News:

Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at http://www.computersolutions.cn/blog

Author Topic: FOSCAM FI8919W  (Read 19439 times)

March 10, 2011, 02:20:37 am
Hello .. I bought a camera Fosca 8918 / / / please help change the web interface, I want to add the Russian language in the control of the camera ..... tried to unzip the firmware writes an error about the size of the file, but I managed to unpack 2.4.8.12.bin but this firmware is not installed in the camera??

  • No avatar
  • *****
March 10, 2011, 01:31:09 pm
The webui is in a hidden partition on the camera.
If you have access to the bootloader via serial, you can reflash webui.

Alternately, you can use the Windows Tools to reflash.

Instructions are here - http://www.openipcam.com/files/Manuals/How%20to%20check%20and%20upgrade%20your%20cameras%20system%20firmware%20version%20or%20Web%20UI%20version.xls

Software required to do that is here - http://www.openipcam.com/files/Software/
Download the IPCam Find or IPCam Tool software, scan for viruses (I use Mac, so haven't checked the Windows ones), and then run.

They should in theory find the camera, and you can flash the webui.

I have a lot of firmware here - http://www.openipcam.com/files/Firmware/

I've made a new subfolder called webui, might start populating that a bit.

The webui is really just a tar file with a header though. 

Here's an example:  aw_4_3_3_39.bin available here - http://www.openipcam.com/files/Firmware/webui/aw_4_3_3_39.bin

Numbering is little endian.
Header is in 16 bytes, with 4 sections of 4 bytes each.

Header of WebUI is as follows    (example bytes in Hex)
Header    0x00 0x01 0x02 0x03 :  BD 9A 0C 44  = Identification Header (in lieu of any other use I can think of..)
CRC32     0x04 0x05 0x06 0x07 :  5E B6 A5 02  = CRC32 http://en.wikipedia.org/wiki/Cyclic_redundancy_check
Filesize  0x08 0x09 0x0A 0x0B :  4D DC 06 00  = 449613 bytes
WebUI Ver 0x0C 0x0D 0x0E 0x0F :  04 03 03 27  = 4.3.3.39

Lawrence.


March 14, 2011, 08:30:56 am
Finally, I did it .. restored my camera 8918 .. all thanks for the help!
now only left to do what I wanted from the beginning ...,,, if anyone can help please write,,, I can not change the firmware web server, I need to add the Russian language in the interface control the camera .... but I can `t unpack it ... please help .... this is a link to the firmware ---http://www.openipcam.com/files/Firmware/Foscam/FI8918%20FI8918W%20sw%20upgrade%20package.rar

March 14, 2011, 02:58:48 pm
Yes I have access to botloader. I made ​​a converter and a data cable from a cell phone based on pl2303 chip, I did the firmware of their cameras so ... downloaded from the site Fosca origenalnuyu firmware and I managed to unpack. bin file, I got two files linuks.zip and rumfs.Img . I flashed them and the camera at me again earned ........ but! my problem in another,I need to unpack ---- make changes - and then pack ... bin file for the Web interface, but with fostar.C I nepoluchaetsya unzip it writes an error about the file size, although bin file unpacks the root without any problems? ??

  • No avatar
  • *****
March 14, 2011, 10:56:39 pm
I explain above how the webui is built.

Once again -

Header of WebUI is as follows    (example bytes in Hex)
Header    0x00 0x01 0x02 0x03 :  BD 9A 0C 44  = Identification Header (in lieu of any other use I can think of..)
CRC32     0x04 0x05 0x06 0x07 :  5E B6 A5 02  = CRC32 http://en.wikipedia.org/wiki/Cyclic_redundancy_check
Filesize  0x08 0x09 0x0A 0x0B :  4D DC 06 00  = 449613 bytes
WebUI Ver 0x0C 0x0D 0x0E 0x0F :  04 03 03 27  = 4.3.3.39

The file then follows in TAR format.




March 15, 2011, 05:19:16 am
I do not understand how to unpack and pack and flash the camera, I do not see any BIOS file in botloader,,

March 15, 2011, 08:17:09 am
Header of WebUI is as follows    (example bytes in Hex)
Header    0x00 0x01 0x02 0x03 :  BD 9A 0C 44  = Identification Header (in lieu of any other use I can think of..)
CRC32     0x04 0x05 0x06 0x07 :  5E B6 A5 02  = CRC32 http://en.wikipedia.org/wiki/Cyclic_redundancy_check
Filesize  0x08 0x09 0x0A 0x0B :  4D DC 06 00  = 449613 bytes
WebUI Ver 0x0C 0x0D 0x0E 0x0F :  04 03 03 27  = 4.3.3.39


That matches with what I have figured out on mine (a EasyN model). I do wonder if the header is checked / enforced anywhere other than through the web interface. The webui header for mine specifies an incorrect length, it works though, probably because the last files header is within the specified file length. Haven't checked the CRC, but I would not be surprised if it was also off.
« Last Edit: March 15, 2011, 08:27:40 am by Nocturnal »

March 15, 2011, 10:06:27 am
What should I do? How do I unpack and pack this WebUI?

March 15, 2011, 10:16:00 am
q@ubuntu:~$ ./fostar -x 2.4.18.15.004.bin ./123/
***      REMEMBER! ALWAYS KEEP A BACKUP OF YOUR ORIGINAL FIRMWARE       ***
*** I AM NOT RESPONSIBLE FOR YOU TURNING YOUR CAMERA INTO A PAPERWEIGHT ***
***              USE OF THIS SOFTWARE IS AT YOUR OWN RISK               ***
***                                                                     ***
***           If you don't agree to this, press 'Ctrl+C' now.           ***

Disassembling firmware file '2.4.18.15.004.bin' to './123/'
File size doesn't match that reported in the header: 1141676733/834358
q@ubuntu:~$

  • No avatar
  • *****
March 15, 2011, 01:28:12 pm
Sergot, as you're persistent on this, I've written a very quick unpacker for you (mostly ripped from Irish Jesus's code).


Copy the code below.
Call it extractwebui.c

Save it, then
Code: [Select]
gcc extractwebui.c -o extractwebui to compile

Usage

./extractwebui  somewebuifile.bin  .

(to extract a webui file to the current folder)

 
Code: [Select]
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <dirent.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <getopt.h>


/* Extract a Webui fileset from a ipcam
   Author Lawrence Sheed
   Based on Foscam.c (Irish Jesus), which in turn was based on Lawrence's work ;)
   
   This does *very* basic checking on the input file, so make sure you have an actual webui file to extract!

 */

static struct option long_options[] = {{"extract", no_argument, 0, 'x'}};
char *g_file;
char *g_path;


int disassemble(char *org_file, char *dst_path) {
FILE *f = NULL;
int len = 0, type = 0, filesize=0,fs=0;
char webui[4];
char src_file[512], dst_file[512], *data = NULL;
int max_data = 0;

//Open File
if ( (f = fopen(org_file, "rb")) == NULL) {
fprintf(stderr, "Unable to open file: %s\n", org_file);
exit(-1);
}

//Get size
fseek(f, 0, SEEK_END);
        fs = ftell(f);
        rewind (f);

//Seek past header and crc
fseek(f, 8, SEEK_SET);
//Get filesize
fread(&filesize, 1, 4, f);
//Get webui version
fread(&webui,1,4,f);

fprintf (stdout, "FileSize: %d\n", filesize);
fprintf (stdout, "WebUI Version %u.%u.%u.%u\n\n", webui[0], webui[1], webui[2],  webui[3]);

if (filesize != fs) {
fprintf (stderr, "** Warning Filesize doesn't match header, exiting **\n\n");
exit(-1);
}

fprintf(stdout, "Disassembling firmware file '%s' to '%s'\n", org_file, dst_path);


while(!feof(f)) {
memset(src_file, 0, sizeof(src_file));
memset(dst_file, 0, sizeof(dst_file));

fread(&len, 1, 4, f); // read filename length
fread(src_file,1,len,f); // read filename
sprintf(dst_file, "%s%s", dst_path, src_file);

type = 0;
fread(&type, 1, 1, f); // read entry type
if (type == 0) {
if (mkdir(dst_file, 0770) != 0) {
fprintf(stderr, "Unable to write file: %s", dst_file);
exit(-1);
}
} else if (type == 1) {
FILE *f2 = fopen(dst_file, "wb");
if (f2 == NULL) {
fprintf(stderr, "Unable to write file: %s", dst_file);
exit(-1);
}

fread(&len, 1, 4, f); // read data length
if (len > max_data) {
data = realloc(data, len);
max_data = len;
if (data == NULL) {
fprintf(stderr, "Unable to allocate  data necessary to extract file.  Requested: %d bytes.\n", len);
exit(-1);
}
}
fread(data,1,len,f);

fprintf(stdout, "Extracting %s (%d bytes)...\n", src_file, len);
fwrite(data, 1, len, f2);
fclose(f2);
}
}

fclose(f);
free(data);
return 0;
}


int main(int argc, char **argv) {


int option_index = 0;
int tmp[4];
int c = getopt_long(argc, argv, "x", long_options, &option_index);

if (optind == (argc - 2)) {
g_file = strdup(argv[optind++]);
g_path = strdup(argv[optind++]);
disassemble(g_file, g_path);
}
else {
fprintf(stderr, "Usage:  extractwebui filename folder\n");
fprintf(stderr, "eg extractwebui  aw_3_0_5.bin .\n");
exit(-1);
}

}


Direct URL for the Foscam and other ARM7 Camera WebUI unpacker is here - http://www.openipcam.com/files/Reverse%20Engineering/extractwebui.c
« Last Edit: March 15, 2011, 02:27:12 pm by admin »

March 16, 2011, 01:48:43 am
Thank you very much .... The file unpacks :)
 How to pack? (I tried to pack with the help of fostar but when loaded into the camera gives an error ... :'(

  • No avatar
  • *****
March 16, 2011, 02:38:11 am
Packing I didn't write.

Can write one, basically you need to follow the file structure as I laid out.

Header  x 16 bytes
4 byte header
4 byte crc (need to calculate this)
4 byte file version value

Then repeated for each file

Filename Size x 4 bytes
FileName (length from above field)
Type of File 1 byte (folder, file 0, 1..)
Length of File 4 bytes
File (length from above field)

March 16, 2011, 01:20:25 pm
I don `t know this ....... I can `t write this ...... if you can help me please?

March 16, 2011, 08:32:20 pm
Packing I didn't write.

Can write one, basically you need to follow the file structure as I laid out.

Header  x 16 bytes
4 byte header
4 byte crc (need to calculate this)

I have been working on a pack program and the only tricky part is the CRC calculation (if that's what it is). I've taken existing files and compared those bytes to a 32-bit CRC calculated a few different ways -- the entire file with the CRC zeroed out, everything after the first 12 bytes, everything after the first 16 bytes, everything after the first 8 bytes, just the contents of the files. None of these agree with what's in the file. Does anyone have any insight into how this is calculated?

Solving this question would be a quantum leap, as then it would be a trivial matter to replace the user interface on the webcam with one of your creation.

Thanks.

  • No avatar
  • *****
March 16, 2011, 09:16:46 pm
Don't forget, you need to reverse the byte order.
I just noticed something interesting regarding the header


Quote
0x00000000: bd 9a 0c 44

http://www.openipcam.com/forum/index.php?topic=43.0

Code: [Select]
005c34:  440c9abd strmi r9, [ip], -#2749
Its our header value -  bd 9a 0c 44!

I guess I need to take a look at what piece of code loads values from 0x5c34 in the disassembly I made at some point..