May
6

IP Cam Hacking – pt#6

Lawrence Sheed // 6 May 2010 // 122 Comments

I’ve uploaded a zip of my built test image here. I’ve only included telnetd, and ftpd, as the sshd binary is very large, and won’t fit into our rom image space!

If someone is willing to test, feel free.

Test Rom with FTPD and TELNETD binaries added

This rom is 700k+- vs the normal 550kb. So this may / may not overwrite the web ui.

As China’s firewall is being particularly obnoxious this week as to what I can view on the web, I can’t actually get to the info I need to see where they typically write the UI to in rom.

In theory, we should be able to write to the same base address via the boot loader.

The original rom is written here -

Image: 6 name:romfs.img base:0×7F0E0000 size:0×0008D000 exec:0×7F0E0000 -a

And I’m pretty sure that the UI gets written somewhere after this, and not as a separate image. I’d have to run Windows and a sniffer to test this though (using their firmware update software).

Our boot logs show that linux blkmem driver is set to view the whole area from 0×7F0E0000 through to 0x7F16D3FF, so we should easily have 200kb to waste^Hplay with.

From my boot logs:

Blkmem 1 disk images:
0: 7F0E0000-7F16D3FF [VIRTUAL 7F0E0000-7F16D3FF] (RO)

Obstensibly, this should be a matter of going to the bootloader over serial, then uploading our img file.
Suggest rename from testrom.img to romfs.img to be consistent.

It should be something like this:

bootloader > del 6
(delete the current romfs.img)

bootloader > fx 6 romfs.img 0x7f0e0000 0x7f0e0000 -a
Waiting for download
Press Ctrl-x to cancel … (while it waits, you have to select Transfer > Send File in Hyperterminal menu, choose the Xmodem protocol and select my rom image)
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Flash programming …

bootloader> boot

Then see what happens in the logs.

It should boot, then attempt to run telnetd and ftpd.
That probably WON’T work just yet, as they’ll complain about missing /etc/ config files.

You might also be missing the UI (as I think this gets written somewhere after our romfs.img in flash)

Send me the serial logs in the comments, and I can fix that up, and repackage.

I also know why the alleged clones (NB they’re not f..king clones sigh, they’re all made by 1 manufacturer here for different people, including FOSCAM) don’t work. The linux.bin for older firmware is set to boot from 0x7f0D0000 as opposed to 0x7f0e0000, so image 6 and 7 both need to be reflashed.

Also of note is that the newer units have gone cheaper, and use 2M flash, previous units had 4M.
uCLinux reports 8M, but its not talking about Flash, just RAM

Be prepared to brick (not completely, as we have a bootloader, and can reflash the original firmware) if it doesn’t work.

If my rom above doesn’t work initially for you, try flashing this linux.zip before reverting, and see if that helps it boot.

eg
bootloader> del 7


bootloader> fx 7 linux.zip 0x7f020000 0x8000 -acxz

Waiting for download

Press Ctrl-x to cancel ...  (while it waits, you have to select Transfer > Send File in Hyperterminal menu, choose the Xmodem protocol and select my linux.zip)

CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

Flash programming ...

bootloader> fx 6 romfs.img 0x7f0e0000 0x7f0e0000 -a Waiting for download Press Ctrl-x to cancel ... (while it waits, you have to select Transfer > Send File in Hyperterminal menu, choose the Xmodem protocol and select my rom image) CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC Flash programming ...

Why aren’t I doing this?

Mostly as I don’t currently have a good serial connection, I’m waiting on headers. Currently I have to hold the serial ports onto the board with fingers, and thats less than reliable!

I should get around to fixing that soonish though, I’m interested in testing this myself…

I’d also appreciate the French contingent adding some info. I’m particularly interested in paillassou’s board photos, and any other firmware people have found for these so I can compare.

I can’t get to Picasa, GadgetVictims, IrishJesus now in China. Grrr.

Yes, I know, use a VPN or proxy… Unfortunately what we do precludes doing so, as I’d probably get told off by our beloved government here, and thats not worth the risk…

Comments please.

May 6, 2010 // IP Cam // 122 Comments // Tags: arm7, debian, foscam, howto, nc745, nuvoton, uclinux

122 Comments to “IP Cam Hacking – pt#6”

Ramon says:

January 8, 2011 at 8:42 am

Maybe I have found a solution!! I hope that my tool is going to work, will keep you posted:
http://blog.morrison.nl/2011/01/foscam-clone-recovery-tool/

Reply
dominique says:

January 8, 2011 at 3:36 pm

Hi and happy new year !
here : http://www.nuvoton.com/hq/enu/ProductAndSales/ProductLines/IndustrialIC/ARMMicrocontroller/ARMMicrocontroller/Pages/default.aspx
They write that there is 2 sdk for the nuc745 :
Normal release : uClinux 2.4.20
Conditional release : uClinux 2.6.9
I presume the first one is the one we use, but what about the second?
Do you know something about it Lawrence?
I’ve never found somthing usefull concerning 2.6 kernel for our NUC745 boards…

Reply
Ramon says:

January 12, 2011 at 6:57 am

I have no idea what is happening!! I have completed a dump from a working camera, the linux.zip file seems to be ok because I can unzip it and I get a linux.bin file, the romfs.img I can’t verfy because I don’t have any reference. I have flashed the firmware from a working camera onto the bricked device… and STILL the device keeps rebooting!!! These are the last lines:

set brightness 100
set contrast 4
set sharpness 3
set mode 0
__pthread_initial_thread_bos:35c000
manage pid:16
2
2
2
2
2
2
audio_dev.state not AU_STATE_RECORDING
wb_audio_start_record
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth0
[29]
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
myreboot

I have 2 bricked camera’s both with the same result, so it is not a hardware failure!

I really am out of options now

Reply
Ramon says:

January 14, 2011 at 10:29 pm

I have zipped my tool and posted it here:
http://blog.morrison.nl/2011/01/foscam-clone-recovery-part-2/

It doesn’t work for my, but maybe for others

Reply
Robert says:

January 16, 2011 at 8:20 pm

Hi Everybody !

Pls help me.
I’m still looking for a working dump for my camera ….

Text On my PCB: IPCAM_PT2_V3.3f_sc

http://rftech.hu/IPCAM/myPCB.jpg
http://rftech.hu/IPCAM/Log

Relay clicks ON, after OFF, and reboot

If sdy has the same (and it’s still working)
pls make a full dump with Ramon’s tool
maybe it can help me.

Thanks in advance!

Robert

Reply
Pinuccio says:

February 16, 2011 at 6:34 pm

Hope this can help someone :

I am a newby and found very interesting this forum.I also have a bricked Foscam clone camera,
and tried to restore romfs.img and linux.zip files taken from the archive called “IP607_Final” with the updated memory addresses .Everything has gone OK,but during the rebooting of the camera,I get this error:”ntpc.c can not resolve ip address time…ecc,ecc”.Of course IPCAMERA_tool does not find the camera via the ethernet port (or wireless).Also pressing reset button does not fix. So I ask :where is my error ? Also tried to re-flashing the 2 files.Thanks

Reply
- jos says:
  
  February 26, 2011 at 12:49 am
  
  hi
  
  i have the same problem. i bought the exact same cam and restored the images from that cam to the broken one but still the same error. img 0 it size says 0×00000048 and on the correct one its 0×00000038 also the size of the img7 is deferent on the working cam its 0x000aaa18 and on the broken one its 0x000aaa00
  
  is the flash borken or what is the problem??
  
  thx
  
  Reply
  - Lawrence Sheed says:
    
    February 26, 2011 at 11:48 am
    
    user error is the problem..
    go to openipcam.com and ask me there for help, have moved discussions on this topic there.
    
    Reply
miriam says:

April 15, 2011 at 5:12 pm

Hello
I need linux.zip and romfs.img to restore my cam. I had try maygion file but not working, somebody can help me??? i see over my cam and see this IPCAM_PT2_v3.3F_sc. I make a mistake after upgrade firmware
i have try too romfs.img and receive the i2c error error please help me!!

Reply
- Robert says:
  
  July 6, 2011 at 11:20 pm
  
  Try the latest Apexis J011 FW (sth like this 17.22.2.36)
  It’s to big, so u won’t be able to upload any WebUI, but
  the IP Cam Tool will see your camera.
  
  Then u should use the tool and upload one of them
  Apexis J011 FW 0.11.1.46 WebUI 18.6.3.12
  or
  Heden FW 0.23.2.18 WebUI 0.3.2.5
  
  Reply