Sannce I41HD - Help getting root access

[erew123]

I have a Sannce I41HD, which Ive managed to get Serial access. It appears to have 256MB of memory and Im trying to figure how to get route access, EDIT - Managed to get to root access, backups of the firmware etc link I just need help deciding which firmware to try.

This is also the same as the Wetrans wifi camera 1080P

U-Boot 2013.07-svn3437 (Oct 27 2018 - 14:21:02)

Board: ISVP (Ingenic XBurst T20 SoC)
DRAM:  256 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 457k for U-Boot at: 83f8c000
Reserving 32800k for malloc() at: 81f84000
Reserving 32 Bytes for Board Info at: 81f83fe0
Reserving 124 Bytes for Global Data at: 81f83f64
Reserving 128k for boot params() at: 81f63f64
Stack Pointer at: 81f63f48
Now running in RAM - U-Boot at: 83f8c000
MMC:   msc: 0
idcode:684017
the manufacturer 68

idcode:684017
the manufacturer 68

In:    serial
Out:   serial
Err:   serial
Net:   Jz4775-9161
idcode:684017
the manufacturer 68

  IRCUT Init
  Sensor is [JXF22]
  Bootargs Sensor is JXF22
Interface:  MMC
  Device 0: Vendor: Man 000003 Snr 064aae01 Rev: 8.5 Prod: SC32G▒
            Type: Removable Hard Disk
            Capacity: 30436.5 MB = 29.7 GB (62333952 x 512)
Filesystem: FAT16 "NO NAME    "
Hit any key to stop autoboot:  0
idcode:684017
the manufacturer 68

SF: 2621440 bytes @ 0x48000 Read: OK
## Booting kernel from Legacy Image at 80600000 ...
   Image Name:   Linux-3.10.14
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1420490 Bytes = 1.4 MiB
   Load Address: 80010000
   Entry Point:  8036e250
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Initializing cgroup subsys cpu
Initializing cgroup subsys cpuacct
Linux version 3.10.14 (root@ubuntu-64) (gcc version 4.7.2 (Ingenic r2.3.3 2016.12) ) #1 PREEMPT Wed Jul 18 09:54:48 CST 2018
bootconsole [early0] enabled
CPU0 RESET ERROR PC:83F8C3FC
CPU0 revision is: 00d00101 (Ingenic Xburst)
FPU revision is: 00b70000
CCLK:835MHz L2CLK:417Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
Determined physical RAM map:
 memory: 00403000 @ 00010000 (usable)
 memory: 0002d000 @ 00413000 (usable after init)
User-defined physical RAM map:
 memory: 024d4000 @ 00000000 (usable)
Zone ranges:
  Normal   [mem 0x00000000-0x024d3fff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x024d3fff]
Primary instruction cache 32kB, 8-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 8-way, VIPT, no aliases, linesize 32 bytes
pls check processor_id[0x00d00101],sc_jz not support!
MIPS secondary cache 128kB, 8-way, linesize 32 bytes.
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 9354
Kernel command line: console=ttyS1,115200n8 mem=37712K@0x0 ispmem=8100K@0x24D4000 rmem=19724K@0x2CBD000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock3 flash=SF sensor=JXF22 maxheight=1080 eeprom=NONE device_id=3040006 ethaddr=00:11:22:33:44:72 devinfo=jcoxa20181001o217701b85d351d8ff206292d283c261f64 cpu=T20 ddr=64M mtdparts=jz_sfc:256K@0K(sf-bootloader),32K@256K(sf-bootenv),1472K@288K(sf-kernel),1152K@1760K(sf-rootfs),4576K@2912K(sf-ipcfs),704K@7488K(sf-miscfs) feature=4 lang=2
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 32368k/37712k available (3483k kernel code, 5344k reserved, 623k data, 180k init, 0k highmem)
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Preemptible hierarchical RCU implementation.
NR_IRQS:418
clockevents_config_and_register success.
Calibrating delay loop... 829.84 BogoMIPS (lpj=4149248)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Initializing cgroup subsys debug
Initializing cgroup subsys freezer
regulator-dummy: no parameters
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
jz-dma jz-dma: JZ SoC DMA initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
i2c-gpio i2c-gpio.1: using pins 57 (SDA) and 58 (SCL)
 (null): set:249  hold:250 dev=100000000 h=500 l=500
media: Linux media interface: v0.10
Linux video capture interface: v2.00
Switching to clocksource jz_clocksource
cfg80211: Calling CRDA to update world regulatory domain
jz-dwc2 jz-dwc2: cgu clk gate get error
jz-dwc2 jz-dwc2: regulator vbus get error
DWC IN OTG MODE
sft id =========================off
dwc2 dwc2: Keep PHY ON
dwc2 dwc2: Using Buffer DMA mode
dwc2 dwc2: Core Release: 3.00a
dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
dwc2 dwc2: new USB bus registered, assigned bus number 1
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: DesignWare USB2.0 High-Speed Host Controller
usb usb1: Manufacturer: Linux 3.10.14 dwc2-hcd
usb usb1: SerialNumber: dwc2
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
dwc2 dwc2: DWC2 Host Initialized
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
freq_udelay_jiffys[0].max_num = 10
cpufreq         udelay  loops_per_jiffy
12000    59588   59588
24000    119176  119176
60000    297941  297941
120000   595882  595882
200000   993137  993137
300000   1489705         1489705
600000   2979411         2979411
dwc2 dwc2: ID PIN CHANGED!
init DWC as A_HOST
792000   3932823         3932823
1008000  5005411         5005411
1200000  5958823         5958823
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
msgmni has been set to 63
io scheduler noop registered
io scheduler cfq registered (default)
jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
console [ttyS1] enabled, bootconsole disabled
console [ttyS1] enabled, bootconsole disabled
loop: module loaded
logger: created 256K log 'log_main'
jz SADC driver registeres over!
jz TCU driver register completed
the id code = 684017, the flash name is BH25Q64BS
JZ SFC Controller for SFC channel 0 driver register
6 cmdlinepart partitions found on MTD device jz_sfc
Creating 6 MTD partitions on "jz_sfc":
0x000000000000-0x000000040000 : "sf-bootloader"
0x000000040000-0x000000048000 : "sf-bootenv"
0x000000048000-0x0000001b8000 : "sf-kernel"
0x0000001b8000-0x0000002d8000 : "sf-rootfs"
0x0000002d8000-0x000000750000 : "sf-ipcfs"
0x000000750000-0x000000800000 : "sf-miscfs"
SPI NOR MTD LOAD OK
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
usbcore: registered new interface driver cdc_wdm
jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
jzmmc_v1.2 jzmmc_v1.2.0: card inserted, state=0
jzmmc_v1.2 jzmmc_v1.2.0: register success!
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
TCP: cubic registered
NET: Registered protocol family 17
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
Freeing unused kernel memory: 180K (80413000 - 80440000)
usb 1-1: new high-speed USB device number 2 using dwc2
usb 1-1: New USB device found, idVendor=0bda, idProduct=0179
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: 802.11n NIC
usb 1-1: Manufacturer: Realtek
mmc0: new high speed SDHC card at address aaaa
mmcblk0: mmc0:aaaa SC32G 29.7 GiB
 mmcblk0: p1

       _                          _____          _
      (_)   ___    ___           |_   _|   ___  | | __
      | |  / __|  / _ \   _____    | |    / _ \ | |/ /
      | | | (__  | (_) | |_____|   | |   |  __/ |   <   hello to jco&jz world
     _/ |  \___|  \___/            |_|    \___| |_|\_\
    |__/


mdev is ok......
--- mount squashfs succ! ---
--- mount jfss2 succ! ---
Auto login as root ...
jabsco login: Mon Oct  1 00:00:10 UTC 2018
PATH: /ipc/bin:/bin:/sbin:/usr/bin:/usr/sbin
LD_LIBRARY_PATH: /ipc/lib:/lib
register all isp device successfully!
@@@@ tx-isp-probe ok @@@@@
EGISTER Device Driver $Version: 1.0.0.0  (REGISTER DRIVER) $ OK
i2c Driver OK
UNIQUE:[00-03] [00][00][00][00]
UNIQUE:[04-07] [50][14][e9][17]
UNIQUE:[08-11] [30][72][97][1c]
UNIQUE:[12-15] [50][14][e9][17]
UNIQUE:[16-19] [30][72][97][1c]
UNIQUE:[20-23] [50][14][e9][17]
gd25q Device Driver OK
jz_codec_register: probe() successful!
dma dma0chan24: Channel 24 have been requested.(phy id 7,type 0x06 desc a087c000)
dma dma0chan25: Channel 25 have been requested.(phy id 6,type 0x06 desc a087d000)
FAT-fs (mmcblk0p1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
nc: can't connect to remote host (127.0.0.1): Connection refused
___________ sd card probe ______________
________ scan after sd card mount ________
usb 1-1: USB disconnect, device number 2
usb 1-1: new high-speed USB device number 3 using dwc2
usb 1-1: New USB device found, idVendor=0bda, idProduct=0179
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: 802.11n NIC
usb 1-1: Manufacturer: Realtek
USB DEV - idVendor:0bda idProduct:0179
RTL871X: module init start
RTL871X: rtl8188eu rtl8188EUS_linux_v4.3.0.9_15178.20150907_modify_by_Di3_for_airlink_2JieGao
RTL871X: build time: Jul 10 2017 10:32:13
bFWReady == _FALSE call reset 8051...
RTL871X: rtw_ndev_init(wlan0)
RTL871X: rtw_ndev_init(wlan1)
usbcore: registered new interface driver rtl8188eu
RTL871X: module init ret=0

        +------------------------------------------------+
             Hello Server World @2018-10-01.00:00:14!!
        +------------------------------------------------+

[-DBG-] [ctrl/wifi_factory_config.c:  228] soft limit -1, hard limit:-1
[-DBG-] [ctrl/wifi_factory_config.c:  233] soft limit 6291456, hard limit:6291456
[-DBG-] [ctrl/wifi_factory_config.c:  109] szDevID: 30400065083
[-DBG-] [ctrl/wifi_factory_config.c:  116] danale.conf is exist,id:9895c41e7d7e87bfd8d4f54abcffd253
[-DBG-] [ctrl/wifi_factory_config.c:  385] device id is ok, danale conf is ok
<log_0> [j_schedule.c:82]:create_BGread_schedule init sche_thread:0x97d640
[j_schedule.c:   69] create_BGread_schedule start sche_thread:0x97d640 pid:214 ppid:71
<log_0> [j_event.c:437]:new event loop:0x97d760
<log_0> [j_schedule.c:199]:new sched:0x97d5f0
[ctrl/system_main.cpp:  121] init support str_dev_type:enhanced str_platfUNIQUE:[00-03] [00][00][00][00]
orm:danale ...
UNIQUE:[04-07] [50][14][e9][17]
UNIQUE:[08-11] [30][72][97][1c]
UNIQUE:[12-15] [50][14][e9][17]
UNIQUE:[16-19] [30][72][97][1c]
UNIQUE:[20-23] [50][14][e9][17]
[-DBG-] [ctrl/system_ctrl.c:  792] systemType:secure=1 sectype=2 devid=30400065083 cpu=3 sensor=25 cpufreq=829
[-DBG-] [conf/jconfig.cpp: 4267] config init
[ctrl/system_main.cpp:  131] init JCPCMD...
[jcp/jcpService.cpp:   65] success create socket (socket:8)
[ctrl/system_main.cpp:  134] init timezone...
[ctrl/system_main.cpp:  140] init Encode ___1___
[-ENC-] [encode/system/encode_system.c:  103] --- gstVencSystem:[13]
set sensor gpio as PA-low-10bit
jxf22 0-0040: jxf22 chip found @ 0x40 (i2c0)
tx_isp: Registered sensor subdevice jxf22 0-0040
Sensor ISP File :/ipc/sensor/jxf22.bin
###### image_tuning_v4l2_open 4329 #######
[-ENC-] [encode/sdk/encode_sdk.c:  195] --- IMP Version:IMP-3.11.1 CPU Info:T20-Lite
[conf/conf_nand.c:  892] read sensor[JXF22] and maxheight[1080]
[-DBG-] [src/pthread_manage.cpp:   92] Init pthreadManage...
[-ENC-] [encode/message/encode_message.c:  541] --- Audio [1][0][80][84][1][2]
[ctrl/system_main.cpp:  142] init Encode ___2___
[-ENC-] [encode/common/encode_common.c:  615] --- priority_min=1,priority_max=99
[src/pthread_manage.cpp:   73] pthread_info [capture_audio_thread] tid:230 ptid:212 pid:212
[-DBG-] [src/pthread_manage.cpp:   74] thread begin = capture_audio_thread, pid = 230
[-ENC-] [encode/audio/encode_captureaudio.c:  374] --- Audio In GetPubAttr samplerate : 8000
[-ENC-] [encode/audio/encode_captureaudio.c:  375] --- Audio In GetPubAttr   bitwidth : 16
[-ENC-] [encode/audio/encode_captureaudio.c:  376] --- Audio In GetPubAttr  soundmode : 1
[-ENC-] [encode/audio/encode_captureaudio.c:  377] --- Audio In GetPubAttr     frmNum : 20
[-ENC-] [encode/audio/encode_captureaudio.c:  378] --- Audio In GetPubAttr  numPerFrm : 640
[-ENC-] [encode/audio/encode_captureaudio.c:  379] --- Audio In GetPubAttr     chnCnt : 1
[src/pthread_manage.cpp:   73] pthread_info [play_audio_process] tid:229 ptid:212 pid:212
[-DBG-] [src/pthread_manage.cpp:   74] thread begin = play_audio_process, pid = 229
[-ENC-] [encode/audio/encode_playaudio.c:  766] --- Audio Out GetPubAttr samplerate : 8000
[-ENC-] [encode/audio/encode_playaudio.c:  767] --- Audio Out GetPubAttr   bitwidth : 16
[-ENC-] [encode/audio/encode_playaudio.c:  768] --- Audio Out GetPubAttr  soundmode : 1
[-ENC-] [encode/audio/encode_playaudio.c:  769] --- Audio Out GetPubAttr     frmNum : 20
[-ENC-] [encode/audio/encode_playaudio.c:  770] --- Audio Out GetPubAttr  numPerFrm : 640
[-ENC-] [encode/audio/encode_playaudio.c:  771] --- Audio Out GetPubAttr     chnCnt : 1
[-ENC-] [encode/infrared/encode_infrared.c:  110] --- SU_ADC_Init is Finish
[-ENC-] [encode/infrared/encode_infrared.c:  113] --- SU_ADC_EnableChn is Finish
[-ENC-] [encode/infrared/encode_infrared.c:   56] --- eIRCUTMode:NORMAL
[-ENC-] [encode/stream/encode_stream.c:   58] --- encode_stream_init is OK
[-ENC-] [encode/osd/encode_osd.c:  398] --- encode_osd_init is OK
[-ENC-] [encode/encode/encode_encode.c: 2221] --- encode_encode_init is OK!
[-ENC-] [encode/message/encode_message.c: 1022] --- Enter message Init...
This event manager doesn't know about '64' events!
This event manager doesn't know about '103' events!
This event manager doesn't know about '105' events!
This eventcodec_set_device: set device: speaker...
 manager doesn't know about '1012' events!
[-ENC-] [encode/message/encode_message.c:   75] --- cb video chage of profile
[-ENC-] [encode/message/encode_message.c:  186] --- gnum:2
[-ENC-] [encode/message/encode_message.c:  190] --- ------------------------------------------
[-ENC-] [encode/message/encode_message.c:  191] --- id:0
[-ENC-] [encode/message/encode_message.c:  192] --- enable:1
[-ENC-] [encode/message/encode_message.c:  193] --- codec:2
[-ENC-] [encode/message/encode_message.c:  194] --- vencsize:5
[-ENC-] [encode/message/encode_message.c:  195] --- standard:0
[-ENC-] [encode/message/encode_message.c:  196] --- fps:12
[-ENC-] [encode/message/encode_message.c:  197] --- bps:1024
[-ENC-] [encode/message/encode_message.c:  198] --- gop:16
[-ENC-] [encode/message/encode_message.c:  199] --- fixfps:1
[-ENC-] [encode/message/encode_message.c:  200] --- fixbps:2
[-ENC-] [encode/message/encode_message.c:   54] --- vencsize:[5] profile:[0]
[-ENC-] [encode/message/encode_message.c:  190] --- ------------------------------------------
[-ENC-] [encode/message/encode_message.c:  191] --- id:1
[-ENC-] [encode/message/encode_message.c:  192] --- enable:1
[-ENC-] [encode/message/encode_message.c:  193] --- codec:2
[-ENC-] [encode/message/encode_message.c:  194] --- vencsize:7
[-ENC-] [encode/message/encode_message.c:  195] --- standard:0
[-ENC-] [encode/message/encode_message.c:  196] --- fps:12
[-ENC-] [encode/message/encode_message.c:  197] --- bps:200
[-ENC-] [encode/message/encode_message.c:  198] --- gop:24
[-ENC-] [encode/message/encode_message.c:  199] --- fixfps:1
[-ENC-] [encode/message/encode_message.c:  200] --- fixbps:1
[-ENC-] [ecodec_set_device: set device: MIC...
ncode/message/encode_message.c:   54] --- vencsize:[7] profile:[0]

Thanks

[erew123]

For reference, heres the board connection settings

[erew123]

This gets me to a prompt I can type things at...

setenv bootargs console=ttyS1,115200n8 mem=37712K@0x0 ispmem=8100K@0x24D4000 rmem=19724K@0x2CBD000 init=/bin/sh rootfstype=squashfs root=/dev/mtdblock3 rw flash=SF sensor=JXF22 maxheight=1080 eeprom=NONE device_id=3040006 ethaddr=00:11:22:33:44:72 devinfo=jcoxa20181001o217701b85d351d8ff206292d283c261f64 cpu=T20 ddr=64M mtdparts=jz_sfc:256K@0K(sf-bootloader),32K@256K(sf-bootenv),1472K@288K(sf-kernel),1152K@1760K(sf-rootfs),4576K@2912K(sf-ipcfs),704K@7488K(sf-miscfs) feature=4 lang=2,-(flag)

However, it looks like there is a watchdog timer as the system reboots to Uboot after maybe 60 seconds. The only folder in the file structure I can find anything in, is the bin folder, which has all the standard unix utilities.

cat /proc/mtd fails

The file system I can see, remains read only, because Ive tried to use passwd to and Im told that it cant change the password, because the file system is read only.

One other thing, the device has ports 8004, 8006, 9527 and 9999 open. A port scanner shows nothing, however, if you hit it on port 8006, the inbuilt speaker says its upgrading.

[erew123]

Some success.

1. Let the device boot normally.
2. Press enter until you get a jabsco login: prompt
3. Log in as root with the password jco66688
4. If you havnt already, insert your SD card that you have formatted as FAT32 with a 512MB partition on it.
5. Type cd /opt/media/mmcblk0p1 to move your location to the SD card's 512MB partition.
6. Run the following commands, one line at a time, to make a backup of the running system:

dd if=/dev/mtdblock0 of=sf-bootloader
dd if=/dev/mtdblock1 of=sf-bootenv
dd if=/dev/mtdblock2 of=sf-kernel
dd if=/dev/mtdblock3 of=sf-rootfs
dd if=/dev/mtdblock4 of=sf-ipcfs
dd if=/dev/mtdblock5 of=sf-miscfs

(I will include a zipped dump, when I have reset my device and removed my personal info out of the files)

[erew123]

@EliasKotlyar Hi Elias, hope you are keeping well. Im sorry to @ you on this, but hoped if you have time you may have a spare moment to take a look and help me? If so, thanks. Also, if you can help me, I will write a full guide for anyone else who attempts this.

• My boot log is at the top of this post.
• I have root access to the device (see above post) and have backed up the OS, though, I cannot use init=/bin/sh to get to a prompt as the device, does go to a prompt, but reboots after 60 seconds of being there.
• There is no auto upgrade option I can see/use on the device, so I believe I am left with the option to flash a bootloader. I have tried dafang_128mb_v2.bin on one of these cameras, but that hasnt worked (it only part completes the UBoot process). I have other ones of these cameras though and also have a CH341A soon.

What should I try from here on these other cameras? or do you not think this will work?

Many thanks

[EliasKotlyar]

Hello @erew123,

many thanks for reaching out, unfortunately i havent been working on this project since some time due to other projects. Regarding your questions:

1. Thanks for the bootlog, it seems to be a newer variant of the sannce.
2. This behaviour is normal. Sannce has a watchdog integrated in their uboot, which reboots after 60 sec. Unfortunately i do not know how to disable it
3. Regarding u-boot. I suppose you will have to compile your own version of it, if no u-boot binary is found which fits your hardware.

Try flashing the ones listed here:
https://github.com/Dafang-Hacks/uboot/tree/master/compiled_bootloader
Especially the sannce ones are different. You will see if the changes when you analyse the changes which were made in the code. Search for SANNCE Constants.

4. Regarding future steps:
   Sannce Support is highly experemential. Altough we managed to make the main binary work with almost every ingenic device for delivering a RTSP, this is not true for other features like LEDs, Rotating etc due to the hardware implementation of the particular device device.

5. I do not know which kind of goals you are setting - if you want to have the device supporting every feature of this hack, it will not work on SANNCE without investing huge efforts. If you are just trying to make a RTSP work, it should work because the sensor seems to be supported

[erew123]

Hi @EliasKotlyar

Thanks so much for taking the time to reply, I really appreciate it.

Ill give that a go over the next few days when I have a spare moment and see where I get to (will feed back on here for others, if I can get it working).

Again, thanks!!

[anonjokerps15]

hello guys >
I cant access to root user ! i has been try
sudo passwd root
ichanged the passwd many times !
who can help

[erew123]

I only know the inbuilt Sannce 141HD password.... I dont know any other passwords

Log in as root with the password jco66688

Hope that helps

[cristian-ene]

I'm not really a fan of bringing dead to life... but here goes nothing.
Has anyone managed to get this camera RTSP/ONVIF? It's sitting in my drawer for ages now... and I would rather have it at my parents house.