News:

Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at http://www.computersolutions.cn/blog

Author Topic: I deleted Image: 0 name:BOOT INFO. Could anyone send it to me.  (Read 33756 times)

April 27, 2011, 10:36:11 pm
I deleted Image: 0 name:BOOT INFO. I decided to delete Image 6 and typed "del" and then pressed Enter. I expected that "del" will show its parameters but it deleted Image 0. I think because "del" had no parameters. So I'm afraid to reboot camera till I can get that Image back. Can anyone send me that rom image it's only 0x38 lenght? I have FOSCAM clone compatible with FOSCAM official software.

Thanks in advance.


April 28, 2011, 02:10:49 am
This is what mine looks like, plus a little on either side.

Code: [Select]
0000fff0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00010000  48 00 00 00 01 00 00 00  00 a8 f8 00 5c a6 00 00  |H...........\...|
00010010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00010020  01 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  |................|
00010030  00 00 30 00 00 00 10 00  ff ff ff ff ff ff ff ff  |..0.............|
00010040  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|

Just hope that's all you deleted.

April 28, 2011, 04:24:08 am
 :D Noctural You are everywhere. Thanks in that post as well:) So, now I can restore Image 0. Hopefully there is no difference between Your BOOT INFO and mine.

Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af

We have different base addresses. Mine is 0x7F010000 and Yours starts from 00010000. Is that just offset in created by You file or real address?
« Last Edit: April 28, 2011, 04:32:43 am by moldov »

April 28, 2011, 04:53:22 am
:-) Thats the offset in the image I dumped from the cameras flash. Offset it by 0x7F000000 and you have the address inside the camera.

April 28, 2011, 08:15:52 pm
I restored my cam. Thanks again man:) I found the meaning for those bytes which are not zeroed in Image 0. 

0x10000 0x48 means begining of BOOT INFO
0x10008 goes Your MAC 00:A8:F8:00:5C:A6 So now I get Your Mac address:) Later I will change it with mine.
0x10020 0x01 means DHCP Client         : Enabled
0x10024 0x01 means CACHE               : Enabled
0x10032 0x30 means  BL buffer base      : 0x00300000
0x10036 0x10 means  BL buffer size      : 0x00100000

I don't know where is IP, Baud Rate and USB Interface bytes, but I think we can find during playing with bytes easily.

Serial number goes from 0x10038.

  • *****
April 28, 2011, 11:34:00 pm
I just did a DEL -all and reloaded everything EXCEPT image 0, the "BOOT INFO" image. After I booted image 0, the "BOOT INFO" was back, having been automatically rebuilt, I assume, by the bootloader.

« Last Edit: April 28, 2011, 11:56:14 pm by celem »

April 29, 2011, 05:06:33 am
celem,  what do You mean
Quote
After I booted image 0
Have You just rebooted the cam after DEL -all and then You've got BOOT INFO?

  • *****
April 29, 2011, 08:36:48 am
I did DEL -all to cure a flash write error, reloaded linux.zip, romfs.bin and webui.bin, rebooted and image 0 was there, filled with "BOOT INFO". I am fairly sure that, after the DEL -all, that I did an LS and saw nothing, meaning that it was truly deleted - but the hour was late. I do intend, in the next week, to do another DEL -all and carefully check that image 0 was actually deleted and that the range displays all "F"s with a memory display, prior to reboot.

April 29, 2011, 09:06:29 am
celem, I will try to del -all also. Just to be sure that BOOT INFO is self recoverable!

  • *****
April 29, 2011, 01:33:44 pm
The answer in NO - DEL -all does not delete image 0.

Code: [Select]
bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.zip base:0x7F020000 size:0x000BF700 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0E0000 size:0x0010C400 exec:0x7F0E0000 -a

bootloader > del -all
Press Ctrl-c to stop
Deleting ... Block 2
Deleting ... Block 3
Deleting ... Block 4
Deleting ... Block 5
Deleting ... Block 6
Deleting ... Block 7
Deleting ... Block 8
Deleting ... Block 9
...
Deleting ... Block 62
Deleting ... Block 63

bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af


April 29, 2011, 02:05:44 pm
Yeah, DEL -all doesn't delete Image 0. But simple DEL deletes:) All noobies need to be careful:) Anyway it's self recoverable.I  think we need to recover MAC address after deleting BOOT INFO. Because It becomes 00:00:00:00:00:01. There is SET command in bootloader but I couldn't find how to write MAC or IP address. I can change only 1 byte parameters like

 DHCP Client       : Enabled
 CACHE               : Disabled
 

April 29, 2011, 02:09:58 pm
ahhh....

set -ip0 10.0.3.200


April 29, 2011, 02:16:20 pm
Oh yeah.
I was typing 0xC0A80102 instead of 192.168.1.2 for ip. I'm getting more familiar with HEX 8)

  • *****
May 05, 2011, 11:34:26 pm
Here is the source code from the bootloader that creates an image 0 if none exists. All of the fields are defined:

Code: [Select]
STRUCTURE OF THE BOOT INFO BLOCK, BLOCK 0

flash.h
-------
typedef struct t_footer
{
UINT32 num;
UINT32 base;
UINT32 length;
UINT32 load_address;
UINT32 exec_address;
CHAR name[16];
UINT32 image_checksum;
UINT32 signature;
UINT32 type;
UINT32 checksum;
} tfooter;

bib.h
-------
#define BOOTLOADER_INFO 0x1
...
typedef struct _t_bootloaer_info
{
UINT32 length;
UINT32 type;
char mac0[6];
char ip0[6];
char mac1[6];
char ip1[6];
UINT32 cache;
UINT32 dhcp;
UINT32 net_mac;
UINT32 phy;
UINT32 buf_base;
UINT32 buf_size;
INT baudrate;
INT rmii; // RMII  = Ethernet port
} tbl_info;

flash.h
-------
#define FLASH_BLOCK_SIZE (0x10000) // 65,535
#define BOOTER_BLOCK_LENGTH FLASH_BLOCK_SIZE

platform.h
-------
#define FLASH_BASE 0x7F000000
...
#define BL_BOOTLOADER_BLOCK_SIZE 0x10000
#define BL_PHY NET_PHY
#define BL_IC_PLUS NET_IC_PLUS
#define BL_MARVELL6052 NET_MARVELL6052
#define BL_DEFAULT_MAC0_ADDR {0x00,0x00,0x00,0x00,0x00,0x01}
#define BL_DEFAULT_IP0_ADDR {0,0,0,0,0,0}
#define BL_DEFAULT_MAC1_ADDR {0x00,0x00,0x00,0x00,0x00,0x02}
#define BL_DEFAULT_IP1_ADDR {0,0,0,0,0,0}
#define BL_DEFAULT_BAUD_RATE 115200UL
#define BL_DHCP 0x1 // BL_DHCP=1 => dhcp default to enable
#define BL_NET_MAC 0x1 // default mac port used by TFTP
#define BL_DEFAULT_PHY_CHIP BL_PHY
#define BL_IMAGE0_BASE (FLASH_BASE+BL_BOOTLOADER_BLOCK_SIZE)
#define BL_BUFFER_BASE 0x300000
#define BL_BUFFER_SIZE 0x100000
#define BL_CACHE_DEFAULT 0x1
#define SEMI_HEAP_SIZE 0x20000
#define SEMI_STACK_SIZE 0x20000


main.c
-------
...
if( !FindImage(0, &footer) )
{
// image 0 not exist. Create it.
tfooter image_footer;
CHAR mac0[6]=BL_DEFAULT_MAC0_ADDR;
CHAR ip0[6]=BL_DEFAULT_IP0_ADDR;
CHAR mac1[6]=BL_DEFAULT_MAC1_ADDR;
CHAR ip1[6]=BL_DEFAULT_IP1_ADDR;
...
// make sure the block 1 is empty.
DelBlock(1);
info.length=sizeof(info);
info.type=BOOTLOADER_INFO;
memcpy(info.mac0, mac0, 6);
memcpy(info.ip0, ip0, 4);
memcpy(info.mac1, mac1, 6);
memcpy(info.ip1, ip1, 4);
ip0[4]=ip0[5]=ip1[4]=ip1[5]=0;
info.cache=BL_CACHE_DEFAULT;
info.dhcp=BL_DHCP;
info.net_mac=BL_NET_MAC;
info.phy=BL_DEFAULT_PHY_CHIP;
info.buf_base=BL_BUFFER_BASE;
info.buf_size=BL_BUFFER_SIZE;
info.baudrate=BL_DEFAULT_BAUD_RATE;
info.rmii=0;
uprintf("WARNING: Image 0 was not found. Try to create one ... \n");
image_footer.num=0;
image_footer.base=BL_IMAGE0_BASE;
image_footer.length=sizeof(tbl_info);
image_footer.load_address=image_footer.exec_address=image_footer.base;
image_footer.signature=SIGNATURE_WORD;
image_footer.type=IMAGE_FILE;
strcpy(image_footer.name,"BOOT INFO");
if( WriteImage(&image_footer, (UINT32)&info) )
{
uprintf("ERROR: Fail to create image 0. \n");
footer=(tfooter *)0;
}
else
{
uprintf("Image 0 created\n");
FindImage(0, &footer);
}
...

image.c
--------
INT DelBlock(UINT32 block)
{
UINT32 addr;
UINT32 flash_type;
UINT32 blockSize;
UINT32 size;
if(block==0)return -1; // block 0 is the location of boot loader.

addr=FLASH_BASE+FLASH_BLOCK_SIZE*block; // for a 4MB flash = 0x7F000000 + (0x10000 * block)
flash_type=FindFlash();
blockSize=flash[flash_type].BlockSize(addr);
if( blockSize==FLASH_BLOCK_SIZE )
flash[flash_type].BlockErase(addr, FLASH_BLOCK_SIZE);
else
{
// for top boot flash
for(size=0;size<FLASH_BLOCK_SIZE;size+=blockSize)
{
blockSize=flash[flash_type].BlockSize(addr+size);
flash[flash_type].BlockErase(addr+size, blockSize);
if(blockSize==0)break;
}

}

return 0;
}

Dump of image 0 (block 1) in a NC541/W camera:
-----------------------------------
[7F010000] 00 00 00 48 00 00 00 01 - 00 00 B8 00 00 00 D2 68
[7F010010] 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
[7F010020] 00 00 00 01 00 00 00 01 - 00 00 00 00 00 00 00 00
[7F010030] 00 30 00 00 00 10 00 00 - FF FF FF FF FF FF FF FF


Note that block 1 refers to image 0, i.e., the BOOT_INFO block at 0x7f010000
« Last Edit: May 06, 2011, 01:49:47 pm by celem »

June 23, 2011, 10:31:13 am
Dear,

 I ask your help because of my zero image IPCAM is in error, how do I save and record a new
 zero image with a bootloader, which command to use and which file, see below as it is appearing to me.

 Rebooting the system ...

 WARNING: Image 0 was not found. Try to create one ...
 . Image 0 created

 ls

 Image: 0 name: BOOT INFO base: 0x7F010000 size: 0x00000048 exec: 0x7F010000-f

 thanks
 casbeto :(