BLK18EV-0062-0035 INFO: https://habr.com/ru/articles/486856/ https://github.com/tothi/pwn-hisilicon-dvr?tab=readme-ov-file https://github.com/PeterEmbedded/Hi3518E-IP-Camera https://gist.github.com/gabonator/74cdd6ab4f733ff047356198c781f27d https://www.burglaryalarmsystem.com/technology-news/china-ip-camera-configuration-firmware.html !!! https://openipc.org/cameras/vendors/hisilicon/socs/hi3518ev200 Save the original firmware Back up your stock firmware, don't skip this part of the installation process! # Enter commands line by line! Do not copy and paste multiple lines at once! setenv ipaddr 192.168.1.10; setenv serverip 192.168.1.254 mw.b 0x82000000 0xff 0x800000 sf probe 0; sf read 0x82000000 0x0 0x800000 tftpput 0x82000000 0x800000 backup-hi3518ev200-nor8m.bin # if there is no tftpput but tftp then run this instead tftp 0x82000000 backup-hi3518ev200-nor8m.bin 0x800000 Flash full OpenIPC Firmware image Download OpenIPC Firmware (Lite) image for HiSilicon HI3518EV200 with 8MB NOR flash: https://openipc.org/cameras/vendors/hisilicon/socs/hi3518ev200/download_full_image?flash_size=8&flash_type=nor&fw_release=lite # Enter commands line by line! Do not copy and paste multiple lines at once! setenv ipaddr 192.168.1.10; setenv serverip 192.168.1.254 mw.b 0x82000000 0xff 0x800000 tftpboot 0x82000000 openipc-hi3518ev200-lite-8mb.bin # if there is no tftpboot but tftp then run this instead tftp 0x82000000 openipc-hi3518ev200-lite-8mb.bin sf probe 0; sf lock 0; sf erase 0x0 0x800000; sf write 0x82000000 0x0 0x800000 reset serial pins next to corner of pcb: 1 (square): RX 2 : TX 3 (hole) : GND default ip: 192.168.1.10 Hack-enable telnet with hs-dvr-telnet.py script ROOT PASS (for telnet): xmhdipc delete /mnt/mtd/config/Account1 to reset login