ICP Permit
Webmail
Newsletters
Support6
IP Cam Hacking – pt#6
I’ve uploaded a zip of my built test image here. I’ve only included telnetd, and ftpd, as the sshd binary is very large, and won’t fit into our rom image space!
If someone is willing to test, feel free.
Test Rom with FTPD and TELNETD binaries added
This rom is 700k+- vs the normal 550kb. So this may / may not overwrite the web ui.
As China’s firewall is being particularly obnoxious this week as to what I can view on the web, I can’t actually get to the info I need to see where they typically write the UI to in rom.
In theory, we should be able to write to the same base address via the boot loader.
The original rom is written here -
Image: 6 name:romfs.img base:0×7F0E0000 size:0×0008D000 exec:0×7F0E0000 -a
And I’m pretty sure that the UI gets written somewhere after this, and not as a separate image. I’d have to run Windows and a sniffer to test this though (using their firmware update software).
Our boot logs show that linux blkmem driver is set to view the whole area from 0×7F0E0000 through to 0x7F16D3FF, so we should easily have 200kb to waste^Hplay with.
From my boot logs:
Blkmem 1 disk images:
0: 7F0E0000-7F16D3FF [VIRTUAL 7F0E0000-7F16D3FF] (RO)
Obstensibly, this should be a matter of going to the bootloader over serial, then uploading our img file.
Suggest rename from testrom.img to romfs.img to be consistent.
It should be something like this:
bootloader > del 6
(delete the current romfs.img)
bootloader > fx 6 romfs.img 0x7f0e0000 0x7f0e0000 -a
Waiting for download
Press Ctrl-x to cancel … (while it waits, you have to select Transfer > Send File in Hyperterminal menu, choose the Xmodem protocol and select my rom image)
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Flash programming …
bootloader> boot
Then see what happens in the logs.
It should boot, then attempt to run telnetd and ftpd.
That probably WON’T work just yet, as they’ll complain about missing /etc/ config files.
You might also be missing the UI (as I think this gets written somewhere after our romfs.img in flash)
Send me the serial logs in the comments, and I can fix that up, and repackage.
I also know why the alleged clones (NB they’re not f..king clones sigh, they’re all made by 1 manufacturer here for different people, including FOSCAM) don’t work. The linux.bin for older firmware is set to boot from 0x7f0D0000 as opposed to 0x7f0e0000, so image 6 and 7 both need to be reflashed.
Also of note is that the newer units have gone cheaper, and use 2M flash, previous units had 4M.
uCLinux reports 8M, but its not talking about Flash, just RAM
Be prepared to brick (not completely, as we have a bootloader, and can reflash the original firmware) if it doesn’t work.
If my rom above doesn’t work initially for you, try flashing this linux.zip before reverting, and see if that helps it boot.
eg
bootloader> del 7
bootloader> fx 7 linux.zip 0x7f020000 0x8000 -acxz
Waiting for download
Press Ctrl-x to cancel ... (while it waits, you have to select Transfer > Send File in Hyperterminal menu, choose the Xmodem protocol and select my linux.zip)
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Flash programming ...
bootloader> fx 6 romfs.img 0x7f0e0000 0x7f0e0000 -a
Waiting for download
Press Ctrl-x to cancel ... (while it waits, you have to select Transfer > Send File in Hyperterminal menu, choose the Xmodem protocol and select my rom image)
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Flash programming ...
Why aren’t I doing this?
Mostly as I don’t currently have a good serial connection, I’m waiting on headers. Currently I have to hold the serial ports onto the board with fingers, and thats less than reliable!
I should get around to fixing that soonish though, I’m interested in testing this myself…
I’d also appreciate the French contingent adding some info. I’m particularly interested in paillassou’s board photos, and any other firmware people have found for these so I can compare.
I can’t get to Picasa, GadgetVictims, IrishJesus now in China. Grrr.
Yes, I know, use a VPN or proxy… Unfortunately what we do precludes doing so, as I’d probably get told off by our beloved government here, and thats not worth the risk…
Comments please.
Do you like this article? Share It!
122 Comments to “IP Cam Hacking – pt#6”
Post comment
Archives
- May 2012
- April 2012
- March 2012
- December 2011
- November 2011
- October 2011
- September 2011
- July 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- October 2010
- September 2010
- August 2010
- July 2010
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
Categories
- Apple
- Arcade Machines
- Badges
- BMW
- China Related
- Cool Hunting
- Exploits
- Firmware
- Food
- General Talk
- government
- IP Cam
- iPhone
- Lasers
- legislation
- MODx
- MySQL
- requirements
- Reviews
- Service Issues
- Tao Bao
- Technical Mumbo Jumbo
- Things that will get me censored
- Travel
- Uncategorized
- Useful Info
Most Popular Posts
- Samsung N310 (Samsung Go) Hackintosh Installation on Snow Leopard (11712)
- IPCam Hacking - pt#2 (9303)
- eFrontWPI - Wordpress integration Plugin for eFront (7577)
- BMW Keys and Transponders E36 E38 E46 etc (EWS2) (7131)
- IP Cam Hacking – pt#5 (6178)
Tags
Recent Comments
-
HenryX: If you have any problems about motocycle , I can answer you. I am a local Shanghaier with a 5 years’...
-
Johnny E: Hi Lawrence.. i have a 1999 Bmw E46 320i, i had to change the engine because it was broken, and now i...
-
Lawrence Sheed: Zoneminder is a video monitoring capture system. I have an IP Camera pointed at the entrance, and...
-
Shaun Wallace: That is pretty cool, and cheap too! I may order one thanks to your recommendation. What is zone...
-
Hector: My country doesn’t require a license for MOPEDS & no highway sticker. Liability and the cost of...
Recent Trackbacks
- eFront Blog: 5 things you (perhaps) don’t know about eFront
- SISTEMAS O.R.P: Recuperar una cámara Zaapa CIP-RW después de un fallo de actualización
- Blog - DO Bots: Brookstone Rover AC13
- How can I stop Pop3 Brute Force attacks: need to create a regex, and add it to fail2ban Here is a guide....
- shanghailoz is our latest member! -:
PHOTOSTREAM
It’s good to see things progressing. As I recall (which means little) tftp is smaller than regular ftp and has some security.
I really wish I had a camera I could experiment on(: I interpret part of your post as a request for the cameras that have the same (or similar) hardware. Such a list would help me a lot here in Mexico. There are several cameras that seem to be the same, but I don’t have enough money to just go out and buy at random.
OTOH: maybe I will try harder to get IP606 imported from the US via UPS.
Ray
No, don’t really need the hardware, I’m interested in photos of the other units (as others have taken photos already), and / or firmware images from other “clones” to compare with.
Again, the clones aren’t really clones, they’re all made by one manufacturer, and the reseller sticks their branding on them. Typical OEM product really.
I could be wrong though, although the factory is pretty believable when they say they they make all of them.
Oh yes, if you need copies of posts on Jesus…. let me know. But not much has been happening.
Ray
Lawrence, I was able to reconfirm the PK bit about the image. Everything is pretty vanilla. Didn’t find time to actually write any code today, but hopefully will tomorrow. Downloaded your firmware, but after reading your notes, and realizing I didn’t have physical access to the camera, decided not to press my luck.
Incidentally, we’re both linked on that slashdot post about camera’s.
http://hardware.slashdot.org/comments.pl?sid=1642252&cid=32107366
Woohoo, my first reference in a slashdot comment.
Sweet on the slashdot references. So, I hacked up some code to extract the core firmware today. Pretty simple, once you figured out the PKzip stuff. I still need to write the packer, but as I’m sure you’ve figured out, its dumb-stupid.
It was your comment about trying that that inspired me to do it anyway. Once I had the zip file out, the rest was easy.
Plus, the documentation is reasonably good for all of this, so its not like we’re working completely in the dark.
Kudos to you though for doing the coding parts. I never have the patience to do that unless I really need to.
Lawrence,
Hadn’t stopped by in a few weeks, and things have been slow on my end too– too much damn work as of late; but I digress. After recovering my camera, I got in a little trouble with the Mrs. and I’m a bit hesitant to risk bricking the camera again. Hoping that I can buy a new one for my own amusement, but its not looking like anytime soon.
Similar, I’ve been busy on other things, and I’ve been distracted by other, more fun projects (eg, my soon to be blogged about Projector)
I have a dev laptop setup again running Mint 9 on a T60 with a gorgeous IPS high res screen, although I still need to redo the environment, but I do have a need for it again, so will be plunging back in soon.
I was pretty much there though – I had everything running, was just mop-up work really, then plunge into working on a camera app.
Famous last words
Hey…has anyone seen my ” round tuit “..??
Lost again.
Guess what I did today, I accidentally deleted …….
0 name:BOOT INFO base:0×7F010000 size:0×00000038 exec:0×7F010000 -af
Question is…..will it still reboot with fx 6 & 7 loaded and/or will it recreate 0 on the reboot?
Dam……if I want to try a reboot without knowing, but my gut says it won’t create 0 but will reboot….., worst case I would think I would need to jump start it.
Or should I connect a cable to my other cam and d/l 0 image first is the million $$$ question???
Later
I guess I should warn all what I did wrong….that would be nice right….!!
Well stupid me typed del without any prams.
It did exactly what it was supposed to do.
DEL every image, including 0 boot info.
Del -all doesn’t vaporize 0 boot info.
Del DOES..!!
Would have been nice to know that tidbit of info.
Honestly, haven’t tried that myself
Still, you can always redo the boot loader using a JTAG device. Pinouts are labelled reasonably clearly.
Wiggler or similar isn’t that expensive. Play with fire, better have more matches…
Instructions on that here –
http://www.wiki.kslemb.com/doku.php/uboot/install
and more uboot stuff here – http://www.stlinux.com/u-boot/target-install
and more here – http://docs.blackfin.uclinux.org/doku.php?id=bootloaders:u-boot:loading
The BSP for Nuvoton also has fairly decent instructions on rebuilding it.
Are you 100% sure that you’ve erased the uBoot ?
Any serial at all? Or just completely dodo’d when you power up over serial.
Hello Lawrence
Thank you very much for the comment in the yellow frame
I’m not a firmware specialist
but your work about that IP CAM is wonderful …
Best Regards
Bye
Paillassou
Hi Paillassou,
Can you send me a copy of your photos of your board?
Unfortunately in China Picasa is blocked, as are lots of other photo/file sharing sites.
I’d like to see if your hardware is the same.
Thanks,
Hello,
I have killed my camera by Foscam firmware and tried every firmware that I have found on the internet but no one works. After initial “rotation” the camera process everytime initiate a command “myreboot” which reboots the device and starts booting again in a loop.
So, I’m planning to buy a second same one to recover this one but is there any way to dump the firmware from it?
Thank you!
myreboot usually comes up for reboot on init if the camera hardware isn’t found.
Are you sure you have all the header cables plugged in firmly?
Do you have serial access? If so, try writing both the firmware files to rom 6, 7.
Also make sure that your hardware is the same. There seem to be at least 2 variations on flash size – newer units use less.
Its possible to dump the firmware, should be doable from the bootloader. If not, can whip something up in user land to do so.
Can you send me the firmware files you’ve found? I want to take a look at a couple to see the differences. Cheers!
Yes, I have serial access and flashing firmware through the bootloader.
I will collect firmwares (and put them online) which I have when I arrive home from work.
Anyway, I’m extracting firmware files from bin file which is used to be uploaded through web interface (splitting bin into linux.zip and romfs.img using HEX editor).
My progress can be seen at http://www.gadgetvictims.com/2009/12/bring-your-fi8908w-paperweight-back-to.html
I’m not alone with “myreboot” problem as you can see from the posts on GadgetVictims.
My suggestion is that the “camera” process needs exact response from hardware (camera/tilt motors) and if it don’t get, it tries to reboot for “recovery” (and yes, I have connected all wires and connectors from camera/motors).
I’ve been playing with bootloader yesterday but only thing that can display (“dump”) contents from memory is “D” command. It is possible to “dump” memory through it by hand but it is very time consuming work.
I’m planning to collect every piece of firmware and information about this camera after I succesfully recover mine to help people with Foscam and mainly its clones to bring them back from dead.
IntEx
Unfortunately the gadgetvictims blog is blocked in China, so not much use to me.
If the hardware is borked though, not really much you can do, aside from taking Camera out of init.
I’m looking at breaking the software out into discrete functions – eg http server, capture, and then normal unix binaries for things like ftp etc, that makes more sense, and makes it more functional. Going to be a while before I get to that stage though.
Can you take a photo of your board at least (both sides), so I can check the hardware is at least the same.
I don’t think that the camera hardware is broken because I’m not alone whose camera acting same.
I will post photos of my camera board asap.
BTW: To access blocked sites, you can try free proxy services like http://www.hidemyass.com
So, I have created a small repository of mine collected firmwares at http://ipcam.intexcz.net and uploaded there photos of my camera PCB’s…
thank you for the upload of the firmware i have got my ipcam up and running thanks guys i think my camera is the same as lawrence and i have the web ui back on thanks again
Yesss!!!
I’ve finally managed to get my camera working thanks to EasyNP camera firmware (added to my repository) provided by Jasper (@GadgetVictims).
So there were no problems with hardware, just some difference in “camera” process.
Now I will try to do a research for splitting “camera” into partial services like “httpd”, “dhcpd”, …
IntEx
there you go guys a serial log with the two files linux file and the test file
thanks dave have alook at the bottomof the file about the do_files
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009nux) (gcc version 3.0) #953 ÈÕ 8ÔÂ 16kmem copyright 1998 Kenneth Albanows
Memory Size is 0×1000000 Bytes, Flash Size is 0×200000 Bytes
Blkmem 1 dis
Processor: Winbond W90N745 revision 1
Board designed by Winbond
0: 7F
Architecture: W90N
Hardware support provided at Winbondtalpages: 2048
Copyright (c) Winbond Limited 2001 – 2006. All rights reserved.tered.
zone(2): 0 pages.
01 eth0 in
Kernel comm
Boot Loader Configuration: Maver
PPP g
MAC Address : 00:30:10:C1:D0:39MIPS006. A
Me
IP Address : 0.0.0.0o capt
Page-cache hash table entries:
Press ESC to enter debug mode …
IP
usb-ohci.c
bootloader > ls4
POSIX conform
Image: 0 name:BOOT INFO base:0x7F010000 size:0×00000038 exec:0x7F010000 -afinux 2.4oked to run file
Based upon Swansea University Computer S
Image: 7 name:linux.zip base:0x7F020000 size:0x000BCB80 exec:0×00008000 -acalizing RT netlink socketnone /pro
Starting
no support
usb.
Memory Size is 0×1000000 Bytes, Flash Size is 0×200000 Bytesfff80100 (irq = 10) is a W90N7451ad command
Board designed by Winbond Driver has been installe
Hardware support provided at Winbond
Blkmem cop
Copyright (c) Winbond Limited 2001 – 2006. All rights reserved.&39.83 B
Blkmem copyright 1998 Kenneth Albanowski0]
usb.c:
Boot Loader Configuration:Blkmem 1 disk images:ix288
MAC Address : 00:30:10:C1:D0:390E0000-7F16CFFF] (RO)
IP Address : 0.0.0.0B Flash Detected
DHCP Client k!P
TC
Serial Number : 0xFFFFFFFFat membase 0xfff05000, IRQ 15
For help on the available commands type ‘h’
new U
usb-ohci.c: AMD756 erratum 4 wor
Press ESC to enter debug mode ……
hc_resetnted roo
usb.c: new
Cache enabled!ered, assigned
Processing image 1 …
Processing image 2 …b.c: USB hub foundin
Processing image 3 … 2 ports detected
Processing image 4 …c: registered new driv
Processing image 5 …dex.htm8,1999 D.
au
Processing image 6 … Class driver
Processing image 7 …ra reg
usb.c: register
Unzip image 7 …al
Executing i
Wait
ZD121
zone(1): 2048 pages.te…OKmmon.c(97): s
zone(2): 0 pages.stered new driver
Kernel command line: root=/dev/rom0 rw
main_usb.c: VIA Networking Wirel
Calibrating delay loop… 39.83 BogoMIPSr version 2.
us
Memory: 8MB = 8MB totaler vntwusb4error: Oops:
Memory: 6272KB available (1447K code, 284K data, 40K init)
CPU: 05 revi
dvm usb cam driver 0.0.0.0
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes) 3aintedializatio
usb.c: registered new driver dvm 0ll
Inode cache hash table entries: 512 (order: 0, 4096for sonix288 b
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options eunt -t ramfs none /var/run
Board designed by Winb
Command: mount -
nabled none
ttyS00 at 0xfff80100 (irq = 10) is a W90N7451 mount -t ramfs none /flashopyright (c) Winbo
I2C Bus Driver has been installed successfully.home
Command:
Blkmem copyright 1998,1999 D. Jeff Dionneh
Sash command shell (version
Blkmem copyright 1998 Kenneth Albanowski
/> no support
hub.c: conne
Blkmem 1 disk images:rt 1 disabled
0: 7F0E0000-7F1A0BFF [VIRTUAL 7F0E0000-7F1A0BFF] (RO) :807dce04-7e8640
hub.
AM29LV160DB Flash Detecteded address 2
01 eth0 initial ok! B
dvm cmos
which:0ully in
PPP generic driver version 2.4.2
dvm camera registered
Linux video capture interface: v1.00
new USB device :807cf204-7e8640a
Winbond Audio Driver v1.0 Initialization successfully, assigned addrterface
usb.c: new USB bus registered, assigned bus number 1_thread_bos:340000mage 4 …
P
hub.c: USB hub found
audio_dev.st
hub.c: 2 ports detectedNG
usb.c: registered new driver audiocordge 7 …
inet_sr.
audio.c: v1.0.0:USB Audio Class driverLin
action===12.4.20-uc0
options==33ic
usb.c: registered new driver serialÔÂ 16
*args===
usbserial.c: USB Serial Driver core v1.4rgs===netmask3:09 CST 2009
*args===eth
_____ ____ _ ____ can not resolve ntpserver(t
|__ / _| _ \ / \ / ___|ure: W90N745
/ / | | | | | |/ _ \ \___ \esolve ntp
IP: routing cache hash table of 512 buckets, 4Kbytespc.c: can not resolve ntpserver(time.nist.gov)’s ipe
TCP: Hash tables configured (established 512 bind 1024)c.c: can not resolve ntpserver(time.nist.gov)’s ip
VFS: Mounted root (romfs filesystem) readonly.
ntpc.c: can not resolve ntpserver(time.nist.
Freeing init memory: 40Kserial options en
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0×4)me.nist.gov)’s ip
abled
ttyS00 at 0xff
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0×4)erver(time.nist.gov)’s ipsion 1.0 (2005-08-15) wi
Shell invoked to run file: /bin/init can not resolve ntpserver(time.nist
Command: mount -t proc none /proced
ttyS00 at 0xfff80100
ntp
Command: mount -t ramfs none /usre.nist.gov)’s ip
Command: mount -t ramfs none /swapu
ntpc.c: can not resolve ntpserve
Command: mount -t ramfs none /var/runight 1998,1999 D. Jeff Dionne
Command: mount -t ramfs none /
sh 1: Child 9 died
ntpc.c:
[9] no
Command: telnetd&r(time.nist.gov)’
[10]
Command: ftpd&
Linux
telnetd: getpeername: Socket operation on non-socket(time.nist.gov)’s ipnd Audio Driver v1.0 Initializat
ÿýÿý ÿý#ÿý’[11]
ntpc.c: c
Command:solve nt
Command: sh.nist.gov)’
Sash command shell (version 1.1.1)
ntpc.c: can
/> hub.c: connect-debounce failed, port 1 disabled
: USB OHCI at memba
ntpc.c
new USB device :807dce04-7e8640.nist.gov)’s ip
hc_alloc
hub.c: new USB device 1, assigned address 2: can not resolve ntpserver(time.nist.gov)’
dvm cmos successfully initialized new USB bus registered
ntpc.c: c
dvm camera registered as v
1e
1i
1.
1v
1s
1p
set resolution 4__ ____ _
set brightness 100
ntpc.c: can not
set contrast 4er(time.nist.g
2
2
2
2
2
2
audio_dev.state not AU_STATE_RECORDING
wb_audio_start_record
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth0
[32]
ntpc adjust ok
do_file: can not find file favicon.ico
do_file: can not find file favicon.ico
do_file: can not find file index.htm
ntpc adjust ok
do_file: can not find file index.php
ntpc adjust ok
Your flow control isn’t set correctly, so the output is a bit mangled, but I can at least see the binaries compiled ok.
Thats good
telnetd is complaining about sockets – I may need to configure as per ucLinux specifically – it might need some ./configure options for that – will look at that
later.Ok, I need to recompile telnetd with the following config options:
CONFIG_USER_TELNETD_TELNETD=y
CONFIG_USER_TELNETD_DOES_NOT_USE_OPENPTY=y
CONFIG_USER_TELNET_TELNET=y
Plus I also need to setup inetd as follows, and build inetd also.
/etc/inetd.conf
ftp stream tcp nowait root /bin/ftpd -l
telnet stream tcp nowait root /bin/telnetd
—
Can you nmap the ip that the device is working on, or telnet / ftp to the device, and see if telnetd or ftpd are up at all, on the off chance that despite me missing some basics they are listening?
I might also build the web ui into the firmware – I have the files, might be easier to mount within the main rom, rather than directly written over the tail end of the romfs structure (which is how they do it).
Looks good though – its doing what its supposed to, which is a good first step.
Would be better if it was working properly, but at least I know what I need to do for the second build
hi i have try to telenet with putty but can get a response and ftp but nothing i will get the flow control right later thanks dave
Is there any documentation for the camera module itself somewhere? Photos, mfr/model#, maybe even a datasheet? I’ve seen quite a few pics of the controller board, but haven’t found anything related to the camera itself yet.
My own personal interest is figuring out whether it might be possible to independently enable IR mode while turning off the IR LEDs themselves (so a camera like the 8909W could be pointed out a window and make use of an outdoor IR light source on the other side, instead of blinding itself with the reflection of its own LEDs the way it does now). Assuming the LEDs aren’t hardwired directly to the camera module itself and controlled by it, I’m guessing that the camera’s IR sensitivity is probably set via I2C, and the IR LEDs’ power state is probably determined by whether or not a GPIO line on the controller board is high or low.
Camera MC is allegedly a SONIX SN9C288
aka Sonix 288
Haven’t checked the Sensor yet. Probably a Micron K14 or similar.
Couldn’t find a datasheet online, but the 235 is similar I’d think:
SN9C235 Features:
- USB Video Class / Audio Class (MIC Array) Compliant
- Build-in 2ch Digital MIC Interface
- Support up to 2M Pixel Image Sensor
- ISP on YUV Domain, Noise Reduction
- Support YUY2 & MJPEG
- Support up to 15fps @ 1.3M, 30fps @ VGA for PC Mode Video
- Support Lens Roll-Off Correction and G1G2 Smooth Filter
- Support Sensor Pixel Offset Compensation
- Support Snap-Shot, Hot-Key, Rotation & LED Indicator
- USB I/F & Microsoft Vista WHQL DTM Certified
- Support C3 Mode and Selective Suspend
- Support OS: Win 2000/XP/Vista (No Driver required for Win
XP SP2 & Vista), Mac, Linux
- Value-Added Software: Special Effects, Digital Zoom & Face
Tracking
- Support Auto Focus(VCM & Stepping Motor), Pan / Tilt Motor
Control for Face Tracking
- Extremely Low Power Consumption < 30mA, Suspend Current
~300uA
- Small Package Size: QFN48-pin (7 x 7mm) / VFBGA ( 5 x 5mm)
I would have to take the top apart to get to it, but if you *really* want the details, I can.
Hello everybody
is there a way to DUMP or retreive the actual firmware (dump.bin)
include into the FOSCAM FI8908W’s chip ?
ie with a reader RS232 ?
Yes, easily within the bootloader (although you’ll need to reparse slightly to rebuilt it), or via the terminal.
No point though, we have all the firmware anyway from our flash file.
Firmware discussion is in one of the posts I wrote about, plus in IrishJesus’s blog.
Hello
After i change lan dns server camera reboot and the i take this error:
Processing image 1 …
Processing image 2 …
Processing image 3 …
Processing image 4 …
Processing image 5 …
Processing image 6 …
Processing image 7 …
Unzip image 7 …
ERROR: unzip failed! -3
I have upload the linux.zip and romfs.img again but same error
I have del -all but again the same error.
Any idea ?
Thanks
means your file is not correct format.
Suggest use the linux.zip file supplied, and make sure that the start point in the rom is correct.
Check the other posts for how to query the bootloader for the current settings.
Make sure that the flash sizes are correct for your hardware.
There are a few different hardware revisions out there with differing flash sizes (2M, 4M…) as well as different load points in different firmwares.
Find out what hardware flash size you have and match images appropriately.
eg if image > 2M and your flash is only 2M, its not right for your device!
Hi ,
Every linux.zip file that i have upload make the same error.With you linux.zip 2 days before evything work perfect but after i change dns server i have this error .How can i change the start point in the rom ?.
When i upload linux.zip as linux.img unzip then the camera they dont take the error but there is no space for romfs.img
Thanks
just typed this in command with the serial cd /home ls -l
but how do i copy files fromthe serial foscam to my pc ?
thanks dave
VFS: Mounted root (ro
-rw-r–r– 1 0 0 4109 Jan 01 1970 admin_content.htm test_mail.htmmory: 40Kess : 00:30:10:C
BINFMT_FLAT: bad magic/r
-rw-r–r– 1 0 0 2034 Jan 1330
dvm camera registered as video0
Proces
Mem: 1476198
drwx—— 1 0 0 0 Jan 01 1970 englishb.c: new USB devic
-rw-r–r– 1 0 0 804 Jan 01 1970 index1.htm
-rw-r–r– 1 0 0 3661 Jan 01 1970 ip.htm
-rw-r–r– 1 0 0 293 Jan 01 1970 live.htm
-rw-r–r– 1 0 0 826 Jan 01 1970 log.htm
-rw-r–r– 1 0 0 2004 Jan 01 1970 login.htm
-rw-r–r– 1 0 0 4449 Jan 01 1970 mail.htm
-rw-r–r– 1 0 0 42433 Jan 01 1970 monitor.htm
-rw-r–r– 1 0 0 15639 Jan 01 1970 multidev.htm
-rw-r–r– 1 0 0 1778 Jan 01 1970 public.js
-rw-r–r– 1 0 0 909 Jan 01 1970 reboot.htm
-rw-r–r– 1 0 0 164 Jan 01 1970 rebootme.htm
-rw-r–r– 1 0 0 613 Jan 01 1970 serverpush.htm
drwx—— 1 0 0 0 Jan 01 1970 simple_chinese
-rw-r–r– 1 0 0 490 Jan 01 1970 snapshot.htm
-rw-r–r– 1 0 0 5240 Jan 01 1970 status.htm
-rw-r–r– 1 0 0 3620 Jan 01 1970 style.css
-rw-r–r– 1 0 0 1544 Jan 01 1970 test_ftp.htm
-rw-r–r– 1 0 0 1564 Jan 01 1970 test_mail.htm
drwxr-xr-x 1 0 0 0 May 11 16:47 tmp
-rw-r–r– 1 0 0 1330 Jan 01 1970 upgrade.htm
-rw-r–r– 1 0 0 1257 Jan 01 1970 upnp.htm
-rw-r–r– 1 0 0 4615 Jan 01 1970 user.htm
-rw-r–r– 1 0 0 9034 Jan 01 1970 wireless.htm
/home>
just to let you know that i made the tmp file with the mkdir comand
Hi!
Now this may not entirely be on topic but I have a few questions / ideas. I am considering using this camera as the remote WLAN link to a robot. Now I would like to avoid changing camera firmware and picking an easier solution if possible. Otherwise I have a lot learning to do
1. I’ve noticed that there is a /comm_write.cgi function, which sends data through camera serial port. I would like to use this feature to establish communication with my MC so I can send commands to servos etc.
To which port does this cgi write function refer to? Is it the same as for accessing camera firmware?
Is there any already built-in method of receiving serial input from the camera port through http?
2. Would it be possible to attach another camera sensor MC to the existing platform and toggle switch between?
Thanks!
Hello Marko,
I think we are in the same boat. Controlling a robot via the camera, that’s what exactly i’m trying to do. Do you think we need another mc for the robot – as we already have a powerfull mc in the camera itself ? Can the serial port be directly connected to a motor driving circuit with an small modification in the webui to add the robot controls also ?
Let me know what you think
Regards
Thushar
Hi Thushar!
Sorry for late reply. Well, I’m sure the controller in the cam is more than capable of fulfilling the task, but I doubt just modifying webUI would suffice. Don’t know though because I don’t have much tech knowledge in this field… and this is probably my primary reason for adding another MC I am familiar with.
But there is another advantage of using another MC for it is easier to brake out connections for additional servos and sensors. Further on I intend to use additional MC to put camera in offline-sleep-mode so it is completely shut off and started back only by some sort of sensor trigger. Now I know this too could be achieved with the existing MC but I have no clue how to do it and I believe it would require quite some effort to add own code to the existing camera program on MC.
One of my first thoughts before I opened the camera was to use audio link for remote communication.
It is feasable using some sort of AFSK or other audio modulation, it just doesn’t make much sense if it can be done via serial.
One way or another, I believe the most important step is to get PC to talk serial through camera WLAN which should be possible simply by sending cgi command for serial write. Now another question is how to get feedback, serial input from the camera…
Regards
Marko
Hi. I have the ebay foscam clon. Firmware seems to be something different. Here is it if you want to test:
http://liken.otsoa.net/pub/ipcamfirmware.rar
I would like to have a firmware with telnet or ssh.
Some of the clones use different usb wireless cards so the foscam firm will bork on those units.
Actually not, wifi is _not_ mission critical.
eg – The camera binary will reboot if no camera firmware is found, but will work fine if no wifi.
I am very interested in finding a solution to use these cameras without ActiveX. I would like to be able to use the low level functions like the Audio and recording from Google Chrome and Apple Safari. Even if I have to use Internet Explorer (have not used it in years), I do not like the idea of using ActiveX, specially one that is not even signed. Do you guys have a solution for this? I would be willing to contribute some money to develop a browser independant solution.
They come ready to use without ActiveX.
ActiveX is optional.
May be I am doing something wrong as I can only view one camera at a time with other browsers (thru server push mode) and not able to get the audio or recording options. The manufacturer also told me that I can only do those functions using IE with ActiveX hence I was trying to find a hacked version. Please let me know how to do those functions (audio and recording) with the other browsers ( I use Chrome and Safari) and I will be very grateful. Thanks you for your quick response.
Recording, you do off-camera. Eg in zoneminder, or similar software. They poll the image page, and save offsite.
Sound, not sure, I haven’t played with that at all.
Hi guys,
I’m working on the a similar firmware. My cam is a Solwise C1002IR – W and I recompile a kernel and build a custom filesystem. I also dump all the memory on the cam finding a cleartext username and password area.
Now I’m trying to add telnet/ssh with password prompt and a VPN for handling remote camera.
My skype contact is: ‘ontheownz’
Cheers.
I have the complete CGI API and there is a Comm_write.cgi command that work good and I can pass serial data to the jtag port.
What I really need is a way to read serial data from the jtag and showing it on the HTML pages somewhere. This function don’t exist and reading this site and Lawrence Sheed site I starting to believe it is possible.can it? did any one successes to recompile the bin file?
Hello! This is my first post in this blog. A month ago I bought three cameras W90P745 model (from Chinavasion.) Everything worked perfectly until one day a camera stopped working.
The camera turned on, but the green light on the front is not lit, either with the cable or wifi.
I decided to buy the cable and try to come back to life using your method.
I can connect successfully to the camera, I have completed the first two steps:
del 7
del 6
But both the rise of file romfs.img linux.zip as 30% I get a message “General failure” (I select the file and put Xmodem protocol.
That may be happening?
why would you even do that?
if you had working serial it would have been better to see where it was crashing than randomly doing stuff.
that just sounded like a hardware problem, not software. Probably either the camera or the power to the camera has a fault.
Sounds like the flash and processor side is ok though, so just need a new camera (although its a pain to take that top piece apart) to get to that.
Lawrence Sheed, thanks for your quick response. When the camera was broken, the lights flickered network cable just like a camera that worked, the only thing was the green light from the front is not lit. So I thought maybe I could be something wrong with the firmware, since many people had given them similar problems also.
This is the log:
W90P745 Boot Loader [Version 1.1 $ Revision: 1 $] Rebuilt on Dec October 2009
Memory Size is 0×1000000 Bytes, Flash Size is 0×400000 Bytes
Board designed by Winbond
Provided at Winbond Hardware support
Copyright (c) Winbond Limited 2001-2006. All rights reserved.
Boot Loader Configuration:
MAC Address: 00:0 C: 5D: 75:14:83
IP Address: 0.0.0.0
DHCP Client: Enabled
CACHE: Enabled
BL buffer base: 0×00300000
BL buffer size: 0×00100000
Baud Rate: 115 200
USB Interface: Enabled
Serial Number: 0xFFFFFFFF
For help on the available commands type ‘h’
Press ESC to enter debug mode ….
bootloader> 7
ERROR: Image 7 is not exist
bootloader> 6
ERROR: Image 6 is not exist
bootloader> fx 7 0x7f020000 0×8000-acxz linux.zip
Waiting for download
Press Ctrl-x to cancel …
C?
Download error!
bootloader> BB0BB0
There Is something wrong so I agree with you that it is hardware problem, if someone thinks something is welcoming. I’ll have to go to the idea of making me buy a new camera.
First off, do a list of your partitions.
in the boot loader –
ls
If you really have erased all the partitions, you’ll need to see what memory size you have in your unit, and use appropriate firmware.
You’ll need to use xmodem to transfer. Can’t really help you further than that, I’m home in South Africa again, so not doing any dev stuff on the camera till I’m back in China again.
I Can noit connected to cam after RESET! What is my ip by factory ?
It gets an ip address via DHCP, so you need to provide DHCP service on something like a router or similar
hi, Lawrence
in order to have telnetd and/or ftpd working you must change this :
…
mount -t ramfs none /home
camera&
sshd&
telnetd&
ftpd&
sh
to this ==>
…
mount -t ramfs none /home
camera&
inetd&
sh
of course this binaries must be in /bin :
telnetd
ftpd
inetd
I don’t think that it’s the same with sshd…
Thank you very much for your work about the NUC745, now i have a homebrew kernel+romfs with dhcp+telnetd+ftpd+busybox (still missing camera/wifi drivers and some software to broadcast video&sound (motion/V4L?)
Hi Dominique,
Good to see someone taking where I’m at and moving on. I’m finally back in a position to start working on this again as I’m back in Shanghai.
Did my advice work (recap from one of my previous comments):
—————————————–
Ok, I need to recompile telnetd with the following config options:
CONFIG_USER_TELNETD_TELNETD=y
CONFIG_USER_TELNETD_DOES_NOT_USE_OPENPTY=y
CONFIG_USER_TELNET_TELNET=y
Plus I also need to setup inetd as follows, and build inetd also.
/etc/inetd.conf
ftp stream tcp nowait root /bin/ftpd -l
telnet stream tcp nowait root /bin/telnetd
———————————————————-
I got mine running manually via serial, just haven’t built a distributable rom for others (lazyness / work issues)
If i sit down and go over where I was in the next day or two should be able to knock out a rom. I have (had) video working too (grab single frame or video), although i didn’t test properly (single frame grabbed, didn’t check more than that at the time)
Looking through my notes was using V4L2 to grab, so compiling xawtv or vidcat or w3camd or videodog (again from my notes) would work.
I went with videodog as it was the easiest to compile under our BSP tools. xawtv looked like a complete headache..
Also need to stop existing camera executable from hogging video0, but thats obvious..
I was aiming for something like boa + cgi + a few binaries, but wasn’t quite there although i mostly had the bits going.
Given a day or two I should have that all ready though.
Do you want to share your work?
Suggest add me on skype (email me for skype details)
via lawrence AT computersolutions DOT cn
Lawrence,
i did not use your binaries : i have done a kernel and a romfs from scratch with every thing recompiled with :
- eth0 (rj45) working
- sound (? but it should work as the driver is in the sdk)
- wifi = no, no driver and not detected
- video = no, but usb video detected & no driver
and software :
- busybox (almost everything activated)
- dhcpcd = ok (some warnings about readonly files)
- inedt = ok
- ftpd =ok
- telnetd = ok
the last 4 compiled with no change in the source/config (just checked in the make menuconfig / user)
but when i was trying to start manualy telned, the same error occured :
“telnetd: getpeername: Socket operation on non-socket” and then i saw your comment !
The probem stoped when i started inetd manualy (inetd&) or from /etc/init.d/rcS (the startup of the kernel i build is not identical as the camera’s one)
and nothing else !
when you try to connect to the cam with telnet then inetd daemon will start automaticaly telnetd
(the same will occur with ftpd and tftpd).
An yes you have to add /etc/inetd.conf (the one present in the romdisk from the sdk works without change).
As you can see i don’t do it the same way of you (i try to have it all from source),
but now i’m facing problems with the “drivers” part… It’s more difficult now to me,
because it’s not just some “make dep&make” to do (the unique things i have done so far + read your docs and the nuvoton docs)
and i can’t extract the drivers from a “vendors” firmware.
i’m not fluent english and do not use skype (it’s not open…) nor msn …
if you have access to megaupload i can prepare and put in a archive :
my two config file for the nuc700 sdk (kernel & user),
my romdisk directory,
the kernel.zip and romfs.img and a .txt with bootloader flash instructions.
well nothing interesting, just a working kernel with a command line prompt…
Now i will try to :
- let the kernel execute from flash (XIP just for fun)
- supress some busybox links (like init and sh cause they take all the memory)
- find wifi driver (via have open source divers for the usb/wifi, and they are included in the 2.6 kernel branch of uClinux)
- find a driver for the usb camera.
But i will stick on your post, cause i think your way is more possible to achieve and quickly, and with full access of camera functions (PT(z)).
bye
I’m more impressed with where you’re at, I looked at recompiling for 2.6, but decided it was too painful.
Megaupload is blocked here, so no use.
XIP isn’t so useful i think, can’t compress if done that way, and we don’t have that much flash space. I’d say jffs2 would be better..
yes, i agree, xip use a lot of flash but would preserve a lot of ram ?
kernel 2.6 would be a good solution but there is nothing (no patch encountered in the net) for nuc7xx.
just in case the archive of the homebrew kernel :
http://dl.free.fr/jLtE4tIgK
or
http://www.megaupload.com/?d=CODP79XZ
i can post the archive somewhere else if you want
oh, i have found a patch for 2.4 kernel with the usb video driver (spa5xx), i will try to patch the source
Hi Lawrence,
I was wondering how you were able to grab that videoframe?
You write that the camera app needs to be killed, in order to release the device files so videodog can grab the frames.
I have an Apexis J011, which is the copy of the FOSCAM F8908W. Building videodog was no problem. But when I try to kill the camera app by killing one of the processes, the whole family of camera processes go zombie, and the board restarts after around 30 secs. How did you manage that?
I’ve also tried burning a romfs where the camera app is not started by init, but the problem then is that no one initiates the device drivers.
Any suggestions would be most welcome!
@dominique
I’ve also tried to get the VIA VT6656 driver to work, but with no success =(
I managed to compile it under the BSP kernel as a module and to modprobe/insmod it. But how do you get the interface up and running? iwconfig does not show any interface, and wpa_supplicant doesn’t give me any clues either. Do you have any thoughts?
Thanks,
Sima
@sima, i know it’s late, but i just see your message now!
i could not compile the module for the wifi, my kernel can use only ethernet…
If you have the source that compiiles good and the module loading, it must be just a configuration problem. I would be very happy to have/test that wifi module!
here is a link to a kernel.bin and a romfs.img that you can load into memory (you don’t have to flash !!!) with ftpd and telnetd, so we can try out things …
http://www.megaupload.com/?d=RSWWCTGB
@dominique
good to know there are more people that have struggled with it =)
I’ll test your rom images, though I’ve started to think about testing the 2.6 kernel to see if it goes better.
I’d appreciate any advice on that, I have no idea on how 2.4-specific the additional files from Nuvoton are. I’m thinking that the wifi-driver is also written for 2.6 so that won’t cause problems. But there are other Nuvoton-specific files in the linux-source that I don’t know about how 2.4 oriented they are. Can they be moved to 2.6 at all?
Would be nice to have some contact info for quicker conversations =)
If Lawrence is willing to forward my e-mail to you, that would be great.
-Sima
@Sima
I’ve been struggling this summer with 2.6, but i didn’t even been able to compile it for a statndard platform based on the same proc (maybe a bad toolchain).
I think that the ethernet/serial driver are the principal specifics addons on the 2.4 kernel.
I’m very often in http://forum.hardware.fr/ in the very good paillassou’s foscam topic, my pseudo is qdftowner so you can PM me from here if you want…
Lawrence, thanks for writing so much about these cameras! I’m trying to select a camera to use for a very small business project, and I’m not adverse to modifying off the shelf units to fit my needs. I bought one of the 501 IP cameras and an FS-603A IP camera before finding your blog. I’m trying to find an inexpensive IP camera with a CS lens mount, ideally with a high frame rate and progressive scan.
The FS-603A camera is yet another variation of the Foscam unit. No built in PTZ, but it does have an RS422 port that speaks pelco PTZ.
I’m trying to find a way to set the JPEG quality level of the camera. So far, I’ve found no clues, but your info that the camera is actually a USB webcam might be my best lead.
I’ve got a serial cable soldered to mine now, and I’m noticing something interesting occasionally on the console:
Buffer overflow: bad data packets 80150 80000
Buffer overflow: bad data packets 80113 80000
Because of when I see these, I think this message is an indication that a single jpeg frame was bigger than 80000 bytes. That might also explain why there’s no way to adjust the jpeg quality of the image.
Based on what you know about the underlying hardware, how much data do you think the hardware is capable of pushing onto the network? Right now, it seems to be about 600kB/s If I work on building my own firmware, will I be able to exceed that, or will I just be trading frame rate for image quality?
Oh, also, how did you get the firmware images off the camera? The bootloader seems to receive files but not send them, unless I missed something obvious.
Thanks! I’ll be following your blog and Dominique’s efforts eagerly!
Hi Peter,
There are better model cameras that would be more suitable.
NB, the manufacturer is suneye, one of their many clients is Foscam. They do make different revisions of the hardware for peoples needs, but most are the base hardware, as per the “Foscam”. I’d say take a look at the h264 models the NC53x series. Those have more professional lens / hardware inside.
The one i’ve been looking at is quite low end (although excellent value for what you get imho!)
To set jpeg you’d set in the v4l video calls.
Sample (untested) code below:
/*
struct video_picture settings to try (unchecked/untested, from the maverick output)
set resolution 4
set brightness 100
set contrast 4
set sharpness 3
set mode 0
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define WIDTH 320
#define HEIGHT 240
#define V4L_DEVICE "/dev/video0"
int write_jpeg(char *filename,unsigned char *buf,int quality,int width, int height, int gray)
{
struct jpeg_compress_struct cinfo;
struct jpeg_error_mgr jerr;
FILE *fp;
int i;
unsigned char *line;
int line_length;
if (NULL == (fp = fopen(filename,"w")))
{
fprintf(stderr,"grab: can't open %s: %s\n",filename,strerror(errno));
return -1;
}
cinfo.err = jpeg_std_error(&jerr);
jpeg_create_compress(&cinfo);
jpeg_stdio_dest(&cinfo, fp);
cinfo.image_width = width;
cinfo.image_height = height;
cinfo.input_components = gray ? 1: 3;
cinfo.in_color_space = gray ? JCS_GRAYSCALE: JCS_RGB;
jpeg_set_defaults(&cinfo);
jpeg_set_quality(&cinfo, quality, TRUE);
jpeg_start_compress(&cinfo, TRUE);
line_length = gray ? width : width * 3;
for (i = 0, line = buf; i < height; i++, line += line_length)
jpeg_write_scanlines(&cinfo, &line, 1);
jpeg_finish_compress(&(cinfo));
jpeg_destroy_compress(&(cinfo));
fclose(fp);
return 0;
}
main()
{
unsigned char* buf;
int i,j;
int fd;
int re;
struct video_capability vcap;
struct video_channel vc;
struct video_mbuf mbuf;
struct video_mmap mm;
fd = open(V4L_DEVICE, O_RDWR);
if(fd<=0)
{
perror("open");
exit(1);
}
if(ioctl(fd, VIDIOCGCAP, &vcap)<0)
{
perror("VIDIOCGCAP");
exit(1);
}
fprintf(stderr,"Video Capture Device Name : %s\n",vcap.name);
for(i=0;i
vc.channel = i;
if(ioctl(fd, VIDIOCGCHAN, &vc)<0)
{
perror("VIDIOCGCHAN");
exit(1);
}
fprintf(stderr,"Video Source (%d) Name : %s\n",i, vc.name);
}
vc.channel =1;
vc.norm=1;
if(ioctl(fd, VIDIOCSCHAN, &vc) < 0)
{
perror("VIDIOCSCHAN");
exit(1);
}
if(ioctl(fd, VIDIOCGMBUF, &mbuf) < 0)
{
perror("VIDIOCGMBUF");
exit(1);
}
fprintf(stderr,"the frames number is %d\n",mbuf.frames);
buf = (unsigned char*)mmap(0, mbuf.size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
if((int)buf < 0)
{
perror("mmap");
exit(1);
}
mm.frame = 0;
mm.height = HEIGHT;
mm.width = WIDTH;
mm.format = VIDEO_PALETTE_RGB24;
if(ioctl(fd, VIDIOCMCAPTURE, &mm)<0)
{
perror("VIDIOCMCAPTURE");
exit(1);
}
if(ioctl(fd, VIDIOCSYNC, &mm.frame)<0)
{
perror("VIDIOCSYNC");
exit(1);
}
if(-1 == (write_jpeg("./pic001.jpg",buf,75,WIDTH,HEIGHT,0)))
{
printf("write_jpeg error\n");
exit(1);
}
munmap(buf,mbuf.size);
close(fd);
}
I'd also look at the v4l tools to read the camera details. Get those here - http://www.raphnet.net/programmation/v4l_tools/
I'm further along than I thought I'd be, but I do need a kick up the butt to finish this all off
Firmware - if you were really really in need, you could read the flash, or via jtag. I got from the gazillion sites online with firmware though (plus from the manufacturer, although I did agree to non-release for those, so can't give that out).
Cheers,
Lawrence.
I bought a IP Cam from ChinaVasion (Foscam clone IP607) The PCB says: ES_IP607_ARM_2 Without thinking I tried to flash a FOSCAM firmware on it. It is now bricked, I have a RS232 thingy, so I can het into the bootloader and tried different linux.zip and romfs.img files, starting with the obvious one yje “Foscam Clone IP607″ recovery. When I try this one the cam accepts the files, but when it reboots it reports the following:
audio_dev.state not AU_STATE_RECORDING
wb_audio_start_record
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth0
[29]
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
myreboot
And it keeps rebooting.. can anybody please help me recover this cam?
Thank you,
RvBCrS
Looks like you have different video hardware. Suggest try another firmware. One of the people in the comments has a site with different firmware to try.
Hi Lawrence,
Thanks for your quick response, I really screwed up I have 4 of those cams and now 2 serve as paperweight. I have tried all firmwares that I could find on that reposetory, and about every firmware I could find.
Is there any way to dump the firmware of the cams that are still good? so I can flash it to the bricked ones? I have looked at the bootloader “d” command, but can’t really seem to understand how to get the linux.zip and romfs.img from the good cam’s
I really hope you or anyone else can help me.
Thank you,
Ramon
Hi,
I have the same problem as @Ramon, since 1 month when i received my new genuine foscam Ip camera, i try to update it. But when i make my cam reboot, she’s start initialization and reboot just after 10 seconds. Without finish her initialization. I try some tutorials to make my cam back to life but that’s not realy a success. I use one USB adaptator to connect to my cam bootloader. I flash the two part with some recovery pack i found on the net. And now i have that just before the cam reboot :
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth0
[27]
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
myreboot
What can i do?
Thanks
i2c is used for talking to other components on the board.
Its possible you’ve used a different firmware than your board has parts for. Suggest try one of the other firmwares from the links above.
Hi all. I’m trying to identify my cheap chinese ip camera to obtain the latest available firmware, with no result at this time.
The camera pcb is a winbond based board (W90N745CDG) with a davicom ethernet interface (DM916AEP) and a common Via chipset based wi-fi board and Spansion Chip (821FVJ04 is printed on the chip).
On the main side of the pcb I can read “WF-99894V0″ and on the back “yu_IR_V1.0a” with the timestamp “2008-01-30″
The cam has a wifi connection support, an athernet port and two cable for external sensors input.
I spent many hours on google without no valid results, only many interesting blog and sites like this one
.
Someone can help me to find the manufacturer or a reseller to obtain the magic update?
Here three photos of the pcb (sorry, low quality shot with cell phone
)
Entire PCB: http://i.imgur.com/Z6d4O.jpg
Under Wi-Fi card: http://i.imgur.com/saHLz.jpg
Near wifi card: http://i.imgur.com/G4u5E.jpg
You can reply me directly to my email extreman79 AT hotmail DOT com
Tnx!
I’ve Found it !!!!
http://www.netwave.cn is the manufacturer of my board.
I’ve asked for a new firmware and they reply me with the latest firmware revision for my camera! Already flashed and working!
Not a fantastic ip camera.. but ok for basic usage!
Pls could u make a photo of your whole PCB?
And share the files which was given to you by your cam’s manufacturer.
Thanks,
Robert
sorry for the late reply. tomorrow I’ll post the info you requested.
Does anybody have ideai who made the PCB:
IPCAM_PT2_V3.3f_sc
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Dec 10 2009
Memory Size is 0×1000000 Bytes, Flash Size is 0×200000 Bytes
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Dec 10 2009
Memory Size is 0×1000000 Bytes, Flash Size is 0×200000 Bytes
Board designed by Winbond
Same as above. Looking for the correct files for my camera.
The PCB is 541_CPU.PCB
Thanks in advance
I also have the 541pcb version. I have re-flashed images 6 and 7 with every brand files I can find, and cannot un-brick yet. Anyone have the linux.zip and romfs.bin files needed?
I have good cameras and bricked ones. I did notice during the init that the correct images sense 16MB of memory (total), while all the other images give 8MB during the init.
Also, the tables (cashe) are halved with the wrong firmware. (I.E. dentry cache hash entries total 2048 on good image (2, 16K bytes), and only 1024 (1, 8K) for the wrong images.
Is there a way to yank back the image 6 and 7 files? I know the bootloader doesn’t have a “TX” command to compliment the FX command, but wonder if anyone has written a utility to do it?
Thanks,
LLoyd
Are you sure you have 16M of flash memory?
The memory onboard is usually 8M, although you can specific 16M if you need it when ordering in volume.
So, there is firmware for 8M and for 16M flash (which translates to actual sizes of 1M (8M/8) or 2M (16M/8) in bytes) .
The size of the file should make it easy enough to spot.
Don’t forget that the linux.bin boots off of different offsets in different firmware, so you need to pair 6,7 together.
I have always paired the image 6 and image 7 copies, although there are very few that have both linux.zip and romfs.bin. All the one’s I’ve tried failed to init successfully. I am not sure I know how to tell what the load and execution addresses of the images should be without some docs. Some of them have docs accompanying them, others have not.
I have text captures of the init sequence in a good camera and of a bricked one.
Would it be appropriate to transcribe those here?
Again, these are the “541_cpu.pcb” version from “goodstore.2010″ ebay vendor.
Thanks,
LS
Oh… based upon the versions of the distribution software that came with the cameras, It appears this camera is the huiyan version(wifi).
LS
I’ve the same, from the same seller….
Pls tell me, if have any good news.
Robert
I’m real close. I uploaded a (non-working) linux.zip to my bricked camera, then re-extracted it with some tools I wrote. It’s almost right, but diffs from the original zip file by 15 bytes (not at the end, sorry…;)). I’ve obviously mangled it somehow.
I will try again tomorrow. “Real” work comes before play.
LS
OK… progress is good, but slow. I got the linux.zip correctly re-built, and my bricked camera now boots successfully. I have not figured out yet how to get the romfs image to be accepted. It downloads, shows the same execution address and size, but /home ends up empty after “processing image 6″, yet I appear to have a faithful image of what’s in the good camera.
FWIW… the linux bootup declares the correct amount of memory now, and all the networking stuff works. There just aren’t any .cgi files in /home to get my user interface working. The camera talks, though… just doesn’t send vids yet.
LLoyd
romfs is being accepted, and it works properly. I’m lacking the WebUI for this camera now.
If I can locate the /home directory in flash, I think I can extract it, and copy it to the bad camera.
Anybody know its origin?
LLoyd
DONE!
I’m at work until 5pm tomorrow, then I’ll start getting my notes together.
I have successfully un-bricked by 541_cpu.pcb cam from goodstore.2010.
It works! (dang!)
LLoyd
Well done Lloyd !!
It seems that a lot of people are trying to find a solution for this camera, to bring it back to life. Waiting for files and the instructions.
Well done, once more !!
I’ve done the writeup and consolidated all the files necessary. As soon as I find a place to post them (maybe IrishJesus – we’ll see), I’ll let you all know.
LLoyd
Give me an email address, and I’ll send the documentation and binary files.
LLoyd
Can send to Lawrence at computersolutions dot cn
I can’t visit IrishJesus website anymore, as its blocked, but i still get the comments as i’m subscribed to that via email.
I can pop your stuff up in a new post if its interesting for people.
Hi Lawrence;
Thanks fro your comments, they are very usefull information. I have just brick my camera. Is there any possiblity to have files.
my mail zkeskinayhan at g mail com.
Hi !
Great, Hope it will works for me also, cos I’ve only similar PCB I think …
Pls send me files here: vrobert82 at gmail dot com
Thanks in advance !
Robert
Hi LLoyd,
can you please send me a copy of these files to vagkap_at_hotmaildotcom
Thanks in advance
I want Lawrence to look over the method first, see if he can find any holes in it, and perhaps make some recommendations. Then we’ll post them in a conspicuous place. It’s silly for me to be sending personal copies all over when we can just publish and be done.
LLoyd
And you should have them now, Lawrence.
LLoyd
Unfortunatelly it’s not working for me …
If u have time pls check theese…
Text On my PCB: IPCAM_PT2_V3.3f_sc
http://rftech.hu/IPCAM/myPCB.jpg
http://rftech.hu/IPCAM/Log
Relay clicks ON, after OFF, and reboot
If have any idea it would be good…
Thanks in advance!
Robert
Lloyd was kind enough to send me the firmware files (and the instructions) for my bricked Foscam clone, and i was able to bring it back to life. I’ve tried all the other firmwares i could find on the net, but none of them was able to do the job. Only Lloyd’s files were correct for my model.
My FOSCAM Clone has the following info:
————————————————————
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Dec 10 2009
Memory Size is 0×1000000 Bytes, Flash Size is 0×200000 Bytes
Board designed by Winbond
————————————————————-
The PCB is 541_CPU.PCB
Well done Lloyd.
Thank you once more.
Lawrence, your spam blocking on your mail server rejected the .zip file I sent.
LLoyd
I have a brute-force method (I told KyleM it was a “stone axe”) for extracting files from any _good_ foscam clone.
A couple of guys have used the files I got from my 541_CPU.PCB clone with success.
The method is simple and can be duplicated in any programming environment you wish. To keep it dumb-simple, I did it with a Kermit 95 script.
LLoyd
A follow-up. After talking with Kyle at IrishJesus, I realized that one need not know exactly how long the WebUI image is if you want to store it as an invisible (-nofooter) image on your camera. You can just download everything from flash from the beginning of the image to the end of flash, and subsequently upload that same image. If it’s a -nofooter image, it doesn’t really _have_ a recorded length.
LLoyd
Another concept Kyle and I talked about was to go ahead and take the time to extract the _entire_ contents of flash — for analysis in a friendlier environment, like in your Linux or PC system.
When I get geared up to understand the Foscam software, that’s sure the way I will go. It’ll be a lot easier than exploring the stuff with the bootloader, or trying out one variant after another of new kernels that don’t work.
LLoyd
Pretty sure thats what I did months ago Lloyd..
I figured out the firmware file packaging, and mounted the filesystem, and successfully added more binaries, and repacked it. My posts talk about this in detail.
I also talk about the build environment too.
I assume you mean that once you loaded a new kernel into the camera, you were able to do that, right?
From an ignorant perspective, I see the problem being that we can’t all figure out how to build a custom kernel, and your kernel wouldn’t work on my particular camera — probably won’t on a number of others, too.
I was trying to figure out how to do this with _any_ camera, without a custom kernel. Once you have the software “out”, then you might have enough info to know what the kernel needs.
Or maybe it’s just a memory size thing, and all I’d need to do is re-compile your kernel with a couple of different defines.
LLoyd
I didn’t touch the kernel,not much point in doing so, unless you want to rewrite the webcam drivers – those aren’t readily available.
Suggest you look at my notes again.
What I’ve done to date is make my own binaries and grab screenshots off the camera using the video for linux api’s. I can’t give out bits of my work as I’ve signed NDA’s.
OK, now I think you are misunderstanding what I wanted to (and did) accomplish. You already had the packaged Foscam binaries to work with, and after unpacking them (all of this outside the camera), you were able to modify and re-pack them. I saw all that, and Kyle’s Fostar.c, also. It was good work, and information that pushed me along.
But for at least half a dozen other clones, there are NO binaries published, and nothing that is published will run on them. Unless you can access flash and transfer its contents outside the camera, you get no binaries to evaluate and modify.
That’s what my experiment was all about — how to snag copies of the binaries from an undocumented, unsupported camera.
With some help from your experiences, and from Kyle, it worked.
What you did is exactly what I will be doing, also, except I think I’ve found some docs on the camera drivers, as well. The USB, MAC, and Ethernet chip drivers are well-documented.
LLoyd
Lawrence, to give you the credit you deserve, I did re-read everything. You and I are working for the same final goal, but with different needs.
At least from the comments here, it would appear that everything you did started with existing binaries.
I have not yet picked apart my binaries, but I started with none, and nabbed them from a good camera.
There have been a number of requests here for that ability — talking about capturing stuff from the JTAG port. But you _know_ how long it would take to bootloader “d” yourself through an entire image.
That’s all this is about.
Now I have to build a machine to install RedHat 8. I had one, and it ended up being a CNC milling machine controller, so I have to build another.
LLoyd
No no no lloyd kudos! Just saying take a look at some of the stuff I’ve done should save time. Why repeat same stuff. Sorry for wrong impression!
Well, thanks. I’m all for saving work. It’s better to stand on one-anothers’ shoulders than to climb alone.
Indeed, it’s been almost two decades since I’ve coded the first line of C or built a kernel, so I have a great deal of re-learning to do. The last version of Linux I did any _serious_ work on was Slackware (if that tells you anything).
LLoyd
A friend just purchased a newer 8918W. I’ve asked him to extract the recovery binaries from it, so they’ll be available.
These will be nice for me to experiment on, because this will be the first time I have both the authentic Foscam files and the extracted files (from the same camera) to compare to one-another.
LLoyd
@Robert or anyone knows…
I have a similiar pcb, IPCAM_PT2_V2.3a.
Did you find a suitable firmware for this camera? (and the producer??)
i want to try some firmware, but i didnt well understand how to extract the complete firmware from the camera, to save it before made my camera a paperweight.
Hi !
Pls try to get in contact with Lloyd, and maybe he can tell
u what and how to do. It would be great if u can make a
working dump from ur cam…. It may help a lot of people
to get their cam back alive.
Pls let me know if u have any news!
Thanks in advance!
W.B.R.,
Robert
@Federico Boldori
Pls get in contact with Ramon, maybe he can help u to dump
your working camera (maybe dump file help me also….).
the firmware files are missing. Then I have decided that I want to compile my own ftpd, or even tftp, or tftpd…but I get errors while compilling
What I would like to create it’s a new firmware with some file transfer protocol (I don’t need telnet because I have the serial console).
In order to not overwrite the WebUI, I though that it could be possilble to remove some file from the original firmware: may be wpa_supplicant and make connection to camera with ethernet; may be camera (and upload the file each time I boot the camera), may be remove route command and only let the camera to connect from localhost, not internet….
Do you see it possible?
Thanks in advance.
Hi Lloyd,
Could you please contact me at: ramonvanbruggen [@] gmail [.] com I have 2 Foscam clones that are bricked, I have tried every firmware I found on the net but none of them work, you are my last hope.
I really hope you we can get in touch.
Cheers,
Ramon