Anything DIY

ANNKE NVR system information

Post Reply
other / anything     Views: 615Prev .. Next
ANNKE NVR system informationPosted: Friday, April 30, 2021 [18:57:59] - 1
rootPosted by:rootMember Since:
June 16 2010
Posts: 357
Integrated security system requires some interaction with home systems.
ANNKE is not the easiest to interact with. Even though it is stated that it runs on Linux Kernel - UNIX internals went through some serious clipping.

All information below related to ANNKE 8-Channel 6MP PoE NVR, Model Number: N48PBB

Image 1

Image 2

Accessing NVR VIA SSH gives no real SSH access. There is no "ls", "cat", "ps" or any other commands. In fact "help" brings-up custom supported commands but for whatever reason half of them don't work:
View Code# help
Support Commands:
GetAnrCfgInfo
GetAnrProcess
GetAnrRecordList
ShowIpcAbility
accessDvrSwitch
channelPlayback
clearDisksMode
ctrlArchDebug
decStat
disableHB
disableHik264
dspStatus
dvrLogInfo
dt
enableHB
enableHik264
enableWatchdog
errputClose
errputOpen
get3GMode
getCMS
getCycleReboot
getDbgCtrl
getHardInfo
getIp
getLastErrorInfo
getPlayTestCtrl
getPort
getServerInfo
guiChkCfg
guiEnterMenuCount
guiPrtScr
guiStatus
helpm
helpu
i2cRead
megaDspConfig
miscCmd
netstat
outputClose
outputOpen
partRecDetails
ping
printPart
pthreadInfo
recorderChanInfo
recorderFileInfo
recorderFileKeyFrame
recorderHDIdle
recorderMediaInfo
recorderPAllocFile
recorderParam
recorderSegExtraInfo
recorderStatus
sendATCom
set3GPrint
set3GEnable
searchInfo
setGateway
setIp
setlang
setMtu
setoutputmode
setPrint
show8107coreUseInfo
showCurPlayChanFileInfo
showDeviceTemp
showIpcMemInfo
showNetIpcmInfo
showNetLinksInfo
showPlayChanStatus
showPlayClipFile
showPlayScreenInfo
showPlayStatus
showPlayTime
showPreviewInfo
showShareSvcInfo
showSpareWorkStatus
showTagSysInfo
showUserInfo
showpu
t1
t2
transcodeResStatus
getDateInfo
dmesg
help

dmesg prints-out the following:
View Code# dmesg
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 4.9.37 (simajian@Cpl-Backend-BSP-118) (gcc version 6.2.1 20161016 (Hisilicon_v510_20180120) ) #2 Wed Jun 19 20:13:32 CST 2019
[ 0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: div instructions available: patching division code
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] OF: fdt:Machine model: HIKVISON K75 Platform Board
[ 0.000000] HIKBASE version ##33439[kernel:33740] v2.1.0 build 2019-6-19
[ 0.000000] request_module: runaway loop modprobe fs-proc
[ 0.000000] Ignoring unrecognised tag 0x54410001
[ 0.000000] Ignoring unrecognised tag 0x54410009
[ 0.000000] cpldinfo offset[0x5e000], size[0x100].
[ 0.000000] Ignoring unrecognised tag 0x484b0002
[ 0.000000] Ignoring unrecognised tag 0x484b0004
[ 0.000000] Ignoring unrecognised tag 0x484b0005
[ 0.000000] Memory policy: Data cache writeback
[ 0.000000] On node 0 totalpages: 40960
[ 0.000000] free_area_init_node: node 0, pgdat c08b71f0, node_mem_map c9eb7000
[ 0.000000] Normal zone: 320 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 40960 pages, LIFO batch:7
[ 0.000000] CPU: All CPU(s) started in SVC mode.
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 40640
[ 0.000000] Kernel command line: mem=160M console=ttyS0,115200n8 noinitrd ip=192.0.0.64:192.0.0.128::255.255.255.0:Hik-eth:eth0:none
[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Memory: 153060K/163840K available (4109K kernel code, 174K rwdata, 1120K rodata, 3360K init, 274K bss, 10780K reserved, 0K cma-reserved)
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB)
[ 0.000000] vmalloc : 0xca800000 - 0xff800000 ( 848 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xca000000 ( 160 MB)
[ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB)
[ 0.000000] .text : 0xc0008000 - 0xc040b748 (4110 kB)
[ 0.000000] .init : 0xc0544000 - 0xc088c000 (3360 kB)
[ 0.000000] .data : 0xc088c000 - 0xc08b78a0 ( 175 kB)
[ 0.000000] .bss : 0xc08b9000 - 0xc08fd8c8 ( 275 kB)
[ 0.000000] SLUB: HWalign=64, Order=0-0, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:16 nr_irqs:16 16
[ 0.000000] clocksource: arm,sp804: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 637086815595 ns
[ 0.000008] sched_clock: 32 bits at 3000kHz, resolution 333ns, wraps every 715827882841ns
[ 0.000198] Console: colour dummy device 80x30
[ 0.000215] Calibrating delay loop... 1692.46 BogoMIPS (lpj=8462336)
[ 0.060016] pid_max: default: 32768 minimum: 301
[ 0.060093] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.060100] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.060677] CPU: Testing write buffer coherency: ok
[ 0.060879] Setting up static identity map for 0x80008200 - 0x80008258
[ 0.064007] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[ 0.064291] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.064304] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.064362] pinctrl core: initialized pinctrl subsystem
[ 0.064690] NET: Registered protocol family 16
[ 0.064959] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 0.064964] Find the board(K75).
[ 0.064969] Current board is PCB[0x80325], BOARD[0x5800]
[ 0.065967] Serial: AMBA PL011 UART driver
[ 0.067160] 12080000.uart: ttyS0 at MMIO 0x12080000 (irq = 18, base_baud = 0) is a PL011 rev2
[ 0.067188] console [ttyS0] enabled
[ 0.067719] uart-pl011 12090000.uart: aliased and non-aliased serial devices found in device tree. Serial port enumeration may be unpredictable.
[ 0.067734] 12090000.uart: ttyS1 at MMIO 0x12090000 (irq = 19, base_baud = 0) is a PL011 rev2
[ 0.068239] uart-pl011 120a0000.uart: aliased and non-aliased serial devices found in device tree. Serial port enumeration may be unpredictable.
[ 0.068252] 120a0000.uart: ttyS2 at MMIO 0x120a0000 (irq = 20, base_baud = 0) is a PL011 rev2
[ 0.096415] SCSI subsystem initialized
[ 0.096846] libata version 3.00 loaded.
[ 0.097173] usbcore: registered new interface driver usbfs
[ 0.097253] usbcore: registered new interface driver hub
[ 0.097319] usbcore: registered new device driver usb
[ 0.098161] clocksource: Switched to clocksource arm,sp804
[ 0.105527] NET: Registered protocol family 2
[ 0.106088] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.106118] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.106144] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.106197] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.106212] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.106321] NET: Registered protocol family 1
[ 0.112909] RPC: Registered named UNIX socket transport module.
[ 0.112916] RPC: Registered udp transport module.
[ 0.112919] RPC: Registered tcp transport module.
[ 0.112922] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.127401] workingset: timestamp_bits=30 max_order=16 bucket_order=0
[ 0.140908] NFS: Registering the id_resolver key type
[ 0.140940] Key type id_resolver registered
[ 0.140943] Key type id_legacy registered
[ 0.140982] fuse init (API version 7.26)
[ 0.143453] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 0.143462] io scheduler noop registered (default)
[ 0.147027] pinctrl-single 120f0000.pinmux: 234 pins at pa fe1f0000 size 936
[ 0.147914] pl061_gpio 12150000.gpio_chip: PL061 GPIO chip @0x12150000 registered
[ 0.148574] pl061_gpio 12160000.gpio_chip: PL061 GPIO chip @0x12160000 registered
[ 0.149262] pl061_gpio 12170000.gpio_chip: PL061 GPIO chip @0x12170000 registered
[ 0.149942] pl061_gpio 12180000.gpio_chip: PL061 GPIO chip @0x12180000 registered
[ 0.150682] pl061_gpio 12190000.gpio_chip: PL061 GPIO chip @0x12190000 registered
[ 0.151396] pl061_gpio 121a0000.gpio_chip: PL061 GPIO chip @0x121a0000 registered
[ 0.167567] brd: module loaded
[ 0.168321] Loading iSCSI transport class v2.0-870.
[ 0.169935] iscsi: registered transport (tcp)
[ 0.290051] ahci 10030000.sata: SSS flag set, parallel bus scan disabled
[ 0.290081] ahci 10030000.sata: AHCI 0001.0300 32 slots 1 ports 6 Gbps 0x1 impl platform mode
[ 0.290093] ahci 10030000.sata: flags: ncq sntf stag pm led clo only pmp fbs slum part ccc sxs boh
[ 0.291310] scsi host0: ahci
[ 0.291728] ata1: SATA max UDMA/133 mmio [mem 0x10030000-0x10030fff] port 0x100 irq 21
[ 0.292208] hisi-sfc hisi_spi_nor.0: SPI Nor ID Table Version 1.2
[ 0.292244] hisi-sfc hisi_spi_nor.0: w25q128(b/f)v (Chipsize 16 Mbytes, Blocksize 64KiB)
[ 0.575488] FEPHY:addr=1, la_am=0xd, ldo_am=0x4, r_tuning=0x1d
[ 0.575647] libphy: hisi_femac_mii_bus: probed
[ 0.576523] libphy: Fixed MDIO Bus: probed
[ 0.683440] Generic PHY 10011100.mdio:01: attached PHY driver [Generic PHY] (mii_bus:phy_addr=10011100.mdio:01, irq=-1)
[ 0.683447] phy_id=0x20669901, phy_mode=mii
[ 0.684433] PPP generic driver version 2.4.2
[ 0.684582] PPP BSD Compression module registered
[ 0.684587] PPP Deflate Compression module registered
[ 0.684601] PPP MPPE Compression module registered
[ 0.684625] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 0.684629] ehci-platform: EHCI generic platform driver
[ 0.684770] ehci-platform 11010000.ehci: EHCI Host Controller
[ 0.684804] ehci-platform 11010000.ehci: new USB bus registered, assigned bus number 1
[ 0.684922] ehci-platform 11010000.ehci: irq 23, io mem 0x11010000
[ 0.710015] ehci-platform 11010000.ehci: USB 2.0 started, EHCI 1.00
[ 0.710807] hub 1-0:1.0: USB hub found
[ 0.710886] hub 1-0:1.0: 2 ports detected
[ 0.711492] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 0.711498] ohci-platform: OHCI generic platform driver
[ 0.711633] ohci-platform 11000000.ohci: Generic Platform OHCI controller
[ 0.711668] ohci-platform 11000000.ohci: new USB bus registered, assigned bus number 2
[ 0.711749] ohci-platform 11000000.ohci: irq 24, io mem 0x11000000
[ 0.784802] hub 2-0:1.0: USB hub found
[ 0.784886] hub 2-0:1.0: 2 ports detected
[ 0.785556] usbcore: registered new interface driver usb-storage
[ 0.785695] usbcore: registered new interface driver usbserial
[ 0.785740] usbcore: registered new interface driver mos7840
[ 0.785793] usbserial: USB Serial support registered for Moschip 7840/7820 USB Serial Driver
[ 0.786027] mousedev: PS/2 mouse device common for all mice
[ 0.786124] i2c /dev entries driver
[ 0.786632] usbcore: registered new interface driver usbhid
[ 0.786635] usbhid: USB HID core driver
[ 0.786818] hisi-dmac 11020000.hidma-controller: hidmac probe!
[ 0.787143] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 0.787187] Initializing XFRM netlink socket
[ 0.787793] NET: Registered protocol family 10
[ 0.790255] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[ 0.791000] NET: Registered protocol family 17
[ 0.791027] NET: Registered protocol family 15
[ 0.791073] 8021q: 802.1Q VLAN Support v1.8
[ 0.791112] Key type dns_resolver registered
[ 0.791247] HIKBASERD: Loading 148KiB [2 disks] into "/home/hikbase.image"...
[ 0.792128] done.
[ 0.793194] hctosys: unable to open rtc device (rtc0)
[ 0.793742] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 0.820078] Waiting up to 0 more seconds for network.
[ 0.850003] IP-Config: Complete:
[ 0.850016] device=eth0, hwaddr=ac:cb:51:f2:af:8e, ipaddr=192.0.0.64, mask=255.255.255.0, gw=255.255.255.255
[ 0.850021] host=Hik-eth, domain=, nis-domain=(none)
[ 0.850026] bootserver=192.0.0.128, rootserver=192.0.0.128, rootpath=
[ 0.850148] PM: Hibernation image not present or could not be loaded.
[ 0.853821] Freeing unused kernel memory: 3360K (c0544000 - c088c000)
[ 0.853827] This architecture does not have kernel memory protection.
[ 0.855470] init(1) called reboot syscall, cmd: 0x0.
[ 1.063437] hik_hal: loading out-of-tree module taints kernel.
[ 1.063466] hik_hal: module license 'HIKLICENSE' taints kernel.
[ 1.063468] Disabling lock debugging due to kernel taint
[ 1.065110] [HKBSP]HIK-BSP version #34316[kernel:33740, hikbase:33439] v2.3.2 build 2019-6-19
[ 1.065172] [HKBSP]start parsing ARGS: 'mem=160M console=ttyS0,115200n8 noinitrd ip=192.0.0.64:192.0.0.128::255.255.255.0:Hik-eth:eth0:none'
[ 1.065183] [HKBSP]Ignoring unrecognised tag 0x54410001
[ 1.065187] [HKBSP]Ignoring unrecognised tag 0x54410009
[ 1.065193] [HKBSP]cpldinfo offset[0x5e000], size[0x100].
[ 1.065199] [HKBSP]bootparam offset[0x5f000], size[0x200].
[ 1.065205] [HKBSP]envinfo offset[0x60000], size[0x1000].
[ 1.065209] [HKBSP]Ignoring unrecognised tag 0x484b0005
[ 1.071103] [HKBSP]Find the platform(K75).
[ 1.071540] Creating 2 MTD partitions on "hi_sfc":
[ 1.071554] 0x000000070000-0x0000000a0000 : "mtdblock1"
[ 1.072699] 0x0000000a0000-0x000001000000 : "mtdblock2"
[ 1.310214] hik_rtc 120b0000.rtc: rtc core: registered 120b0000.rtc as rtc0
[ 1.482315] libphy: GPIO MII Bus: probed
[ 1.490083] usb 2-1: new low-speed USB device number 2 using ohci-platform
[ 1.505181] libphy: GPIO MII Bus: probed
[ 1.770603] input: SEMICCHIP Usb Mouse as /devices/platform/soc/11000000.ohci/usb2/2-1/2-1:1.0/0003:1A2C:0042.0001/input/input0
[ 1.770900] hid-generic 0003:1A2C:0042.0001: input: USB HID v1.10 Mouse [SEMICCHIP Usb Mouse] on usb-11000000.ohci-1/input0
[ 1.908305] random: sleep: uninitialized urandom read (4 bytes read)
[ 2.880236] hisi-femac 10010000.ethernet eth0: Link is Up - 100Mbps/Full - flow control off
[ 2.888611] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 5.300171] random: fast init done
[ 8.360315] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 310)
[ 8.361338] ata1.00: ATA-8: TOSHIBA DT01ABA200V, MZ4OABB0, max UDMA/133
[ 8.361348] ata1.00: 3907029168 sectors, multi 0: LBA48 NCQ (depth 31/32)
[ 8.362433] ata1.00: configured for UDMA/133
[ 8.365384] scsi 0:0:0:0: Direct-Access ATA TOSHIBA DT01ABA2 ABB0 PQ: 0 ANSI: 5
[ 8.367833] sd 0:0:0:0: [sda] 3907029168 512-byte logical blocks: (2.00 TB/1.82 TiB)
[ 8.367844] sd 0:0:0:0: [sda] 4096-byte physical blocks
[ 8.370095] sd 0:0:0:0: [sda] Write Protect is off
[ 8.370112] sd 0:0:0:0: [sda] Mode Sense: 00 3a 00 00
[ 8.370844] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[ 8.396628] sd 0:0:0:0: [sda] Attached SCSI removable disk
[ 15.463392] load sys_config.ko for ...OK!
[ 15.476453] Module himedia: init ok
[ 15.476460] Hisilicon Media Memory Zone Manager
[ 15.476618] hi_osal 1.0 init success!
[ 15.500005] load base.ko ... OK!
[ 15.505700] load sys.ko ...OK!
[ 15.526185] load vdec.ko ....OK!
[ 15.538306] load vdh firmware.ko OK
[ 15.565226] load tde.ko ...OK!
[ 15.573967] load region.ko ....OK!
[ 15.601117] load vgs.ko ...OK!
[ 15.608322] load vpss.ko ...OK!
[ 15.630051] load vou.ko OK!
[ 15.670527] load hifb.ko OK!
[ 15.691202] load hdmi.ko OK!
[ 15.697418] load chnl.ko ...OK!
[ 15.702558] Load hi_cipher.ko success.
[ 15.713171] vca encrypt ready!vca_encrypt_major = 250
[ 15.723984] load aio.ko OK!
[ 15.734680] load ai.ko OK!
[ 15.745498] load ao.ko OK!
[ 15.764239] load adec.ko OK!
[ 15.990521] load acodec.ko OK!
[ 16.078374] start.sh (1322): drop_caches: 3
[ 16.775710] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 16.776385] hisi-femac 10010000.ethernet eth0: Link is Up - 100Mbps/Full - flow control off
[ 17.380712] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 32.424812] vca_encrypt_dbg: vca_encrypt_ioctl: CMD = 0x90
[ 32.424819] vca_encrypt_dbg: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[ 32.424822] vca_encrypt_dbg: before:chip id = 0x0
[ 32.424826] vca_encrypt_dbg: after:chip id = 0xcc3a6b18
[ 40.472189] random: crng init done
[ 48.806191] warning: process `taskStartSntpCl' used the deprecated sysctl system call with
[ 48.806204] 1.
[ 48.806208] 40.
[ 48.806210]
[62622.647448] sched: RT throttling activated

It appears as Hikvision kernel build on old Linux 4.9.37. Simple search for "Linux version 4.9.37" reveals a lot of Security Vulnerabilities.
It would be interesting to see how they were patched if patched at all.There's no place like ~
Using ANNKE NVR systemPosted: Friday, April 30, 2021 [19:50:52] - 2
rootPosted by:rootMember Since:
June 16 2010
Posts: 357
Some ideas on how to access ANNKE NVR remotely as streaming and taking a snapshots:
www.codemacs.com/other/an..There's no place like ~
other / anythingPrev .. Next
 
Post Reply
Home - Other: Anything DIY
Our Telegram Group