[FH8852V200] Hikvision DS-2CD1043G0-IUF — Hardware Profile, Architecture Question, and Test Hardware Offer

[byfaruk]

hese are GK7205V200 dumps mislabeled as FH8852V200. Flagging this so others don't get misled.

---

What I Cannot Do (Constraints)

1. Cannot dump flash from running stock firmware (psh has no cat/dd/nc/redirect; U-Boot has no sf/md/tftpput).
2. Cannot escape psh to /bin/sh (redirect/psx-redirect don't work; sandbox needs admin password but device isn't activated).
3. Cannot bypass U-Boot bootargs filter (init=/bin/sh stripped before bootm).
4. Cannot brute-force debug command's challenge-response without Hikvision's signing key.

What I Can Provide

• Full UART access (3.3V CH340G adapter, 115200 baud)
• Hikvision psh shell access — willing to run any commands you suggest
• Full dmesg, U-Boot environment, process list, MTD layout (above)
• Full 16 MB SPI NOR flash dump via CH341A (programmer + SOIC-8 clip arriving in 3-5 days). Will publish publicly.
• Image sensor identification from dump strings
• Functional testing of OpenIPC firmware once architecture is confirmed
• Willing to brick this device for development; once CH341A is here, recovery is easy

---

Specific Questions for the OpenIPC Team

1. CPU architecture: Is FH8852V200's main CPU actually ARM, or CK810/C-SKY? My stock dmesg says CK810 revision 7 but your build is unambiguously ARM. Has anyone successfully booted the current openipc.fh8852v200-nor-lite.tgz on real hardware?

2. Is openipc.fh8852v200-nor-lite.tgz (2026-04-24) functional or placeholder? Has any FH8852V200 device booted it?

3. Expected flash partition layout for OpenIPC FH8852V200. What offsets do you expect for boot/env/kernel/rootfs? Does OpenIPC reformat my Hikvision 7-partition layout to a simpler 4-partition layout?

4. Installation procedure for HKVS U-Boot. With no sf/tftpboot/md commands available, how do I actually flash OpenIPC?

   • Replace HKVS U-Boot via updateb first? If so, do you have an OpenIPC U-Boot binary for FH8852V200?
   • Or flash kernel+rootfs into existing partitions, keeping HKVS U-Boot? Will <sbal_seboot> reject the unsigned OpenIPC kernel?

5. Sensor support in current build. Which image sensors are integrated in openipc.fh8852v200-nor-lite.tgz? My device's sensor is unknown — will report after CH341A dump.

6. Highest-impact contribution. Given my willingness to test (and brick if needed):

   • Wait for CH341A → publish dump → coordinate?
   • Flash current build and report results?
   • Try other approaches?

7. OpenIPC U-Boot for FH8852V200. Does one exist? Where? How is it flashed (given HKVS lockdown)?

8. rtthread_arc_FH885xV200.bin. What does this ARC coprocessor firmware do? Is it required for OpenIPC to function?

---

My Test Setup

• USB-TTL adapter: CH340G, 3.3V, 115200 8N1
• UART pin mapping verified by multimeter
• PC IP: 192.168.1.70 (Windows, Tftpd64 ready)
• Camera IP: 192.168.1.69 (U-Boot default, not yet activated)
• Linux server available for hosting binaries if needed
• CH341A 1.8V/3.3V SPI programmer + SOIC-8 clip: ordered, ETA 3-5 days

---

Summary

I'm building a video surveillance platform and want to migrate Hikvision cameras to OpenIPC for better long-term integration. Happy to dedicate this DS-2CD1043G0-IUF as a test platform for FH8852V200 OpenIPC development.

Specific asks:

• ARM vs CK810/C-SKY confirmation
• Any existing notes on flashing OpenIPC to Hikvision FH8852V200 devices (even unsuccessful attempts)
• Pointers to OpenIPC U-Boot binary if one exists
• Any tests you'd like me to run via psh or U-Boot before committing to flash

Thanks for the great work on OpenIPC!

---

Appendix A: Full stock dmesg (key excerpts)

[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 4.9.129 (root@CI-HZV-FRONTEND-SLAVE-71-99) (gcc version 6.5.0 (arm_multilib_uclibc_20200924)) #1 Thu Oct 19 11:24:38 CST 2023
[ 0.000000] CPU: CK810 revision 7
[ 0.000000] CPU: VIPT aliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine: FH885xV200
[ 0.098239] boot_media = 1, hik_flash_size = 0x1000000
[ 1.853328] m25p80 spi0.0: found xm25qh128c, expected m25p80
[ 1.853360] m25p80 spi0.0: xm25qh128c (16384 Kbytes)
[ 1.860193] Creating 7 MTD partitions on "spi0.0":
[ 1.860210] 0x000000000000-0x000000060000 : "bld"
[ 1.861418] 0x000000060000-0x000000070000 : "env"
[ 1.862578] 0x000000070000-0x000000080000 : "enc"
[ 1.863743] 0x000000080000-0x000000090000 : "sysflg"
[ 1.864922] 0x000000090000-0x0000003c0000 : "sys0"
[ 1.866177] 0x0000003e0000-0x000000f20000 : "app0"
[ 1.867342] 0x000000f20000-0x000001000000 : "cfg0"
[ 2.294526] eth0: PHY ID 00441400 at 0 IRQ -1 (0:00) active
[ 9.058706] hikcore: module license 'Proprietary' taints kernel.
[ 9.060080] initialized an41908a
[28.964569] [VMM] version: V1.0.2.P94, build: 2022-11-01
[29.121527] [XBUS] version: V1.0.2.P94, build: 2022-11-01
[29.723256] func: motor_module_init, successful to initialize motor!
[35.571786] Chipid is 0x56

Appendix B: References

• OpenIPC FH8852V200 SoC page: https://openipc.org/cameras/vendors/fullhan/socs/fh8852v200
• OpenIPC firmware release: https://github.com/OpenIPC/firmware/releases/tag/latest
• IPCamTalk IPCE_R_E8 thread: https://ipcamtalk.com/threads/ipce_r_e8-fw.60263/
• C-SKY architecture (kernel mainline): https://lwn.net/Articles/771126/
• Fullhan FH8852V200 product: http://www.fullhan.com/en/index.php?c=article&id=420

[byfaruk]

OpenIPC flash failed on Hikvision DS-2CD1043G0-IUF (FH8852V200) — Root Cause
Attempt:
Flashed OpenIPC firmware (fullflash_202206161629_BY25Q64AS_8MB_FH8852V200_OpenIPC.bin) to a Hikvision DS-2CD1043G0-IUF (Fullhan FH8852V200 SoC, V5.7.21).

Result:
Boot halted at:

ROM: Use nor flash.
ROM: Init cipher.
ROM: 215
Root cause:
Hikvision blows the secure-boot eFuse at the factory. The FH8852V200 BootROM verifies the first-stage bootloader's RSA-2048 signature against an OEM public-key hash burned into OTP fuses. OpenIPC's u-boot is unsigned — the BootROM rejected it with error code 215 (signature verification failed) and halted with no fallback path (no USB DFU, no UART recovery).

Why it can't be fixed:

The Hikvision RSA private key is not public (no known leak in 8+ years).
The OTP fuses are one-way; the public-key hash cannot be replaced.
OpenIPC works only on non-Hikvision FH8852V200 modules (Vatilon, Asecam, RevoTech) where the eFuse is left open at factory.
Even bypassing RSA wouldn't help: the SoC runs CK810 (C-SKY), but current OpenIPC FH8852V200 builds target ARM — architecture mismatch.
Conclusion:
OpenIPC cannot run on Hikvision-branded FH8852V200 cameras due to hardware-enforced secure boot. The device must be used with stock Hikvision firmware.

[byfaruk]

Hikvision DS-2CD1043G0-IUF (FH8852V200) — OpenIPC install attempt blocked

Hardware

• Model: Hikvision DS-2CD1043G0-IUF (4MP IR bullet, motorized lens)
• Firmware: V5.7.21 build 231213 (baseline_E8)
• SoC: Fullhan FH8852V200, CPU: CK810 rev 7 (C-SKY ISA, NOT ARM)
• DRAM: 128 MB, Flash: 16 MB SPI NOR (XMC XM25QH128C)
• chip_id: 0x56, MAC: 04:03:12:63:47:32

What works

• UART access (TX=29, RX=28, GND=30, VCC=27 @ 115200)
• HKVS U-Boot prompt reachable
• Hikvision psh debug shell reachable from Linux (no auth needed)

HKVS U-Boot is locked down

Available: update updateb upbs upm upf erase format loadk bootm setenv saveenv printenv ping
Missing (stripped by Hikvision): sf, tftpboot, tftpput, mw.b, md, cp, nand, mmc
Standard OpenIPC TFTP install procedure (sf probe, tftpboot, sf write) cannot run.

What update* commands want

• update → file: digicap.dav, load: 0xa2000000
• updateb → file: u-boot_e8.bin, load: 0xa2000000
• upm → file: mImage_e8, load: 0xa0007fc0

All do AES decrypt (white-box) + SHA verify + RSA signature check via <sbal_seboot>.
Wrong/unsigned images are rejected cleanly — no brick on bad input.

Tried & failed

• TFTP'd OpenIPC uImage.fh8852v200 as mImage_e8 via upm
  Result: download OK (1508840 bytes), then check revision error
• redirect / psx-redirect from psh shell — no /bin/sh drop
• sandbox from psh — asks for admin password (device not activated)
• U-Boot init=/bin/sh injection — stripped before kernel boot
• Boot args forcibly overridden by HKVS

OpenIPC official status (FH8852V200)

• openipc.fh8852v200-nor-lite.tgz exists (2026-04-24 release, 5.87 MB, ARM EABI5)
• BUT: official page says "installation instructions are not yet ready"
• No OpenIPC U-Boot binary published for FH8852V200
• ARM build vs CK810 stock dmesg — architecture status unclear

MTD layout (16 MB)

mtd0 bld 0x000000-0x060000 (384 KB) U-Boot
mtd1 env 0x060000-0x070000 (64 KB) env
mtd2 enc 0x070000-0x080000 (64 KB) encryption keys
mtd3 sysflg 0x080000-0x090000 (64 KB) system flags
mtd4 sys0 0x090000-0x3c0000 (3.18 MB) kernel (mImage)
mtd5 app0 0x3e0000-0xf20000 (12.3 MB) rootfs/app
mtd6 cfg0 0xf20000-0x1000000 (896 KB) config (JFFS2)

Why I'm stuck

1. HKVS secure boot (RSA-signed) rejects unsigned OpenIPC kernel
2. mImage format is Hikvision-proprietary (header + AES + signature + revision check)
3. HKVS has no raw flash commands; only Hikvision-wrapped formats accepted
4. No OpenIPC FH8852V200 U-Boot binary available publicly
5. CPU architecture conflict: dmesg says CK810 (C-SKY), OpenIPC build is ARM

Questions for the community

• Has anyone successfully booted OpenIPC on a real FH8852V200 device?
• Is FH8852V200's main CPU actually ARM, or CK810? Stock dmesg vs OpenIPC build conflict.
• Anyone has the OpenIPC U-Boot binary for FH8852V200? Or know the build target?
• Anyone reverse-engineered Hikvision's mImage format / check revision logic?
• Is CH341A + flash dump + manual image construction the only viable path right now?

Will share my full 16 MB flash dump (CH341A arriving in a few days) once I have it,
to help future OpenIPC FH8852V200 development.
@ZigFisher @flyrouter

[RATMANrush]

Hi, I have a different camera with the same FH8852V200 SoC but different hardware:

Hardware:

• Camera: Hikvision DS-2CD1043G2-IU
• SoC: FH8852V200 (ARM, not CK810)
• Sensor: GC4653
• Flash: 8MB XM25QH64A
• RAM: 64MB

Current status with openipc.fh8852v200-nor-lite.tgz:

• Kernel boots successfully ✅
• Network works, SSH accessible ✅
• CHIP: UNKNOWN in dmesg (kernel doesn't recognize chip revision)
• ipcinfo -v returns "fullhan" ✅
• ipcinfo -s returns empty (no sensor detected)

Problem:
S70vendor script calls load_unknown (from ipcinfo -v) but only /usr/bin/load_fullhan exists. Fixed with overlay symlink.

load_fullhan runs insmod xbus_rpc.ko fn=/lib/firmware/rtthread_arc_FH885xV200.bin fa=0xbff80000 which causes kernel panic and system freeze.

Without xbus_rpc: system boots, SSH works, but majestic segfaults immediately when trying to initialize ISP/sensor.

Question: Is there a correct fa= address for xbus_rpc on this hardware revision? Or is rtthread_arc_FH885xV200.bin required for majestic to work at all?

Happy to test and provide any additional logs.

[RATMANrush]

Update: With mem=32M kernel parameter, system boots successfully, SSH works,
all vendor modules load correctly (vmm, xbus_rpc, media_process, isp, vpu, enc, jpeg).

However majestic segfaults immediately after "Using gc4653 sensor":

04:26:31 INFO [sdk] start_sdk@1556: Using gc4653 sensor
Segmentation fault

lsmod shows all modules loaded. xbus_rpc loads ARC firmware successfully:
Xbus: fwver=7a9372ed,phyaddr=bfffe000,len=8192

Key finding: mem=32M is required - with mem=64M kernel overlaps VMM memory
region (0xA2000000) causing kernel panic.

Is there a known fix for majestic segfault on FH8852V200 with gc4653?

[RATMANrush]

Update 2 (latest findings):

Further debugging with original Hikvision firmware (restore.bin) analysis:

Original Hikvision autorun.sh uses:

• VMM: mmz=anonymous,0,0xa5000000,63M (for 64MB RAM)
• VMM: mmz=anonymous,0,0xa2800000,23M (for <64MB RAM)
• xbus_rpc: fa=0xbff80000 (same as OpenIPC)
• Sensor GC4653 on /dev/i2c-0, address 0x52
• GPIO13 for sensor reset, GPIO29 for IR LED

With correct VMM address (0xa5000000,63M) and mem=32M:

• All modules load correctly
• xbus_rpc: Xbus: fwver=7a9372ed,phyaddr=bfffe000,len=8192 ✅
• /proc/driver/clock shows cis_clk_out: 24000000HZ (MCLK OK) ✅
• BUT mipi_wrap_gate: 0HZ (MIPI not initialized) ❌
• GC4653 not detected on any i2c bus (0,1,2) ❌
• majestic segfaults at start_sdk before MIPI/sensor initialization

Conclusion: majestic crashes before initializing MIPI interface.
Sensor is never reached via i2c. This appears to be a majestic
bug specific to FH8852V200 ARM revision.

gc4653_mipi_attr.hex differs between Hikvision and OpenIPC builds
(different md5sum). Replacing with Hikvision version does not help.

Is majestic for fh8852v200 actively maintained?
Any chance of a fix for MIPI initialization on this SoC revision?

[RATMANrush]

Update 3 (final findings):

Tested with mem=16M + vmm mmz=anonymous,0,0xA2000000,32M:

• Same result, majestic segfaults at start_sdk
• 22 second delay before crash (i2c timeout trying to reach sensor)
• MIPI wrap stays at 0Hz throughout
• No kernel errors in dmesg - pure userspace segfault in majestic binary

The majestic binary for fh8852v200 appears to have hardcoded
memory assumptions incompatible with this ARM revision.

Is there any chance of a recompile/fix of majestic for this SoC?
Or is there a way to run majestic with debug symbols to get
a proper stack trace at crash point?

Confirmed: majestic binary is ARM (ELF 32-bit ARM, e_machine=0x28).
Architecture mismatch is NOT the issue.
Problem is in Fullhan SDK blobs with hardcoded memory addresses
incompatible with this specific chip revision (CHIP: UNKNOWN in dmesg).

[RATMANrush]

Update 4 (root cause found via strace):

Using strace -ff to trace all threads, found two unknown syscalls:

• syscall_389: called once after loading libadvapi.so, returns errno 22 (EINVAL)
• syscall_403: called multiple times during SDK init, returns errno 38 (ENOSYS)

Stack overflow at guard page 0x66c000 (si_addr=0x66c014) causes SIGSEGV.

These syscalls exist in original Hikvision kernel but NOT in OpenIPC kernel 4.9.129.
syscall_389 appears to be a custom Fullhan syscall used by libadvapi.so
for SDK initialization.

Without these custom syscalls in the kernel, majestic SDK
cannot initialize properly and crashes with stack overflow.

Fix required: Add syscall 389 and 403 to OpenIPC kernel for FH8852V200,
OR provide information about what these syscalls do so we can
patch the kernel ourselves.

Original Hikvision kernel is stored on separate flash partition
and not accessible via restore.bin dump.

[RATMANrush]

Root cause confirmed via strace:

• syscall 389 (called from libadvapi.so) = EINVAL
• syscall 403 (called during SDK thread init) = ENOSYS

Original Hikvision kernel was overwritten during OpenIPC installation.
Only solution: add dummy syscalls 389 and 403 to OpenIPC kernel for FH8852V200.

Can you add these to the kernel build? Or provide kernel sources
so we can compile ourselves?

strace logs available if needed.

[flyrouter]

Good afternoon
Thank you for your interest in our project.
Unfortunately, at the moment, research on Fullhan processors is not our main priority.
All requested and available components can be found in the repositories on GitHub.
https://github.com/OpenIPC/linux