Did you know - OpenIPCam has an Extensive files section of firmware, utilities and developer tools -

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Topics - celem

Pages: [1] 2 3 4
Hacking & Modding / IP camera teardown and getting root password
« on: April 04, 2016, 07:01:01 pm »
Below is a link to an excellent article about hacking a  Logilink WC0030A / Apexis APM-JP8015-WS IP-Camera.

For $43 (delivered) I recently purchased a small, outdoor 720P ONVIF camera from China via eBay. It took a little over a month to arrive, but it did arrive. See attached screen capture of its eBay listing page. It is quite small - the camera body measures 3.75x2.75x2.75 inches. The image quality is quite nice - see the attachment.

It, like most Chinese IP-Cameras is MicroSoft Internet Explorer (IE) centric, meaning that full utility is achieved only by using IE with the camera's downloaded ActiveX installed. While I did test the camera in a Windows XP VirtualBox, I use Linux, not Microsoft products. Consequentially, this camera is sub-par for non-Microsoft use. Nonetheless, it is useful. I mostly monitor my cameras on either my Android phone or tablet and I can configure it for good operation on Android. On the Android, my preferred app is "IP Cam Viewer" by Robert Chou. It is excellent for my MJPEG and pretty good for ONVIF cameras. The other Android app that I use is just for ONVIF cameras - "Onvifer" by IPCentcom. Its image quality for ONVIF is excellent. On my desktop, I use VLC for image viewing.

The camera that I received has a wide-angle 3.6mm lens. I think that I would prefer the 6mm or 8mm as there is some edge distortion with the 3.6mm lens.

The camera's factory is Shenzhen Hong Jing Tian Electronics. The manufacturer is listed as "IPCAM" and the model as "C6F0SeZ3N0P0L0". The WiFI card identifies itself as Shenzen Oqemray Technology. The Shenzen Oqemray Technology website only lists peripherals like WiFi cards on their website.

The IP address arrives fixed at "", although DHCP can be activated, if desired.

The eBay seller that I used is affiliated with the factory. The seller's eBay name is "szhongjingtian". In an email, szhongjingtian signed her name as an employee of Shenzhen HONGJINGTIAN Electronics Co., Ltd.

FYI - this is how I access via RTSP:

rtsp://myURL/11  (Note 11 is HD & 12 is SD)

If you use Windows OS you can utilize the software that comes with the camera.

NOTE: The PDF file at the link below is for a camera with the same camera PCB. All CGI commands from it that I have tried also work with this camera:

General Discussion / TL-WR703N
« on: February 17, 2013, 10:00:56 am »
Recently I loaded openWRT onto a $21 TP-LINK TL-WR703N. While fine tuning the TL-WR703N I came across an interesting code module that can be loaded onto a TL-WR703N with attached camera that tracks motion. It occurred to me that this "motion" package might be applicable to IP-Cameras, as well. You can read about installing the "motion" package on the TL-WR703N HERE, and about the motion package HERE.

You can even turn the tl-wr703n into a camera using firmware packages found at the blog.

General Discussion / Raspberry Pi Camera?
« on: October 25, 2012, 09:37:00 am »
Just a thought, at this time, but I've been pondering the feasibility of gutting the main board of a FOSCAM and substituting a Raspberry Pi. At $35, the Raspberry Pi has a lot of libraries and would yield a lot of capability that is easier to program. The primary obstacle would be drivers for the sensor and, to a lessor degree, servos.

uCLinux / Yocto
« on: August 31, 2012, 01:17:46 pm »
Has anyone looked at the Yocto Project for building a system for the Foscam-ish cameras? They claim "the Yocto Project is an open source collaboration project providing templates, tools and methods to help developers create embedded Linux-based systems, regardless of the hardware architecture."

General Discussion / IR-CUT Solenoid
« on: July 25, 2012, 10:24:39 am »
I continue to try to decipher the IR-CUT solenoid circuitry in the Foscam FI8904W. I searched for the solenoid used and have not found an exact match, although I have found one very similar. It is the IR-CUT-3-01 by the Aung Run Technology Co., Ltd. of Shenzhen, China.

I do not read Chinese but Google-translate provides enough info that it seems that a 50ms pulse of 3V at 200ma will operate the solenoid and a subsequent pulse will reverse the solenoid. No current is drawn in the quiescent state. I do not see polarity reversal mentioned so I assume that it is an identical subsequent pulse that reverses the solenoid's rotary current position(?). ADMIN - please take a look at the Chinese in the attached image and advise if a better explanation is disclosed there. Google translate cannot translate from an image. I suspect that it does require a polarity reversal because other, similar, IR-CUT solenoids that I have researched, such as one made by Sunnex ( state "Reverse anode/cathode to reverse mode".

In the FI8904W, the 50ms pulse is provided by an HC4538 multivibrator IC on a tiny daughterboard withn the lens area.

General Discussion / FI8904W IR Sensor
« on: July 15, 2012, 09:43:21 pm »
The FI8904W uses a photoresistor to detect light levels for operating its 24 LEDs. I have attached a photo that shows the exploded sensor and its characteristics. Although the LDR is unmarked, I believe it to be a GL5528. See Datasheet

General Discussion / SMD marking advice
« on: July 11, 2012, 06:46:59 pm »
I am trying to reverse engineer the LED/IR-CUT board of a Foscam FI8904W camera. There are two SOT-23 SMD transistors, Q1 and Q2. Q1 is marked "t04". Using a meter I have verified that it is an NPN transistor. However, Q2 is marked "MON" and it does not meter in an identifiable way. Googling around, this marking is a mystery. Does anyone know what it is??

I'm thinking that it is, maybe, a MOSFET

General Discussion / Help Identify Part for connector???
« on: July 01, 2012, 10:43:14 pm »
Can anyone identify a compatible part manufacturer/part number for the intra-pcb connectors used on Foscam? Especially J1, marked by the red arrow in the attached photo. Any help appreciated - I want to purchase some.

ADDENDUM: I measured the connector as best that I could with my cheap plastic, manual micrometer, which is quite hard to do at the single millimeter level. After measuring and searching It is similar to MOLEX Part Number 501330-0200 but with enough dimension differences to not permit using the Molex part. The part is marked "NRL A3" I assume that it is a China sourced part but I cannot find a manufacturer that uses "NRL" as a logo. I have attached a drawing of the dimensions as accurate as possible with my cheap plastic, manual micrometer.

IF, however, my reading is a wee bit off, and the pitch is really 1.25mm, then the HARWIN M30-610-02-46 looks pretty good - EXCEPT for the pin shape. The HARWIN has a square .35mm pin while the NRL A3 has a rectangular pin .35mm X .2mm pin. Mouser sells the HARWIN M30-610-02-46 as a non-stocked item with a minimum quantity of 1,950 (rather exceeds my needs)

The FCI - 10114829-10102LF looks about as close as I can get with off-the-shelf parts. Newark stocks this part and will sell in quantity one at 16.7 cents each. Mouser stocks them at 17 cents each and Digi-Key sells them for 30 cents each.

Does ANYONE know who NRL is???

General Discussion / Dissembly Photos
« on: June 18, 2012, 01:50:08 pm »
There are some nice camera Dissembly Photos HERE.

General Discussion / Cheap serial interface
« on: March 02, 2012, 04:28:20 pm »
I just recently purchased, on eBay, a couple of inexpensive serial interfaces that work well and cost me $2.93 each, including postage. They are designed for 3.3V logic so they will work well for the typical IP-Camera. Also, they use a CP2102 IC that is 5-Volt tolerant so they also work in 5-Volt circuits, such as Arduino boards. The only problem is that the Tx and Rx lines are labeled backwards on the silk screen labels. To order one just search for "USB 2.0 to UART TTL 6PIN Module Serial Converter CP2102" on eBay. There are several versions on eBay. The ones that I purchased are made by and the logo on the board looks like "BA\TE". See attached photo. They have a full-size USB port on one end and pins on the other. You'll probably need a USB extender cable to use it (male/female) - at least I needed one.

General Discussion / Stepper motor in camera
« on: December 30, 2011, 04:31:43 pm »
I have been playing around with some Arduino boards and recently obtained a cheap stepper motor. It appears very similar to those in the IP Cameras. It is a 28BYJ-48, 5-Volt. The motors in my WansView NC-541/W is marked W-24BYJ DC:5 Volt The key difference is the case diameter, 28mm versus 24mm. Anyway, the website below has some information on the stepper that, I suspect, is rather applicable to the camera's steppers:

General Discussion / Alarm Server function of WansView
« on: December 10, 2011, 03:26:45 pm »
I have been looking at a screen that is present on my WansView NC-541/W but not present on my Foscam. It is the alarm function Alarm Settings->Enable Alarm Server.

I contacted WansView's customer support and after much back and forth I got nowhere:

Partial Transcript of emails:
Code: [Select]
Me to WansView: The ALARM section of  NC-541/W camera has a ALARM SERVER section
with fields for address, port, name and password. I find no documentation about
requirements for such a ALARM SERVER. It would appear to be referring to some sort
of ALARM SERVER software running on the attached network but documentation is needed
to utilize this function. Thank you.

Reply: Dear Sir, The alarm server is your own server if you have. If the user has his
own alarm server, he can use that server do help doing the alarm.

Me to WansView: I understand that much but what is the protocol for communicating
with the server?

Reply: there is no restriction with our items. You may use any one.

Me to WansView: Answer not useful. What computer software is used on the
remote computer server.

Reply: What kind of alarm server do you have?

Me to WansView: 我目前還沒有鬧鐘程序。我需要WansView兼容鬧鐘程序軟件的身份
I currently have no alarm server. I need the  identity of WansView
compatible alarm server software.
Alternatively, please supply details of the alarm server interface to WansView.

Reply: We do not has any restriction for the alarm server. So every kind such as
telephone, HTTP server can both support.

Me to WansView: 描述一个例子
Pleas describe one example

Reply: (none was received)

I monitored my LAN with WireShark and saw that when I activated the Alarm Server
function in the camera, the camera sent an HTTP packet to port 56915 of the IP
address that I established for the Alarm Server in the camera. The text portion
of the message contained lots of alarm settings:

Code: [Select]
HTTP/1.1 200 OK
Server: Netwave IP Camera
Date: Sat, 10 Dec 2011 19:33:07 GMT
Content-Type: text/plain
Content-Length: 358
Cache-Control: no-cache
Connection: close

var mid='smarteye';
var pid='BSeries';
var se_ddns_svr='';
var se_ddns_port=80;
var se_ddns_interval=18000;
var se_ddns_name='';
var se_ddns_user='HY000103';
var se_ddns_pwd='82616413';
var alarm_enabled=1;
var alarm_svr='';
var alarm_port=80;
var alarm_user='alarmtest';
var alarm_pwd='7654321';
var se_ddns_status=3;

var ftp_schedule_fri_2=0;
var ftp_schedule_sat_0=0;
var ftp_schedule_sat_1=0;
var ftp_schedule_sat_2=0;
var alarm_motion_armed=1;
var alarm_motion_sensitivity=5;
var alarm_motion_compensation=0;
var alarm_input_armed=0;
var alarm_ioin_level=1;
var alarm_iolinkage=0;
var alarm_preset=0;
var alarm_ioout_level=1;
var alarm_mail=0;
var alarm_upload_interval=0;
var alarm_http=0;
var alarm_msn=0;
var alarm_http_url='';
var alarm_schedule_enable=0;
var alarm_schedule_sun_0=0;
var alarm_schedule_sun_1=0;
var alarm_schedule_sun_2=0;
var alarm_schedule_mon_0=0;
var alarm_schedule_mon_1=0;
var alarm_schedule_mon_2=0;
var alarm_schedule_tue_0=0;
var alarm_schedule_tue_1=0;
var alarm_schedule_tue_2=0;
var alarm_schedule_wed_0=0;
var alarm_schedule_wed_1=0;
var alarm_schedule_wed_2=0;
var alarm_schedule_thu_0=0;
var alarm_schedule_thu_1=0;
var alarm_schedule_thu_2=0;
var alarm_schedule_fri_0=0;
var alarm_schedule_fri_1=0;
var alarm_schedule_fri_2=0;
var alarm_schedule_sat_0=0;
var alarm_schedule_sat_1=0;
var alarm_schedule_sat_2=0;
var decoder_baud=12;
var msn_user='';
var msn_pwd='';
var msn_friend1='';
var msn_friend2='';
var msn_friend3='';
var msn_friend4='';
var msn_friend5='';
var msn_friend6='';
var msn_friend7='';
var msn_friend8='';
var msn_friend9='';
var msn_friend10='';

Anybody know anything about the intended Alarm Server, its protocol, etc? Any ideas?

General Discussion / Motion Compensation
« on: December 06, 2011, 04:08:56 pm »
Newer Foscam camera's Alarm Settings have a section titled "Motion Compensation". My WansView does not have this setting. It appears to be rather useful according to this site which states:  “Motion Compensation”, it means it is compensation of lights. As usually, camera will alarm even when light changes, here if you choose motion compensation, camera will not cause so many alarms by light changes. In other words, it can decrease these alarms caused by light changes.

In testing with my WansView, turning a nearby light on and off produces an alarm. I haven't tested with the Foscam as this feature is not present in my FI8909. Has anyone tested this feature> Also, are there any other camera brands that have this feature?

General Discussion / Microphone sensitivity
« on: December 04, 2011, 06:42:15 pm »
Since I use Linux and the microphones are pretty much not supported except in Micro$oft's internet Explorer, I really haven't bothered with the built-in microphones other than one test to listen to them once with VLC. Currently I am on a project to equip my daughter's house with four cameras which I want in a single screen. As a result, I am having to set this up on Windows. I tried testing the microphone of both a FOSCAM 1809 and a WansView NC541/W. The microphones on both have equally poor sensitivity. I find the built-in microphones so insensitive as to be close to worthless. What is the experience of others?

I think that I am going to use WansView cameras (I like them the best) and the built-in Multi-View capability to display the four cameras. I'll be using motion sensing on a couple of them to send alerts via SMS to a cell phone as well as some audio indicator on a single PC.

I tested some software called Ispy and it looks promising but the totally free version is too limited. All of the features that I need require an $8/monthly web service in the middle. No thanks. If audio doesn't turn out to be a serious issue, I may put ZoneMinder onto a small Linux box and give that to her.

Pages: [1] 2 3 4