Swann DVR (security camera recorder) bricked after firmware update (Fixed) - Page 1
Forum section: electronics / repair

author: poot36
author_rank: Frequent Contributor
timestamp: March 27, 2021, 08:24:19 pm
content: I have a Swann DVR model swdvr-44000H / DVR4-4000 that I found a firmware update from this link:https://www.swann.com/downloads/drivers/DVR_4000/GA1.9/I selected the DVR4-4000_GA1.9_1025.pak file and it updated and booted normally. I then found by going back a link and to this link:https://www.swann.com/downloads/drivers/DVR_4000/GA2.0/a newer (or what I thought) version of the firmware here DVR4-4000.0118.759.676.10.2.nor.sw.S300.pak and it installed but when the unit rebooted it never fully booted up (no screen output and the blue remote activity indicator light on the front never de illuminated). What would I have to do to unbrick the unit? I did find it a bit odd with the first successful firmware update that the USB drive that I used to install the update with was giving me an error about unable to mount the file system and I had to use another one to install the (newer) update that bricked the unit. The motherboard has the markings TCBB02 V140 2012-04-07 and the sub board with the CPU on it has these markings TCCB01_V110 2012-03-09. I think this unit runs Linux but I am unsure. Can send pictures if needed.

author: ttx450
author_rank: Regular Contributor
timestamp: March 27, 2021, 10:07:41 pm
content: I accidentally bricked a dsl modem/router/w-wireless. spent many calls / time trying to undo with company, no luck. It's good for australia, canada and maybe others - ebay item. The wireless I think I can get to work with my network, have not tried. sitting on the shelve for the last several years.

author: poot36
author_rank: Frequent Contributor
timestamp: March 28, 2021, 01:23:25 am
content: Well I found the serial port and all I get out of it is a repeating string of CCCC's. I think the uboot firmware has been bricked. Is there any way to use an Arduino UNO to fix the NAND flash by writing to it?

author: rsjsouza
author_rank: Super Contributor
timestamp: March 28, 2021, 02:36:51 am
content: CCCC is typically the ROM bootloader testing the line, so an external host can respond and perform a serial boot. Depending on the device on the board, there is a chance its manufacturer will have the procedure documented somewhere. Then, locate a valid firmware (probably a.bin file) then there is a chance the box will boot normally.If this is a linux-based device, you will probably need to check the status of the flash before the kernel boots - you need to halt at the u-boot phase to erase and write flash, etc. But at this point anything is heavily dependent on the device in question.

author: amyk
author_rank: Super Contributor
timestamp: March 28, 2021, 03:17:06 am
content: If you can locate the chip that holds the firmware and have a way of reading/writing it, you may be able to fix this.

author: poot36
author_rank: Frequent Contributor
timestamp: March 28, 2021, 10:02:31 pm
content: Ok, after some more research I have found that this CPU board is in a China ST DVR-1604 unit that supports 16 channels of recording. My unit only supports 4 so is missing some of the decoder chips. At the bottom of this translated post there are some pictures of what the CPU board looks like with all 4 decoder chips installed (mine only has the one on the top of the PCB by the crystal)https://translate.google.com/translate?hl=en&sl=ru&u=https://monitor.net.ru/forum/threads/585570/page-3&prev=search&pto=auenot sure if this is helpful or not. And about halfway down this post:https://translate.google.com/translate?hl=en&sl=ru&u=http://monitor.espec.ws/section8/printview288201.html&prev=search&pto=aueit mentions that the CCCC message I am seeing is somehow related to corrupt or missing NAND (search for CCCCC on the page and you will find it). I am starting to think that I may be screwed unless I can directly access the NAND chip.

author: rsjsouza
author_rank: Super Contributor
timestamp: March 28, 2021, 10:23:36 pm
content: Quote from: poot36 on March 28, 2021, 10:02:31 pmIt makes sense. If the processor can't find a valid image on the NAND Flash, its bootloader routine may or may not circle around several other boot modes (it could be SPI, Ethernet, etc.) or, what seems to be your case, lock on UART bootmode.One thing is that, depending on the image, it may have a u-boot in it that allows accessing, verifying, erasing and reprogramming the NAND Flash. You need, however, the device information itself.

author: dc101
author_rank: Regular Contributor
timestamp: March 28, 2021, 10:46:10 pm
content: Perhaps this is u-boot over UART?http://www.staroceans.org/e-book/AM335x_U-Boot_User%27s_Guide.html#Boot_Over_UARTI'm familiar with u-boot, but I've never booted over UART before. It looks like it's expecting u-boot-spl.bin for your specific architecture?I took a look at the update binary in the 2nd cramfs image in the firmware, but I haven't seen anything interesting so far. I was hoping maybe there would be something that pointed to alternate firmware update modes.Cheers-Tim

author: poot36
author_rank: Frequent Contributor
timestamp: April 03, 2021, 02:00:37 am
content: Well I did a bit of research into the UART booting and found this:http://web.archive.org/web/20210115021712if_/http://processors.wiki.ti.com/index.php/DM814x_AM387x_PSP_U-Boot#U-Boot-MIN_for_UART_bootand thishttps://www.xuebuyuan.com/2133280.html.Hopefully by downloading the files from here:https://software-dl.ti.com/dsps/dsps_public_sw/ezsdk/latest/index_FDS.htmlI can figure out how to make the U-Boot_Min for my board and load the correct firmware back onto it. I have very little experience with Linux so it will be an adventure that is for sure.

author: poot36
author_rank: Frequent Contributor
timestamp: April 04, 2021, 12:17:13 am
content: Not sure if anyone cares but here is the link to download the CodeSourcery version that the EZSDK installer needs:http://www.codesourcery.com/sgpp/lite/arm/portal/package4573/public/arm-none-linux-gnueabi/arm-2009q1-203-arm-none-linux-gnueabi.bin

author: rsjsouza
author_rank: Super Contributor
timestamp: April 04, 2021, 01:19:53 am
content: This is indeed a very old family of DaVinci devices... Something that I suspect there is no support anymore, unless you buy heaps of parts.The details escape me. I think the EZSDK has some documentation but the (now decomissioned) wiki is your friend here. That and some threads on the e2e support.Also, be sure to use the Ubuntu version used by the EZSDK, as many gremlins will appear if using something newer.Good luck in your journey.

author: poot36
author_rank: Frequent Contributor
timestamp: April 04, 2021, 03:48:08 am
content: Well after a lot of fighting with the VM, compiler errors and running out of space on the VM hard drive I got it to compile. If you get the compiler error make: arm-none-linux-gnueabi-gcc: Command not found you need to add these lines to your .bashrc file in your home directory /home/(User Name)/CodeSourcery/Sourcery_G++_Lite/bin and CROSS_COMPILE=arm-none-linux-gnueabi-. You should also check your permissions on the CodeSourcery and folder you installed the EZSDK to as that can also cause errors due to not being able to read or write to various files as needed. I have attached the u-boot.min.uart file to this post after I copied it out of the VM so that other people do not have to go through what I did to make the file (not sure if this will cause issues or not due to how Windows handles files). You should just have to take the .hex extension off the end of the file.

author: poot36
author_rank: Frequent Contributor
timestamp: April 04, 2021, 04:28:08 am
content: Well here is the results of 1st and 2nd stage boot:U-Boot 2010.06 (Apr 03 2021 - 21:26:14)TI8148-GP rev 2.1ARM clk: 600MHzDDR clk: 400MHzDRAM: 2 GiBUsing default environmentThe 2nd stage U-Boot will now be auto-loadedPlease do not interrupt the countdown till TI8148_EVM prompt if 2nd stage is already flashedHit any key to stop autoboot: 0TI-MIN#loadb 0x81000000## Ready for binary (kermit) download to 0x81000000 at 115200 bps...## Total Size = 0x000335e0 = 210400 Bytes## Start Addr = 0x81000000TI-MIN#go 0x81000000## Starting application at 0x81000000 ...U-Boot 2010.06 (Dec 26 2012 - 18:12:01)TI8148-GP rev 2.1ARM clk: 600MHzDDR clk: 400MHzI2C: readyDRAM: 2 GiBNAND: HW ECC BCH8 Selected128 MiBMMC: OMAP SD/MMC: 0ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.ECC: uncorrectable.*** Warning - bad CRC or NAND, using default environment.:;rrr;;.,5#@@@@#####@@@@@@#2,,A@@@hi;;;r5;;;;r;rrSG@@@A,r@@#i;:;s222hG;rrsrrrrrr;ri#@@r:@@hr:r;SG3ssrr2r;rrsrsrsrsrr;rh@@:B@H;;rr;3Hs;rrr;sr;;rrsrsrsrsrsr;;H@B@@s:rrs;5#;;rrrr;r#@H:;;rrsrsrsrsrr:s@@@@;;srs&X#9;r;r;;,2@@@rrr:;;rrsrsrsrr;;@@@@;;rrsrrs@MB#@@@@@###@@@@@@#rsrsrsrsrr;;@@G@r;rrsrsr;#X;SX25Ss#@@#M@#9H9rrsrsrsrsrs;r@G@9:srsrsrs;2@;:;;:.X@@@@@H::;rrsrsrsrsrsrr:3@X@;rrsrsrsrr;XAi;;:&@@#@Bs:rrsrsrsrsrsrsrsrr;@X@#;rsrsrsrsrr;r2ir@@@###::rrsrsrsrsrsrsrsrsr:@@@A:rrsrsrsrr;:2@29@@M@@@;:;rrrrsrsrsrsrsrsrs;H@@&;rsrsrsrr;A@@@@@@###@@@s::;:;;rrsrsrsrsrsr;G@@#:rrsrsrsr;G@5Hr25@@@#@@@#9XG9s:rrrrsrsrsrs:#@M@;rsrsrsrs;r@&#;::S@@@@@@@M@@@@Grr:;rsrsrsr;@#:@s;rsrsrsrr:M#Msrr;;&#@@@@@@@@@@H@@5;rsrsr;s@,@@:rrsrsrsr;S@rrrsr;:;r3MH@@#@M5,S@@irrsrr:@@@A:rrsrsrsrrrrrsrsrrr;::;@##@r:;rH@h;srr:H@;@9:rrsrsrsrrrsrsrsrsr;,S@Hi@i:;s;MX;rr:h@;r@B:rrrrsrsrsrsrsrr;;sA@#i,i@h;r;S5;r:H@r,@@r;rrrsrsrsrsrr;2BM3r:;r:G@:rrr;;r@@,B@Mr;rrrrsrsrsr@@S;;;rrr:5M;rr;rM@H.@@@i;;rrrrsrs2i;rrrrr;r@M:;i@@@..A@@#5r;;;r;;;rrr;r:r#AsM@@H.;&@@@@MhXS5i5SX9B@@@@G;:ihM#@@@@@##hs,Net: <ethaddr> not set. Reading from E-fuseDetected MACID:0:17:eb:ed:11:5acpswHit any key to stop autoboot: 0Card did not respond to voltage select!** Can't read from device 0 **** Unable to use mmc 0:1 for fatload **In case ENV on MMC/SD is requiredPlease put a valid script named boot.scr on the cardRefer to the User Guide on how to generate the imageTI8148_EVM#If you type help you get this list of commands:? - alias for 'help'base - print or set address offsetbdinfo - print Board Info structurebmp - manipulate BMP image databoot - boot default, i.e., run 'bootcmd'bootd - boot default, i.e., run 'bootcmd'bootm - boot application image from memorybootp - boot image via network using BOOTP/TFTP protocolcmp - memory compareconinfo - print console devices and informationcp - memory copycrc32 - checksum calculationdcache - enable or disable data cachedhcp - boot image via network using DHCP/TFTP protocolecho - echo args to consoleeditenv - edit environment variableexit - exit scriptfalse - do nothing, unsuccessfullyfatinfo - print information about filesystemfatload - load binary file from a dos filesystemfatls - list files in a directory (default /)go - start application at address 'addr'help - print command description/usagei2c - I2C sub-systemicache - enable or disable instruction cacheiminfo - print header information for application imageimxtract- extract a part of a multi-imageitest - return true/false on integer compareloadb - load binary file over serial line (kermit mode)loads - load S-Record file over serial lineloady - load binary file over serial line (ymodem mode)loop - infinite loop on address rangemd - memory displaymm - memory modify (auto-incrementing address)mmc - MMC sub systemmmcinfo - mmcinfo <dev num>-- display MMC infomtest - simple RAM read/write testmw - memory write (fill)nand - NAND sub-systemnandecc - Switch NAND ECC calculation algorithm b/w hardware and softwarenboot - boot from NAND devicenfs - boot image via network using NFS protocolnm - memory modify (constant address)ping - send ICMP ECHO_REQUEST to network hostprintenv- print environment variablesrarpboot- boot image via network using RARP/TFTP protocolreset - Perform RESET of the CPUrun - run commands in an environment variablesaveenv - save environment variables to persistent storagesetenv - set environment variablessf - SPI flash sub-systemshowvar - print local hushshell variablessleep - delay execution for some timesource - run script from memorytest - minimal test like /bin/shtftpboot- boot image via network using TFTP protocoltrue - do nothing, successfullyversion - print monitor versionI think I should be able to somehow fix this over the network.

author: rsjsouza
author_rank: Super Contributor
timestamp: April 04, 2021, 09:12:53 am
content: Good progress. Deslite slow, having u-boot is a great thing as you can tell the surrounding hardware is working well for the most part. Obviously that your NAND seems to be indeed shot - not an uncommon scenario.If the Ethernet is working well, then you can load the uImage kernel from TFTP and the filesystem from an NFS share - be prepared for one more round of wrenching with Linux to configure these two services. Also, you will need a sequence of commands to be passed to u-boot - there is a page on the wiki named Teraterm scripts (or something similar) that has some ready-to-run u-boot scripts for several boards - I think DM814x is there as well. Otherwise, you can check the setup program of the EZSDK and configure it for NFS boot - it should create a minicom script for the sequence of commands/parameters for u-boot there.I don't remember if the EZSDK user's guide has this information as well but, with the wiki out of commission, things become a lot harder to browse (I still can't believe why they killed this, but oh well...)

author: poot36
author_rank: Frequent Contributor
timestamp: April 11, 2021, 11:46:08 pm
content: I have made some headway, I have managed to dump 2Kb of the NAND over the serial terminal using the nand dump 0 command. This has dumped page 00000000 from the NAND at what I presume is the start of the flash. I have found that if you increment it by the hex value 800 you get to the next 2Kb block of data. Now that I know that I can try and figure out where the u-boot code starts and where the file system is. I have attached the first 2Kb dump of the NAND to this post and have found that it matches the incorrect firmware .pak file starting at hex address 4F8. It would be great if all I have to do is dump a modified .pak file into the RAM and then write it to the NAND and have the unit boot.

author: poot36
author_rank: Frequent Contributor
timestamp: April 12, 2021, 02:39:54 am
content: Well here is what I got from what I think is the 2nd stage u-boot that I extracted from the correct .pak firmware file:## Starting application at 0x81000000 ...U-Boot 2010.06 (Jun 07 2012 - 16:12:09)TI8148-GP rev 2.1ARM clk: 720MHzDDR clk: 400MHzIVA clk: 321MHzISS clk: 400MHzDSS clk: 200MHzDSP clk: 600MHzI2C: readyDRAM: 1 GiBNAND: HW ECC Hamming Code selected128 MiB*** Warning - bad CRC or NAND, using default environment_____ ___ _ _____ _ _ _ _ ___ __ _| _ \ / | | | / ___| | | | | | | | | / | | \ | || |_| | / /| | | | | | | |_| | | | | | / /| | | \| || _ { / / | | | | | | | _ | | | | | / / | | | |\ || |_| | / / | | | | | |___ | | | | | |_| | / / | | | | \ ||_____/ /_/ |_| |_| \_____| |_| |_| \_____/ /_/ |_| |_| \_|MMC: OMAP SD/MMC: 0Net: <ethaddr> not set. Reading from E-fuseDetected MACID:0:17:eb:ed:11:5acpswHit any key to stop autoboot: 0NAND read: device 0 offset 0x1ee0000, size 0x2000002097152 bytes read: OKchange to 400K for i2cNAND read: device 0 offset 0x280000, size 0x3000003145728 bytes read: OK## Booting kernel from Legacy Image at 81000000 ...Image Name: Linux-2.6.37Image Type: ARM Linux Kernel Image (uncompressed)Data Size: 2700532 Bytes = 2.6 MiBLoad Address: 80008000Entry Point: 80008000Verifying Checksum ... OKLoading Kernel Image ... OKOKStarting kernel ...Uncompressing Linux... done, booting the kernel.Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #11 Tue Jan 15 14:52:00 CST 2013CPU: ARMv7 Processor  revision 2 (ARMv7), cr=10c53c7fCPU: VIPT nonaliasing data cache, VIPT aliasing instruction cacheMachine: ti8148evmbootconsole  enabledti81xx_reserve: ### Reserved DDR region @87f00000reserved size = 52428800 at 0x0FB: Reserving 52428800 bytes SDRAM for VRAMMemory policy: ECC disabled, Data cache writebackOMAP chip is TI8148 2.1SRAM: Mapped pa 0x402f1000 to va 0xfe400000 size: 0xf000Built 1 zonelists in Zone order, mobility grouping on. Total pages: 19456Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400PID hash table entries: 512 (order: -1, 2048 bytes)Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)Memory: 76MB 1MB = 77MB totalMemory: 71852k/71852k available, 59220k reserved, 0K highmemVirtual kernel memory layout:vector : 0xffff0000 - 0xffff1000 ( 4 kB)fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)DMA : 0xffc00000 - 0xffe00000 ( 2 MB)vmalloc : 0xc8800000 - 0xf8000000 ( 760 MB)lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)modules : 0xbf000000 - 0xbfe00000 ( 14 MB).init : 0xc0008000 - 0xc0042000 ( 232 kB).text : 0xc0042000 - 0xc051f000 (4980 kB).data : 0xc0520000 - 0xc056d280 ( 309 kB)SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1NR_IRQS:407omap_hwmod: gpio1: softreset failed (waited 10000 usec)omap_hwmod: gpio2: softreset failed (waited 10000 usec)omap_hwmod: gpio3: softreset failed (waited 10000 usec)omap_hwmod: gpio4: softreset failed (waited 10000 usec)IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interruptsTotal of 128 interrupts on 1 active controllerGPMC revision 6.0Trying to install interrupt handler for IRQ400Trying to install interrupt handler for IRQ401Trying to install interrupt handler for IRQ402Trying to install interrupt handler for IRQ403Trying to install interrupt handler for IRQ404Trying to install interrupt handler for IRQ405Trying to install interrupt handler for IRQ406Trying to install type control for IRQ407Trying to set irq flags for IRQ407OMAP clockevent source: GPTIMER1 at 20000000 HzConsole: colour dummy device 80x30Calibrating delay loop... 598.01 BogoMIPS (lpj=2990080)pid_max: default: 32768 minimum: 301Security Framework initializedMount-cache hash table entries: 512CPU: Testing write buffer coherency: okdevtmpfs: initializedTI81XX: Map 0x87f00000 to 0xfe500000 for dram barrierTI81XX: Map 0x40300000 to 0xfe600000 for sram barrieromap_voltage_early_init: voltage driver support not addedregulator: core version 0.5regulator: dummy:NET: Registered protocol family 16omap_voltage_domain_lookup: Voltage driver init not yet happened.Faulting!omap_voltage_add_dev: VDD specified does not exist!OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1ti8148_evm_init: LIXUEQIANG failed to request GPIO for TSC IRQomap_mux_init: Add partition: #1: core, flags: 4_omap_mux_init_gpio: Could not set gpio38NOR: Can't request GPMC CSti814x_sata_pllcfg: LIXUEQIANG (cpu_is_ti814x()) && (!cpu_is_dm385()))clk get on i2c3 fck failedCannot clk_get ck_32omap2_init_devices: LIXUEQIANG begin 8Debugfs: Only enabling/disabling deep sleep and wakeup timer is supported nowregistered ti81xx_vpss deviceregistered ti81xx_vidout deviceregistered ti81xx on-chip HDMI deviceregistered ti81xx_fb deviceregistered ti81xx_vin deviceti81xx_pcie: Invoking PCI BIOS...ti81xx_pcie: Setting up Host Controller...ti81xx_pcie: Register base mapped @0xc8820000ti81xx_pcie: Starting PCI scan...PCI: bus0: Fast back to back transfers enabledti81xx_pcie: PCI scan done.bio: create slab <bio-0> at 0vgaarb: loadedSCSI subsystem initializedusbcore: registered new interface driver usbfsusbcore: registered new interface driver hubusbcore: registered new device driver usbUSBSS revision 4ea2080bregisterd cppi-dma Intr @ IRQ 17Cppi41 Init Doneomap_i2c omap_i2c.1: bus 1 rev4.0 at 400 kHzI2C: Read failed at pcf8575_cir_enable 236 with error code: -121I2C: Transfer failed at pcf8575_cir_enable 243 with error code: -121tps65910 1-002d: read from reg 3f failedtps65910 1-002d: read from reg 1e failedset_machine_constraints: failed to enable VRTCtps65910 1-002d: failed to register tps65910-pmic regulatortps65910-pmic: probe of tps65910-pmic failed with error -121tps65910 1-002d: No interrupt support, no core IRQomap_i2c omap_i2c.3: bus 3 rev4.0 at 400 kHzAdvanced Linux Sound Architecture Driver Version 1.0.23.Switching to clocksource gp timermusb-hdrc: version 6.0, host, debug=0musb-hdrc musb-hdrc.0: dma type: dma-cppi41MUSB controller-0 revision 4ea20800usb2phy: computed values rxcalib(15)DACs(37 11 11)usb2phy: override computed values rxcalib(15)DACs(37 11 11)usb2phy_config: musb(0) rxcalib done, rxcalib read value 6f72d75emusb-hdrc musb-hdrc.0: MUSB HDRC host drivermusb-hdrc musb-hdrc.0: new USB bus registered, assigned bus number 1usb usb1: New USB device found, idVendor=1d6b, idProduct=0002usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1usb usb1: Product: MUSB HDRC host driverusb usb1: Manufacturer: Linux 2.6.37 musb-hcdusb usb1: SerialNumber: musb-hdrc.0hub 1-0:1.0: USB hub foundhub 1-0:1.0: 1 port detectedmusb-hdrc musb-hdrc.0: USB Host mode controller at c881e000 using DMA, IRQ 18musb-hdrc musb-hdrc.1: dma type: dma-cppi41MUSB controller-1 revision 4ea20800usb2phy: computed values rxcalib(15)DACs(38 13 14)usb2phy: override computed values rxcalib(15)DACs(38 13 14)usb2phy_config: musb(1) rxcalib done, rxcalib read value 6f735b76musb-hdrc musb-hdrc.1: MUSB HDRC host drivermusb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 2usb usb2: New USB device found, idVendor=1d6b, idProduct=0002usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1usb usb2: Product: MUSB HDRC host driverusb usb2: Manufacturer: Linux 2.6.37 musb-hcdusb usb2: SerialNumber: musb-hdrc.1hub 2-0:1.0: USB hub foundhub 2-0:1.0: 1 port detectedmusb-hdrc musb-hdrc.1: USB Host mode controller at c8826800 using DMA, IRQ 19NET: Registered protocol family 2IP route cache hash table entries: 1024 (order: 0, 4096 bytes)TCP established hash table entries: 4096 (order: 3, 32768 bytes)TCP bind hash table entries: 4096 (order: 2, 16384 bytes)TCP: Hash tables configured (established 4096 bind 4096)TCP reno registeredUDP hash table entries: 256 (order: 0, 4096 bytes)UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)NET: Registered protocol family 1RPC: Registered udp transport module.RPC: Registered tcp transport module.RPC: Registered tcp NFSv4.1 backchannel transport module.NetWinder Floating Point Emulator V0.97 (double precision)PMU: registered new PMU device of type 0omap-iommu omap-iommu.0: ducati registeredomap-iommu omap-iommu.1: sys registeredfuse init (API version 7.15)msgmni has been set to 140io scheduler noop registeredio scheduler deadline registeredio scheduler cfq registered (default)Serial: 8250/16550 driver, 4 ports, IRQ sharing enabledomap_uart.0: ttyO0 at MMIO 0x48020000 (irq = 72) is a OMAP UART0console  enabled, bootconsole disabledconsole  enabled, bootconsole disabledomap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5brd: module loadedloop: module loadedahci ahci.0: forcing PORTS_IMPL to 0x1ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform modeahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apstscsi0 : ahci_platformata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x100 irq 16omap2-nand driver initializingONFI flash detectedONFI param page 0 validNAND device: Maf ID: 0xad, Chip ID: 0xf1 (Hynix, NAND 128MiB 3,3V 8-bit)erasesize: 0x20000, writesize: 2048, oobsize: 64Creating 7 MTD partitions on "omap2-nand.0":0x000000000000-0x000000020000 : "U-Boot-min"0x000000020000-0x000000260000 : "U-Boot"0x000000260000-0x000000280000 : "U-Boot Env"0x000000280000-0x000000580000 : "U-Boot Logo"0x000000580000-0x0000009c0000 : "Kernel"0x0000009c0000-0x00000d1e0000 : "File System"mtd: partition "File System" extends beyond the end of device "omap2-nand.0" -- size truncated to 0x76400000x000008000000-0x000008000000 : "Reserved"mtd: partition "Reserved" is out of reach -- disableddavinci_mdio davinci_mdio.0: davinci mdio revision 1.6davinci_mdio davinci_mdio.0: detected phy mask fffffffddavinci_mdio.0: probeddavinci_mdio davinci_mdio.0: phy: device 0:01, driver unknownusbcore: registered new interface driver cdc_etherusbcore: registered new interface driver dm9601usbcore: registered new interface driver cdc_acmcdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adaptersInitializing USB Mass Storage driver...usbcore: registered new interface driver usb-storageUSB Mass Storage support registered.mice: PS/2 mouse device common for all miceqt602240_ts 1-004a: __qt602240_read_reg: i2c transfer failedqt602240_ts: probe of 1-004a failed with error -5omap_rtc omap_rtc: rtc core: registered omap_rtc as rtc0i2c /dev entries driverLinux video capture interface: v2.00usbcore: registered new interface driver uvcvideoUSB Video Class driver (v1.0.0)OMAP Watchdog Timer Rev 0x00: initial timeout 60 secusbcore: registered new interface driver usbhidusbhid: USB HID core drivernotify_init : notify drivercreated for remote proc id 2 at physical Address 0xbfd00000usbcore: registered new interface driver snd-usb-audiofunction cs4334_modinit,line:219Registered tvp5158 audio codecasoc: HDMI-DAI-CODEC <-> hdmi-dai mapping okALSA device list:#0: TI81XX SOUND1TCP cubic registeredNET: Registered protocol family 17Registering the dns_resolver key typeVFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3omap_voltage_late_init: Voltage driver support not addedPower Management for TI81XX.Detected MACID=0:17:eb:ed:11:5aomap_rtc omap_rtc: setting system clock to 2000-01-01 00:00:00 UTC (946684800)usb 1-1: new high speed USB device using musb-hdrc and address 2usb 1-1: New USB device found, idVendor=05e3, idProduct=0608usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0usb 1-1: Product: USB2.0 Hubhub 1-1:1.0: USB hub foundhub 1-1:1.0: 4 ports detectedusb 2-1: new high speed USB device using musb-hdrc and address 2usb 2-1: New USB device found, idVendor=05e3, idProduct=0718usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=2usb 2-1: Product: USB Storageusb 2-1: SerialNumber: 000000000033scsi1 : usb-storage 2-1:1.0scsi 1:0:0:0: Direct-Access USB TO I DE/SATA Device 0016 PQ: 0 ANSI: 4sd 1:0:0:0: Attached scsi generic sg0 type 0sd 1:0:0:0:  Attached SCSI diskata1: SATA link down (SStatus 0 SControl 300)cramfs_fill_nand blocks is 34List of all partitions:1f00 128 mtdblock0 (driver?)1f01 2304 mtdblock1 (driver?)1f02 128 mtdblock2 (driver?)1f03 3072 mtdblock3 (driver?)1f04 4352 mtdblock4 (driver?)1f05 121088 mtdblock5 (driver?)No filesystem could mount root, tried: cramfsKernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)Backtrace:[<c0050bf4>] (dump_backtrace+0x0/0x110) from [<c03d707c>] (dump_stack+0x18/0x1c)r7:c4814000 r6:c0079854 r5:c002fb94 r4:c056de90[<c03d7064>] (dump_stack+0x0/0x1c) from [<c03d70e0>] (panic+0x60/0x17c)[<c03d7080>] (panic+0x0/0x17c) from [<c00092b4>] (mount_block_root+0x1e0/0x220)r3:00000000 r2:00000020 r1:c4825f58 r0:c049ce8c[<c00090d4>] (mount_block_root+0x0/0x220) from [<c00093a0>] (mount_root+0xac/0xcc)[<c00092f4>] (mount_root+0x0/0xcc) from [<c0009530>] (prepare_namespace+0x170/0x1d4)r4:c056d2e4[<c00093c0>] (prepare_namespace+0x0/0x1d4) from [<c00087c4>] (kernel_init+0x114/0x154)r5:c00086b0 r4:c056d280[<c00086b0>] (kernel_init+0x0/0x154) from [<c0079854>] (do_exit+0x0/0x5e4)r5:c00086b0 r4:00000000I think it crashes due to the flash being messed up. I also extracted what I think is the u-boot-min.nand file as well. I have attached both these files to this post for you to look over and tell me what you think. It looks like the ASCII art did not fully copy correctly, what is says is baichuan.

author: poot36
author_rank: Frequent Contributor
timestamp: April 19, 2021, 02:18:43 am
content: More progress has been made. I have managed to extract the correct u-boot-min.nand file from the .pak file and have found that if I load it over serial when the unit is displaying CCCCC it will actually boot it and then start booting the u-boot that is on the NAND but crashes due to the u-boot being for a different processor. I have attached the corrected u-boot-min.nand and a potentially correct u-boot files to this post. The last boot log that I posted is for the incorrect kernel that was flashed onto the unit and that is why I suspect it does not fully boot. I am working on extracting the kernel out of the correct .pak file. I have been able to confirm that the kernel starts at hex address 0x280000 and the u-boot image (.bmp file) starts at hex address 0x1ee0000 in the NAND. u-boot-min.nand starts at hex address 0x0 and u-boot starts at hex address 0x20000. Not sure if that helps anyone.

author: dc101
author_rank: Regular Contributor
timestamp: April 19, 2021, 02:48:21 am
content: I recently ran into this same issue after modifying filesystems on several embedded devices, I ended up bricking them. After looking at the boot logs we determined that the most likely cause was a difference in the filesystem size compared to the Linux kernel command line arguments.However, in your case it appears the Linux kernel is trying to load rootfs from the wrong mtd partition:Code:Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400In this case loading from the mtdblock4, but looking at the partitions, it should be mtdblock5.Code:Creating 7 MTD partitions on "omap2-nand.0":0x000000000000-0x000000020000 : "U-Boot-min"0x000000020000-0x000000260000 : "U-Boot"0x000000260000-0x000000280000 : "U-Boot Env"0x000000280000-0x000000580000 : "U-Boot Logo"0x000000580000-0x0000009c0000 : "Kernel"0x0000009c0000-0x00000d1e0000 : "File System"mtd: partition "File System" extends beyond the end of device "omap2-nand.0" -- size truncated to 0x76400000x000008000000-0x000008000000 : "Reserved"...List of all partitions:1f00 128 mtdblock0 (driver?)1f01 2304 mtdblock1 (driver?)1f02 128 mtdblock2 (driver?)1f03 3072 mtdblock3 (driver?)1f04 4352 mtdblock4 (driver?)1f05 121088 mtdblock5 (driver?)So you are correct, this is the incorrect kernel. The kernel seems to be working though, so you might actually be able to just modify the kernel using a hex editor and change the rootfs partition from 4 to 5. Although that size truncated error is a bit suspect. Changing the 4 to a 5 in a hex editor won't change the size of the file, so it should still work fine. If you don't already have a favorite hex editor, I like HxD and 010 Editor, on Linux sometimes I'll use Bless in a pinch.I would try flashing the correct Linux kernel if you have it. You should be able to flash it using uboot, not all uboot images support networking though, so you may have to use ymodem or something.Good luck!Cheers-Tim

author: dc101
author_rank: Regular Contributor
timestamp: April 19, 2021, 03:35:34 am
content: It should be fairly straight forward to extract the kernel from the .pak file.Code:user@femto:~/re_projs/dvr4000$ binwalk DVR4-4000_GA1.9_1025.pakDECIMAL HEXADECIMAL DESCRIPTION--------------------------------------------------------------------------------78648 0x13338 CRC32 polynomial table, little endian255164 0x3E4BC CRC32 polynomial table, little endian433280 0x69C80 uImage header, header size: 64 bytes, header CRC: 0x4918710A, created: 2012-09-21 03:11:57, image size: 2662416 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x343FB2FF, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-2.6.37"449983 0x6DDBF gzip compressed data, maximum compression, from Unix, last modified: 2012-09-21 03:11:563095760 0x2F3CD0 CramFS filesystem, little endian, size: 8011776 version 2 sorted_dirs CRC 0xD8777123, edition 0, 4491 blocks, 1405 files11107536 0xA97CD0 CramFS filesystem, little endian, size: 8957952 version 2 sorted_dirs CRC 0x3CE298E8, edition 0, 6640 blocks, 746 files20065488 0x1322CD0 PC bitmap, Windows 3.x format,, 684 x 456 x 24The uImage wrapped kernel starts at 0x69C80 and goes to 0x2F3CD0, so extract with:Code:user@femto:~/re_projs/dvr4000$ dd if=DVR4-4000_GA1.9_1025.pak bs=1 skip=433280 count=2662480 of=uimage.binuser@femto:~/re_projs/dvr4000$ mkimage -l uimage.binImage Name: Linux-2.6.37Created: Thu Sep 20 23:11:57 2012Image Type: ARM Linux Kernel Image (uncompressed)Data Size: 2662416 Bytes = 2600.02 KiB = 2.54 MiBLoad Address: 80008000Entry Point: 80008000Strip off the uboot header:Code:user@femto:~/re_projs/dvr4000$ tail -c+65 < uimage.bin > zimage.binuser@femto:~/re_projs/dvr4000$ file zimage.binzimage.bin: Linux kernel ARM boot executable zImage (little-endian)user@femto:~/re_projs/dvr4000$Now you should be able to load zimage.bin in uboot (loadb/loady) and flash it using the nand subsystem commands (nand write)Cheers-Tim

author: poot36
author_rank: Frequent Contributor
timestamp: April 19, 2021, 03:40:57 am
content: I think I have already extracted the kernel under windows but I am not sure. I have attached what I think it is to this post.

author: dc101
author_rank: Regular Contributor
timestamp: April 19, 2021, 04:25:54 am
content: Your file does not appear to be the correct size.Code:user@femto:~/re_projs/dvr4000$ file Kernel.binKernel.bin: u-boot legacy uImage, Linux-2.6.37, Linux/ARM, OS Kernel Image (Not compressed), 2662416 bytes, Fri Sep 21 03:11:57 2012, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x4918710A, Data CRC: 0x343FB2The kernel should be 2662416 bytes. Comparing your Kernel.bin to the zimage.bin you can also see that Kernel.bin appears to contain some amount of the cramfs file system that follows the kernel image in the .pak file.Side note, .hex is usually reserved for ascii files that contain the ascii hex values of data to be flashed. Intel and Motorola are two popular formats, but they are also used for Atmel AVRs and PIC micros.https://en.wikipedia.org/wiki/Intel_HEX

author: dc101
author_rank: Regular Contributor
timestamp: April 19, 2021, 04:32:37 am
content: You can try flashing your kernel.hex file. The kernel mtd partition is 0x440000 bytes which works out to 4456448 decimal, so it should still fit without spilling over into the rootfs partition. You may have to strip of the 64 byte uImage header though, I'm not certain if it's supposed to be there or not.I would dump the first page of the kernel image flash space and see what the first 64 bytes look like. If they look like your kernel.hex, you should be good to go, otherwise you may need to remove the uImage header.Cheers-Tim

author: poot36
author_rank: Frequent Contributor
timestamp: April 20, 2021, 02:08:51 am
content: Here is the first 2Kb of data from address 0x280000 in the NAND (note this is the incorrect kernel so it may not match with what you have got from binwalk). Not sure if it is enough data to figure out where it ends though. I have had to add the hex extention to all files that I upload as the forum does not support odd file types. @dc101 The log file you are looking at is from the incorrect firmware so the file size mentioned may be wrong. I do know that the partition map is incorrect but oddly the u-boot file for for the incorrect firmware also references 0x280000 for booting the kernel but then also in the kernel boot assigns it to the u-boot logo. Very odd.

author: dc101
author_rank: Regular Contributor
timestamp: April 20, 2021, 02:39:45 am
content: Interesting, it does actually have the uImage header, so you should not remove it when you flash it.Code:user@femto:~/re_projs/dvr4000$ file nand_dump_280000.binnand_dump_280000.bin: u-boot legacy uImage, Linux-2.6.37, Linux/ARM, OS Kernel Image (Not compressed), 2700532 bytes, Tue Jan 15 06:52:04 2013, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0xE86EB12F, Data CRC: 0x38CEFF47user@femto:~/re_projs/dvr4000$ file uimage.binuimage.bin: u-boot legacy uImage, Linux-2.6.37, Linux/ARM, OS Kernel Image (Not compressed), 2662416 bytes, Fri Sep 21 03:11:57 2012, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x4918710A, Data CRC: 0x343FB2FFI understand the log file you posted was for the wrong kernel. The kernel size I mentioned was the one I extracted from the original firmware you posted in your first message, DVR4-4000_GA1.9_1025.pak.You should be fine flashing the kernel image you extracted. Linux shows the kernel size should be 2662416 bytes. I renamed it .bin on my system because it's a binary file and not ascii hex, .hex is used for ascii files, but this is the same file you posted.Code:user@femto:~/re_projs/dvr4000$ file Kernel.binKernel.bin: u-boot legacy uImage, Linux-2.6.37, Linux/ARM, OS Kernel Image (Not compressed), 2662416 bytes, Fri Sep 21 03:11:57 2012, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x4918710A, Data CRC: 0x343FB2FFuser@femto:~/re_projs/dvr4000$ ll Kernel.bin-rw------- 1 user user 3145728 Apr 19 00:06 Kernel.binAs I mentioned, you have some extra data at the end of the kernel image you attached to your previous post. It won't hurt anything since the file size is smaller than the Linux mtd kernel partition, but it would be safer to extract just the kernel and nothing more. The reason the count is larger that than the kernel size is to account for the 64 byte uImage kernel header.Code:dd if=DVR4-4000_GA1.9_1025.pak bs=1 skip=433280 count=2662480 of=uimage.binCheers-Tim

author: poot36
author_rank: Frequent Contributor
timestamp: April 20, 2021, 02:45:29 am
content: Well I got the kernel booting from RAM, here is the output (no video out of the device though):TI8148_EVM#bootm 0x81000000## Booting kernel from Legacy Image at 81000000 ...Image Name: Linux-2.6.37Image Type: ARM Linux Kernel Image (uncompressed)Data Size: 2662416 Bytes = 2.5 MiBLoad Address: 80008000Entry Point: 80008000Verifying Checksum ... OKLoading Kernel Image ... OKOKStarting kernel ...Uncompressing Linux... done, booting the kernel.Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #4 Fri Sep 21 11:11:53 CST 2012CPU: ARMv7 Processor  revision 2 (ARMv7), cr=10c53c7fCPU: VIPT nonaliasing data cache, VIPT aliasing instruction cacheMachine: ti8148evmreserved size = 52428800 at 0x0FB: Reserving 52428800 bytes SDRAM for VRAMMemory policy: ECC disabled, Data cache writebackOMAP chip is TI8148 2.0Built 1 zonelists in Zone order, mobility grouping on. Total pages: 19712Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400PID hash table entries: 512 (order: -1, 2048 bytes)Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)Memory: 78MB = 78MB totalMemory: 73032k/73032k available, 58040k reserved, 0K highmemVirtual kernel memory layout:vector : 0xffff0000 - 0xffff1000 ( 4 kB)fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)DMA : 0xffc00000 - 0xffe00000 ( 2 MB)vmalloc : 0xc8800000 - 0xf8000000 ( 760 MB)lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)modules : 0xbf000000 - 0xbfe00000 ( 14 MB).init : 0xc0008000 - 0xc003a000 ( 200 kB).text : 0xc003a000 - 0xc0506000 (4912 kB).data : 0xc0506000 - 0xc0547f80 ( 264 kB)SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1NR_IRQS:375omap_hwmod: gpio1: softreset failed (waited 10000 usec)omap_hwmod: gpio2: softreset failed (waited 10000 usec)omap_hwmod: gpio3: softreset failed (waited 10000 usec)omap_hwmod: gpio4: softreset failed (waited 10000 usec)IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interruptsTotal of 128 interrupts on 1 active controllerGPMC revision 6.0Trying to install interrupt handler for IRQ368Trying to install interrupt handler for IRQ369Trying to install interrupt handler for IRQ370Trying to install interrupt handler for IRQ371Trying to install interrupt handler for IRQ372Trying to install interrupt handler for IRQ373Trying to install interrupt handler for IRQ374Trying to install type control for IRQ375Trying to set irq flags for IRQ375OMAP clockevent source: GPTIMER1 at 20000000 HzConsole: colour dummy device 80x30Calibrating delay loop... 719.25 BogoMIPS (lpj=3596288)pid_max: default: 32768 minimum: 301Security Framework initializedMount-cache hash table entries: 512CPU: Testing write buffer coherency: okdevtmpfs: initializedomap_voltage_early_init: voltage driver support not addedregulator: core version 0.5regulator: dummy:NET: Registered protocol family 16OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1omap_mux_init: Add partition: #1: core, flags: 4registered ti814x_vpss deviceregistered TI814x on-chip HDMI deviceclk get on i2c3 fck failedregistered ti81xx_vidout deviceDebugfs: Only enabling/disabling deep sleep and wakeup timer is supported nowbio: create slab <bio-0> at 0SCSI subsystem initializedusbcore: registered new interface driver usbfsusbcore: registered new interface driver hubusbcore: registered new device driver usbregisterd cppi-dma Intr @ IRQ 17Cppi41 Init Doneomap_i2c omap_i2c.1: bus 1 rev4.0 at 100 kHzpcf857x: probe of 1-0021 failed with error -121omap_i2c omap_i2c.3: bus 3 rev4.0 at 400 kHzAdvanced Linux Sound Architecture Driver Version 1.0.23.Switching to clocksource gp timermusb-hdrc: version 6.0, host, debug=0musb-hdrc musb-hdrc.0: dma type: dma-cppi41musb-hdrc musb-hdrc.0: MUSB HDRC host drivermusb-hdrc musb-hdrc.0: new USB bus registered, assigned bus number 1usb usb1: New USB device found, idVendor=1d6b, idProduct=0002usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1usb usb1: Product: MUSB HDRC host driverusb usb1: Manufacturer: Linux 2.6.37 musb-hcdusb usb1: SerialNumber: musb-hdrc.0hub 1-0:1.0: USB hub foundhub 1-0:1.0: 1 port detectedmusb-hdrc musb-hdrc.0: USB Host mode controller at c881e000 using DMA, IRQ 18musb-hdrc musb-hdrc.1: dma type: dma-cppi41musb-hdrc musb-hdrc.1: MUSB HDRC host drivermusb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 2usb usb2: New USB device found, idVendor=1d6b, idProduct=0002usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1usb usb2: Product: MUSB HDRC host driverusb usb2: Manufacturer: Linux 2.6.37 musb-hcdusb usb2: SerialNumber: musb-hdrc.1hub 2-0:1.0: USB hub foundhub 2-0:1.0: 1 port detectedmusb-hdrc musb-hdrc.1: USB Host mode controller at c8828800 using DMA, IRQ 19NET: Registered protocol family 2IP route cache hash table entries: 1024 (order: 0, 4096 bytes)TCP established hash table entries: 4096 (order: 3, 32768 bytes)TCP bind hash table entries: 4096 (order: 2, 16384 bytes)TCP: Hash tables configured (established 4096 bind 4096)TCP reno registeredUDP hash table entries: 256 (order: 0, 4096 bytes)UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)NET: Registered protocol family 1RPC: Registered udp transport module.RPC: Registered tcp transport module.RPC: Registered tcp NFSv4.1 backchannel transport module.NetWinder Floating Point Emulator V0.97 (double precision)PMU: registered new PMU device of type 0omap-iommu omap-iommu.0: ducati registeredomap-iommu omap-iommu.1: sys registeredJFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.fuse init (API version 7.15)msgmni has been set to 142io scheduler noop registeredio scheduler deadline registeredio scheduler cfq registered (default)Serial: 8250/16550 driver, 4 ports, IRQ sharing enabledomap_uart.0: ttyO0 at MMIO 0x48020000 (irq = 72) is a OMAP UART0console  enabledomap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5brd: module loadedloop: module loadedahci ahci.0: forcing PORTS_IMPL to 0x1ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform modeahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apstscsi0 : ahci_platformata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x100 irq 16omap2-nand driver initializingONFI flash detectedONFI param page 0 validNAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)Creating 11 MTD partitions on "omap2-nand.0":0x000000000000-0x000000020000 : "U-Boot-min"0x000000020000-0x000000260000 : "U-Boot"0x000000260000-0x000000280000 : "U-Boot Env"0x000000280000-0x0000006c0000 : "Kernel"0x0000006c0000-0x000000ec0000 : "File System"0x000000ec0000-0x000001ac0000 : "Application"0x000001ac0000-0x000001ec0000 : "Param"0x000001ec0000-0x000001ee0000 : "Version"0x000001ee0000-0x0000020e0000 : "Logo"0x000000000000-0x000004000000 : "Whole"0x0000020e0000-0x000008000000 : "Reserved"usb 1-1: new high speed USB device using musb-hdrc and address 2davinci_mdio davinci_mdio.0: davinci mdio revision 1.6davinci_mdio davinci_mdio.0: detected phy mask fffffffddavinci_mdio.0: probeddavinci_mdio davinci_mdio.0: phy: device 0:01, driver unknownPPP generic driver version 2.4.2PPP Deflate Compression module registeredPPP BSD Compression module registeredPPP MPPE Compression module registeredNET: Registered protocol family 24usbcore: registered new interface driver cdc_etherusbcore: registered new interface driver dm9601usbcore: registered new interface driver cdc_acmcdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adaptersInitializing USB Mass Storage driver...usbcore: registered new interface driver usb-storageUSB Mass Storage support registered.mice: PS/2 mouse device common for all miceqt602240_ts 1-004a: __qt602240_read_reg: i2c transfer failedqt602240_ts: probe of 1-004a failed with error -5rtc-isl1208 1-006f: chip found, driver version 0.3rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0rtc-isl1208 1-006f: rtc power failure detected, please set clock.Linux video capture interface: v2.00usbcore: registered new interface driver uvcvideoUSB Video Class driver (v1.0.0)OMAP Watchdog Timer Rev 0x00: initial timeout 60 secusbcore: registered new interface driver usbhidusbhid: USB HID core drivernotify_init : notify drivercreated for remote proc id 2 at physical Address 0xbfd00000function cs4334_modinit,line:219function cs4334_codec_probe,line:192function hdmi_dai_init,line:276function davinci_hdmi_probe,line:238function cs4334_probe,line:164function cs4334_init,line:158asoc: cs4334 <-> davinci-mcasp.2 mapping okasoc: HDMI-DAI-CODEC <-> hdmi-dai mapping okasoc: tvp5158-hifi <-> davinci-mcasp.0 mapping okALSA device list:#0: TI81XX EVM#1: TI81XX EVM {TVP5158}TCP cubic registeredNET: Registered protocol family 17Registering the dns_resolver key typeVFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3omap_voltage_late_init: Voltage driver support not addedPower Management for TI81XX.Detected MACID=0:17:eb:ed:11:5ausb 1-1: New USB device found, idVendor=05e3, idProduct=0608usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0usb 1-1: Product: USB2.0 Hubrtc-isl1208 1-006f: hctosys: invalid date/timehub 1-1:1.0: USB hub foundhub 1-1:1.0: 4 ports detectedusb 2-1: new high speed USB device using musb-hdrc and address 2usb 2-1: New USB device found, idVendor=05e3, idProduct=0718usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=2usb 2-1: Product: USB Storageusb 2-1: SerialNumber: 000000000033scsi1 : usb-storage 2-1:1.0scsi 1:0:0:0: Direct-Access USB TO I DE/SATA Device 0016 PQ: 0 ANSI: 4sd 1:0:0:0: Attached scsi generic sg0 type 0sd 1:0:0:0:  Attached SCSI diskata1: SATA link down (SStatus 0 SControl 300)cramfs_fill_nand blocks is 64VFS: Mounted root (cramfs filesystem) readonly on device 31:4.devtmpfs: mountedFreeing init memory: 200KINIT: version 2.86 bootingPlease wait: booting...Error opening /dev/fb0: No such file or directoryStarting udevudevd (85): /proc/85/oom_adj is deprecated, please use /proc/85/oom_score_adj instead.Remounting root file system...Caching udev devnodesALSA: Restoring mixer settings...Configuring network interfaces... PHY 0:00 not foundCPSW phy found : id is : 0x2430c54done.Setting up IP spoofing protection: rp_filter.mount nfs...Mon Dec 19 13:46:00 UTC 2011INIT: Entering runlevel: 5Starting telnet daemon.Starting syslogd/klogd: doneusb is not ready for autoexeccramfs_fill_nand blocks is 96UBI: attaching mtd6 to ubi0UBI: physical eraseblock size: 131072 bytes (128 KiB)UBI: logical eraseblock size: 129024 bytesUBI: smallest flash I/O unit: 2048UBI: sub-page size: 512UBI: VID header offset: 512 (aligned 512)UBI: data offset: 2048UBI: max. sequence number: 0UBI error: ubi_read_volume_table: the layout volume was not foundubiattach: error!: cannot attach "/dev/mtd6"error 22 (Invalid argument)mount: unknown filesystem type 'ubifs'/etc/rc5.d/S81appinit: cd: line 21: can't cd to /mnt/app/ti810x//etc/rc5.d/S81appinit: line 22: ./init.sh: not found/etc/rc5.d/S81appinit: line 23: ./load.sh: not found/etc/rc5.d/S81appinit: line 19: ./logo: not foundinsmod: can't read './kermod/ti_gpio.ko': No such file or directoryinsmod: can't read './kermod/at88sc.ko': No such file or directorySCREEN_MOD_4SCREEN_MOD_4SCREEN_MOD_4SCREEN_MOD_4init is :0,max is:10umount2: Invalid argumentumount: /mnt/para/: not mountedErasing 128 Kibyte @ 100000 -- 25 % completyaffs: dev is 32505862 name is "mtdblock6" rwErasing 128 Kyaffs: passed flags ""Erasing 128 Kibyte @ 400000 -- 100 % complete.--------dvr configure start--------board_type:TNMB01frontboard_type:S300display_type_info:DVR4-4000detail_machine_type:5804S300cfg_ptz_dev:/dev/ttyO1cfg_test_mail_content:If you receive this e-mail you have successfully setup and tested the e-mail alert from your Swann DVRdefault_norm:1default_output_reso:5default_time_zone:28800default_language:1default_playbacknum:4default_alarmin_num:0default_alarmout_num:0default_enable_485:1default_audio_num:4default_osd_fmt:0default_disk_num:4default_esata_port:-1default_record_type:1support_avi_backup:1support_chn_switch:1support_swann_ddns:1support_dyndns_ddns:1support_3322_ddns:0http_port:85support_ntsc:1support_pal:1need_reduce_fps:0--------dvr configure end--------watchdog not enabled!:scan_key_wt5700_init 370 Open /dev/ti_gpio Dev error, Init scan key fail!ERROR: Module ti_cir does not exist in /proc/modulescramfs: bad compressed blocksize 3642924313cramfs: bad compressed blocksize 3719287697cramfs: bad compressed blocksize 2922450229cramfs: bad compressed blocksize 3642924313insmod: can't read '/mnt/app/ti814x/kermod/ti_cir.ko': Input/output error:misc_ir_open_s 853 /dev/ti_cir:misc_led_open_s 987 open gpio err!:misc_buzzer_open 951 open gpio err!Open /dev/at88sc0104 error!VSYS_USECASE_MULTICHN_PROGRESSIVE_VCAP_VDIS_VENC_VDEC_4CHVenc_init complete:1vdec_init completetype_init_vdis_param vodev :0 resolution:13SCREEN_MOD_4window 0 start x,y=0,0; w,h=960.540window 1 start x,y=960,0; w,h=960.540window 2 start x,y=0,540; w,h=960.540window 3 start x,y=960,540; w,h=960.540VoDev :0 width is:1920,height is :1080:Device_ths8200Init :28 =======>> Global semaphore create !!!!!!:Device_ths8200Create :97 =======>> Device_ths8200Create !!!!!!:Device_ths8200Create :121 =======>> Device_ths8200Create !!!!!! done:Device_ths8200Control :178 =======>> Device_ths8200Control !!!!!!standard is :13:Device_ths8200Control :214 =======>> Device_ths8200Control !!!!!!doneVdis_init completeVenc_registerCallback complete0: SYSTEM: IPC init in progress !!!OsalDrv driver open: /dev/syslinkipc_Osal: No such file or directoryOsalDrv driver close: /dev/syslinkipc_Osal: Bad file descriptor/dev/syslinkipc_MultiProc: No such file or directoryMultiProc driver close: : Bad file descriptorSharedRegion driver open: : No such file or directorySharedRegion driver close: : Bad file descriptor/dev/syslinkipc_GateMP: No such file or directory/dev/syslinkipc_MessageQ: No such file or directoryMessageQ driver close: : Bad file descriptorNotify driver open: /dev/syslinkipc_Notify: No such file or directoryNotify driver close: /dev/syslinkipc_Notify: Bad file descriptorProcMgr driver open: /dev/syslinkipc_ProcMgr: No such file or directoryProcMgr driver close: /dev/syslinkipc_ProcMgr: Bad file descriptor/dev/syslinkipc_HeapBufMP: No such file or directory/dev/syslinkipc_HeapMemMP: No such file or directory/dev/syslinkipc_ListMP: No such file or directory/dev/syslinkipc_RingIO: No such file or directoryRingIO driver close: : Bad file descriptor/dev/syslinkipc_RingIOShm: No such file or directoryRingIO driver close: : Bad file descriptor/dev/syslinkipc_ClientNotifyMgr: No such file or directoryClientNotifyMgr driver close: : Bad file descriptor/dev/syslinkipc_FrameQBufMgr: No such file or directoryFrameQBufMgr driver close: : Bad file descriptor/dev/syslinkipc_FrameQ: No such file or directoryFrameQ driver close: : Bad file descriptor/dev/syslinkipc_Ipc: No such file or directory15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...ASSERT (system_ipc_msgq.c|System_ipcMsgQHeapCreate|46)dm814x-evm login:

author: dc101
author_rank: Regular Contributor
timestamp: April 20, 2021, 03:01:40 am
content: Very strange it's trying to load a ubifs from mtd6, I'm not sure what to make of that. Those missing files are in the second cramfs image in the .pak file in the ti814x directory.

author: poot36
author_rank: Frequent Contributor
timestamp: April 20, 2021, 03:05:46 am
content: I think the issue is from how I loaded it from RAM as the u-boot appears to send extra configuration commands when it is run normally (I stopped the auto boot so that I could load my correct kernel into RAM instead of the incorrect one that u-boot would try and load). Based on your previous post would I have to trim my kernel file to be 2662480 bytes in total size?

author: dc101
author_rank: Regular Contributor
timestamp: April 20, 2021, 03:16:23 am
content: It's worth a shot. You are correct, if you take the offset of the first cramfs image (3095760) and subtract the offset of the uImage header (433280) from it, you will get 2662480 which is the size of the kernel reported by the Linux file command + the 64 byte uImage header.Code:user@femto:~/re_projs/dvr4000$ binwalk DVR4-4000_GA1.9_1025.pakDECIMAL HEXADECIMAL DESCRIPTION--------------------------------------------------------------------------------78648 0x13338 CRC32 polynomial table, little endian255164 0x3E4BC CRC32 polynomial table, little endian433280 0x69C80 uImage header, header size: 64 bytes, header CRC: 0x4918710A, created: 2012-09-21 03:11:57, image size: 2662416 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x343FB2FF, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-2.6.37"449983 0x6DDBF gzip compressed data, maximum compression, from Unix, last modified: 2012-09-21 03:11:563095760 0x2F3CD0 CramFS filesystem, little endian, size: 8011776 version 2 sorted_dirs CRC 0xD8777123, edition 0, 4491 blocks, 1405 files11107536 0xA97CD0 CramFS filesystem, little endian, size: 8957952 version 2 sorted_dirs CRC 0x3CE298E8, edition 0, 6640 blocks, 746 files20065488 0x1322CD0 PC bitmap, Windows 3.x format,, 684 x 456 x 24

author: poot36
author_rank: Frequent Contributor
timestamp: April 21, 2021, 03:34:39 am
content: Well I think I successfully flashed the kernel to the NAND at the correct address because it did boot further then with the incorrect kernel. However it is still not loading fully, I think it is something to do with the cramfs being incorrect. The video gets initilized and I have a thin line at the bottom of the screen with green and purple colors on it. Here is the boot log:TI-MIN#go 0x81000000## Starting application at 0x81000000 ...U-Boot 2010.06 (Jun 07 2012 - 16:12:09)TI8148-GP rev 2.1ARM clk: 720MHzDDR clk: 400MHzIVA clk: 321MHzISS clk: 400MHzDSS clk: 200MHzDSP clk: 600MHzI2C: readyDRAM: 1 GiBNAND: HW ECC Hamming Code selected128 MiB*** Warning - bad CRC or NAND, using default environment_____ ___ _ _____ _ _ _ _ ___ __ _| _ \ / | | | / ___| | | | | | | | | / | | \ | || |_| | / /| | | | | | | |_| | | | | | / /| | | \| || _ { / / | | | | | | | _ | | | | | / / | | | |\ || |_| | / / | | | | | |___ | | | | | |_| | / / | | | | \ ||_____/ /_/ |_| |_| \_____| |_| |_| \_____/ /_/ |_| |_| \_|MMC: OMAP SD/MMC: 0Net: <ethaddr> not set. Reading from E-fuseDetected MACID:0:17:eb:ed:11:5acpswHit any key to stop autoboot: 0NAND read: device 0 offset 0x1ee0000, size 0x2000002097152 bytes read: OKchange to 400K for i2cNAND read: device 0 offset 0x280000, size 0x3000003145728 bytes read: OK## Booting kernel from Legacy Image at 81000000 ...Image Name: Linux-2.6.37Image Type: ARM Linux Kernel Image (uncompressed)Data Size: 2662416 Bytes = 2.5 MiBLoad Address: 80008000Entry Point: 80008000Verifying Checksum ... OKLoading Kernel Image ... OKOKStarting kernel ...Uncompressing Linux... done, booting the kernel.Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #4 Fri Sep 21 11:11:53 CST 2012CPU: ARMv7 Processor  revision 2 (ARMv7), cr=10c53c7fCPU: VIPT nonaliasing data cache, VIPT aliasing instruction cacheMachine: ti8148evmreserved size = 52428800 at 0x0FB: Reserving 52428800 bytes SDRAM for VRAMMemory policy: ECC disabled, Data cache writebackOMAP chip is TI8148 2.0Built 1 zonelists in Zone order, mobility grouping on. Total pages: 19712Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400PID hash table entries: 512 (order: -1, 2048 bytes)Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)Memory: 78MB = 78MB totalMemory: 73032k/73032k available, 58040k reserved, 0K highmemVirtual kernel memory layout:vector : 0xffff0000 - 0xffff1000 ( 4 kB)fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)DMA : 0xffc00000 - 0xffe00000 ( 2 MB)vmalloc : 0xc8800000 - 0xf8000000 ( 760 MB)lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)modules : 0xbf000000 - 0xbfe00000 ( 14 MB).init : 0xc0008000 - 0xc003a000 ( 200 kB).text : 0xc003a000 - 0xc0506000 (4912 kB).data : 0xc0506000 - 0xc0547f80 ( 264 kB)SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1NR_IRQS:375omap_hwmod: gpio1: softreset failed (waited 10000 usec)omap_hwmod: gpio2: softreset failed (waited 10000 usec)omap_hwmod: gpio3: softreset failed (waited 10000 usec)omap_hwmod: gpio4: softreset failed (waited 10000 usec)IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interruptsTotal of 128 interrupts on 1 active controllerGPMC revision 6.0Trying to install interrupt handler for IRQ368Trying to install interrupt handler for IRQ369Trying to install interrupt handler for IRQ370Trying to install interrupt handler for IRQ371Trying to install interrupt handler for IRQ372Trying to install interrupt handler for IRQ373Trying to install interrupt handler for IRQ374Trying to install type control for IRQ375Trying to set irq flags for IRQ375OMAP clockevent source: GPTIMER1 at 20000000 HzConsole: colour dummy device 80x30Calibrating delay loop... 719.25 BogoMIPS (lpj=3596288)pid_max: default: 32768 minimum: 301Security Framework initializedMount-cache hash table entries: 512CPU: Testing write buffer coherency: okdevtmpfs: initializedomap_voltage_early_init: voltage driver support not addedregulator: core version 0.5regulator: dummy:NET: Registered protocol family 16OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1omap_mux_init: Add partition: #1: core, flags: 4registered ti814x_vpss deviceregistered TI814x on-chip HDMI deviceclk get on i2c3 fck failedregistered ti81xx_vidout deviceDebugfs: Only enabling/disabling deep sleep and wakeup timer is supported nowbio: create slab <bio-0> at 0SCSI subsystem initializedusbcore: registered new interface driver usbfsusbcore: registered new interface driver hubusbcore: registered new device driver usbregisterd cppi-dma Intr @ IRQ 17Cppi41 Init Doneomap_i2c omap_i2c.1: bus 1 rev4.0 at 100 kHzpcf857x: probe of 1-0021 failed with error -121omap_i2c omap_i2c.3: bus 3 rev4.0 at 400 kHzAdvanced Linux Sound Architecture Driver Version 1.0.23.Switching to clocksource gp timermusb-hdrc: version 6.0, host, debug=0musb-hdrc musb-hdrc.0: dma type: dma-cppi41musb-hdrc musb-hdrc.0: MUSB HDRC host drivermusb-hdrc musb-hdrc.0: new USB bus registered, assigned bus number 1usb usb1: New USB device found, idVendor=1d6b, idProduct=0002usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1usb usb1: Product: MUSB HDRC host driverusb usb1: Manufacturer: Linux 2.6.37 musb-hcdusb usb1: SerialNumber: musb-hdrc.0hub 1-0:1.0: USB hub foundhub 1-0:1.0: 1 port detectedmusb-hdrc musb-hdrc.0: USB Host mode controller at c881e000 using DMA, IRQ 18musb-hdrc musb-hdrc.1: dma type: dma-cppi41musb-hdrc musb-hdrc.1: MUSB HDRC host drivermusb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 2usb usb2: New USB device found, idVendor=1d6b, idProduct=0002usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1usb usb2: Product: MUSB HDRC host driverusb usb2: Manufacturer: Linux 2.6.37 musb-hcdusb usb2: SerialNumber: musb-hdrc.1hub 2-0:1.0: USB hub foundhub 2-0:1.0: 1 port detectedmusb-hdrc musb-hdrc.1: USB Host mode controller at c8828800 using DMA, IRQ 19NET: Registered protocol family 2IP route cache hash table entries: 1024 (order: 0, 4096 bytes)TCP established hash table entries: 4096 (order: 3, 32768 bytes)TCP bind hash table entries: 4096 (order: 2, 16384 bytes)TCP: Hash tables configured (established 4096 bind 4096)TCP reno registeredUDP hash table entries: 256 (order: 0, 4096 bytes)UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)NET: Registered protocol family 1RPC: Registered udp transport module.RPC: Registered tcp transport module.RPC: Registered tcp NFSv4.1 backchannel transport module.NetWinder Floating Point Emulator V0.97 (double precision)PMU: registered new PMU device of type 0omap-iommu omap-iommu.0: ducati registeredomap-iommu omap-iommu.1: sys registeredJFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.fuse init (API version 7.15)msgmni has been set to 142io scheduler noop registeredio scheduler deadline registeredio scheduler cfq registered (default)Serial: 8250/16550 driver, 4 ports, IRQ sharing enabledomap_uart.0: ttyO0 at MMIO 0x48020000 (irq = 72) is a OMAP UART0console  enabledomap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5brd: module loadedloop: module loadedahci ahci.0: forcing PORTS_IMPL to 0x1ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform modeahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apstscsi0 : ahci_platformata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x100 irq 16omap2-nand driver initializingONFI flash detectedONFI param page 0 validNAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)Creating 11 MTD partitions on "omap2-nand.0":0x000000000000-0x000000020000 : "U-Boot-min"0x000000020000-0x000000260000 : "U-Boot"0x000000260000-0x000000280000 : "U-Boot Env"0x000000280000-0x0000006c0000 : "Kernel"0x0000006c0000-0x000000ec0000 : "File System"0x000000ec0000-0x000001ac0000 : "Application"0x000001ac0000-0x000001ec0000 : "Param"0x000001ec0000-0x000001ee0000 : "Version"0x000001ee0000-0x0000020e0000 : "Logo"0x000000000000-0x000004000000 : "Whole"0x0000020e0000-0x000008000000 : "Reserved"usb 1-1: new high speed USB device using musb-hdrc and address 2davinci_mdio davinci_mdio.0: davinci mdio revision 1.6davinci_mdio davinci_mdio.0: detected phy mask fffffffddavinci_mdio.0: probeddavinci_mdio davinci_mdio.0: phy: device 0:01, driver unknownPPP generic driver version 2.4.2PPP Deflate Compression module registeredPPP BSD Compression module registeredPPP MPPE Compression module registeredNET: Registered protocol family 24usbcore: registered new interface driver cdc_etherusbcore: registered new interface driver dm9601usbcore: registered new interface driver cdc_acmcdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adaptersInitializing USB Mass Storage driver...usbcore: registered new interface driver usb-storageUSB Mass Storage support registered.mice: PS/2 mouse device common for all miceqt602240_ts 1-004a: __qt602240_read_reg: i2c transfer failedqt602240_ts: probe of 1-004a failed with error -5rtc-isl1208 1-006f: chip found, driver version 0.3rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0Linux video capture interface: v2.00usbcore: registered new interface driver uvcvideoUSB Video Class driver (v1.0.0)OMAP Watchdog Timer Rev 0x00: initial timeout 60 secusbcore: registered new interface driver usbhidusbhid: USB HID core drivernotify_init : notify drivercreated for remote proc id 2 at physical Address 0xbfd00000function cs4334_modinit,line:219function cs4334_codec_probe,line:192function hdmi_dai_init,line:276function davinci_hdmi_probe,line:238function cs4334_probe,line:164function cs4334_init,line:158asoc: cs4334 <-> davinci-mcasp.2 mapping okasoc: HDMI-DAI-CODEC <-> hdmi-dai mapping okasoc: tvp5158-hifi <-> davinci-mcasp.0 mapping okALSA device list:#0: TI81XX EVM#1: TI81XX EVM {TVP5158}TCP cubic registeredNET: Registered protocol family 17Registering the dns_resolver key typeVFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3omap_voltage_late_init: Voltage driver support not addedPower Management for TI81XX.Detected MACID=0:17:eb:ed:11:5ausb 1-1: New USB device found, idVendor=05e3, idProduct=0608usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0usb 1-1: Product: USB2.0 Hubrtc-isl1208 1-006f: setting system clock to 2011-12-20 14:32:57 UTC (1324391577)hub 1-1:1.0: USB hub foundhub 1-1:1.0: 4 ports detectedusb 2-1: new high speed USB device using musb-hdrc and address 2usb 2-1: New USB device found, idVendor=05e3, idProduct=0718usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=2usb 2-1: Product: USB Storageusb 2-1: SerialNumber: 000000000033scsi1 : usb-storage 2-1:1.0scsi 1:0:0:0: Direct-Access USB TO I DE/SATA Device 0016 PQ: 0 ANSI: 4sd 1:0:0:0: Attached scsi generic sg0 type 0sd 1:0:0:0:  Attached SCSI diskata1: SATA link down (SStatus 0 SControl 300)cramfs_fill_nand blocks is 64VFS: Mounted root (cramfs filesystem) readonly on device 31:4.devtmpfs: mountedFreeing init memory: 200KINIT: version 2.86 bootingPlease wait: booting...Error opening /dev/fb0: No such file or directoryStarting udevudevd (85): /proc/85/oom_adj is deprecated, please use /proc/85/oom_score_adj instead.Remounting root file system...Caching udev devnodesALSA: Restoring mixer settings...Configuring network interfaces... PHY 0:00 not foundCPSW phy found : id is : 0x2430c54done.Setting up IP spoofing protection: rp_filter.mount nfs...INIT: Entering runlevel: 5Starting telnet daemon.Starting syslogd/klogd: doneusb is not ready for autoexeccramfs_fill_nand blocks is 96UBI: attaching mtd6 to ubi0UBI: physical eraseblock size: 131072 bytes (128 KiB)UBI: logical eraseblock size: 129024 bytesUBI: smallest flash I/O unit: 2048UBI: sub-page size: 512UBI: VID header offset: 512 (aligned 512)UBI: data offset: 2048UBI: max. sequence number: 0UBI error: ubi_read_volume_table: the layout volume was not foundubiattach: error!: cannot attach "/dev/mtd6"error 22 (Invalid argument)mount: unknown filesystem type 'ubifs'/etc/rc5.d/S81appinit: cd: line 21: can't cd to /mnt/app/ti810x//etc/rc5.d/S81appinit: line 22: ./init.sh: not found/etc/rc5.d/S81appinit: line 23: ./load.sh: not found/etc/rc5.d/S81appinit: line 19: ./logo: not foundinsmod: can't read './kermod/ti_gpio.ko': No such file or directoryinsmod: can't read './kermod/at88sc.ko': No such file or directorySCREEN_MOD_4SCREEN_MOD_4SCREEN_MOD_4SCREEN_MOD_4init is :0,max is:10umount2: Invalid argumentumount: /mnt/para/: not mountedErasing 128 Kibyte @ 100000 -- 25 % completyaffs: dev is 32505862 name is "mtdblock6" rwErasing 128 Kyaffs: passed flags ""Erasing 128 Kibyte @ 400000 -- 100 % complete.--------dvr configure start--------board_type:TNMB01frontboard_type:S300display_type_info:DVR4-4000detail_machine_type:5804S300cfg_ptz_dev:/dev/ttyO1cfg_test_mail_content:If you receive this e-mail you have successfully setup and tested the e-mail alert from your Swann DVRdefault_norm:1default_output_reso:5default_time_zone:28800default_language:1default_playbacknum:4default_alarmin_num:0default_alarmout_num:0default_enable_485:1default_audio_num:4default_osd_fmt:0default_disk_num:4default_esata_port:-1default_record_type:1support_avi_backup:1support_chn_switch:1support_swann_ddns:1support_dyndns_ddns:1support_3322_ddns:0http_port:85support_ntsc:1support_pal:1need_reduce_fps:0--------dvr configure end--------watchdog not enabled!dm814x-evm login: :scan_key_wt5700_init 370 Open /dev/ti_gpio Dev error, Init scan key fail!ERROR: Module ti_cir does not exist in /proc/modulescramfs: bad compressed blocksize 3642924313cramfs: bad compressed blocksize 3719287697cramfs: bad compressed blocksize 2922450229cramfs: bad compressed blocksize 3642924313insmod: can't read '/mnt/app/ti814x/kermod/ti_cir.ko': Input/output error:misc_ir_open_s 853 /dev/ti_cir:misc_led_open_s 987 open gpio err!:misc_buzzer_open 951 open gpio err!Open /dev/at88sc0104 error!VSYS_USECASE_MULTICHN_PROGRESSIVE_VCAP_VDIS_VENC_VDEC_4CHVenc_init complete:1vdec_init completetype_init_vdis_param vodev :0 resolution:13SCREEN_MOD_4window 0 start x,y=0,0; w,h=960.540window 1 start x,y=960,0; w,h=960.540window 2 start x,y=0,540; w,h=960.540window 3 start x,y=960,540; w,h=960.540VoDev :0 width is:1920,height is :1080:Device_ths8200Init :28 =======>> Global semaphore create !!!!!!:Device_ths8200Create :97 =======>> Device_ths8200Create !!!!!!:Device_ths8200Create :121 =======>> Device_ths8200Create !!!!!! done:Device_ths8200Control :178 =======>> Device_ths8200Control !!!!!!standard is :13:Device_ths8200Control :214 =======>> Device_ths8200Control !!!!!!doneVdis_init completeVenc_registerCallback complete0: SYSTEM: IPC init in progress !!!OsalDrv driver open: /dev/syslinkipc_Osal: No such file or directoryOsalDrv driver close: /dev/syslinkipc_Osal: Bad file descriptor/dev/syslinkipc_MultiProc: No such file or directoryMultiProc driver close: : Bad file descriptorSharedRegion driver open: : No such file or directorySharedRegion driver close: : Bad file descriptor/dev/syslinkipc_GateMP: No such file or directory/dev/syslinkipc_MessageQ: No such file or directoryMessageQ driver close: : Bad file descriptorNotify driver open: /dev/syslinkipc_Notify: No such file or directoryNotify driver close: /dev/syslinkipc_Notify: Bad file descriptorProcMgr driver open: /dev/syslinkipc_ProcMgr: No such file or directoryProcMgr driver close: /dev/syslinkipc_ProcMgr: Bad file descriptor/dev/syslinkipc_HeapBufMP: No such file or directory/dev/syslinkipc_HeapMemMP: No such file or directory/dev/syslinkipc_ListMP: No such file or directory/dev/syslinkipc_RingIO: No such file or directoryRingIO driver close: : Bad file descriptor/dev/syslinkipc_RingIOShm: No such file or directoryRingIO driver close: : Bad file descriptor/dev/syslinkipc_ClientNotifyMgr: No such file or directoryClientNotifyMgr driver close: : Bad file descriptor/dev/syslinkipc_FrameQBufMgr: No such file or directoryFrameQBufMgr driver close: : Bad file descriptor/dev/syslinkipc_FrameQ: No such file or directoryFrameQ driver close: : Bad file descriptor/dev/syslinkipc_Ipc: No such file or directory15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...ASSERT (system_ipc_msgq.c|System_ipcMsgQHeapCreate|46)

author: dc101
author_rank: Regular Contributor
timestamp: April 22, 2021, 10:32:48 pm
content: It's strange that it's still trying to load a ubifs partition:Code:Starting syslogd/klogd: doneusb is not ready for autoexeccramfs_fill_nand blocks is 96UBI: attaching mtd6 to ubi0UBI: physical eraseblock size: 131072 bytes (128 KiB)UBI: logical eraseblock size: 129024 bytesUBI: smallest flash I/O unit: 2048UBI: sub-page size: 512UBI: VID header offset: 512 (aligned 512)UBI: data offset: 2048UBI: max. sequence number: 0UBI error: ubi_read_volume_table: the layout volume was not foundubiattach: error!: cannot attach "/dev/mtd6"error 22 (Invalid argument)mount: unknown filesystem type 'ubifs'/etc/rc5.d/S81appinit: cd: line 21: can't cd to /mnt/app/ti810x//etc/rc5.d/S81appinit: line 22: ./init.sh: not found/etc/rc5.d/S81appinit: line 23: ./load.sh: not found/etc/rc5.d/S81appinit: line 19: ./logo: not foundinsmod: can't read './kermod/ti_gpio.ko': No such file or directoryinsmod: can't read './kermod/at88sc.ko': No such file or directoryI wonder if this was something that was part of the other firmware that you loaded the first time? I'm going to look at the other firmware image you linked and see what is in that one. I haven't found any mention of ubifs in the correct firmware image, which makes me wonder if the root partition contains startup/boot procedures for a different model device.Cheers-Tim

author: dc101
author_rank: Regular Contributor
timestamp: April 23, 2021, 12:11:37 am
content: I found the same model as yours on eBay for dirt cheap so I picked it up. It should get here some time next week.Once it shows up I can start digging into it and we can get to the bottom of this mystery! This is going to be fun, I love reverse engineering embedded systems.Cheers-Tim

author: poot36
author_rank: Frequent Contributor
timestamp: April 23, 2021, 01:29:32 am
content: If you are interested the processor for the incorrect firmware is a DM8107, if that helps you figure out what is going on with the file system.

author: poot36
author_rank: Frequent Contributor
timestamp: April 23, 2021, 02:39:47 am
content: Well I have confirmed that the File System partition has the data from the incorrect firmware in it. The good news is that the Application partition still has the correct data in it. I have also found out that using ymodem is way faster then kermet to transfer the files (almost 4 times as fast when using TeraTerm version 4.103 on Win 10 X64 using an old Arduino Uno board (around 2012 or so) as the serial converter chip). Going to attempt to flash the correct File System partition that I extracted out of the correct firmware to the unit and see where that gets me.

author: poot36
author_rank: Frequent Contributor
timestamp: April 23, 2021, 03:21:13 am
content: Well I flashed the File System to the correct partition location and then tried to boot it with the boot command and it just crashed at the same point that it had before. I then power cycled the unit loaded the 1st and 2nd stage boot loaders and then tried the boot command again and this time it dropped me to a login prompt. Tried root and that got me to this prompt root@dm814x-evm:~# not really sure what I can do from there though. Here is a copy of that boot:TI8148_EVM#bootNAND read: device 0 offset 0x1ee0000, size 0x2000002097152 bytes read: OKchange to 400K for i2cNAND read: device 0 offset 0x280000, size 0x3000003145728 bytes read: OK## Booting kernel from Legacy Image at 81000000 ...Image Name: Linux-2.6.37Image Type: ARM Linux Kernel Image (uncompressed)Data Size: 2662416 Bytes = 2.5 MiBLoad Address: 80008000Entry Point: 80008000Verifying Checksum ... OKLoading Kernel Image ... OKOKStarting kernel ...Uncompressing Linux... done, booting the kernel.Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #4 Fri Sep 21 11:11:53 CST 2012CPU: ARMv7 Processor  revision 2 (ARMv7), cr=10c53c7fCPU: VIPT nonaliasing data cache, VIPT aliasing instruction cacheMachine: ti8148evmreserved size = 52428800 at 0x0FB: Reserving 52428800 bytes SDRAM for VRAMMemory policy: ECC disabled, Data cache writebackOMAP chip is TI8148 2.0Built 1 zonelists in Zone order, mobility grouping on. Total pages: 19712Kernel command line: console=ttyO0,115200n8 noinitrd root=/dev/mtdblock4 ro rootfstype=cramfs mem=128M earlyprintk notifyk.vpssm3_sva=0xBFD00000 i2c_bus=3,400PID hash table entries: 512 (order: -1, 2048 bytes)Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)Memory: 78MB = 78MB totalMemory: 73032k/73032k available, 58040k reserved, 0K highmemVirtual kernel memory layout:vector : 0xffff0000 - 0xffff1000 ( 4 kB)fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)DMA : 0xffc00000 - 0xffe00000 ( 2 MB)vmalloc : 0xc8800000 - 0xf8000000 ( 760 MB)lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)modules : 0xbf000000 - 0xbfe00000 ( 14 MB).init : 0xc0008000 - 0xc003a000 ( 200 kB).text : 0xc003a000 - 0xc0506000 (4912 kB).data : 0xc0506000 - 0xc0547f80 ( 264 kB)SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1NR_IRQS:375omap_hwmod: gpio1: softreset failed (waited 10000 usec)omap_hwmod: gpio2: softreset failed (waited 10000 usec)omap_hwmod: gpio3: softreset failed (waited 10000 usec)omap_hwmod: gpio4: softreset failed (waited 10000 usec)IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interruptsTotal of 128 interrupts on 1 active controllerGPMC revision 6.0Trying to install interrupt handler for IRQ368Trying to install interrupt handler for IRQ369Trying to install interrupt handler for IRQ370Trying to install interrupt handler for IRQ371Trying to install interrupt handler for IRQ372Trying to install interrupt handler for IRQ373Trying to install interrupt handler for IRQ374Trying to install type control for IRQ375Trying to set irq flags for IRQ375OMAP clockevent source: GPTIMER1 at 20000000 HzConsole: colour dummy device 80x30Calibrating delay loop... 719.25 BogoMIPS (lpj=3596288)pid_max: default: 32768 minimum: 301Security Framework initializedMount-cache hash table entries: 512CPU: Testing write buffer coherency: okdevtmpfs: initializedomap_voltage_early_init: voltage driver support not addedregulator: core version 0.5regulator: dummy:NET: Registered protocol family 16OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1OMAP GPIO hardware version 0.1omap_mux_init: Add partition: #1: core, flags: 4registered ti814x_vpss deviceregistered TI814x on-chip HDMI deviceclk get on i2c3 fck failedregistered ti81xx_vidout deviceDebugfs: Only enabling/disabling deep sleep and wakeup timer is supported nowbio: create slab <bio-0> at 0SCSI subsystem initializedusbcore: registered new interface driver usbfsusbcore: registered new interface driver hubusbcore: registered new device driver usbregisterd cppi-dma Intr @ IRQ 17Cppi41 Init Doneomap_i2c omap_i2c.1: bus 1 rev4.0 at 100 kHzpcf857x: probe of 1-0021 failed with error -121omap_i2c omap_i2c.3: bus 3 rev4.0 at 400 kHzAdvanced Linux Sound Architecture Driver Version 1.0.23.Switching to clocksource gp timermusb-hdrc: version 6.0, host, debug=0musb-hdrc musb-hdrc.0: dma type: dma-cppi41musb-hdrc musb-hdrc.0: MUSB HDRC host drivermusb-hdrc musb-hdrc.0: new USB bus registered, assigned bus number 1usb usb1: New USB device found, idVendor=1d6b, idProduct=0002usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1usb usb1: Product: MUSB HDRC host driverusb usb1: Manufacturer: Linux 2.6.37 musb-hcdusb usb1: SerialNumber: musb-hdrc.0hub 1-0:1.0: USB hub foundhub 1-0:1.0: 1 port detectedmusb-hdrc musb-hdrc.0: USB Host mode controller at c881e000 using DMA, IRQ 18musb-hdrc musb-hdrc.1: dma type: dma-cppi41musb-hdrc musb-hdrc.1: MUSB HDRC host drivermusb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 2usb usb2: New USB device found, idVendor=1d6b, idProduct=0002usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1usb usb2: Product: MUSB HDRC host driverusb usb2: Manufacturer: Linux 2.6.37 musb-hcdusb usb2: SerialNumber: musb-hdrc.1hub 2-0:1.0: USB hub foundhub 2-0:1.0: 1 port detectedmusb-hdrc musb-hdrc.1: USB Host mode controller at c8828800 using DMA, IRQ 19NET: Registered protocol family 2IP route cache hash table entries: 1024 (order: 0, 4096 bytes)TCP established hash table entries: 4096 (order: 3, 32768 bytes)TCP bind hash table entries: 4096 (order: 2, 16384 bytes)TCP: Hash tables configured (established 4096 bind 4096)TCP reno registeredUDP hash table entries: 256 (order: 0, 4096 bytes)UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)NET: Registered protocol family 1RPC: Registered udp transport module.RPC: Registered tcp transport module.RPC: Registered tcp NFSv4.1 backchannel transport module.NetWinder Floating Point Emulator V0.97 (double precision)PMU: registered new PMU device of type 0omap-iommu omap-iommu.0: ducati registeredomap-iommu omap-iommu.1: sys registeredJFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.fuse init (API version 7.15)msgmni has been set to 142io scheduler noop registeredio scheduler deadline registeredio scheduler cfq registered (default)Serial: 8250/16550 driver, 4 ports, IRQ sharing enabledomap_uart.0: ttyO0 at MMIO 0x48020000 (irq = 72) is a OMAP UART0console  enabledomap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5brd: module loadedloop: module loadedahci ahci.0: forcing PORTS_IMPL to 0x1ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 3 Gbps 0x1 impl platform modeahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apstscsi0 : ahci_platformata1: SATA max UDMA/133 mmio [mem 0x4a140000-0x4a150fff] port 0x100 irq 16omap2-nand driver initializingONFI flash detectedONFI param page 0 validNAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)Creating 11 MTD partitions on "omap2-nand.0":0x000000000000-0x000000020000 : "U-Boot-min"0x000000020000-0x000000260000 : "U-Boot"0x000000260000-0x000000280000 : "U-Boot Env"0x000000280000-0x0000006c0000 : "Kernel"0x0000006c0000-0x000000ec0000 : "File System"0x000000ec0000-0x000001ac0000 : "Application"0x000001ac0000-0x000001ec0000 : "Param"0x000001ec0000-0x000001ee0000 : "Version"0x000001ee0000-0x0000020e0000 : "Logo"0x000000000000-0x000004000000 : "Whole"0x0000020e0000-0x000008000000 : "Reserved"usb 1-1: new high speed USB device using musb-hdrc and address 2davinci_mdio davinci_mdio.0: davinci mdio revision 1.6davinci_mdio davinci_mdio.0: detected phy mask fffffffddavinci_mdio.0: probeddavinci_mdio davinci_mdio.0: phy: device 0:01, driver unknownPPP generic driver version 2.4.2PPP Deflate Compression module registeredPPP BSD Compression module registeredPPP MPPE Compression module registeredNET: Registered protocol family 24usbcore: registered new interface driver cdc_etherusbcore: registered new interface driver dm9601usbcore: registered new interface driver cdc_acmcdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adaptersInitializing USB Mass Storage driver...usbcore: registered new interface driver usb-storageUSB Mass Storage support registered.mice: PS/2 mouse device common for all miceqt602240_ts 1-004a: __qt602240_read_reg: i2c transfer failedqt602240_ts: probe of 1-004a failed with error -5rtc-isl1208 1-006f: chip found, driver version 0.3rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0Linux video capture interface: v2.00usbcore: registered new interface driver uvcvideoUSB Video Class driver (v1.0.0)OMAP Watchdog Timer Rev 0x00: initial timeout 60 secusbcore: registered new interface driver usbhidusbhid: USB HID core drivernotify_init : notify drivercreated for remote proc id 2 at physical Address 0xbfd00000function cs4334_modinit,line:219function cs4334_codec_probe,line:192function hdmi_dai_init,line:276function davinci_hdmi_probe,line:238function cs4334_probe,line:164function cs4334_init,line:158asoc: cs4334 <-> davinci-mcasp.2 mapping okasoc: HDMI-DAI-CODEC <-> hdmi-dai mapping okasoc: tvp5158-hifi <-> davinci-mcasp.0 mapping okALSA device list:#0: TI81XX EVM#1: TI81XX EVM {TVP5158}TCP cubic registeredNET: Registered protocol family 17Registering the dns_resolver key typeVFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3omap_voltage_late_init: Voltage driver support not addedPower Management for TI81XX.Detected MACID=0:17:eb:ed:11:5ausb 1-1: New USB device found, idVendor=05e3, idProduct=0608usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0usb 1-1: Product: USB2.0 Hubrtc-isl1208 1-006f: setting system clock to 2011-12-22 14:20:38 UTC (1324563638)hub 1-1:1.0: USB hub foundhub 1-1:1.0: 4 ports detectedusb 2-1: new high speed USB device using musb-hdrc and address 2usb 2-1: New USB device found, idVendor=05e3, idProduct=0718usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=2usb 2-1: Product: USB Storageusb 2-1: SerialNumber: 000000000033scsi1 : usb-storage 2-1:1.0scsi 1:0:0:0: Direct-Access USB TO I DE/SATA Device 0016 PQ: 0 ANSI: 4sd 1:0:0:0: Attached scsi generic sg0 type 0sd 1:0:0:0:  Attached SCSI diskata1: SATA link down (SStatus 0 SControl 300)cramfs_fill_nand blocks is 64VFS: Mounted root (cramfs filesystem) readonly on device 31:4.devtmpfs: mountedFreeing init memory: 200KINIT: version 2.86 bootingPlease wait: booting...Error opening /dev/fb0: No such file or directoryStarting udevudevd (85): /proc/85/oom_adj is deprecated, please use /proc/85/oom_score_adj instead.Remounting root file system...Caching udev devnodesALSA: Restoring mixer settings...Configuring network interfaces... PHY 0:00 not foundCPSW phy found : id is : 0x2430c54done.Setting up IP spoofing protection: rp_filter.mount nfs...INIT: Entering runlevel: 5Starting telnet daemon.Starting syslogd/klogd: doneusb is not ready for autoexeccramfs_fill_nand blocks is 96yaffs: dev is 32505862 name is "mtdblock6" rwyaffs: passed flags ""cramfs: bad compressed blocksize 2688251248cramfs: bad compressed blocksize 2688251248/etc/rc5.d/S81appinit: line 18: ./logo: not found/etc/rc5.d/S81appinit: line 21: ./init.sh: Input/output errorcramfs: bad compressed blocksize 3786985870cramfs: bad compressed blocksize 3786985870/etc/rc5.d/S81appinit: line 22: ./load.sh: Input/output errorSCREEN_MOD_4SCREEN_MOD_4SCREEN_MOD_4SCREEN_MOD_4init is :0,max is:10--------dvr configure start--------board_type:TNMB01frontboard_type:S300display_type_info:DVR4-4000detail_machine_type:5804S300cfg_ptz_dev:/dev/ttyO1cfg_test_mail_content:If you receive this e-mail you have successfully setup and tested the e-mail alert from your Swann DVRdefault_norm:1default_output_reso:5default_time_zone:28800default_language:1default_playbacknum:4default_alarmin_num:0default_alarmout_num:0default_enable_485:1default_audio_num:4default_osd_fmt:0default_disk_num:4default_esata_port:-1default_record_type:1support_avi_backup:1support_chn_switch:1support_swann_ddns:1support_dyndns_ddns:1support_3322_ddns:0http_port:85support_ntsc:1support_pal:1need_reduce_fps:0--------dvr configure end--------watchdog not enabled!:scan_key_wt5700_init 370 Open /dev/ti_gpio Dev error, Init scan key fail!ERROR: Module ti_cir does not exist in /proc/modulescramfs: bad compressed blocksize 3642924313cramfs: bad compressed blocksize 3719287697cramfs: bad compressed blocksize 2922450229cramfs: bad compressed blocksize 3642924313insmod: can't read '/mnt/app/ti814x/kermod/ti_cir.ko': Input/output error:misc_ir_open_s 853 /dev/ti_cir:misc_led_open_s 987 open gpio err!:misc_buzzer_open 951 open gpio err!Open /dev/at88sc0104 error!VSYS_USECASE_MULTICHN_PROGRESSIVE_VCAP_VDIS_VENC_VDEC_4CHVenc_init complete:1vdec_init completetype_init_vdis_param vodev :0 resolution:13SCREEN_MOD_4window 0 start x,y=0,0; w,h=960.540window 1 start x,y=960,0; w,h=960.540window 2 start x,y=0,540; w,h=960.540window 3 start x,y=960,540; w,h=960.540VoDev :0 width is:1920,height is :1080:Device_ths8200Init :28 =======>> Global semaphore create !!!!!!:Device_ths8200Create :97 =======>> Device_ths8200Create !!!!!!:Device_ths8200Create :121 =======>> Device_ths8200Create !!!!!! done:Device_ths8200Control :178 =======>> Device_ths8200Control !!!!!!standard is :13:Device_ths8200Control :214 =======>> Device_ths8200Control !!!!!!doneVdis_init completeVenc_registerCallback complete0: SYSTEM: IPC init in progress !!!OsalDrv driver open: /dev/syslinkipc_Osal: No such file or directoryOsalDrv driver close: /dev/syslinkipc_Osal: Bad file descriptor/dev/syslinkipc_MultiProc: No such file or directoryMultiProc driver close: : Bad file descriptorSharedRegion driver open: : No such file or directorySharedRegion driver close: : Bad file descriptor/dev/syslinkipc_GateMP: No such file or directory/dev/syslinkipc_MessageQ: No such file or directoryMessageQ driver close: : Bad file descriptorNotify driver open: /dev/syslinkipc_Notify: No such file or directoryNotify driver close: /dev/syslinkipc_Notify: Bad file descriptorProcMgr driver open: /dev/syslinkipc_ProcMgr: No such file or directoryProcMgr driver close: /dev/syslinkipc_ProcMgr: Bad file descriptor/dev/syslinkipc_HeapBufMP: No such file or directory/dev/syslinkipc_HeapMemMP: No such file or directory/dev/syslinkipc_ListMP: No such file or directory/dev/syslinkipc_RingIO: No such file or directoryRingIO driver close: : Bad file descriptor/dev/syslinkipc_RingIOShm: No such file or directoryRingIO driver close: : Bad file descriptor/dev/syslinkipc_ClientNotifyMgr: No such file or directoryClientNotifyMgr driver close: : Bad file descriptor/dev/syslinkipc_FrameQBufMgr: No such file or directoryFrameQBufMgr driver close: : Bad file descriptor/dev/syslinkipc_FrameQ: No such file or directoryFrameQ driver close: : Bad file descriptor/dev/syslinkipc_Ipc: No such file or directory15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...15: SYSTEM: Opening MsgQ Heap  ...ASSERT (system_ipc_msgq.c|System_ipcMsgQHeapCreate|46)dm814x-evm login:

author: dc101
author_rank: Regular Contributor
timestamp: April 23, 2021, 04:02:01 am
content: Well that definitely looks better than prior attempts! Still seems to be a lot of missing files though. Can you look in /mnt/app and see if there's anything in there? From looking at the bootlog /mnt/app should contain the contents of the ti814x folder from the 2nd cramfs image from the firmware.As you discovered there's no root password. You can rundf -handcat /proc/mtdon your DVR and check the output.Cheers-Tim

author: poot36
author_rank: Frequent Contributor
timestamp: April 24, 2021, 03:06:09 am
content: Here is the output of df -h:root@dm814x-evm:~# df -hFilesystem Size Used Available Use% Mounted on/dev/root 17.5M 17.5M 0 100% /devtmpfs 1.0M 52.0K 972.0K 5% /devtmpfs 40.0K 0 40.0K 0% /mnt/.splashnone 1.0M 52.0K 972.0K 5% /devtmpfs 16.0M 20.0K 16.0M 0% /var/volatiletmpfs 35.8M 0 35.8M 0% /dev/shmtmpfs 16.0M 0 16.0M 0% /media/ram/dev/mtdblock5 25.9M 25.9M 0 100% /mnt/app/dev/mtdblock6 4.0M 788.0K 3.2M 19% /mnt/paraand here is the output of cat /proc/mtd:root@dm814x-evm:~# cat /proc/mtddev: size erasesize namemtd0: 00020000 00020000 "U-Boot-min"mtd1: 00240000 00020000 "U-Boot"mtd2: 00020000 00020000 "U-Boot Env"mtd3: 00440000 00020000 "Kernel"mtd4: 00800000 00020000 "File System"mtd5: 00c00000 00020000 "Application"mtd6: 00400000 00020000 "Param"mtd7: 00020000 00020000 "Version"mtd8: 00200000 00020000 "Logo"mtd9: 04000000 00020000 "Whole"mtd10: 05f20000 00020000 "Reserved"Any other commands you want me to try running?

author: amyk
author_rank: Super Contributor
timestamp: April 24, 2021, 05:51:28 am
content: Shenzhen Baichuan was the company that made it, and that company is now known as Reolink. Worth asking them?

author: dc101
author_rank: Regular Contributor
timestamp: April 24, 2021, 06:29:26 pm
content: Can you list the contents of /mnt/app?ls -alF /mnt/appIt is complaining about not being able to find several files that are supposed to be in that directory. The /mnt/app directory should contain all the files in the 2nd cramfs image from the firmware image.Cheers-Tim

author: poot36
author_rank: Frequent Contributor
timestamp: April 24, 2021, 10:35:20 pm
content: @amyk I had a look at their websight and found that the oldest firmware they have listed is from 2018 and is not for my device however the interface shown in the screen shots looks very similar to what I was working with before I bricked the unit. May have to contact them if I can not get any further with what I am doing right now.@dc101 Here is the output of ls -alF /mnt/app:root@dm814x-evm:~# ls -alF /mnt/app-rwxr-xr-x 1 1002 234 7632 Jan 1 1970 armbase64*-rwxr-xr-x 1 1002 234 4096 Jan 1 1970 asc16*-rwxr-xr-x 1 1002 234 12438 Jan 1 1970 daemon*-rwxr-xr-x 1 1002 234 2832088 Jan 1 1970 dvr*-rwxr-xr-x 1 1002 234 761 Jan 1 1970 dvr.xml*-rwxr-xr-x 1 1002 234 261696 Jan 1 1970 hzk16*-rwxr-xr-x 1 1002 234 981292 Jan 1 1970 msmtp*-rwxr-xr-x 1 1002 234 631940 Jan 1 1970 parted*-rwxr-xr-x 1 1002 234 574408 Jan 1 1970 partprobe*drwxr-xr-x 1 1002 234 32 Jan 1 1970 res/drwxr-xr-x 1 1002 234 204 Jan 1 1970 ti814x/-rwxr-xr-x 1 1002 234 486640 Jan 1 1970 update*-rwxr-xr-x 1 1002 234 49350 Jan 1 1970 upnpc*drwxr-xr-x 1 1002 234 48 Jan 1 1970 www/At least there is files in it.

author: dc101
author_rank: Regular Contributor
timestamp: April 24, 2021, 10:53:24 pm
content: Can youcat /etc/rc5.d/S81appinitAnd alsols -alF /mnt/app/ti814xAlso, how did you conduct the firmware update initially? Was it through the GUI, or was it some other method?

author: poot36
author_rank: Frequent Contributor
timestamp: April 24, 2021, 11:04:58 pm
content: Output of cat /etc/rc5.d/S81appinit:root@dm814x-evm:~# cat /etc/rc5.d/S81appinitif [ -r /dev/usb/usbhd1 ];thenmount -t vfat /dev/usb/usbhd1 /mnt/usbif [ -r /mnt/usb/autoexec.sh ];thenchmod +x /mnt/usb/autoexec.sh/mnt/usb/autoexec.shelseecho "autoexec is not ready for running"fiumount -f /mnt/usbelseecho "usb is not ready for autoexec"fimount -t cramfs /dev/mtdblock5 /mnt/appmount -t yaffs2 /dev/mtdblock6 /mnt/paracd /mnt/app./logo&cd /mnt/app/ti814x/./init.sh./load.shcd /mnt/app./daemon ./dvr &Output of ls -alF /mnt/app/ti814x:root@dm814x-evm:~# ls -alF /mnt/app/ti814xdrwxr-xr-x 1 1002 234 132 Jan 1 1970 bin/-rwxr-xr-x 1 1002 234 1039 Jan 1 1970 env.sh*drwxr-xr-x 1 1002 234 108 Jan 1 1970 firmware/-rwxr-xr-x 1 1002 234 1593 Jan 1 1970 init.sh*drwxr-xr-x 1 1002 234 200 Jan 1 1970 kermod/-rwxr-xr-x 1 1002 234 646 Jan 1 1970 load.sh*-rwxr-xr-x 1 1002 234 32 Jan 1 1970 run.sh*drwxr-xr-x 1 1002 234 220 Jan 1 1970 scripts/-rwxr-xr-x 1 1002 234 522 Jan 1 1970 unload.sh*-rwxr-xr-x 1 1002 234 568 Jan 1 1970 validate.sh*I updated it through the GUI, the interesting thing is that the original firmware saw one of my flash drives but not another one and once I updated to the newer firmware (that was the working one) it did not see my original flash drive but did see the other one and then I tired the what I thought was even later firmware that resulted in the brick I have now. Odd behavior with the flash drives don't you think? They were formatted with the same filesystem as far as I can remember. I have also extracted the 2nd cramfs file system from the .pak file if I need it (I think it is the Application partition but I am not sure).

author: dc101
author_rank: Regular Contributor
timestamp: April 25, 2021, 03:32:40 pm
content: It take the GUI doesn't come up on the screen at this point?Might not be a bad idea to try and flash the 2nd cramfs image (application) to mtd5.Code:cramfs: bad compressed blocksize 2688251248cramfs: bad compressed blocksize 2688251248/etc/rc5.d/S81appinit: line 18: ./logo: not found/etc/rc5.d/S81appinit: line 21: ./init.sh: Input/output errorcramfs: bad compressed blocksize 3786985870cramfs: bad compressed blocksize 3786985870/etc/rc5.d/S81appinit: line 22: ./load.sh: Input/output errorI did some searching on these error messages and thatInput/output errorgenerally means some sort of disk/ram issue.You could try running fsck on /dev/mtdblock5 before you flash it again:umount /dev/mtdblock5; /usr/sbin/fsck.cramfs -v /dev/mtdblock5Cheers-Tim

author: poot36
author_rank: Frequent Contributor
timestamp: April 25, 2021, 04:04:10 pm
content: The GUI does not come up, I get video output but it is just a thin line on the bottom of the screen. It is giving me this error when I run that command:umount: /mnt/app: device is busy.(In some cases useful info about processes that usethe device is found by lsof(or fuser(1))cramfs endianness is littlewarning: file extends past end of filesystem/usr/sbin/fsck.cramfs: crc errorI am going to try it on mtdblock6 and see what happens. I am also going to try and mount a USB flash drive and see if I can dump the partitions.

author: poot36
author_rank: Frequent Contributor
timestamp: April 25, 2021, 04:06:57 pm
content: When I try that command on mtdblock6 I get this error:/usr/sbin/fsck.cramfs: superblock magic not foundI get the feeling that mtdblock6 is somehow corrupted.

author: poot36
author_rank: Frequent Contributor
timestamp: April 25, 2021, 04:49:24 pm
content: Well I have managed to dump all the partitions off the DVR using dd and am in the process of comparing them to the content of the .pak file.

author: poot36
author_rank: Frequent Contributor
timestamp: April 25, 2021, 05:12:55 pm
content: I have compared mtdblock5 (which is the Application partition) and have found it to be good up to a point at which it does not match the original file what so ever, the dump even includes more data then the original file so I think the incorrect firmware may have added to it in some way as well. I think the mtdblock6 is actually fine (it is completely blank according to my dump). I will flash the Application partition to the system and see what happens.

author: dc101
author_rank: Regular Contributor
timestamp: April 25, 2021, 05:44:26 pm
content: For whatever reason, the vendor decided to make mtdblock6 yaffs2 and not cramfs, so it makes sense that the super block is not found. If you look in/etc/rc5.d/S81appinityou will see the line where it mounts mtdblock6Quote from: poot36 on April 25, 2021, 04:06:57 pm

author: dc101
author_rank: Regular Contributor
timestamp: April 25, 2021, 05:49:06 pm
content: Take care that the application cramfs image you flash to mtdblock5 doesn't contain any extra information. There is a BMP file after it in the .pak file. You can run fsck.cramfs on the actual cramfs file to check it.Code:user@femto:~/re_projs/swan/DVR4-4000_GA1.9_1025$ fsck.cramfs -v cramfs2.bincramfs endianness is littlecramfs2.bin: OKIf your cramfs image contains extra data you will see something like this:Code:user@femto:~/re_projs/swan/DVR4-4000_GA1.9_1025$ fsck.cramfs ./cramfs2.binfsck.cramfs: file extends past end of filesystemQuote from: poot36 on April 25, 2021, 05:12:55 pm

author: poot36
author_rank: Frequent Contributor
timestamp: April 25, 2021, 05:50:22 pm
content: I have attached the output of the boot log to this post as it is too long for the forum once I flashed the Application partition using dd. It is now booted and I went through the initial setup wizard but now it is asking for a password to let me in that I did not set in the setup wizard so I will have to figure that out as well. Not sure if the extra data that was in the Application partition is still there or not.

author: dc101
author_rank: Regular Contributor
timestamp: April 25, 2021, 05:53:42 pm
content: Quote from: poot36 on April 25, 2021, 05:12:55 pmThis makes sense, if you recall the other kernel had a different mtd partition layout. So it probably overwrote part of what the correct kernel considers the application partition.

author: dc101
author_rank: Regular Contributor
timestamp: April 25, 2021, 05:57:02 pm
content: Quote from: poot36 on April 25, 2021, 05:50:22 pmThat's great news, glad it's working now! Hopefully it is easy enough to find the default password or figure out how to reset it. I recall seeing some forum posts about this when searching for the manuals.

author: dc101
author_rank: Regular Contributor
timestamp: April 25, 2021, 06:01:30 pm
content: Quote from: poot36 on April 25, 2021, 05:50:22 pmYou probably already discovered this but in case not "The default all-access username is admin, the default password is 12345"https://www.swann.com/us/downloads/dl/file/id/1611/product/257/4400_series_4_8_16_channel_manual.pdf

author: poot36
author_rank: Frequent Contributor
timestamp: April 25, 2021, 06:09:11 pm
content: I did find the password in this manual:https://www.appliancesonline.com.au/manuals/SWDVR-44000H/17102012100716SWDVR-44000H.pdf. The one you linked to is somewhat different from the one I found perhaps this one is for the version of the recorder that has the different firmware that does not work on my unit or vise versa (it mentioned SRDVR-84400 (8 cameras perhaps) under the system information screen(my manual shows dvr5808 (8 cameras as well)?. I tried the firmware update option and it got stuck trying to open the USB file browser and is giving me this error in the terminal:WARNING: at drivers/usb/musb/musb_host.c:148 musb_h_tx_flush_fifo+0x94/0xd4()Could not flush host TX2 fifo: csr: 3403Modules linked in: ti_cir ti_sndbase ti_gpio ti81xxhdmi ti81xxfb vpss osa_kermod syslinkBacktrace:[<c0048b70>] (dump_backtrace+0x0/0x110) from [<c03cb950>] (dump_stack+0x18/0x1c)r7:c4bb7e10 r6:c02b5768 r5:c04c3955 r4:00000094[<c03cb938>] (dump_stack+0x0/0x1c) from [<c006a1f8>] (warn_slowpath_common+0x54/0x6c)[<c006a1a4>] (warn_slowpath_common+0x0/0x6c) from [<c006a2b4>] (warn_slowpath_fmt+0x38/0x40)r9:00000000 r8:c4845bac r7:c881e522 r6:ffffffff r5:00003403r4:00003403[<c006a27c>] (warn_slowpath_fmt+0x0/0x40) from [<c02b5768>] (musb_h_tx_flush_fifo+0x94/0xd4)r3:00000002 r2:c04c3972[<c02b56d4>] (musb_h_tx_flush_fifo+0x0/0xd4) from [<c02b6890>] (musb_cleanup_urb+0x108/0x164)r8:c4b96900 r7:c881e520 r6:00000000 r5:c4811060 r4:c4845bac[<c02b6788>] (musb_cleanup_urb+0x0/0x164) from [<c02b70a8>] (musb_urb_dequeue+0x150/0x180)[<c02b6f58>] (musb_urb_dequeue+0x0/0x180) from [<c02a1eb8>] (unlink1+0xa4/0xb0)[<c02a1e14>] (unlink1+0x0/0xb0) from [<c02a1fe8>] (usb_hcd_unlink_urb+0x58/0x74)r9:c4967844 r8:c4bb6000 r7:ffffff98 r6:c4b96900 r5:a0000093r4:00000000[<c02a1f90>] (usb_hcd_unlink_urb+0x0/0x74) from [<c02a21a0>] (usb_unlink_urb+0x40/0x44)r7:c023c264 r6:c4967800 r5:c4bb7f7c r4:c4967b20[<c02a2160>] (usb_unlink_urb+0x0/0x44) from [<c02b0d70>] (usb_stor_stop_transport+0x38/0x64)[<c02b0d38>] (usb_stor_stop_transport+0x0/0x64) from [<c02b05fc>] (command_abort+0x78/0x8c)r5:c4bb7f7c r4:c4967b20[<c02b0584>] (command_abort+0x0/0x8c) from [<c023a8d4>] (scsi_try_to_abort_cmd+0x2c/0x30)r5:c4bb7f7c r4:c32179c0[<c023a8a8>] (scsi_try_to_abort_cmd+0x0/0x30) from [<c023c390>] (scsi_error_handler+0x12c/0x370)[<c023c264>] (scsi_error_handler+0x0/0x370) from [<c0081558>] (kthread+0x8c/0x94)[<c00814cc>] (kthread+0x0/0x94) from [<c006d400>] (do_exit+0x0/0x5e4)r7:00000013 r6:c006d400 r5:c00814cc r4:c48abb78---[ end trace 53cb76d1ab031c95 ]---_IRrecv key: KEY_ENTER_IRhub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: Cannot enable port 3. Maybe the USB cable is bad?hub 1-1:1.0: cannot disable port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: Cannot enable port 3. Maybe the USB cable is bad?hub 1-1:1.0: cannot disable port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)hub 1-1:1.0: cannot reset port 3 (err = -110)AUDIO >> read recover return -32AUDIO >> read rehub 1-1:1.0: cannot reset port 3 (err = -110)cover return -32hub 1-1:1.0: Cannot enable port 3. Maybe the USB cable is bad?AUDIO >> read recover return -32AUDIO >> read recover return -32AUDIO >> read recover return -32hub 1-1:1.0: cannot disable port 3 (err = -110)AUDIO >> read rehub 1-1:1.0: cannot reset port 3 (err = -110)cover return -32AUDIO >> read rehub 1-1:1.0: cannot reset port 3 (err = -110)cover return -32Not sure what is going on here but I suspect that there is still issues with the boot or the flash drive is somehow incompatible with the OS (it worked fine for the dd stuff though). The unit did eventually crash and reboot on its own.

author: poot36
author_rank: Frequent Contributor
timestamp: April 25, 2021, 09:39:28 pm
content: Well I managed to get the firmware update loader screen to show by booting the unit with the USB drive not connected and then connecting it when I was in the update screen. Here is the terminal output of the update process if anyone is interested (is continued on 2nd post as it is to long):Sending discover...usb 1-1.3: new high speed USB device using musb-hdrc and address 4Sending discover...usb 1-1.3: New USB device found, idVendor=090c, idProduct=1000usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0usb 1-1.3: Product: USB DISKusb 1-1.3: Manufacturer: SMI Corporationscsi3 : usb-storage 1-1.3:1.0scsi 3:0:0:0: Direct-Access SMI USB DISK 1100 PQ: 0 ANSI: 4sd 3:0:0:0: Attached scsi generic sg2 type 0sd 3:0:0:0:  15974400 512-byte logical blocks: (8.17 GB/7.61 GiB)sd 3:0:0:0:  Write Protect is offsd 3:0:0:0:  Assuming drive cache: write throughsd 3:0:0:0:  Assuming drive cache: write throughsdc: sdc1sd 3:0:0:0:  Assuming drive cache: write throughsd 3:0:0:0:  Attached SCSI removable diskumount: /mnt/usb/: not mountedmount usb device ok,Leftsize:0 Bclean list control and linklist.clean list control and linklist ok.no file in dir "/mnt/usb/"winBackupInfo.pFiles count:24list file ok.func:BackupProc line:299 winBackupInfo.Leftsize=236 MBSending discover...recv key: KEY_ENTER_IRmount usb device ok,Leftsize:236 MBclean list control and linklist.clean list control and linklist ok.no file in dir "/mnt/usb/"winBackupInfo.pFiles count:24list file ok.func:BackupProc line:299 winBackupInfo.Leftsize=236 MBusb 1-1.3: USB disconnect, address 4Save Child Window hMenu is 0 !umount -f /mnt/usb/res = 0x:320 y:168Sending discover...Sending discover...Sending discover...Sending discover...Sending discover...Sending discover...Sending discover...Sending discover...usb 1-1.3: new high speed USB device using musb-hdrc and address 5Sending discover...usb 1-1.3: New USB device found, idVendor=090c, idProduct=1000usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0usb 1-1.3: Product: USB DISKusb 1-1.3: Manufacturer: SMI Corporationscsi4 : usb-storage 1-1.3:1.0scsi 4:0:0:0: Direct-Access SMI USB DISK 1100 PQ: 0 ANSI: 4sd 4:0:0:0: Attached scsi generic sg2 type 0sd 4:0:0:0:  15974400 512-byte logical blocks: (8.17 GB/7.61 GiB)sd 4:0:0:0:  Write Protect is offsd 4:0:0:0:  Assuming drive cache: write throughsd 4:0:0:0:  Assuming drive cache: write throughsdc: sdc1sd 4:0:0:0:  Assuming drive cache: write throughsd 4:0:0:0:  Attached SCSI removable diskumount: /mnt/usb/: not mountedmount usb device ok,Leftsize:0 Bclean list control and linklist.clean list control and linklist ok.no file in dir "/mnt/usb/"winBackupInfo.pFiles count:25list file ok.func:BackupProc line:299 winBackupInfo.Leftsize=216 MBfunc:BackupProc line:299 winBackupInfo.Leftsize=216 MBrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_UP_IRrecv key: KEY_ENTER_IRrecv key: KEY_ENTER_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_UP_IRrecv key: KEY_UP_IRrecv key: KEY_ENTER_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRSending discover...recv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRSending discover...recv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRSending discover...recv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_ENTER_IRrecv key: KEY_DOWN_IRrecv key: KEY_ENTER_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_IR_EXITrecv key: KEY_DOWN_IRrecv key: KEY_DOWN_IRrecv key: KEY_UP_IRrecv key: KEY_ENTER_IRrecv key: KEY_DOWN_IRrecv key: KEY_ENTER_IRSelected file is DVR4-4000_GA1.9_1025.pak.source file is "DVR4-4000_GA1.9_1025.pak"upgrade soft ware.path:/mnt/usb/DVR4-4000_GA1.9_1025.pakftp exit alreadykill net serverSending discover...Erasing 128 Kibyte @ 1a0000 -- 40 % cyaffs: dev is 32505862 name is "mtdblock6" rwErasingyaffs: passed flags ""Erasing 128 Kibyte @ 400000 -- 100 % complete.killall: ntpclient: no process killedkillall: ddns-start: no process killedDDNS stopedAUDIO >> disable -1AUDIO >> disable -1AUDIO >> disable -1AUDIO >> disable -1killall: msmtp: no process killedkillall: httpd: no process killedkillall: jffs2_gcd_mtd1: no process killedkillall: jffs2_gcd_mtd3: no process killedwatchdog not enabled!---image layer out---uboot1 in /dev/mtd0 0x00000000 +0x0 0x20000uboot2 in /dev/mtd1 0x00020000 +0x0 0x240000bootargs in /dev/mtd2 0x00260000 +0x0 0x20000kernel in /dev/mtd3 0x00280000 +0x0 0x440000fs in /dev/mtd4 0x006c0000 +0x0 0x800000app in /dev/mtd5 0x00ec0000 +0x0 0xc00000para in /dev/mtd6 0x01ac0000 +0x0 0x400000logo in /dev/mtd8 0x01ee0000 +0x0 0x100000version in /dev/mtd7 0x01ec0000 +0x0 0x20000---------------------prepare update uboot1 to mtd:/dev/mtd0ioctl(): Bad file descriptorThis doesn't seem to be a valid MTD flash device!update uboot1 errprepare update uboot2 to mtd:/dev/mtd1writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 195328 byteserasing start:131072,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 195328 / 195328 bytesupdate uboot2 successprepare update bootargs to mtd:/dev/mtd2writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 131072 bytesupdate bootargs successprepare update kernel to mtd:/dev/mtd3writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 2662480 byteserasing start:131072,len:131072 ...ok !Erased 131072 bytesok ! Wrote 262144 / 2662480 byteserasing start:262144,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 393216 / 2662480 byteserasing start:393216,len:131072 ...ok !Erased 131072 bytesok ! Wrote 524288 / 2662480 byteserasing start:524288,len:131072 ...ok !Erased 131072 bytesok ! Wrote 655360 / 2662480 byteserasing start:655360,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 786432 / 2662480 byteserasing start:786432,len:131072 ...ok !Erased 131072 bytesok ! Wrote 917504 / 2662480 byteserasing start:917504,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1048576 / 2662480 byteserasing start:1048576,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1179648 / 2662480 byteserasing start:1179648,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 1310720 / 2662480 byteserasing start:1310720,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1441792 / 2662480 byteserasing start:1441792,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1572864 / 2662480 byteserasing start:1572864,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1703936 / 2662480 byteserasing start:1703936,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 1835008 / 2662480 byteserasing start:1835008,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1966080 / 2662480 byteserasing start:1966080,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2097152 / 2662480 byteserasing start:2097152,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 2228224 / 2662480 byteserasing start:2228224,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2359296 / 2662480 byteserasing start:2359296,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2490368 / 2662480 byteserasing start:2490368,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2621440 / 2662480 byteserasing start:2621440,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 2662480 / 2662480 bytesupdate kernel successprepare update fs to mtd:/dev/mtd4writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 8011776 byteserasing start:131072,len:131072 ...ok !Erased 131072 bytesok ! Wrote 262144 / 8011776 byteserasing start:262144,len:131072 ...ok !Erased 131072 bytesok ! Wrote 393216 / 8011776 byteserasing start:393216,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 524288 / 8011776 byteserasing start:524288,len:131072 ...ok !Erased 131072 bytesok ! Wrote 655360 / 8011776 byteserasing start:655360,len:131072 ...ok !Erased 131072 bytesok ! Wrote 786432 / 8011776 byteserasing start:786432,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 917504 / 8011776 byteserasing start:917504,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1048576 / 8011776 byteserasing start:1048576,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1179648 / 8011776 byteserasing start:1179648,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1310720 / 8011776 byteserasing start:1310720,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 1441792 / 8011776 byteserasing start:1441792,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1572864 / 8011776 byteserasing start:1572864,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1703936 / 8011776 byteserasing start:1703936,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1835008 / 8011776 byteserasing start:1835008,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 1966080 / 8011776 byteserasing start:1966080,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2097152 / 8011776 byteserasing start:2097152,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2228224 / 8011776 byteserasing start:2228224,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 2359296 / 8011776 byteserasing start:2359296,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2490368 / 8011776 byteserasing start:2490368,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2621440 / 8011776 byteserasing start:2621440,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2752512 / 8011776 byteserasing start:2752512,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 2883584 / 8011776 byteserasing start:2883584,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3014656 / 8011776 byteserasing start:3014656,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3145728 / 8011776 byteserasing start:3145728,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 3276800 / 8011776 byteserasing start:3276800,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3407872 / 8011776 byteserasing start:3407872,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3538944 / 8011776 byteserasing start:3538944,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3670016 / 8011776 byteserasing start:3670016,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 3801088 / 8011776 byteserasing start:3801088,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3932160 / 8011776 byteserasing start:3932160,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4063232 / 8011776 byteserasing start:4063232,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4194304 / 8011776 byteserasing start:4194304,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 4325376 / 8011776 byteserasing start:4325376,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4456448 / 8011776 byteserasing start:4456448,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4587520 / 8011776 byteserasing start:4587520,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 4718592 / 8011776 byteserasing start:4718592,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4849664 / 8011776 byteserasing start:4849664,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4980736 / 8011776 byteserasing start:4980736,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5111808 / 8011776 byteserasing start:5111808,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 5242880 / 8011776 byteserasing start:5242880,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5373952 / 8011776 byteserasing start:5373952,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5505024 / 8011776 byteserasing start:5505024,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5636096 / 8011776 byteserasing start:5636096,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 5767168 / 8011776 byteserasing start:5767168,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5898240 / 8011776 byteserasing start:5898240,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6029312 / 8011776 byteserasing start:6029312,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 6160384 / 8011776 byteserasing start:6160384,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6291456 / 8011776 byteserasing start:6291456,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6422528 / 8011776 byteserasing start:6422528,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6553600 / 8011776 byteserasing start:6553600,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 6684672 / 8011776 byteserasing start:6684672,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6815744 / 8011776 byteserasing start:6815744,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6946816 / 8011776 byteserasing start:6946816,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7077888 / 8011776 byteserasing start:7077888,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 7208960 / 8011776 byteserasing start:7208960,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7340032 / 8011776 byteserasing start:7340032,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7471104 / 8011776 byteserasing start:7471104,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 7602176 / 8011776 byteserasing start:7602176,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7733248 / 8011776 byteserasing start:7733248,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7864320 / 8011776 byteserasing start:7864320,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7995392 / 8011776 byteserasing start:7995392,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 8011776 / 8011776 bytesupdate fs success

author: poot36
author_rank: Frequent Contributor
timestamp: April 25, 2021, 09:46:02 pm
content: prepare update app to mtd:/dev/mtd5writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 8957952 byteserasing start:131072,len:131072 ...ok !Erased 131072 bytesok ! Wrote 262144 / 8957952 byteserasing start:262144,len:131072 ...ok !Erased 131072 bytesok ! Wrote 393216 / 8957952 byteserasing start:393216,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 524288 / 8957952 byteserasing start:524288,len:131072 ...ok !Erased 131072 bytesok ! Wrote 655360 / 8957952 byteserasing start:655360,len:131072 ...ok !Erased 131072 bytesok ! Wrote 786432 / 8957952 byteserasing start:786432,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 917504 / 8957952 byteserasing start:917504,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1048576 / 8957952 byteserasing start:1048576,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1179648 / 8957952 byteserasing start:1179648,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1310720 / 8957952 byteserasing start:1310720,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 1441792 / 8957952 byteserasing start:1441792,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1572864 / 8957952 byteserasing start:1572864,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1703936 / 8957952 byteserasing start:1703936,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1835008 / 8957952 byteserasing start:1835008,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 1966080 / 8957952 byteserasing start:1966080,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2097152 / 8957952 byteserasing start:2097152,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2228224 / 8957952 byteserasing start:2228224,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 2359296 / 8957952 byteserasing start:2359296,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2490368 / 8957952 byteserasing start:2490368,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2621440 / 8957952 byteserasing start:2621440,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2752512 / 8957952 byteserasing start:2752512,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 2883584 / 8957952 byteserasing start:2883584,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3014656 / 8957952 byteserasing start:3014656,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3145728 / 8957952 byteserasing start:3145728,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3276800 / 8957952 byteserasing start:3276800,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 3407872 / 8957952 byteserasing start:3407872,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3538944 / 8957952 byteserasing start:3538944,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3670016 / 8957952 byteserasing start:3670016,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 3801088 / 8957952 byteserasing start:3801088,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3932160 / 8957952 byteserasing start:3932160,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4063232 / 8957952 byteserasing start:4063232,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4194304 / 8957952 byteserasing start:4194304,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 4325376 / 8957952 byteserasing start:4325376,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4456448 / 8957952 byteserasing start:4456448,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4587520 / 8957952 byteserasing start:4587520,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4718592 / 8957952 byteserasing start:4718592,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 4849664 / 8957952 byteserasing start:4849664,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4980736 / 8957952 byteserasing start:4980736,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5111808 / 8957952 byteserasing start:5111808,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 5242880 / 8957952 byteserasing start:5242880,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5373952 / 8957952 byteserasing start:5373952,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5505024 / 8957952 byteserasing start:5505024,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5636096 / 8957952 byteserasing start:5636096,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 5767168 / 8957952 byteserasing start:5767168,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5898240 / 8957952 byteserasing start:5898240,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6029312 / 8957952 byteserasing start:6029312,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 6160384 / 8957952 byteserasing start:6160384,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6291456 / 8957952 byteserasing start:6291456,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6422528 / 8957952 byteserasing start:6422528,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6553600 / 8957952 byteserasing start:6553600,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 6684672 / 8957952 byteserasing start:6684672,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6815744 / 8957952 byteserasing start:6815744,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6946816 / 8957952 byteserasing start:6946816,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7077888 / 8957952 byteserasing start:7077888,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 7208960 / 8957952 byteserasing start:7208960,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7340032 / 8957952 byteserasing start:7340032,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7471104 / 8957952 byteserasing start:7471104,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 7602176 / 8957952 byteserasing start:7602176,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7733248 / 8957952 byteserasing start:7733248,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7864320 / 8957952 byteserasing start:7864320,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7995392 / 8957952 byteserasing start:7995392,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 8126464 / 8957952 byteserasing start:8126464,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8257536 / 8957952 byteserasing start:8257536,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8388608 / 8957952 byteserasing start:8388608,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8519680 / 8957952 byteserasing start:8519680,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 8650752 / 8957952 byteserasing start:8650752,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8781824 / 8957952 byteserasing start:8781824,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8912896 / 8957952 byteserasing start:8912896,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 8957952 / 8957952 bytesupdate app successprepare update logo to mtd:/dev/mtd8writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 935766 byteserasing start:131072,len:131072 ...ok !Erased 131072 bytesok ! Wrote 262144 / 935766 byteserasing start:262144,len:131072 ...ok !Erased 131072 bytesok ! Wrote 393216 / 935766 byteserasing start:393216,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 524288 / 935766 byteserasing start:524288,len:131072 ...ok !Erased 131072 bytesok ! Wrote 655360 / 935766 byteserasing start:655360,len:131072 ...ok !Erased 131072 bytesok ! Wrote 786432 / 935766 byteserasing start:786432,len:131072 ...ok !Erased 131072 bytesok ! Wrote 917504 / 935766 byteserasing start:917504,len:131072 ...ok !Erased 131072 byteswatchdog not enabled!ok ! Wrote 93576nand_do_write_ops: Attempt to write not page aligned data6 / 935766 bytesupdate logo successwrite versionread uboot1 's version:v1.0.0.1read uboot2 's version:v1.0.0.1read bootargs 's version:v1.0.0.1read kernel 's version:v1.0.0.1read fs 's version:v1.0.0.2read app 's version:v1.0.0.9the section:para is not found in imgget para 's info errread logo 's version:v1.0.0.1the section:version is not found in imgget version 's info errwrite version err:-1**********update logo from file**********file doesn't exist.file:update.cpp line:154 reset.watchdog not enabled!watchdog not enabled!CCCCC

author: poot36
author_rank: Frequent Contributor
timestamp: April 25, 2021, 10:18:22 pm
content: After examining the output it looks like it can not flash the first stage bootloader for some reason. Also it is having issues with a few other partitions. Got any idea how to fix this? The 2nd stage bootloader is working as I was able to boot the DVR after I manually loaded the first stage bootloader over serial (u-boot-min.nand in this case). I found that you do not need to send the u-boot-min.serial to get it to boot off serial, you can send any of the compatible u-boot-min.XXXX versions and it should execute them. I also took a look at the cramfs files in my Linux vm (mounted them) and found out that the incorrect firmware was for the DM810x version of the main chip. I have attached to this post the u-boot-min.nand and u-boot files that are for this incorrect main chip that I wound up flashing to my unit (dumped from my unit). These are labeled u-boot-min, u-boot, and u-boot env by the kernel. They are partitions 0, 1 , and 2. May help someone with this other unit fix theirs.

author: dc101
author_rank: Regular Contributor
timestamp: April 25, 2021, 11:47:36 pm
content: The unit I ordered from eBay is supposed to arrived tomorrow. I will take a look at it and dump the partitions and compare them to yours.Quote from: poot36 on April 25, 2021, 10:18:22 pm

author: poot36
author_rank: Frequent Contributor
timestamp: April 26, 2021, 01:13:19 am
content: That is good to know. Also figured out that the Application partition has extra data in it even after I ran the firmware updater so I manually erased the partition and re-loaded the Application data through the serial port under the u-boot environment. It did not fix the failure to have the firmware update flash the u-boot-min though. Is there a way to stop Linux from loading the DVR program and drop me to a login prompt so that I can try re-dumping the partitions now that I have fixed some of them?

author: dc101
author_rank: Regular Contributor
timestamp: April 26, 2021, 01:38:07 am
content: If you want to prevent it from loading the dvr program you just need to edit/etc/rc5.d/S81appinitand comment out./daemon ./dvr &Quote from: poot36 on April 24, 2021, 11:04:58 pm

author: poot36
author_rank: Frequent Contributor
timestamp: April 26, 2021, 01:55:39 am
content: Ok, but that is in the cramfs partition that gets uncompressed when it runs. Not sure how to edit that from u-boot either. Is there a key combination that I can press in the serial terminal that will stop boot and drop me to to a login prompt?

author: dc101
author_rank: Regular Contributor
timestamp: April 26, 2021, 08:28:58 pm
content: You might be able to ctrl-c escape out of it, but I'm not sure that works since the commands are coming from the rc.d startup process.I popped the lid off my DVR that arrived today, it's a little dusty inside but seems to boot ok. Can you post a picture of the the serial port and mark the TX and RX?Cheers-Tim

author: dc101
author_rank: Regular Contributor
timestamp: April 26, 2021, 09:37:55 pm
content: So it turns out you can just press enter when it's done booting to get the login prompt and then it's just root with no password.I've attached my boot log for comparison. I only glanced at it, but I noticed similar error messages as yours despite it working fine.Quote from: poot36 on April 26, 2021, 01:55:39 am

author: poot36
author_rank: Frequent Contributor
timestamp: April 27, 2021, 01:38:01 am
content: I wonder if you have the original firmware that these units shipped with. Yours does not have the dvr configure start section that mine has. Do you want me to dump my partitions again? By the way can you recommend a good windows based hex file compare program that preferably has the ability to show if the file being compared is part of a larger file? I am currently using FlexHEX but it has it's issues and I do not fully trust it to make the best decisions when comparing files.

author: poot36
author_rank: Frequent Contributor
timestamp: April 27, 2021, 02:17:41 am
content: I have got the terminal but it keeps popping up with Sending discover message that interferes with me typing in commands. What process do I need to kill to stop it from sending these messages? I have attached a list of all the running processes found with the ps command:PID USER VSZ STAT COMMAND1 root 1708 S init 2 root 0 SW 3 root 0 SW [ksoftirqd/0]4 root 0 SW [kworker/0:0]5 root 0 SW [kworker/u:0]6 root 0 SW< 7 root 0 SW [irq/72-serial i]8 root 0 SW [irq/73-serial i]9 root 0 SW [irq/74-serial i]10 root 0 SW [irq/44-serial i]11 root 0 SW [irq/45-serial i]12 root 0 SW [irq/46-serial i]13 root 0 SW< 14 root 0 SW 15 root 0 SW [bdi-default]16 root 0 SW< 17 root 0 SW< 18 root 0 SW 19 root 0 SW 20 root 0 SW< 21 root 0 SW< [musb-hdrc.0]22 root 0 SW< [musb-hdrc.1]23 root 0 SW< 24 root 0 SW 25 root 0 SW [kworker/0:1]26 root 0 SW< 27 root 0 SW< 28 root 0 SW< 37 root 0 SW 38 root 0 SW [kworker/u:1]39 root 0 SW [kworker/u:2]40 root 0 SW 41 root 0 SW 42 root 0 SW 43 root 0 SW 44 root 0 SW 45 root 0 SW 46 root 0 SW 47 root 0 SW 48 root 0 SW 49 root 0 SW 50 root 0 SW 59 root 0 SW< 60 root 0 SW 61 root 0 SW [usb-storage]84 root 1956 S < /sbin/udevd -d782 root 2936 S /usr/sbin/telnetd787 root 3000 S /sbin/syslogd -n -C64 -m 20789 root 2936 S /sbin/klogd -n793 root 0 SW [yaffs-bg-1]808 root 1752 S ./bin/remote_debug_client.out 0xbff00000888 root 3092 S ./daemon ./dvr890 root 2516 S login -- root891 root 1964 S /sbin/getty 38400 tty1892 root 3092 S ./daemon ./dvr893 root 2936 S sh -c ./dvr894 root 369m R ./dvr937 root 0 SW [flush-31:6]942 root 0 SW 943 root 0 SW [flush-8:0]954 root 2940 S udhcpc -i eth0971 root 2936 S httpd -h /mnt/app/www -p 85976 root 3128 S -sh1013 root 0 SW 1014 root 0 SW [usb-storage]1065 root 3128 R ps

author: dc101
author_rank: Regular Contributor
timestamp: April 27, 2021, 02:30:19 am
content: I'm not sure what version I have. Our kernel version are different though.Mine is:Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #126 Tue May 22 19:07:21 CST 2012And yours is:Linux version 2.6.37 (zr@pub-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #4 Fri Sep 21 11:11:53 CST 2012In the system menu, my system information is:Device Name : DVRModel : DVR4-4000Build No. : build 0618Hw No. : TCCB01Cfg version : v1.0.0.1Fw version :As far as the messages that pop up, I get a regular stream of these messages. They're just output though and won't actually change the command you're typing. You can just ignore them and continue typing.Code:sendto: Network is unreachableNo IGD UPnP Device found on the network !

author: poot36
author_rank: Frequent Contributor
timestamp: April 27, 2021, 02:49:23 am
content: I did figure out that they do not interfere with command typing but I want to copy some of the commands I run to make sure I don't screw up typing in the command when I am dumping the partitions. If I plugged in the network cable would that stop them?

author: dc101
author_rank: Regular Contributor
timestamp: April 27, 2021, 03:04:20 am
content: No, I have a network cable plugged in and still receive those messages.It looks like it's caused by the UPnP client (/mnt/app/upnpc), but I haven't looked to see what's calling it. Running the command manually produces the same message.Code:root@dm814x-evm:/mnt/app# ./upnpc -lsendto: Network is unreachableNo IGD UPnP Device found on the network !

author: dc101
author_rank: Regular Contributor
timestamp: April 27, 2021, 03:18:33 am
content: As far as Windows hex editors go, I use HxD and 010. I believe only 010 can do comparison between binary files though. I don't ever use 010 for file comparison though. In my opinion vbindiff for Linux is much more flexible and faster and is what I use 99.9% of the time. The biggest thing I like about vbindiff is that it will let you re-align files so you can continue the comparison so something like an extra character in the middle of the file doesn't throw off the comparison when it would have otherwise matched.Quote from: poot36 on April 27, 2021, 01:38:01 am

author: dc101
author_rank: Regular Contributor
timestamp: April 27, 2021, 03:24:04 am
content: Quote from: poot36 on April 27, 2021, 02:49:23 amIt looks like upnpc is called directly from the main dvr program. I've tried killing the dvr program a few times and it always results in the system rebooting, probably some watch dog checking to see if it died.

author: poot36
author_rank: Frequent Contributor
timestamp: April 27, 2021, 03:27:40 am
content: When I killed that process my unit ended up crashing and rebooting. I plugged a network cable into the unit and the messages stopped. Could also be that I was also trying pressing Ctrl z,x,c at various times in the boot process along with enter that may have had an effect. I have re-dumped the partitions and there are some differences, partition 6 has changed with the units configuration info in it and partition 10 (I am starting from partition 0) has changed in size (now 96,414 KB instead of the orignal 97,408 KB). Partition 0 is still incorrect but I think the rest of them are now correct. I have attached partitions 0, 1, and 2 to this post.

author: dc101
author_rank: Regular Contributor
timestamp: April 27, 2021, 04:23:36 am
content: If you wanted to try doing a firmware update, it looks like you can run it from the command line by runningupdate 1 release.pak all. I found this command in the .ash_history file of the root user.I will probably wait to make copies of all the mtd partitions and analyze it before I decide if I want to upgrade the firmware.

author: poot36
author_rank: Frequent Contributor
timestamp: April 28, 2021, 01:55:00 am
content: I will give that command a go. Hopefully it will update partition 0 and I will be out of the woods. Thank you for all the help you have provided. It is rare to get an expert on the thing that you are trying to fix.

author: poot36
author_rank: Frequent Contributor
timestamp: April 28, 2021, 02:02:14 am
content: That did not work, update command not found.

author: dc101
author_rank: Regular Contributor
timestamp: April 28, 2021, 11:35:32 am
content: It should be in /mnt/app which is not in $PATH. You will need to run it either as /mnt/app/update or cd to /mnt/app and then ./updateYou will also need to make sure to point to the full path of your .pak file as well. Probably easiest to put it on a thumb drive, I don't believe any of the file systems have enough room for the update file.

author: poot36
author_rank: Frequent Contributor
timestamp: April 29, 2021, 03:07:47 am
content: Well running it from there worked but still did not update partition 0. Here is the log:root@dm814x-evm:/mnt/app# ./update 1 /proc/bus/usb/DVR4-4000_GA1.9_1025.pak allsh: killall: not foundsh: killall: not foundsh: killall: not foundsh: killall: not foundsh: killall: not foundsh: killall: not foundsh: killall: not foundsh: killall: not foundsh: killall: not foundsh: killall: not found---image layer out---uboot1 in /dev/mtd0 0x00000000 +0x0 0x20000uboot2 in /dev/mtd1 0x00020000 +0x0 0x240000bootargs in /dev/mtd2 0x00260000 +0x0 0x20000kernel in /dev/mtd3 0x00280000 +0x0 0x440000fs in /dev/mtd4 0x006c0000 +0x0 0x800000app in /dev/mtd5 0x00ec0000 +0x0 0xc00000para in /dev/mtd6 0x01ac0000 +0x0 0x400000logo in /dev/mtd8 0x01ee0000 +0x0 0x100000version in /dev/mtd7 0x01ec0000 +0x0 0x20000---------------------prepare update uboot1 to mtd:/dev/mtd0ioctl(): Bad file descriptorThis doesn't seem to be a valid MTD flash device!update uboot1 errprepare update uboot2 to mtd:/dev/mtd1writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 195328 byteserasing start:131072,len:131072 ...ok !Erased 131072 bytesok ! Wrote 195328 / 195328 bytesupdate uboot2 successprepare update bootargs to mtd:/dev/mtd2writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 131072 bytesupdate bootargs successprepare update kernel to mtd:/dev/mtd3writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 2662480 byteserasing start:131072,len:131072 ...ok !Erased 131072 bytesok ! Wrote 262144 / 2662480 byteserasing start:262144,len:131072 ...ok !Erased 131072 bytesok ! Wrote 393216 / 2662480 byteserasing start:393216,len:131072 ...ok !Erased 131072 bytesok ! Wrote 524288 / 2662480 byteserasing start:524288,len:131072 ...ok !Erased 131072 bytesok ! Wrote 655360 / 2662480 byteserasing start:655360,len:131072 ...ok !Erased 131072 bytesok ! Wrote 786432 / 2662480 byteserasing start:786432,len:131072 ...ok !Erased 131072 bytesok ! Wrote 917504 / 2662480 byteserasing start:917504,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1048576 / 2662480 byteserasing start:1048576,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1179648 / 2662480 byteserasing start:1179648,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1310720 / 2662480 byteserasing start:1310720,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1441792 / 2662480 byteserasing start:1441792,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1572864 / 2662480 byteserasing start:1572864,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1703936 / 2662480 byteserasing start:1703936,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1835008 / 2662480 byteserasing start:1835008,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1966080 / 2662480 byteserasing start:1966080,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2097152 / 2662480 byteserasing start:2097152,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2228224 / 2662480 byteserasing start:2228224,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2359296 / 2662480 byteserasing start:2359296,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2490368 / 2662480 byteserasing start:2490368,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2621440 / 2662480 byteserasing start:2621440,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2662480 / 2662480 bytesupdate kernel successprepare update fs to mtd:/dev/mtd4writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 8011776 byteserasing start:131072,len:131072 ...ok !Erased 131072 bytesok ! Wrote 262144 / 8011776 byteserasing start:262144,len:131072 ...ok !Erased 131072 bytesok ! Wrote 393216 / 8011776 byteserasing start:393216,len:131072 ...ok !Erased 131072 bytesok ! Wrote 524288 / 8011776 byteserasing start:524288,len:131072 ...ok !Erased 131072 bytesok ! Wrote 655360 / 8011776 byteserasing start:655360,len:131072 ...ok !Erased 131072 bytesok ! Wrote 786432 / 8011776 byteserasing start:786432,len:131072 ...ok !Erased 131072 bytesok ! Wrote 917504 / 8011776 byteserasing start:917504,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1048576 / 8011776 byteserasing start:1048576,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1179648 / 8011776 byteserasing start:1179648,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1310720 / 8011776 byteserasing start:1310720,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1441792 / 8011776 byteserasing start:1441792,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1572864 / 8011776 byteserasing start:1572864,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1703936 / 8011776 byteserasing start:1703936,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1835008 / 8011776 byteserasing start:1835008,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1966080 / 8011776 byteserasing start:1966080,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2097152 / 8011776 byteserasing start:2097152,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2228224 / 8011776 byteserasing start:2228224,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2359296 / 8011776 byteserasing start:2359296,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2490368 / 8011776 byteserasing start:2490368,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2621440 / 8011776 byteserasing start:2621440,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2752512 / 8011776 byteserasing start:2752512,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2883584 / 8011776 byteserasing start:2883584,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3014656 / 8011776 byteserasing start:3014656,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3145728 / 8011776 byteserasing start:3145728,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3276800 / 8011776 byteserasing start:3276800,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3407872 / 8011776 byteserasing start:3407872,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3538944 / 8011776 byteserasing start:3538944,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3670016 / 8011776 byteserasing start:3670016,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3801088 / 8011776 byteserasing start:3801088,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3932160 / 8011776 byteserasing start:3932160,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4063232 / 8011776 byteserasing start:4063232,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4194304 / 8011776 byteserasing start:4194304,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4325376 / 8011776 byteserasing start:4325376,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4456448 / 8011776 byteserasing start:4456448,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4587520 / 8011776 byteserasing start:4587520,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4718592 / 8011776 byteserasing start:4718592,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4849664 / 8011776 byteserasing start:4849664,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4980736 / 8011776 byteserasing start:4980736,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5111808 / 8011776 byteserasing start:5111808,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5242880 / 8011776 byteserasing start:5242880,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5373952 / 8011776 byteserasing start:5373952,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5505024 / 8011776 byteserasing start:5505024,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5636096 / 8011776 byteserasing start:5636096,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5767168 / 8011776 byteserasing start:5767168,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5898240 / 8011776 byteserasing start:5898240,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6029312 / 8011776 byteserasing start:6029312,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6160384 / 8011776 byteserasing start:6160384,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6291456 / 8011776 byteserasing start:6291456,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6422528 / 8011776 byteserasing start:6422528,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6553600 / 8011776 byteserasing start:6553600,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6684672 / 8011776 byteserasing start:6684672,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6815744 / 8011776 byteserasing start:6815744,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6946816 / 8011776 byteserasing start:6946816,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7077888 / 8011776 byteserasing start:7077888,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7208960 / 8011776 byteserasing start:7208960,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7340032 / 8011776 byteserasing start:7340032,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7471104 / 8011776 byteserasing start:7471104,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7602176 / 8011776 byteserasing start:7602176,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7733248 / 8011776 byteserasing start:7733248,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7864320 / 8011776 byteserasing start:7864320,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7995392 / 8011776 byteserasing start:7995392,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8011776 / 8011776 bytesupdate fs successprepare update app to mtd:/dev/mtd5writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 8957952 byteserasing start:131072,len:131072 ...ok !Erased 131072 bytesok ! Wrote 262144 / 8957952 byteserasing start:262144,len:131072 ...ok !Erased 131072 bytesok ! Wrote 393216 / 8957952 byteserasing start:393216,len:131072 ...ok !Erased 131072 bytesok ! Wrote 524288 / 8957952 byteserasing start:524288,len:131072 ...ok !Erased 131072 bytesok ! Wrote 655360 / 8957952 byteserasing start:655360,len:131072 ...ok !Erased 131072 bytesok ! Wrote 786432 / 8957952 byteserasing start:786432,len:131072 ...ok !Erased 131072 bytesok ! Wrote 917504 / 8957952 byteserasing start:917504,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1048576 / 8957952 byteserasing start:1048576,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1179648 / 8957952 byteserasing start:1179648,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1310720 / 8957952 byteserasing start:1310720,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1441792 / 8957952 byteserasing start:1441792,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1572864 / 8957952 byteserasing start:1572864,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1703936 / 8957952 byteserasing start:1703936,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1835008 / 8957952 byteserasing start:1835008,len:131072 ...ok !Erased 131072 bytesok ! Wrote 1966080 / 8957952 byteserasing start:1966080,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2097152 / 8957952 byteserasing start:2097152,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2228224 / 8957952 byteserasing start:2228224,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2359296 / 8957952 byteserasing start:2359296,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2490368 / 8957952 byteserasing start:2490368,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2621440 / 8957952 byteserasing start:2621440,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2752512 / 8957952 byteserasing start:2752512,len:131072 ...ok !Erased 131072 bytesok ! Wrote 2883584 / 8957952 byteserasing start:2883584,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3014656 / 8957952 byteserasing start:3014656,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3145728 / 8957952 byteserasing start:3145728,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3276800 / 8957952 byteserasing start:3276800,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3407872 / 8957952 byteserasing start:3407872,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3538944 / 8957952 byteserasing start:3538944,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3670016 / 8957952 byteserasing start:3670016,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3801088 / 8957952 byteserasing start:3801088,len:131072 ...ok !Erased 131072 bytesok ! Wrote 3932160 / 8957952 byteserasing start:3932160,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4063232 / 8957952 byteserasing start:4063232,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4194304 / 8957952 byteserasing start:4194304,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4325376 / 8957952 byteserasing start:4325376,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4456448 / 8957952 byteserasing start:4456448,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4587520 / 8957952 byteserasing start:4587520,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4718592 / 8957952 byteserasing start:4718592,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4849664 / 8957952 byteserasing start:4849664,len:131072 ...ok !Erased 131072 bytesok ! Wrote 4980736 / 8957952 byteserasing start:4980736,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5111808 / 8957952 byteserasing start:5111808,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5242880 / 8957952 byteserasing start:5242880,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5373952 / 8957952 byteserasing start:5373952,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5505024 / 8957952 byteserasing start:5505024,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5636096 / 8957952 byteserasing start:5636096,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5767168 / 8957952 byteserasing start:5767168,len:131072 ...ok !Erased 131072 bytesok ! Wrote 5898240 / 8957952 byteserasing start:5898240,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6029312 / 8957952 byteserasing start:6029312,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6160384 / 8957952 byteserasing start:6160384,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6291456 / 8957952 byteserasing start:6291456,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6422528 / 8957952 byteserasing start:6422528,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6553600 / 8957952 byteserasing start:6553600,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6684672 / 8957952 byteserasing start:6684672,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6815744 / 8957952 byteserasing start:6815744,len:131072 ...ok !Erased 131072 bytesok ! Wrote 6946816 / 8957952 byteserasing start:6946816,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7077888 / 8957952 byteserasing start:7077888,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7208960 / 8957952 byteserasing start:7208960,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7340032 / 8957952 byteserasing start:7340032,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7471104 / 8957952 byteserasing start:7471104,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7602176 / 8957952 byteserasing start:7602176,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7733248 / 8957952 byteserasing start:7733248,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7864320 / 8957952 byteserasing start:7864320,len:131072 ...ok !Erased 131072 bytesok ! Wrote 7995392 / 8957952 byteserasing start:7995392,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8126464 / 8957952 byteserasing start:8126464,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8257536 / 8957952 byteserasing start:8257536,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8388608 / 8957952 byteserasing start:8388608,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8519680 / 8957952 byteserasing start:8519680,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8650752 / 8957952 byteserasing start:8650752,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8781824 / 8957952 byteserasing start:8781824,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8912896 / 8957952 byteserasing start:8912896,len:131072 ...ok !Erased 131072 bytesok ! Wrote 8957952 / 8957952 bytesupdate app successprepare update logo to mtd:/dev/mtd8writing ...erasing start:0,len:131072 ...ok !Erased 131072 bytesok ! Wrote 131072 / 935766 byteserasing start:131072,len:131072 ...ok !Erased 131072 bytesok ! Wrote 262144 / 935766 byteserasing start:262144,len:131072 ...ok !Erased 131072 bytesok ! Wrote 393216 / 935766 byteserasing start:393216,len:131072 ...ok !Erased 131072 bytesok ! Wrote 524288 / 935766 byteserasing start:524288,len:131072 ...ok !Erased 131072 bytesok ! Wrote 655360 / 935766 byteserasing start:655360,len:131072 ...ok !Erased 131072 bytesok ! Wrote 786432 / 935766 byteserasing start:786432,len:131072 ...ok !Erased 131072 bytesok ! Wrote 917504 / 935766 byteserasing start:917504,len:131072 ...ok !Erased 131072 bytesok ! Wrote 93576nand_do_write_ops: Attempt to write not page aligned data6 / 935766 bytesupdate logo successwrite versionread uboot1 's version:v1.0.0.1read uboot2 's version:v1.0.0.1read bootargs 's version:v1.0.0.1read kernel 's version:v1.0.0.1read fs 's version:v1.0.0.2read app 's version:v1.0.0.9the section:para is not found in imgget para 's info errread logo 's version:v1.0.0.1the section:version is not found in imgget version 's info errwrite version err:-1**********update logo from file**********file doesn't exist.file:update.cpp line:51 misc_wdt_open failed!file:update.cpp line:98 misc_wdt_settimeout failed!!file:update.cpp line:154 reset.

author: dc101
author_rank: Regular Contributor
timestamp: April 29, 2021, 04:58:49 am
content: Interesting. When I attempted to dump all of the mtd partitions, I was actually unable to dump mtd0, even if I aborted boot at the first stage bootloader. Probably need to do some more research to figure out whats going on.

author: poot36
author_rank: Frequent Contributor
timestamp: April 30, 2021, 02:32:29 am
content: You may need to use the nandecc command from the 2nd stage boot to dump that partition of the NAND. I have no clue what to change it to though. I know my entire flash is set to Hamming code ecc and that may be the issue with being able to flash it correctly as it is not set to the correct ecc type. Here is what the TI page has to say about it:Flashing 1st stage to NAND from 2nd stageFlash U-Boot-MIN for NAND (u-boot.min.nand) to NAND by executing the following commands:TI8148_EVM# mw.b 0x81000000 0xFF 0x20000TI8148_EVM# loadb 0x81000000From TeraTerm Menu click “File -> Transfer -> Kermit -> Send”.Select the 1st stage u-boot image “u-boot.min.nand” and click “OPEN” buttonWait for download to complete and then run following commands in u-boot promptTI8148_EVM# nand erase 0x0 0x20000TI8148_EVM# nandecc hw 2TI8148_EVM# nand write.i 0x81000000 0x0 0x20000TI8148_EVM# nandecc hw 0If no error messages are displayed the 1st stage of NAND boot has been successfully transferred to NAND.Flashing 2nd stage to NAND from 2nd stageFlash the 2nd stage U-Boot (u-boot.bin) to NAND by executing the following commands:TI8148_EVM# mw.b 0x81000000 0xFF 0x60000TI8148_EVM# loadb 0x81000000From TeraTerm Menu click “File -> Transfer -> Kermit -> Send”.Select the 2nd stage u-boot image “u-boot.bin” and click “OPEN” buttonWait for download to complete and then run following commands in u-boot promptTI8148_EVM# nand erase 0x20000 0x60000TI8148_EVM# nandecc hw 0TI8148_EVM# nand write.i 0x81000000 0x20000 0x60000If no error messages are displayed the 2nd stage of NAND boot has been successfully transferred to NAND.But I do not know if that is correct for this unit as when I tried to access the flash after booting the serial version of the u-boot-min all I got was ecc errors due to the ecc being set to HW ECC BCH8 and not the correct HW ECC Hamming code. Good luck with dumping partition 0.

author: poot36
author_rank: Frequent Contributor
timestamp: May 11, 2021, 03:39:09 am
content: Well I got the first stage bootloader working by following the instructions on the TI websight but I also screwed up and managed to flash the bootloader at the wrong address and wipe all the NAND after that address as well so I am in the process of rebuilding it. I forgot the 0x0 in this command: TI8148_EVM# nand write.i 0x81000000 0x0 0x20000 and so from address 0x20000 and beyond I managed to wipe it to the end of the NAND. Stupid mistake I know.

author: dc101
author_rank: Regular Contributor
timestamp: May 11, 2021, 04:18:49 am
content: Ooof, let me know if you need me to send you dumps from my device. I never ended up trying to do a firmware update, I decided to let well enough alone and am just using it as an embedded platform to experiment with.

author: poot36
author_rank: Frequent Contributor
timestamp: May 12, 2021, 12:50:36 am
content: I have dumps of all the partitions of my system. Just need to place enough of them back over the serial port to get it back to a Linux prompt and I should be good. I have confirmed that the u-boot-min partition is a different NAND ecc type and that is why you are not able to dump it.

author: dc101
author_rank: Regular Contributor
timestamp: May 12, 2021, 01:32:05 am
content: Interesting, I would think that if it's hardware ecc, it would be the same for an entire nand chip? Perhaps it's stored somewhere else?

author: poot36
author_rank: Frequent Contributor
timestamp: May 12, 2021, 02:37:21 am
content: You should be able to dump it by changing the ecc type with this command: nandecc hw 2 from the 2nd stage bootloader. Good luck.

author: dc101
author_rank: Regular Contributor
timestamp: May 12, 2021, 02:58:06 am
content: Thanks, I'll give it a shot sometime this week and let you know.So funny story, I bought my DVR off eBay and apparently the owner didn't bother to erase any of the video on the device. I haven't found anything super interesting, seemed like it was used by a private home owner. Just kinda wild that with all the news these days related to cybersecurity, the owner didn't think to wipe the drive.Cheers-Tim

author: poot36
author_rank: Frequent Contributor
timestamp: May 12, 2021, 03:44:46 am
content: That was the same case with my unit as well, no interesting footage either, just a sidewalk. I already wiped it anyways.

author: poot36
author_rank: Frequent Contributor
timestamp: May 16, 2021, 02:27:26 am
content: Unit has been fully restored and repaired, thanks for all the help. I even added a custom boot logo as this unit is going to a friend of mine.

author: dc101
author_rank: Regular Contributor
timestamp: May 16, 2021, 02:47:39 am
content: Glad to hear!