News:

Re-organized the forum to more cleanly delineate the development section, as the end user support side appears to have taken a life of its own!

Author Topic: Rosewill RXS-3323/RXS-4324 clones, firmware, hardware & telnet  (Read 7003 times)

February 17, 2013, 11:53:38 am
I recently got an RXS-3323 link to specs here here is the newegg page its not a  bad camera for what I paid but I wanted to see if their where any firmware updates. My purchased unit shipped with firmware 5.0.2.5525 according to the GUI. Turns out Rosewill does not offer any firmware so I started looking for another vendor or the OEM. Here is what I have found

Brands
Rosewill RXS-3323, manual
ABS MegaCam 421M   , manual and firmware on site is an older version, 3.0.3.3597 from 2010.
A-MTK Co. LT AM9230M  possible firmware at this page


A thing all these brands of this camera have in common is the use of a desktop software application called “IP Wizard II” and a DDNS service they run on their sites called DIPS. Clearly they are all purchasing this package from some vendor. Does anyone know who the OEM is?

Hardware
Here are the hardware specs on the non-wireless version

Top of board
Grain GM8180 SoC IP camera chip
A3S12D40ETP 64MB DDR RAM
Allegro A3967 Microstepping Driver with Translator (obscured by wire in pic)
TOPRO MCU TP2804
IC+ IP101A Single Port 10/100 Fast Ethernet Transceiver
MXIC flash memory chip

Underside of board
A3S12D40ETP 64MB DDR RAM
Allegro A3967 Microstepping Driver with Translator

Firmware
I have flashed the A-MTK firmware found here onto the Rosewill brand camera. The file named 5.a.2.7436-ipcam.pck would not flash due to a checksum error but the file called 5.0.2.7232-ipcam.pck did flash and the camera seem to work fine. The web GUI now reports the camera as running version 5.0.2.7232. This is a one way street since Rosewill does not provide firmware on their website

Telnet
The unit responds to telnet requests but the login and password are different then that of the web interface.

Questions
Do you guys have any idea who may have made this? What the telnet password might be or what other firmware sources/options I have?
« Last Edit: February 17, 2013, 12:26:19 pm by radix »

July 12, 2013, 01:18:54 pm
These days my memory is not so great.. awhile back I came across a way to get the telnet login/pass for the RXS-3323 but the method I used escapes me.

Perhaps it was by sniffing the traffic sent by the IP Wizard II app communicating with the camera?

Here's some info via telnet..

BusyBox v1.1.3 (2011.02.15-09:27+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ $ cat /proc/cpuinfo
Processor       : FA626id(wb) rev 1 (v4l)
BogoMIPS        : 328.70
Features        : swp half
CPU implementer : 0x66
CPU architecture: 4
CPU variant     : 0x0
CPU part        : 0x626
CPU revision    : 1
Cache type      : write-back
Cache clean     : cp15 c7 ops
Cache lockdown  : format B
Cache format    : Harvard
I size          : 32768
I assoc         : 4
I line length   : 32
I sets          : 256
D size          : 32768
D assoc         : 4
D line length   : 32
D sets          : 256

Hardware        : Faraday GM8180
Revision        : 0000
Serial          : 0000000000000000

/proc $ cat meminfo
MemTotal:       126916 kB
MemFree:         49032 kB
Buffers:             0 kB
Cached:          15996 kB
SwapCached:          0 kB
Active:          16224 kB
Inactive:         7908 kB
HighTotal:       34816 kB
HighFree:         5432 kB
LowTotal:        92100 kB
LowFree:         43600 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
Mapped:          12584 kB
Slab:             2816 kB
CommitLimit:     46048 kB
Committed_AS:   139232 kB
PageTables:        760 kB
VmallocTotal:   122880 kB
VmallocUsed:     47056 kB
VmallocChunk:    70076 kB

/proc $ cat modules
security 5068 0 - Live 0xbf099000
ftmac100 10604 0 - Live 0xbf095000
fmjpeg_drv 110668 4 - Live 0xbf078000
fmpeg4_drv 62008 3 - Live 0xbf067000
fmcp_drv 29772 2 fmjpeg_drv,fmpeg4_drv, Live 0xbf05e000
favc_drv 71456 6 - Live 0xbf04b000
favc_common 3732 1 favc_drv, Live 0xbf049000
fcap100_mt9m112 8180 4 - Live 0xbf046000
fcap1 21848 3 - Live 0xbf03f000
fcap0 21848 3 - Live 0xbf038000
fcap_common 73000 3 fcap100_mt9m112,fcap1,fcap0, Live 0xbf025000
snd_fi2s_wm8731_c1 9448 2 - Live 0xbf021000
snd_ftssp010 24044 1 snd_fi2s_wm8731_c1, Live 0xbf01a000
cpe_rtc 6580 0 - Live 0xbf017000
cpe_wdt 2888 1 - Live 0xbf015000
ct656 5184 0 - Live 0xbf012000
fgpio 4608 1 - Live 0xbf00f000
fi2c 35400 2 fcap100_mt9m112,snd_fi2s_wm8731_c1, Live 0xbf005000
apb_dma 7732 0 - Live 0xbf002000
pinmux 4012 0 - Live 0xbf000000

/bin $ nvram getbrand
read_brand_from_flash
Original values:
manufacturer:  Rosewill
model:         RXS-3323
version:       5.0.2.5525
mac:    00:0E:AE:A1:C3:CD

I just realized that the login name is based on your MAC address, my telnet root username was AEA1C3CD

/tmp $ cat passwd
root:abATsxpNxEp4Y:0:0:root:/:/bin/sh
AEA1C3CD:abJ57KZ5hGfTI:0:0:root:/:/bin/sh


I wish I had more information for you but its been awhile since I poked around and in my research I was unable to find any firmware updates or anything specific.

July 12, 2013, 11:19:04 pm
Okay I figured it out.

You need to download the settings backup via the web interface and then you can find the root telnet username and password saved in plain text.

For example in my config file I found the following information.

user.username_from_mac=AEA1C3CD
user.password_from_mac=AMTqYfRUUamxw




  • No avatar
  • *
April 18, 2014, 06:55:59 pm
This is a stupid question but i do work with these particular cameras all day.  But how do you telnet into them?  For example what ports?  I used 23 or the open ones like 80, 554, 443 but i am a noob when it comes to this particularly.  I am using putty as well.

What i am trying to do is to reboot the cameras because the web interface is not function.

Thanks
Vince