Poking around an Ademco RapidEye Multi
Written 2011-09-25
Tags:VxWorks teardown CCTV FAT CCCKC Ademco RapidEye DVR
The Ademco RapidEye Multi is a small CCTV DVR, serving the same purpose as the Pelco. As it turns out, this hardware is quite different from Pelco's. The Ademco uses a Pentium-I desktop, wrapped with a custom housing and interface boards.
The unit is also running Wind River VxWorks. Since we all know a Pentium cannot simultaneously compress 8 different video streams, this card contains the extra horsepower. It also has a small wire running to the motherboard's reset line.
The unit also has a modem and two serial ports. If you attach a cable to the second port, you can interrupt the boot sequence to change settings like the IP address. Use 8-N-1, 9600 baud. You'll need to press enter quickly to block the boot-up sequence. Here's an example capture:
AVAILABLE COMMANDS DESCRIPTION ? This command list q Quit; Start Application; Run OS shell on console cls Clear Screen ver Display Product Version show Show all parameter values= Set LAN parameter, e.g., 'ip = 172.25.2.1' 'gateway = 172.25.100.1' 'netmask = 255.255.0.0' Set PPP parameter, e.g., 'local = 172.26.2.1' 'host = 172.26.200.1' 'comport = port1' (options are 'none', 'port1', 'port2', or 'internal') 'timeout = 60' (timeout may be between 0 and 999 seconds) 'baudrate = 9600' (options are 9600, 19200, 38400, 57600, 115200) 'modem prefix = at' 'modem init = z' 'modem dial = D' recover Recover system to the previous version. Enter a command, or '?' for help: ver Rapid Eye MULTI Configuration Shell Version 3.2 Copyright 1999-2000, Ademco Enter a command, or '?' for help: show Current LAN Settings: ip = 10.174.8.64 gateway = 10.174.8.1 netmask = 255.255.254.0 Current PPP Settings: local = 172.26.2.1 host = 172.26.200.1 comport = internal timeout = 60 baudrate = 115200 modem prefix = AT modem init = Z modem dial = D Enter a command, or '?' for help: q Configuration Shell Stopped... Attached TCP/IP interface to eeE
I also imaged the disk. The disk is split into two partitions. The first is a 2GB FAT containing VxWorks. The second is a partition listed as 'free space', but actually holds the video data. Here's the file list:
. ./streadir.dat ./STARTUP ./VERSION ./eventdup.dat ./JAV308.O ./system.log ./JAV306.O ./VXWORKS ./EVENTDIR.DAT ./TEMP ./KALATEL.O ./blockdir.dat ./PPPWAIT ./DAU ./storage.cfg ./streadup.dat ./alarmdir.dat ./PPPINIT ./PELCO_P.O ./MANUF ./serialid ./alarmdup.dat ./eventcol.dat ./SECURITY ./BOOTROM.SYS ./MTC ./MTC/SECURITY ./MTC/USR.INI ./MTC/LUCENT.INI ./MTC/config ./MTC/cfgdup ./GPOSTATE ./DELTA.O ./storage.csv ./CONTEXT ./PELCO_D.O ./DSH2 ./config ./DSHUNLD ./cfgdup
More photos are available here: http://www.flickr.com/photos/40925843@N03/sets/72157627615155249/