News:

Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at http://www.computersolutions.cn/blog

Author Topic: FOSCAM FI8919W  (Read 19438 times)

March 16, 2011, 11:33:10 pm
I've yet to think about ... all files that are archived because they are decompressed web when we load them in the camera's memory ..... so why they can not be downloaded directly into the chamber through port Ewart unpacked ... just need to know where they are stored there .... . I type the command "LS" in botloader but I do not see the Web is only 6-7.flesh (But if it is difficult then it will no

March 16, 2011, 11:53:19 pm
Generally, my idea to make a web interface for Aktion + adobe flash script (using this I understand) but I'm not to understand how to pack it in the camera ...

March 16, 2011, 11:56:54 pm
using adobe flash can make a digital zoom for camera and volume control from any browser that supports adobe flash ... (do not use active-x)

March 17, 2011, 04:27:22 am
Its our header value -  bd 9a 0c 44!

I guess I need to take a look at what piece of code loads values from 0x5c34 in the disassembly I made at some point..

See, 0x5b90. Subroutine starts at around 0x5b70. Of interest there is also this.

Code: [Select]
ROM:0000628C                 LDR     R2, =0x440C9ABD
ROM:00006290                 CMP     R3, R2
ROM:00006294                 BEQ     loc_6310
ROM:00006298                 ORR     R3, R5, #0xBD
ROM:0000629C                 STRB    R3, [R4,R12]
ROM:000062A0                 ORR     R3, R5, #0x9A
ROM:000062A4                 STRB    R3, [R4,LR]
ROM:000062A8                 ORR     R3, R5, #0xC
ROM:000062AC                 STRB    R3, [R4,R0]
ROM:000062B0                 ORR     R3, R5, #0x44
ROM:000062B4                 STRB    R3, [R4,R1]
ROM:000062B8                 ADD     R0, R4, #0xF90
ROM:000062BC                 ADD     R0, R0, #0xA
ROM:000062C0                 MOV     R1, R5

However, if looking for the checksum code (which I am), I think its likely being called somewhere near 0x67cc to 0x6844, where it looks like its reading the header for webui out of the flash.

Unfortunately my arm assembler is extremely weak, and I have only limited experience disassembling things, so I probably wouldn't recognise it even if I found it.

March 17, 2011, 07:08:45 am
the swf would have to reside on the camera and flash usually is pretty big. Trying to fit that in the 2MB flash, would be a challange. Kernel being 1MB, userland being say 500kb, leaves only 500kb for the webui (i'm just throwing some numbers around here, i'm guessing userland would be more like 700kb and the kernel more like 1.2MB laving 100kb for the webui )

See what the problem is?

Also flash is horrid! Isn't this all not possible via javascript and http (e.g. jquery) requests?

March 17, 2011, 08:35:58 am
WEBIU-2.4.18.15.004.bin=815k
swf flash.bin =700k

  • No avatar
  • *****
March 17, 2011, 08:44:00 am
Kernel is 1.3M (700-800kb compressed), decompresses into ram on boot.
WebUI is about 500kb mostly, especially if we dump the OCX!
Apps about 800kb.

On the 2M flash its tight, on 4M, plenty of room ;)


You can make the WebUI visible in the bootloader, but its been set to hidden in the default firmwares.

@Sergot

If you want to make the flash, I'll do the repack tool, and integrate.
You'll need to look at the current cgi implementations, and copy that for backward compatibility.

Sound like a plan?


« Last Edit: March 17, 2011, 08:53:10 am by admin »

March 17, 2011, 09:05:28 am
I'll be very happy! :)

April 04, 2011, 10:04:53 pm
Don't forget, you need to reverse the byte order.

Ah, that does it!
Not! (I'm just jerking your chain).

In case anyone looks in this thread, it turns out it's just a simple sum of the bytes. See here:
http://www.openipcam.com/forum/index.php/topic,72.0.html

  • No avatar
  • *
September 30, 2015, 09:05:13 pm
Admin, sorry for hijacking such an old thread but I've been searching all over the web for the location of the Web UI on the device (I'm customizing the init script and want to append some command out to the web pages/css/images to leak some information, I'm trying to cross compile some binaries for the ARM architecture and to figure out why they don't work I need to debug somehow, I don't want to statically customize the web pages so modifying the web ui firmare is not what I'm looking. I'm looking for the location of the web files on the disk).

After tons of searching, you're literally the only person on the net who seems to know where it is! You mention it's hidden, but do you know the path to the Web UI on the disk? I tried /var/www and the other common ones with no luck.

Unfortunately I don't have the equipment to get a serial connection, but I can now successfully pack custom firmware and upload to the device via the web interface.

My firmware is a x.37.2.x but after checking out the camera binary from several differnt versions it seems to me they are mostly the same.

Any help in locating these web files on the device would be greatly appreciated!! I currently have to debug blind :(