News:

Re-organized the forum to more cleanly delineate the development section, as the end user support side appears to have taken a life of its own!

Author Topic: WansView NC541/W IP-Camera  (Read 36789 times)

  • *****
April 23, 2011, 05:15:55 pm
I purchased a Wansview model NC541/W IP Camera specifically for hacking. I chose it because I don't want to hack my Foscam and the Wansview NC541/W was a bit cheaper - giving me a camera that I didn't mind messing up, or at least didn't mind too much. Wansview model NC541/W is physically very similar to the FOSCAM FI8908W.The webui is inferior to Foscam's, in my opinion. While the Foscam works well with Firefox and Chrome browsers, the Wansview has very poor support for anything other than Internet Explorer.

Photographs of the Wansview model NC541/W mainboard can be viewes at:
http://www.flickr.com/photos/23036115@N03/sets/72157626561497692/

I connected a serial port to the JTAG and the following is some of the output:
Code: [Select]
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

        MAC Address         : 00:B8:00:00:68:D2
        IP Address          : 0.0.0.0
        DHCP Client         : Enabled
        CACHE               : Enabled
        BL buffer base      : 0x00300000
        BL buffer size      : 0x00100000
        Baud Rate           : -1
        USB Interface       : Disabled
        Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode .

bootloader > h

W90P745 Command Shell v1.0 Rebuilt on May 06 2010 at 13:00:07

H        Display the available commands
B        Set Baud Rate
D        Display memory. D -? for help
E        Edit memory. E -? for help
G        Goto address
I        information
MX       Xmodem download
MT       TFTP/USB download
FT       Program the flash by TFTP/USB. FT -? for help
FX       Program the flash by Xmodem. FX -? for help
CP       Memory copy
LS       List the images in the flash
SET      Setting boot loader configuration. SET -? for help
CHK      Check the flash
RUN      Execute image
DEL      DEL the image or flash block
MSET     Fill memory
TERM     Change the terminal output port
BOOT     Reboot the system
CACHE    Cache setting
USB      USB interface setting
UNZIP    Unzip image
ATTRIB   Change the image attribution
INTF     Print bootloader supported interface, ether USB or MAC
bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.bin base:0x7F020000 size:0x000BFE5C exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0E0000 size:0x0010C400 exec:0x7F0E0000 -a

bootloader > d 0x7f020000
Displaying memory at 0x7F020000
[7F020000] 04034B50 00020014 - 43E50008 983B3D86  PK.........C.=;.
[7F020010] FDE8192B 8D30000B - 00090019 696C0000  +.....0.......li
[7F020020] 2E78756E EC6E6962 - 547C7DFD 8E07BD47  nux.bin..}|TG...
[7F020030] 6487D9CF 79385B09 - 72A436EC 34A6B480  ...d.[8y.6.r...4
[7F020040] B6900F6D 14B2D314 - 2ED0515A B1516D0F  m.......ZQ...mQ.
[7F020050] A8AD2DA6 1515A6D4 - 24DDB4BD A062909B  .-.........$..b.
[7F020060] 6943C201 7A2DACDA - 54578BD1 DE8AC5EA  ..Ci..-z..WT....
[7F020070] 4AC5502D DED45A2D - 6EECF55A 5459098E  -P.J-Z..Z..n..YT
[7F020080] 6D62F454 7BF7DFBB - 49BB3666 DEF70FA9  T.bm...{f6.I....
[7F020090] C7F7F7EF 6618BCCF - F3399CCF D3CF99F8  .......f..9.....
[7F0200A0] 2233E67C 693E4F11 - 882FD3C6 9A9C5A78  |.3".O>i../.xZ..
[7F0200B0] 3C8BAC94 B29A6A94 - E3845075 31B880E9  ...<.j..uP.....1
[7F0200C0] 37B70BE9 CECD9ABC - 5CFAB5AA 4FB87561  ...7.......\au.O
[7F0200D0] 3D67C85A F1BD8AE8 - 1886F5F4 2D539F0A  Z.g=..........S-
[7F0200E0] 8B56958E 88D5DFE6 - 344588A3 E6E98C24  ..V.......E4$...
[7F0200F0] C8850BF4 DD2B3108 - 49DEE22C 2E5C9442  .....1+.,..IB.\.

bootloader >
                                                                                                 


Normal boot output is:
Code: [Select]
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010

Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes

Board designed by Winbond

Hardware support provided at Winbond

Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.

Boot Loader Configuration:

MAC Address         : 00:B8:00:00:68:D2

IP Address          : 0.0.0.0

DHCP Client         : Enabled

CACHE               : Enabled

BL buffer base      : 0x00300000

BL buffer size      : 0x00100000

Baud Rate           : -1

USB Interface       : Disabled

Serial Number       : 0xFFFFFFFF

For help on the available commands type 'h'

Press ESC to enter debug mode ......

Cache enabled!

Processing image 1 ...

Processing image 2 ...

Processing image 3 ...

Processing image 4 ...

Processing image 5 ...

Processing image 6 ...

Processing image 7 ...

Unzip image 7 ...

Executing image 7 ...

Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #1453 Ò» 12ÔÂ 6 08:30:46 CST 2010

Processor: Winbond W90N745 revision 1

Architecture: W90N745

On node 0 totalpages: 4096

zone(0): 0 pages.

zone(1): 4096 pages.

zone(2): 0 pages.

Kernel command line: root=/dev/rom0 rw

Calibrating delay loop... 39.83 BogoMIPS

Memory: 16MB = 16MB total

Memory: 14320KB available (1481K code, 299K data, 40K init)

Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)

Inode cache hash table entries: 1024 (order: 1, 8192 bytes)

Mount-cache hash table entries: 512 (order: 0, 4096 bytes)

Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)

Page-cache hash table entries: 4096 (order: 2, 16384 bytes)

POSIX conformance testing by UNIFIX

Linux NET4.0 for Linux 2.4

Based upon Swansea University Computer Society NET3.039

Initializing RT netlink socket

Starting kswapd

PTZ Driver has been installed successfully.

Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled

ttyS00 at 0xfff80000 (irq = 9) is a W90N745

Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options enabled

ttyS00 at 0xfff80100 (irq = 10) is a W90N7451

I2C Bus Driver has been installed successfully.

Blkmem copyright 1998,1999 D. Jeff Dionne

Blkmem copyright 1998 Kenneth Albanowski

Blkmem 1 disk images:

0: 7F0E0000-7F1EC3FF [VIRTUAL 7F0E0000-7F1EC3FF] (RO)

S29GL032N Flash Detected

01 eth0 initial ok!

which:0

PPP generic driver version 2.4.2

Linux video capture interface: v1.00

Winbond Audio Driver v1.0 Initialization successfully.

usb.c: registered new driver hub

add a static ohci host controller device

: USB OHCI at membase 0xfff05000, IRQ 15

hc_alloc_ohci

usb-ohci.c: AMD756 erratum 4 workaround

hc_reset

usb.c: new USB bus registered, assigned bus number 1

hub.c: USB hub found

hub.c: 2 ports detected

usb.c: registered new driver audio

audio.c: v1.0.0:USB Audio Class driver

usb.c: registered new driver serial

usbserial.c: USB Serial Driver core v1.4

 _____     ____    _    ____

|__  /   _|  _ \  / \  / ___|

  / / | | | | | |/ _ \ \___ \

 / /| |_| | |_| / ___ \ ___) |

/____\__, |____/_/   \_\____/

     |___/

ZD1211B - version 2.24.0.0

usb.c: registered new driver zd1211b

main_usb.c: VIA Networking Wireless LAN USB Driver 1.20.04

usb.c: registered new driver vntwusb

usb.c: registered new driver rt73

dvm usb cam driver 0.0.0.1 by Maverick Gao in 2010-8-3

usb.c: registered new driver dvm

dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20

usb.c: registered new driver dvm usb cam driver for sonix288

NET4: Linux TCP/IP 1.0 for NET4.0

IP Protocols: ICMP, UDP, TCP

IP: routing cache hash table of 512 buckets, 4Kbytes

TCP: Hash tables configured (established 1024 bind 2048)

VFS: Mounted root (romfs filesystem) readonly.

Freeing init memory: 40K

BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)

BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)

Shell invoked to run file: /bin/init

Command: mount -t proc none /proc

Command: mount -t ramfs none /usr

Command: mount -t ramfs none /swap

Command: mount -t ramfs none /var/run

Command: mount -t ramfs none /etc

Command: mount -t ramfs none /flash

Command: mount -t ramfs none /home

Command: mount -t ramfs none /tmp

Command: mkdir /tmp/run

Command: camera&

[8]

Command: sh

no support

Sash command shell (version 1.1.1)

/> /> hub.c: connect-debounce failed, port 1 disabled

new USB device :80fb4004-fed740

hub.c: new USB device 1, assigned address 2

probing sonix288 usb camera ...

dvm camera registered as video0

p1[7]:1,j 3,config->bNumInterfaces:4

usbaudio: device 2 audiocontrol interface 2 has 1 input and 0 output AudioStreaming interfaces

usbaudio: valid input sample rate 16000

usbaudio: device 2 interface 3 altsetting 1: format 0x00000010 sratelo 16000 sratehi 16000 attributes 0x01

usbaudio: valid input sample rate 48000

usbaudio: device 2 interface 3 altsetting 2: format 0x00000010 sratelo 48000 sratehi 48000 attributes 0x01

usbaudio: registered dsp 14,35

usbaudio: warning: found 1 of 0 logical channels.

usbaudio: assuming the channel found is the master channel (got a Philips camera?). Should be fine.

usbaudio: registered mixer 14,32

usb_audio_parsecontrol: usb_audio_state at 00ff3c60

new USB device :80fb4404-fed740

hub.c: new USB device 2, assigned address 3

idVendor = 0x148f, idProduct = 0x2573

sw version is 21.22.2.36

aw version is 0.7.4.4

Wait for auto-negotiation complete...

ResetPhyChip Failed

/>

/> video0 opened

1

1

1

1

1

1

unknown command

do_zoom_stop: write error 5

__pthread_initial_thread_bos:440000

manage pid:16

h

h: Bad command or file name

/> audio_dev.state not AU_STATE_RECORDING

wb_audio_start_record

=> usb_rtusb_open

[29]

update_smarteye_ddns: can not get server www.nwsvr.com ip

ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip

bonjour callback: service registered

ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip

ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip

3

3

3

3

3

3

ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip

/> ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip

ntpc adjust ok

Apr 23 19:06:43 2011 bonjour: mDNSPlatformRawTime went backwards by 863195658 ticks; setting correction factor to 214442231

Apr 23 19:06:43 2011 bonjour: mDNS_FinalExit failed to send goodbye for: 00FCC5C8 01   59 _http._tcp.local. PTR ipcamera(id:00B8000068D2,\032alias:002bxaf)._http._tcp.local.

update_smarteye_ddns: update ddns ok

bonjour callback: service registered

  • No avatar
  • *****
April 24, 2011, 02:42:20 am
Correction - you connected a serial port to the Serial connection.


JTAG is completely different.
JTAG is necessary if you want to rewrite the chip bootloader.


You have a 4M flash, otherwise looks pretty standard.
« Last Edit: April 24, 2011, 02:45:01 am by admin »

  • *****
April 28, 2011, 07:30:13 pm
In my continuing quest with a Wansview corrupt NC541/w camera, I just received a second camera. I have left this camera "as-is", except that I removed the bottom plate and soldered on my FTDI USB to serial UART (FT232BM/BL)  serial port adapter. 

Next, I used the .NET FoscamCloneRecovery program in an XP VirtualBox to suck out the factory fresh linux and romfs images.

I then transferred my  my FTDI serial port adapter back to the  corrupt NC541/w camera and, again with XP in a VirtualBox, used HyperTerminal tp load the newly acquired romfs and new webui back into the corrupt  NC541/w camera with:

fx 6 romfs.img 0x7F0E0000 0x7F0E0000 -a

fx 8 webui 0x7f200000 0x7f200000 -a

del b31

The camera now boots correctly but I was unable to login with either the default password or what I had changed it to. I pressed and held the reset button on the camera to reset to factory settings and, after seeing the reset to factory settings on the serial port, rebooted again. I still cannot login - my credentials are rejected. At this point everything is running, including the webui, but I cannot login!

I don't know what the "Factory Reset" really did because some parameters were retained. For example, I had changed the camera to patrol upon boot (the factory default was no patrol), yet now that the romfs and webui have been brute force replaced, the patrol remains active.

Ideas?

By the way, I chose to not make the webui invisible:

bootloader > ls

Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af

Image: 7 name:linux.bin base:0x7F020000 size:0x000BFE5C exec:0x00008000 -acxz

Image: 6 name:romfs.img base:0x7F0E0000 size:0x0010C400 exec:0x7F0E0000 -a

Image: 8 name:webui base:0x7F200000 size:0x000A5600 exec:0x7F200000 -a

Code: [Select]
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

        MAC Address         : 00:B8:00:00:68:D2
        IP Address          : 0.0.0.0
        DHCP Client         : Enabled
        CACHE               : Enabled
        BL buffer base      : 0x00300000
        BL buffer size      : 0x00100000
        Baud Rate           : -1
        USB Interface       : Disabled
        Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #1453 �һ 12�� 6 08:30:46 CST 2010
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 4096
zone(0): 0 pages.
zone(1): 4096 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 16MB = 16MB total
Memory: 14320KB available (1481K code, 299K data, 40K init)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
PTZ Driver has been installed successfully.
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80100 (irq = 10) is a W90N7451
I2C Bus Driver has been installed successfully.
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0E0000-7F1EC3FF [VIRTUAL 7F0E0000-7F1EC3FF] (RO)
S29GL032N Flash Detected
01 eth0 initial ok!
which:0
PPP generic driver version 2.4.2
Linux video capture interface: v1.00
Winbond Audio Driver v1.0 Initialization successfully.
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver audio
audio.c: v1.0.0:USB Audio Class driver
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4

 _____     ____    _    ____
|__  /   _|  _ \  / \  / ___|
  / / | | | | | |/ _ \ \___ \
 / /| |_| | |_| / ___ \ ___) |
/____\__, |____/_/   \_\____/
     |___/
ZD1211B - version 2.24.0.0
usb.c: registered new driver zd1211b
main_usb.c: VIA Networking Wireless LAN USB Driver 1.20.04
usb.c: registered new driver vntwusb
usb.c: registered new driver rt73
dvm usb cam driver 0.0.0.1 by Maverick Gao in 2010-8-3
usb.c: registered new driver dvm
dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20
usb.c: registered new driver dvm usb cam driver for sonix288
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: /bin/init
Command: mount -t proc none /proc
Command: mount -t ramfs none /usr
Command: mount -t ramfs none /swap
Command: mount -t ramfs none /var/run
Command: mount -t ramfs none /etc
Command: mount -t ramfs none /flash
Command: mount -t ramfs none /home
Command: mount -t ramfs none /tmp
Command: mkdir /tmp/run
Command: camera&
no support
[8]
Command: sh

Sash command shell (version 1.1.1)
/> hub.c: connect-debounce failed, port 1 disabled
new USB device :80fb4004-fed740
hub.c: new USB device 1, assigned address 2
probing sonix288 usb camera ...
dvm camera registered as video0
p1[7]:1,j 3,config->bNumInterfaces:4
usbaudio: device 2 audiocontrol interface 2 has 1 input and 0 output AudioStreaming interfaces
usbaudio: valid input sample rate 16000
usbaudio: device 2 interface 3 altsetting 1: format 0x00000010 sratelo 16000 sratehi 16000 attributes 0x01
usbaudio: valid input sample rate 48000
usbaudio: device 2 interface 3 altsetting 2: format 0x00000010 sratelo 48000 sratehi 48000 attributes 0x01
usbaudio: registered dsp 14,35
usbaudio: warning: found 1 of 0 logical channels.
usbaudio: assuming the channel found is the master channel (got a Philips camera?). Should be fine.
usbaudio: registered mixer 14,32
usb_audio_parsecontrol: usb_audio_state at 00ff3a80
new USB device :80fb4404-fed740
hub.c: new USB device 2, assigned address 3
idVendor = 0x148f, idProduct = 0x2573
sw version is 21.22.2.36
aw version is 0.0.4.17

Wait for auto-negotiation complete...OK
100MB - FULL
video0 opened
1
1
1
1
1
1
unknown command
do_zoom_stop: write error 5
__pthread_initial_thread_bos:440000
manage pid:16
2
2
2
2
2
2
audio_dev.state not AU_STATE_RECORDING
wb_audio_start_record
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth0
[28]
update_smarteye_ddns: can not get server  ip
ntpc adjust ok
Apr 28 23:26:18 2011 bonjour: mDNSPlatformRawTime went backwards by 404873332 ticks; setting correction factor to -810235423
bonjour callback: service registered
update_smarteye_ddns: can not get server  ip
update_smarteye_ddns: can not get server  ip
update_smarteye_ddns: can not get server  ip


- - - -UPDATE- - - -
I am really good at breaking these cameras. Just to be sure that making the webui visible was not causing my problem, I reloaded the webui with:
fx 8 webui.bin 0x7f200000 0x7f200000 -nofooter

No change. Next, I loaded the linux.bin extracted from the fresh camera -twice! Each time it fails with:
Code: [Select]
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...

ERROR: Prefetch Abort @ pc=0x00000010
bootloader >

Obviously I have missed a step. The Foscam image benins with BNEG while the image from FoscamCloneRecovery does not. Meanwhile, I tried loading foscam's linux.bin and get a flash write error.
« Last Edit: April 28, 2011, 09:14:46 pm by celem »

April 29, 2011, 06:00:20 am
Look at it like this. Your not breaking it so much as you are developing your skill set (sometimes that means learning what not to do).

You recall that memory map you asked me to post? Remember I listed user settings and factory settings as a part of it? replacing the linux.bin, romfs and webui will not change those blocks. Admin username and password should be right near the top (about 0x36 bytes in on mine). Of course, if you managed to delete those chunks, they are now probably all 0xFF, which could be tricky.

As to your other problem... this is what you should see

Quote
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...

So your camera appears to be failing to unzip the image. Check the linux.bin file you are uploading, the  first four bytes should be 0x50 0x4b 0x03 0x04, which is the header tag for a zip file. The second thing to try is to copy your linux.bin file somewhere else and rename it to linux.bin.zip, and then unzip it (it should unzip a new file called linux.bin).

If above works, your linux kernel image is fine. If it doesn't work, your linux image is not good.

April 30, 2011, 10:54:27 pm
Hi Celem,

A friend of mine bricked his camera using a Foscam firmware. I tried but I could not find the WansView NC541-W firmware anywhere. Could you post it or send it to me somehow?

Greatly appreciate it!

  • *****
May 03, 2011, 11:22:48 am
Finally, success with restoring my WansView NC541/W.

I obtained good firmware dumps using the kermit/jedit procedure outlined by Lawrence in the General/Firmware topic "Firmware Recovery - method #2", except that I found the recommended HexBin software unusable. I modified HexBin.c to only do hex to binary conversion, outputting to stdout, which I simply redirect to whatever filename that I desired (source attached to a reply to that topic). This method worked perfectly the first time, while Ramon van Bruggen's firmware download tool failed for me, producing a bad copy. Plus, method#2 has the benefit of being an all linux solution.

I loaded a good copy of linux.zip, romfs.bin and webui.bin for my wansview NC541/w ipcamera, as obtained via method #2. The system booted cleanly and the serial output indicated all was normal. The system went into its initial patrol when booted. When I attempt to login via the web I was presented with a login prompt. However, my attempts to login are rejected. The factory default login for the NC541W is id=admin, pw=123456, which is what this camera should be. I dumped the User Settings and Factory settings, as documented by nocturnal in the General Discussion post titled "Relating bootloader image number to flash sector?". They were:

Code: [Select]
bootloader > d 0x7f1f0000
Displaying memory at 0x7F1F0000
[7F1F0000] 440C9ABD 00003193 - 000014E8 38423030  ...D.1......00B8
[7F1F0010] 30303030 34353538 - 02161500 00000024  00008554....$...
[7F1F0020] 00000000 00000000 - 00000000 00000000  ................
[7F1F0030] 00000000 64610000 - 006E696D 00000000  ......admin.....
[7F1F0040] 00000000 00000000 - 00000000 00000000  ................
...

bootloader > d 0x7f1f8000
Displaying memory at 0x7F1F8000
[7F1F8000] 440C9ABD 00002D9F - 000014E8 00000000  ...D.-..........
[7F1F8010] 00000000 00000000 - 00000000 00000000  ................
[7F1F8020] 00000000 00000000 - 00000000 00000000  ................
[7F1F8030] 00000000 64610000 - 006E696D 00000000  ......admin.....
[7F1F8040] 00000000 00000000 - 00000000 00000000  ................
...

I then tried various combinations of id/pw for logging in and then decided to try admin without a password - voilà - that worked! Once logged in, I set the administrator login to admin/123456, the factory original, and rebooted. The display of the updated  User Settings and Factory settings are now:

Code: [Select]
bootloader > d 0x7f1f0000
Displaying memory at 0x7F1F0000
[7F1F0000] 440C9ABD 000032DD - 000014E8 38423030  ...D.2......00B8
[7F1F0010] 30303030 34353538 - 02161500 04000024  00008554....$...
[7F1F0020] 00000011 00000000 - 00000000 00000000  ................
[7F1F0030] 00000000 64610000 - 006E696D 00000000  ......admin.....
[7F1F0040] 31000000 35343332 - 00000036 00000000  ...123456.......
...

bootloader > d 0x7f1f8000
Displaying memory at 0x7F1F8000
[7F1F8000] 440C9ABD 00002D9F - 000014E8 00000000  ...D.-..........
[7F1F8010] 00000000 00000000 - 00000000 00000000  ................
[7F1F8020] 00000000 00000000 - 00000000 00000000  ................
[7F1F8030] 00000000 64610000 - 006E696D 00000000  ......admin.....
[7F1F8040] 00000000 00000000 - 00000000 00000000  ................
...

Interesting - the root password is in clear text! Also, the factory default was unaltered and remains at id=admin, pw=none.


FYI - here is my current image list:

Code: [Select]
bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.zip base:0x7F020000 size:0x000BFF00 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0E0000 size:0x0010C400 exec:0x7F0E0000 -a
Image: 8 name:webui.bin base:0x7F200000 size:0x000A5600 exec:0x7F200000 -a

April 20, 2013, 09:53:00 am
Hello celem
Maybe you can help me, I have a Foscam FI8918W and it's in a reboot loop, reboots over and over again.
Any in the bootloader just before the reboot happens it shows this error
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip

And it doesn't correct itself, then it says rebooting.. and happens all over again
Things I tried?
Upgraded frimware
down graded frimware
reset button