News:

Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at http://www.computersolutions.cn/blog

Author Topic: Another Foscam FI8908W Clone Firmware Exploration  (Read 113876 times)

  • ***
January 03, 2013, 12:34:21 am
Note: I get these IP Cameras in quantities of 10, with shipping included, for $54.00 U.S. each. They come with a 1 year warranty as well.

These IP Cameras are very stable, IMHO. I have used them as my main IP Cameras for both indoor and outdoor ("In heated housing") use, to sell, customize the Web UI and install for others. They also have 4M available of 16M which makes them excellent IP Camera candidates to use, to modify the Web UI, with custom Web UI changes.

This IP Camera has no logo, is a dull black ("Not shiny") and has the 4 alarm pins and an audio out jack on the back. The label on the bottom of this IP Cameras, says "IP Camera" and the free factory DDNS is topipcam.org. It matches the FI8908W features and has no IR-CUT.



I have searched the files and posts here and nothing seems to exactly match this FI8908W IP Camera clone, with an exact match of where things are located in images as well as this IP Cameras memory.

I am not sure how common this FI8908W IP Camera clone is ("If any of these IP Cameras could be ever considered a clone, lol"). That said, hopefully, maybe these instructions will help bring some now paperweights back to life.

It should be noted that I used a Windows based system, specifically a Win7 64 bit system, to do this. So I will also go into some details on what I needed to use, since I could not locate a copy of HyperTerminal. While I do run Ubuntu as a dual/tripple boot option, on some of my Windows systems, I am far from a Linux Guru!

If you still have some access to your IP Camera and even if you think you don't. It's always best to before doing anything to save the contents of what the IP Camera thinks it has as configuration data. Even if the Web UI is currently not functional. This still maybe possible.

To do this simply follow these instructions:

xxx.xxx.xxx.xxx = Local IP Address or ISP IP Address or DDNS of IP Camera
#### = Port for IP Camera
Username = Admin Level User Name of IP Camera
Password = Password for the above User Name of IP Camera

From any browser window do:

Code: [Select]
http://xxx.xxx.xxx.xxx:####/get_params.cgi?user=Username&pwd=Password

If it works, please copy and save the results, for reference later, if needed.

As your proceed, it would not be a good idea to download any changes to your IP Camera, unless it looks like things you see here, are similar to your IP camera. To do otherwise, most likely will cause you more grief.

Once you get into the bootloader of your IP Camera, assuming that the pin instructions you see here, matched your IP Camera? You can then compare what you see with your IP Camera vs. what is shown here and then decide, to stop or move forward, on actually downloading anything to your IP Camera.

Please remember, that when you do any of the things you see here, that you do so, at your own risk as well.

Tools:

Small Phillips screwdriver.

Soldering iron and solder.

Potentially some wire, if your Serial Interface has none.

Some kind of Serial Interface. I used this, but you can use any serial interface that supports a 3.3V DC interface:

USB to UART TTL Cable: http://www.ebay.com/itm/120921203767?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649

I am including a .zip file here, that contains the things used in these instructions.

1. linux.zip
2. romfs.img
3. 0.2.9.12.bin ("WebUI")
4. lr_cmos_0_37_2_47.bin ("Is the normal system firmware for the camera, having 1. and 2. here merged")
5. IPCamera.exe ("IP Camera Finder Tool")
6. ActiveX_IP.exe ("ActiveX Installer")
7. Instructions ("Windows Shortcut to this Forum post here")

http://www.saveontelephonebills.com/camera/908clonerecovery.zip

These files are from the latest version for this IP Camera. They are also required for the instructions and procedures shown here.

Here is the Boot Loader Users Manual that lists details on all the commands that can be used by the Boot Loader:

http://www.openipcam.com/files/BSP/Nuvoton%20W90N745%20-%20W90N745%20Bootloader%20Users%20Manual.pdf

Location of (J2) IP Camera Serial Connection


Please do NOT pay any attention to the pin hole designations, shown in the above photo. The above photo was meant to be used, simply as a reference, as to where, the general location on the IP Cameras PCB ("Printed Circuit Board") the 4 pin holes, for (J2) are located.

The IP Cameras main PCB has clear markings for the (J2) serial connection. It has 4 empty pin holes, side by side. On one side of the PCB board it says RX ("Next to the RX pin hole and on the other side of the PCB, it shows the 3.3 VDC pin hole as well as GND pin hole for these 4 holes. So you may need to flip the PCB board over, to see all the markings for the (J2) serial connection pin holes.

The only (J2) pin hole not marked, in some way, on one side or the other of the PCB for this IP Camera, is the TX pin hole.

When the IP Camera is centered and the IP Camera lens is pointing away from you with the bottom of the IP Camera PCB board ("In the IP Camera housing as normal"), facing up. The pin holes are ("Left to right") 3.5V DC pin hole 1, GND Pin hole 2, TX Pin hole 3, RX Pin hole 4. You do NOT want to connect anything to the 3.5V DC (J2) Pin hole. All (J2) pin holes are what they say, there is no need to reverse anything listed here. Meaning TX is your TX, RX is your RX.

You will need to detach the IP Cameras main PCB board from the IP Camera housing, in order to make the solder connections. The main PCB board is held on by 1 screw. To access the bottom of the IP Camera and unscrew the 4 screws that hold the IP Cameras bottom on. You will need to remove some of the rubber feet on the bottom of the IP Camera to access the screw holes. You can glue them on later again, if needed. In some cases, they are so sticky, there is no need to re-glue them. Simply try placing them back as they were, when you are all done.

On newer Windows systems, like Win7 or Win8. The normal serial communications terminal program, known as HyperTerminal is not included with the Operating System. While people say you can copy it from an XP Windows system. I used a 64 Bit based Win7 system to test and produce what you see here. So, the program listed below is more compatible with current or newer Windows Operating Systems.

Free HyperTerminal Like Program: http://www.clearconnex.com/content/clearterminal

ClearTerminal Settings ("Seen when opening a connection") From the ClearTerminal Menu:

Connection -> New Connection



ClearTerminal will list the COMM ports it sees as available. If your system has more than one available, you will need to determine which COMM port is being used by whatever serial interface you will be using to communicate with your IP Camera, from your Windows system.

Note: ClearTerminal seems not very good at generating the required ESC character to enter the bootloader, using the keyboard. I use this secondary ClearTerminal window, to send the ESC character. To invoke this window. From the ClearTerminal menu do:

Tools -> Send ASCII/Binary Bytes

Please make sure the "ASCII" radio button is selected and press the ESC button located in the new window prior to the 3 second timeout to remain in the bootloader.



ClearTerminal Main Window ("Made smaller to show it here"):



You have two choices on where you can enter text to send to the IP Camera, in ClearTerminal. You can type in the main ClearTerminal window, which is not very forgiving with typos or you can type in the text line below the main ClearTerminal window. This allows you to change text, if needed, much more easily, prior to sending a command.

To download files to the IP Camera, when needed using ClearTerminal. From the ClearTerminal menu do:

Transfer -> Send File

This will open up a secondary window, please make sure that you have XModem selected as a radio button. There is no need to define ASCII or Binary mode transfers:



With the settings shown above. The data being transferred to the IP Camera will not display in the main ClearTerminal window, during any download to the IP Camera. You will have a progress bar that will show bytes transferred during the download process to the IP Camera, as well as notification of when the download completes for the IP Camera. You will need to manually close this secondary window, when the download has completed, with the settings shown above.

Here are my current findings, with these IP Cameras.

It should be noted that I have personally never had issues with this IP Camera. This process was done as more of an exploratory process, so that in case I ever did, I would know how to recover. Which is why I wanted to share these procedures on how you can recover these IP Cameras, when/if needed. All the procedures here, were done many times, with no issues for this particular IP Camera.

Once you have a serial connection to your IP Camera, you can compare the output from your IP Camera, so that you can determine, if these IP Camera recovery instructions, will fit your needs.

Once you have an active serial connection to Your IP Camera, anytime you boot the camera, you will see the boot process displayed. You can leave the serial connection to the IP Camera in place, with or without the serial connection being connected with no ill effects.

Here are things you will see and can see, from your IP Camera, while you have an active serial connection, to your IP Camera.

Full Boot:

Code: [Select]
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:6E:06:05:8A:12
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #1699    3   8 07:58:22 CST 2012
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 4096
zone(0): 0 pages.
zone(1): 4096 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 16MB = 16MB total
Memory: 14612KB available (1283K code, 206K data, 40K init)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
PTZ Driver has been installed successfully.
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80100 (irq = 10) is a W90N7451
I2C Bus Driver has been installed successfully.
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0D0000-7F1CC7FF [VIRTUAL 7F0D0000-7F1CC7FF] (RO)
S29GL032N Flash Detected
01 eth0 initial ok!
which:0
PPP generic driver version 2.4.2
Linux video capture interface: v1.00
Winbond Audio Driver v1.0 Initialization successfully.
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver audio
audio.c: v1.0.0:USB Audio Class driver
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4
rtusb init --->
usb.c: registered new driver rt2870
dvm usb cam driver 0.0.0.1 by Maverick Gao in 2010-8-3
usb.c: registered new driver dvm
dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20
usb.c: registered new driver dvm usb cam driver for sonix288
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: /bin/init
Command: mount -t proc none /proc
Command: mount -t ramfs none /usr
Command: mount -t ramfs none /swap
Command: mount -t ramfs none /var/run
Command: mount -t ramfs none /etc
Command: mount -t ramfs none /flash
Command: mount -t ramfs none /home
Command: mount -t ramfs none /tmp
Command: mkdir /tmp/run
Command: camera&
[8]
Command: sh
no support

Sash command shell (version 1.1.1)
/> hub.c: connect-debounce failed, port 1 disabled
new USB device :80fb3004-fed740
hub.c: new USB device 1, assigned address 2
probing sonix288 usb camera ...
vid/pid is 0x1d0f/0x1801
dvm camera registered as video0
p1[7]:1,j 3,config->bNumInterfaces:4
usbaudio: device 2 audiocontrol interface 2 has 1 input and 0 output AudioStreaming interfaces
usbaudio: valid input sample rate 16000
usbaudio: device 2 interface 3 altsetting 1: format 0x00000010 sratelo 16000 sratehi 16000 attributes 0x01
usbaudio: valid input sample rate 48000
usbaudio: device 2 interface 3 altsetting 2: format 0x00000010 sratelo 48000 sratehi 48000 attributes 0x01
usbaudio: registered dsp 14,35
usbaudio: warning: found 1 of 0 logical channels.
usbaudio: assuming the channel found is the master channel (got a Philips camera?). Should be fine.
usbaudio: registered mixer 14,32
usb_audio_parsecontrol: usb_audio_state at 00ff3bc0
new USB device :80fb3404-fed740
hub.c: new USB device 2, assigned address 3
params length is 5428
sw version is 0.37.2.47
aw version is 0.2.9.12

Wait for auto-negotiation complete...ResetPhyChip Failed
video0 opened
1
1
1
1
1
1
unknown command
do_zoom_stop: write error 5
__pthread_initial_thread_bos:3fc000
manage pid:14
frag is 2048
Prepare Audio Buffer
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
can not get dyndns server ip
check_ipid_shat_net: can not get ip of ipid.shat.net
update_9299: can not get server www.topipcam.org ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
0x1300 = 000a4260
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth1
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
bonjour callback: service registered
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===default
*args===gw
*args===eth1
bonjour callback: memory free
bonjour callback: service registered
3
3
3
3
3
3
ntpc adjust ok
update_9299: update ok
getDevicesFromMiniSSDPD: socket(unix) error
Jan  3 05:06:37 2013 bonjour: mDNSPlatformRawTime went backwards by 1807289983 ticks; setting correction factor to -539565910

Please see the Boot Loader Users Manual link above for details on what Bootloader commands are available and what they do.

BootLoader ("Stopped within 3 seconds using ESC. Then I used the Bootloader "ls" command"):

Code: [Select]
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:6E:06:05:8A:12
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode .

bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.bin base:0x7F020000 size:0x000ADFD8 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0D0000 size:0x000FC800 exec:0x7F0D0000 -a

bootloader >

Info Command:

Code: [Select]
bootloader >i

W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:6E:06:05:8A:12
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Supports flash types:
W19L320SB        AM29LV320DB      AM29LV320DT      AM29LV800BB     
AM29LV800BT      AM29LV160DB      AM29LV160DT      EN29LV160AB     
EN29LV160AT      SST39VF160       HY29LV160        MX28F160C3T     
MX28F160C3B      MX29LV160BT      MX29LV640BB      MBM29LV160BE     
MBM29LV160TE     W19B322MB        M29WL320DT       W19B320BTT       
W19B320ABT       W19B320BBT       W19B160BB        W28J800TT       
W28J800BT        W28J160TT        W28J160BT        W28J320TT       
W28J320BT        INTEL E28F320    INTEL E28F640    SST39VF6401     
SST39VF1601      INTEL E28F128    28F800C3-T       28F800C3-B       
28F160C3-T       28F160C3-B       28F320C3-T       28F320C3-B       
W39L010          W29EE011         S29GL032A        MX29lv160BB     
A29DL320FUV      A29L160B         A29L320B         EN29LV160B       
EN29LV320B       ML29lv162FE     
bootloader >

The Bootloader only allows memory locations to be displayed, 256 bytes at a time. So, it can be a tedious process, to display memory for the IP Camera, when searching for something in memory and not really knowing at that moment, where exactly, that information is located in memory. The memory addresses shown here, are where the information starts and where it ends, in the IP Cameras memory.

Memory Locations:

The WebUI.bin has no footer and therefore has no image number assigned to it, like the linux.zip and romfs.ing files do. But it's located at 0x7F200000 - 0x7F33727F

Code: [Select]
d 0x7f200000
Displaying memory at 0x7F200000
[7F200000] 440C9ABD 04D81A69 - 000E124B 0C090200  ...Di...K.......
[7F200010] 0000000F 7463412F - 58657669 2E50495F  ..../ActiveX_IP.
[7F200020] 01657865 00016E92 - 00905A4D 00000003  exe..n..MZ......
[7F200030] 00000004 0000FFFF - 000000B8 00000000  ................
[7F200040] 00000040 00000000 - 00000000 00000000  @...............
[7F200050] 00000000 00000000 - 00000000 00000000  ................
[7F200060] 00000000 000000D0 - 0EBA1F0E CD09B400  ................
[7F200070] 4C01B821 685421CD - 70207369 72676F72  !..L.!This.progr
[7F200080] 63206D61 6F6E6E61 - 65622074 6E757220  am.cannot.be.run
[7F200090] 206E6920 20534F44 - 65646F6D 0A0D0D2E  .in.DOS.mode....
[7F2000A0] 00000024 00000000 - A84A75E5 FB2414A1  $........uJ...$.
[7F2000B0] FB2414A1 FB2414A1 - FB7B1C2F FB2414A3  ..$...$./.{...$.
[7F2000C0] FB2514A1 FB24143A - FB791C22 FB2414B0  ..%.:.$.".y...$.
[7F2000D0] FB1437F5 FB2414A8 - FB221266 FB2414A0  .7....$.f."...$.
[7F2000E0] 68636952 FB2414A1 - 00000000 00000000  Rich..$.........
[7F2000F0] 00000000 00000000 - 00004550 0005014C  ........PE..L...

bootloader >

Your current camera settings. Better known as the "params.bin" file. If you were to backup and save your IP Camera settings, using the IP Cameras Web UI. This is where the "params.bin" file is maintained and comes from and it's located at 0x7F1F0000 - 0x7F1F1533

Code: [Select]
d 0x7f1f0000
Displaying memory at 0x7F1F0000
[7F1F0000] 440C9ABD 000058F6 - 00001534 45363030  ...D.X..4...006E
[7F1F0010] 35303630 32314138 - 02250000 0902002F  06058A12..%./...
[7F1F0020] 6D65440C 6143206F - 6172656D 00003220  .Demo.Camera.2..
[7F1F0030] 00000000 64610000 - 006E696D 00000000  ......admin.....
[7F1F0040] 70000000 77737361 - 0064726F 00006461  ...password.ad..
[7F1F0050] 00000002 00000000 - 00000000 00000000  ................
[7F1F0060] 00000000 00000000 - 00000000 00000000  ................
[7F1F0070] 00000000 00000000 - 00000000 00000000  ................
[7F1F0080] 00000000 00000000 - 00000000 00000000  ................
[7F1F0090] 00000000 00000000 - 00000000 00000000  ................
[7F1F00A0] 00000000 00000000 - 00000000 00000000  ................
[7F1F00B0] 00000000 00000000 - 00000000 00000000  ................
[7F1F00C0] 00000000 00000000 - 00000000 00000000  ................
[7F1F00D0] 00000000 00000000 - 00000000 00000000  ................
[7F1F00E0] 00000000 00000000 - 00000000 00000000  ................
[7F1F00F0] 00000000 00000000 - 00000000 00000000  ................

bootloader >

Factory Defaults. This is where the IP Camera stores factory default values, that the IP Camera uses when you restore factory defaults using the Web UI or use the IP Cameras reset button, on the bottom of the IP Camera, which is located at 0x7F1F8000 - 0x7F1F9533:

Code: [Select]
D 0x7F1F8000
Displaying memory at 0x7F1F8000
[7F1F8000] 440C9ABD 000041A1 - 00001534 00000000  ...D.A..4.......
[7F1F8010] 00000000 00000000 - 00000000 00000000  ................
[7F1F8020] 00000000 00000000 - 00000000 00000000  ................
[7F1F8030] 00000000 64610000 - 006E696D 00000000  ......admin.....
[7F1F8040] 00000000 00000000 - 00000000 00000000  ................
[7F1F8050] 00000002 00000000 - 00000000 00000000  ................
[7F1F8060] 00000000 00000000 - 00000000 00000000  ................
[7F1F8070] 00000000 00000000 - 00000000 00000000  ................
[7F1F8080] 00000000 00000000 - 00000000 00000000  ................
[7F1F8090] 00000000 00000000 - 00000000 00000000  ................
[7F1F80A0] 00000000 00000000 - 00000000 00000000  ................
[7F1F80B0] 00000000 00000000 - 00000000 00000000  ................
[7F1F80C0] 00000000 00000000 - 00000000 00000000  ................
[7F1F80D0] 00000000 00000000 - 00000000 00000000  ................
[7F1F80E0] 00000000 00000000 - 00000000 00000000  ................
[7F1F80F0] 00000000 00000000 - 00000000 00000000  ................

bootloader >

The IP camera also contains a "stand-alone shell with built-in commands" also known as "Sash command shell (version 1.1.1)".

Here is a general list of Sash commands, please note that some commands are not presently supported in the IP Camera:

http://www.linuxcommand.org/man_pages/sash8.html

To get to the shell commands supported by the IP Camera and leave the bootloader command interface. Simply place your cursor in the ClearTerminal main window and use your <Enter> key. This will give you a sh ("Shell Prompt") with the following commands:

Code: [Select]
/> help
cd         [dirname]
sleep      seconds
chgrp      gid filename ...
chmod      mode filename ...
chown      uid filename ...
cmp        filename1 filename2
cp         srcname ... destname
df         [file-system]
echo       [args] ...
exec       filename [args]
exit       
free       
help       
hexdump    [-s] filename
hostname   [hostname]
kill       [-sig] pid ...
ln         [-s] srcname ... destname
ls         [-lidC] filename ...
mkdir      dirname ...
mknod      filename type major minor
more       filename ...
mount      [-t type] devname dirname
mv         srcname ... destname
printenv   [name]
pwd       
pid       
quit       
rm         filename ...
rmdir      dirname ...
setenv     name value
source     filename
sync       
touch      filename ...
umask      [mask]
umount     filename
ps         
cat        filename ...
date       date [MMDDhhmm[YYYY]]
/>

Some Shell Command Examples

Directories in the cameras flash memory:

Code: [Select]
/> ls -la
drwxr-xr-x  1 0        0              32  Jan 01 1970  .
drwxr-xr-x  1 0        0              32  Jan 01 1970  ..
drwxr-xr-x  1 0        0              32  Jan 01 1970  bin
drwxr-xr-x  1 0        0              32  Jan 01 1970  dev
drwxr-xr-x  1 0        0               0  Jan 01 1970  etc
drwxr-xr-x  1 0        0               0  Jan 01 1970  flash
drwxr-xr-x  1 0        0               0  Jan 01 1970  home
dr-xr-xr-x 30 0        0               0  Jan 01 1970  proc
drwxr-xr-x  1 0        0               0  Jan 01 1970  swap
drwxr-xr-x  1 0        0               0  Jan 01 1970  tmp
drwxr-xr-x  1 0        0               0  Jan 01 1970  usr
drwxr-xr-x  1 0        0              32  Jan 01 1970  var
/>

Files in the bin directory:

Code: [Select]
/> cd bin
/bin> ls -la
drwxr-xr-x  1 0        0              32  Jan 01 1970  .
drwxr-xr-x  1 0        0              32  Jan 01 1970  ..
-rwxr-xr-x  1 0        0           12288  Jan 01 1970  .init.swo
-rwxr-xr-x  1 0        0          576972  Jan 01 1970  camera
-rwxr-xr-x  1 0        0           44792  Jan 01 1970  dhcpcd
-rwxr-xr-x  1 0        0             929  Jan 01 1970  fcc_ce.wlan

-rwxr-xr-x  1 0        0           21610  Jan 01 1970  ifconfig
-rwxr-xr-x  1 0        0             234  Jan 01 1970  init
-rwxr-xr-x  1 0        0           38300  Jan 01 1970  iwconfig
-rwxr-xr-x  1 0        0           33630  Jan 01 1970  iwpriv
drwxr-xr-x  1 0        0              32  Jan 01 1970  mypppd
-rwxr-xr-x  1 0        0           28824  Jan 01 1970  route
-rwxr-xr-x  1 0        0           31043  Jan 01 1970  sh
-rwxr-xr-x  1 0        0           48520  Jan 01 1970  wetctl
-rwxr-xr-x  1 0        0           96327  Jan 01 1970  wpa_supplic
ant
/bin>

Files in proc directory:

Code: [Select]
/bin> cd
/> cd proc
/proc> ls -la
dr-xr-xr-x 30 0        0               0  Jan 01 1970  .
drwxr-xr-x  1 0        0              32  Jan 01 1970  ..
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 1
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 14
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 15
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 16
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 17
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 18
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 19
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 2
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 20
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 25
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 26
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 27
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 28
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 3
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 30
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 4
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 5
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 6
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 7
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 8
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 9
dr-xr-xr-x  2 0        0               0  Jan 03 05:14 bus
-r--r--r--  1 0        0               0  Jan 03 05:14 cmdline
-r--r--r--  1 0        0               0  Jan 03 05:14 cpuinfo
-r--r--r--  1 0        0               0  Jan 03 05:14 devices
-r--r--r--  1 0        0               0  Jan 03 05:14 dma
dr-xr-xr-x  2 0        0               0  Jan 03 05:14 driver
-r--r--r--  1 0        0               0  Jan 03 05:14 execdomai
ns
-r--r--r--  1 0        0               0  Jan 03 05:14 filesyste
ms
-------r--  1 0        0               0  Jan 03 05:14 flash_4m
dr-xr-xr-x  2 0        0               0  Jan 03 05:14 fs
-------r--  1 0        0               0  Jan 03 05:14 i2s_dac
-r--r--r--  1 0        0               0  Jan 03 05:14 interrupt
s
-r--r--r--  1 0        0               0  Jan 03 05:14 iomem
-r--r--r--  1 0        0               0  Jan 03 05:14 ioports
-r--------  1 0        0        16781312  Jan 03 05:14 kcore
-r--------  1 0        0               0  Jan 03 05:14 kmsg
-r--r--r--  1 0        0               0  Jan 03 05:14 loadavg
-r--r--r--  1 0        0               0  Jan 03 05:14 locks
-r--r--r--  1 0        0               0  Jan 03 05:14 meminfo
-r--r--r--  1 0        0               0  Jan 03 05:14 misc
lrwxrwxrwx  1 0        0              11  Jan 03 05:14 mounts ->
 self/mounts
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 net
-------r--  1 0        0               0  Jan 03 05:14 p1_p1
-r--r--r--  1 0        0               0  Jan 03 05:14 partition
s
lrwxrwxrwx  1 0        0              64  Jan 03 05:14 self -> 9

-rw-r--r--  1 0        0               0  Jan 03 05:14 slabinfo
-r--r--r--  1 0        0               0  Jan 03 05:14 stat
-r--r--r--  1 0        0               0  Jan 03 05:14 swaps
dr-xr-xr-x  4 0        0               0  Jan 03 05:14 tty
-r--r--r--  1 0        0               0  Jan 03 05:14 uptime
-r--r--r--  1 0        0               0  Jan 03 05:14 version
/proc>

Devices:

Code: [Select]

/proc> cat devices
Character devices:
  1 mem
  2 pty
  3 ttyp
  4 ttyS
  5 cua
 10 misc
 14 sound
 81 video_capture
 89 i2c
108 ppp
162 raw
180 usb
188 ttyUSB
200 ptz

Block devices:
 31 Blkmem
/proc>

Memory Info:

Code: [Select]
/proc> cat meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  15003648  6369280  8634368        0    45056  1269760
Swap:        0        0        0
MemTotal:        14652 kB
MemFree:          8432 kB
MemShared:           0 kB
Buffers:            44 kB
Cached:           1240 kB
SwapCached:          0 kB
Active:             44 kB
Inactive:         1240 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        14652 kB
LowFree:          8432 kB
SwapTotal:           0 kB
SwapFree:            0 kB
/proc>

To boot at anytime, after going into the shell command interface. Simply type "exit" without the double quotes. This will force the IP Camera to re-boot. You may need to place your cursor in the main ClearTerminal window and use your <Enter> key first, to get a shell prompt, to be able do this.

To stop at the bootloader prompt during boot, please use the ESC method shown here, before the 3 second timer expires.

Please never do a "del 0" command. The 0 image you see listed here when using the Bootloader ls command, is the boot information image area and if this is deleted it can/could cause issues. Also never use the "del" command alone, without a 6 or 7 following it. Some have reported that using the "del" command alone, even accidentally, has caused them issues. I have never tried it personally and have no need or desire, to learn, if this is true, or simply an Urban Legend.

When you enter a del 6 or del 7 Bootloader command, there will be a slight delay. The IP camera will then inform you that the delete process has completed. Please wait for that notification, before doing a Bootloader fx command.

After any file is downloaded to the IP Camera, you will need to place your cursor in the main window of ClearTerminal and use your <Enter> Key to get your Bootloader prompt back. You many need to use the <Enter> key more than once before you see the Bootloader prompt. You should then do a Bootloader ls command, to check if you see what you just downloaded is now present and with the proper image number, of 6 or 7.

To download the linux.zip file to the IP Camera, which is included in the .zip file, listed above, for this IP Camera, from the bootloader prompt do:

del 7
fx 7 linux.zip 0x7F020000 0x8000 -acxz

Then use the ClearTerminal Transfer to send the file as mentioned here.

To download the romfs.img file to the IP Camera, which is included in the .zip file, listed above, for this IP Camera, from the bootloader prompt do:

del 6
fx 6 romfs.img 0x7F0D0000 0x7F0D0000 -a

Then use the ClearTerminal Transfer to send the file as mentioned here.

Note: You must have both a linux.zip and romfs.img in order to boot properly.

Once done with the above enter the Bootloader command:

ls

You should see exactly this:

Code: [Select]
bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.zip base:0x7F020000 size:0x000AE000 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0D0000 size:0x000FC800 exec:0x7F0D0000 -a

bootloader >

Now you can enter this to reboot the IP Camera and see if whatever was wrong with your IP Camera, has now been fixed:

boot

The IP Camera should now reboot and you can view the boot process from ClearTerminal. There is no need to start a new connection for ClearTerminal, the connection will remain in place with ClearTerminal.

Don't use the ESC key, let the 3 second timer expire and let the IP Camera go into a normal boot process.

Give the IP Camera a couple of minutes to completely reboot.

You can now try to see if you are able to access the camera using the IP Cameras, IP Address and port in a browser window. You can also use the IP Camera Finder Tool included in the .zip file, listed above, to see what the current IP Address and port is for the IP Camera. You may need to also install the Web UI as well, if access to the IP Camera fails, when trying to access the IP Camera via a web browser, see below.

IMHO, for this IP Camera. I would NOT use the Bootloader method, to download the 0.2.9.12.bin ("WebUI") firmware file. Because this IP Camera does not use a image with a footer for that and you might end up stepping on something else in memory, like factory default settings, if they still happen to be there or even ending up with two copies of the 0.2.9.12.bin ("WebUI") firmware file, resident in memory, at the same time, because of doing so.

For example the next time you install firmware, using the normal Web UI firmware install method, from the IP Cameras Web UI. The IP camera, may place the 0.2.9.12.bin ("WebUI") Firmware file somewhere else in memory, leaving the other copy of the 0.2.9.12.bin ("WebUI") firmware file, where it was installed, using the Bootloader method as well.

It's better to use the IP Camera Finder Tool, included with the .zip file here, to install the 0.2.9.12.bin ("WebUI") for this IP Camera. When there is no functional Web UI for the IP Camera, currently to do so.

You can do that by starting the IPCamera.exe file, included with the .zip file, listed above. Locate the IP Camera, change the IP Address and port if needed. Once the IP Cameras IP Address and port are as you want it to be. Select the IP Camera from the IP Camera Finder Tool and then right click on it and choose "Upgrade Firmware". Then use the admin and password and choose  "Upgrade Web UI" select the "0.2.9.12.bin" file included in the .zip file.



If the IP Camera Finder Tool, fails to locate and find the IP Camera. You may need to connect the IP Camera via Ethernet cable directly to your Router/AP. This might be because your wireless settings need to be changed or defined.

If you are still having trouble and you only installed one of the two files, romfs.img or linux.zip, you should try installing the other file you did not install.

Once you have manually installed the linux.zip and/or romfs.img files using the bootloader. You should then re-install the system firmware from the IP Cameras UI, if all is well using the lr_cmos_0_37_2_47.bin file that is included in the .zip file. Just to verify that the camera can be re-flashed now, using normal methods.

It should be noted that if you do re-install the system firmware version lr_cmos_0_37_2_47.bin from the .zip file included here. That when using the ls Bootloader command afterwards. Things will be slightly different:

Code: [Select]
bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.bin base:0x7F020000 size:0x000ADFD8 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0D0000 size:0x000FC800 exec:0x7F0D0000 -a

Image 7, will now have a name of "linux.bin" vs. "linux.zip" and the size will be 0x000ADFD8 not 0x000AE000.

Again, this is why it is suggested to install the system firmware version lr_cmos_0_37_2_47.bin from the .zip file included here, at this point, using the normal methods to make sure that everything is exactly as it would have been, without this manual intervention.

The final step is to use the reset button on the bottom of your  IP Camera, while the  IP Camera is powered up, hold down the reset button for 20 seconds. You can use a bent paperclip to do this, if needed.

This should recover any factory default settings that your IP Camera may still have, that can now be attempted to be reloaded. This might be important for example, if you are trying to recover any free DDNS that came with the camera before it was having issues.

When you use the reset button on the IP Camera, you will need to connect the IP Camera directly to your Router/AP via an Ethernet cable to re-configure the IP Camera as if it just was taken out of the box.

If Things are back to normal. Maybe it's time to play with your IP Camera?

Here is a modified version of the Web UI, for this  IP Camera. Which I created using a version number of 0.2.9.13:

http://www.saveontelephonebills.com/camera/0.2.9.13.zip

It shows, just how easy it is to play with this IP Camera and make custom Web UI changes. It contains an Interface I created here, that normally runs externally from the IP Camera. This Interface works with any Internet browser capable device. From computers to tablets, to phones and TVs running on any Operating System and using any browser:

http://foscam.us/forum/free-generic-browser-interface-for-foscam-ip-mjpeg-cameras-t2522.html#p10970

But....It's now running by being embedded in the IP Cameras Web UI firmware. Once this version of the Web UI is installed, simply use your normal IP camera IP Address and port or DDNS and add /public.htm:

Code: [Select]
http://xxx.xxx.xxx.xxx:####/public.htm
A working live example of this running from inside a live IP Cameras Web UI firmware, using a different name can be seen here:

http://foscam.us/forum/free-generic-browser-interface-for-foscam-ip-mjpeg-cameras-t2522-200.html#p17434

You might say "So What!". Well, now you don't need to give people a direct link to your IP Cameras logon page and force them to always login, you can choose, if you wish to use auto-logon, you also don't need a web site, because the IP Camera is hosting this.

So as an example, you can simply use a link in a social media site that goes directly to your IP Camera. You can email a link to people. Using prompt for logon or auto-logon, which you can change/disable at anytime.

This special version of the Web UI is using a User Id of "public" and a password of "public", without the double quotes.

So, if your IP Camera has no User Id of "public", the Interface will be disabled. If you add a User Id of "public", but make the password something besides "public" then only people that know the User Id "public" and the correct password for "public" will be able to use public.htm.

Even better, because the Interface does things differently based on User Level. If you make User Id "public" a visitor User Level Id, then people accessing public.htm will only be able to view the IP Cameras video. At anytime, you could change the User Level of User Id "public" to be an Operator User Level Id, which then would allow people to both control and view the IP Camera.

Again, in all cases, only if they knew the password to User Id "public" or if you keep the password for public as "public" then they will not be required to logon to use public.htm.

But....How was it done? Show me Please!

Here is a copy of all the files, used to build this special custom Web UI firmware version 0.2.9.13.bin:

http://www.saveontelephonebills.com/camera/webui.zip

The Web UI firmware for this IP Camera, 0.2.9.12.bin ("Yes, I know this Web UI is UGLY!"), was extracted and used as a base and rebuilt as 0.2.9.13.bin, using two new files. public.htm and jquery-latest.js ("So that public.htm could be used by IP Cameras, without the IP Cameras needing or requiring Internet access to get jquery-latest.js"). All other files in the .zip above were part of the stock 0.2.9.12.bin Web UI firmware version.

Additionally. All the string.js language files, located in each language folder, were modified to change var str_IP_Cam='IP Camera'; to var str_IP_Cam='TheUberOverLord Creations';

Sigh!

Now I have created yet another IP Camera Clone. Worse, I have shown others how to easily do the same.

2013 will become the "Year" of IP Camera clones, lol. Soon you will see posts like..."Does anyone else own a 'Bob's IP Camera Model Zx9?04792'? I can't seem to find the most current Web UI for this IP Camera, my current Web UI version number for this IP Camera brand and model is 6.6.6, it seems like it's missing a digit?" ::). After awhile, it becomes humorous with so many IP Camera clones out there. It took me 6 months working with Chinese suppliers to get the best quality cameras at the cheapest prices. So, it's time to be happy after all that hard work.

I mean "Come On" 8) everyone else has their own IP Camera brand :P. After all, the bottom of the camera only says "IP Camera" and only has the CE, FCC and RoHS logos and lists the free DDNS. Who would know?

Mom, I finally made it! My name in lights! ("Well, no reason to tell her IR lights").

This way, you see my Logo Name, on the logon screen for every language that can be used for the camera in the new 0.2.9.13.bin custom Web UI version vs. simply "IP Camera" which is what was there instead, before making the change. My graphic arts skills are even worse than my Linux skills. So there really is little hope of me, by myself, creating a drop-dead gorgeous Web UI, anytime soon from scratch. Ah...So much for the new "TheUberOverLord Creations" IP Cameras taking over the world! :'(



This was all done, by using win_fostarn.exe. Note: You will not be able to see the download links for win_fostarn, in the links below, without being registered and logged in here:

http://www.openipcam.com/forum/index.php/topic,101.msg449/topicseen.html#msg449

http://www.openipcam.com/forum/index.php/topic,166.msg1019/topicseen.html#msg1019

win_fostarn.exe must be run from a Windows command window. It does not have a GUI interface.

It should also be noted that, win_fostarn.exe was also used to split the normal system firmware.bin file lr_cmos_0_37_2_47.bin into separate linux.zip and romfs.img files from the lr_cmos_0_37_2_47.bin system firmware version, used here as well.

This also means that if you have a copy of any system firmware release .bin file your IP Camera has used, you should be able to spilt that file info a linux.zip and romfs.img file using win_fostarn.exe and use the same methods show here, to bring your IP Camera back to life, using the system firmware files, meant for your IP Camera.

You however most likely, would want or need to know where the proper base memory address locations should be and what the execution addresses should be, for each of these two files, for you IP Camera. Prior to downloading these files into your IP Camera.

Firmware for other IP Cameras, as well as recovery instructions for other IP Cameras, can also be found here, in the files section:

http://www.openipcam.com/files/

The win_fostarn.exe instructions below, can and will be displayed, when running win_fostarn.exe without any runtime parameters:

Code: [Select]
C:>win_fostarn.exe

win_fostarn.exe is a special purpose archive utility written to extract and crea
te
the firmwarefiles use by the Foscam FI8908W cameras. win_fostarn.exe can be ran
in
any one of the four operating modes, described below:

CREATE a new WebUI Firmware file (-c, --create)

    The following options are only valid when creating a WebUI file:

    --version=#.#.#.#     the version for the created file (# = 0-255)
    -o, --old             choose old file format
    --prefix=<path>       an alternate path prefix for the contents of
                          the newlycreated file.  ** USE WITH CAUTION **
    --action=<command>    **DON'T USE THIS**
    <filename>            the file name of the file to create.
    <path>                the path to the directory with the files to be
                          assembled.  (Don't specify a trailing '/')

  Example:   win_fostarn.exe -c -v 2.4.8.13 test.bin webui_contents

EXTRACT the contents of the WebUI firmware file (-x, --extract)

    The following arguments are needed when extracting a WebUI file:

    <filename>            the file name of the firmware file to extract.
    <path>                the path to an existing directory where the files
                          will be written to.(Don't specify a trailing '/')

  Example:   win_fostarn.exe -x 2.4.8.12.bin webui_contents

PACK a new system firmware file (-k, --pack)

    These options and argument are needed when packing a new system fw file:

    --linux=<image>       the linux image to include in the firmware file.
    --romfs=<image>       the romfs image to include in the firmware file.
    <filename>            the file name of the firmware file to create.

  Example:   win_fostarn.exe -k -l linux.bin -r romfs.img lc_cmos_11_14_1_46.bin


UNPACK system fw file into linunx.bin and romfs.img (-u, --unpack)

    The following argument is needed when unpacking a system fw file:

    <filename>            the name of the firmware file to extract.

  Example:   win_fostarn.exe -u lc_cmos_11_14_1_46.bin

*** REMEMBER! ALWAYS KEEP A BACKUP OF YOUR ORIGINAL FIRMWARE ***
*** I AM NOT RESPONSIBLE FOR YOU TURNING YOUR CAMERA INTO A PAPERWEIGHT ***

So as you can see, you can also use your IP Camera as a mini web server. You could add things to the IP cameras Web UI that have nothing to do with the IP camera and simply use it to serve web pages while it also is doing normal IP Camera tasks. The IP camera does have limited memory however, but this can be done, as you can see by this example. The camera functions as it has, the normal IP Camera Web UI has not been altered or impacted by customizing the Web UI firmware, in this example.

Don't like your IP Cameras Web UI. No problem, change it!

You can replace the custom version of the Web UI firmware at anytime, by installing the stock Web UI firmware version included in the .zip file here or by installing any other Web UI firmware version.

So, now that you got your paperweight back to life. Maybe it's time to celebrate, by making your IP Camera do things, it never could before as well? Maybe even, just make it look better, while it's doing what it normally does? Create your own IP Camera Brand *Cough*.

Other posts here, the Wiki as well as the files sections, have an abundance of information and extensive details, source code, tools and documentation on the magic that goes on inside many different IP cameras. This is simply one of many examples that can be found here.

Don

About Me: http://airforce.togetherweserved.com/sbv/TheUberOverLord
« Last Edit: January 05, 2013, 12:09:44 pm by TheUberOverLord »

  • No avatar
  • *****
January 05, 2013, 09:39:56 pm
Nicely documented.  Made into a sticky post.

February 03, 2013, 05:18:05 am
Oh man, what a great job you've done
Thumbs up! Thanks!

April 09, 2013, 05:51:33 pm
Wow, I wish I understood half of that as it would of been realy usefull as I suspect the ebay clone I've just bought http://www.ebay.co.uk/itm/Internet-Wifi-Wireless-IP-CCTV-Remote-Security-Camera-Home-System-DVR-Recording-/250989575465?pt=UK_CCTV&hash=item3a7024fd29 is the same as what you bulk buy. Also the same these ebay listings:
250987931734
170918778521
230815331244
270992244861

It works,just not how its supposed to and I got no idea what Foscam firmware/web UI versions are compatible with it !.

Peter

  • *****
April 10, 2013, 04:17:28 pm
... I got no idea what Foscam firmware/web UI versions are compatible with it !...

Answer, none. The WebUI would probably work but possibly not all functions - ditti for the kernel although it is more dubious and romfs is VERY unlikely to work. Subtle hardware differences, especially around the sensor makes cross-brand compatibility virtually nil.

April 18, 2013, 05:12:17 pm
Hello\
Can you please help me with jtag part, when I connect the uart to ipcam logicboard and open terminal all that shows are weird symbols and charters like '' -; not the bootloader... please any idea what I am doing wrong.

  • ***
April 18, 2013, 06:03:06 pm
Hello\
Can you please help me with jtag part, when I connect the uart to ipcam logicboard and open terminal all that shows are weird symbols and charters like '' -; not the bootloader... please any idea what I am doing wrong.

What are your settings for Baud rate, Data bits, Stop bits, Parity, Flow control?

Generally. The wrong settings, can cause these types of issues.

Example:



Don
« Last Edit: April 18, 2013, 07:43:48 pm by TheUberOverLord »

April 18, 2013, 08:24:12 pm
Yes it was the setting thanks man..
I notice when it keeps rebooting it says this
can not resolve ntp server time.nist.govs  over and over again

  • ***
April 18, 2013, 08:31:41 pm
Yes it was the setting thanks man..
I notice when it keeps rebooting it says this
can not resolve ntp server time.nist.govs  over and over again
You are very welcome.

This can be the case. However, in some cases you will see this error and afterwards the ntp server connection will work without informing you that it was resolved. So, it's not a fatal error in all cases.

Don

April 19, 2013, 08:07:30 am
Hey Don ( Thanks for the help )
When I press esc to debug it do anything the bootloader, I have a FI8918W with a reboot loop, and I was wondering would the files above work with my cam, it doesn't really matter because I can't get into debug to flash..
Thanks in advance
juna

April 19, 2013, 08:53:32 am
Hey  never mind the last question, I got into bootloader
But in bootloader when I try to send file image, it doesn't transfer the file it stay on 0% it will send the file when raw binary is selected

  • ***
April 19, 2013, 09:43:15 am
Hey  never mind the last question, I got into bootloader
But in bootloader when I try to send file image, it doesn't transfer the file it stay on 0% it will send the file when raw binary is selected
You are very welcome.

Why not use ClearTerminal. The free tool, that I use in this example?

http://www.clearconnex.com/content/clearterminal

It works without any need to select file type.

Note: The firmware files are raw binary and need to be uploaded to the camera as such.

Don
« Last Edit: April 19, 2013, 09:47:42 am by TheUberOverLord »

April 19, 2013, 09:45:44 am
That is the one I am using, when I hit file to send, it gets stuck
Thanks Don
Will your romfs.img  file work with cam
« Last Edit: April 19, 2013, 09:48:05 am by juna1103 »

  • ***
April 19, 2013, 09:47:01 am
That is the one I am using, when I hit file to send, it gets stuck
Thanks Don
You are very welcome.

ok. So, it works with raw binary selected, correct?

Don
« Last Edit: April 19, 2013, 09:49:24 am by TheUberOverLord »

  • ***
April 19, 2013, 10:33:53 am
Yes raw did,  but when I did that the camera dosen't full reboot, it goes into bootloader, but the camera doesn't move around like it use to

What firmware did you use and did you place it in the proper place and use any setting and offsets that you saw, prior to installing it?

More importantly. Did you note these firmware locations and settings and any offsets, prior to installing the new firmware?

Example:

Code: [Select]
bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.zip base:0x7F020000 size:0x000AE000 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0D0000 size:0x000FC800 exec:0x7F0D0000 -a

bootloader >

Don
« Last Edit: April 19, 2013, 10:36:35 am by TheUberOverLord »