Open IP Camera Forum

General => General Discussion => Topic started by: TheUberOverLord on January 03, 2013, 12:34:21 am

Title: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on January 03, 2013, 12:34:21 am
Note: I get these IP Cameras in quantities of 10, with shipping included, for $54.00 U.S. each. They come with a 1 year warranty as well.

These IP Cameras are very stable, IMHO. I have used them as my main IP Cameras for both indoor and outdoor ("In heated housing") use, to sell, customize the Web UI and install for others. They also have 4M available of 16M which makes them excellent IP Camera candidates to use, to modify the Web UI, with custom Web UI changes.

This IP Camera has no logo, is a dull black ("Not shiny") and has the 4 alarm pins and an audio out jack on the back. The label on the bottom of this IP Cameras, says "IP Camera" and the free factory DDNS is topipcam.org. It matches the FI8908W features and has no IR-CUT.

(http://www.saveontelephonebills.com/camera/908clone.gif)

I have searched the files and posts here and nothing seems to exactly match this FI8908W IP Camera clone, with an exact match of where things are located in images as well as this IP Cameras memory.

I am not sure how common this FI8908W IP Camera clone is ("If any of these IP Cameras could be ever considered a clone, lol"). That said, hopefully, maybe these instructions will help bring some now paperweights back to life.

It should be noted that I used a Windows based system, specifically a Win7 64 bit system, to do this. So I will also go into some details on what I needed to use, since I could not locate a copy of HyperTerminal. While I do run Ubuntu as a dual/tripple boot option, on some of my Windows systems, I am far from a Linux Guru!

If you still have some access to your IP Camera and even if you think you don't. It's always best to before doing anything to save the contents of what the IP Camera thinks it has as configuration data. Even if the Web UI is currently not functional. This still maybe possible.

To do this simply follow these instructions:

xxx.xxx.xxx.xxx = Local IP Address or ISP IP Address or DDNS of IP Camera
#### = Port for IP Camera
Username = Admin Level User Name of IP Camera
Password = Password for the above User Name of IP Camera

From any browser window do:

Code: [Select]
http://xxx.xxx.xxx.xxx:####/get_params.cgi?user=Username&pwd=Password

If it works, please copy and save the results, for reference later, if needed.

As your proceed, it would not be a good idea to download any changes to your IP Camera, unless it looks like things you see here, are similar to your IP camera. To do otherwise, most likely will cause you more grief.

Once you get into the bootloader of your IP Camera, assuming that the pin instructions you see here, matched your IP Camera? You can then compare what you see with your IP Camera vs. what is shown here and then decide, to stop or move forward, on actually downloading anything to your IP Camera.

Please remember, that when you do any of the things you see here, that you do so, at your own risk as well.

Tools:

Small Phillips screwdriver.

Soldering iron and solder.

Potentially some wire, if your Serial Interface has none.

Some kind of Serial Interface. I used this, but you can use any serial interface that supports a 3.3V DC interface:

USB to UART TTL Cable: http://www.ebay.com/itm/120921203767?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649 (http://www.ebay.com/itm/120921203767?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649)

I am including a .zip file here, that contains the things used in these instructions.

1. linux.zip
2. romfs.img
3. 0.2.9.12.bin ("WebUI")
4. lr_cmos_0_37_2_47.bin ("Is the normal system firmware for the camera, having 1. and 2. here merged")
5. IPCamera.exe ("IP Camera Finder Tool")
6. ActiveX_IP.exe ("ActiveX Installer")
7. Instructions ("Windows Shortcut to this Forum post here")

http://www.saveontelephonebills.com/camera/908clonerecovery.zip

These files are from the latest version for this IP Camera. They are also required for the instructions and procedures shown here.

Here is the Boot Loader Users Manual that lists details on all the commands that can be used by the Boot Loader:

http://www.openipcam.com/files/BSP/Nuvoton%20W90N745%20-%20W90N745%20Bootloader%20Users%20Manual.pdf (http://www.openipcam.com/files/BSP/Nuvoton%20W90N745%20-%20W90N745%20Bootloader%20Users%20Manual.pdf)

Location of (J2) IP Camera Serial Connection
(http://www.saveontelephonebills.com/camera/908clonepcb.jpg)

Please do NOT pay any attention to the pin hole designations, shown in the above photo. The above photo was meant to be used, simply as a reference, as to where, the general location on the IP Cameras PCB ("Printed Circuit Board") the 4 pin holes, for (J2) are located.

The IP Cameras main PCB has clear markings for the (J2) serial connection. It has 4 empty pin holes, side by side. On one side of the PCB board it says RX ("Next to the RX pin hole and on the other side of the PCB, it shows the 3.3 VDC pin hole as well as GND pin hole for these 4 holes. So you may need to flip the PCB board over, to see all the markings for the (J2) serial connection pin holes.

The only (J2) pin hole not marked, in some way, on one side or the other of the PCB for this IP Camera, is the TX pin hole.

When the IP Camera is centered and the IP Camera lens is pointing away from you with the bottom of the IP Camera PCB board ("In the IP Camera housing as normal"), facing up. The pin holes are ("Left to right") 3.5V DC pin hole 1, GND Pin hole 2, TX Pin hole 3, RX Pin hole 4. You do NOT want to connect anything to the 3.5V DC (J2) Pin hole. All (J2) pin holes are what they say, there is no need to reverse anything listed here. Meaning TX is your TX, RX is your RX.

You will need to detach the IP Cameras main PCB board from the IP Camera housing, in order to make the solder connections. The main PCB board is held on by 1 screw. To access the bottom of the IP Camera and unscrew the 4 screws that hold the IP Cameras bottom on. You will need to remove some of the rubber feet on the bottom of the IP Camera to access the screw holes. You can glue them on later again, if needed. In some cases, they are so sticky, there is no need to re-glue them. Simply try placing them back as they were, when you are all done.

On newer Windows systems, like Win7 or Win8. The normal serial communications terminal program, known as HyperTerminal is not included with the Operating System. While people say you can copy it from an XP Windows system. I used a 64 Bit based Win7 system to test and produce what you see here. So, the program listed below is more compatible with current or newer Windows Operating Systems.

Free HyperTerminal Like Program: http://www.clearconnex.com/content/clearterminal

ClearTerminal Settings ("Seen when opening a connection") From the ClearTerminal Menu:

Connection -> New Connection

(http://www.saveontelephonebills.com/camera/ClearTerminalSettings.png)

ClearTerminal will list the COMM ports it sees as available. If your system has more than one available, you will need to determine which COMM port is being used by whatever serial interface you will be using to communicate with your IP Camera, from your Windows system.

Note: ClearTerminal seems not very good at generating the required ESC character to enter the bootloader, using the keyboard. I use this secondary ClearTerminal window, to send the ESC character. To invoke this window. From the ClearTerminal menu do:

Tools -> Send ASCII/Binary Bytes

Please make sure the "ASCII" radio button is selected and press the ESC button located in the new window prior to the 3 second timeout to remain in the bootloader.

(http://www.saveontelephonebills.com/camera/SendESC.png)

ClearTerminal Main Window ("Made smaller to show it here"):

(http://www.saveontelephonebills.com/camera/ClearTerminal.png)

You have two choices on where you can enter text to send to the IP Camera, in ClearTerminal. You can type in the main ClearTerminal window, which is not very forgiving with typos or you can type in the text line below the main ClearTerminal window. This allows you to change text, if needed, much more easily, prior to sending a command.

To download files to the IP Camera, when needed using ClearTerminal. From the ClearTerminal menu do:

Transfer -> Send File

This will open up a secondary window, please make sure that you have XModem selected as a radio button. There is no need to define ASCII or Binary mode transfers:

(http://www.saveontelephonebills.com/camera/ClearTerminalTransfer.png)

With the settings shown above. The data being transferred to the IP Camera will not display in the main ClearTerminal window, during any download to the IP Camera. You will have a progress bar that will show bytes transferred during the download process to the IP Camera, as well as notification of when the download completes for the IP Camera. You will need to manually close this secondary window, when the download has completed, with the settings shown above.

Here are my current findings, with these IP Cameras.

It should be noted that I have personally never had issues with this IP Camera. This process was done as more of an exploratory process, so that in case I ever did, I would know how to recover. Which is why I wanted to share these procedures on how you can recover these IP Cameras, when/if needed. All the procedures here, were done many times, with no issues for this particular IP Camera.

Once you have a serial connection to your IP Camera, you can compare the output from your IP Camera, so that you can determine, if these IP Camera recovery instructions, will fit your needs.

Once you have an active serial connection to Your IP Camera, anytime you boot the camera, you will see the boot process displayed. You can leave the serial connection to the IP Camera in place, with or without the serial connection being connected with no ill effects.

Here are things you will see and can see, from your IP Camera, while you have an active serial connection, to your IP Camera.

Full Boot:

Code: [Select]
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:6E:06:05:8A:12
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #1699    3   8 07:58:22 CST 2012
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 4096
zone(0): 0 pages.
zone(1): 4096 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 16MB = 16MB total
Memory: 14612KB available (1283K code, 206K data, 40K init)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
PTZ Driver has been installed successfully.
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80100 (irq = 10) is a W90N7451
I2C Bus Driver has been installed successfully.
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0D0000-7F1CC7FF [VIRTUAL 7F0D0000-7F1CC7FF] (RO)
S29GL032N Flash Detected
01 eth0 initial ok!
which:0
PPP generic driver version 2.4.2
Linux video capture interface: v1.00
Winbond Audio Driver v1.0 Initialization successfully.
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver audio
audio.c: v1.0.0:USB Audio Class driver
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4
rtusb init --->
usb.c: registered new driver rt2870
dvm usb cam driver 0.0.0.1 by Maverick Gao in 2010-8-3
usb.c: registered new driver dvm
dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20
usb.c: registered new driver dvm usb cam driver for sonix288
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: /bin/init
Command: mount -t proc none /proc
Command: mount -t ramfs none /usr
Command: mount -t ramfs none /swap
Command: mount -t ramfs none /var/run
Command: mount -t ramfs none /etc
Command: mount -t ramfs none /flash
Command: mount -t ramfs none /home
Command: mount -t ramfs none /tmp
Command: mkdir /tmp/run
Command: camera&
[8]
Command: sh
no support

Sash command shell (version 1.1.1)
/> hub.c: connect-debounce failed, port 1 disabled
new USB device :80fb3004-fed740
hub.c: new USB device 1, assigned address 2
probing sonix288 usb camera ...
vid/pid is 0x1d0f/0x1801
dvm camera registered as video0
p1[7]:1,j 3,config->bNumInterfaces:4
usbaudio: device 2 audiocontrol interface 2 has 1 input and 0 output AudioStreaming interfaces
usbaudio: valid input sample rate 16000
usbaudio: device 2 interface 3 altsetting 1: format 0x00000010 sratelo 16000 sratehi 16000 attributes 0x01
usbaudio: valid input sample rate 48000
usbaudio: device 2 interface 3 altsetting 2: format 0x00000010 sratelo 48000 sratehi 48000 attributes 0x01
usbaudio: registered dsp 14,35
usbaudio: warning: found 1 of 0 logical channels.
usbaudio: assuming the channel found is the master channel (got a Philips camera?). Should be fine.
usbaudio: registered mixer 14,32
usb_audio_parsecontrol: usb_audio_state at 00ff3bc0
new USB device :80fb3404-fed740
hub.c: new USB device 2, assigned address 3
params length is 5428
sw version is 0.37.2.47
aw version is 0.2.9.12

Wait for auto-negotiation complete...ResetPhyChip Failed
video0 opened
1
1
1
1
1
1
unknown command
do_zoom_stop: write error 5
__pthread_initial_thread_bos:3fc000
manage pid:14
frag is 2048
Prepare Audio Buffer
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
can not get dyndns server ip
check_ipid_shat_net: can not get ip of ipid.shat.net
update_9299: can not get server www.topipcam.org ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
0x1300 = 000a4260
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth1
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
bonjour callback: service registered
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===default
*args===gw
*args===eth1
bonjour callback: memory free
bonjour callback: service registered
3
3
3
3
3
3
ntpc adjust ok
update_9299: update ok
getDevicesFromMiniSSDPD: socket(unix) error
Jan  3 05:06:37 2013 bonjour: mDNSPlatformRawTime went backwards by 1807289983 ticks; setting correction factor to -539565910

Please see the Boot Loader Users Manual link above for details on what Bootloader commands are available and what they do.

BootLoader ("Stopped within 3 seconds using ESC. Then I used the Bootloader "ls" command"):

Code: [Select]
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:6E:06:05:8A:12
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode .

bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.bin base:0x7F020000 size:0x000ADFD8 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0D0000 size:0x000FC800 exec:0x7F0D0000 -a

bootloader >

Info Command:

Code: [Select]
bootloader >i

W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:6E:06:05:8A:12
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Supports flash types:
W19L320SB        AM29LV320DB      AM29LV320DT      AM29LV800BB     
AM29LV800BT      AM29LV160DB      AM29LV160DT      EN29LV160AB     
EN29LV160AT      SST39VF160       HY29LV160        MX28F160C3T     
MX28F160C3B      MX29LV160BT      MX29LV640BB      MBM29LV160BE     
MBM29LV160TE     W19B322MB        M29WL320DT       W19B320BTT       
W19B320ABT       W19B320BBT       W19B160BB        W28J800TT       
W28J800BT        W28J160TT        W28J160BT        W28J320TT       
W28J320BT        INTEL E28F320    INTEL E28F640    SST39VF6401     
SST39VF1601      INTEL E28F128    28F800C3-T       28F800C3-B       
28F160C3-T       28F160C3-B       28F320C3-T       28F320C3-B       
W39L010          W29EE011         S29GL032A        MX29lv160BB     
A29DL320FUV      A29L160B         A29L320B         EN29LV160B       
EN29LV320B       ML29lv162FE     
bootloader >

The Bootloader only allows memory locations to be displayed, 256 bytes at a time. So, it can be a tedious process, to display memory for the IP Camera, when searching for something in memory and not really knowing at that moment, where exactly, that information is located in memory. The memory addresses shown here, are where the information starts and where it ends, in the IP Cameras memory.

Memory Locations:

The WebUI.bin has no footer and therefore has no image number assigned to it, like the linux.zip and romfs.ing files do. But it's located at 0x7F200000 - 0x7F33727F

Code: [Select]
d 0x7f200000
Displaying memory at 0x7F200000
[7F200000] 440C9ABD 04D81A69 - 000E124B 0C090200  ...Di...K.......
[7F200010] 0000000F 7463412F - 58657669 2E50495F  ..../ActiveX_IP.
[7F200020] 01657865 00016E92 - 00905A4D 00000003  exe..n..MZ......
[7F200030] 00000004 0000FFFF - 000000B8 00000000  ................
[7F200040] 00000040 00000000 - 00000000 00000000  @...............
[7F200050] 00000000 00000000 - 00000000 00000000  ................
[7F200060] 00000000 000000D0 - 0EBA1F0E CD09B400  ................
[7F200070] 4C01B821 685421CD - 70207369 72676F72  !..L.!This.progr
[7F200080] 63206D61 6F6E6E61 - 65622074 6E757220  am.cannot.be.run
[7F200090] 206E6920 20534F44 - 65646F6D 0A0D0D2E  .in.DOS.mode....
[7F2000A0] 00000024 00000000 - A84A75E5 FB2414A1  $........uJ...$.
[7F2000B0] FB2414A1 FB2414A1 - FB7B1C2F FB2414A3  ..$...$./.{...$.
[7F2000C0] FB2514A1 FB24143A - FB791C22 FB2414B0  ..%.:.$.".y...$.
[7F2000D0] FB1437F5 FB2414A8 - FB221266 FB2414A0  .7....$.f."...$.
[7F2000E0] 68636952 FB2414A1 - 00000000 00000000  Rich..$.........
[7F2000F0] 00000000 00000000 - 00004550 0005014C  ........PE..L...

bootloader >

Your current camera settings. Better known as the "params.bin" file. If you were to backup and save your IP Camera settings, using the IP Cameras Web UI. This is where the "params.bin" file is maintained and comes from and it's located at 0x7F1F0000 - 0x7F1F1533

Code: [Select]
d 0x7f1f0000
Displaying memory at 0x7F1F0000
[7F1F0000] 440C9ABD 000058F6 - 00001534 45363030  ...D.X..4...006E
[7F1F0010] 35303630 32314138 - 02250000 0902002F  06058A12..%./...
[7F1F0020] 6D65440C 6143206F - 6172656D 00003220  .Demo.Camera.2..
[7F1F0030] 00000000 64610000 - 006E696D 00000000  ......admin.....
[7F1F0040] 70000000 77737361 - 0064726F 00006461  ...password.ad..
[7F1F0050] 00000002 00000000 - 00000000 00000000  ................
[7F1F0060] 00000000 00000000 - 00000000 00000000  ................
[7F1F0070] 00000000 00000000 - 00000000 00000000  ................
[7F1F0080] 00000000 00000000 - 00000000 00000000  ................
[7F1F0090] 00000000 00000000 - 00000000 00000000  ................
[7F1F00A0] 00000000 00000000 - 00000000 00000000  ................
[7F1F00B0] 00000000 00000000 - 00000000 00000000  ................
[7F1F00C0] 00000000 00000000 - 00000000 00000000  ................
[7F1F00D0] 00000000 00000000 - 00000000 00000000  ................
[7F1F00E0] 00000000 00000000 - 00000000 00000000  ................
[7F1F00F0] 00000000 00000000 - 00000000 00000000  ................

bootloader >

Factory Defaults. This is where the IP Camera stores factory default values, that the IP Camera uses when you restore factory defaults using the Web UI or use the IP Cameras reset button, on the bottom of the IP Camera, which is located at 0x7F1F8000 - 0x7F1F9533:

Code: [Select]
D 0x7F1F8000
Displaying memory at 0x7F1F8000
[7F1F8000] 440C9ABD 000041A1 - 00001534 00000000  ...D.A..4.......
[7F1F8010] 00000000 00000000 - 00000000 00000000  ................
[7F1F8020] 00000000 00000000 - 00000000 00000000  ................
[7F1F8030] 00000000 64610000 - 006E696D 00000000  ......admin.....
[7F1F8040] 00000000 00000000 - 00000000 00000000  ................
[7F1F8050] 00000002 00000000 - 00000000 00000000  ................
[7F1F8060] 00000000 00000000 - 00000000 00000000  ................
[7F1F8070] 00000000 00000000 - 00000000 00000000  ................
[7F1F8080] 00000000 00000000 - 00000000 00000000  ................
[7F1F8090] 00000000 00000000 - 00000000 00000000  ................
[7F1F80A0] 00000000 00000000 - 00000000 00000000  ................
[7F1F80B0] 00000000 00000000 - 00000000 00000000  ................
[7F1F80C0] 00000000 00000000 - 00000000 00000000  ................
[7F1F80D0] 00000000 00000000 - 00000000 00000000  ................
[7F1F80E0] 00000000 00000000 - 00000000 00000000  ................
[7F1F80F0] 00000000 00000000 - 00000000 00000000  ................

bootloader >

The IP camera also contains a "stand-alone shell with built-in commands" also known as "Sash command shell (version 1.1.1)".

Here is a general list of Sash commands, please note that some commands are not presently supported in the IP Camera:

http://www.linuxcommand.org/man_pages/sash8.html (http://www.linuxcommand.org/man_pages/sash8.html)

To get to the shell commands supported by the IP Camera and leave the bootloader command interface. Simply place your cursor in the ClearTerminal main window and use your <Enter> key. This will give you a sh ("Shell Prompt") with the following commands:

Code: [Select]
/> help
cd         [dirname]
sleep      seconds
chgrp      gid filename ...
chmod      mode filename ...
chown      uid filename ...
cmp        filename1 filename2
cp         srcname ... destname
df         [file-system]
echo       [args] ...
exec       filename [args]
exit       
free       
help       
hexdump    [-s] filename
hostname   [hostname]
kill       [-sig] pid ...
ln         [-s] srcname ... destname
ls         [-lidC] filename ...
mkdir      dirname ...
mknod      filename type major minor
more       filename ...
mount      [-t type] devname dirname
mv         srcname ... destname
printenv   [name]
pwd       
pid       
quit       
rm         filename ...
rmdir      dirname ...
setenv     name value
source     filename
sync       
touch      filename ...
umask      [mask]
umount     filename
ps         
cat        filename ...
date       date [MMDDhhmm[YYYY]]
/>

Some Shell Command Examples

Directories in the cameras flash memory:

Code: [Select]
/> ls -la
drwxr-xr-x  1 0        0              32  Jan 01 1970  .
drwxr-xr-x  1 0        0              32  Jan 01 1970  ..
drwxr-xr-x  1 0        0              32  Jan 01 1970  bin
drwxr-xr-x  1 0        0              32  Jan 01 1970  dev
drwxr-xr-x  1 0        0               0  Jan 01 1970  etc
drwxr-xr-x  1 0        0               0  Jan 01 1970  flash
drwxr-xr-x  1 0        0               0  Jan 01 1970  home
dr-xr-xr-x 30 0        0               0  Jan 01 1970  proc
drwxr-xr-x  1 0        0               0  Jan 01 1970  swap
drwxr-xr-x  1 0        0               0  Jan 01 1970  tmp
drwxr-xr-x  1 0        0               0  Jan 01 1970  usr
drwxr-xr-x  1 0        0              32  Jan 01 1970  var
/>

Files in the bin directory:

Code: [Select]
/> cd bin
/bin> ls -la
drwxr-xr-x  1 0        0              32  Jan 01 1970  .
drwxr-xr-x  1 0        0              32  Jan 01 1970  ..
-rwxr-xr-x  1 0        0           12288  Jan 01 1970  .init.swo
-rwxr-xr-x  1 0        0          576972  Jan 01 1970  camera
-rwxr-xr-x  1 0        0           44792  Jan 01 1970  dhcpcd
-rwxr-xr-x  1 0        0             929  Jan 01 1970  fcc_ce.wlan

-rwxr-xr-x  1 0        0           21610  Jan 01 1970  ifconfig
-rwxr-xr-x  1 0        0             234  Jan 01 1970  init
-rwxr-xr-x  1 0        0           38300  Jan 01 1970  iwconfig
-rwxr-xr-x  1 0        0           33630  Jan 01 1970  iwpriv
drwxr-xr-x  1 0        0              32  Jan 01 1970  mypppd
-rwxr-xr-x  1 0        0           28824  Jan 01 1970  route
-rwxr-xr-x  1 0        0           31043  Jan 01 1970  sh
-rwxr-xr-x  1 0        0           48520  Jan 01 1970  wetctl
-rwxr-xr-x  1 0        0           96327  Jan 01 1970  wpa_supplic
ant
/bin>

Files in proc directory:

Code: [Select]
/bin> cd
/> cd proc
/proc> ls -la
dr-xr-xr-x 30 0        0               0  Jan 01 1970  .
drwxr-xr-x  1 0        0              32  Jan 01 1970  ..
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 1
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 14
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 15
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 16
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 17
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 18
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 19
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 2
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 20
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 25
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 26
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 27
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 28
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 3
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 30
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 4
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 5
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 6
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 7
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 8
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 9
dr-xr-xr-x  2 0        0               0  Jan 03 05:14 bus
-r--r--r--  1 0        0               0  Jan 03 05:14 cmdline
-r--r--r--  1 0        0               0  Jan 03 05:14 cpuinfo
-r--r--r--  1 0        0               0  Jan 03 05:14 devices
-r--r--r--  1 0        0               0  Jan 03 05:14 dma
dr-xr-xr-x  2 0        0               0  Jan 03 05:14 driver
-r--r--r--  1 0        0               0  Jan 03 05:14 execdomai
ns
-r--r--r--  1 0        0               0  Jan 03 05:14 filesyste
ms
-------r--  1 0        0               0  Jan 03 05:14 flash_4m
dr-xr-xr-x  2 0        0               0  Jan 03 05:14 fs
-------r--  1 0        0               0  Jan 03 05:14 i2s_dac
-r--r--r--  1 0        0               0  Jan 03 05:14 interrupt
s
-r--r--r--  1 0        0               0  Jan 03 05:14 iomem
-r--r--r--  1 0        0               0  Jan 03 05:14 ioports
-r--------  1 0        0        16781312  Jan 03 05:14 kcore
-r--------  1 0        0               0  Jan 03 05:14 kmsg
-r--r--r--  1 0        0               0  Jan 03 05:14 loadavg
-r--r--r--  1 0        0               0  Jan 03 05:14 locks
-r--r--r--  1 0        0               0  Jan 03 05:14 meminfo
-r--r--r--  1 0        0               0  Jan 03 05:14 misc
lrwxrwxrwx  1 0        0              11  Jan 03 05:14 mounts ->
 self/mounts
dr-xr-xr-x  3 0        0               0  Jan 03 05:14 net
-------r--  1 0        0               0  Jan 03 05:14 p1_p1
-r--r--r--  1 0        0               0  Jan 03 05:14 partition
s
lrwxrwxrwx  1 0        0              64  Jan 03 05:14 self -> 9

-rw-r--r--  1 0        0               0  Jan 03 05:14 slabinfo
-r--r--r--  1 0        0               0  Jan 03 05:14 stat
-r--r--r--  1 0        0               0  Jan 03 05:14 swaps
dr-xr-xr-x  4 0        0               0  Jan 03 05:14 tty
-r--r--r--  1 0        0               0  Jan 03 05:14 uptime
-r--r--r--  1 0        0               0  Jan 03 05:14 version
/proc>

Devices:

Code: [Select]

/proc> cat devices
Character devices:
  1 mem
  2 pty
  3 ttyp
  4 ttyS
  5 cua
 10 misc
 14 sound
 81 video_capture
 89 i2c
108 ppp
162 raw
180 usb
188 ttyUSB
200 ptz

Block devices:
 31 Blkmem
/proc>

Memory Info:

Code: [Select]
/proc> cat meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  15003648  6369280  8634368        0    45056  1269760
Swap:        0        0        0
MemTotal:        14652 kB
MemFree:          8432 kB
MemShared:           0 kB
Buffers:            44 kB
Cached:           1240 kB
SwapCached:          0 kB
Active:             44 kB
Inactive:         1240 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        14652 kB
LowFree:          8432 kB
SwapTotal:           0 kB
SwapFree:            0 kB
/proc>

To boot at anytime, after going into the shell command interface. Simply type "exit" without the double quotes. This will force the IP Camera to re-boot. You may need to place your cursor in the main ClearTerminal window and use your <Enter> key first, to get a shell prompt, to be able do this.

To stop at the bootloader prompt during boot, please use the ESC method shown here, before the 3 second timer expires.

Please never do a "del 0" command. The 0 image you see listed here when using the Bootloader ls command, is the boot information image area and if this is deleted it can/could cause issues. Also never use the "del" command alone, without a 6 or 7 following it. Some have reported that using the "del" command alone, even accidentally, has caused them issues. I have never tried it personally and have no need or desire, to learn, if this is true, or simply an Urban Legend.

When you enter a del 6 or del 7 Bootloader command, there will be a slight delay. The IP camera will then inform you that the delete process has completed. Please wait for that notification, before doing a Bootloader fx command.

After any file is downloaded to the IP Camera, you will need to place your cursor in the main window of ClearTerminal and use your <Enter> Key to get your Bootloader prompt back. You many need to use the <Enter> key more than once before you see the Bootloader prompt. You should then do a Bootloader ls command, to check if you see what you just downloaded is now present and with the proper image number, of 6 or 7.

To download the linux.zip file to the IP Camera, which is included in the .zip file, listed above, for this IP Camera, from the bootloader prompt do:

del 7
fx 7 linux.zip 0x7F020000 0x8000 -acxz

Then use the ClearTerminal Transfer to send the file as mentioned here.

To download the romfs.img file to the IP Camera, which is included in the .zip file, listed above, for this IP Camera, from the bootloader prompt do:

del 6
fx 6 romfs.img 0x7F0D0000 0x7F0D0000 -a

Then use the ClearTerminal Transfer to send the file as mentioned here.

Note: You must have both a linux.zip and romfs.img in order to boot properly.

Once done with the above enter the Bootloader command:

ls

You should see exactly this:

Code: [Select]
bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.zip base:0x7F020000 size:0x000AE000 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0D0000 size:0x000FC800 exec:0x7F0D0000 -a

bootloader >

Now you can enter this to reboot the IP Camera and see if whatever was wrong with your IP Camera, has now been fixed:

boot

The IP Camera should now reboot and you can view the boot process from ClearTerminal. There is no need to start a new connection for ClearTerminal, the connection will remain in place with ClearTerminal.

Don't use the ESC key, let the 3 second timer expire and let the IP Camera go into a normal boot process.

Give the IP Camera a couple of minutes to completely reboot.

You can now try to see if you are able to access the camera using the IP Cameras, IP Address and port in a browser window. You can also use the IP Camera Finder Tool included in the .zip file, listed above, to see what the current IP Address and port is for the IP Camera. You may need to also install the Web UI as well, if access to the IP Camera fails, when trying to access the IP Camera via a web browser, see below.

IMHO, for this IP Camera. I would NOT use the Bootloader method, to download the 0.2.9.12.bin ("WebUI") firmware file. Because this IP Camera does not use a image with a footer for that and you might end up stepping on something else in memory, like factory default settings, if they still happen to be there or even ending up with two copies of the 0.2.9.12.bin ("WebUI") firmware file, resident in memory, at the same time, because of doing so.

For example the next time you install firmware, using the normal Web UI firmware install method, from the IP Cameras Web UI. The IP camera, may place the 0.2.9.12.bin ("WebUI") Firmware file somewhere else in memory, leaving the other copy of the 0.2.9.12.bin ("WebUI") firmware file, where it was installed, using the Bootloader method as well.

It's better to use the IP Camera Finder Tool, included with the .zip file here, to install the 0.2.9.12.bin ("WebUI") for this IP Camera. When there is no functional Web UI for the IP Camera, currently to do so.

You can do that by starting the IPCamera.exe file, included with the .zip file, listed above. Locate the IP Camera, change the IP Address and port if needed. Once the IP Cameras IP Address and port are as you want it to be. Select the IP Camera from the IP Camera Finder Tool and then right click on it and choose "Upgrade Firmware". Then use the admin and password and choose  "Upgrade Web UI" select the "0.2.9.12.bin" file included in the .zip file.

(http://www.saveontelephonebills.com/camera/UpgradeWebUI.png)

If the IP Camera Finder Tool, fails to locate and find the IP Camera. You may need to connect the IP Camera via Ethernet cable directly to your Router/AP. This might be because your wireless settings need to be changed or defined.

If you are still having trouble and you only installed one of the two files, romfs.img or linux.zip, you should try installing the other file you did not install.

Once you have manually installed the linux.zip and/or romfs.img files using the bootloader. You should then re-install the system firmware from the IP Cameras UI, if all is well using the lr_cmos_0_37_2_47.bin file that is included in the .zip file. Just to verify that the camera can be re-flashed now, using normal methods.

It should be noted that if you do re-install the system firmware version lr_cmos_0_37_2_47.bin from the .zip file included here. That when using the ls Bootloader command afterwards. Things will be slightly different:

Code: [Select]
bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.bin base:0x7F020000 size:0x000ADFD8 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0D0000 size:0x000FC800 exec:0x7F0D0000 -a

Image 7, will now have a name of "linux.bin" vs. "linux.zip" and the size will be 0x000ADFD8 not 0x000AE000.

Again, this is why it is suggested to install the system firmware version lr_cmos_0_37_2_47.bin from the .zip file included here, at this point, using the normal methods to make sure that everything is exactly as it would have been, without this manual intervention.

The final step is to use the reset button on the bottom of your  IP Camera, while the  IP Camera is powered up, hold down the reset button for 20 seconds. You can use a bent paperclip to do this, if needed.

This should recover any factory default settings that your IP Camera may still have, that can now be attempted to be reloaded. This might be important for example, if you are trying to recover any free DDNS that came with the camera before it was having issues.

When you use the reset button on the IP Camera, you will need to connect the IP Camera directly to your Router/AP via an Ethernet cable to re-configure the IP Camera as if it just was taken out of the box.

If Things are back to normal. Maybe it's time to play with your IP Camera?

Here is a modified version of the Web UI, for this  IP Camera. Which I created using a version number of 0.2.9.13:

http://www.saveontelephonebills.com/camera/0.2.9.13.zip (http://www.saveontelephonebills.com/camera/0.2.9.13.zip)

It shows, just how easy it is to play with this IP Camera and make custom Web UI changes. It contains an Interface I created here, that normally runs externally from the IP Camera. This Interface works with any Internet browser capable device. From computers to tablets, to phones and TVs running on any Operating System and using any browser:

http://foscam.us/forum/free-generic-browser-interface-for-foscam-ip-mjpeg-cameras-t2522.html#p10970 (http://foscam.us/forum/free-generic-browser-interface-for-foscam-ip-mjpeg-cameras-t2522.html#p10970)

But....It's now running by being embedded in the IP Cameras Web UI firmware. Once this version of the Web UI is installed, simply use your normal IP camera IP Address and port or DDNS and add /public.htm:

Code: [Select]
http://xxx.xxx.xxx.xxx:####/public.htm
A working live example of this running from inside a live IP Cameras Web UI firmware, using a different name can be seen here:

http://foscam.us/forum/free-generic-browser-interface-for-foscam-ip-mjpeg-cameras-t2522-200.html#p17434 (http://foscam.us/forum/free-generic-browser-interface-for-foscam-ip-mjpeg-cameras-t2522-200.html#p17434)

You might say "So What!". Well, now you don't need to give people a direct link to your IP Cameras logon page and force them to always login, you can choose, if you wish to use auto-logon, you also don't need a web site, because the IP Camera is hosting this.

So as an example, you can simply use a link in a social media site that goes directly to your IP Camera. You can email a link to people. Using prompt for logon or auto-logon, which you can change/disable at anytime.

This special version of the Web UI is using a User Id of "public" and a password of "public", without the double quotes.

So, if your IP Camera has no User Id of "public", the Interface will be disabled. If you add a User Id of "public", but make the password something besides "public" then only people that know the User Id "public" and the correct password for "public" will be able to use public.htm.

Even better, because the Interface does things differently based on User Level. If you make User Id "public" a visitor User Level Id, then people accessing public.htm will only be able to view the IP Cameras video. At anytime, you could change the User Level of User Id "public" to be an Operator User Level Id, which then would allow people to both control and view the IP Camera.

Again, in all cases, only if they knew the password to User Id "public" or if you keep the password for public as "public" then they will not be required to logon to use public.htm.

But....How was it done? Show me Please!

Here is a copy of all the files, used to build this special custom Web UI firmware version 0.2.9.13.bin:

http://www.saveontelephonebills.com/camera/webui.zip (http://www.saveontelephonebills.com/camera/webui.zip)

The Web UI firmware for this IP Camera, 0.2.9.12.bin ("Yes, I know this Web UI is UGLY!"), was extracted and used as a base and rebuilt as 0.2.9.13.bin, using two new files. public.htm and jquery-latest.js ("So that public.htm could be used by IP Cameras, without the IP Cameras needing or requiring Internet access to get jquery-latest.js"). All other files in the .zip above were part of the stock 0.2.9.12.bin Web UI firmware version.

Additionally. All the string.js language files, located in each language folder, were modified to change var str_IP_Cam='IP Camera'; to var str_IP_Cam='TheUberOverLord Creations';

Sigh!

Now I have created yet another IP Camera Clone. Worse, I have shown others how to easily do the same.

2013 will become the "Year" of IP Camera clones, lol. Soon you will see posts like..."Does anyone else own a 'Bob's IP Camera Model Zx9?04792'? I can't seem to find the most current Web UI for this IP Camera, my current Web UI version number for this IP Camera brand and model is 6.6.6, it seems like it's missing a digit?" ::). After awhile, it becomes humorous with so many IP Camera clones out there. It took me 6 months working with Chinese suppliers to get the best quality cameras at the cheapest prices. So, it's time to be happy after all that hard work.

I mean "Come On" 8) everyone else has their own IP Camera brand :P. After all, the bottom of the camera only says "IP Camera" and only has the CE, FCC and RoHS logos and lists the free DDNS. Who would know?

Mom, I finally made it! My name in lights! ("Well, no reason to tell her IR lights").

This way, you see my Logo Name, on the logon screen for every language that can be used for the camera in the new 0.2.9.13.bin custom Web UI version vs. simply "IP Camera" which is what was there instead, before making the change. My graphic arts skills are even worse than my Linux skills. So there really is little hope of me, by myself, creating a drop-dead gorgeous Web UI, anytime soon from scratch. Ah...So much for the new "TheUberOverLord Creations" IP Cameras taking over the world! :'(

(http://www.saveontelephonebills.com/MyClone.png)

This was all done, by using win_fostarn.exe. Note: You will not be able to see the download links for win_fostarn, in the links below, without being registered and logged in here:

http://www.openipcam.com/forum/index.php/topic,101.msg449/topicseen.html#msg449 (http://www.openipcam.com/forum/index.php/topic,101.msg449/topicseen.html#msg449)

http://www.openipcam.com/forum/index.php/topic,166.msg1019/topicseen.html#msg1019 (http://www.openipcam.com/forum/index.php/topic,166.msg1019/topicseen.html#msg1019)

win_fostarn.exe must be run from a Windows command window. It does not have a GUI interface.

It should also be noted that, win_fostarn.exe was also used to split the normal system firmware.bin file lr_cmos_0_37_2_47.bin into separate linux.zip and romfs.img files from the lr_cmos_0_37_2_47.bin system firmware version, used here as well.

This also means that if you have a copy of any system firmware release .bin file your IP Camera has used, you should be able to spilt that file info a linux.zip and romfs.img file using win_fostarn.exe and use the same methods show here, to bring your IP Camera back to life, using the system firmware files, meant for your IP Camera.

You however most likely, would want or need to know where the proper base memory address locations should be and what the execution addresses should be, for each of these two files, for you IP Camera. Prior to downloading these files into your IP Camera.

Firmware for other IP Cameras, as well as recovery instructions for other IP Cameras, can also be found here, in the files section:

http://www.openipcam.com/files/ (http://www.openipcam.com/files/)

The win_fostarn.exe instructions below, can and will be displayed, when running win_fostarn.exe without any runtime parameters:

Code: [Select]
C:>win_fostarn.exe

win_fostarn.exe is a special purpose archive utility written to extract and crea
te
the firmwarefiles use by the Foscam FI8908W cameras. win_fostarn.exe can be ran
in
any one of the four operating modes, described below:

CREATE a new WebUI Firmware file (-c, --create)

    The following options are only valid when creating a WebUI file:

    --version=#.#.#.#     the version for the created file (# = 0-255)
    -o, --old             choose old file format
    --prefix=<path>       an alternate path prefix for the contents of
                          the newlycreated file.  ** USE WITH CAUTION **
    --action=<command>    **DON'T USE THIS**
    <filename>            the file name of the file to create.
    <path>                the path to the directory with the files to be
                          assembled.  (Don't specify a trailing '/')

  Example:   win_fostarn.exe -c -v 2.4.8.13 test.bin webui_contents

EXTRACT the contents of the WebUI firmware file (-x, --extract)

    The following arguments are needed when extracting a WebUI file:

    <filename>            the file name of the firmware file to extract.
    <path>                the path to an existing directory where the files
                          will be written to.(Don't specify a trailing '/')

  Example:   win_fostarn.exe -x 2.4.8.12.bin webui_contents

PACK a new system firmware file (-k, --pack)

    These options and argument are needed when packing a new system fw file:

    --linux=<image>       the linux image to include in the firmware file.
    --romfs=<image>       the romfs image to include in the firmware file.
    <filename>            the file name of the firmware file to create.

  Example:   win_fostarn.exe -k -l linux.bin -r romfs.img lc_cmos_11_14_1_46.bin


UNPACK system fw file into linunx.bin and romfs.img (-u, --unpack)

    The following argument is needed when unpacking a system fw file:

    <filename>            the name of the firmware file to extract.

  Example:   win_fostarn.exe -u lc_cmos_11_14_1_46.bin

*** REMEMBER! ALWAYS KEEP A BACKUP OF YOUR ORIGINAL FIRMWARE ***
*** I AM NOT RESPONSIBLE FOR YOU TURNING YOUR CAMERA INTO A PAPERWEIGHT ***

So as you can see, you can also use your IP Camera as a mini web server. You could add things to the IP cameras Web UI that have nothing to do with the IP camera and simply use it to serve web pages while it also is doing normal IP Camera tasks. The IP camera does have limited memory however, but this can be done, as you can see by this example. The camera functions as it has, the normal IP Camera Web UI has not been altered or impacted by customizing the Web UI firmware, in this example.

Don't like your IP Cameras Web UI. No problem, change it!

You can replace the custom version of the Web UI firmware at anytime, by installing the stock Web UI firmware version included in the .zip file here or by installing any other Web UI firmware version.

So, now that you got your paperweight back to life. Maybe it's time to celebrate, by making your IP Camera do things, it never could before as well? Maybe even, just make it look better, while it's doing what it normally does? Create your own IP Camera Brand *Cough*.

Other posts here, the Wiki as well as the files sections, have an abundance of information and extensive details, source code, tools and documentation on the magic that goes on inside many different IP cameras. This is simply one of many examples that can be found here.

Don

About Me: http://airforce.togetherweserved.com/sbv/TheUberOverLord (http://airforce.togetherweserved.com/sbv/TheUberOverLord)
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: admin on January 05, 2013, 09:39:56 pm
Nicely documented.  Made into a sticky post.
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: egrueda on February 03, 2013, 05:18:05 am
Oh man, what a great job you've done
Thumbs up! Thanks!
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Peanuts on April 09, 2013, 05:51:33 pm
Wow, I wish I understood half of that as it would of been realy usefull as I suspect the ebay clone I've just bought http://www.ebay.co.uk/itm/Internet-Wifi-Wireless-IP-CCTV-Remote-Security-Camera-Home-System-DVR-Recording-/250989575465?pt=UK_CCTV&hash=item3a7024fd29 is the same as what you bulk buy. Also the same these ebay listings:
250987931734
170918778521
230815331244
270992244861

It works,just not how its supposed to and I got no idea what Foscam firmware/web UI versions are compatible with it !.

Peter
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: celem on April 10, 2013, 04:17:28 pm
... I got no idea what Foscam firmware/web UI versions are compatible with it !...

Answer, none. The WebUI would probably work but possibly not all functions - ditti for the kernel although it is more dubious and romfs is VERY unlikely to work. Subtle hardware differences, especially around the sensor makes cross-brand compatibility virtually nil.
Title: Help with jtag
Post by: juna1103 on April 18, 2013, 05:12:17 pm
Hello\
Can you please help me with jtag part, when I connect the uart to ipcam logicboard and open terminal all that shows are weird symbols and charters like '' -; not the bootloader... please any idea what I am doing wrong.
Title: Re: Help with jtag
Post by: TheUberOverLord on April 18, 2013, 06:03:06 pm
Hello\
Can you please help me with jtag part, when I connect the uart to ipcam logicboard and open terminal all that shows are weird symbols and charters like '' -; not the bootloader... please any idea what I am doing wrong.

What are your settings for Baud rate, Data bits, Stop bits, Parity, Flow control?

Generally. The wrong settings, can cause these types of issues.

Example:

(http://www.saveontelephonebills.com/camera/ClearTerminalSettings.png)

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 18, 2013, 08:24:12 pm
Yes it was the setting thanks man..
I notice when it keeps rebooting it says this
can not resolve ntp server time.nist.govs  over and over again
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on April 18, 2013, 08:31:41 pm
Yes it was the setting thanks man..
I notice when it keeps rebooting it says this
can not resolve ntp server time.nist.govs  over and over again
You are very welcome.

This can be the case. However, in some cases you will see this error and afterwards the ntp server connection will work without informing you that it was resolved. So, it's not a fatal error in all cases.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 19, 2013, 08:07:30 am
Hey Don ( Thanks for the help )
When I press esc to debug it do anything the bootloader, I have a FI8918W with a reboot loop, and I was wondering would the files above work with my cam, it doesn't really matter because I can't get into debug to flash..
Thanks in advance
juna
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 19, 2013, 08:53:32 am
Hey  never mind the last question, I got into bootloader
But in bootloader when I try to send file image, it doesn't transfer the file it stay on 0% it will send the file when raw binary is selected
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on April 19, 2013, 09:43:15 am
Hey  never mind the last question, I got into bootloader
But in bootloader when I try to send file image, it doesn't transfer the file it stay on 0% it will send the file when raw binary is selected
You are very welcome.

Why not use ClearTerminal. The free tool, that I use in this example?

http://www.clearconnex.com/content/clearterminal

It works without any need to select file type.

Note: The firmware files are raw binary and need to be uploaded to the camera as such.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 19, 2013, 09:45:44 am
That is the one I am using, when I hit file to send, it gets stuck
Thanks Don
Will your romfs.img  file work with cam
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on April 19, 2013, 09:47:01 am
That is the one I am using, when I hit file to send, it gets stuck
Thanks Don
You are very welcome.

ok. So, it works with raw binary selected, correct?

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on April 19, 2013, 10:33:53 am
Yes raw did,  but when I did that the camera dosen't full reboot, it goes into bootloader, but the camera doesn't move around like it use to

What firmware did you use and did you place it in the proper place and use any setting and offsets that you saw, prior to installing it?

More importantly. Did you note these firmware locations and settings and any offsets, prior to installing the new firmware?

Example:

Code: [Select]
bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux.zip base:0x7F020000 size:0x000AE000 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0D0000 size:0x000FC800 exec:0x7F0D0000 -a

bootloader >

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 19, 2013, 05:05:20 pm
Yes I end up following your post to every line.. I finally got it to send the image and other files, but my camera still keeps rebooting or restarting, the pc see it and I can move the camera around but it doesn't show a image..
Would have any idea why it would keep restarting rebooting whatever? I know it not the frimware I have updated and down graded.. and nothing.
Please any help..
Thanks again Don   your post was very helpful
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on April 19, 2013, 05:11:45 pm
Yes I end up following your post to every line.. I finally got it to send the image and other files, but my camera still keeps rebooting or restarting, the pc see it and I can move the camera around but it doesn't show a image..
Would have any idea why it would keep restarting rebooting whatever? I know it not the frimware I have updated and down graded.. and nothing.
Please any help..
Thanks again Don   your post was very helpful
You are very welcome.

I assume this is happening in both wired and wireless mode? Have you tried both to see if one is ok and the other is not?

If so. Have you tried to use the reset button on the bottom of the camera, while the camera is powered on? You can use a bent paperclip to do this, and hold the reset button down while the camera is powered on, for 30 seconds.

If all the above fail. Most likely, some hardware component in the camera is causing the cameras initialization process to fail. So, the camera tries to auto-reboot to attempt to resolve that.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 20, 2013, 07:47:45 am
Thanks for the reply
Yes I tried all the reset button, wired, and wireless, nothing. The cam connects for seconds but shows nothing for a image, I can mess with the setting until it reboots seconds later..
When I had in bootloader, just before it would reboot it show this error.
ntpc.c: ntp server time.nist.govs ip
 
So I think it's like you say a hardware failure, I talk to a rep a Foscam about a warranty exchange because the cam is less than a year old, but because it a reseller I would have to ship it to them, pay for shipping and 45 dollars for the exchange. I see why the have the SCAM on Foscam..lol
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on April 20, 2013, 08:10:17 am
Thanks for the reply
Yes I tried all the reset button, wired, and wireless, nothing. The cam connects for seconds but shows nothing for a image, I can mess with the setting until it reboots seconds later..
When I had in bootloader, just before it would reboot it show this error.
ntpc.c: ntp server time.nist.govs ip
 
So I think it's like you say a hardware failure, I talk to a rep a Foscam about a warranty exchange because the cam is less than a year old, but because it a reseller I would have to ship it to them, pay for shipping and 45 dollars for the exchange. I see why the have the SCAM on Foscam..lol
You are very welcome.

Have you tried to change the cameras time sync settings. To see for example if you can change to sync with PC vs. what the NTP Server settings are now, to see if that changes anything?

I have heard some people complain, that if their Router/AP blocked access to the NTP server and/or DDNS, that their camera would go into a loop. Not sure if this is the same problem. But changing how the camera syncs time might help see if your problem could be the same.

If your firmware level allows disabling the DDNS, you might wish to try and do that as well. If the above change has no impact. Older firmware versions don't allow disabling the DDNS via the Standard Camera Interface GUI that comes with the camera. There are other methods via .cgi commands that can do this, if needed, however.

Of course, you could check to see if your Router/AP is blocking the NTP Server connection request and if it is also blocking the DDNS connection request as well.

More details about this, as well as how to resolve it. Can be found here:

http://foscam.us/forum/reboots-due-to-unreachable-ddns-t4082.html#p19292

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 21, 2013, 03:44:17 pm
Hey Don
  I did what you mention, I set the time and sync with the pc, on the camera web page, and it show the right time on the web page.
 But when I check it out with jtag, it said this 1969-12-31 17:00  and it show a ip address and it says access.
  It also showed this error  pid 30: failed 1792   also a different something like video stopped
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on April 21, 2013, 04:21:53 pm
Hey Don
  I did what you mention, I set the time and sync with the pc, on the camera web page, and it show the right time on the web page.
 But when I check it out with jtag, it said this 1969-12-31 17:00  and it show a ip address and it says access.
  It also showed this error  pid 30: failed 1792   also a different something like video stopped

Has the looping stopped?

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 21, 2013, 04:27:53 pm
No still with the looping, seems like it connects for 4 seconds more.. still rebooting and resetting..
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on April 21, 2013, 04:29:54 pm
No still with the looping, seems like it connects for 4 seconds more.. still rebooting and resetting..

Please try following the instructions here. To disable your DDNS:

http://foscam.us/forum/security-concern-with-myfoscam-org-t3728-10.html#p17816

Please also follow the instructions to save your DDNS information, so that if needed, you can restore it later.

You should also disable UPnP. The end-goal here is to try and disable anything that is external, that the camera maybe getting hung-up on during initialization. To see, if those things, somehow or someway could be causing the initialization loop you are seeing vs. some other problem.

Those external things are:

1. Time Servers
2. DDNS
3. UPnP

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 21, 2013, 04:39:41 pm
Hello
 The codes on to diable DDNS do copy and paste them in Clear terminal?  I don't understand where to paste the codes..

Also the errors I was telling you about in my last reply, those error is what I get just before the cam reboots.
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on April 21, 2013, 04:40:57 pm
Hello
 The codes on to diable DDNS do copy and paste them in Clear terminal?  I don't understand where to paste the codes..

Also the errors I was telling you about in my last reply, those error is what I get just before the cam reboots.

The instructions include .cgi commands that are executed in a browser window. Not via the serial interface to the camera.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 21, 2013, 06:07:39 pm
So right in the search bar?
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on April 21, 2013, 06:09:23 pm
So right in the search bar?

Right where you enter web sites in your browser window.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: juna1103 on April 26, 2013, 04:43:26 pm
Hey Don
 Thanks for all your help man.. That didn't work, I sent the system logs from clear terminal, to foscam tech, they say what is happening is the lens motherboard, is not communicating to the ip cam motherboard. Thats why I keep getting reboots, right before  the camera is supposed to show a image..
 Anyway there going to let me exchange but they want 45 dollars, I think i'm going to do it..
Thanks again for all the help and replies..
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Malvineous on May 03, 2013, 10:46:56 pm
@TheUberOverLord: Just FYI to save you some trouble, when the bootloader gives you the prompt to press ESC you can also type a capital B to do the same thing, so you don't have to mess around with sending the code for ESC.  Found this out in the bootloader manual.
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on May 04, 2013, 02:58:11 am
@TheUberOverLord: Just FYI to save you some trouble, when the bootloader gives you the prompt to press ESC you can also type a capital B to do the same thing, so you don't have to mess around with sending the code for ESC.  Found this out in the bootloader manual.

Yes. Sadly. My original post is at the maximum number of characters. I was going to add that earlier, but the post edit would not take, because the post exceeded maximum text length. So, thanks.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Jay G. on May 23, 2013, 06:30:44 pm
Hi,

I have the same motherboard in one of my cams that I'm currently hacking/modding.

I am in the processes of integrating a NAS (WLX-652), a wireless router (DIR-615)
and one of these cams into a DVR chassis to make a 'Linux CCTV Alarm Box'.
The idea is to make use of the motor IO lines for sensors and external automation,
plus, maybe also make use of the ex-WiFi module's USB controller. <Had to remove
those parts, its a long story! (Detailed in my other post/topic) :-)

Do you have any knowledge of what the latest firmware and web ui files are for the
IPCAM_PT2_V3.3f_sc board as at the moment I think I have rather old ones, its on
FW-0.23.2.14 & WebUI-0.3.2.6 and it wasn't the best cam for stability, but it seems
quite ok now its been stripped of extras and transplanted into the ex-DVR box!

Any advice or pointers (or firmwares! :-D) for what I am trying to do here would be
most helpful indeed,

Thanks in advance,

Jay G.
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 27, 2014, 09:23:01 am
Hi guys,

Thanks for this guide I have successfully fixed my camera by following this.  Thanks for all the hard work.

I am now in a position where I have 0.37.2.47 and web 0.2.9.12 installed.

The web UI seems older (or newer) than my old one.  The old one said something like 2 login options, 1 was "push mode"

Also the wifi when scanning will not pick up any networks.

Does anyone know the latest firmware and web ui for these cameras and how I identify exactly which camera I have got?

Thanks in advance!
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 27, 2014, 01:34:13 pm
Hi,

I have now managed to upgrade the Web UI back to what I think was the old one (2.4.8.14) it certainly looks the same.

I am trying to now update the firmware in the hope that the Wifi will start working again.

I have tried 11.14.1.42 and some others in the series.  Some fail, some say upgrading, but when the camera reboots it is still showing 0.37.2.47

Does the way the zip file gets copied in this fix essentially lock any firmware upgrades?

Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on November 27, 2014, 04:58:05 pm
Hi,

I have now managed to upgrade the Web UI back to what I think was the old one (2.4.8.14) it certainly looks the same.

I am trying to now update the firmware in the hope that the Wifi will start working again.

I have tried 11.14.1.42 and some others in the series.  Some fail, some say upgrading, but when the camera reboots it is still showing 0.37.2.47

Does the way the zip file gets copied in this fix essentially lock any firmware upgrades?



Please install the 11.22.2.51 version of firmware here for the FI8910W/FI8918W:

http://www.foscam.com/down3.aspx

The firmware you installed is for cameras that have wireless daughterboards for 802.11 b,g,n

Cameras that have VNT followed by letters/numbers ("MAC Address") on their labels only support 802.11 b,g

x.37 firmware releases are for cameras that have FR followed by letters/numbers ("MAC Address") wireless daughterboards on their labels.

Because the firmware current installed can't recognize or communicate with the current wireless daughterboard in the camera. Wireless functions won't work for the camera. Until you install the correct firmware.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 27, 2014, 05:36:03 pm
Thanks

I think the version you speak of is the one that bricked it in the first place!

I have just  tried to apply it from ip camera tool and it gets progress bar to about 80% then freezes.  Then a warning pops up but there is not message in the box just an OK button.

It has rediscovered the camera so its not bricked but its still showing 0.37.2.47

Thanks

Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on November 27, 2014, 05:49:28 pm
Thanks

I think the version you speak of is the one that bricked it in the first place!

I have just  tried to apply it from ip camera tool and it gets progress bar to about 80% then freezes.  Then a warning pops up but there is not message in the box just an OK button.

It has rediscovered the camera so its not bricked but its still showing 0.37.2.47

Thanks

You are in a real pickle of a situation that most likely can't be resolved without the use of a serial TTY adapter.

The issue is this:

Due to you installing the incorrect firmware for the camera and coincidentally that firmware versions number being higher ("System firmware last two digits") than any versions for the correct firmware for your camera. That incorrect firmware won't let you simply downgrade to a lower firmware version.

This was done to protect camera owners. Because prior to the .59 system firmware versions. Many security vulnerabilities were found and fixed in the .59 systems firmware versions.

So the only way out of this mess. Is to use special firmware recovery software. Which I have, but it requires the use of the methods which I show in this thread which I created as well. Using a serial adapter.

Note: It's never recommended by anyone I am aware of to try this or that firmware before asking many questions first. In places like here. In most cases where that's not done. Results are equal to yours.

Usually someone here just by getting camera label and/or other details about your camera can tell you if it's good or bad idea. On a case by case, camera by camera basis.

There are no other methods to resolve your situation other than using a 3.3V DC TTL Serial Adapter, connected to your camera to install the proper camera recovery firmware. Are you willing and capable to take on a procedure like this, as shown in this Forum thread. At your own risk?

Do you see a FR or a VNT followed by letters/numbers ("The Cameras Wireless MAC Address") on the cameras label, anywhere?

Because the recovery methods and firmware used to recover the camera, are reliant on it being FR or VNT based, as far as wireless daughterboards are concerned.

If you use the wrong recovery firmware and methods. Your camera can become a eternal paperweight.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 27, 2014, 07:58:21 pm
Hi thanks for your continued help.

I am comfortable with using the TTL as I used this to get to this stage in the first place.  It wouldn't even start up before.  I found this thread and it matched my symptoms and device  and hence I downloaded your files and gave it a go.

The wifi label says VNT in the model number.

Thanks
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on November 28, 2014, 01:34:19 am
Hi thanks for your continued help.

I am comfortable with using the TTL as I used this to get to this stage in the first place.  It wouldn't even start up before.  I found this thread and it matched my symptoms and device  and hence I downloaded your files and gave it a go.

The wifi label says VNT in the model number.

Thanks

You are very welcome.

I have sent you your camera recovery instructions via PM ("Private Message") in the forum.

Dom
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 28, 2014, 06:25:13 am
Hi,

Thanks for the file. 

I have applied it.  I notice the address where their instructions place romfs.img are slightly different to your instructions here.

Everything seemed in order but the camera is booting, doing about a quarter of the pan that it normally does at boot time and stopping.  In this time the camera appears in the Ip camera tool then when it stops rotating it dissapears again and restarts the boot process.

I see you mentioned FI8910W and the file is named as such.

I believe mine is a clone (as referenced in this thread) of the FI8908W.  Is that important?

Thanks again
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 28, 2014, 06:32:10 am
Scrap that.  Ive took it to bits again and it is now rotating!  I must have put it together badly.

Now showing 11.22.2.51 2.4.8.14

You said update to latest version after ive applied it?  What is the latest version?  looking at the site it looks like 11.22.2.51 ?

Thanks
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on November 28, 2014, 06:47:46 am
Scrap that.  Ive took it to bits again and it is now rotating!  I must have put it together badly.

Now showing 11.22.2.51 2.4.8.14

You said update to latest version after ive applied it?  What is the latest version?  looking at the site it looks like 11.22.2.51 ?

Thanks

You are very welcome.

The instructions I supplied to you are current vs. instructions for firmware version made many years ago. Which is why they are different.

I always say to check for the latest versions of firmware. Once the camera has been recovered because the recovery firmware can lag behind the current firmware versions.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 28, 2014, 07:10:03 am
hmm, now its not spinning again on boot up, only for about 3 seconds.  I still have it in bits so im a little confused.  When it was on I still could not see wifi networks either oddly.  Could the spinning issue be software?  It was fine before.  Might have to confine this one to the bin!
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on November 28, 2014, 07:33:49 am
hmm, now its not spinning again on boot up, only for about 3 seconds.  I still have it in bits so im a little confused.  When it was on I still could not see wifi networks either oddly.  Could the spinning issue be software?  It was fine before.  Might have to confine this one to the bin!

Please define "Spinning" using more detail.

Secondly. Try doing a "Hard Reset" using the reset button on the bottom of the camera using a paperclip if needed. Holding down the reset button for 30 seconds. While the camera is powered up.

Note: You will need to reconfigure the camera using a hard wired Ethernet connection, because this will set the camera to factory defaults as if it just came out of the box.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 28, 2014, 08:43:24 am
When the camera switches on it does some sort of self check where it rotates through all the axis of movement.  That normally lasts about 30 seconds.  Now it is just doing it for about 3 seconds then stops and resets and does the same again.

Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on November 28, 2014, 08:45:26 am
When the camera switches on it does some sort of self check where it rotates through all the axis of movement.  That normally lasts about 30 seconds.  Now it is just doing it for about 3 seconds then stops and resets and does the same again.

With the serial connection going. What bot text do you see when/while this is going on?

Any errors and if so, what?

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 28, 2014, 08:51:04 am
I need to hook it up and take a look, its disconnected from the serial cable now.

Thanks
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 28, 2014, 09:28:17 am
Seems to be only when a network lead connected it has the spinning freeze issue...
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 28, 2014, 10:52:13 am
It boots up OK when you have network lead out.

As soon as you plug it in this happens.

MAC Line-on...

Wait for auto-negotiation complete...OK
100MB - FULL
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth0
down wire eth
MAC Line-off...
sh: allocation of 118 pages failed!
Allocation of length 482353 from process 34 failed
Buffer memory:        0kB
Cache memory:     1132kB
Active: 0, inactive: 283, free: 99
Free pages:      99 (396kB), %5 frag, %0 slack
Free blks:        5 min=1 max=92 avg=19
Used blks:        6 min=1 max=1474 avg=324
Unable to allocate RAM for process text/data, errno 12

Then it reboots and this happens.  With network lead in it does the freeze at each reboot

W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Au
g 19 2009
Memory Size is 0x800000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:60:6E:80:3F:10
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #2020    3   27 11:05:03 CST 2013
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 2048
zone(0): 0 pages.
zone(1): 2048 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 8MB = 8MB total
Memory: 6416KB available (1399K code, 192K data, 40K init)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
PTZ Driver has been installed successfully.
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80100 (irq = 10) is a W90N7451
I2C Bus Driver has been installed successfully.
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0E0000-7F1E17FF [VIRTUAL 7F0E0000-7F1E17FF] (RO)
W19B320SB Flash Detected
01 eth0 initial ok!
which:0
PPP generic driver version 2.4.2
Linux video capture interface: v1.00
i2c write io
i2s audio write failed
i2s audio probe 0
Winbond Audio Driver v1.0 Initialization successfully.
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver audio
audio.c: v1.0.0:USB Audio Class driver
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4
rtusb init rt2870 --->
usb.c: registered new driver rt2870
dvm usb cam driver 0.0.0.1 by Maverick Gao in 2010-8-3
usb.c: registered new driver dvm
dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20
usb.c: registered new driver dvm usb cam driver for sonix288
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: -t
Command: mount -t proc none /proc
Command: mount -t ramfs none /usr
Command: mount -t ramfs none /swap
Command: mount -t ramfs none /var/run
Command: mount -t ramfs none /etc
Command: mount -t ramfs none /flash
Command: mount -t ramfs none /home
Command: mount -t ramfs none /tmp
Command: mkdir /tmp/run
Command: camera&
[8]
Command: sh

Sash command shell by maverick (version 1.1.1)
no support
/> hub.c: connect-debounce failed, port 1 disabled
new USB device :807cee04-7e8740
hub.c: new USB device 1, assigned address 2
detect_sensor: mi360
dvm cmos successfully initialized
dvm camera registered as video0
new USB device :807b3204-7e8740
hub.c: new USB device 2, assigned address 3
usb.c: USB device 3 (vend/prod 0x160a/0x3184) is not claimed by any active driver.
params length is 5428
sw version is 11.22.2.51
aw version is 2.4.8.14

Wait for auto-negotiation complete...OK
100MB - FULL
eth1: unknown interface: Unknown error 19
eth1: unknown interface: Unknown error 19
video0 opened
1
1
1
1
1
1
set resolution 5
set brightness 80
set contrast 4
set sharpness 3
set mode 0
unknown command
do_zoom_stop: read error 5
do_focus_stop: read error 5
__pthread_initial_thread_bos:470000
manage pid:18
set speed 8000 0
set channels 1 0
set fmt 432 0
audio_dev.state not AU_STATE_RECORDING
wb_audio_start_record
2
2
2
2
2
2
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth0


Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 28, 2014, 11:00:31 am
This is a clean boot with no network lead connected.

The spinning starts after the auto negotiation and ethernet errors.  The scanning accross all axis then completes.



W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
Memory Size is 0x800000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:60:6E:80:3F:10
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...



W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
Memory Size is 0x800000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:60:6E:80:3F:10
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #2020    3   27 11:05:03 CST 2013
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 2048
zone(0): 0 pages.
zone(1): 2048 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 8MB = 8MB total
Memory: 6416KB available (1399K code, 192K data, 40K init)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
PTZ Driver has been installed successfully.
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80100 (irq = 10) is a W90N7451
I2C Bus Driver has been installed successfully.
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0E0000-7F1E17FF [VIRTUAL 7F0E0000-7F1E17FF] (RO)
W19B320SB Flash Detected
01 eth0 initial ok!
which:0
PPP generic driver version 2.4.2
Linux video capture interface: v1.00
i2c write io
i2s audio write failed
i2s audio probe 0
Winbond Audio Driver v1.0 Initialization successfully.
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver audio
audio.c: v1.0.0:USB Audio Class driver
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4
rtusb init rt2870 --->
usb.c: registered new driver rt2870
dvm usb cam driver 0.0.0.1 by Maverick Gao in 2010-8-3
usb.c: registered new driver dvm
dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20
usb.c: registered new driver dvm usb cam driver for sonix288
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: -t
Command: mount -t proc none /proc
Command: mount -t ramfs none /usr
Command: mount -t ramfs none /swap
Command: mount -t ramfs none /var/run
Command: mount -t ramfs none /etc
Command: mount -t ramfs none /flash
Command: mount -t ramfs none /home
Command: mount -t ramfs none /tmp
Command: mkdir /tmp/run
Command: camera&
[8]
Command: sh

Sash command shell by maverick (version 1.1.1)
no support
/> hub.c: connect-debounce failed, port 1 disabled
new USB device :807cee04-7e8740
hub.c: new USB device 1, assigned address 2
detect_sensor: mi360
dvm cmos successfully initialized
dvm camera registered as video0
new USB device :807b3204-7e8740
hub.c: new USB device 2, assigned address 3
usb.c: USB device 3 (vend/prod 0x160a/0x3184) is not claimed by any active driver.
params length is 5428
sw version is 11.22.2.51
aw version is 2.4.8.14

Wait for auto-negotiation complete...ResetPhyChip Failed
eth1: unknown interface: Unknown error 19
eth1: unknown interface: Unknown error 19



W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
Memory Size is 0x800000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:60:6E:80:3F:10
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #2020    3   27 11:05:03 CST 2013
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 2048
zone(0): 0 pages.
zone(1): 2048 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 8MB = 8MB total
Memory: 6416KB available (1399K code, 192K data, 40K init)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
PTZ Driver has been installed successfully.
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80100 (irq = 10) is a W90N7451
I2C Bus Driver has been installed successfully.
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0E0000-7F1E17FF [VIRTUAL 7F0E0000-7F1E17FF] (RO)
W19B320SB Flash Detected
01 eth0 initial ok!
which:0
PPP generic driver version 2.4.2
Linux video capture interface: v1.00
i2c write io
i2s audio write failed
i2s audio probe 0
Winbond Audio Driver v1.0 Initialization successfully.
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver audio
audio.c: v1.0.0:USB Audio Class driver
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4
rtusb init rt2870 --->
usb.c: registered new driver rt2870
dvm usb cam driver 0.0.0.1 by Maverick Gao in 2010-8-3
usb.c: registered new driver dvm
dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20
usb.c: registered new driver dvm usb cam driver for sonix288
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: -t
Command: mount -t proc none /proc
Command: mount -t ramfs none /usr
Command: mount -t ramfs none /swap
Command: mount -t ramfs none /var/run
Command: mount -t ramfs none /etc
Command: mount -t ramfs none /flash
Command: mount -t ramfs none /home
Command: mount -t ramfs none /tmp
Command: mkdir /tmp/run
Command: camera&
[8]
Command: sh

Sash command shell by maverick (version 1.1.1)
no support
/> hub.c: connect-debounce failed, port 1 disabled
new USB device :807cee04-7e8740
hub.c: new USB device 1, assigned address 2
detect_sensor: mi360
dvm cmos successfully initialized
dvm camera registered as video0
new USB device :807b3204-7e8740
hub.c: new USB device 2, assigned address 3
usb.c: USB device 3 (vend/prod 0x160a/0x3184) is not claimed by any active driver.
params length is 5428
sw version is 11.22.2.51
aw version is 2.4.8.14

Wait for auto-negotiation complete...ResetPhyChip Failed
eth1: unknown interface: Unknown error 19
eth1: unknown interface: Unknown error 19
video0 opened
1
1
1
1
1
1
set resolution 5
set brightness 80
set contrast 4
set sharpness 3
set mode 0
unknown command
do_zoom_stop: read error 5
do_focus_stop: read error 5
__pthread_initial_thread_bos:470000
manage pid:18
set speed 8000 0
set channels 1 0
set fmt 432 0
audio_dev.state not AU_STATE_RECORDING
wb_audio_start_record
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
bonjour callback: service registered
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
armed !!!!!!
start alarm video 2480
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
motion detect alarm !!!!!!
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
_i2c_write: write i2c error
_i2c_write: write i2c error
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on November 28, 2014, 02:16:46 pm
Do you have a spare Ethernet cable you can try to see if that current cable is bad?

Or use the current Ethernet Cable with another device to see if that device can connect to the Router/AP using the same cable?

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on November 28, 2014, 02:35:30 pm
Yeh tried 2 different cables now, same deal :(
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on November 28, 2014, 07:09:44 pm
Yeh tried 2 different cables now, same deal :(

Was the Ethernet connection working with the x.37 firmware version?

I am wondering if your "Clone" is using a different Ethernet adapter interface that works with x.37 but not this .22 version. This would mean you might need to choose one firmware version of the other. One with working wireless and one with working Ethernet. Assuming that you configured your wireless prior to changing firmware versions.

I will PM you the x.37 recovery instructions and see if it boots with it.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Syab on December 02, 2014, 04:08:04 am
Hi all.

First of all sorry my bad English.

So, i have a Neo CoolCam Nip-02 Oam (http://en.szneo.com/en/products/show.php?id=142).
I want to flash rom and firmware via uart. I open Hyperterminal and i can connect the camera, press ESC and i'm in the boot loader. I type del 6 and del 7 and everything works fine. In the next step i send and flashing rom.img and linux.zip :

fx 7 linux.zip 0x7f020000 0x8000 -acxz
fx 6 rom.img 0x7f0e0000 0x7f0e0000 -a

I send the boot command and the camera reboot. This step the camera unzip the linux.zip and I always get this message "open video device error ... myreboot". I try a lot of rom and a lot of firmware. Please help me, anybody can link me a good rom and a good firmware ? Thanks
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: Resonate on December 06, 2014, 09:06:12 am
Hi,

Ive upgraded as per the files you sent me and im now at 11.37.2.51 and 2.4.8.14

Camera is stable now i dont get no freeze when booting with network lead in but the wifi is still not working....

When I press scan nothing is found and when i configure manually it does not connect.

here is the output from boot

W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
Memory Size is 0x800000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

MAC Address         : 00:60:6E:80:3F:10
IP Address          : 0.0.0.0
DHCP Client         : Enabled
CACHE               : Enabled
BL buffer base      : 0x00300000
BL buffer size      : 0x00100000
Baud Rate           : -1
USB Interface       : Disabled
Serial Number       : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #2020    3   27 11:05:03 CST 2013
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 2048
zone(0): 0 pages.
zone(1): 2048 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 8MB = 8MB total
Memory: 6416KB available (1399K code, 192K data, 40K init)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
PTZ Driver has been installed successfully.
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80100 (irq = 10) is a W90N7451
I2C Bus Driver has been installed successfully.
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0E0000-7F1E17FF [VIRTUAL 7F0E0000-7F1E17FF] (RO)
W19B320SB Flash Detected
01 eth0 initial ok!
which:0
PPP generic driver version 2.4.2
Linux video capture interface: v1.00
i2c write io
i2s audio write failed
i2s audio probe 0
Winbond Audio Driver v1.0 Initialization successfully.
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver audio
audio.c: v1.0.0:USB Audio Class driver
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4
rtusb init rt2870 --->
usb.c: registered new driver rt2870
dvm usb cam driver 0.0.0.1 by Maverick Gao in 2010-8-3
usb.c: registered new driver dvm
dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20
usb.c: registered new driver dvm usb cam driver for sonix288
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: -t
Command: mount -t proc none /proc
Command: mount -t ramfs none /usr
Command: mount -t ramfs none /swap
Command: mount -t ramfs none /var/run
Command: mount -t ramfs none /etc
Command: mount -t ramfs none /flash
Command: mount -t ramfs none /home
Command: mount -t ramfs none /tmp
Command: mkdir /tmp/run
Command: camera&
[8]
Command: sh

Sash command shell by maverick (version 1.1.1)
no support
/> hub.c: connect-debounce failed, port 1 disabled
new USB device :807cee04-7e8740
hub.c: new USB device 1, assigned address 2
detect_sensor: mi360
dvm cmos successfully initialized
dvm camera registered as video0
new USB device :807b3204-7e8740
hub.c: new USB device 2, assigned address 3
usb.c: USB device 3 (vend/prod 0x160a/0x3184) is not claimed by any active driver.
params length is 5428
sw version is 11.37.2.51
aw version is 2.4.8.14

Wait for auto-negotiation complete...OK
100MB - FULL
eth1: unknown interface: Unknown error 19
eth1: unknown interface: Unknown error 19
video0 opened
1
1
1
1
1
1
set resolution 5
set brightness 80
set contrast 4
set sharpness 3
set mode 0
unknown command
_i2c_write: write i2c error
_i2c_write: write i2c error
do_zoom_stop: read error 5
do_focus_stop: read error 5
__pthread_initial_thread_bos:470000
manage pid:18
set speed 8000 0
set channels 1 0
set fmt 432 0
audio_dev.state not AU_STATE_RECORDING
wb_audio_start_record
2
2
2
2
2
2
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth0
ntpc adjust ok
armed !!!!!!
start alarm video 2359
motion detect alarm !!!!!!
_i2c_write: write i2c error
_i2c_write: write i2c error
do_file: can not find file favicon.ico
start monitor video 9869
stop monitor video
motion detect alarm !!!!!!
process_HTTP_REQ: can not recv total http head
process_HTTP_REQ: can not recv total http head
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on December 07, 2014, 12:46:01 am
Based on your results. It appears.

a. The WiFi daughter board in your IP Camera used for wireless communications. Is not the same brand/model, which is used in Foscam MJPEG based IP Cameras.

b. There is some hardware issue with the WiFi Daughter board in your camera.

Can you capture a serial boot with your IP Camera not having a Ethernet hardwired connection and post that text here. It might help to determine if any WiFi initialization problems are taking place or give some insight into what your issue is.

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: barrys on July 21, 2015, 08:29:57 pm
Hi Don,
Thanks for such a thorough post.  I think I found the clone cam but figured I'd pass it by you and others to make sure:
http://www.ebay.com/itm/Sricam-Wireless-WiFi-IP-Camera-PT-Record-Audio-Smartphone-Android-iPhone-View-/171214170640?pt=LH_DefaultDomain_0&hash=item27dd28ea10

For about half price (40.00), that seems like a great deal.

I would love to start tweaking on the foscam f/w since I think they missed a few useful APIs.  But, I'll continue that on the foscam forum.
In the meantime, I'd like to try some of these cams just for fun.  So far, I'm having a tough time finding pics from all angles.
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: barrys on July 21, 2015, 08:39:36 pm
Actually I think this is more like it since it has the 4 alarm pin outputs.
http://www.ebay.com/itm/New-Wireless-WiFi-IP-Security-Camera-Monitor-IR-LED-Webcam-Night-Vision-Network-/111720121533?pt=LH_DefaultDomain_0&hash=item1a0309c4bd
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: TheUberOverLord on July 21, 2015, 08:44:42 pm
Hi Don,
Thanks for such a thorough post.  I think I found the clone cam but figured I'd pass it by you and others to make sure:
http://www.ebay.com/itm/Sricam-Wireless-WiFi-IP-Camera-PT-Record-Audio-Smartphone-Android-iPhone-View-/171214170640?pt=LH_DefaultDomain_0&hash=item27dd28ea10

For about half price (40.00), that seems like a great deal.

I would love to start tweaking on the foscam f/w since I think they missed a few useful APIs.  But, I'll continue that on the foscam forum.
In the meantime, I'd like to try some of these cams just for fun.  So far, I'm having a tough time finding pics from all angles.

Hello. You are very welcome.

It's tough to look at the outside of a Network IP Camera and try to determine if it's compatible with the firmware shown here.

The only true way is to open the camera up and see if it looks like you can create a serial connection with it and see if it has some of the same values at the same hex locations shown here.

If it does not. Please don't try to update the firmware using these methods. Because you will most likely eternally brick your Network IP Camera by potentially stepping on important factory default memory locations like the Network IP Cameras Serial Number, MAC Address and/or DDNS. Which can cause the Network IP Camera to never be able to perform a successful startup process ("Boot") afterwards.

As far as doing the same for Foscam Network IP Cameras. Currently I don't have the liberty of providing that information because I am a moderator in the Foscam.us forum and am under and have NDA's ("Non Disclosure Agreements") with Foscam.

That all said. There are other ways to create your own custom front ends to many different Network IP Cameras. Which don't require the opening of a Network IP Camera and don't require the risk of bricking a Network IP Camera, by needing to install custom firmware.

Here are 40 different live Network IP Camera demonstrations using custom Interfaces without requiring custom firmware. You can try any and all of the current 40 examples shown below.

Please click on the image or link below to see the entire list of the 40 different live Network IP Camera demonstrations using my current Interfaces, to choose from:

(http://www.saveontelephonebills.com/camera/LiveDemoCameraList.png) (http://107.170.59.150)

http://107.170.59.150

Note: The above list has a language translation list box to automatically translate the list from English to over 90 different languages.

Over the years. I have come to determine that having the obligation to always update custom firmware to match a Network IP Cameras manufacturers latest firmware releases, becomes very burdensome vs. leaving the firmware updates to the manufactures and instead trying to create custom Interfaces to those Network IP Cameras that work with any Internet browser capable devices which are running on any Operating Systems and using any browsers. From Computers to Tablets to Phones and TV's. Without requiring special custom firmware to use those Interfaces. 

Don
Title: Re: Another Foscam FI8908W Clone Firmware Exploration
Post by: barrys on July 21, 2015, 10:55:47 pm
Hi Don,
I just messaged you on skype (as V Schwartz)....
I'm going through the NDA process w/ foscam now.  I also asked a really specific functionality question there which would be the only reason I'd start hacking on f/w.  And, I agree it's unstable and a pain to keep it up to date.