cutfert.blogg.se

1. Hikvision tftp test tftpserver install#
2. Hikvision tftp test tftpserver serial#
3. Hikvision tftp test tftpserver full#
4. Hikvision tftp test tftpserver download#

We’ll use a tool called uboot-mdb-dump to allow us to convert the verbose md output into a binary.įirst, make sure git is installed. Use a text editor to trim anything before and after the memory dump output itself. Once this is done, close the capture file using: Ctrl-A L Trimming the file It’s clearly not workable for the 32GByte+ eMMC found in some devices though – that would take months!

Hikvision tftp test tftpserver serial#

This might seem like a long time, but given how safe serial connections are, and how ubiquitous U-boot is, it’s a highly effective mechanism for smaller SPI flash memories. That means for our 16Mbyte flash memory, we need to transfer 80Mbytes over a serial connection! At 115200bps (where each byte takes 10 bits including start and stop bits), that’s just over 2 hours! Why? Each row is 80 characters long – 80 bytes – and only contains 16 bytes of data. How do we leverage this to extract the flash? Capture to file If you type the follwing command you with get 0x10 (16) bytes of memory from address 0x0. We can use memory display to show us the contents of flash memory.

Hikvision tftp test tftpserver full#

Then, back in the uboot prompt, we run: tftp 0x82000000 firmware.bin 0x1000000Īnd now, heading back to the server – we will have the full flash firmware. Note the file has 0 size and is read/write by everyone. The easiest way to resolve this is to create an empty file on the server, and let it be overwritten. sf read 0x82000000 0x0 0x1000000 Copy out with tftpĪ quirk of tftp is that you can’t, by default, create files on the server.

This command copies 0x1000000 bytes from address 0x0 of the flash into RAM.

A suitable address in RAM is nearly always 0x82000000. We need to copy it into RAM first.įirst we need to initialise the flash: sf probe 0 SPI flash is not directly memory mapped on Hisilicon DVRs, which means we can’t directly access it. This means we want to read back 0x1000000 bytes. You can look up the size using the part number from the board, or just read it from the boot log. This device has a 16MByte SPI flash chip. Setenv serverip 10.42.0.1 Copy the flash to RAM To change both, run: setenv ipaddr 10.42.0.2 You can either change the IP of the machine hosting the server, or you can modify the environment variables. These will generally have default values. You are looking for ipaddr (the DVR’s IP) and serverip (the IP of the TFTP server). U-boot stores settings in something called “environment variables”. Files that are received by it will be stored by default in /srv/tftp.

Hikvision tftp test tftpserver install#

In Ubuntu 18.04 and 20.04, the package tftpd-hpa sets up a TFTP server: sudo apt install tftpd-hpa

We can use this to copy data off the device. TFTP is Trivial FTP, a very simple file transfer protocol that U-boot often integrates. There is also a command md – memory display, which we can use to read the memory on the device out over serial.

Hikvision tftp test tftpserver download#

Other embedded devices vary it’s common to find U-boot only allows data to be download to the device. On most DVRs this allows data to be uploaded and downloaded. The USB commands are not of help.įrequently a protocol called TFTP is supported – Trivial File Transfer Protocol. Unfortunately (for us), U-boot is mostly concerned with copying data onto the SPI flash, whereas we want to copy data from the SPI flash. The number of commands supported varies from device to device, but most low-cost DVRs will have a fairly comprehensive list. Type help to see what commands are supported. In a later post we will look at ways of getting into the U-boot even when there is no obvious key sequence, by glitching one of the SPI flash signals. The “hisilicon” prompt is because this is a Hisilicon SoC using their version of U-boot. This is U-boot prompting to see if you want to go into the U-boot console. There will normally also be a countdown timer for a few seconds. It’s highly likely you will see a message: Hit any key to stop autoboot: You want to connect up a serial adapter, start your terminal emulator (minicom) and watch the screen as the device boots. We can use the U-boot console to dump the data out over serial, and rebuild it into a binary file! Getting to the U-boot console

But what happens if we can’t get a full shell on the device? What happens if the kernel doesn’t have a serial console enabled? In previous posts, we saw how we could identify a serial console on a DVR, connect and interact with it, and – if full shell access was enabled – recover the firmware using a USB stick.