Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at

Recent Posts

Pages: 1 ... 8 9 [10]
Hacking & Modding / Re: Hacking the IPRobot3
« Last post by Robo on August 04, 2017, 09:21:15 pm »
Unbricking a bricked IProbot3 ver1. 2013 with firmware 1.1.6  :)

This is a bit old news since the version of the camera has changed, but after a few years and many months of trial and error, I finally found a combination of steps that let me unbrick my old Tenvis IPRobot3 camera.  It looks that some people were able to use Telnet for this, I used the USB method.  I am ending my work on these cameras and will not be able to support those of you that try this nor will not be able to give out the firmware.  You might be able to find old  firmware on the web and the tools to extract the pk2 files.   Also, this procedure might only work on older discontinued versions of cameras and on a limited number of instances when the camera had a bad firmware update and it became unresponsive.  Specifically in my case, it failed during a firmware update when the Ethernet cable got unplugged and wifi was used for the update by accident. If this has happened to you too, then there is a good chance the steps below could help you.   

In order to complete the procedure, you will need to remove the camera bottom cover and connect a 3.3v USB converter to J9 by soldering wires to the camera's pcb, then use a terminal program to interact with the boot-loader. You will also need a fat32 formatted TIFF SD memory card and a copy of the firmware that has been uncompressed and renamed from “” to “linux”.  I also copied all the other files in the uncompressed gm8126-tenvis-1-1-6-2-2012-11-08.pk2 to the SD card then renamed them removing “.new” from each, but it seemed unnecessary.  If your camera is newer, use a version of firmware that is intended for that model of camera and J9 maybe different as well.

The steps are to copy Linux to the TIFF SD card and then put the SD into the camera. Then connect an Ethernet cable and the U9/USB port to a computer.  Now power up the camera and launch your Hyper Terminal program at 38400 baud N81 with the correct com port setting. Next power off and on the camera and press “.” in the terminal program during the first two seconds of the camera's startup. Then from the bootloader menu, do option 78 to boot from SD. The camera should load Linux from the sd.  Next find the IP address of the camera. The IP address of the camera is listed in hex format at the end of the linux boot log seen on the terminal screen.  To resolve the IP address of the camera, convert the hex numbers to decimal. Lastly, log into the camera with a web browser and do a normal firmware update. 

Notes: There are post regarding what wires to connect to J9 already and you will have to search for them. You will have to manually set your computer's IP address in the same subnet of your camera, but as a different IP address in that subnet.  I also found that Hyper Terminal would not recognize the USB com port unless I connect the USB converter to the computer and camera first, then power on the camera before I launched Hyper Terminal.  I suggest getting comfortable with the boot-loader via Hyper Terminal after connecting to J9 and insuring you have working USB drivers for the USB converter first. 

Good Luck!

Firmware / Help me with no name ip camera
« Last post by redstrat984 on August 02, 2017, 05:09:55 am »
i'm new user of this forum, i'm from italy, i need help with my ip camera,
this camera is a no name camera, buyed from ebay, some time ago. have a great video, it's 720p resolution with cloud service,
the problem is's signed like onvif but have only main stream and limitated firmware....
it's possibile to swap firmware with other version??

current version sign:
firmware time 2016-10-07 18.43
if can help, this is the site of the productor... i've got a x seris.

if you need photo of the camera or motherborad of the camera ask me :)

thanks to all for the help.
Firmware / Re: Hi3516 Unknown command 'root' - try 'help'
« Last post by admin on July 28, 2017, 01:42:11 pm »
Suggest read the uBoot docs for what is (possibly) available.

a uboot is a preboot that loads the OS
You will need to see if you have an OS on your board to boot into.

I'd try some common commands like

and try see what partitions you have etc
Firmware / Re: U-boot corrupted. Looking for recovery procedure
« Last post by admin on July 28, 2017, 01:36:53 pm »
Whats the SoC?

Some of the more modern SoC's can do recovery via USB boot.
If not, you'll need an SPI flasher or similar to rewrite the uboot directly onto the flash, eg with a BusPirate or dedicated device.
Firmware / Re: VACRON firmware format
« Last post by admin on July 28, 2017, 01:30:05 pm »
I wish I could afford IDA, that was actually moderately useful.

You can't assume/guarantee that the update /upgrade mechanism will be the same for each camera though.

Looks like it loads the file via web interface into ram, writes to /tmp then does some compares to see if valid.
I'd check the .bin file you first gave to see if it passes their compare process.

Firmware / Re: VACRON firmware format
« Last post by temp0727 on July 28, 2017, 07:36:03 am »
I grabbed some other files they provide for other cams. One of those files was JFFS, from which I got "update.cgi", but couldn't understand the algoright for it. Anyway, they seem to pack kernel and fs into that binary file. Attached some flowcharts from IDA and original update.cgi
Firmware / Re: Wanscam HW0021 firmware
« Last post by sirbossa on July 28, 2017, 04:26:36 am »
Does someone have the FW of the HW0021? I have seemed to install a wrong FW, and now my cam is all black and white, with very poor resolution. Want to get back to the original FW, but can't find it..:-S.
Firmware / Re: VACRON firmware format
« Last post by admin on July 28, 2017, 01:16:26 am »
I downloaded the rar file, unpacked and took a cursory look at the bin file.

Looks like its possibly encrypted or compressed post header, as I don't see many FF's or 00 strings in the file after the initial header.
strings also doesn't show any readable text, which ties in with it being compressed or encrypted.

A scan with binwalk ( ) to see if it finds any recognizable FS or compression in there shows nothing.

I'm guessing its probably encrypted with some custom method.

You'd need more firmware files to look at in order to proceed.
Hacking & Modding / Re: In over my head/dumb questions
« Last post by admin on July 27, 2017, 06:24:45 am »
Post 5 messages, and the restriction is lifted,  its a spammer block, unfortunately if you don't make it difficult then the boards get inundated with spam.

I have removed some of the non relevant questions (the ones related to the older forum template).

Firmware / VACRON firmware format
« Last post by temp0727 on July 27, 2017, 05:12:16 am »

I have this IP camera from, I checked their firmware and couldn't find anything about it. I mean it either encypted or compressed.

Suppose it's possible to unpack/decrypt firmware. Would it be possible to modify the linux inside it and upload it back?
Pages: 1 ... 8 9 [10]