3

Within this very stripped down firmware I'm looking at (hikvision camera misrepresented), this is all I have to work with. No other firmware exists, and the open-seasame command presents an encrypted challenge, so no root.

Is there anything in this list that pokes at the ability to dump the firmware via uboot ?

There are pads for a micro-SD card, but I haven't soldered anything up or tested / probed it with a scope.

The following commands are supported:
boot    erase   help    reset
saveenv printenv        setenv  upbs
format  update  upfusb  upf
updatebusb      updateb gos     go
mii     gpio    ping
Use help to get help on a specific command
3

Well I come up with two way.

  • The first one is a difficult way. I've looked up some resource and found that the upf command on Hikvision camera should be able to update the firmware, and it's using TFTP to load the firmware into 0x02000000 address.
    Ref: https://ipcamtalk.com/threads/hikvision-g1-5-5-firmware-exploring-the-cam-attempting-unlock.40814/
    https://ipcamtalk.com/threads/unrestricted-root-shell-on-g1-cameras.23213/ So, you can use upf command to receive file from your computer, and then load it to memory at 0x02000000, before the load finished, you can interrupt the update operation by cutting off the connection, so you can return to the uboot prompt and do other operations, and the transmitted data will still be there in the memory.
    Then there's also a go command, which can bring the processor to execute the address you supply.
    To wrap them all, you can use the technique decribed above to load arbitary data into a fixed memory address, and then you can control the processor to execute arbitary address, so you can write shellcode to read from nand and print them.

  • The second one is a easier way. You can try to have a look at the printenv's output, and there may be some interesting environment variable controlling the updating progress and boot progress. There's chance you can upload a custom small rom without overwriting the original one.

Anyway, I'd suggest you use a debugger like JTAG to dump the memory, which is much more easier except you have to do some soldering.

  • I don't see a JTAG port on the board, but that doesn't mean there isn't. I'm sure the chip has one I'll just have to figure out if the pins go somewhere for it. imgur.com/gallery/JcgsEPE HKVS # printenv ipaddr=192.0.0.64 serverip=192.0.0.128 gatewayip=0.0.0.0 netmask=255.255.255.0 ethaddr=94:e1:ac:00:55:0e loadaddr=0x00208000 bootfile=hImage bootcmd=null bootargs=console=ttyS0 bootdelay=2 dbg=8 chip_id=1 – J.Hirsch Aug 15 '19 at 22:27
  • 1
    Well the console=ttyS0 suggest that it's a Linux kernel, maybe you can try setting the init= param, so you can execute any possiible executable on the firmware :) – Yunchao Guan Aug 16 '19 at 15:49
0

The go command in uboot allows you to specify an address and provide arguments. You could potentially use this invoke a printf(), providing a pointer to a format string and a pointer to what you wish to read.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.