DS-2ZMN3608-WD bricked.

[arcademachinist]

I have a bricked TKH Siqura 3MP dome camera (PD1103Z2-E) based on HikVision DS-2ZMN3608-WD camera module.
Camera stopped working and exposes HikVision specific behavior of 192.0.0.64 IP on the camera and all ports closed.
It would not look for TFP or anything else. It would ocassionally send a 20 byte UDP packet to 192.0.0.128, with "SWKH" padded with zeroes.

I was able to figure out UART location and pinout and it is unlocked and avaiable.
I have played around with it, was able to boot to /bin/init, was able to use restore_mtd to rewrite primary kernel and initd from secondaries.
Was able to manually mount secondary apps partition and rewrite that to primary.
No effect.

Comparing to a known good camera behavior I can see that around this block:

warning, iavStream=3, smart264_disable, state is null
pack info:chan 1 2048x1536
pack info:chan 2 704x576
pack info:chan 3 1920x1080

Good camera runs more "DSP" stuff, like "setup_video_input :vin_mode 13".
Bad camera skips to launching the TKH app frontend.
There is nothing else in the log that might suggest hardware problems or corrupted libraries, etc.


I wonder if anyone ran into this before and what would be the best approach to investigate.
It is for fun and self education, there is no other reason to waste time in a 10 y/o camera.
I'm new to HikVision cams world, but not new in embedded in general.

Thanks.

Edit. I have tried to attach logs from both cameras, but I guess my level is not enough.

Bricked: pastebin v6TGXqTP
Good: pastebin fABqsj4t

 

[watchful_ip]

You could reseat/reconnect all components and cables.

Given you have a root shell, you could manually bring the camera up bit by bit. Even better in tandem with good camera to pin things down more.

You could raise the pritnk level and see if there's any help there.

Assuming the devices use the same firmware you could copy the the good application partition across between cameras, manually clear config, and/or even just mount SD card over relevant partitions for a manual attempt.

Feels more like hardware issue than software, but I'm not certain and it's fun to play with things anyway.

 

[arcademachinist]

I have completely disassembled the camera and put it back before realizing it is HIKvision module based on Ambarella SOC.
So the cabling is not the issue here. I would also say corruption is unlikely, unti both pri and sec are corrupt at once and in the same spot.

Do you know how to mount SDcard in HIK cameras from shell? Is does see:

mmc0 power register success!
mmc1 power register success!

But no /dev/mmcblk* devices show up with card inserted.

Any clues how to disable watchdog?
I see /dev/watchdog, but what is expects to receive as a "ping"? Any clues from other HIKvision cameras?

 

[watchful_ip]

I have completely disassembled the camera and put it back before realizing it is HIKvision module based on Ambarella SOC.
So the cabling is not the issue here. I would also say corruption is unlikely, unti both pri and sec are corrupt at once and in the same spot.

Do you know how to mount SDcard in HIK cameras from shell? Is does see:

mmc0 power register success!
mmc1 power register success!

But no /dev/mmcblk* devices show up with card inserted.

Any clues how to disable watchdog?
I see /dev/watchdog, but what is expects to receive as a "ping"? Any clues from other HIKvision cameras?

I'm kinda limited in how much help I can give. But in general:

/etc/udev is a good place to look assuming udevd is running.

As for /dev/watchdog, I usually have a look around for userspace programs or script that mention /dev/watchdog to figure it out Either that or disable from the bootloader (e.g. bootargs) if supported.

Sometimes it's a simple as a soft wd script that runs reboot command if main program isn't running within a certain time.