Help needed, my new IP Cam MP-3.3 with WPS is dead

press for a large picture


press for a large picture


press for a large picture

Hello ALL
Only after a week the camera was not responding or some times yes and many times no .
Normally when you press the WPS button you got a blue led at the back near the wps switch that fliker until you have a connection with the router then it turn off.
Before camera died the wps button was not responding.

After that the camera went  hot. I open it and I found the horizontal stepper motor and the power driver IC ULN2803 at the bottom of the camera very hot.
I remove the motor socket and the ic ULN2803 cool down with the main power on.
I think the main problem is with firmware.

I bought another camera and in less than a week the same scenario happen again.
What I was sure of is that the camera was connecting on IP 192.168.1.111 but now the router is not seeing the camera.
I tried FTP but no luck.
If any one can help with this hardware MP-3.3 , this will be great.
Thanks

To Admin
Please help me to understand what is going on with this product.
Is it the processor MIAGLE600?
Is it the Flash memory?

The electronic parts are not  so many,and I have the possibility to replace any of the known parts even BGA.

I will try to put here data sheets of parts as soon as I found them.

1- uPD45128163G5-A75LI-9JF.       ELPIDA   SDRAM.    U3
   ---> 128M-bit Synchronous DRAM  4-bank, LVTTL  WTR (Wide Temperature Range)
   http://www.elpida.com/eolpdfs/E0346N10_EOL.pdf
2- ULN2803AG.         U1
   ---> 8ch high voltage high current darlington array
   http://www.sycelectronica.com.ar/semiconductores/ULN2803-SMD.pdf
   http://www.rentron.com/Files/uln2803.pdf
3- H1102NL Pulse.    T1
    ---> 10/100BASE-T SINGLE PORT SURFACE MOUNT MAGNETICS
    http://ww2.pulseeng.com/products/datasheets/H325.pdf
4- WM8988L.             
    ---> Low power high quality stereo CODEC
    http://www.wolfsonmicro.com/documents/uploads/data_sheets/en/WM8988.pdf
5- FR9886D.                U5
    ---> Synchronous step-down DC/DC converter
    http://www.hongoda.com/upload/Image/EYkqr4.pdf
6- RT5350F   APSoC        U7    (Etched by Laser)
    ---> World’s Smallest Integrated Wireless Router-on-a-chip
    SoC  means "System on Chip"
    http://www.ralinktech.com/en/02_products/product.php?sn=1005

     The BGA size is 12x12 mm and pitch 0.8mm or a total of 196 balls (14x14).


      M1AGLE600  IGLOOe
---> Developed by ARM in collaboration with Actel, the 32-bit ARM Cortex™-M1 processor is the first ARM processor designed for FPGA implementation. With a balance between size and speed, the free Cortex-M1 processor operates at up to 60 MHz and can be implemented in as few as 4,353 tiles.
      http://www.actel.com/documents/IGLOOe_DS.pdf
      http://www.actel.com/documents/IGLOOe_UG.pdf
      http://www.actel.com/documents/CortexM1_PB.pdf
      http://www.actel.com/products/igloo/docs.aspx#ds


Finaly I could read what was written on the BGA before it was ETCHED by LASER, hope this can help.



   Mine is
Ralink
RT5350F
PAN6700409
1142STA1


    I can't find datasheet for RT5350F but the RF3050 is similar.
 http://dl.dropbox.com/u/55442241/My%20IP%20Camera/RT3050_5x_V2.0_081408_0902.pdf
   
    The SDK for the RT5350 can be obtained from gitorious:
    http://gitorious.org/wive-rtnl-ralink-rt305x-routers-firmware
    SDK means "Software Development Kit"

7- MX25L3206E   Macronix    U9     (Etched by Laser)
    --->32M-BIT [x 1 / x 2] CMOS SERIAL FLASH   8-PIN SOP  "Small Outline Package"
  http://dl.dropbox.com/u/55442241/My%20IP%20Camera/MX25L3206E%2C%203V%2C%2032Mb%2C%20v1.4.pdf


If any one has a comment please don't hesitate.
Excuse my English is not so good.
Regards

novasat
Have you solved issue? i have same Ip Cam with same chips and same issue.
can you or any other can give me some hints where are serial port connectors?
my cam is still connect with ftp. i want a dump firmware from cam and upload here for others.
cam is a mips maygion and name is X buy from lightinthebox.com.

update:

i have seen telnetd was in /usr/sbin but was not active.
so i download /tmp/eye/init.sh that was look like.

Code: [Select]

iwpriv ra0 set TxPower=100
cd /tmp/eye
./ldr &

modify the init.sh and put telnetd & and upload file by command line ftp from linux restart cam but changed nothing. script not being executed permessions was rwx and also befor upload script i chnage permissions in linux chmod +x init.sh but still no go.
i read in a post ftp client change permissions when upload so i rename file to init in linux and upload now try to rename init to init.sh from command line ftp but it fail to rename.
installed file filezila on windows upload init.sh still same rename file in windows to init upload and try to rename to init.sh but filezila also refuse to rename.
read some hints from MayGion site he suggest using cuteftp installed cuteftp trial uploaded init rename to init.sh reboot cam e via.

Code: [Select]

[root@localhost ~]# nmap -v 192.168.1.111 -p0-65331

Starting Nmap 4.20 ( http://insecure.org ) at 2012-12-21 10:34 CET
Initiating ARP Ping Scan at 10:34
Scanning 192.168.1.111 [1 port]
Completed ARP Ping Scan at 10:34, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 10:34
Completed Parallel DNS resolution of 1 host. at 10:34, 0.01s elapsed
Initiating SYN Stealth Scan at 10:34
Scanning 192.168.1.111 [65332 ports]
Discovered open port 21/tcp on 192.168.1.111
Discovered open port 23/tcp on 192.168.1.111
Completed SYN Stealth Scan at 10:35, 10.12s elapsed (65332 total ports)
Host 192.168.1.111 appears to be up ... good.
Interesting ports on 192.168.1.111:
Not shown: 65330 closed ports
PORT   STATE SERVICE
21/tcp open  ftp
23/tcp open  telnet
MAC Address: 00:09:06:06:0B:70 (Esteem Networks)

Nmap finished: 1 IP address (1 host up) scanned in 10.556 seconds
               Raw packets sent: 65333 (2.875MB) | Rcvd: 65333 (3.005MB)

port 23 is open good.
telnet 192.168.1.111
and i am in

Code: [Select]

BusyBox v1.12.1 (2012-06-09 22:28:51 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# ls -l
-rw-r--r--    1 0        0             254 ldr.ini
-rwxr-xr-x    1 0        0              61 init.sh
drwxr-xr-x    3 0        0               0 www
-rwxr-xr-x    1 0        0          156098 ldr
drwxr-xr-x    2 0        0               0 app
-rwxr-xr-x    1 0        0          141632 fd

so in /tmp/eye are 4 hidden files.
as i seen boot log in some posts ldr is being executed in the end of boot
i try to execute manualy

Code: [Select]

# ./ldr
Bus error

now i am blocked here i dont know what ectualy does ldr? is it a web server? multi function program or what is? can sombody give me some hints?

there is also another executabel fd i try to run this.
and surprise.

Code: [Select]

./fd &

nmap output

Not shown: 65329 closed ports
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
23/tcp open  telnet
MAC Address: 00:09:06:06:0B:70 (Esteem Networks)

Nmap finished: 1 IP address (1 host up) scanned in 11.528 seconds
               Raw packets sent: 65333 (2.875MB) | Rcvd: 65333 (3.005MB)


fd opens port 22 i try ssh 192.168.1.111
but it will not connect stay in waiting forever.

try another telnet session telnet 192.168.1.111 22 and got responce.

Code: [Select]

[root@localhost ~]# telnet 192.168.1.111 22
Trying 192.168.1.111...
Connected to 192.168.1.111 (192.168.1.111).
Escape character is '^]'.
220 IPCamera FtpServer(www.maygion.com),do NOT change firmware unless you know what you are doing!

332 Need account for login.
MayGion
332 Need account for login.
maygion.com
332 Need account for login.
login
332 Need account for login.

now i am out of idea if any one can help me.

1. What is ldr?
2. What should in ldr.ini
3. What is /tmp/eye/app/cs and cs.ini

Plaese help i am new to ip cam world but not new in linux.

Hi all,
I've a very nice post but my sessino expired :-P
Well, I'll make a summary.
first, thans to asghar144 & novasat but starting that post, it has helped me.
I've been able to start telnetd and login to the camera by the shell.
Now I'm trying to debug.

With cute ftp you're able to rename the init to init.sh and keep the permissions.
But with lftp from linux, you're able to "cat" files and see the contents.
So I've been able to see the ldr.ini:

Code: [Select]

lftp MayGion@192.168.1.111:~> cat ldr.ini
mac=00-09-06-06-0E-5C                 
ipdef=192.168.1.111
svr=192.168.1.3
svr_port=110
devid=80-000414
ddns_provider=tridro
ddns_user=aj5740
ddns_password=aj5740
ddns_hostname=aj5740.iview.hk
ddns_enable=1
wifimac=00-11-43-30-53-AB
[system]
hwver=oem_vs3.1
Which seems to be a startup config file.
And download ldr binary with lftp... which also seems to be a startup file which calls cs binary.

I've modified init with the following lines:

Code: [Select]

[dodger@ciberterminal ipcam]$ cat init
exec > /tmp/eye/init.log
exec 2> /tmp/eye/init.err
iwpriv ra0 set TxPower=100
cd /tmp/eye
./ldr &
#
/usr/sbin/telnetd &
So we can have more debugging info here...
What I saw in init.log and init.err was:

Code: [Select]

[dodger@ciberterminal-home ipcam]$ cat init.err
Interface doesn't accept private ioctl...
set (8BE2): Invalid argument
[dodger@ciberterminal-home ipcam]$ cat init.log
[2000.01.01 00:00:05]::[ldr start#1](ldr.cpp:996)
[2000.01.01 00:00:05]::[ldr start#2](ldr.cpp:1061)
[2000.01.01 00:00:05]::[ldr start#3](ldr.cpp:1063)
[2000.01.01 00:00:05]::[run#1](ldr.cpp:505)
[2000.01.01 00:00:05]::[rand=890786446](ldr.cpp:276)
[2000.01.01 00:00:05]::[szMainArgs=[2631060517527215275398880739515090198262114037585336144319291992]](ldr.cpp:277)
[2000.01.01 00:00:05]::[m_nMainPort=36630](ldr.cpp:278)
[2000.01.01 00:00:05]::[run#2](ldr.cpp:507)
[2000.01.01 00:00:05]::[run#3](ldr.cpp:522)
1bbbab21e2b93aa9ceb9a137f1077ad5
id#2=802719BF8296DBFA493BFF9BA03E17B7
[2000.01.01 00:00:05]::[this board has burn flash id,check valid now...](flashid.cpp:378)
[2000.01.01 00:00:05]::[check key,bFlashOK = 1](ldr.cpp:524)
[2000.01.01 00:00:05]::[open ini#1](ldr.cpp:534)
[2000.01.01 00:00:05]::[set mac addr#1,szMac=[000906060E5C]](ldr.cpp:584)
[2000.01.01 00:00:05]::[####################################CTool::WinExec[ifconfig eth2.1 down]
](SockTool.cpp:356)
[2000.01.01 00:00:05]::[####################################CTool::WinExec[ifconfig eth2.1 hw ether 000906060E5C]
](SockTool.cpp:356)
[2000.01.01 00:00:05]::[####################################CTool::WinExec[ifconfig eth2.1 up]
](SockTool.cpp:356)
[2000.01.01 00:00:05]::[set mac addr#2](ldr.cpp:593)
[2000.01.01 00:00:05]::[set default ip:192.168.1.111](ldr.cpp:600)
[2000.01.01 00:00:05]::[####################################CTool::WinExec[ifconfig eth2.1 192.168.1.111]
](SockTool.cpp:356)
[2000.01.01 00:00:05]::[try connect 192.168.1.3:110](ldr.cpp:291)
###Warning:[2000.01.01 00:00:09]::[connect svr fail](ldr.cpp:349)
[2000.01.01 00:00:09]::[####################################CTool::WinExec[ifconfig lo 127.0.0.1]
](SockTool.cpp:356)
[2000.01.01 00:00:09]::[ldr open port[36630] for vs to connect. sListen=3](ldr.cpp:623)
[2000.01.01 00:00:09]::[####################################CTool::WinExec[/tmp/eye/app/cs &]
](SockTool.cpp:356)
[2000.01.01 00:00:10]::[ldr recv[abdd]](ldr.cpp:647)
[2000.01.01 00:00:10]::[ldr#2,exit ldr...](ldr.cpp:1065)

So ldr try a connection to the "server" 192.168.1.3:110 which sould be any of the programs provided by Maygion...

I'll update with more info if I get anything userful
cheers!

Hi,
Finally I recover the webserver on the ipcam...
I tried again the maygion instructions by using the windows executables (ipcamrecover) which listens on port 110.
It seems to do ANYTHING on the cam after uploading the firmware but I wasn't able to sniff it (I was using a vbox windows machine with the ports forwarded but my tcpdump was wrong  )
No I don't want to try it again 
But the camera with the new firmware seems to be much more stable than before... It keeps running for 4+ hours over wifi and It's still running (meanwhile before It hungs in about 1hour or less).

If you're still trying to recover the cam, you can try to run the "cs" binary directly from "/tmp/eye/init.sh" cause I can see it running with a ps, and it's a standalone process:

Code: [Select]

# ps
  PID USER       VSZ STAT COMMAND
    1 0         1188 S    init 
    2 0            0 SWN  [ksoftirqd/0]
    3 0            0 SW<  [events/0]
    4 0            0 SW<  [khelper]
    5 0            0 SW<  [kthread]
   25 0            0 SW<  [kblockd/0]
   28 0            0 SW<  [khubd]
   42 0            0 SW<  [kswapd0]
   43 0            0 SW   [pdflush]
   44 0            0 SW   [pdflush]
   45 0            0 SW<  [aio/0]
  619 0            0 SWN  [jffs2_gcd_mtd5]
  633 0            0 SW   [RtmpCmdQTask]
  634 0            0 SW   [RtmpWscTask]
  686 0         1188 R    /usr/sbin/telnetd
  687 0         1448 S    fd
  695 0         1192 S    /bin/sh
  705 0         4072 R    /tmp/eye/app/cs
  706 0         4072 S    /tmp/eye/app/cs
  707 0         4072 S    /tmp/eye/app/cs
  708 0         4072 S    /tmp/eye/app/cs
  709 0         4072 S    /tmp/eye/app/cs
  710 0         4072 S    /tmp/eye/app/cs
  712 0         4072 S    /tmp/eye/app/cs
  713 0         4072 S    /tmp/eye/app/cs
  714 0         4072 S    /tmp/eye/app/cs
  715 0         4072 S    /tmp/eye/app/cs
  761 0         1196 S    /bin/sh
  765 0         1184 R    ps


hello i have the same problem can you provide your firmware please?

 

Hello,
I have the same PCB.
Unfortunately my ipcam bricked after a firmware update incorrectly.
Now the IP CAM is no longer reachable via Ethernet. No IP address is assigned by the router.
What can I do to restore my ip cam?

Thank you.

Bye

Dodger,

I have the same problem can you provide your firmware and ldr file please?, when run ps command i can see  /tmp/eye/app/cs  process, but web server never response.

Thank you

I need to identify rx/tx gnd vcc on this board please I need a help

its not miagle its actel agle600 and here it is the pdf but I need someone to help me to tell me where could I find the Jtag its pin in the processore is N14 http://www.datasheet4u.com/download_new.php?id=687180

Hi..i am a new user here. I have same Ip Cam with same chips and same issue.Can you or any other can give me some hints where are serial port connectors?My cam is still connect with ftp. I want a dump firmware from cam and upload here for others.Cam is a mips maygion and name is X.