Trying to hack Lenovo C2E camera using Ingenic T21, can't boot into uboot.

[afirmware]

I get an Lenovo C2E camera which is using Ingenic T21. I have disassembled the camera and soldered the TTL pins and tried to get root using this method: https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks/blob/master/hacks/getroot.md But I can't boot into uboot. It appears it has set Hit any key to stop autoboot: 0. It ignores the keys I presssed. This is the boot log:

U-Boot SPL 2013.07 (Jun 09 2020 - 10:59:33)
Timer init
CLK stop
PLL init
pll_init:399
pll_cfg.pdiv = 10, pll_cfg.h2div = 5, pll_cfg.h0div = 5, pll_cfg.cdiv = 1, pll_cfg.l2div = 2
fbdiv = 50 , refdiv = 1 , fdivq = 2 ,pllod = 1 range = 3
cppcr is 03100860
CPM_CPAPCR 0310086d
fbdiv = 38 , refdiv = 1 , fdivq = 2 ,pllod = 1 range = 3
cppcr is 02500860
CPM_CPMPCR 04a0484d
fbdiv = 50 , refdiv = 1 , fdivq = 2 ,pllod = 1 range = 3
cppcr is 03100860
CPM_CPVPCR 0310086d
cppcr 0x9a773310
apll_freq 1200000000
mpll_freq 900000000
vpll_freq = 1200000000
ddr sel mpll, cpu sel apll
ddrfreq 450000000
cclk  1200000000
l2clk 600000000
h0clk 180000000
h2clk 180000000
pclk  90000000
CLK init
SDRAM init
sdram init start
ddr_inno_phy_init ..!
phy reg = 0x00000007, CL = 0x00000007
ddr_inno_phy_init ..! 11:  00000004
ddr_inno_phy_init ..! 22:  00000006
ddr_inno_phy_init ..! 33:  00000006
REG_DDR_LMR: 00000210
REG_DDR_LMR: 00000310
REG_DDR_LMR: 00000110
REG_DDR_LMR, MR0: 00d73011
T30_0x5: 00000007
T30_0x15: 0000000c
T30_0x4: 00000000
T30_0x14: 00000002
INNO_TRAINING_CTRL 1: 00000000
INNO_TRAINING_CTRL 2: 000000a1
T30_cc: 00000003
INNO_TRAINING_CTRL 3: 000000a0
T30_118: 0000003c
T30_158: 0000003c
T30_190: 00000020
T30_194: 0000001e
jz-04 :  0x00000051
jz-08 :  0x000000a0
jz-28 :  0x00000024
DDR PHY init OK
INNO_DQ_WIDTH   :00000003
INNO_PLL_FBDIV  :00000008
INNO_PLL_PDIV   :00000002
INNO_MEM_CFG    :00000051
INNO_PLL_CTRL   :00000018
INNO_CHANNEL_EN :0000000d
INNO_CWL        :00000006
INNO_CL         :00000007
DDR Controller init
DDRC_STATUS         0x80000001
DDRC_CFG            0x0a688a40
DDRC_CTRL           0x0000891c
DDRC_LMR            0x00400008
DDRC_DLP            0x00000000
DDRC_TIMING1        0x040e0706
DDRC_TIMING2        0x02150607
DDRC_TIMING3        0x2006051b
DDRC_TIMING4        0x17240031
DDRC_TIMING5        0xff060405
DDRC_TIMING6        0x32150505
DDRC_REFCNT         0x00da2401
DDRC_MMAP0          0x000020fc
DDRC_MMAP1          0x00002400
DDRC_REMAP1         0x03020100
DDRC_REMAP2         0x07060504
DDRC_REMAP3         0x0b0a0908
DDRC_REMAP4         0x0f0e0d0c
DDRC_REMAP5         0x13121110
DDRC_AUTOSR_EN      0x00000000
sdram init finished
SDRAM init ok
board_init_r
image entry point: 0x80100000


U-Boot 2013.07 (Jun 09 2020 - 10:59:33)

Board: ISVP (Ingenic XBurst T21 SoC)
DRAM:  64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 439k for U-Boot at: 83f90000
Reserving 32784k for malloc() at: 81f8c000
Reserving 32 Bytes for Board Info at: 81f8bfe0
Reserving 124 Bytes for Global Data at: 81f8bf64
Reserving 128k for boot params() at: 81f6bf64
Stack Pointer at: 81f6bf48
Now running in RAM - U-Boot at: 83f90000
MMC:   msc: 0
the manufacturer c2
SF: Detected MX25L128**E

*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   cpm_mphyc_rst = 0x01000000 cpm_mphyc = 0x00000000
Jz4775-9161
Hit any key to stop autoboot:  0
the manufacturer c2
SF: Detected MX25L128**E

--->probe spend 4 ms
SF: 2621440 bytes @ 0x40000 Read: OK
--->read spend 842 ms
## Booting kernel from Legacy Image at 80600000 ...
   Image Name:   Linux-3.10.14__isvp_turkey_1.0__
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1500101 Bytes = 1.4 MiB
   Load Address: 80010000
   Entry Point:  803a4670
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.14__isvp_turkey_1.0__ (root@ubuntu) (gcc version 4.7.2 (Ingenic r2.3.3 2016.12) ) #2 PREEMPT Sat Sep 28 13:47:33 CST 2019
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 RESET ERROR PC:86002CB1
[    0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)
[    0.000000] FPU revision is: 00b70000
[    0.000000] CCLK:1200MHz L2CLK:600Mhz H0CLK:225MHz H2CLK:225Mhz PCLK:112Mhz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 00444000 @ 00010000 (usable)
[    0.000000]  memory: 0003c000 @ 00454000 (usable after init)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 02a00000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x029fffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x029fffff]
[    0.000000] Primary instruction cache 16kB, 8-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 16kB, 8-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] pls check processor_id[0x00d00100],sc_jz not support!
[    0.000000] MIPS secondary cache 64kB, 8-way, linesize 32 bytes.
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 10668
[    0.000000] Kernel command line: console=ttyS1,115200n8 mem=42M@0x0 rmem=22M@0x2A00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),1536k(kernel),2560k(rootfs),128k(rom),512k(config),9216k(appfs),2176k(appfs1)
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 37332k/43008k available (3700k kernel code, 5676k reserved, 666k data, 240k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:422
[    0.000000] clockevents_config_and_register success.
[    0.000028] Calibrating delay loop... 1196.85 BogoMIPS (lpj=5984256)
[    0.087793] pid_max: default: 32768 minimum: 301
[    0.092719] Mount-cache hash table entries: 512
[    0.097829] Initializing cgroup subsys debug
[    0.102090] Initializing cgroup subsys freezer
[    0.109171] regulator-dummy: no parameters
[    0.113438] NET: Registered protocol family 16
[    0.122034] bio: create slab <bio-0> at 0
[    0.128322] jz-dma jz-dma: JZ SoC DMA initialized
[    0.133376] usbcore: registered new interface driver usbfs
[    0.139007] usbcore: registered new interface driver hub
[    0.144476] usbcore: registered new device driver usb
[    0.149772] i2c-gpio i2c-gpio.1: using pins 57 (SDA) and 58 (SCL)
[    0.156031]  (null): set:280  hold:281 dev=112500000 h=562 l=562
[    0.162181] media: Linux media interface: v0.10
[    0.166788] Linux video capture interface: v2.00
[    0.173195] Switching to clocksource jz_clocksource
[    0.178166] cfg80211: Calling CRDA to update world regulatory domain
[    0.185299] jz-dwc2 jz-dwc2: cgu clk gate get error
[    0.190182] jz-dwc2 jz-dwc2: regulator vbus get error
[    0.195348] DWC IN OTG MODE
[    0.348461] sft id =========================off
[    0.353080] dwc2 dwc2: Keep PHY ON
[    0.356496] dwc2 dwc2: Using Buffer DMA mode
[    0.560469] dwc2 dwc2: Core Release: 3.00a
[    0.564578] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[    0.570939] dwc2 dwc2: new USB bus registered, assigned bus number 1
[    0.578166] hub 1-0:1.0: USB hub found
[    0.581911] hub 1-0:1.0: 1 port detected
[    0.586114] dwc2 dwc2: DWC2 Host Initialized
[    0.590593] NET: Registered protocol family 2
[    0.595578] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.602496] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.608992] TCP: Hash tables configured (established 512 bind 512)
[    0.615274] TCP: reno registered
[    0.618476] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.624397] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.631036] NET: Registered protocol family 1
[    0.635804] RPC: Registered named UNIX socket transport module.
[    0.641737] RPC: Registered udp transport module.
[    0.646582] RPC: Registered tcp transport module.
[    0.651272] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.658181] freq_udelay_jiffys[0].max_num = 10
[    0.662610] cpufreq  udelay  loops_per_jiffy
[    0.667083] dwc2 dwc2: ID PIN CHANGED!
[    0.670854] init DWC as A_HOST
[    0.673940] 12000     59842   59842
[    0.677204] 24000     119685  119685
[    0.680621] 60000     299212  299212
[    0.684065] 120000    598425  598425
[    0.687733] 200000    997376  997376
[    0.691192] 300000    1496064         1496064
[    0.695043] 600000    2992128         2992128
[    0.698676] 792000    3949608         3949608
[    0.702383] 1008000   5026775         5026775
[    0.706215] 1200000   5984256         5984256
[    0.714751] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.721543] jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
[    0.727512] msgmni has been set to 72
[    0.733369] io scheduler noop registered
[    0.737431] io scheduler cfq registered (default)
[    0.743811] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1
[    0.751615] console [ttyS1] enabled, bootconsole disabled
[    0.751615] console [ttyS1] enabled, bootconsole disabled
[    0.762796] jz-uart.2: ttyS2 at MMIO 0x10032000 (irq = 57) is a uart2
[    0.773821] brd: module loaded
[    0.779478] loop: module loaded
[    0.783387] zram: Created 2 device(s) ...
[    0.787730] logger: created 256K log 'log_main'
[    0.793057] jz TCU driver register completed
[    0.798005] the id code = c22018, the flash name is MX25L12835F
[    0.804121] JZ SFC Controller for SFC channel 0 driver register
[    0.810311] 7 cmdlinepart partitions found on MTD device jz_sfc
[    0.816442] Creating 7 MTD partitions on "jz_sfc":
[    0.821389] 0x000000000000-0x000000040000 : "boot"
[    0.826905] 0x000000040000-0x0000001c0000 : "kernel"
[    0.832601] 0x0000001c0000-0x000000440000 : "rootfs"
[    0.838341] 0x000000440000-0x000000460000 : "rom"
[    0.843763] 0x000000460000-0x0000004e0000 : "config"
[    0.849539] 0x0000004e0000-0x000000de0000 : "appfs"
[    0.855205] 0x000000de0000-0x000001000000 : "appfs1"
[    0.860875] SPI NOR MTD LOAD OK
[    0.864187] tun: Universal TUN/TAP device driver, 1.6
[    0.869453] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    0.994607] Bus Mode Reg after reset: 0x00020101, cnt=0
[    1.015849] libphy: jz_mii_bus: probed
[    1.019802] =======>gmacdev = 0x821f6100<================
[    1.025472] =========>gmacdev->MacBase = 0xb34b0000 DmaBase = 0xb34b1000
[    1.032391] Bus Mode Reg after reset: 0x00020101, cnt=0
[    1.777174] dwc2 dwc2:  ++OTG Interrupt: A-Device Timeout Change++
[    2.055734] jz_mac jz_mac.0: JZ on-chip Ethernet MAC driver, Version 1.0
[    2.062659] failed to request GPIO 47
[    2.066634] usbcore: registered new interface driver zd1201
[    2.072390] i2c /dev entries driver
[    2.076548] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[    2.115667] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[    2.121034] jzmmc_v1.2 jzmmc_v1.2.1: vmmc regulator missing
[    2.165670] jzmmc_v1.2 jzmmc_v1.2.1: register success!
[    2.171299] TCP: cubic registered
[    2.174785] NET: Registered protocol family 17
[    2.179762] soc_vpu probe success,version:1.0.0-03203fd46d
[    2.185791] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[    2.193132] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[    2.204364] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    2.212254] Freeing unused kernel memory: 240K (80454000 - 80490000)
mdev is ok......
==> startapp ok
Tue Jan  1 00:00:00 UTC 2019
[    4.607026] exFAT: Version 1.2.9
[    4.628876] Bus Mode Reg after reset: 0x00020101, cnt=0

Jooan login: udhcpc (v1.22.1) started
Sending discover...
[    7.381744] RTL871X: module init start
[    7.385745] RTL871X: rtl8189fs v4.3.24.12_27796.20180510
[    7.391231] RTL871X: build time: Dec 24 2018 11:45:25
[    7.396508] wlan power on
[    7.415164] RTL871X: module init ret=0
[    7.460320] mmc1: card claims to support voltages below the defined range. These will be ignored.
[    7.480210] mmc1: new SDIO card at address 0001
[    7.532339] RTL871X: HW EFUSE
[    7.535613] RTL871X: hal_com_config_channel_plan chplan:0x20
[    7.631077] RTL871X: rtw_regsty_chk_target_tx_power_valid return _FALSE for band:0, path:0, rs:0, t:-1
[    7.644045] RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=d4:d2:d6:31:0e:04
[    7.667372] RTL871X: rtw_ndev_init(wlan1) if2 mac_addr=d6:d2:d6:31:0e:04
{ Wireless Enter Station Mode }
/mnt/mtd/startapp: line 21: can't create /sys/devices/platform/jz-dwc2/dwc2/udc/dwc2/soft_connect: nonexistent directory
ifconfig: SIOCSIFADDR: No such device
[   10.130898] name : i2c-gpio1 nr : 1
[   10.134504] name : i2c0 nr : 0
Sending discover...
[   10.174856] libphy: 0:00 - Link is Up - 100/Half
[   10.235098]  sensor_read: addr=0xa value = 0xf
[   10.249751]  sensor_read: addr=0xb value = 0x23
[   10.254492] info: success sensor find : jxf23
sensor :jxf23
[   10.577683] @@@@ tx-isp-probe ok(version H20181105a) @@@@@
Successfully initialized wpa_supplicant
rfkill: Cannot open RFKILL control device
nl80211: Could not re-add multicast membership for vendor events: -2 (No such file or directory)
[   10.835231] jz_codec_register: probe() successful!
[   11.215097] dma dma0chan24: Channel 24 have been requested.(phy id 7,type 0x06 desc a0b01000)
[   11.224338] dma dma0chan25: Channel 25 have been requested.(phy id 6,type 0x06 desc a0a7c000)
[   11.233780] dma dma0chan26: Channel 26 have been requested.(phy id 5,type 0x04 desc a1dcd000)
[   11.262132] motor_probe730
mount: mounting /dev/mmcblk0p1 on /mnt/sd_card/ failed: No such file or directory
Now Timezone is Asia/Shanghai
main: <6>[    0.000000] Initializing cgroup subsys cpu

main: <6>[    0.000000] Initializing cgroup subsys cpuacct

main: <5>[    0.000000] Linux version 3.10.14__isvp_turkey_1.0__ (root@ubuntu) (gcc version 4.7.2 (Ingenic r2.3.3 2016.12) ) #2 PREEMPT Sat Sep 28 13:47:33 CST 2019

main: <6>[    0.000000] bootconsole [early0] enabled

main: <4>[    0.000000] CPU0 RESET ERROR PC:86002CB1

main: <6>[    0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)

main: <6>[    0.000000] FPU revision is: 00b70000

main: <7>[    0.000000] cgu_get_rate, parent = 1200000000, rate = 0, m = 0, n = 0, reg val = 0x881000ff

main: <4>[    0.000000] CCLK:1200MHz L2CLK:600Mhz H0CLK:225MHz H2CLK:225Mhz PCLK:112Mhz

main: <6>[    0.000000] Determined physical RAM map:

main: <6>[    0.000000]  memory: 00444000 @ 00010000 (usable)

main: <6>[    0.000000]  memory: 0003c000 @ 00454000 (usable after init)

main: <6>[    0.000000] User-defined physical RAM map:

main: <6>[    0.000000]  memory: 02a00000 @ 00000000 (usable)

main: <4>[    0.000000] Zone ranges:

main: <4>[    0.000000]   Normal   [mem 0x00000000-0x029fffff]

main: <4>[    0.000000] Movable zone start for each node

main: <4>[    0.000000] Early memory node ranges

main: <4>[    0.000000]   node   0: [mem 0x00000000-0x029fffff]

main: <7>[    0.000000] On node 0 totalpages: 10752

main: <7>[    0.000000] free_area_init_node: node 0, pgdat 804514e0, node_mem_map 81000000

main: <7>[    0.000000]   Normal zone: 84 pages used for memmap

main: <7>[    0.000000]   Normal zone: 0 pages reserved

main: <7>[    0.000000]   Normal zone: 10752 pages, LIFO batch:1

main: <4>[    0.000000] Primary instruction cache 16kB, 8-way, VIPT, linesize 32 bytes.

main: <4>[    0.000000] Primary data cache 16kB, 8-way, VIPT, no aliases, linesize 32 bytes

main: <4>[    0.000000] pls check processor_id[0x00d00100],sc_jz not support!

main: <4>[    0.000000] MIPS secondary cache 64kB, 8-way, linesize 32 bytes.

main: <7>[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768

main: <7>[    0.000000] pcpu-alloc: [0] 0

main: <4>[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 10668

main: <5>[    0.000000] Kernel command line: console=ttyS1,115200n8 mem=42M@0x0 rmem=22M@0x2A00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256k(boot),1536k(kernel),2560k(rootfs),128k(rom),512k(config),9216k(appfs),2176k(appfs1)

main: <6>[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)

main: <6>[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)

main: <6>[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)

main: <6>[    0.000000] Memory: 37332k/43008k available (3700k kernel code, 5676k reserved, 666k data, 240k init, 0k highmem)

main: <6>[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1

main: <6>[    0.000000] Preemptible hierarchical RCU implementation.

main: <6>[    0.000000] NR_IRQS:422

main: <4>[    0.000000] clockevents_config_and_register success.

main: <6>[    0.000028] Calibrating delay loop... 1196.85 BogoMIPS (lpj=5984256)

main: <6>[    0.087793] pid_max: default: 32768 minimum: 301

main: <6>[    0.092719] Mount-cache hash table entries: 512

main: <6>[    0.097829] Initializing cgroup subsys debug

main: <6>[    0.102090] Initializing cgroup subsys freezer

main: <6>[    0.109171] regulator-dummy: no parameters

main: <6>[    0.113438] NET: Registered protocol family 16

main: <6>[    0.122034] bio: create slab <bio-0> at 0

main: <6>[    0.128322] jz-dma jz-dma: JZ SoC DMA initialized

main: <6>[    0.133376] usbcore: registered new interface driver usbfs

main: <6>[    0.139007] usbcore: registered new interface driver hub

main: <6>[    0.144476] usbcore: registered new device driver usb

main: <6>[    0.149772] i2c-gpio i2c-gpio.1: using pins 57 (SDA) and 58 (SCL)

main: <6>[    0.156031]  (null): set:280  hold:281 dev=112500000 h=562 l=562

main: <6>[    0.162181] media: Linux media interface: v0.10

main: <6>[    0.166788] Linux video capture interface: v2.00

main: <6>[    0.173195] Switching to clocksource jz_clocksource

main: <6>[    0.178166] cfg80211: Calling CRDA to update world regulatory domain

main: <4>[    0.185299] jz-dwc2 jz-dwc2: cgu clk gate get error

main: <4>[    0.190182] jz-dwc2 jz-dwc2: regulator vbus get error

main: <4>[    0.195348] DWC IN OTG MODE

main: <4>[    0.348461] sft id =========================off

main: <6>[    0.353080] dwc2 dwc2: Keep PHY ON

main: <6>[    0.356496] dwc2 dwc2: Using Buffer DMA mode

main: <6>[    0.560469] dwc2 dwc2: Core Release: 3.00a

main: <6>[    0.564578] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller

main: <6>[    0.570939] dwc2 dwc2: new USB bus registered, assigned bus number 1

main: <6>[    0.578166] hub 1-0:1.0: USB hub found

main: <6>[    0.581911] hub 1-0:1.0: 1 port detected

main: <6>[    0.586114] dwc2 dwc2: DWC2 Host Initialized

main: <6>[    0.590593] NET: Registered protocol family 2

main: <6>[    0.595578] TCP established hash table entries: 512 (order: 0, 4096 bytes)

main: <6>[    0.602496] TCP bind hash table entries: 512 (order: -1, 2048 bytes)

main: <6>[    0.608992] TCP: Hash tables configured (established 512 bind 512)

main: <6>[    0.615274] TCP: reno registered

 Goahead run ok ======
========= goform API Define ==========
main: <6>[    0.618476] UDP hash table entries: 256 (order: 0, 4096 bytes)

main: <6>[    0.624397] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)

main: <6>[    0.631036] NET: Registered protocol family 1

main: <6>[    0.635804] RPC: Registered named UNIX socket transport module.

main: <6>[    0.641737] RPC: Registered udp transport module.

main: <6>[    0.646582] RPC: Registered tcp transport module.

main: <6>[    0.651272] RPC: Registered tcp NFSv4.1 backchannel transport module.

main: <4>[    0.658181] freq_udelay_jiffys[0].max_num = 10

main: <4>[    0.662610] cpufreq         udelay  loops_per_jiffy

main: <6>[    0.667083] dwc2 dwc2: ID PIN CHANGED!

main: <6>[    0.670854] init DWC as A_HOST

main: <4>[    0.673940] 12000    59842   59842

main: <4>[    0.677204] 24000    119685  119685

main: <4>[    0.680621] 60000    299212  299212

main: <4>[    0.684065] 120000   598425  598425

main: <4>[    0.687733] 200000   997376  997376

main: <4>[    0.691192] 300000   1496064         1496064

main: <4>[    0.695043] 600000   2992128         2992128

main: <4>[    0.698676] 792000   3949608         3949608

main: <4>[    0.702383] 1008000  5026775         5026775

main: <4>[    0.706215] 1200000  5984256         5984256

main: <6>[    0.714751] squashfs: version 4.0 (2009/01/31) Phillip Lougher

main: <6>[    0.721543] jffs2: version 2.2. © 2001-2006 Red Hat, Inc.

main: <6>[    0.727512] msgmni has been set to 72

main: <6>[    0.733369] io scheduler noop registered

main: <6>[    0.737431] io scheduler cfq registered (default)

main: <6>[    0.743811] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1

main: <6>[    0.751615] console [ttyS1] enabled, bootconsole disabled

main: <6>[    0.762796] jz-uart.2: ttyS2 at MMIO 0x10032000 (irq = 57) is a uart2

main: <6>[    0.773821] brd: module loaded

main: <6>[    0.779478] loop: module loaded

main: <6>[    0.783387] zram: Created 2 device(s) ...

main: <6>[    0.787730] logger: created 256K log 'log_main'

main: <4>[    0.793057] jz TCU driver register completed

main: <4>[    0.798005] the id code = c22018, the flash name is MX25L12835F

main: <6>[    0.804121] JZ SFC Controller for SFC channel 0 driver register

main: <5>[    0.810311] 7 cmdlinepart partitions found on MTD device jz_sfc

main: <5>[    0.816442] Creating 7 MTD partitions on "jz_sfc":

main: <5>[    0.821389] 0x000000000000-0x000000040000 : "boot"

main: <5>[    0.826905] 0x000000040000-0x0000001c0000 : "kernel"

main: <5>[    0.832601] 0x0000001c0000-0x000000440000 : "rootfs"

main: <5>[    0.838341] 0x000000440000-0x000000460000 : "rom"

main: <5>[    0.843763] 0x000000460000-0x0000004e0000 : "config"

main: <5>[    0.849539] 0x0000004e0000-0x000000de0000 : "appfs"

main: <5>[    0.855205] 0x000000de0000-0x000001000000 : "appfs1"

main: <4>[    0.860875] SPI NOR MTD LOAD OK

main: <6>[    0.864187] tun: Universal TUN/TAP device driver, 1.6

main: <6>[    0.869453] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>

main: <4>[    0.994607] Bus Mode Reg after reset: 0x00020101, cnt=0

main: <6>[    1.015849] libphy: jz_mii_bus: probed

main: <4>[    1.019802] =======>gmacdev = 0x821f6100<================

main: <4>[    1.025472] =========>gmacdev->MacBase = 0xb34b0000 DmaBase = 0xb34b1000

main: <4>[    1.032391] Bus Mode Reg after reset: 0x00020101, cnt=0

main: <6>[    1.777174] dwc2 dwc2:  ++OTG Interrupt: A-Device Timeout Change++

main: <6>[    2.055734] jz_mac jz_mac.0: JZ on-chip Ethernet MAC driver, Version 1.0

main: <4>[    2.062659] failed to request GPIO 47

main: <6>[    2.066634] usbcore: registered new interface driver zd1201

main: <6>[    2.072390] i2c /dev entries driver

main: <4>[    2.076548] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing

main: <6>[    2.115667] jzmmc_v1.2 jzmmc_v1.2.0: register success!

main: <4>[    2.121034] jzmmc_v1.2 jzmmc_v1.2.1: vmmc regulator missing

main: <6>[    2.165670] jzmmc_v1.2 jzmmc_v1.2.1: register success!

main: <6>[    2.171299] TCP: cubic registered

main: <6>[    2.174785] NET: Registered protocol family 17

main: <4>[    2.179762] soc_vpu probe success,version:1.0.0-03203fd46d

main: <6>[    2.185791] input: gpio-keys as /devices/platform/gpio-keys/input/input0

main: <3>[    2.193132] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)

main: <6>[    2.204364] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.

main: <6>[    2.212254] Freeing unused kernel memory: 240K (80454000 - 80490000)

main: <6>[    4.607026] exFAT: Version 1.2.9

main: <4>[    4.628876] Bus Mode Reg after reset: 0x00020101, cnt=0

main: <4>[    7.381744] RTL871X: module init start

main: <4>[    7.385745] RTL871X: rtl8189fs v4.3.24.12_27796.20180510

main: <4>[    7.391231] RTL871X: build time: Dec 24 2018 11:45:25

main: <4>[    7.396508] wlan power on

main: <4>[    7.415164] RTL871X: module init ret=0

main: <4>[    7.460320] mmc1: card claims to support voltages below the defined range. These will be ignored.

main: <6>[    7.480210] mmc1: new SDIO card at address 0001

main: <4>[    7.532339] RTL871X: HW EFUSE

main: <4>[    7.535613] RTL871X: hal_com_config_channel_plan chplan:0x20

main: <4>[    7.631077] RTL871X: rtw_regsty_chk_target_tx_power_valid return _FALSE for band:0, path:0, rs:0, t:-1

main: <4>[    7.644045] RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=d4:d2:d6:31:0e:04

main: <4>[    7.667372] RTL871X: rtw_ndev_init(wlan1) if2 mac_addr=d6:d2:d6:31:0e:04

main: <4>[   10.130898] name : i2c-gpio1 nr : 1

main: <4>[   10.134504] name : i2c0 nr : 0

main: <6>[   10.174856] libphy: 0:00 - Link is Up - 100/Half

main: <4>[   10.235098]  sensor_read: addr=0xa value = 0xf

main: <4>[   10.249751]  sensor_read: addr=0xb value = 0x23

main: <4>[   10.254492] info: success sensor find : jxf23

main: <4>[   10.577683] @@@@ tx-isp-probe ok(version H20181105a) @@@@@

main: <7>[   10.835215] request spk en gpio 63 ok!

main: <4>[   10.835231] jz_codec_register: probe() successful!

main: <7>[   10.844716] cgu_set_rate, parent = 1200000000, rate = 2048000, n = 9375, reg val = 0x8100249f

main: <7>[   10.844734] cgu_enable,cgu_i2s reg val = 0xa100249f

main: <6>[   11.215097] dma dma0chan24: Channel 24 have been requested.(phy id 7,type 0x06 desc a0b01000)

main: <6>[   11.224338] dma dma0chan25: Channel 25 have been requested.(phy id 6,type 0x06 desc a0a7c000)

main: <6>[   11.233780] dma dma0chan26: Channel 26 have been requested.(phy id 5,type 0x04 desc a1dcd000)

main: <4>[   11.262132] motor_probe730

 JoaSyslogd run ok ======
 My_watch_dog run ok ======
[my_watch_dog.c][main][299]@@@@@@@@ my_watch_dog statrt...
 avengine run ok ======
Sending discover...
[   13.624902] set sensor gpio as PA-low-10bit
main: <6>[   13.624902] set sensor gpio as PA-low-10bit

main: <7>[   13.629231] probe ok ------->jxf23

[   13.785440] jxf23 chip found @ 0x40 (i2c0)
[   13.789664] sensor driver version H20181031a
main: <7>[   13.785014] -----jxf23_detect: 562 ret = 0, v = 0x0f

main: <7>[   13.785430] -----jxf23_detect: 570 ret = 0, v = 0x23

main: <4>[   13.785440] jxf23 chip found @ 0x40 (i2c0)

main: <4>[   13.789664] sensor driver version H20181031a

main: <7>[   14.490287] jxf23 stream on

i264e[info]: profile High, level 4.0
i264e[info]: profile High, level 2.2
Line=145, media_type=1, codec=3, res=18, key1=17830186, key2=17830187, iShmSize=655360, iMaxFrameSize=524288
Line=145, media_type=1, codec=3, res=7, key1=17840186, key2=17840287, iShmSize=393216, iMaxFrameSize=262144
Line=145, media_type=1, codec=3, res=4, key1=17870186, key2=17870587, iShmSize=307200, iMaxFrameSize=131072
main: <7>[   14.783789] codec_codec_ctl: set sample rate...

main: <7>[   14.784186] codec_codec_ctl: set device...

[   15.214692] codec_set_device: set device: MIC...
main: <4>[   15.214692] codec_set_device: set device: MIC...

/
main: <7>[   15.254933] codec_codec_ctl: set repaly channel...

main: <7>[   15.254960] codec_codec_ctl: set sample rate...

main: <7>[   15.255156] codec_codec_ctl: set device...

[   15.474681] codec_set_device: set device: speaker...
main: <4>[   15.474681] codec_set_device: set device: speaker...

the moter will reset
[   15.930177] motor_ops_reset467
main: <4>[   15.930177] motor_ops_reset467

main: <7>[   15.941955] before register 0x1f value : 0x01

main: <7>[   15.942285] after register 0x1f value : 0x81

ifconfig eth0 down
Read error: Network is down, reopening socket
[INFO  rtsp/rtsp_demo.c:324:rtsp_new_demo] rtsp server demo starting on port 554
[INFO  rtsp/rtsp_demo.c:510:rtsp_new_session] add session path: /live/ch00_
rtsp Video Stream ShmID = 0, codec = 3
rtsp Video Stream ShmID = 1, codec = 3
FOX startup!
Line=246, media_type=0, codec=100, key1=54637402, key2=54637703, iShmSize=102400, iMaxFrameSize=4096
newest frame.............. uiPos=132200, uiSeq=50
the width height is (640, 360) region count is 25
[   16.294699] libphy: 0:00 - Link is Down
main: <6>[   16.294699] libphy: 0:00 - Link is Down

search wifi list start
iNetworkid = 0
No lease, forking to background
[   19.694761] RTL871X: rtw_set_802_11_connect(wlan0)  fw_state=0x00000008
main: <4>[   19.694761] RTL871X: rtw_set_802_11_connect(wlan0)  fw_state=0x00000008

[   19.924317] RTL871X: start auth
main: <4>[   19.924317] RTL871X: start auth

[   19.935446] RTL871X: auth success, start assoc
[   19.944649] RTL871X: assoc success
main: <4>[   19.935446] RTL871X: auth success, start assoc

main: <4>[   19.944649] RTL871X: assoc success

search wifi list finish
[   20.377583] RTL871X: recv eapol packet
[   20.382924] RTL871X: send eapol packet
main: <4>[   20.377583] RTL871X: recv eapol packet

main: <4>[   20.382924] RTL871X: send eapol packet

[   20.395592] RTL871X: recv eapol packet
main: <4>[   20.395592] RTL871X: recv eapol packet

[   20.801006] RTL871X: send eapol packet
main: <4>[   20.801006] RTL871X: send eapol packet

[   20.817693] RTL871X: set pairwise key camid:4, addr:8c:ab:8e:c6:d1:70, kid:0, type:AES
main: <4>[   20.817693] RTL871X: set pairwise key camid:4, addr:8c:ab:8e:c6:d1:70, kid:0, type:AES

[   20.835602] RTL871X: set group key camid:5, addr:8c:ab:8e:c6:d1:70, kid:1, type:AES
main: <4>[   20.835602] RTL871X: set group key camid:5, addr:8c:ab:8e:c6:d1:70, kid:1, type:AES

wan_udhcpc.sh wlan0 &
the curx is (2000, 1050) the half max is (2000, 1050)
[my_watch_dog.c][my_watch_dog_init][77]watchdog started...
The gettimeout was is 5 seconds
[my_watch_dog.c][my_watch_dog_init][92]The settimeout was is 60 seconds
will send ptz reset fin notify
finish reset x is 0 y is 840
the max x y steps is (4000, 2100) the cur step is (0, 840)the curxstep is 0 the curystep is 28 the latest action is 0
search wifi list start
search wifi list finish
/bin/sh: /usr/bin/setpwd: not found
the width height is (640, 360) region count is 25
ls
Password:
Login incorrect
Jooan login: root
Password:
Login incorrect
Jooan login: admin
Password:
Login incorrect

Jooan login:

After it boot up, if I press any thing, it just shows Jooan login: and asks for Password:. I searched online and it appears Jooan is yet another brand of IP cameras. But no one have hacked them to figure out their password.

Then I soldered the 16MB SPI chip off and dumped it's content using CH341 programmer. The chip dump is uploaded here: https://paste.c-net.org/EsteemedCeleste. Then I used binwalk on it and extracted some files. I found it has a shadow file with this content:

root:$5$5UHCk3K0XO5reyuw$ZS/spuAdHeRfpA1.C.7NH.d.U9fiSHJaxildqr6oJFB:10933:0:99999:7:::

But I found nothing by searching for the hashes online.

Then I don't know what to do to get root. It appears I maybe need to modify the contents on the chip to get root, but I don't know what to modify and how. Is there any guide under this situation?

[tachang]

@afirmware I replied in Gitter lobby fyi.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.