I have a Hikvision IP camera that I'm doing security research on. (Model DFI6257E, looks like a Taiwan exclusive model. )
After dumping firmware from its flash and analyze it with binwalk, I found it intriguingly difficult to understand how its working. Almost like they are trying to hide things.
Dumped firmware : https://drive.google.com/file/d/1x9JiVbnZo4zNNnX8V8JS1MGsK4wmHFM6/view?usp=sharing
Here's the output of binwalk:
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
36392 0x8E28 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: -1 bytes
10092544 0x9A0000 JFFS2 filesystem, little endian
16318544 0xF90050 Zlib compressed data, compressed
16318764 0xF9012C Zlib compressed data, compressed
16319000 0xF90218 Zlib compressed data, compressed
16319136 0xF902A0 Zlib compressed data, compressed
16319592 0xF90468 Zlib compressed data, compressed
16320424 0xF907A8 Zlib compressed data, compressed
16320864 0xF90960 Zlib compressed data, compressed
16321796 0xF90D04 Zlib compressed data, compressed
16322380 0xF90F4C Zlib compressed data, compressed
16322560 0xF91000 Zlib compressed data, compressed
16323100 0xF9121C Zlib compressed data, compressed
16324028 0xF915BC Zlib compressed data, compressed
16324556 0xF917CC Zlib compressed data, compressed
16325336 0xF91AD8 Zlib compressed data, compressed
16326072 0xF91DB8 JFFS2 filesystem, little endian
16326276 0xF91E84 Zlib compressed data, compressed
16327348 0xF922B4 JFFS2 filesystem, little endian
16328220 0xF9261C Zlib compressed data, compressed
16328684 0xF927EC JFFS2 filesystem, little endian
16329344 0xF92A80 Zlib compressed data, compressed
16329840 0xF92C70 JFFS2 filesystem, little endian
16330528 0xF92F20 Zlib compressed data, compressed
16330992 0xF930F0 JFFS2 filesystem, little endian
16331632 0xF93370 Zlib compressed data, compressed
16332212 0xF935B4 JFFS2 filesystem, little endian
16332416 0xF93680 Zlib compressed data, compressed
16332680 0xF93788 JFFS2 filesystem, little endian
16333240 0xF939B8 Zlib compressed data, compressed
16333528 0xF93AD8 JFFS2 filesystem, little endian
16334148 0xF93D44 Zlib compressed data, compressed
16334188 0xF93D6C JFFS2 filesystem, little endian
16334896 0xF94030 Zlib compressed data, compressed
16335076 0xF940E4 Zlib compressed data, compressed
16335412 0xF94234 Zlib compressed data, compressed
16335520 0xF942A0 Zlib compressed data, compressed
16335708 0xF9435C Zlib compressed data, compressed
16335984 0xF94470 Zlib compressed data, compressed
16336320 0xF945C0 Zlib compressed data, compressed
16336888 0xF947F8 Zlib compressed data, compressed
16337540 0xF94A84 Zlib compressed data, compressed
16337852 0xF94BBC Zlib compressed data, compressed
16338032 0xF94C70 Zlib compressed data, compressed
16338288 0xF94D70 Zlib compressed data, compressed
16339092 0xF95094 Zlib compressed data, compressed
16339748 0xF95324 Zlib compressed data, compressed
16339792 0xF95350 JFFS2 filesystem, little endian
The first thing I noticed is that there is no uboot header or uImage header that's often seen in other embedded device firmware.
The bootloader is located in the decompressed LZMA data at 0x8E28 (Known by comparing what I see from UART console output and output of strings 8E28)
But again it's not a usual U-boot program as binwalk failed to detect U-boot when I used binwalk to analyze it.
I really want to know how I can process this data at 0x8E28 so I can do some RE on IDA or ghidra and sort out how this device works internally.
The camera's web service is running on Angular (yet another unusual feature in embedded device.) but there are no Angular binaries to be found in the firmware even after binwalk extraction.
Web interface password is not stored in ipc_db as most other Hikvision products do.
(The provided firmware file is dumped after I edited admin password to "HikHiktest", so the entry "admin:12345" in ipc_db is not the correct one which web interface is looking for authentication.)
And there are also a lot of cryptic stuff happening in this firmware.
My guess for now is decryption is done in uboot and other stuff is handled by Huawei LiteOS powering this device, but in order to do further research I will need to first extract these two and the binaries in use from the firmware.
Can anyone share how I might achieve my goal? Any advice is appreciated.
Some part of console boot log, if it's useful:
Uncompress..............Ok
System startup
U-Boot 2010.06-396122 (Jun 12 2018 - 14:17:54)
SPI Nor: 16MB
DDR: 64MB
Erasing SPI flash, offset 0x00060000 size 64K ...done
Writing to SPI flash, offset 0x00060000 size 64K ...done
[Uboot] In release mode!
Hit Ctrl+u to stop autoboot: 0
MAC: 68-6D-BC-7D-81-EC
PHY not link.
TFTP server auto connect disabled
booting from sys part...
Load kernel to 0x81ffffc0 ...
Done!
Succeed!
## Booting kernel from Legacy Image at 81ffffc0 ...
Image Name: LiteOS-0.1.0-e3
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 5997539 Bytes = 5.7 MiB
Load Address: 80000000
Entry Point: 80000000
Uncompressing Kernel Image ... OK
Starting kernel ...
********hello Huawei LiteOS ARM926********
version : Huawei LiteOS V200R001C10B039
open-version : Huawei LiteOS 1.4.11
build data : Dec 11 2018 10:44:09
**********************************
osAppInit
uart init ...
spi bus init ...
dmac init
i2c bus init ...
random dev init ...
hw random dev init ...
mem dev init ...
porc fs init ...
Mount procfs finished.
Mount ramfs finished.
cxx init ...
spi nor flash init ...
Spi Nor ID:0xC8 0x40 0x18 0xC8 0x40 0x18 0xC8 0x40
Spi Nor Flash Info:
Name:"GD25Q128" Size:16MB Block:64KB
gpio init ...
base module init success.
RS485_CTRL MUXCTRL(37) FCN0 GPIO3_0 OUTPUT LOW_LEVEL
RS485_RXD MUXCTRL(36) FCN1 NO_GPIO
RS485_TXD MUXCTRL(34) FCN1 NO_GPIO
UART2_RXD MUXCTRL(49) FCN2 NO_GPIO
UART2_TXD MUXCTRL(50) FCN2 NO_GPIO
SENSOR_RST MUXCTRL(14) FCN1 NO_GPIO
SENSOR_CLK MUXCTRL(15) FCN1 NO_GPIO
PHY_RST MUXCTRL(48) FCN1 NO_GPIO
I2C0_SDA MUXCTRL(11) FCN3 NO_GPIO
I2C0_SCL MUXCTRL(12) FCN3 NO_GPIO
I2C1_SDA MUXCTRL(8 ) FCN1 NO_GPIO
I2C1_SCL MUXCTRL(9 ) FCN1 NO_GPIO
SPI0_CSN MUXCTRL(13) FCN1 NO_GPIO
SPI1_SCLK MUXCTRL(53) FCN1 NO_GPIO
SPI1_MOSI MUXCTRL(51) FCN1 NO_GPIO
SPI1_MISO MUXCTRL(53) FCN1 NO_GPIO
SPI1_CSN0 MUXCTRL(57) FCN1 GPIO7_3 OUTPUT HIGH_LEVEL
SPI1_CSN1 MUXCTRL(58) FCN1 GPIO7_4 OUTPUT HIGH_LEVEL
ALARM_OUT1 MUXCTRL(62) FCN0 GPIO0_1 OUTPUT LOW_LEVEL
ALARM_IN2 MUXCTRL(61) FCN0 GPIO0_0 INPUT LOW_LEVEL
ALARM_OUT2 MUXCTRL(22) FCN0 GPIO1_6 OUTPUT LOW_LEVEL
IRCUT_1 MUXCTRL(7 ) FCN0 GPIO6_0 OUTPUT LOW_LEVEL
IRCUT_2 MUXCTRL(6 ) FCN0 GPIO6_1 OUTPUT LOW_LEVEL
IRCUT/ZOOM_FB MUXCTRL(55) FCN1 GPIO7_1 INPUT LOW_LEVEL
ABF/FOCUS_FB MUXCTRL(56) FCN1 GPIO7_2 INPUT LOW_LEVEL
MFOCUS MUXCTRL(60) FCN1 GPIO7_6 INPUT LOW_LEVEL
IRIS_SET MUXCTRL(35) FCN0 GPIO3_2 OUTPUT LOW_LEVEL
IRIS_PWM MUXCTRL(3 ) FCN1 NO_GPIO
FAR_IR_PWM MUXCTRL(1 ) FCN1 NO_GPIO
NEAR_IR_PWM MUXCTRL(2 ) FCN1 NO_GPIO
PHOTO_FB MUXCTRL(63) FCN1 NO_GPIO
PIR/TEMP_IN MUXCTRL(64) FCN1 NO_GPIO
USB_PWREN MUXCTRL(25) FCN1 NO_GPIO
WORK_LED MUXCTRL(21) FCN0 GPIO1_5 OUTPUT LOW_LEVEL
START_LED MUXCTRL(16) FCN0 GPIO1_0 OUTPUT LOW_LEVEL
ETHERNET_LED MUXCTRL(18) FCN0 GPIO1_2 OUTPUT LOW_LEVEL
BCMDHD_OOB MUXCTRL(65) FCN0 GPIO8_2 INPUT LOW_LEVEL
MRESET MUXCTRL(59) FCN1 GPIO7_5 INPUT LOW_LEVEL
<6>Successfully insmod exact_timer module!
hik_core module init success.
enter pwm init
<6>init hikio.
watchdog_init success.
rtc init success
tcpip init ...
Calling lwIPRegSecSspCbk
net init ...
enter hisi_eth_init!
hisi_eth init begin.
hisi_eth: User did not set phy mode, use default=rmii
hisi_eth: User did not set phy addr, auto scan...
Detected phy addr 3, phyid: 0x1cc816
s
# g_sys_mem_addr_end=0x81f00000,
done init!
Date:Dec 18 2018.
Time:12:51:58.
osal_proc_mkdir - parent is NULL! proc=0x8109a860
mem_start=0x80000000, MEM_OS_SIZE=31M, MEM_USB_SIZE=0M, mmz_start=0x81f00000, mmz_size=33M
mmz param= anonymous,0,0x81f00000,26556K:ddr0,0,0x838ef000,7236K
<6>Hisilicon Media Memory Zone Manager
load sys.ko...OK!
load region.ko...OK!
load vgs.ko...OK!
load viu.ko...OK!
ISP Mod init!
load vpss.ko...OK!
load rc.ko ...OK!
ModuleParam: VencMaxChnNum(0) is illegal,should be [1, 16]
load venc.ko ...OK!
load chnl.ko...OK!
load vedu.ko ...OK!
ModuleParam: check H264eVBSource(0) illegal
load h264e.ko ...OK!
ModuleParam: H265eVBSource(0) is illegal,should be [1, 2]
load h265e.ko ...OK!
load jpege.ko ...OK!
sensor dev init OK.
load pwm.ko OK!
load hi_mipi driver successful!
Load hi_cipher.ko success.
load aio.ko ...OK!
load ai.ko OK!
load ao.ko OK!
load aenc.ko OK!
load adec.ko OK!
load acodec.ko...OK!
load ive.ko...OK!
SDK init ok...
Load power ok.
power on.
Unload power success.