Flussonic

Beward DS05MP: UART port or any way to get console

Video Surveillance
#1

Got a IP door bell/camera device Beward DS05MP and want to get UART working or any other way to get in and modify software for my needs. The device is comprised of 2 parts: entryphone (door bell with camera panel) and relay set, which are connected with ethernet cable.

photo_2018-12-04_17-30-38
photo_2018-12-04_17-30-381280Ă—640 62.4 KB

No specs provided by Beward, no any docs or hints. The first thing want to do is to get UART connection. I have found 4-pin socket on board, and it looks like an UART port or something like this.

First of all, some words about “relay module”. It has two ethernet ports and a set of connectors to relays. (image will be posted later)

And main panel inside looks like this: (image will be posted later)

It has two boards, and one has an 4-pin connector: (image will be posted later)

Is it an UART port? No specs for pins, and no idea what it could be. IMHO, this device should have an UART port.

And a lot of questions to Beward about security of this device. To my opinion, it’s not safe, a burglar can connect to ethernet cable his device and get access to private network. Moreover, anybody can open the box, connect to this port and do something bad.

At the moment I want to explorer this device more thoroughly. The first goal is to get console access, and I hope UART is enabled. I tried to contact Beward support, but they do not provide any docs.

#2

I’m new user and can’t post more than one image at once. Sorry.

This is how 4-pin connector looks like:

photo_2018-12-04_18-26-26
photo_2018-12-04_18-26-261280Ă—640 83 KB

#3

SoC: Hi3518

photo_2018-12-05_03-39-55
photo_2018-12-05_03-39-55640Ă—1280 213 KB

Looks like that 4-pin connector is not UART, no idea what is it. :frowning:

And no idea where UART port is located…

#4

Show another side of panel

#5

Good news, I’ve got UART working, but now it’s time for soldering.

Here is back side:

photo_2018-12-06_16-44-13
photo_2018-12-06_16-44-13640Ă—1280 163 KB

#6

Pins (from left to right on my pic): RX, unknown, gnd, unknown.

It was not easy to detect TX, next comment about it.

#7

photo_2018-12-06_16-48-13

Left (small) red arrow points to TX, upper pin of R52.

R29 is absent, and definitely it looks like some kind of “protection” (from fair users).

#8

Hi,

Seems like the second pin (from left to right) should be TX, but the vendor could lock it for input (software lock like “0 seconds delay” for bootloader, or hardware lock when the track to processor damaged), to be sure that it isn’t the hardware lock, try to measure voltage between ground and the second pin, it should be around 3v and will not be constant.

#9

No voltage on second pin, yeah. It looks to be damaged, so the only way to connect to TX is soldering to R52.

Last right pin is connected to R29, which does not exist. :slight_smile:

#10

Have got root access but have lost bootargs (no backup, as usual :()

Now it’s time to restore partition table, it will take some time.

1 Like
#11

Sounds good, perfect.
Good luck.

#12

don’t forget: you should start from 3 volts, not 5.

#13

Have spent a lot of time to restore original firmware.

Current stage:

  • DS05MP UART, will solder today TX a small connector. It looks like Beward service guys use only RX connector to enter uboot and upload new firmware from “secret” IP with tftp.
  • Got root access and set my password.
  • Have working firmware dump.

Next goal is to get working OpenWRT :slight_smile:

#14
  1. OpenWRT (from RAM) working — DONE.
  2. Some troubles with network. eth0 interface looks to be up and working, but no RX. :confused:
#15

Hi,

try to unlock telnet via new original firmware and use telnet for working with the device.

#16

Beward does not allow ssh/telnet, they hate their advanced customers. :slight_smile:

Moreover, I do not want to use their ugly firmware, it does not have features I need.

I’ve got eth0 working and now I’m going to get sensor working. It will take a couple of days for my to do this.

#17

Usually it takes more than several days to start capturing video.

What sensor and chipset is there?

#18

DS05M has imx138, but I sent it as a gift to guy from telegram group. :slight_smile: Will be working on Bewards together!

I’ve got DS06M and it has imx225, but guys from telegram group say it will work like imx222.

The problem is that I can’t solder small part to get UART working. Will try to do it these days, but my soldering guy is on holidays.

#19

Just visit any phone repairing service, they will solder it.

#20

Hello,
I have Beward DS05M door camera unit. I would like to get access to the OS so I can schedule daily restart of the OS to eliminate random connection loss.
Do you know the root password? thank you