{"id":468,"date":"2010-04-27T15:43:41","date_gmt":"2010-04-27T07:43:41","guid":{"rendered":"http:\/\/www.computersolutions.cn\/blog\/?p=468"},"modified":"2013-01-04T22:50:49","modified_gmt":"2013-01-04T14:50:49","slug":"ip-cam-hacking-pt3","status":"publish","type":"post","link":"https:\/\/www.computersolutions.cn\/blog\/2010\/04\/ip-cam-hacking-pt3\/","title":{"rendered":"IP Cam Hacking \u2013 pt#3"},"content":{"rendered":"

I’ve finally received my 2nd camera, so I can now start working properly on it (assuming I get some free time too!)<\/p>\n

High resolution photos of the board are below:<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Main parts used are:<\/p>\n

RAM – Winbond W9812G61H-6 (2M)<\/strong>
\nAccording to the data sheet, that 2M X 4 BANKS X 16 BITS SDRAM @ 3.3V \/ 166MHz\/CL3
\nData sheet is here – http:\/\/jp.ic-on-line.cn\/IOL\/datasheet\/w9812g6ih_4223255.pdf<\/a><\/p>\n

Flash – Spansion S29AL016D (2M)<\/strong>
\nOther boards are populated with different providers – some people have Samsung flash…
\nMine has the Spansion onboard both units. Its programmable onboard (via the uBoot)
\nData sheet here – http:\/\/www.datasheetpro.com\/259722_view_S29AL016D_datasheet.html<\/a><\/p>\n

Sound Card – ALC203<\/strong>
\nThis is obviously used as the BSP for the Novotel provides sample code for that card, making their life easier…
\nData sheet here – http:\/\/realtek.info\/pdf\/alc203.pdf<\/a><\/p>\n

Wired Ethernet – Davicom DM9161AEP (10\/100 Ethernet)<\/strong>
\nData sheet here –
\nhttp:\/\/www.davicom.com.tw\/userfile\/24247\/DM9161AEPProductBrief_v1.0.pdf<\/a><\/p>\n

8 Port Relay Driver (for the motors etc) – ULN2803<\/strong>
\nData sheet here – http:\/\/www.rentron.com\/Files\/uln2803.pdf<\/a>
\nMore info \/ explanation here – http:\/\/wiki.answers.com\/Q\/What_is_Relay_driver_ULN2803<\/a><\/p>\n

Wifi – RALINK 2571 (on daughterboard). Wireless G <\/strong>
\nThis is a USB based chipset, so we’re using 4 usb connector pins for this one.
\nNo datasheet, as Ralink are dicks.<\/p>\n

CPU – ARM7 N745CDG (Arm 7 by Nuvoton)<\/strong>
\nLot of info for chip available at Nuvoton. <\/p>\n

W90N745 makes use of the ARM7TDMI microprocessor core of ARMR and 0.18um production to achieve standard operation at 80MHz. 128-Pin LQPF packing is also used to save electricity and lower costs. The built-in 4KBytes I-Cache and 4KBytes D-Cache of W90N745 can also be set as On-Chip RAM according to the needs of product developers. With regards to system integration, W90N745 is suitable for network-related applications such as management switch, IP cameras, VoIP and printer servers.
\nFeatures
\n * One Ethernet MAC
\n * One USB 2.0 full speed Host controller
\n * One USB 2.0 full speed Host\/Device controller
\n * AC97\/I2S
\n * 4 UARTs
\n * I\u00b2C Master
\n * 31 GPIOs
\n * Power Management<\/p>\n

Data sheets – http:\/\/www.nuvoton.com\/hq\/enu\/ProductAndSales\/ProductLines\/ConsumerElectronicsIC\/ARMMicrocontroller\/ARMMicrocontroller\/NUC745A.htm<\/a>
\nThe uclinux sample distribution and files can be downloaded here – http:\/\/www.metavert.com\/public\/NO-SUPPORT\/NUC700%20Series%20MCU%20uCLinux%20BSP.zip<\/a><\/p>\n

I’m just waiting on a JLINK USB adaptor, then I’m ready to roll.<\/p>\n

[Updates]<\/p>\n

David M from comments at http:\/\/irishjesus.wordpress.com\/2010\/03\/30\/hacking-the-foscam-fi8908w\/#comments<\/a> provided his rom sizing from his device, I’ve got some notes on that here.<\/p>\n

MAC Address : 00:30:10:C1:D0:39
\nIP Address : 0.0.0.0
\nDHCP Client : Enabled
\nCACHE : Enabled
\nBL buffer base : 0\u00d700300000
\nBL buffer size : 0\u00d700100000
\nBaud Rate : -1
\nUSB Interface : Disabled
\nSerial Number : 0xFFFFFFFF<\/p>\n

For help on the available commands type \u2018h\u2019<\/p>\n

Press ESC to enter debug mode \u2026<\/p>\n

bootloader > ls
\nImage: 0 name:BOOT INFO base:0x7F010000 size:0\u00d700000038 exec:0x7F010000 -af
\nImage: 7 name:linux.bin base:0x7F020000 size:0x000BB334 exec:0\u00d700008000 -acxz
\nImage: 6 name:romfs.img base:0x7F0E0000 size:0x0008D000 exec:0x7F0E0000 -a<\/p>\n

My notes:<\/p>\n

Image: 0 name:BOOT INFO base:0x7F010000 size:0\u00d700000038 exec:0x7F010000 -af<\/p>\n

[Image 0 is 38 bytes (small!).
\nBoot info is not the bootloader – 38bytes is way too small for that.
\nIt actually stores our bootloader config settings.
\neg ip address, cache setting, boot loader buffer address etc.
\nOur initial settings are below:<\/p>\n

MAC Address : 00:30:10:C1:D0:39 (should be changed, this Mac range belongs to Cisco!)
\nIP Address : 0.0.0.0 (unset)
\nDHCP Client : Enabled (pulls ip from dhcp..)
\nCACHE : Enabled (onboard chip cache)
\nBL buffer base : 0\u00d700300000
\nBL buffer size : 0\u00d700100000
\nBaud Rate : -1 (unset \/ so defaults to 115,200,8,n,1)
\nUSB Interface : Disabled (NC745 has no USB for bootloader)
\nSerial Number : 0xFFFFFFFF (unset)<\/p>\n

-af indicates Active (a) , and is a Filesystem image (f)]<\/p>\n

Image: 7 name:linux.bin base:0x7F020000 size:0x000BB334 exec:0\u00d700008000 -acxz
\n[Image 7 is our OS – Linux 2.4.20 ucLinux Not sure why Maverick didn’t build on 2.6, there is more hardware support. Probably time dependant – 2.6 may not have been available, plus the Nuvoton sample code is also 2.4 based…<\/p>\n

-axcz says active (a) executable (x) copied to ram (c) compressed (z) ]<\/p>\n

Image: 6 name:romfs.img base:0x7F0E0000 size:0x0008D000 exec:0x7F0E0000 -a<\/p>\n

[Our rom image – aka userland stuff. This is where we’ll be putting our own code. Looks like its stuck quite high up in the flash, although doesn’t need to be given size of the Linux rom. We have plenty of room available.<\/p>\n

We’ll need to make appropriate changes to Image 6 size on flashing<\/p>\n

-a says active partition.]<\/p>\n","protected":false},"excerpt":{"rendered":"

I’ve finally received my 2nd camera, so I can now start working properly on it (assuming I get some free time too!) High resolution photos of the board are below: Main parts used are: RAM – Winbond W9812G61H-6 (2M) According to the data sheet, that 2M X 4 BANKS X 16 BITS SDRAM @ 3.3V […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[252,25],"tags":[251,245,241,240,250,249],"class_list":["post-468","post","type-post","status-publish","format-standard","hentry","category-ip-cam","category-technical-mumbo-jumbo","tag-embedded","tag-foscam","tag-hacking","tag-ipcam","tag-nc745","tag-nuvoton"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/comments?post=468"}],"version-history":[{"count":8,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/468\/revisions"}],"predecessor-version":[{"id":920,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/468\/revisions\/920"}],"wp:attachment":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/media?parent=468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/categories?post=468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/tags?post=468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}