root@KALI:~# minicom -s Welcome to minicom 2.7.1 OPTIONS: I18n Compiled on May 6 2018, 08:02:47. Port /dev/ttyUSB0, 17:45:28 Press CTRL-A Z for help on special keys U-Boot 1.1.3 (Dec 26 2012 - 17:31:39) Board: Ralink APSoC DRAM: 32 MB relocate_code Pointer at: 81fb4000 sysctl:40200300 spi_wait_nsec: 42 spi device id: ef 40 17 0 0 (40170000) find flash: W25Q64BV raspi_read: from:30000 len:1000 .raspi_read: from:30000 len:1000 .============================================ Ralink UBoot Version: 3.5.3.0 -------------------------------------------- ASIC 5350_MP (Port5<->None) DRAM_CONF_FROM: Boot-Strapping DRAM_TYPE: SDRAM DRAM_SIZE: 256 Mbits DRAM_WIDTH: 16 bits DRAM_TOTAL_WIDTH: 16 bits TOTAL_MEMORY_SIZE: 32 MBytes Flash component: SPI Flash Date:Dec 26 2012 Time:17:31:39 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:128, ways:4, linesz:32 ,total:16384 ##### The CPU freq = 360 MHZ #### estimate memory size =32 Mbytes Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. 0 3: System Boot system code via Flash. ## Booting image at bc050000 ... raspi_read: from:50000 len:40 . Image Name: Linux Kernel Image Created: 2013-03-02 5:31:51 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 4091840 Bytes = 3.9 MB Load Address: 80000000 Entry Point: 802fd000 raspi_read: from:50040 len:3e6fc0 ............................................................... Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 802fd000) ... ## Giving linux memsize in MB, 32 Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.21 (root@mailzxh-desktop) (gcc version 3.4.2) #697 Sat Mar 2 13:31:48 CST 2013 The CPU feqenuce set to 360 MHz CPU revision is: 0001964c Determined physical RAM map: memory: 02000000 @ 00000000 (usable) Built 1 zonelists. Total pages: 8128 Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes. Primary data cache 16kB, 4-way, linesize 32 bytes. Synthesized TLB refill handler (20 instructions). Synthesized TLB load handler fastpath (32 instructions). Synthesized TLB store handler fastpath (32 instructions). Synthesized TLB modify handler fastpath (31 instructions). Cache parity protection disabled cause = d0808000, status = 11000000 PID hash table entries: 128 (order: 7, 512 bytes) calculating r4koff... 00057e40(360000) CPU frequency 360.00 MHz Using 180.000 MHz high precision timer. Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 29204k/32768k available (2653k kernel code, 3564k reserved, 402k data, 124k init, 0k highmem) Mount-cache hash table entries: 512 NET: Registered protocol family 16 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 Time: MIPS clocksource has been installed. IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered deice id : ef 40 17 0 0 (40170000) W25Q64BV(ef 40170000) (8192 Kbytes) mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 8 MTD partitions on "raspi": 0x00000000-0x00800000 : "ALL" 0x00000000-0x00030000 : "Bootloader" 0x00030000-0x00040000 : "Config" 0x00040000-0x00050000 : "Factory" 0x00050000-0x00150000 : "Kernel" 0x00150000-0x00480000 : "RootFS" 0x00480000-0x00780000 : "sys" 0x00780000-0x00800000 : "param" Load Ralink DFS Timer Module RT3xxx EHCI/OHCI init. squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc. io scheduler noop registered (default) gpiomode:404055 addr:b0000000 by zqh gpiomode:404059 by zqh1 Ralink gpio driver initialized Enable Ralink GDMA Controller Module GDMA IP Version=2 i2cdrv_major = 218 HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096 N_HDLC line discipline registered. Ralink APSoC Hardware Watchdog Timer Serial: 8250/16550 driver $Revision: 1.7 $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A loop: loaded (max 8 devices) rdm_major = 254 Ralink APSoC Ethernet Driver Initilization. v2.1 256 rx/tx descriptors allocated, mtu = 1500! NAPI enable, weight = 32, Tx Ring = 256, Rx Ring = 256 MAC_ADRH -- : 0x00004433 MAC_ADRL -- : 0x4cfafbe6 PROC INIT OK! PPP generic driver version 2.4.2 PPP BSD Compression module registered NET: Registered protocol family 24 PPPoL2TP kernel driver, V0.17 PPTP driver version 0.8.1 tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky Linux video capture interface: v2.00 === SONiX UVC Like Driver(H264) Initial === usbcore: registered new interface driver uvcvideo USB Video Class driver (v0.1.0_SONiX_v2.6.24.03) block2mtd: version $Revision: 1.1.1.1 $ usbmon: debugfs is not available rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1 rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000 rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2 rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected Initializing USB Mass Storage driver... usb 1-1: new high speed USB device using rt3xxx-ehci and address 2 usb 1-1: configuration #1 chosen from 1 choice uvcvideo: Found UVC 1.00 device USB 2.0 PC Camera (058f:3861) uvcvideo: Failed to query (1) UVC control 1 (unit 4) : -145 (exp. 4). uvcvideo: Failed to query (1) UVC control 1 (unit 3) : -32 (exp. 4). usbcore: registered new interface driver usb-storage USB Mass Storage support registered. Advanced Linux Sound Architecture Driver Version 1.0.14rc3 (Wed Mar 14 07:25:50 2007 UTC). ALSA device list: No soundcards found. nf_conntrack version 0.5.0 (256 buckets, 131072 max) ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 10 NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 124k freed init started: BusyBox v1.12.1 (2013-03-02 13:26:40 CST) starting pid 16, tty '': '/etc_ro/rcS' Algorithmics/MIPS FPU Emulator v1.5 devpts: called with bogus options drivers/usb/core/inode.c: usbfs: unrecognised mount option "defaults" or missing value drivers/usb/core/inode.c: usbfs: mount parameter error: Welcome to _______ _______ ___ __ ____ _ _ ___ | ___ \| __ || | |__|| \ | || | / / | |___| || |__| || |__ __ | \| || |/ / | _ /| _ || || || |\ || \ |__| \__\|__| |__||______||__||_| \____||_|\___\ =System Architecture Department= gpio open ralink gpio release by zqh clr gpio starting pid 32, tty '/dev/ttyS1': '/bin/sh' BusyBox v1.12.1 (2013-03-02 13:26:40 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. # Started WatchDog Timer. InitSystemParam 0 =========================read system param from file================================== zqh socket fd=3 zqh bind(6666) address successful! zqh socket fd=3 zqh bind(6666) address successful! mac:00:A1:14:01:7F:E1 30 wifimac:00:A1:14:01:7F:E2 30 wifimac:00:A1:14:01:7F:E2 daemon:===== wifi.c, line 311, WifiDriversInit(): insmod From kernal ie param ppid 39 ie param ppid 41 rt2860v2_sta: module license 'unspecified' taints kernel. === pAd = c0095000, size = 534784 === <-- RTMPAllocAdapterBlock, Status=0 daemon:===== wifi.c, line 316, WifiDriversInit(): [insmod /lib/modules/2.6.21/kernel/drivers/netRX DESC a18d6000 size = 2048 /wireless/rt2860v2_sta/rt2860v2_sta.ko mac=00:A1<-- RTMPAllocTxRxRingMemory, Status=0 :14:01:7F:E2] OK Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) 1. Phy Mode = 9 2. Phy Mode = 9 3. Phy Mode = 9 MCS Set = ff 00 00 00 01 <==== rt28xx_init, Status=0 0x1300 = 00064300 EthMacInit2 EthMacInit3 phy_tx_ring = 0x01f41000, tx_ring = 0xa1f41000 phy_rx_ring0 = 0x01f42000, rx_ring0 = 0xa1f42000 MAC_ADRH -- : 0x000000a1 MAC_ADRL -- : 0x14017fe1 RT305x_ESW: Link Status Changed EthMacInit4 switch reg write offset=14, value=5555 switch reg write offset=40, value=1001 switch reg write offset=44, value=1001 switch reg write offset=48, value=1001 switch reg write offset=4c, value=1 switch reg write offset=50, value=2001 switch reg write offset=70, value=ffffffff switch reg write offset=98, value=7f7f switch reg write offset=e4, value=7f done. EthMacInit5 EthMacInit5 switch reg write offset=14, value=5555 switch reg write offset=40, value=1001 switch reg write offset=44, value=1001 switch reg write offset=48, value=1001 switch reg write offset=4c, value=1 switch reg write offset=50, value=2001 switch reg write offset=70, value=ffffffff switch reg write offset=98, value=7f7f switch reg write offset=e4, value=7f done. eth is start =====InitNetDrivers======= daemon:===== network.c, line 383, DnsConfig(): Save to File, 1 = [8.8.8.8] daemon:===== network.c, line 384, DnsConfig(): Save to File, 2 = [202.96.134.33] pid 29 NetThreadProc netstatsem post =======network change======= netok -1 link 0 net is work on wifi enter dhcp mode route: ioctl 0x890c failed: No such process killall: udhcpc: no process killed Ethnet Dhcp udhcpc (v1.12.1) started netstatsem post end start app update thread start sys update thread =======mac======= 00-a1-14-01-7f-e1- No lease, failing zqh socket fd=7 zqh bind(9123) address successful! ipc param ppid 34 update socket init update Socket proc is start ==== sysparam.c , line 308, InitSystemParam :read system.ini user1: , pwd1: user2: , pwd2: user3: admin, pwd3: zqh socket fd=4 zqh bind(8832) address successful! zqh socket fd=5 zqh bind(6666) address successful! zqh socket fd=9 zi2s enable:1 qh bind(8813) adwork in slave audiohw_preinit by zqh 12Mhz dress successfulgpio open ! zqh socket fd=10 zqh bind(8822) address successful! zqh socket fd=11 zqh bind(8832) address successful! ie param ppid 131 ie param ppid 131 mac:00:A1:14:01:7F:E1 30 wifimac:00:A1:14:01:7F:E2 30 wifimac:00:A1:14:01:7F:E2 sys_ver 1a02007d write date ok curtime 1440519018 dhcp is start...=0 dhcp is stop... wifistart1 route: ioctl 0x890c failed: No such process wifistart2 wifistart3 wifistart4 wifistart5 _i2c_read==== encrypt.c , line 467, CheckEncrypt :===========encryt is ok============ fp == null ==== encrypt.c ralink gpio release by zqh , line 1117clr gpio , CheckChipOk :es8388 is ok =======mac======= 00-a1-14-01-7f-e1- ============autio init========= audio capture:147 audio play:148 ==== stream.c , line 368, VideoEnable :---VideoEnable(bysize=0)---Initing... length: 921600 offset: 0 Buffer mapped at address 0x2af83000. length: 921600 offset: 921600 Buffer mapped at address 0x2b064000. length: 921600 offset: 1843200 Buffer mapped at address 0x2b145000. length: 921600 offset: 2764800 Buffer mapped at address 0x2b226000. video_enable video enable video enable ok init capture ok init thread ok capture video:156 Socket proc is start pid=160 send live jpeg:161 send live jpeg:162 send live jpeg:163 send live jpeg:164 send video jpeg:165 send video jpeg:166 send video jpeg:167 send video jpeg:168 send live audio:169 send live audio:170 send live audio:171 send live audio:172 AudioPlayProc:173 send record file:174 send record file:175 send record file:176 send record file:177 start gpio check start motion check start alarm proc ==== dns.c , line 107, DnsSendAlarmProc :start alarm to DNS servgpio open er... init thread ok web pid:193 upnpc : miniupnpc library test client. (c) 2006-2010 Thomas Bernard Go to http://miniupnp.free.fr/ or http://miniupnp.tuxfamily.org/ for more information. ========ipaddr 192.168.1.138=========== ========port 81=========== FrameRate proc:194 p2p init proc P2P cmd thread is start... ==== moto-new.c , line 4418, InitMoto :Init, alarminhappen = 0 ==== moto-new.c , line 1318, ReadVertSteps :Read maxverttime = 160 ==== moto-new.c , line 1372, GetVertTime :get vertime 64 ==== moto-new.c , line 1026, ReadLevelSteps :Read maxleveltime = 520 ==== moto-new.c , line 1053, GetLevelTime :get levelime 444 P2P media thread is start... P2P play thread is start... P2P media thread is start... P2P cmd thread is start... --------------SaveSystemParam---------- bparam.stNetParam.szIpAddr = 192.168.1.138 link:0 status:0 sys_ver 1a02007d ==== dns.c , line 694, FactoryRegisterProc :FactoryRegisterProc ========version:20804=========== ==== moto-new.c , line 4438, MotoCentProc :=====moto is start===== ==== moto-new.c , line 4439, MotoCentProc :moto start, read moto sit ==== moto-new.c , line 4440, MotoCentProc :presend = 0, speed = 10 ==== moto-new.c , line 4447, MotoCentProc :Set Moto to Center----- ==== moto-new.c , line 3611, SendMotoCmd :Motocmd=0 start run ddns timer sd start is start...900 No IGD UPnP Device found on the network ! iRet 0 upnp:/system/system/bin/upnpc-static -a 192.168.1.138 81 81 TCP iRet 0 ==== network.c , line 2897, Networkhread :Create Thread WfiCheckProc ==== network.c , line 2832, WfiCheckProc :===wifi check status=== ==== capture.c , line 366, SetBrightness :size iRet=0, value=1 ==== video.c , line 664, VideoParamInit :--------------VideoParamInit---------- set mirr flip=5 ==== video.c , line 717, VideoParamInit :set mirr flip, Param = 5, Saturation = 5 write 5020 get main thread param ==== main.c , line 441, main :SystemVerion==================[ 26.2.0.125 ]============== def key proc check wifi ==== date.c , line 141, NtpThreadProc :Call GetNtpTime ==== date.c , line 90, GetNtpTime :bparam.stDTimeParam.byIsNTPServer = 0 ==== date.c , line 91, GetNtpTime :bparam.stDTimeParam.szNtpSvr = dircnt 64 verttime 160 ===onstart===1 on start = 20 on start 20 ==== date.c , line 141, NtpThreadProc :Call GetNtpTime ==== date.c , line 90, GetNtpTime :bparam.stDTimeParam.byIsNTPServer = 0 ==== date.c , line 91, GetNtpTime :bparam.stDTimeParam.szNtpSvr = iRet 0 bFlagInternet 0 bFlagHostResolved 0 bFlagServerHello 0 NAT_Type 0 PPPP_Share_Bandwidth(1) iRet 0 P2P init =0 ==== date.c , line 141, NtpThreadProc :Call GetNtpTime ==== date.c , line 90, GetNtpTime :bparam.stDTimeParam.byIsNTPServer = 0 ==== date.c , line 91, GetNtpTime :bparam.stDTimeParam.szNtpSvr = #