if you don't know what you are doing you will lock yourself out of the camera.

 

But it's possible to run syslogd and klogd (with a new busybox binary) and get /var/log/messages.

 

Feb 24 14:58:02 ipcam1 user.notice kernel: [    6.915789] UBI: image sequence number:  521241466
Feb 24 14:58:02 ipcam1 user.notice kernel: [    6.918819] UBI: background thread "ubi_bgt3d" started, PID 636
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.000659] UBIFS: recovery needed
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.045625] UBIFS: recovery completed
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.045673] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.045704] UBIFS: file system size:   2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.045732] UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.045755] UBIFS: media format:       w4/r0 (latest is w4/r0)
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.045773] UBIFS: default compressor: lzo
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.045790] UBIFS: reserved for root:  103599 bytes (101 KiB)
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.156860] UBI: attaching mtd16 to ubi4
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.156900] UBI: physical eraseblock size:   131072 bytes (128 KiB)
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.156923] UBI: logical eraseblock size:    129024 bytes
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.156941] UBI: smallest flash I/O unit:    2048
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.156958] UBI: sub-page size:              512
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.156976] UBI: VID header offset:          512 (aligned 512)
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.156996] UBI: data offset:                2048
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.166144] UBI: max. sequence number:       2165
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190498] UBI: attached mtd16 to ubi4
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190531] UBI: MTD device name:            "cfg_sec"
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190553] UBI: MTD device size:            4 MiB
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190570] UBI: number of good PEBs:        32
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190585] UBI: number of bad PEBs:         0
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190601] UBI: number of corrupted PEBs:   0
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190618] UBI: max. allowed volumes:       128
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190635] UBI: wear-leveling threshold:    4096
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190650] UBI: number of internal volumes: 1
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190666] UBI: number of user volumes:     1
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190681] UBI: available PEBs:             0
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190696] UBI: total number of reserved PEBs: 32
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190713] UBI: number of PEBs reserved for bad PEB handling: 2
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190733] UBI: max/mean erase counter: 83/70
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.190749] UBI: image sequence number:  110853645
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.198933] UBI: background thread "ubi_bgt4d" started, PID 646
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.275619] UBIFS: recovery needed
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.321399] UBIFS: recovery completed
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.321448] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.321477] UBIFS: file system size:   2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.321503] UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.321527] UBIFS: media format:       w4/r0 (latest is w4/r0)
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.321546] UBIFS: default compressor: lzo
Feb 24 14:58:02 ipcam1 user.notice kernel: [    7.321564] UBIFS: reserved for root:  103599 bytes (101 KiB)
Feb 24 14:58:02 ipcam1 user.notice kernel: [    8.528841] net eth0: Could not find default PHY in 9.
Feb 24 14:58:02 ipcam1 user.notice kernel: [    8.528883] net eth0: Try PHY[9] whose id is 0x00008201!
Feb 24 14:58:02 ipcam1 user.info kernel: [    8.530082] ADDRCONF(NETDEV_UP): eth0: link is not ready
Feb 24 14:58:02 ipcam1 user.info kernel: [   10.529082] PHY: 0:09 - Link is Up - 100/Full
Feb 24 14:58:02 ipcam1 user.info kernel: [   10.529295] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Feb 24 14:58:02 ipcam1 user.warn kernel: [   12.575205] ========== SD Driver Build Date: Nov 14 2013, Time: 11:59:44 ==========
Feb 24 14:58:02 ipcam1 user.info kernel: [   12.575391] SD card slot0, card detect mode:soft poll
Feb 24 14:58:02 ipcam1 user.notice kernel: [   12.575649] ambarella-sd ambarella-sd.0: Slot0 use bounce buffer[0xc2f80000<->0xc3180000]
Feb 24 14:58:02 ipcam1 user.notice kernel: [   12.575692] ambarella-sd ambarella-sd.0: Slot0 req_size=131072, segs=32, seg_size=131072
Feb 24 14:58:02 ipcam1 user.notice kernel: [   12.575863] ambarella-sd ambarella-sd.0: Slot1 use bounce buffer[0xc2fa0000<->0xc31a0000]
Feb 24 14:58:02 ipcam1 user.notice kernel: [   12.575901] ambarella-sd ambarella-sd.0: Slot1 req_size=131072, segs=32, seg_size=131072
Feb 24 14:58:02 ipcam1 user.notice kernel: [   12.658870] ambarella-sd ambarella-sd.0: Ambarella SD/MMC[0] probed 2 slots, 0x09e130b0!
Feb 24 14:58:02 ipcam1 user.info kernel: [   13.188946] mmc0: new high speed SDHC card at address aaaa
Feb 24 14:58:02 ipcam1 user.info kernel: [   13.200210] mmcblk0: mmc0:aaaa SU32G 29.7 GiB
Feb 24 14:58:02 ipcam1 user.info kernel: [   13.213705]  mmcblk0: p1 p2 p3
Feb 24 14:58:02 ipcam1 user.warn kernel: [   14.581040] EXT4-fs (mmcblk0p2): warning: mounting unchecked fs, running e2fsck is recommended
Feb 24 14:58:02 ipcam1 user.info kernel: [   14.589052] EXT4-fs (mmcblk0p2): mounted filesystem without journal. Opts: barrier=1,data=writeback
Feb 24 14:58:02 ipcam1 user.warn kernel: [   14.631995] EXT2-fs (mmcblk0p3): warning: mounting unchecked fs, running e2fsck is recommended
Feb 24 14:58:02 ipcam1 user.info kernel: [   15.068852] Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
Feb 24 14:58:02 ipcam1 user.warn kernel: [   15.610003] svc: failed to register lockdv1 RPC service (errno 97).
Feb 24 14:58:02 ipcam1 user.warn kernel: [   16.053357] dsp: module license 'Proprietary' taints kernel.
Feb 24 14:58:02 ipcam1 user.warn kernel: [   16.053396] Disabling lock debugging due to kernel taint
Feb 24 14:58:02 ipcam1 user.warn kernel: [   16.212546] img: aaa_fifo2_base malloc c2ac0000
Feb 24 14:58:02 ipcam1 user.warn kernel: [   17.014364] >>>>>> DSP LOG ADDR START PHY 0xc0080000
Feb 24 14:58:02 ipcam1 user.debug kernel: [   17.014399] Init software HR timer for DSP communication
Feb 24 14:58:02 ipcam1 user.info kernel: [   17.148211] amba_debug_init 248:248.
Feb 24 14:58:02 ipcam1 user.debug kernel: [   21.478744] eth0: no IPv6 routers present
Feb 24 14:58:12 ipcam1 user.warn kernel: [  105.488909] ak4954 i2c probe
Feb 24 14:58:12 ipcam1 user.warn kernel: [  105.489160] ak4954 mode init
Feb 24 14:58:12 ipcam1 user.info kernel: [  105.527832] ak4954-codec 0-0012: AK4954 Audio Codec 0.1AK4954 probe
Feb 24 14:58:12 ipcam1 user.warn kernel: [  105.528034] ambarella-i2c ambarella-i2c.0: ambarella_i2c_stop[2] from 1 to 9
Feb 24 14:58:12 ipcam1 user.err kernel: [  105.528199] ambarella-i2c ambarella-i2c.0: ambarella_i2c_irq in wrong state[0x9]
Feb 24 14:58:12 ipcam1 user.err kernel: [  105.528237] ambarella-i2c ambarella-i2c.0: status_reg[0x40]
Feb 24 14:58:12 ipcam1 user.err kernel: [  105.528261] ambarella-i2c ambarella-i2c.0: control_reg[0x3]
Feb 24 14:58:13 ipcam1 user.err kernel: [  106.518764] ambarella-i2c ambarella-i2c.0: No ACK from address 0x24, 0:0!
Feb 24 14:58:13 ipcam1 user.err kernel: [  106.518810] ambarella-i2c ambarella-i2c.0: I2C state 0x9, please check address 0x24!
Feb 24 14:58:13 ipcam1 user.notice kernel: [  106.626707] audio codec AK4954 initialized, 0!
Feb 24 14:58:13 ipcam1 user.info kernel: [  106.628264] asoc: ak4954-hifi <-> ambarella-i2s.0 mapping ok
Feb 24 14:58:13 ipcam1 user.warn kernel: [  106.899711] AK4954:set input volum 50
Feb 24 14:58:14 ipcam1 user.warn kernel: [  107.589069] MT9T002 sensor ID is 0x2604
Feb 24 14:58:14 ipcam1 user.info kernel: [  107.639019] CMEMK module: built on Aug 23 2012 at 17:05:43
Feb 24 14:58:14 ipcam1 user.info kernel: [  107.639065]         Reference Linux version 2.6.38
Feb 24 14:58:14 ipcam1 user.info kernel: [  107.639083]         File /mnt/data_bsp/data_yuhuanhuan/raptor/a5s_svn2/kernel/hik_drivers/cmem/src/module/cmemk.c
Feb 24 14:58:14 ipcam1 user.info kernel: [  107.646669] cmemk initialized
Feb 24 14:58:16 ipcam1 user.debug kernel: [  109.792261] set audio rates 8000Hz
Feb 24 14:58:16 ipcam1 user.debug kernel: [  109.866072] set audio rates 8000Hz
Feb 24 14:58:20 ipcam1 user.warn kernel: [  113.809752] EXT4-fs (mmcblk0p1): warning: mounting unchecked fs, running e2fsck is recommended
Feb 24 14:58:20 ipcam1 user.info kernel: [  113.843291] EXT4-fs (mmcblk0p1): mounted filesystem without journal. Opts: (null)
Feb 24 14:58:29 ipcam1 user.info kernel: [  121.633659] warning: process `ipc_sntptask' used the deprecated sysctl system call with 1.40.
Feb 24 14:58:32 ipcam1 user.warn kernel: [  125.354158] iav error: Failed to wait for completion!
Feb 24 14:58:32 ipcam1 user.warn kernel: [  125.424990] iav error: Failed to wait for completion!
Feb 24 15:00:12 ipcam1 user.err kernel: [  224.948902] ambarella-sd.0.0: ambarella_sd_send_cmd cmd18 timeout 2@1000, retries=0
Feb 24 15:00:12 ipcam1 user.warn kernel: [  224.988909] mmcblk0: retrying using single block read
Feb 24 15:03:05 ipcam1 auth.info login[1338]: root login on 'pts/1'
Feb 24 16:12:55 ipcam1 user.notice kernel: [ 4587.910103] rpc-srv/tcp: nfsd: got error -32 when sending 140 bytes - shutting down socket
Feb 24 17:47:33 ipcam1 auth.info login[1512]: root login on 'pts/1'
Feb 24 20:52:23 ipcam1 auth.info login[1761]: root login on 'pts/1'
Feb 24 23:17:45 ipcam1 daemon.notice rpc.mountd[754]: authenticated unmount request from 192.168.0.6:651 for /mnt/sd2 (/mnt/sd2)
Feb 24 23:17:46 ipcam1 daemon.notice rpc.mountd[754]: authenticated unmount request from 192.168.0.6:652 for /mnt/mmc01 (/mnt/mmc01)
Feb 25 09:37:46 ipcam1 daemon.notice rpc.mountd[754]: authenticated mount request from 192.168.0.6:956 for /mnt/mmc01 (/mnt/mmc01)
Feb 25 09:37:46 ipcam1 daemon.notice rpc.mountd[754]: authenticated mount request from 192.168.0.6:699 for /mnt/sd2 (/mnt/sd2)
Feb 25 10:35:10 ipcam1 auth.info login[2513]: root login on 'pts/1'
Feb 25 10:58:07 ipcam1 auth.info login[2544]: root login on 'pts/1'

Edited by Guest

Share this post


Link to post
Share on other sites

Video and picture extraction

 

You can parse the video and picture indexes on your NAS or SD card, and extract videos and pictures. Of course, you can do this manually on your camera via the web interface, but I prefer for this to happen automatically so I extract from my SD card to my primary server which has 5Tb+ rather than 32Gb

 

I then generate a playlist for xbmc with last nights motion detection recordings.

 

root@rl70:/# /usr/local/bin/extract_hik_picindex.php --indexfile=/mnt/sd2/datadir0/index00p.bin  --extract-pics=yes  --extract-dir=/mnt/hdd/sd2pic
Start Time: 24-02-14 19:17:55
End Time: 25-02-14 11:02:59
Number of extents: 1
Number of pics: 968
Total pic size: 135296848
Extracting to /mnt/hdd/sd2pic/25-02-14/11_00_58.jpg .... OK
Extracting to /mnt/hdd/sd2pic/25-02-14/11_01_58.jpg .... OK
Extracting to /mnt/hdd/sd2pic/25-02-14/11_02_58.jpg .... OK
3 pics extracted. 

 

Videos (the extracted filenames look user unfriendly but suit my needs!).

 

root@rl70:/# /usr/local/bin/extract_hik_vidindex.php  --indexfile=/mnt/sd2/datadir0/index00.bin --type=Motion --extract-videos=yes --extract-dir=/mnt/hdd/sd2
Number of videos: 5
Total video size: 10325437836
File /mnt/hdd/sd2/24-02-14/20_57___24-02-14_20_57_56_to_24-02-14_20_58_16.mp4 exists - skpping....
File /mnt/hdd/sd2/24-02-14/22_24___24-02-14_22_24_20_to_24-02-14_22_24_38.mp4 exists - skpping....
File /mnt/hdd/sd2/24-02-14/23_20___24-02-14_23_20_03_to_24-02-14_23_20_23.mp4 exists - skpping....
File /mnt/hdd/sd2/24-02-14/23_21___24-02-14_23_21_41_to_24-02-14_23_22_01.mp4 exists - skpping....
File /mnt/hdd/sd2/25-02-14/06_38___25-02-14_06_38_39_to_25-02-14_06_38_59.mp4 exists - skpping....
File /mnt/hdd/sd2/25-02-14/10_03___25-02-14_10_03_30_to_25-02-14_10_03_48.mp4 exists - skpping....
0 videos extracted.

 

Here's an example of a video extent and video object:

 

    [18] => HIK_EXTENT_INDEX Object
       (
           [index_num] => 18
           [video_count] => 2
           [time_start] => 1393067869
           [time_start_str] => 22-02-14 11:17:49
           [time_end] => 1393090333
           [time_end_str] => 22-02-14 17:32:13
           [duration] => 22464
           [data1] => 8308
           [data2] => 17927
       )

   [21-02-14_16_38_14_to_21-02-14_17_05_51] => HIK_VIDEO_INDEX Object
       (
           [video_id] => 21-02-14_16_38_14_to_21-02-14_17_05_51
           [video_extent_filename] => /mnt/sd2/datadir0/hiv00032.mp4
           [video_extract_filename] => /mnt/hdd/sd2/21-02-14/16_38___21-02-14
_16_38_14_to_21-02-14_17_05_51.mp4
           [video_extent_id] => 32
           [video_start_pos] => 00000000
           [video_end_pos] => 0f873828
           [video_start_pos_dec] => 0
           [video_end_pos_dec] => 260519976
           [video_size] => 260519976
           [video_type_int] => 00
           [video_type_str] => Continuous
           [video_time1] => 1393000694
           [video_time2] => 1393002351
           [video_time3] => 1393000694
           [video_time4] => 1393000694
           [video_time5] => 1393002351
           [video_start_str] => 21-02-14 16:38:14
           [video_end_str] => 21-02-14 17:05:51
           [video_duration] => 1657
           [video_data1] => 000c6f98
           [video_data2] => 000399e0
           [video_data3] => 000c6f98
           [video_data4] => 26a9b673
           [video_data5] => 2b1b1657
           [video_data6] => 0000
           [video_data7] => 4aa8
       )

 

I'm still working on some of the extra data which is to do with frames etc.

Share this post


Link to post
Share on other sites

ONVIF monitoring

 

I want to know when motion is detected, preferably via my TV and an audio alert from my server (which is in my front room).

 

I decided to do this via ONVIF with a script which runs on the server and subscribes to events on the camera, and then runs another script to take actions as apropriate (onscreen notice, pause video, audio alert from server etc).

 

root@rl70:~/cam51/home# ipcam_monitor --help

Usage: ipcam_monitor --user=<username> --pw=<password> --ip=<IP>  [OPTION]...

--help                         print this help

IPcam ONVIF monitor - CBX v0.0.1 21-01-14

 

Basically you need to initialize things with the camera (sync time, get media event and device info, and do a event_CreatePullPointSubscriptionRequest() and listen to what the camera says when motion is detected and renew the Subscription periodically.

 

i don't want alerts popping up all the time, so I use a different script to control the settings of what will happen when motion is detected.

 

I also optionally enable a separate motion detection window if I want to know when someone is coming up the drive.

screenshot030.jpg.bb4c6e8e1513b68f657143bc28dc524a.jpg

Share this post


Link to post
Share on other sites

Turn camera into NFS/NAS server, and share internal SD card with other cameras.

 

Complicated and low level as you would expect.

 

Cross compile kernel modules, user space programs.

Alter various system files on boot.

Cross compile ext4 for use on SD card instead of vfat. Tunefs.

Jiggery pokery with SD card partitioning, losetup etc.

Patch davinci.

Change NFS mount options for bigger write and read windows, and no sync.

 

/dav/opt/nfsd # cat ../nfsd.sh
cd /dav/opt/nfsd
insmod exportfs.ko
insmod nfsd.ko
mkdir -p /var/lib/nfs
#mount -n -t rpc_pipefs none /var/lib/nfs/rpc_pipefs
./portmap
cp exports /etc
cp services /etc
touch /var/lib/nfs/rmtab
exportfs -ra
statd --no-notify
mount -t nfsd nfsd /proc/fs/nfsd
rpc.mountd --nfs-version 3 --no-nfs-version 4.1 --no-nfs-version 4
rpc.nfsd --nfs-version 3 --no-nfs-version 4.1 --no-nfs-version 4

 

And on non SD card camera, add NFS share to SD camera.

 

Now no need to keep main server on for NAS functions yay, saving power and in the event of a break in in which the server might be stolen I'll at least have the recordings from both cameras on the SD card.

Share this post


Link to post
Share on other sites

CBX,

 

Is there a way to hack the nfs format to occupy a fixed amount of space instead of taking the entire space of the nfs share available?

 

I can't create partitions and nfs quotas on the synology NAS.

Share this post


Link to post
Share on other sites
CBX,

 

Is there a way to hack the nfs format to occupy a fixed amount of space instead of taking the entire space of the nfs share available?

 

I can't create partitions and nfs quotas on the synology NAS.

 

As things stand you need to only have one server share per server partition (which sucks). Don't know if that's possible with your product.

 

But yes - you could patch davinci - specifically the value returned by the server to something fixed. Then see how it responds to having a server reported free space > total space. If it doesn't like that you'll need to patch returned free space too. Or simply patch out the error checking.

 

I think there's already a patch going around (which is nothing to do with me and may work another way) - you might want to try that.

Share this post


Link to post
Share on other sites

I've been asked to post my custom busybox, which I'm happy to do.

 

Note that you use this at your own risk.

 

If you want to use syslogd/klogd you'll need to create /var/log before running them (unless you tell them to put logs somewhere else).

 

/mnt/server # md5sum busybox
c58ae7c6c47c969cb276a51d67879ca5  busybox

 

NOTE

 

The attachment is really busybox.7z but I had to rename it for the forum to accept it.

Share this post


Link to post
Share on other sites

CBX,

 

Your video and picture extraction scripts would be appreciated as well!

 

I'm also getting this error:

 

# cat busybox.sh
for FUNC in `/dav/opt/busybox --list-functions`; do
 ln -s /dav/opt/busybox /"$FUNC"
done
# bash busybox.sh
busybox.sh: line 1: syntax error: unexpected word (expecting "do")
#

 

Cheers!

Share this post


Link to post
Share on other sites

I don't know why that doesn't work for you to be honest - I've tried copy and pasting that and it runs fine on my camera.

 

You could try this instead?

 

for FUNC in `/dav/opt/busybox --list-functions`
do
 ln -s /dav/opt/busybox /"$FUNC"
done

 

Actually I wonder if you are saving the script in MSDOS/Windows format instead of one compatible with linux.

 

http://en.wikipedia.org/wiki/Newline#Common_problems

Share this post


Link to post
Share on other sites

Yeah, it was the unix vs windows line encoding. Everything seems to be working now.

 

Anyways, do you have time to investigate returning a fixed amount of space on NFS shares instead of the entire partition?

 

Also, how do you get two cameras to write to the same SD card? Does 1 not try to "format" the other?

 

Thanks, this has been very educational!

Share this post


Link to post
Share on other sites
Yeah, it was the unix vs windows line encoding. Everything seems to be working now.

 

Good

 

Anyways, do you have time to investigate returning a fixed amount of space on NFS shares instead of the entire partition?

 

As I say, I think there is a patch someone else did for that. I don't need it myself so won't be looking into it.

 

Also, how do you get two cameras to write to the same SD card? Does 1 not try to "format" the other?

 

No, the SD card is partitioned (like a hard disk) to give the cameras separate areas to write to.

 

Thanks, this has been very educational!

 

You're welcome.

Share this post


Link to post
Share on other sites

Bootloader

 

On my 2732, there is a 4 pin header named JP1 which gives rs-232 access to the UART - i.e. so you can access the bootloader and the console.

 

Taking where JP1 is printed as pin 4, pin out is:

 

1 - GND

2 - RX

3 - TX

4 - VCC 3.3V

 

Some of the below formatting isn't quite right.

 


U-Boot 1.3.4-57424 (Nov 14 2013 - 11:56:46)

ARM Clock: 480MHz
DDR Clock: 336MHz

Hit Ctrl+u to stop autoboot: 2

HKVS # help

The following commands are supported:


boot
help
bios
diag
mtest
dump
erase
go
exec
ping
r8
r16
r32
reset
saveenv
printenv
setenv
show
usbdl
w8
w16
w32
tftpboot
boot
mreadoob
killb
crc
nandread
nandwrite
ups
upm
format
update
upf
upa
upr
upk
updateb
ubi
bapi

Use 'help' to get help on a specific command

HKVS # show logo
                ___  ___  _________                _    
               / _ \ |  \/  || ___ \              | |   
              / /_\ \| .  . || |_/ /  ___    ___  | |_  
              |  _  || |\/| || ___ \ / _ \  / _ \ | __| 
              | | | || |  | || |_/ /| (_) || (_) || |_  
              \_| |_/\_|  |_/\____/  \___/  \___/ \__|
----------------------------------------------------------
Amboot(R) Ambarella(R) Copyright (C) 2004-2007


HKVS # help upk
Help for 'upk':
Usage: update kernel to nand flash

HKVS # help tftpboot

Help for 'tftpboot':Usage: tftpboot [address] [filename]
Load images from TFTP server to memory
Boot image via network using TFTP protocol

HKVS # print
ipaddr=192.0.0.64
serverip=192.0.0.128
gatewayip=0.0.0.0
netmask=255.255.255.0
ethaddr=<removed>
loadaddr=0xc2000000
bootfile=digicap.dav
bootcmd=nullbootargs=console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0bootdelay=2

HKVS # show flash
RCT configured to NAND mode
main size: 2048
pages per block: 64
bst partition blocks: 0 - 1
ptb partition blocks: 1 - 9
bld partition blocks: 9 - 17
hal partition blocks: 17 - 25
ano_ptb partition blocks: 25 - 33
env partition blocks: 33 - 37
param partition blocks: 37 - 41
dpt partition blocks: 41 - 49
rcvy partition blocks: 49 - 129
krn_pri partition blocks: 129 - 193
krn_sec partition blocks: 193 - 257
rmd_pri partition blocks: 257 - 289
rmd_sec partition blocks: 289 - 321
app_pri partition blocks: 321 - 513
app_sec partition blocks: 513 - 705
cfg_pri partition blocks: 705 - 737
cfg_sec partition blocks: 737 - 769
dbg partition blocks: 769 - 897

HKVS # show ptb
bst: 0xc8577d60 1.3 (2013/8/27)0x00000000 0x00000001 (2048)
bld: 0xcdd6116b 1.3 (2013/11/14)0xc0000000 0x00000000 (235748)
hal: 0x3407bf3c 5.1 (2013/11/14)0xc00a0000 0x00000000 (59144)
S/N: usbdl_mode: 0
auto_boot: 1
cmdline: "console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0"

HKVS # show bb 
No bad blocks 
HKVS # show bbt
HKVS # show meta
bst sblk: 0 nblk: 1 on: NAND
ptb sblk: 1 nblk: 8 on: NAND
bld sblk: 9 nblk: 8 on: NAND
hal sblk: 17 nblk: 8 on: NAND
ano_ptb sblk: 25 nblk: 8 on: NAND
env sblk: 33 nblk: 4 on: NAND
param sblk: 37 nblk: 4 on: NANDd
pt sblk: 41 nblk: 8 on: NAND
rcvy sblk: 49 nblk: 80 on: NAND
krn_pri sblk: 129 nblk: 64 on: NAND
krn_sec sblk: 193 nblk: 64 on: NAND
rmd_pri sblk: 257 nblk: 32 on: NAND
rmd_sec sblk: 289 nblk: 32 on: NAND
app_pri sblk: 321 nblk: 192 on: NAND
app_sec sblk: 513 nblk: 192 on: NAND
cfg_pri sblk: 705 nblk: 32 on: NAND
cfg_sec sblk: 737 nblk: 32 on: NAND
dbg sblk: 769 nblk: 128 on: NAND 
sblk: 0 nblk: 0 on: DEFAULT 
sblk: 0 nblk: 0 on: DEFAULT
sm_stg[0] sblk: 0 nblk: 0
sm_stg[1] sblk: 0 nblk: 0
model name:
crc32:0x9d57e812

 

 

Booting:

U-Boot 1.3.4-57424 (Nov 14 2013 - 11:56:46)ARM Clock: 480MHzDDR Clock: 336MHzHit Ctrl+u to stop autoboot: 2
Hit Ctrl+u to stop autoboot: 1
Hit Ctrl+u to stop autoboot: 0|BIND err|Unknown command:null nand booting ...load kernel...load ramdisk...
init started: BusyBox v1.19.3 (2013-11-01 10:10:26 CST)

starting pid 377, tty '': '/etc/init.d/rcS'
Starting udev:      [ OK ]

starting pid 608, tty '': '/sbin/iptables -A INPUT -p tcp --dport 23 -j DROP'

starting pid 609, tty '': '/sbin/iptables -A INPUT -p tcp --dport 21 -j DROP'

starting pid 610, tty '': '/sbin/inetd -f -e /etc/inetd.conf'

starting pid 611, tty '': '-/bin/sh'


BusyBox v1.19.3 (2013-11-01 10:10:26 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

UBI device number 1, total 192 LEBs (24772608 bytes, 23.6 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi1_0.
Check dir /dav ok! (0)
UBI device number 3, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi3_0.
Check dir /davinci ok! (0)
UBI device number 4, total 32 LEBs (4128768 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
waiting for /dev/ubi4_0.
Check dir /config ok! (0)
Hit Ctrl+c to stop and exec /home/initrun.sh to continue
route: ioctl 0x890c failed: No such process
map_size = 0x300000
nr_item = 3
addr_offset = 0x0 filename = orccode.bin
addr_offset = 0x200000 filename = orcme.bin
addr_offset = 0x2a0000 filename = default_binary.bin
mmap returns 0x40281000
loading ./orccode.bin...addr = 0x40281000, size = 0x19f02d
loading ./orcme.bin...addr = 0x40481000, size = 0x36374
loading ./default_binary.bin...addr = 0x40521000, size = 0x40000
===============================
u_code version = 2013/10/24 3.0
===============================

Share this post


Link to post
Share on other sites

Yes you could write to the relevant areas of the flash from u-boot. You might need to recaculate the CRC though or it may fail to boot (depending on whether the CRC covers those areas of flash or not). And as I've said there may be other ramifications which anyone who attempts this should think about.

 

You could probably also do this from within booted linux on the camera, but probably safer from the bootloader.

Share this post


Link to post
Share on other sites

Hikvision kernel source

 

I made a GPL request for the kernel sources used on the camera in early January. After some initial confusion (they didn't seem to know what GPL was) I've now been provided with them, and I've now compiled my own kernel.

 

Well done to Hikvision for working with me on this. I hope that in the future you will also include the GPL license text with your product (in the manual, on the web interface etc) which you are required to by the licensing conditions.

 

To anyone who wishes to make a similar request, I would advise being patient, explaining what GPL is if asked, making it clear you are not asking for Hikvision owned code and not mentioning legal issues Please tread gently in order to encourage Hikvision to keep a positive attitude towards GPL requests and open source in general.

 

They also asked me who I was, my company details, what I needed it for. Under GPL I wasn't obligated to answer but I did in order the grease the wheels.

 

Maybe one day they'll even just put GPL sources on their website so you don't have to ask.

 

I did have to comment out the below in arch/arm/mach-ambarella/init-coconut.c to get the kernel to compile. Seems silly it was even needed as "CONFIG_TOUCH_AMBARELLA_CHACHA_MT4D is not set" in the .config anyway.

 

/*      ambarella_chacha_mt4d_board_info.irq =
               ambarella_board_generic.touch_panel_irq.irq_line;
       ambarella_chacha_mt4d_board_info.flags = 0;
       i2c_register_board_info(0, &ambarella_chacha_mt4d_board_info, 1);*/

Share this post


Link to post
Share on other sites

Congratulations. Does this help with your ability to make these sort of fixes? Maybe there's a way to get the fixes back to Hikvision so they put it in their latest firmware, like the fixes to the NAS stuff, especially if there's a way to use a single NAS partition to handle multiple cameras.

Share this post


Link to post
Share on other sites

It certainly helps with my goal to modify my cameras to suit my network and requirements. I've noticed that there's lots of free space in the 2 kernel partitions in the flash, so compiling a kernel with more functionality is appealing.

 

The 1 server partition per share issue is annoying (and poorly implemented by Hikvision). It's not something I'm looking into though as I use the camera's SD card as the NAS for the other camera. I was also under the impression that there was a 5.1 patch by someone else for this?

Share this post


Link to post
Share on other sites

Fantastic thread.

 

Where do you get the php script to extract the pictures and videos?

 

extract_hik_picindex.php

 

Did you write it? If so, are you willing to share?

Share this post


Link to post
Share on other sites
Fantastic thread.

 

Thanks I need to up date it with some more logging info, and putting ssh on it some time.

 

Where do you get the php script to extract the pictures and videos?

 

extract_hik_picindex.php

 

Did you write it? If so, are you willing to share?

 

Yes - I wrote that and the video extract scripts. I'm still doing some dev on them (adding the picture event types for example). When they are complete I'll think about it

Share this post


Link to post
Share on other sites

ssh (dropbear)

 

download zlib-1.2.8.tar.gz, cross compile

dropload dropbear-2014.63.tar.bz2, cross compile using zlib

tar up, and copy to camera.

 

Create /dav/opt/dropbear/authorized_keys if you are using keys to authenticate for passwordless access.

 

# cat /dav/opt/dropbear.sh

mkdir /home/dropbear
/dav/opt/busybox tar vxfj /dav/opt/dropbear/dropbear.tar.bz2 -C /home
ln -s /home/dropbear/dropbearkey /usr/bin
ln -s /home/dropbear/dbclient /usr/bin/ssh
ln -s /home/dropbear/dropbear /usr/sbin
ln -s /home/dropbear/dropbearconvert /usr/bin
ln -s /dav/opt/dropbear /etc
ln -s /home/dropbear/libz.so.1.2.8 /lib/libz.so.1
ln -s /home/dropbear/scp /usr/bin
ln -s /home/dropbear/dbclient /usr/bin

chmod 700 /root
mkdir /root/.ssh
ln -s /dav/opt/dropbear/authorized_keys /root/.ssh
/usr/sbin/dropbear -R -P

 

Test passwordless scp and login:

 

root@rl70:/tmp# echo test > testfile
root@rl70:/tmp# scp testfile ipcam1:/tmp
testfile                               100%    5     0.0KB/s   00:00

root@rl70:~# ssh ipcam1


BusyBox v1.19.3 (2013-11-01 10:10:26 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# uname -a
Linux Hikvision 2.6.38.8 #12 PREEMPT Thu Nov 14 12:04:07 CST 2013 armv6l GNU/Linux

# cat /tmp/testfile
test

# scp /dav/davinci.tar.gz 192.168.0.6:/tmp
root@192.168.0.6's password:

 

Logging

 

mkdir /var/log
touch /var/log/lastlog
touch /var/log/wtmp
/dav/opt/busybox hostname ipcam1
/dav/opt/busybox syslogd
/dav/opt/busybox klogd

# last
root     pts/0        192.168.0.6      Wed Mar 12 12:07   still logged in
root     pts/0        192.168.0.6      Wed Mar 12 12:04 - 12:07 (0+00:02)

wtmp begins Wed Mar 12 12:04:58 2014

# tail /var/log/messages -n 2
Mar 12 12:07:10 ipcam1 authpriv.info dropbear[3395]: Child connection from 192.168.0.6:34655
Mar 12 12:07:12 ipcam1 authpriv.notice dropbear[3395]: Pubkey auth succeeded for 'root' with key md5 5e:c8:dd:5e:26:0b:28:f<removed> from 192.168.0.6:34655

 

Disable telnet once tested.

Share this post


Link to post
Share on other sites

I've not tested this, but based on the windows writeup beullwinkle has posted, the linux patch in memory solution would be:

 

# 5.1.2 language fix
for HEX in 01 a0 a0 e3; do
 echo -n -e \\x$HEX
done | dd of=/home/davinci seek=1536408 bs=1 conv=notrunc

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×