Teardown & serial port on the Foscam C2
As my Foscam camera died, I took it apart to see if I could somehow restore its working.
As with these sort of devices, the first thing that breaks is typically the power circuit.
In this case, the power unit still appeared to be delivering sufficient power... time to dig deeper and take the thing apart.
See here some pictures of the device
Note the brown coloring... seems the device gets bit hot during regular operations.
This is the main PCB, in the right corner empty header. (Serial port)
 |
| Main PCB Front |
 |
| Main PCB Back |
 |
| Networking PCB |
 |
| Wifi Antenna |
 |
| IR led |
On the main PCB there is some empty pins. When connecting a serial port, it spits out the linux boot output at 115200bps (at 3.3v):
The booting process of my (broken) device:
___ ___ _________ _
/ _ \ | \/ || ___ \ | |
/ /_\ \| . . || |_/ / ___ ___ | |_
| _ || |\/| || ___ \ / _ \ / _ \ | __|
| | | || | | || |_/ /| (_) || (_) || |_
\_| |_/\_| |_/\____/ \___/ \___/ \__|
----------------------------------------------------------
Amboot(R) Ambarella(R) Foscam(R) Copyright (C) 2004-2014 2015-05-23
Foscam(R) Copyright (C) 2015-05-23
will reset phy by g95.
reset phy completed, gpios2 data: 0xB8001E00.
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 3.10.73 (root@foscam-virtual-machine) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & ARMv6k] 2014.06) ) #1 PREEMPT Mon Feb 27 10:37:06 CST 2017
[ 0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine: Ambarella S2L (Flattened Device Tree), model: Ambarella S2LM Kiwi Board
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] Ambarella: AHB = 0xe0000000[0xe0000000],0x01000000 0
[ 0.000000] Ambarella: APB = 0xe8000000[0xe8000000],0x01000000 0
[ 0.000000] Ambarella: PPM = 0x00000000[0xdfe00000],0x00200000 9
[ 0.000000] Ambarella: AXI = 0xf0000000[0xf0000000],0x00030000 0
[ 0.000000] Ambarella: DRAMC = 0xdffe0000[0xef000000],0x00020000 0
[ 0.000000] Ambarella: DBGBUS = 0xec000000[0xec000000],0x00200000 0
[ 0.000000] Ambarella: DBGFMEM = 0xee000000[0xee000000],0x01000000 0
[ 0.000000] Ambarella: IAVMEM = 0x07000000[ ],0x09000000
[ 0.000000] CPU: All CPU(s) started in SVC mode.
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 27940
[ 0.000000] Kernel command line: console=ttyS0 ubi.mtd=lnx root=ubi0:rootfs rw rootfstype=ubifs init=/linuxrc
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 110MB = 110MB total
[ 0.000000] Memory: 106272k/106272k available, 6368k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0x87000000 - 0xff000000 (1920 MB)
[ 0.000000] lowmem : 0x80000000 - 0x86e00000 ( 110 MB)
[ 0.000000] modules : 0x7f000000 - 0x80000000 ( 16 MB)
[ 0.000000] .text : 0x80008000 - 0x804a40e4 (4721 kB)
[ 0.000000] .init : 0x804a5000 - 0x804c87b4 ( 142 kB)
[ 0.000000] .data : 0x804ca000 - 0x805094f0 ( 254 kB)
[ 0.000000] .bss : 0x805094f0 - 0x80529738 ( 129 kB)
[ 0.000000] NR_IRQS:240
[ 0.000000] sched_clock: 32 bits at 54MHz, resolution 18ns, wraps every 79536ms
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] console [ttyS0] enabled
[ 0.233824] Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
[ 0.292608] pid_max: default: 32768 minimum: 301
[ 0.297301] Mount-cache hash table entries: 512
[ 0.304081] CPU: Testing write buffer coherency: ok
[ 0.309233] Setting up static identity map for 0x8037fc58 - 0x8037fcb8
[ 0.318068] devtmpfs: initialized
[ 0.322649] pinctrl core: initialized pinctrl subsystem
[ 0.328097] NET: Registered protocol family 16
[ 0.333312] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 0.340718] L310 cache controller enabled
[ 0.344718] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x32020000, Cache size: 131072 B
[ 0.354266] ambarella-pinctrl e8009000.pinctrl: Ambarella pinctrl driver registered
[ 0.362274] ambarella-gpio gpio.0: Ambarella GPIO driver registered
[ 0.372191] bio: create slab <bio-0> at 0
[ 0.377240] ambarella-dma e0005000.dma: Ambarella DMA Engine
[ 0.384371] ambarella-i2c e8003000.i2c: Ambarella I2C adapter[0] probed!
[ 9.389982] ambarella-i2c e8007000.i2c: No ACK from address 0xe8, 2:0!
[ 9.396498] pca953x 2-0074: failed reading register
[ 9.401385] pca953x: probe of 2-0074 failed with error -16
[ 9.406860] ambarella-i2c e8007000.i2c: Ambarella I2C adapter[2] probed!
[ 9.414815] Switching to clocksource ambarella-cs-timer
[ 9.420109] cfg80211: Calling CRDA to update world regulatory domain
[ 9.433151] ambarella-sd e0002000.sdmmc0: Slot0 use bounce buffer[0x86720000<->0x06920000]
[ 9.441440] ambarella-sd e0002000.sdmmc0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[ 9.450309] ambarella-sd e0002000.sdmmc0: Slot0 use ADMA
[ 9.526597] ambarella-sd e0002000.sdmmc0: 1 slots @ 24000000Hz
[ 9.532568] NET: Registered protocol family 2
[ 9.537710] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 9.544677] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 9.552087] TCP: Hash tables configured (established 1024 bind 1024)
[ 9.558499] TCP: reno registered
[ 9.561717] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 9.567560] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 9.573970] NET: Registered protocol family 1
[ 9.578628] RPC: Registered named UNIX socket transport module.
[ 9.584531] RPC: Registered udp transport module.
[ 9.589266] RPC: Registered tcp transport module.
[ 9.593950] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 9.600756] ambarella-adc e801d000.adc: Ambarella ADC driver init
[ 9.608557] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[ 9.614758] msgmni has been set to 207
[ 9.619809] NET: Registered protocol family 38
[ 9.624322] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 9.631855] io scheduler noop registered
[ 9.635762] io scheduler deadline registered
[ 9.640062] io scheduler cfq registered (default)
[ 9.645212] ambarella-fb ambarella-fb.0: ambfb_probe: use prealloc.
[ 9.651754] ambarella-fb ambarella-fb.0: probe p[320x240] v[320x480] c[16] b[0] l[1280] @ [0x00100000:0x00100000]!
[ 9.662435] e8005000.uart: ttyS0 at MMIO 0xe8005000 (irq = 9) is a ambuart
[ 9.670186] brd: module loaded
[ 9.675828] loop: module loaded
[ 9.679504] ambarella-nand e0001000.nand: hardware can only support [4] bit ecc
[ 9.686885]
[ 9.686885]
[ 9.686885] !!! in ambarella_nand_get_resource, 1873, soft_ecc is 0, ecc_bits is 0 !!!
[ 9.686885]
[ 9.701439] in ambarella_nand_init_chip, 1692
[ 9.705871] ambarella-nand e0001000.nand: ###in ecc-[1]bit mode,however,hardware can only support [4] bit
[ 9.715538] ambarella_nand: Use On Flash BBT
[ 9.719882] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD/Spansion NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[ 9.732527] Bad block table found at page 65472, version 0x01
[ 9.738438] Bad block table found at page 65408, version 0x01
[ 9.744404] 8 ofpart partitions found on MTD device amba_nand
[ 9.750151] Creating 8 MTD partitions on "amba_nand":
[ 9.755185] 0x000000000000-0x000000020000 : "bst"
[ 9.760645] 0x000000020000-0x000000160000 : "bld"
[ 9.765978] 0x000000160000-0x0000002a0000 : "ptb"
[ 9.771349] 0x0000002a0000-0x0000012a0000 : "pba"
[ 9.776729] 0x0000012a0000-0x000001aa0000 : "pri"
[ 9.782072] 0x000001aa0000-0x000004aa0000 : "lnx"
[ 9.787506] 0x000004aa0000-0x0000050a0000 : "add"
[ 9.792869] 0x0000050a0000-0x000007ca0000 : "adc"
[ 9.798757] ambarella-spi e0020000.spi: Ambarella spi controller 0 created.
[ 9.856542] libphy: Ambarella MII Bus: probed
[ 9.861380] ambarella-eth e000e000.ethernet: Ethernet PHY[0]: 0x001cc816!
[ 9.868708] ambarella-eth e000e000.ethernet: MAC Address[5a:b5:61:0f:2c:26].
[ 9.875998] mousedev: PS/2 mouse device common for all mice
[ 9.881916] ambarella-rtc e8015000.rtc: rtc core: registered rtc-ambarella as rtc0
[ 9.889647] i2c /dev entries driver
[ 9.893752] ambarella-wdt e800c000.wdt: Ambarella Watchdog Timer Probed.
[ 9.900812] TCP: cubic registered
[ 9.904111] Initializing XFRM netlink socket
[ 9.908408] NET: Registered protocol family 17
[ 9.912907] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[ 9.920561] ThumbEE CPU extension supported.
[ 9.925959] UBI: attaching mtd5 to ubi0
[ 10.053064] UBI: scanning is finished
[ 10.062039] UBI: attached mtd5 (name "lnx", size 48 MiB) to ubi0
[ 10.068086] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 10.074850] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 10.081543] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 10.088405] UBI: good PEBs: 384, bad PEBs: 0, corrupted PEBs: 0
[ 10.094300] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[ 10.101421] UBI: max/mean erase counter: 4/0, WL threshold: 4096, image sequence number: 101050398
[ 10.110361] UBI: available PEBs: 0, total reserved PEBs: 384, PEBs reserved for bad PEB handling: 20
[ 10.119483] UBI: background thread "ubi_bgt0d" started, PID 43
[ 10.125330] ambarella-rtc e8015000.rtc: setting system clock to 2106-02-07 06:28:15 UTC (4294967295)
[ 10.135616] UBIFS: background thread "ubifs_bgt0_0" started, PID 44
[ 10.162005] UBIFS: recovery needed
[ 10.237173] UBIFS: recovery completed
[ 10.241024] UBIFS: mounted UBI device 0, volume 0, name "rootfs"
[ 10.247088] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 10.256197] UBIFS: FS size: 44441600 bytes (42 MiB, 350 LEBs), journal size 6348800 bytes (6 MiB, 50 LEBs)
[ 10.265840] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 10.270890] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 244ADC85-FB6B-4F9C-BF96-500F51B5CD76, small LPT model
[ 10.282379] VFS: Mounted root (ubifs filesystem) on device 0:12.
[ 10.289005] devtmpfs: mounted
[ 10.292138] Freeing unused kernel memory: 140K (804a5000 - 804c8000)
[ 10.304987] ambarella-nand e0001000.nand: nand_amb_request: dma_status=0x05000800, cmd=0xe, addr_hi=0x0, addr=0x3c79000, dst=0x0, buf=0x6a11000, len=0x800, area=0x2, ecc=0x2, block addr=0x3c60000!
[ 10.322509] UBI warning: ubi_io_read: error -74 (ECC error) while reading 60 bytes from PEB 270:104080, read only 60 bytes, retry
[ 10.334270] ambarella-nand e0001000.nand: nand_amb_request: dma_status=0x05000800, cmd=0xe, addr_hi=0x0, addr=0x3c79000, dst=0x0, buf=0x6a11000, len=0x800, area=0x2, ecc=0x2, block addr=0x3c60000!
[ 10.351763] UBI warning: ubi_io_read: error -74 (ECC error) while reading 60 bytes from PEB 270:104080, read only 60 bytes, retry
[ 10.363516] ambarella-nand e0001000.nand: nand_amb_request: dma_status=0x05000800, cmd=0xe, addr_hi=0x0, addr=0x3c79000, dst=0x0, buf=0x6a11000, len=0x800, area=0x2, ecc=0x2, block addr=0x3c60000!
[ 10.381002] UBI warning: ubi_io_read: error -74 (ECC error) while reading 60 bytes from PEB 270:104080, read only 60 bytes, retry
[ 10.392751] ambarella-nand e0001000.nand: nand_amb_request: dma_status=0x05000800, cmd=0xe, addr_hi=0x0, addr=0x3c79000, dst=0x0, buf=0x6a11000, len=0x800, area=0x2, ecc=0x2, block addr=0x3c60000!
[ 10.410234] UBI error: ubi_io_read: error -74 (ECC error) while reading 60 bytes from PEB 270:104080, read 60 bytes
[ 10.420659] CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.73 #1
[ 10.426508] [<800133ac>] (unwind_backtrace+0x0/0x12c) from [<80011a14>] (show_stack+0x10/0x14)
[ 10.435128] [<80011a14>] (show_stack+0x10/0x14) from [<8026bc58>] (ubi_io_read+0x13c/0x384)
[ 10.443478] [<8026bc58>] (ubi_io_read+0x13c/0x384) from [<80268f38>] (ubi_eba_read_leb+0x194/0x4e8)
[ 10.452515] [<80268f38>] (ubi_eba_read_leb+0x194/0x4e8) from [<80267c98>] (ubi_leb_read+0xcc/0x188)
[ 10.461555] [<80267c98>] (ubi_leb_read+0xcc/0x188) from [<8017c058>] (ubifs_leb_read+0x28/0x88)
[ 10.470247] [<8017c058>] (ubifs_leb_read+0x28/0x88) from [<8017e0f8>] (ubifs_read_node+0xac/0x304)
[ 10.479198] [<8017e0f8>] (ubifs_read_node+0xac/0x304) from [<801a0c18>] (ubifs_tnc_read_node+0x174/0x1fc)
[ 10.488756] [<801a0c18>] (ubifs_tnc_read_node+0x174/0x1fc) from [<8017f328>] (tnc_read_node_nm+0xc4/0x1dc)
[ 10.498401] [<8017f328>] (tnc_read_node_nm+0xc4/0x1dc) from [<80182104>] (ubifs_tnc_locate+0x19c/0x1e8)
[ 10.507783] [<80182104>] (ubifs_tnc_locate+0x19c/0x1e8) from [<80182874>] (ubifs_tnc_lookup_nm+0x38/0x21c)
[ 10.517436] [<80182874>] (ubifs_tnc_lookup_nm+0x38/0x21c) from [<80174748>] (ubifs_lookup+0xc4/0x290)
[ 10.526654] [<80174748>] (ubifs_lookup+0xc4/0x290) from [<800b0014>] (lookup_real+0x20/0x4c)
[ 10.535075] [<800b0014>] (lookup_real+0x20/0x4c) from [<800b0dbc>] (__lookup_hash+0x34/0x3c)
[ 10.543507] [<800b0dbc>] (__lookup_hash+0x34/0x3c) from [<800b13c8>] (lookup_slow+0x38/0xa4)
[ 10.551939] [<800b13c8>] (lookup_slow+0x38/0xa4) from [<800b1fe4>] (link_path_walk+0x30c/0x9ac)
[ 10.560632] [<800b1fe4>] (link_path_walk+0x30c/0x9ac) from [<800b4884>] (path_openat.isra.61+0x84/0x468)
[ 10.570103] [<800b4884>] (path_openat.isra.61+0x84/0x468) from [<800b5a64>] (do_filp_open+0x2c/0x88)
[ 10.579227] [<800b5a64>] (do_filp_open+0x2c/0x88) from [<800ac22c>] (open_exec+0x34/0x114)
[ 10.587487] [<800ac22c>] (open_exec+0x34/0x114) from [<800ef338>] (load_elf_binary+0x6b8/0x13d4)
[ 10.596251] [<800ef338>] (load_elf_binary+0x6b8/0x13d4) from [<800aca0c>] (search_binary_handler+0x98/0x2ec)
[ 10.606067] [<800aca0c>] (search_binary_handler+0x98/0x2ec) from [<800adf34>] (do_execve+0x44c/0x4e0)
[ 10.615289] [<800adf34>] (do_execve+0x44c/0x4e0) from [<80378a88>] (kernel_init+0xa0/0x154)
[ 10.623641] [<80378a88>] (kernel_init+0xa0/0x154) from [<8000ed58>] (ret_from_fork+0x14/0x3c)
[ 10.633064] UBIFS error (pid 1): ubifs_check_node: bad CRC: calculated 0x24546655, read 0x66f6c6ad
[ 10.642025] UBIFS error (pid 1): ubifs_check_node: bad node at LEB 315:99824
[ 10.649062] magic 0x6101831
[ 10.652703] crc 0x66f6c6ad
[ 10.656431] node_type 0 (inode node)
[ 10.660517] group_type 0 (no node group)
[ 10.664850] sqnum 67128807
[ 10.668414] len 160
[ 10.671537] key (1665, inode)
[ 10.675523] creat_sqnum 15499
[ 10.678828] size 6120
[ 10.682034] nlink 5
[ 10.684983] atime 1497516655.0
[ 10.688896] mtime 1479975337.0
[ 10.692796] ctime 1497516693.0
[ 10.696706] uid 0
[ 10.699652] gid 0
[ 10.702598] mode 16895
[ 10.705892] flags 0x1
[ 10.709024] xattr_cnt 0
[ 10.711969] xattr_size 0
[ 10.714916] xattr_names 0
[ 10.717874] compr_type 0x1
[ 10.720992] data len 0
[ 10.723947] CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.73 #1
[ 10.729791] [<800133ac>] (unwind_backtrace+0x0/0x12c) from [<80011a14>] (show_stack+0x10/0x14)
[ 10.738401] [<80011a14>] (show_stack+0x10/0x14) from [<8017c788>] (ubifs_check_node+0x1d8/0x2e0)
[ 10.747179] [<8017c788>] (ubifs_check_node+0x1d8/0x2e0) from [<8017e134>] (ubifs_read_node+0xe8/0x304)
[ 10.756463] [<8017e134>] (ubifs_read_node+0xe8/0x304) from [<801a0c18>] (ubifs_tnc_read_node+0x174/0x1fc)
[ 10.766021] [<801a0c18>] (ubifs_tnc_read_node+0x174/0x1fc) from [<80182124>] (ubifs_tnc_locate+0x1bc/0x1e8)
[ 10.775751] [<80182124>] (ubifs_tnc_locate+0x1bc/0x1e8) from [<80179118>] (ubifs_iget+0xbc/0x890)
[ 10.784622] [<80179118>] (ubifs_iget+0xbc/0x890) from [<801747e0>] (ubifs_lookup+0x15c/0x290)
[ 10.793146] [<801747e0>] (ubifs_lookup+0x15c/0x290) from [<800b0014>] (lookup_real+0x20/0x4c)
[ 10.801667] [<800b0014>] (lookup_real+0x20/0x4c) from [<800b0dbc>] (__lookup_hash+0x34/0x3c)
[ 10.810099] [<800b0dbc>] (__lookup_hash+0x34/0x3c) from [<800b13c8>] (lookup_slow+0x38/0xa4)
[ 10.818531] [<800b13c8>] (lookup_slow+0x38/0xa4) from [<800b1fe4>] (link_path_walk+0x30c/0x9ac)
[ 10.827224] [<800b1fe4>] (link_path_walk+0x30c/0x9ac) from [<800b4884>] (path_openat.isra.61+0x84/0x468)
[ 10.836697] [<800b4884>] (path_openat.isra.61+0x84/0x468) from [<800b5a64>] (do_filp_open+0x2c/0x88)
[ 10.845808] [<800b5a64>] (do_filp_open+0x2c/0x88) from [<800ac22c>] (open_exec+0x34/0x114)
[ 10.854067] [<800ac22c>] (open_exec+0x34/0x114) from [<800ef338>] (load_elf_binary+0x6b8/0x13d4)
[ 10.862844] [<800ef338>] (load_elf_binary+0x6b8/0x13d4) from [<800aca0c>] (search_binary_handler+0x98/0x2ec)
[ 10.872662] [<800aca0c>] (search_binary_handler+0x98/0x2ec) from [<800adf34>] (do_execve+0x44c/0x4e0)
[ 10.881880] [<800adf34>] (do_execve+0x44c/0x4e0) from [<80378a88>] (kernel_init+0xa0/0x154)
[ 10.890231] [<80378a88>] (kernel_init+0xa0/0x154) from [<8000ed58>] (ret_from_fork+0x14/0x3c)
[ 10.898742] UBIFS error (pid 1): ubifs_read_node: expected node type 0
[ 10.905249] UBIFS error (pid 1): ubifs_iget: failed to read inode 1665, error -117
[ 10.912821] UBIFS error (pid 1): ubifs_lookup: dead directory entry 'lib', error -117
[ 10.920643] UBIFS warning (pid 1): ubifs_ro_mode: switched to read-only mode, error -117
[ 10.928723] CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.73 #1
[ 10.934550] [<800133ac>] (unwind_backtrace+0x0/0x12c) from [<80011a14>] (show_stack+0x10/0x14)
[ 10.943161] [<80011a14>] (show_stack+0x10/0x14) from [<8017488c>] (ubifs_lookup+0x208/0x290)
[ 10.951596] [<8017488c>] (ubifs_lookup+0x208/0x290) from [<800b0014>] (lookup_real+0x20/0x4c)
[ 10.960115] [<800b0014>] (lookup_real+0x20/0x4c) from [<800b0dbc>] (__lookup_hash+0x34/0x3c)
[ 10.968547] [<800b0dbc>] (__lookup_hash+0x34/0x3c) from [<800b13c8>] (lookup_slow+0x38/0xa4)
[ 10.976978] [<800b13c8>] (lookup_slow+0x38/0xa4) from [<800b1fe4>] (link_path_walk+0x30c/0x9ac)
[ 10.985656] [<800b1fe4>] (link_path_walk+0x30c/0x9ac) from [<800b4884>] (path_openat.isra.61+0x84/0x468)
[ 10.995126] [<800b4884>] (path_openat.isra.61+0x84/0x468) from [<800b5a64>] (do_filp_open+0x2c/0x88)
[ 11.004249] [<800b5a64>] (do_filp_open+0x2c/0x88) from [<800ac22c>] (open_exec+0x34/0x114)
[ 11.012505] [<800ac22c>] (open_exec+0x34/0x114) from [<800ef338>] (load_elf_binary+0x6b8/0x13d4)
[ 11.021281] [<800ef338>] (load_elf_binary+0x6b8/0x13d4) from [<800aca0c>] (search_binary_handler+0x98/0x2ec)
[ 11.031098] [<800aca0c>] (search_binary_handler+0x98/0x2ec) from [<800adf34>] (do_execve+0x44c/0x4e0)
[ 11.040312] [<800adf34>] (do_execve+0x44c/0x4e0) from [<80378a88>] (kernel_init+0xa0/0x154)
[ 11.048661] [<80378a88>] (kernel_init+0xa0/0x154) from [<8000ed58>] (ret_from_fork+0x14/0x3c)
[ 11.057273] Failed to execute /linuxrc. Attempting defaults...
[ 11.065566] ambarella-nand e0001000.nand: nand_amb_request: dma_status=0x05000800, cmd=0xe, addr_hi=0x0, addr=0x3c79000, dst=0x0, buf=0x6a11000, len=0x800, area=0x2, ecc=0x2, block addr=0x3c60000!
[ 11.083097] UBI warning: ubi_io_read: error -74 (ECC error) while reading 160 bytes from PEB 270:103920, read only 160 bytes, retry
[ 11.095041] ambarella-nand e0001000.nand: nand_amb_request: dma_status=0x05000800, cmd=0xe, addr_hi=0x0, addr=0x3c79000, dst=0x0, buf=0x6a11000, len=0x800, area=0x2, ecc=0x2, block addr=0x3c60000!
[ 11.112651] UBI warning: ubi_io_read: error -74 (ECC error) while reading 160 bytes from PEB 270:103920, read only 160 bytes, retry
[ 11.124593] ambarella-nand e0001000.nand: nand_amb_request: dma_status=0x05000800, cmd=0xe, addr_hi=0x0, addr=0x3c79000, dst=0x0, buf=0x6a11000, len=0x800, area=0x2, ecc=0x2, block addr=0x3c60000!
[ 11.142086] UBI warning: ubi_io_read: error -74 (ECC error) while reading 160 bytes from PEB 270:103920, read only 160 bytes, retry
[ 11.154012] ambarella-nand e0001000.nand: nand_amb_request: dma_status=0x05000800, cmd=0xe, addr_hi=0x0, addr=0x3c79000, dst=0x0, buf=0x6a11000, len=0x800, area=0x2, ecc=0x2, block addr=0x3c60000!
[ 11.171496] UBI error: ubi_io_read: error -74 (ECC error) while reading 160 bytes from PEB 270:103920, read 160 bytes
[ 11.182094] CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.73 #1
[ 11.187950] [<800133ac>] (unwind_backtrace+0x0/0x12c) from [<80011a14>] (show_stack+0x10/0x14)
[ 11.196566] [<80011a14>] (show_stack+0x10/0x14) from [<8026bc58>] (ubi_io_read+0x13c/0x384)
[ 11.204898] [<8026bc58>] (ubi_io_read+0x13c/0x384) from [<80268f38>] (ubi_eba_read_leb+0x194/0x4e8)
[ 11.213937] [<80268f38>] (ubi_eba_read_leb+0x194/0x4e8) from [<80267c98>] (ubi_leb_read+0xcc/0x188)
[ 11.222975] [<80267c98>] (ubi_leb_read+0xcc/0x188) from [<8017c058>] (ubifs_leb_read+0x28/0x88)
[ 11.231668] [<8017c058>] (ubifs_leb_read+0x28/0x88) from [<8017f4c8>] (fallible_read_node+0x88/0x2fc)
[ 11.240880] [<8017f4c8>] (fallible_read_node+0x88/0x2fc) from [<8018206c>] (ubifs_tnc_locate+0x104/0x1e8)
[ 11.250435] [<8018206c>] (ubifs_tnc_locate+0x104/0x1e8) from [<80179118>] (ubifs_iget+0xbc/0x890)
[ 11.259308] [<80179118>] (ubifs_iget+0xbc/0x890) from [<801747e0>] (ubifs_lookup+0x15c/0x290)
[ 11.267833] [<801747e0>] (ubifs_lookup+0x15c/0x290) from [<800b0014>] (lookup_real+0x20/0x4c)
[ 11.276340] [<800b0014>] (lookup_real+0x20/0x4c) from [<800b0dbc>] (__lookup_hash+0x34/0x3c)
[ 11.284772] [<800b0dbc>] (__lookup_hash+0x34/0x3c) from [<800b13c8>] (lookup_slow+0x38/0xa4)
[ 11.293204] [<800b13c8>] (lookup_slow+0x38/0xa4) from [<800b1fe4>] (link_path_walk+0x30c/0x9ac)
[ 11.301898] [<800b1fe4>] (link_path_walk+0x30c/0x9ac) from [<800b4884>] (path_openat.isra.61+0x84/0x468)
[ 11.311370] [<800b4884>] (path_openat.isra.61+0x84/0x468) from [<800b5a64>] (do_filp_open+0x2c/0x88)
[ 11.320493] [<800b5a64>] (do_filp_open+0x2c/0x88) from [<800ac22c>] (open_exec+0x34/0x114)
[ 11.328753] [<800ac22c>] (open_exec+0x34/0x114) from [<800ef338>] (load_elf_binary+0x6b8/0x13d4)
[ 11.337530] [<800ef338>] (load_elf_binary+0x6b8/0x13d4) from [<800aca0c>] (search_binary_handler+0x98/0x2ec)
[ 11.347346] [<800aca0c>] (search_binary_handler+0x98/0x2ec) from [<800adf34>] (do_execve+0x44c/0x4e0)
[ 11.356568] [<800adf34>] (do_execve+0x44c/0x4e0) from [<80378ac4>] (kernel_init+0xdc/0x154)
[ 11.364905] [<80378ac4>] (kernel_init+0xdc/0x154) from [<8000ed58>] (ret_from_fork+0x14/0x3c)
[ 11.373424] UBIFS error (pid 1): ubifs_leb_read: reading 160 bytes from LEB 315:99824 failed, error -74
[ 11.382804] CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.73 #1
Seems I need to find a way to restore the NAND read-error.... Any suggestions?
Found a very descriptive post that is very promising. Next step is to try to boot using the amanda boot password plaintext string "ipc.fos~"
BeantwoordenVerwijderenI decrypted the software using this post
https://northwave-security.com/blog-abusing-ip-cameras-for-red-teaming/