Flussonic

Novatek SoC (NV98515)

IP camera Reolink RLC-410-5MP. SoC is Novatek NV98515.

UART works fine (found it quickly), root access without passwrd.

Any information about this manufacter?

Here is some information from U-boot.

U-Boot 2014.07 (Jun 07 2018 - 16:00:39)

Welcome to uboot
DRAM:  59 MiB
MMC:   NVT_MMC0: 0
Using default environment

In:    serial
Out:   serial
Err:   serial
SPI:   id =  0xc2 0x20 0x18 0xc2 0x00
Use default table
MX25L12835F with page size 256 Bytes, erase size 64 KiB, total 16 MiB
Firmware name: FW98515A.bin FW98515T.bin FW98515A.ext.bin  
nvt_detect_fw_tbin Boot from flash
Open SD fail: No SD device? 
=>run cmd : sf read 3cff000 10000 1000
SF: 4096 bytes @ 0x10000 Read: OK
Find MODELEXT at flash
pinmux init
iocfg init
intdir init
Reset_para:2500
Hit any key to stop autoboot:  0 
NA51023>

help:

NA51023> help
?       - alias for 'help'
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
env     - environment handling commands
eth_init- ethernet init
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
go      - start application at address 'addr'
help    - print command description/usage
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mw      - memory write (fill)
nm      - memory modify (constant address)
nvt_boot- To do nvt platform boot init.
nvt_bootd- nvt_bootd     - Loading dsp and boot dsp (Without Linux). 

nvt_booti- nvt_booti     - Loading itron and boot itron (Without Linux).

nvt_bootm- nvt_bootm     - bootm Linux.

nvt_update_all- To Update all-in-one image from memory address and size

ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
setenv  - set environment variables
sf      - SPI flash sub-system
tftpboot- boot image via network using TFTP protocol
version - print monitor, compiler and linker version

Most important feature: no commands to save spi dump or tftp it :slight_smile:

printenv:

NA51023> printenv
baudrate=115200
bootargs=earlyprintk console=ttyS0,115200 rootwait rootfstype=squashfs ro  mtdparts=spi_nor.0:0x10000@0x0(loader),0x10000@0x10000(ext),0x3a0000@0x20000(uitron),0x50000@0x3c0000(uboot),0x10000@0x410000(uenv),0x2c0000@0x420000(linux),0x840000@0x6e0000(rootfs),0xc0000@0xf20000(para),0x20000@0xfe0000(sp),0x1000000@0x0(all)  root=/dev/mtdblock6 
bootcmd=nvt_boot;nvt_bootm
bootdelay=1
ethaddr=0a:0b:0c:0d:0e:01
gatewayip=192.168.1.254
hostname=soclnx
ipaddr=192.168.1.99
mtdids=sf0=spi_nor.0
mtdparts=mtdparts=spi_nor.0:0x10000@0x0(loader),0x10000@0x10000(ext),0x3a0000@0x20000(uitron),0x50000@0x3c0000(uboot),0x10000@0x410000(uenv),0x2c0000@0x420000(linux),0x840000@0x6e0000(rootfs),0xc0000@0xf20000(para),0x20000@0xfe0000(sp),0x1000000@0x0(all)
netmask=255.255.255.0
serverip=192.168.1.11
stderr=serial
stdin=serial
stdout=serial

Environment size: 876/8188 bytes

Almost no information about this SoC :frowning:

can you dump here firmware?

please let me know how to access the serial port, where are the pins located on the camera pcb? many thanks.

On my Reolink cam it has been already soldered, 4-pin connector. I postd in OpenIPC telegram group how it looks on my camera:

I’ve found more detailed information about this cam at github

1 Like