Author Topic: Hikvision DS-2TP31 series Thermal Camera Teardown  (Read 21531 times)

0 Members and 1 Guest are viewing this topic.

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #25 on: April 24, 2022, 04:06:46 pm »
Hikvision cleverly incorporated a very accurate FFC shutter design that is used as a calibration reference for the microbolometer measurement process. The standard DS-2TP31 camera uses a conventional “free air” open FFC flag that is vulnerable to temperature errors at the point of flag temperature measurement. Image stacking also appears to have been employed but I do not know the exact purpose of this except to create an average sample for measurement.

I totally agree that the use of thermal imaging cameras was a mixture of science and ‘wishful thinking’ It is very difficult to accurately measure a human's core temperature at a distance, using a thermal camera.That is a topic that has been covered before on this forum though. What impressed me with ten DC-2TP31B  was that the design had been enhanced in hardware and firmware to provide meaningful non contact measurements of good accuracy. How accurate the camera is over the full range of ambient temperature, I have not tested. Like some thermal camera manufacturers, Hikvision realised that a weakness in many modern budget thermal cameras was the thermal differential between the FFC flag and the temperature sensor used to enter mine it’s surface temperature. An error in this measurement is transferred to ten measurement system and introduces that error into it. Hikvision positioned a small temperature sensor in a ‘garage’ that reps the FFC shutter at a stable temperature away from air currents. The sensor obtains a reasonable measurement of the shutters surface temperature as a result. Nice idea  :-+ As the the accuracy of any master reference for temperature….. that is not known to me at this time. I can say that my test DS-2TP31B easily met the stated specification of measurement accuracy when tested against a Professional Blackbody of known accuracy and emissivity. The permitted error was +/-0.3C between 30C and 45C. My sample unit had an error of +0.1C at 40C in an ambient of 21C and this level of error starts to challenge the accuracy of the Blackbody so an error can be in the cameras measurement, or the Blackbody control loop/deviation etc.
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 
The following users thanked this post: vip23

Offline Tim Foo

  • Newbie
  • Posts: 2
  • Country: sg
UTi260B Thermal Camera Teardown
« Reply #26 on: February 04, 2023, 03:24:39 pm »
Before you open up your UTi260B watch this first https://youtu.be/1yYN5GsLT3w

This morning my UTi260B overheated during charging.  I always monitor my USB charging and it went to something like 3.5A!  That's what trigger my interest. 

After disconnecting the charger, I placed the unit in a safer location (outdoors) as a precaution against any possibility of the unit going up in flames.  Some spots are hot to the touch.  The hottest spot is near the (finger) trigger switch is in excess of 54°C, measurement done with an IR Thermometer about 20 min after disconnection.  It took me a bit of time to recompose myself after moving the unit. 

5 hours latter after letting the unit to cool down, as expected that unit wouldn't startup. 

I would now recommend everyone to exercise caution when charging thier UTi260Bs.  It may be sensible to place the unit in some place where any fire dammage can be controlled in case the battery chargging goes wrong.

I will attempt opening the unit up very soon.

Meanwhile I am open to any advice. 
 

Offline vip23

  • Newbie
  • Posts: 2
  • Country: ru
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #27 on: September 04, 2023, 12:42:01 pm »

Hello. Found this menu, maybe it will help. Back button three times, up once.
 
The following users thanked this post: Fraser, nikitasius

Offline nikitasius

  • Regular Contributor
  • *
  • Posts: 174
  • Country: fr
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #28 on: September 30, 2023, 09:07:55 am »
Some folks selling it 600€
The 31B model 🤣🤣
There are idlers that want to have money without working and fools that are ready to work without becoming rich.
 

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #29 on: September 30, 2023, 10:46:06 am »
The DS-2TP31B model was a higher priced version of the DS-2TP31 aka E1 camera. The cost was likely due to the “COVID-19” effect on pricing and also the specialist nature of the camera. Whilst it is true that I bought several brand new DS2TP31B cameras at only £60 each, that was just one of those bargains that I stumbled across as the Pandemic began to recede and also people realised that thermal cameras were not the panacea to COVID-19 detection that they once thought they were. I have not seen that great price repeated. I believe it was a surplus dealer who had bought a large number of units and was just dumping them onto the market. He said as much to me and claimed I would never find a lower price.

It is true that the DS-2TP31B has a limited temperature measurement range but thankfully it still offers the full high sensitivity range for the actually imaging that it produces. It is still perfect for things like PCB repair where you are looking for the hot component when injecting a voltage. For £60 they were an absolute bargain. Added to that, they are very accurate for measurements between +20C and +50C which is still a useful range. They also lend themselves to spotting wildlife in the garden. I would think that they would be great for VET work as well as VETS are looking for soft tissue issues that fall within the cameras measurement capabilities.

It does not surprise me that some of these DS-2TP31B cameras are still for sale at high prices. They were not cheap to buy into stock and some dealers are trying to recover their investment so advertise them at cost of higher. They likely hope for another peak in Covid-19 events that might stimulate sales again. I will not knock someone for trying to recover their investment. Some sellers on eBay may have seen the original RRP and are thinking the cameras are still worth that sort of money. The market price of this specialist version of the DS-2TP31 is highly unstable and there are bargains to be had  :)

I just bought the DS-2TP21B which is the bigger brother to the 31B. It is the COVID-19 fever detection version of the HikMicro M10 camera. Still 160 x 120 pixels, but a more capable camera with manual focus, touch screen, Wireless connectivity, video recording, many measurement functions,  decent IFOV and it actually measures from 0C to +100C (tested by me). That has turned out to be a really nice thermal camera that is perfect for PCB work etc. I bought it, new in its hard case with two batteries, a desk charger and power supply for only £220. There is another of these cameras on eBay UK at the moment for £300. Still not a bad price for what it offers the user. The RRP on the DS-2TP21B was over 7000 Euros  :scared:  It can now be bought from UK dealers for prices ranging from just over £1.5K to £3K. The prices were highly inflated during the Pandemic.

https://www.conrad.com/p/hikvision-ds-2tp21b-6avfw-ir-camera-30-up-to-45-c-160-x-120-pixel-wi-fi-fever-detection-2251776

Fraser
« Last Edit: September 30, 2023, 12:16:15 pm by Fraser »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 
The following users thanked this post: nikitasius

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #30 on: September 30, 2023, 10:59:59 am »
Link to the DS-2TP21B auction.

Consider the specification carefully and make your own decision on whether it offers value for money in the current market. I like mine, but that is because it meets my needs. Your needs may be different !

https://www.ebay.co.uk/itm/256066753767?mkcid=16&mkevt=1&mkrid=711-127632-2357-0&ssspo=PxmtoXM_Ryu&sssrc=4429486&ssuid=BgpdXaaLSkK&var=&widget_ver=artemis&media=COPY

He is asking £300 or offers. I tried £200 and it was declined. I believe he will more likely accept something like £280.

I have no connection to the seller or the camera they are offering.

Fraser
« Last Edit: September 30, 2023, 11:31:32 am by Fraser »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 
The following users thanked this post: nikitasius

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #31 on: September 30, 2023, 11:03:36 am »
The next cheapest price I found on eBay was £549. To me that is getting into serious money for the resolution offered and I would not consider it a bargain at that price. Another seller on eBay UK wants £3.3K for this camera !

https://www.ebay.co.uk/itm/234831838047?mkcid=16&mkevt=1&mkrid=711-127632-2357-0&ssspo=P_cEFmGMRQy&sssrc=4429486&ssuid=BgpdXaaLSkK&var=&widget_ver=artemis&media=COPY

https://www.ebay.co.uk/itm/234476142785?mkcid=16&mkevt=1&mkrid=711-127632-2357-0&ssspo=L7ng4TgNRhG&sssrc=4429486&ssuid=BgpdXaaLSkK&var=&widget_ver=artemis&media=COPY
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 
The following users thanked this post: nikitasius

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #32 on: September 30, 2023, 11:07:55 am »
A refurbished HikMicro M10 that has the full measurement range plus torch and laser function active is available for £779….

https://www.ebay.co.uk/itm/235130267978?mkcid=16&mkevt=1&mkrid=711-127632-2357-0&ssspo=v18jirrrqzq&sssrc=4429486&ssuid=BgpdXaaLSkK&var=&widget_ver=artemis&media=COPY

Still serious money for a 160 x 120 pixel camera though. I provide these prices only as a guide to the market price and to show the great price variation across the market.

There are bargains to be had but you need to keep your eyes open to spot them before some else does.
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 
The following users thanked this post: nikitasius

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #33 on: September 30, 2023, 11:20:58 am »
I am not going to defend the RRP of COVID-19 fever detection versions of thermal cameras but there may be some justification in the higher prices beyond just the specialist nature of the camera version and market demand at a time of crisis.

I recently saw a comment on a UK thermal camera dealers site detailing the two available purchase options…… Ex Factory and Calibration Checked. The comment stated that thermal cameras come out of the factory without a calibration certificate as the factory production processes normally provide a camera that makes measurements that fall within its stated tolerances. It was stated that this was a belief of compliance and accuracy, rather than a proven fact….. just like CE marking ! The dealer stated that where the measurements of a cameras measurements need to be of known, proven accuracy, a calibration check and associated certificate is available at additional cost.

With the above in mind, it is plausible that the Covid-19 fever detection cameras with their claimed enhanced measurement accuracy of +/- 0.5 Celsius (+/- 0.3 Celsius if a Blackbody is used) tolerance may have undergone enhanced calibration at the time of production to ensure accuracy. Such calibration can be time consuming so additional cost of production may result. I have no insight into the production of the fever detection versions of cameras beyond noting the hardware enhancements that were employed to improve measurement accuracy.

As a side note, the DS-2TP21B provides a measurement calibration enhancement option in the menu. The camera is pointed at a known accurate Blackbody with Emissivity, distance and temperature known, and a measurement calibration correction is stored. A nice feature to have and one not offered on the DS-2TP31B camera. Such a user accessible feature would be great on all thermal imaging cameras that are capable of taking temperature measurements.
« Last Edit: September 30, 2023, 11:30:36 am by Fraser »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 
The following users thanked this post: nikitasius

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #34 on: September 30, 2023, 11:52:44 am »
To show how times have changed….I was watching an auction for a Guide IR T120H COVID-19 fever detection camera as the priced dropped over time. The camera is from the guide IR entry level series so is pretty basic. The resolution is 120 x 90 pixels provided by the Guide Sensmart TIM120 core. The “H” version firmware is heavily modified and offers two modes of operation to detect Fever in humans….. Portrait mode and bulk surveillance mode (my terms, not Guide’s). The portrait mode provides the outline of a face that the user must align with the person being tested. The bulk surveillance mode is more like a normal thermal camera and the measurement function highlights hottest target in view. The temperature measurement range is restricted to improve accuracy. Sadly only one colour palette is available and it is tuned fir fever detection :(

I saw that the T120H that I was watching had dropped to £80 on eBay. Some years ago I would have bought that in the blink of an eye…. But not any more. My analysis of that camera was that it’s 120 x 90 pixels was a serious restriction on its usefulness when the wide FOV lens was also considered. The fact that there was only the one colour pallet was a real downer for me, and this was a very basic camera that may be purchased from China for around £200 in its normal T120 general use format. I considered £80 too much to pay for a thermal camera with such limitations. The market has virtually exploded with affordable thermal imaging cameras so we can afford to be picky when it comes to hunting for bargains :)

Someone bought the £80 T120H camera after it being listed for many weeks. Their use case may mean that it was an excellent buy for them. I certainly hope so. That camera could be used for PCB work if a close up lens were fitted. £80 is not much to pay for the benefit that a thermal camera provides when examining faulty laptops etc. Absolute temperature measurements are less important than seeing hot spots worthy of further investigation.

https://www.ebay.co.uk/itm/295942607142

Some may recall that I bought two camera modules from Dahua fever detection tablet kiosks. The seller did not know what they were and I took a risk that the cores within the metal casings might be useful. It turned out that the two metal camera cases contained the Guide IR MobIR AIR USB C thermal camera Dongles. They contain the same TIMO 120 core as the T120H camera. The cameras work with a mobile phone but are the fever detection model so need the fever detection APP for accurate temperature measurements. They work with the standard MobIR AIR APP but measurements are incorrect. Each of those Dahua camera modules cost me only £18.

As a warning though….. I have investigated other Fever Detection kiosk solutions and determined that they use sensors like the Melexis MLX series that provide resolutions of only 32 x 24 pixels, or even less, with a slow response time. Be careful what you buy …. Do your research !

Fraser
« Last Edit: September 30, 2023, 12:24:25 pm by Fraser »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 
The following users thanked this post: nikitasius

Offline nikitasius

  • Regular Contributor
  • *
  • Posts: 174
  • Country: fr
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #35 on: September 30, 2023, 06:24:14 pm »
Thanks for info Fraser 👍
But i still wanna find 17um hikvision for less than 80€ 😁
It's kind of fun, négociations etc.
There are idlers that want to have money without working and fools that are ready to work without becoming rich.
 

Offline nikitasius

  • Regular Contributor
  • *
  • Posts: 174
  • Country: fr
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #36 on: September 30, 2023, 08:54:49 pm »
Just got brandnew 31B for 80€ + 7€ (delivery & insurance).
Well, lets see next week if it's match the description, online is always risky 😁
There are idlers that want to have money without working and fools that are ready to work without becoming rich.
 

Offline nikitasius

  • Regular Contributor
  • *
  • Posts: 174
  • Country: fr
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #37 on: October 06, 2023, 07:17:09 pm »
Here is my  Hikvision DS-2TP31B-3AUF   :popcorn:

Thanks Fraser to show me this pearl, it's awesome camera!

And for 87€ (delivery included) it rocks!


Here is gdrive https://drive.google.com/drive/folders/1Meb7P2H3lyOa8La_MXdfiYTKUNFuYO-3


Upd: compared 17μm pixel w/ 12μm  w/ hand on the wall
https://drive.google.com/file/d/1NP0NU7LH1SF9pdlrSCEn-YjvY02wud7L/view
« Last Edit: October 06, 2023, 08:14:09 pm by nikitasius »
There are idlers that want to have money without working and fools that are ready to work without becoming rich.
 

Offline nikitasius

  • Regular Contributor
  • *
  • Posts: 174
  • Country: fr
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #38 on: October 07, 2023, 05:59:24 pm »
Well, even if it display 25-45 range in UI it saves full range.
On last picture it's a tea from Tefal's teapot (w/ green tea inside).
89.7°C could be pretty close to real.

All pictures i took w/ default settings
There are idlers that want to have money without working and fools that are ready to work without becoming rich.
 

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #39 on: October 07, 2023, 06:51:40 pm »
Yes, I noticed that the saved images are fully radiometric and contain the full temperature range rather than the limited one shown on the display. As Bill-W commented, it is likely that the firmware was just changed to only show the Fever Scanning range of temperatures and I hoped to modify the firmware to eliminate that restriction on measurement. Sadly Hikvision firmware updates are encrypted so I have not been able to dig into them. With regard to accuracy, I believe much of the accuracy gains come from the use of a better FFC flag as a temperature reference and likely a factory calibration that is targeted at the fever detection temperature range to achieve greatest accuracy. Such a limited range calibration sill locks the Radiance to Temperature unit curve to the values that came out of ten microbolometer ROIC at time of calibration. The accuracy at temperatures higher and lower than that restricted range will still be pretty accurate  :-+

I really like the DS-2TP31 camera. It is well built and produces very good images co side ring it’s 160 x 120 pixel resolution. Hikvision chose wiseLy when it came to the lens FOV. From memory, the IFOV is similar to one of my 320 x 240 pixel cameras that are fitted with much wider angle lenses. I have used my camera for PCB thermal imaging and it does benefit from a close up lens and produces good imagery. That said, I recently bought the DS-2TP21B (basically a modified HikMicro M10) for £220. The 21B is also 160 x 120 pixel resolution but it has the advantage of a manual focus lens and large touch screen display :) The close focus capability of the 21B lens means I do not need a close up lens for PCB work  :-+ The 21B and 31B are well worth considering if found at a good price, as was the case for me and you Nikitasius :) I used the DS-2TP21B to diagnose a shorted MLCC in a £5000 rugged laptop this week. It makes life soooo easy  :-+ I own a FLIR E40 (upgraded to E60+) but would not hesitate to pick up the 21B, or even the 31B for a PCB repair. As a side note, it is interesting that the 21B allows the display of temperatures outside the fever detection range, yet the 31B does not.

Fraser
« Last Edit: October 08, 2023, 06:41:59 pm by Fraser »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 
The following users thanked this post: nikitasius

Offline nikitasius

  • Regular Contributor
  • *
  • Posts: 174
  • Country: fr
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #40 on: October 07, 2023, 08:52:55 pm »
I've seen the forum you posted where folks discuss about modding hikvision firmwares. There almost 50+ pages to read lol 🤓
I will read next week to see where we are and is there are any progress to do w/ that firmware.

Btw here is mine (S/N photoshopped).
Aren't updated yet:
• maybe there are exploits for the old firmwares
• maybe i can make telnet working, there are option in settings but i see no telnet, ever no com via usb (like i have w/ chinese walkietalkies).
There are idlers that want to have money without working and fools that are ready to work without becoming rich.
 

Offline nikitasius

  • Regular Contributor
  • *
  • Posts: 174
  • Country: fr
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #41 on: October 08, 2023, 05:30:38 pm »
Any news with configuration file unlock?
Other Hikvision thermal camera use ftp for access
http://ftp.hikvision.ru/01.%20Firmware/01.%20Hikvision/10.%20Thermal/2.%20How%20to/07%20System/

And...
http://ftp.hikvision.ru/01.%20Firmware/01.%20Hikvision/10.%20Thermal/2.%20How%20to/07%20System/How%20to%20get%20thermal%20information%20by%20serial%20port.pdf

Or we can try to repack firmware with some changes :)
https://ipcamtalk.com/threads/hikvision-firmware-tools-change-language-extract-files-and-create-own-firmware.2664/

Well, just checked, it doesn't unpack E1 firmwares.
We need hik_pack by leecher which is wiped out from ipcamtalk forum. If to do easy way.
There are idlers that want to have money without working and fools that are ready to work without becoming rich.
 

Offline nikitasius

  • Regular Contributor
  • *
  • Posts: 174
  • Country: fr
There are idlers that want to have money without working and fools that are ready to work without becoming rich.
 

Offline vip23

  • Newbie
  • Posts: 2
  • Country: ru
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #43 on: April 22, 2024, 11:20:44 am »
The time and date settings are lost. Can you tell me what battery is installed?
 

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #44 on: April 22, 2024, 07:36:58 pm »
These cameras often use a rechargeable Lithium cell so yours may just need the camera to be used to recharge the cell.

If the cell has failed (which would be surprising for these cells) you can just measure it’s dimensions and buy the nearest physical size of tagged rechargeable Lithium button cell that you can find.

https://www.sii.co.jp/en/me/battery/products/ms-lithium-2/#:~:text=OUTLINE,and%20highly%20stable%20overdischarge%20characteristics.
« Last Edit: April 22, 2024, 08:47:32 pm by Fraser »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #45 on: April 22, 2024, 09:05:28 pm »
I just checked my image archives for this camera and the cell is a "ML" series rechargeable LiMnO2 type. You just need the cells dimensions to match it to the correct cell in the series (dimensions form the part number as with non-rechargeable Lithium button cells). Useful details are provided in the Wiki page for button cells.

https://en.wikipedia.org/wiki/Button_cell

The cell should not have failed this soon so it would be worth checking that it is not just discharged due to a lack of use. Also check that the cells very low current trickle charging circuit is working to keep it charged whilst the camera is in use.
« Last Edit: April 23, 2024, 11:07:32 pm by Fraser »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 
The following users thanked this post: vip23

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #46 on: April 22, 2024, 10:19:01 pm »
A possible candidate for this cell….. the ML414H

https://www.sii.co.jp/en/me/datasheets/ms-rechargeable/ml414h/
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 
The following users thanked this post: vip23

Offline pixar

  • Newbie
  • Posts: 4
  • Country: de
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #47 on: May 09, 2024, 09:18:34 am »
Hi together,

Fraser, thanks for your awesome teardown. I am following you already with the FLIR E4 hack and now also tried to play around with the Hikvision.

Some insights from me:
- next to the UART port that looks like a port for ethernet, not sure how useful this is, but potentially can be used to play around more
- the things you can do with UART are pretty limited. Hikvision asks for a password pretty soon if you want to go into the "debug" mode (similar to here: https://ipcamtalk.com/threads/hikvision-ds-7816nb-how-to-enter-debug-mode.55472/)

These are the supported commands:
Code: [Select]
help
Support Commands:
printPart                prtHardInfo              setIp                   
setV6ip                  setGateway              dspStatus               
getDebug                setDebug                getIp                   
ifconfig                netstat                  ping                   
cpup                    task                    free                   
help                    debug     

Iterating through the commands:

Code: [Select]
printPart
printPart:command not found

Code: [Select]
prtHardInfo
Start at 1970-01-01 00:11:00
Serial NO :DS-2TP31B-3AUF20200515AAWRE42106159
V5.4.22 build 200325
NetProcess Version:
Db Encrypt Version: 131072
hardwareVersion = 0x0
hardWareExtVersion = 0x0
encodeChans = 1
decodeChans = 1
alarmInNums = 0
alarmOutNums = 0
ataCtrlNums = 0
flashChipNums = 0
ramSize = 0x40
networksNums = 1
language = 1
devType = 0xa41402
net reboot count = 0
Path: /Camera/Thermography/Software/Branches/Thermal_develop_branch/LiteOS_for_temp_baseline
Last Changed Rev: 787287
Last Changed Date: 2020-03-25 16:08:12 +0800 (Wed, 25 Mar 2020)

Code: [Select]
dspStatus
[armlib]get_dsp_status: buf=8113eb94, len=20480, arg0=0, arg1=0
<lib>dsp_build_time: Day(2020-3-5),Time(21:8:46)
************************************** DSP status ************************************
*** ENC Chan info.
----------------------------------------------------------------------------------------------------------------
Chan Enc EncV EncA EncV EncA VI Signal Video
Num Bps Bps Bps Fps Fps Fps Status Standard
  0: 1411 1411   0 25   0   0 FALSE VS_PAL
----------------------------------------------------------------------------------------
Chan VI EncV EncA Sub Pre0 Pre1 Pre2 Data VIP CD FD
Num Lost Lost Lost Lost Lost Lost Lost Lost Reset Status Status
  0:   0   0   0   0   0   0   0   0   0 FALSE FALSE

Code: [Select]
ifconfig
lo ip:127.0.0.1 netmask:255.0.0.0 gateway:127.0.0.1
HWaddr 00 MTU:0 Runing Link Down
# #

Code: [Select]
netstat
========== total sockets 128 ======  unused sockets 122 ==========
Proto   Recv-Q      Send-Q      Local Address           Foreign Address         State           
tcp     0           0           0.0.0.0:554             0.0.0.0:0               LISTEN         
tcp     0           0           0.0.0.0:8000            0.0.0.0:0               LISTEN         
tcp     0           0           127.0.0.1:443           0.0.0.0:0               LISTEN         
tcp     0           0           127.0.0.1:80            0.0.0.0:0               LISTEN         
Proto   Recv-Q      Send-Q      Local Address           Foreign Address         
udp     0           0           0.0.0.0:13724           0.0.0.0:0               
udp     0           0           127.0.0.1:9473          0.0.0.0:0               
# #


I was not able to access the webservers yet...

Code: [Select]
ping 127.0.0.1
[0]Reply from 127.0.0.1: time=1ms TTL=255
[1]Reply from 127.0.0.1: time<1ms TTL=255
[2]Reply from 127.0.0.1: time=1ms TTL=255
[3]Reply from 127.0.0.1: time<1ms TTL=255
--- 127.0.0.1 ping statistics ---
4 packets transmitted, 4 received, 0 loss
# #

Code: [Select]
cpup
SysCpuUsage in 10s: 74.2
# #

Code: [Select]
task
Name                          TID    Priority   Status       StackSize    WaterLine    StackPoint  TopOfStack   EventMask  SemID CPUUSE   CPUUSE10s  CPUUSE1s   MEMUSE
----                          ---    --------   --------     ---------    ----------   ----------  ----------   ---------  -----  ------- ---------  ---------  -------
Swt_Task                      0x0    0          QueuePend    0x6000       0x3a0        0x81121d50  0x8111bde0   0x0        0xffff    1.8       1.7         1.7     0         
IdleCore000                   0x1    31         Ready        0x800        0x5c         0x811225a4  0x81121e00   0x0        0xffff   24.7      26.0        26.5     0         
system_wq                     0x2    1          Pend         0x6000       0x130        0x81129658  0x811236e8   0x1        0xffff    0.0       0.0         0.0     0         
app_Task                      0x3    10         Delay        0x6000       0xa58        0x8112f650  0x81129700   0x1        0xffff    0.0       0.0         0.0     1247160   
USB_FMASS_Task                0x4    10         Pend         0x6000       0x370        0x814432a8  0x8143d358   0x1        0xffff    0.0       0.0         0.0     2507464   
ipc_watchdog                  0x5    3          Delay        0x5000       0x138        0x815435e0  0x8153e678   0x0        0xffff    0.0       0.0         0.0     104       
himci_Task                    0x6    10         Ready        0x1800       0x150        0x81144310  0x81142ba8   0x0        0xffff    0.0       0.0         0.0     0         
jffs2_gc_thread               0x7    10         Pend         0x1000       0x128        0x81156730  0x811557b8   0x3        0xffff    0.0       0.0         0.0     0         
jffs2_gc_thread               0x8    10         Pend         0x1000       0x340        0x8115e5d0  0x8115d658   0x3        0xffff    0.0       0.0         0.0     -4044     
jffs2_gc_thread               0x9    10         Pend         0x1000       0x128        0x81167cc8  0x81166d50   0x3        0xffff    0.0       0.0         0.0     0         
jffs2_gc_thread               0xa    10         Pend         0x1000       0x128        0x8116fe68  0x8116eef0   0x3        0xffff    0.0       0.0         0.0     0         
power_button_task             0xb    1          Pend         0x6000       0x130        0x81175e78  0x8116ff08   0x1        0xffff    0.0       0.0         0.0     0         
tcpip_thread                  0xc    5          PendTimeOut  0x6000       0x310        0x8117c720  0x81176828   0xf        0xffff    0.1       0.1         0.1     2880       
shellTask                     0xd    9          Running      0x3000       0xba0        0x81185a24  0x81182e08   0xfff      0xffff    0.0       0.0         0.0     2100356   
cmdParesTask                  0xe    9          Pend         0x1000       0x170        0x81186d50  0x81185e20   0x1        0xffff    0.1       0.0         0.0     476       
mmc_data_thread               0xf    6          PendTimeOut  0x800        0x1c0        0x8120f320  0x8120ebe0   0x4        0xffff    0.0       0.0         0.0     0         
bcache_async_task             0x10   12         Pend         0x3000       0x1f0        0x81432938  0x8142f9e0   0xf        0xffff    0.0       0.0         0.0     0         
USB_GIANT_Task                0x11   5          Pend         0x6000       0x150        0x814492c0  0x81443370   0xf        0xffff    0.0       0.0         0.0     0         
USB_NGIAN_Task                0x12   2          Pend         0x6000       0x150        0x8144f2
e0  0x81449390   0xf        0xffff    0.0       0.0         0.0     0         
USB_EXPLR_Task                0x13   5          Pend         0x6000       0x4c8        0x814552f8  0x8144f3a8   0xf        0xffff    0.0       0.0         0.0     2008       
USB_CXFER_Task                0x14   5          Pend         0x6000       0x150        0x8145b318  0x814553c8   0xf        0xffff    0.0       0.0         0.0     0         
USB_SWTCH_Task                0x15   10         Ready        0x6000       0x110        0x81461370  0x8145b3e0   0x0        0xffff    0.0       0.0         0.0     0         
ipc_reboot                    0x17   3          Delay        0x5000       0x1c0        0x81548570  0x81543690   0x0        0xffff    0.0       0.0         0.0     0         
ipc_dsp_init                  0x18   0          Delay        0x20000      0xa38        0x815c6ab8  0x815a6b50   0x0        0xffff    0.0       0.0         0.0     3487296   
ifr_source                    0x19   2          PendTimeOut  0x20000      0xbe0        0x81927020  0x81907490   0x1        0xffff   63.6      64.0        64.0     188       
Dsp_Encode                    0x1a   2          PendTimeOut  0x20000      0xd98        0x81947148  0x819274b0   0x0        0x11f     1.3       1.3         1.3     1484       
Dsp_OsdRefresh                0x1b   5          Delay        0x20000      0xa80        0x81967408  0x819474c8   0x1        0xffff    1.5       1.2         1.1     0         
TSK_ViSignal                  0x1c   10         Delay        0x20000      0x658        0x81987450  0x819674e8   0x0        0xffff    0.0       0.0         0.0     0         
Dsp_Timer                     0x1d   2          Delay        0x20000      0x1f8        0x819a7478  0x81987500   0x0        0xffff    0.3       0.3         0.3     0         
Shutter_Process               0x1e   10         Ready        0x20000      0x930        0x819c7460  0x819a7520   0x0        0xffff    0.2       0.1         0.1     120       
K_MatrikProcess               0x1f   10         Ready        0x20000      0x158        0x819e7490  0x819c7538   0x0        0xffff    0.0       0.0         0.0     0         
K_MatrikProcess               0x20   10         Ready        0x20000      0x160        0x81a074a8  0x819e7558   0x0        0xffff    0.0       0.0         0.0     0         
TSK_BPC_Process               0x21   10         Ready        0x20000      0x160        0x81a274c0  0x81a07570   0x0        0xffff    0.0       0.0         0.0     0         
TSK_PCC_Process               0x22   10         Ready        0x20000      0x168        0x81a474d8  0x81a27590   0x0        0xffff    0.0       0.0         0.0     0         
TM_Process                    0x23   10         Ready        0x20000      0x2890       0x81a673e0  0x81a475a8   0xf        0xffff    3.9       3.7         3.5     832       
TSK_RawDataProcess            0x24   10         Ready        0x20000      0x6b8        0x81a87520  0x81a675c8   0x0        0xffff    0.1       0.1         0.0     604       
Dsp_SaveRawData               0x25   5          Delay        0x20000      0x140        0x81aa7550  0x81a875e0   0x0        0xffff    0.0       0.0         0.0     0         
Dsp_EncRoi                    0x26   5          Delay        0x20000      0x678        0x81ac7550  0x81aa7600   0x0        0xffff    0.0       0.0         0.0     0         
ipc_appweb                    0x27   7          Delay        0x8000       0xd58        0x81acf558  0x81ac7618   0x0        0xffff    0.0       0.0         0.0     85880     
menu_logo_thd                 0x28   7          QueuePend    0x8000       0xa38        0x81b03210  0x81afb3e8   0x0        0xffff    0.4       0.3         0.2     54472     
thm_cameralib_send            0x29   16         QueuePend    0x5000       0x390        0x81b09b58  0x81b04ca8   0x0        0xffff    0.0       0.0         0.0     0         
ipc_blueled                   0x2a   13         Ready        0x5000       0x128        0x81b0ec38  0x81b09cc0   0x0        0xffff    0.0       0.0         0.0     0         
ipc_usrSucurty                0x2b   16         Delay        0x5000       0x150        0x81b98478  0x81b93528   0x0        0xffff    0.0       0.0         0.0     0         
ipc_hdtaskctrl                0x2c   10         QueuePend    0x5000       0xb00        0x81b9f868  0x81b9b128   0x0        0xffff    0.0       0.0         0.0     1148       
ipc_sdctrl                    0x2d   16         Delay        0x5000       0x968        0x81ba4ff8  0x81ba0140   0x0        0xffff    0.0       0.0         0.0     11648     
ipc_dvrNetServ                0x2e   7          Pend         0x5000       0x260        0x81bad820  0x81ba89e0   0xf        0xffff    0.0       0.0         0.0     700       
streamRecv                    0x2f   16         Ready        0x5000       0x1740       0x81bc5048  0x81bc0e10   0x0        0xffff    0.2       0.2         0.3     107648     
events                        0x31   7          PendTimeOut  0x10000      0x6fc        0x81adf410  0x81acf638   0x0        0xeb      0.0       0.0         0.0     -19856     
key_event_interface           0x32   7          QueuePend    0x8000       0x638        0x81bde120  0x81bd6278   0x0        0xffff    0.0       0.0         0.0     1136       
key_listen                    0x33   7          Pend         0x8000       0x698        0x81be60b8  0x81bde290   0x0        0xed      0.0       0.0         0.0     916       
monitor_eth0                  0x34   16         Ready        0x5000       0x8d8        0x81c1ba90  0x81c16bb0   0x0        0xffff    0.3       0.0         0.0     21908     
is_multi_eth                  0x35   16         Ready        0x8000       0x1220       0x81c23168  0x81c1bbd0   0x0        0xffff    0.3       0.0         0.0     0         
ipc_svchandler                0x36   7          PendTimeOut  0x5000       0x6a0        0x81c28a28  0x81c23be8   0x0        0x12b     0.0       0.0         0.0     868       
# #

Code: [Select]
free
        total        used          free
Mem:    15792896     13836396      1956500   
        text         data          rodata        bss
Mem:    6914048      220572        2064384       8488164   
# #

Getting more powerful access requires a password (see link above). This is impossible to get, without the private key of hikvision, as it uses RSA.
Code: [Select]
debug
CQAAAAAAAAAAAASFlkI=
Password: abc
HI_MPI_CIPHER_RsaPublicDec,3037: Error, u32InLen != u32KeyLen.
HI_UNF_CIPHER_RsaPublicDec failed
Incorrect Password. 2 Times Left
# #

Increasing the log level
Code: [Select]
setDebug -h
setDebug : Set debug parm. module name is nessary
e.g. setDebug -l 2 -m rtsp -d 111
-l, --level range is 0~7:
0:NON
1:SYS_ERROR
2:RT_ERROR
3:KEY_WARN
4:NORMAL_WARN
5:DEBUG_NOTICE
6:DEBUG_INFO
7:DEBUG_ALL_DAV
-d, --display from right to left:
first bit'1' is show 'line';
second bit'1' is show 'function name';
third bit'1' is show 'file name'
-m --module moudule name. below is all modules name
ALL
module class NETPRO_CLASS:
   RTSP WEBSERVER ONVIF PSIA CGI SDKCMD UNI_IF RTCP GENETEC EHOME EZVIZ
module class SYSFUN_CLASS:
   SYSINIT RECORD SYSLOG ALARM_EXP HDMANAGER SD NAS MOTDETECT FTP CAPA PIC PLAYBACK PREVIEW CLOUD BUTTON GUI
module class NETFUN_CLASS:
   SADP ARP SNTP DDNS EMAIL PPP 8021X GB28181 TSOCKS MOBILE
module class HW_CLASS:
   HW_IF DSP FPGA RTC SENSOR PTZ MOTION DOME STRM_ANLS
module class OTHER:
   OTHER
module class IPC:
   IPC IPC_UNIX SDK_SECURITY DB
# # [01-01 00:46:07] 

Default is "2":
Code: [Select]
getDebug
modulename      level      display(FILENAME,FUNCTION,LINE)
IPZOOM          2          111
IPZOOM_AF        2          111
IPZOOM_AE        2          111
RTSP            2          111
WEBSERVER        2          111
ONVIF            2          111
PSIA            2          111
CGI              2          111
SDKCMD          2          111
UNI_IF          2          111
RTCP            2          111
GENETEC          2          111
EHOME            2          111
EZVIZ            2          111
SYSINIT          2          111
RECORD          2          111
SYSLOG          2          111
ALARM_EXP        2          111
HDMANAGER        2          111
SD              2          111
NAS              2          111
MOTDETECT        2          111
FTP              2          111
CAPA            2          111
PIC              2          111
PLAYBACK        2          111
PREVIEW          2          111
CLOUD            2          111
BUTTON          2          111
GUI              2          111
SADP            2          111
ARP              2          111
SNTP            2          111
DDNS            2          111
EMAIL            2          111
PPP              2          111
8021X            2          111
GB28181          2          111
TSOCKS          2          111
MOBILE          2          111
HW_IF            2          111
DSP              2          111
FPGA            2          111
RTC              2          111
SENSOR          2          111
PTZ              2          111
MOTION          2          111
DOME            2          111
STRM_ANLS        2          111
OTHER            2          111
IPC              2          111
IPC_UNIX        2          111
SDK_SECURITY    2          111
DB              2          111
has open debug module nums is : 54
# # [01-01 00:45:44] 

Increasing all to 7 gives the following debug messages:
Code: [Select]
[pid:0][OTHER][ERROR][netconfig.c 569][get_ipaddr]get_ipaddr failed. p_interface_name:eth0 
[pid:0][SYSINIT][WARNING][mainCtrl/usrMainApp.c 2177][monitor_eth0]eth0 disconnet...
[pid:0][SADP][DEBUG][multicast/is_discovery_do.c 262][wait_net_available]eth0: wait_net_available
[pid:0][DSP][WARNING][hardwareif/e2l/dsp/streamRecv.c 2743][streamRecv]chan 1: Unsupport type = 560, len = 8540
[pid:0][SD][DEBUG][hardwareif/e2l/sdcard.c 61][is_sd_ok]sd_status.name = mmc0
[pid:0][SD][DEBUG][hardwareif/e2l/sdcard.c 65][is_sd_ok]sd status = 1
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 8942][get_hdisk_space]ctrl 0, drive 0: total_space 7648.
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 8958][get_hdisk_space]partition [/dev/mmcblk0p0] exist.
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 8953][get_hdisk_space]partition [/dev/mmcblk0p1] don't exist and errno = 2.
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 8962][get_hdisk_space]partition numbers:[1].
[pid:0][SD][DEBUG][hdCtrl/sd_check.c 176][get_disksize] stfs.f_bfree=244944, stfs.f_bavail=244944, stfs.f_bsize=32768 .
[pid:0][SD][DEBUG][hdCtrl/sd_check.c 188][get_disksize] freesize=239, blocksize=32,*getsize=7648 .
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 8977][get_hdisk_space][/mnt/mmc01] get_disksize sucess!
[pid:0][HDMANAGER][DEBUG][hdCtrl/hdmanager.c 16789][get_free_record_space_percent]freespace=7648, totalspace=7648, percent=100 .
[pid:0][GUI][DEBUG][menu/menu.c 2709][menu_logo_thread] logo_sd_idx=16,last_logo_sd_idx=16,sd_usb_window = 0
[pid:0][GUI][DEBUG][menu/menu.c 2735][menu_logo_thread]no need to display window!
[pid:0][OTHER][DEBUG][net_base_operate.c 622][socket_accept_with_timeout]time out.
hi_i2c_wait_rxfifo_notempty->344: transmit error, int_raw_status: 0x750!
hi_i2c_wait_rxfifo_notempty->346: tx_abrt_cause is 1.
hi_i2c_abortprocess->73: tx_src: 0x1!
<3>fuel_gague_i2c_read failed!
<3>fuel_gauge_ioctl-118 i2c read err!
[pid:0][BUTTON][ERROR][button/button_operation.c 943][get_battery_quantity_percent]get_battery_info HAL_FUEL_GAUGE_SOC failed
[pid:0][BUTTON][DEBUG][button/button_operation.c 966][get_battery_quantity_percent]last_value = 0,battery_value = -1
[pid:0][GUI][DEBUG][menu/menu.c 2820][menu_logo_thread] logo_battery_idx=19,last_logo_battery_idx=19
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:0, time:6192s 160986us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2175][is_key_press]E_KEY_STATE_DOWN!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2225][is_key_press]E_KEY_STATE_DOWN! NOT KEY COMBINATION!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2334][init_key_time]init_time = 6192s 160986us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2320][is_key_press]ret: 0!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 408][key_listen]key5: 11!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 449][key_listen]send -2118386504 msg success, ret = 0,key_statuts=11
[pid:0][NAS][DEBUG][keying/key_event_e2.c 1174][key_action]S_KEY_TRIGGER_DOWN
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:1, time:6192s 241034us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 1214][key_action]main_status = 1,fouce_index = 1
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2236][is_key_press]E_KEY_STATE_UP!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 519][key_event_interface]flag_respond = 0!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2239][is_key_press]E_KEY_STATE_UP! NOT KEY COMBINATION!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 80048us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2320][is_key_press]ret: 1!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 408][key_listen]key5: 12!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 449][key_listen]send -2118386504 msg success, ret = 0,key_statuts=12
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:0, time:6192s 290966us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 1202][key_action]S_KEY_TRIGGER_UP,L1202
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2083][get_main_status]main_status: 157!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2334][init_key_time]init_time = 6192s 290966us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 528][key_event_interface]main_status = 157!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:1, time:6192s 502092us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 1214][key_action]main_status = 157,fouce_index = 1
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 211126us
[pid:0][GUI][DEBUG][menu/menu.c 1828][menu_logo_thread]type=157
[pid:0][GUI][DEBUG][menu/menu.c 6503][draw_logo_bg] width = 140 height = 108
[pid:0][GUI][DEBUG][menu/menu.c 6730][draw_string]str:Disconnect the
[pid:0][GUI][DEBUG][menu/menu.c 6750][draw_string] str:Disconnect the ,osd_config.charCnt,  15,b_selected=0
[pid:0][GUI][DEBUG][menu/menu.c 6730][draw_string]str:device from USB
[pid:0][GUI][DEBUG][menu/menu.c 6750][draw_string] str:device from USB ,osd_config.charCnt,  16,b_selected=0
[pid:0][GUI][DEBUG][menu/menu.c 6730][draw_string]str:and try again.
[pid:0][GUI][DEBUG][menu/menu.c 6750][draw_string] str:and try again.,osd_config.charCnt,  14,b_selected=0
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:0, time:6193s 881001us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2334][init_key_time]init_time = 6193s 881001us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 1214][key_action]main_status = 164,fouce_index = 1
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6194s 130876us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2275][is_key_press]E_KEY_STATE_DOWN_REPEATE!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 249875us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 408][key_listen]key5: 0!!
[pid:0][GUI][DEBUG][menu/menu.c 5779][pic_win_timer]main_status = 164!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6194s 230871us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 349870us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6194s 330872us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 449871us
[pid:0][DSP][DEBUG][hardwareif/e2l/dsp/dsp.c 461][get_vomenu_state]Waiting dsp to finish reading menu!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6194s 430867us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 549866us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6194s 530876us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 649875us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:1, time:6194s 591209us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 710208us
[pid:0][GUI][DEBUG][menu/menu.c 6852][draw_string_main]str::0.98
[pid:0][GUI][DEBUG][menu/menu.c 6872][draw_string_main] str::0.98,osd_config.charCnt,  5,b_selected=1
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:0, time:6198s 591238us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2334][init_key_time]init_time = 6198s 591238us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6198s 840884us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 249646us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6198s 941786us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 350548us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 40887us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 449649us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 141883us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 550645us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 240884us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 649646us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 341708us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 750470us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 440888us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 849650us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 541824us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 950586us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 640882us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 1049644us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2296][is_key_press]is_long_press = TRUE!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2320][is_key_press]ret: 2!!
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:2, time:6199s 741885us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 1150647us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 217][key_listen]type:1, code:0x105, value:1, time:6199s 801003us
[pid:0][NAS][DEBUG][keying/key_event_e2.c 2351][get_key_press_time]press_time = 1209765us


Pixar
 

Online FraserTopic starter

  • Super Contributor
  • ***
  • Posts: 13266
  • Country: gb
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #48 on: May 09, 2024, 12:54:04 pm »
Hi Pixar,

Excellent work  :-+ I have not had time to dig deeply into the cameras operating system and see that Hikvision have protected the more sensitive areas of the build with a decent encryption method :( It would appear to be a significant challenge to change this cameras configuration from a “Health screening” mode to the general use mode.

As a side note, the superior DS-2TP21B series cameras are selling for very reasonable prices on eBay UK at the moment. A brand new kit sold for £225 in the last week. The DS-2TP21B model retains most of the functionality of its general-use stable mate and has a measurement range that extends well beyond the health screening range. Combined with the manual focus, desktop charger, two batteries and hard case, it is a very nice package  :-+ I find it strange that the DS-2TP31B model was so heavily restricted in terms of temperature measurement range, yet the DS-2TP21B was far less restricted in this respect. It could be due to different development teams working in the firmware during the technical response to the Pandemic.

Fraser
« Last Edit: May 09, 2024, 12:58:09 pm by Fraser »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Offline pixar

  • Newbie
  • Posts: 4
  • Country: de
Re: Hikvision DS-2TP31 series Thermal Camera Teardown
« Reply #49 on: May 09, 2024, 06:38:12 pm »
Thanks Fraser, also for the great tip!

With UART you can also control the boot loader. After pressing CTRL + U (\x15) you are able to open the uboot console:
Code: [Select]
System startup
U-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)
SPI Nor:"W25M512JV", Block:64KB, Chip:64MB
wait timeout, auto_satatus: 0xd0b00000!
###read error, int_raw_satatus: 0x750!
tx_abrt_cause is 0x1.
iptp_thermo_poweroff: hi_i2c_read error!
Hit Ctrl+u to stop autoboot:  0
Net:   USB:   scanning bus for devices...
1 USB Device(s) found
No asix device found!
Initializ AX88772B usb-net device failed !
asix usb net initialize err.
No ethernet found.
HKVS #

Code: [Select]
version
U-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)
HKVS #

Code: [Select]
help
?       - alias for 'help'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
ddr     - ddr training function
ext2load- load binary file from a Ext2 filesystem
ext2ls  - list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
getinfo - print hardware information
help    - print command description/usage
hwdec   - hw decompress
loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
mii     - MII utility commands
mmc     - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor version
HKVS #

AX88772B is the installed USB Ethernet adapter (which could not be loaded from the boot loader, so booting via LAN may be impossible).
Code: [Select]
ping 127.0.0.1
No ethernet found.
ping failed; host 127.0.0.1 is not alive
HKVS #

Code: [Select]
printenv
bootcmd=loadk
bootdelay=0
baudrate=115200
netmask=255.255.255.0
bootfile="uImage"
bootargs=console=ttyAMA0,115200 KRN_PRT=pri mac=00:00:23:34:45:66 bld_rev=788427 hardware_id=0x1
ethact=AX88772C
ipaddr=192.168.1.77
serverip=192.168.1.128
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06-788427 (Mar 27 2020 - 11:37:08)
hardwareID=0x01(iptp_v0)
ethaddr=58:50:ed:91:64:9f
Environment size: 390/65480 bytes
HKVS #

Code: [Select]
mmcinfo
Manufacturer ID: 0
OEM: fd00
Name: Tran Speed: 537067740
Rd Block Len: 18
MMC version 0.0
High Capacity: Yes
Capacity: 2306688413412950016
Bus Width: 537067520-bit
HKVS #

You can then boot from the flash memory using the (undocumented) command
Code: [Select]
loadk
booting from pri part...
Load kernel to 0x81800000 ... Done!
## Booting kernel from Legacy Image at 81800000 ...
   Image Name:   LiteOS-0.1.0-e2
   Image Type:   ARM Linux Kernel Image (lzma compressed)
   Data Size:    4990000 Bytes = 4.8 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Uncompressing Kernel Image ... OK
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf