0x01. 摄像头卡刷初体验

最近研究了手上一台摄像头的sd卡刷机功能，该摄像头只支持fat32格式的sd卡，所以需要先把sd卡格式化为fat32，另外微软把fat32限制了最大容量32G，所以也只能用不大于32G的sd卡来刷机。

这里使用32G的sd卡来刷

win10格式化sd卡命令，X是sd卡所在磁盘名。

format /FS:FAT32 X:

准备就绪，将固件直FIRMWARE.bin放SD卡根目录下， 长按reset键刷机。

但是后面发现并未成功，刷完后成砖了，摄像头未能正常启动，此时刷入的还是正常固件，还未做任何篡改，却直接刷成砖，确实有点出师不利，一时间不知哪个环节出了问题。

T 
IPL xxx
D-15
HW Reset
SPI 54M
IPL_CUST xxxx
MXP found at 0x0000f000
offset:00010000
XZ decomp_size=0x0004a19c
U-Boot 2015.01
WARNING: Caches not enabled
MMC:   MStar SD/MMC: 0
SF: Detected nor0 with total size 8 MiB
gpio debug MHal_GPIO_Pad_Set:603
gpio debug MHal_GPIO_Pad_Set:603
In:    serial
Out:   serial
Err:   serial
Net:   MAC Address E0:EF:02:88:AD:26
Auto-Negotiation...
Link Status Speed:100 Full-duplex:1
sstar_emac
gpio debug MHal_GPIO_Pad_Set:603
ddrsize 64
mtd_num 5, flash_size 0x00800000(8M)
To run up...
Using sstar_emac device
TFTP from server 192.168.1.99;
 our IP address is 192.168.1.10
Filename 'update.bin'.
Load address: 0x21000000
Loading: T T T T T T T T T T 
Retry count exceeded; starting again
Using sstar_emac device
TFTP from server 192.168.1.99;
our IP address is 192.168.1.10
Filename 'update.bin'.
Load address: 0x21000000
Loading: T T T T T T T T T T

T 
IPL xxx
D-15
HW Reset
SPI 54M
IPL_CUST xxxx
U-Boot 2015.01
WARNING: Caches not enabled
MMC:   MStar SD/MMC: 0
SF: Detected nor0 with total
size 8 MiB
gpio debug MHal_GPIO_Pad_Set:603
In:    serial
Out:   serial
Err:   serial
Auto-Negotiation...
sstar_emac
SF: Detected nor0 with total
size 8 MiB
Erasing SPI flash..._spi_flash_erase:
 addr 0x30000,
len 0x10000 100%(cost 248 ms)
Writing to
SPI flash..._spi_flash_write
to 0x30000,
len 0x10000 from
 0x23b01870 100%(cost 169 ms)
done
ddrsize 64
mtd_num 5,
flash_size 0x00800000(8M)
To run up...
Using sstar_emac device
TFTP from server 192.168.1.99;
our IP address is 192.168.1.10
Filename 'update.bin'.
Load address: 0x21000000
Loading:
T #################################################
###################################################
#####################################################
#####################################################
#####################################################
#####################################################
#####################################################
#####################################################
#####################################################
##############
         237.3 KiB/s
doneBytes transferred =
7114336 (6c8e60 hex)
head_crc32 9ba634e1
 crc32 9ba634e1
MXIC REMS: 0xC2,0x16
SF: Detected nor0 with
total size 8 MiB
...
...
SF:
1507328 bytes @ 0x40000
Written: OK
head_crc32 4d5121d7 crc32 4d5121d7
...
...
Erasing SPI flash..._spi_flash_erase:
 addr 0x30000,
 len 0x10000 100%(cost 255 ms)
Writing to
SPI flash..._spi_flash_write
to 0x30000,
len 0x10000
from 0x23b018d0 100%(cost 175 ms)
done
resetting ...
##  Booting kernel
 from Legacy Image at 21000000 ...
Image Name:MVX4##I6B0xxxxxxxx
Image Type:
ARM Linux Kernel
 Image (lzma compressed)
   Data Size:1494344 Bytes = 1.4 MiB
   Load Address: 20008000
   Entry Point:  20008000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... 
[XZ] !!!reserved 0x21000000
 length=0x 1000000 for xz!!
   XZ: uncompressed size=0x2e2000,
ret=7
OK
Starting kernel ...

make menuconfig

make busybox-menuconfig

sudo mksquashfs ./squashfs-root/
out.fs -comp xz -b 64K -noappend

dd if=out.fs of=target.bin
conv=notrunc
bs=1 seek=1494600

if=out.fs
表示输入文件为 out.fs。
of=target.bin
表示输出文件为 target.bin。
conv=notrunc
表示不截断输出文件，
即保留输出文件中的原有内容。
bs=1 表示每次读写一个字节。
seek=1494600
表示在输出文件中的偏移 1494600 处开始写入，
这就相当于将输入文件
拼接到输出文件的偏移 1494600 处