Open IP Camera Forum

Development => Hacking & Modding => Topic started by: Robo on April 19, 2013, 10:27:29 pm

Title: Hacking the IPRobot3
Post by: Robo on April 19, 2013, 10:27:29 pm
The IPRobot3 is an HD IP Camera based on the ARM9 GM8126 chip that uses H.264 video encoding.  Like most cameras in this class, it has limitation.  It has dependency on Microsoft IE  for all the features, however, it will work with other browsers with limitations. There is a TIFF SD slot that is only visible when using IE.  The recording alarm feature will continue to record to the SD when not connected to a browser. When connected to IE, it offloads the SD stored content to your local hard drive.  There are firmware updates for the camera, but they are experiential and found in the Tenvis forums.   Be very careful when you update the firmware. Be sure your connected to the LAN and not Wifi since if you run into any problems doing a firmware upgrade, you void the warranty.

Hacking:  If you open the camera case, you will find that J9 on the main board is the serial console and with a USB to 3.3v TTL converter, it works great. The baud rate is 38400 n81 no handshaking and the pin order is 3.3v, gnd, rx, tx on the pcb (do not connect 3.3v and swap TR/RX from the converter).  The silkscreen of J9 does not indicate pin 1, so use a ohm meter to find gnd and go from there.  J9 are just solder tabs that you have to solder to.

The IRobot3 is a linux based system. It is using U-Boot as the bootloader.  With hyperterminal you can watch the linux bootlog of the camera as it loads or hit ESC in the first 2 seconds to get into U-Boot. Uboot has a lot of commands.

Get involved and share your efforts and hacks here. Items for community involvement would be to unpacking the firmware (found here  http://forum.tenvis.com/forum-redirect-goto-findpost-ptid-485-pid-1834.html  version 1.1.2.6),  build a memory map of the hardware, access the flash memory of the camera, update the UI and recompile the firmware.
Title: Disabling the IR LEDs
Post by: Robo on April 28, 2013, 04:24:47 am
Disabling the IR LEDs

If you have an IPRobot3 from Tenvis and you are waiting for new firmware that will control the IR LEDs, but keep the Lens filter enabled (this is the clicking sound), then you are in for a long wait! Tenvis claims it is a hardware issue and can not be controlled with firmware.  I needed the camera to work behind glass at night, so I covered the IR LEDs with aluminum tape.  It did hide the red hue of the LEDs, but still behind glass, there was some IR reflection in the shape of a crescent moon that was escaping from camera lens area.  Next I opened the optics housing and took a closer look at the sensor PCB.  U501 is the MPU that controls the IR LEDs and the lens filter. Pin 1 of U501 is the input from the photo sensor.  Pin 3 is the output control.  So, there is a case to be made that a firmware update could be made that turns off the IR Cut mode, hence, the IR LEDs would be controllable, however, it would also turn off the lens filter (that famous clicking sound) that gives the IPRobot 3 night vision.  Well for those of you like me that want night vision mode without IR LEDs, you do to next best thing, you hack the PCB with minimal alteration.  Q501 is the driver control for the IR LEDs.  A small trace cut between between Q501 and the solder point of LED6, disables the IR LED and the lens filter of the IR cut still works.  See photos bellow.  As you can see, my cut went through the top of the "5" of the Q501 silkscreen text, 

(Note: You have to be logged in openipcam to see the images)

(http://www.openipcam.com/forum/index.php?action=dlattach;topic=565.0;attach=454)

(http://www.openipcam.com/forum/index.php?action=dlattach;topic=565.0;attach=456)

Word of caution.  This will void your warranty and, like in a Mission Imposable Assignment Mr. Phelps,  one slip of your cutting tool and the camera will self destruct in seconds.  So be sure your up for the challenge.     

If you have a fine point soldering iron, you could install a switch to have a manual IR LED enable.  In my case, I do not want the IR LEDs on, so until I do, I am holding off installing a switch. When the day comes that I need it, I plan on soldering to the middle pin of Q501 and the LED6 solder pad (the green dots in the photo).   
Title: Re: Hacking the IPRobot3
Post by: SpockieTech on June 17, 2013, 10:28:09 am
Greetings Cam Hackers.

Im presently tinkering with the IPRobots from Tenvis as the next in a long line of IPCams Ive experimented with over the years.

The IPRobots dont appear too bad so far compared to most, although Im annoyed by the loss of the relay I/O pins that I like to use to activate interior and exterior lights from my phone (IPCamViewer).

Im tinkering around inside trying to find if there is an output I can tap into with a buffered relay driver to restore this functionality.  The WebGUI refers to alarm inputs and outputs, so Im hoping they are in there, but cant see anything yet.

This may be a "new version" of the IPRobot, since it has an SDCard Slot, and looking inside, the most likely candidate for the serial port seems to be J7 rather than J9 as Ive read here.

Im quite comfy with ucLinux and Microcontrollers, I was considering adding an I2C based I/O chip to the onboard I2C channels, but then Id likely have to hack up some code and custom webgui stuff to run it..  Id much rather find the existing I/O channels if they are in there.

I can see its the Grain ARM9 SOC and various other recognisable chips, but nothing that leaps out at me as an I/O driver chip.  If noone can suggest where to start looking, Ill have to wade into the 8126 datasheet.

Any Clues ?
Title: Re: Hacking the IPRobot3
Post by: TheUberOverLord on June 17, 2013, 11:53:14 am
Greetings Cam Hackers.

Im presently tinkering with the IPRobots from Tenvis as the next in a long line of IPCams Ive experimented with over the years.

The IPRobots dont appear too bad so far compared to most, although Im annoyed by the loss of the relay I/O pins that I like to use to activate interior and exterior lights from my phone (IPCamViewer).

Im tinkering around inside trying to find if there is an output I can tap into with a buffered relay driver to restore this functionality.  The WebGUI refers to alarm inputs and outputs, so Im hoping they are in there, but cant see anything yet.

This may be a "new version" of the IPRobot, since it has an SDCard Slot, and looking inside, the most likely candidate for the serial port seems to be J7 rather than J9 as Ive read here.

Im quite comfy with ucLinux and Microcontrollers, I was considering adding an I2C based I/O chip to the onboard I2C channels, but then Id likely have to hack up some code and custom webgui stuff to run it..  Id much rather find the existing I/O channels if they are in there.

I can see its the Grain ARM9 SOC and various other recognisable chips, but nothing that leaps out at me as an I/O driver chip.  If noone can suggest where to start looking, Ill have to wade into the 8126 datasheet.

Any Clues ?

It seems that there is alarm in/out (GPIO)

http://www.openipcam.com/files/ARM9/GM8126/GM8126%20v1.1/Docs/EVB_User_Guide/GM8126_EVB_User_Guide_V1.1.pdf (http://www.openipcam.com/files/ARM9/GM8126/GM8126%20v1.1/Docs/EVB_User_Guide/GM8126_EVB_User_Guide_V1.1.pdf)

More GM8126 files here:

http://www.openipcam.com/files/ARM9/GM8126/ (http://www.openipcam.com/files/ARM9/GM8126/)

Don
Title: Re: Hacking the IPRobot3
Post by: SpockieTech on June 21, 2013, 12:21:32 pm
Thanks for the link to the GM816 files. Some Interesting reading. 

Unfortunately, even after reading them, there are no Pin-out details that I could find there or on GrainMedia's site which makes it hard to track down the GPIO pins.   Found the ULN darlington driver chips on the board, but they seem to be for driving the motors.

Does anyone know where I might find pin outs for the GM8126 ?

regards
Brett
Title: Re: Hacking the IPRobot3
Post by: mrc333777 on June 21, 2013, 11:57:49 pm
from the bottom, j9 with the mic facing you and ethernet away from you at 38400 8n1

left to right

+3.3v , ground , receive , transmit - J9

MP SPI-NOR Bootstrap v0.2
Boot image offset: 0x10000. Booting Image .....
0567Will set the following freq...
PLL1: 800 MHz, PLL2: 540 MHz, CPU freq: 540 MHz, AHB freq: 270 MHz, DDR freq: 800 MHz
go...

*********************************************
Please input Space to run Linux
Please input ESC to run UBOOT
Please input . to run burn-in
Otherwise, system will run Linux after 2 sec
*********************************************
Load image from SPI-NOR offset 0x80000 to sdram 0x4000000
Jump 0x4000000
Uncompressing Linux...
................................................... done, booting the kernel.
Linux version 2.6.28 (song@songzc) (gcc version 4.4.0 (Faraday C/C++ Compiler Release 20100325) ) #189 PREEMPT Thu Dec 13 18:43:33 CST 2012
CPU: FA626TE [66056261] revision 1 (ARMv5TE), cr=0000797f
CPU: VIPT aliasing data cache, VIPT aliasing instruction cache
Machine: Faraday GM8126
Warning: bad configuration page, trying to continue
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: mem=128M console=uart,shift,2,io,0xF9830000,38400
Early serial console at I/O port 0xf9830000 (options '38400', shift 2)
console [uart0] enabled
PID hash table entries: 512 (order: 9, 2048 bytes)
IC: GM8128 MP
GM Clock: CPU = 540 MHz, AHBCLK = 270 MHz, PLL1CLK = 800 MHz, PLL2CLK = 540 MHz
console handover: boot [uart0] -> real [ttyS0]
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 123064KB available (3398K code, 215K data, 3060K init)
Calibrating delay loop... 534.52 BogoMIPS (lpj=267264)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
net_namespace: 636 bytes
Fmem: node 0 is online, alloc pages = 20480(active pages = 32768)
high_memory:0xc8000000, VM Start:0xc8800000, End:0xe0000000
NET: Registered protocol family 16
PMU: Mapped at 0xf9900000
pmu_get_cpu_clk:221 <fclk_mode=2, pll2_out=540000000>
Attach GM AHB-DMA Driver
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
Video Timer(timer3) Max 31000ms in 0xf9720840 HZ.
# of pwm can be used = 8
MPFX:
Register PWM character driver success!

JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
msgmni has been set to 240
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
probe ftgpio010.0 OK!!, at c8814000
probe ftgpio010.1 OK!!, at c8818000
probe ftgpio010.2 OK!!, at c881c000
Serial: 8250/16550 driver 4 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xf9830000 (irq = 9) is a 16550A
serial8250: ttyS1 at I/O 0xf9840000 (irq = 10) is a 16550A
serial8250: ttyS2 at I/O 0xf9850000 (irq = 20) is a 16550A
serial8250: ttyS3 at I/O 0xf9880000 (irq = 21) is a 16550A
brd: module loaded
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Linux video capture interface: v2.00
Driver 'sd' needs updating - please use bus_type methods
Driver 'sr' needs updating - please use bus_type methods
Can't identify flash type, use default setting
Creating 6 MTD partitions on "wb_spi_flash":
0x00080000-0x0051f000 : "Linux Section"
0x00520000-0x00800000 : "User Section"
0x00001000-0x00010000 : "Loader Section"
0x00010000-0x00060000 : "BurnIn Section"
0x00060000-0x00080000 : "UBoot Section"
0x006e0000-0x00700000 : "CFG Section"
Probe FTSSP010 SPI Controller at 0x98200000 (irq 6)
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
AMBA bus_register ok
Enter Device A
temp = 340
Drive Vbus because of ID pin shows Device A
otg2xx device_register ok
AMBA_bus_match(...) Found Driver FOTG2XX_DRV
AMBA_bus_match(...) Found Driver FOTG2XX_DRV
FOTG2XX_DRV fotg2xx_dev: GM  USB2.0 Host Controller
FOTG2XX_DRV fotg2xx_dev: new USB bus registered, assigned bus number 1
FOTG2XX_DRV fotg2xx_dev: irq 4, io mem 0xf9220000
FOTG2XX_DRV fotg2xx_dev: USB 2.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
FOTG200 Controller Initialization
fotg200 int enable = 1f30
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
ftiic010 ftiic010.0: irq 18, mapped at c887e000
Advanced Linux Sound Architecture Driver Version 1.0.18rc3.
ALSA device list:
  No soundcards found.
TCP cubic registered
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
GPIO-9 autorequested

IC Card Registered.
initlializing alert gpio ...
gm8126 alarm in/out device driver initialized.
Freeing init memory: 3060K
usb 1-1: new high speed USB device using FOTG2XX_DRV and address 2
port status 10009
2nd port status 10009
***************************************
Busybox starts to run
***************************************
Mounting root fs rw ...
Mounting other filesystems ...
Setting hostname ...
Mounting user's MTD partion
Has JFFS2 on mtdblock1
FTMAC with FARADAY Internal PHY support
FTMAC110 Driver (Linux 2.6) 01/10/11 - (C) 2011 GM Corp.
reset Faraday Internal PHY.
mmc0: SDHCI controller on <NULL> [ftsdc010] using DMA

Frammap: 1536 pages in DDR0 are freed.
Frammap: DDR0: memory base=0x1800000, memory size=0x4a00000, alignment=256K
Frammap: version 0.28.3, 1 DDR is managed.

VideoGraph v0.44 You may use
   #echo 11 > /proc/videograph/dbg
to enable debug mode (0xbf04a50c)
Debug message at 0xc88d2000 start pointer 0xbf06a5f0 size 0x124f80
Insert dvr_common driver done.
Platform GM812600
    enc_in0=(buf: 1843200,4,0)
    enc_in0_d=(buf: 1843200,4,1)
    enc_out0=(res: 1280,720)
    enc_out0=(buf: 783360,4,0)
    ssenc_out0=(buf: 261120,1,0)
    enc_in1=(buf: 1843200,4,0)
    enc_in1_d=(buf: 1843200,4,1)
    enc_out1=(res: 1280,720)
    enc_out1=(buf: 783360,4,0)
    scl0_out1=(res: 848,480)
    scl0_out1=(buf: 829940,4,0)
    ssenc_out1=(buf: 783360,1,0)
    enc_in2=(buf: 1555200,4,0)
    enc_in2_d=(buf: 1555200,4,1)
    enc_out2=(res: 1080,720)
    enc_out2=(buf: 660960,4,0)
    ssenc_out2=(buf: 65280,1,0)
    enc_in3=(buf: 35840,4,0)
    enc_in3_d=(buf: 35840,4,1)
    enc_out3=(res: 160,112)
    enc_out3=(buf: 20000,4,0)
    ssenc_out3=(buf: 15232,1,0)
    sub1_enc_out3=(res: 160,112)
    sub1_enc_out3=(buf: 20000,3,0)
    sub2_enc_out3=(res: 160,112)
    sub2_enc_out3=(buf: 20000,3,0)
ISP v2.05, built @ May  7 2012 15:48:47
set cmos clk out 24545454 Hz
i2c-adapter i2c-0: NAK!
i2c-adapter i2c-0: I2C TX data 0x12 timeout!
sensor_i2c_transfer fail: i2c_transfer not OK
sen_ov9710(init): OV9710 init fail!!
insmod: cannot insert '/lib/modules/fisp_ov9710.ko': No such device
fcap: V0.3.13
vcap_dev:
                LL_BusDeadlock_bug=0, bSupportSplitOSDDispRamWritePort=1

fcap:
fcap: fosd00: minor=54
fcap: fosd02: minor=53
fcap: fosd01: minor=52
fcap: fosd03: minor=51
vcap_dev: [1]:bAlbum_bug=0, bCrop_bug=1, bCU_bug=0
                LL_BusDeadlock_bug=0, bSupportSplitOSDDispRamWritePort=1

fcap: [1]: Link List mode!
fcap: fosd10: minor=50
fcap: fosd12: minor=49
fcap: fosd11: minor=48
fcap: fosd13: minor=47
load CFG: /mnt/mtd/isp_ov9710.cfg
isp_dev(dev_init):

isp_drv(isp_drv_init_dev):
Unable to handle kernel NULL pointer dereference at virtual address 00000008
pgd = c6620000
[00000008] *pgd=06618031, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT
Modules linked in: fcap200_isp(+) fcap1 fcap0 fcap_common fisp_gm_awb fisp_gm_ae fisp0 fisp_common dvr_enc dvr_common videograph frammap ftsdc010 cpe_wdt ftmac100
CPU: 0    Not tainted  (2.6.28 #189)
PC is at isp_dev_set_sensor_size+0x20/0x88 [fisp_common]
LR is at Isp_Set_Size+0x70/0x9c [fisp_common]
pc : [<bf10bc4c>]    lr : [<bf1126b4>]    psr: a0000013
sp : c666fd78  ip : c666fda8  fp : c666fda4
r10: 40025000  r9 : c666e000  r8 : 000002d0
r7 : c6520000  r6 : 00000500  r5 : 00000500  r4 : c666fda8
r3 : 00000000  r2 : 00000500  r1 : c666fda8  r0 : c6520000
Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 0000797f  Table: 06620000  DAC: 00000017
Process insmod (pid: 79, stack limit = 0xc666e268)
Stack: (0xc666fd78 to 0xc6670000)
fd60:                                                       c6520000 c666fd94
fd80: c666fdb4 c666fda0 000002d0 00000500 00000500 c6520000 c666fdd4 c666fda8
fda0: bf1126b4 bf10bc3c 00000500 000002d0 bf10f888 bf1864e0 00000000 bf186388
fdc0: 00000000 bf1863a0 c666fe14 c666fdd8 bf189384 bf112654 00000000 00000001
fde0: 00000000 00000000 c0448f38 c0448c60 c666fe54 bf1863a0 bf189000 00000000
fe00: 00000000 c0308104 c666ff7c c666fe18 c0306a44 bf189010 c666fe88 00000001
fe20: c666fe84 c666fe30 c03aa0c0 c0591608 c7008a00 c666fe40 c666fe6c c075bda0
fe40: c065ce24 40000013 c666fe7c c666fe58 c034f3b4 c034cc70 00000000 80000013
fe60: c666fe84 c666fe70 c03132dc c0313238 c065ce24 c068f000 c666fea4 c666fe88
fe80: c03654a4 c03132d8 00000002 c6589520 00000003 00000001 c666fec4 c666fea8
fea0: c0363058 c0365474 00000000 bf1863a0 c6549660 00000001 c666fed4 c666fec8
fec0: c0363088 c0362fe0 c666ff7c c666fed8 c0343654 c0363084 00000000 c666ff48
fee0: c065cbb0 c0341ae4 c8e286a4 c8e27000 c8e285cd 00000046 c8e286a4 c8e286a4
ff00: c666ff34 c8e28e9c 00000046 c65497a0 c8e28a14 00000015 bf1863a0 bf1863e8
ff20: bf185b38 00000017 00000000 00000000 00000000 00000000 00000000 00000000
ff40: 00000000 bf1863a0 00075008 00000000 000026ac c0308104 c666ff7c c666ff68
ff60: bf1863a0 00075008 00000000 000026ac c666ffa4 c666ff80 c0343920 c0306a00
ff80: 60000010 ffffffff 000026ac 00060850 bea99f4d 00000080 00000000 c666ffa8
ffa0: c0307f80 c0343898 000026ac 00060850 00075038 000026ac 00075008 bea99f4d
ffc0: 000026ac 00060850 bea99f4d 00000080 000000f0 00000000 40025000 00000000
ffe0: bea99cc0 bea99cb0 000128d4 400e9420 60000010 00075038 ffffffff ffffffff
Backtrace:
[<bf10bc2c>] (isp_dev_set_sensor_size+0x0/0x88 [fisp_common]) from [<bf1126b4>] (Isp_Set_Size+0x70/0x9c [fisp_common])
 r7:c6520000 r6:00000500 r5:00000500 r4:000002d0
[<bf112644>] (Isp_Set_Size+0x0/0x9c [fisp_common]) from [<bf189384>] (init_module+0x384/0x45c [fcap200_isp])
 r8:bf1863a0 r7:00000000 r6:bf186388 r5:00000000 r4:bf1864e0
[<bf189000>] (init_module+0x0/0x45c [fcap200_isp]) from [<c0306a44>] (__exception_text_end+0x54/0x17c)
 r8:c0308104 r7:00000000 r6:00000000 r5:bf189000 r4:bf1863a0
[<c03069f0>] (__exception_text_end+0x0/0x17c) from [<c0343920>] (sys_init_module+0x98/0x184)
 r7:000026ac r6:00000000 r5:00075008 r4:bf1863a0
[<c0343888>] (sys_init_module+0x0/0x184) from [<c0307f80>] (ret_fast_syscall+0x0/0x2c)
 r7:00000080 r6:bea99f4d r5:00060850 r4:000026ac
Code: e59f306c e5912000 e7903003 e1a04001 (e5937008)
---[ end trace 0aed37a78ebccb83 ]---
SCL: Version, v1.17
SegmentSCL: div:4
ation fault
FAVC Encoder IRQ mode(29)v4.2.1
FAVC codec Max Resolution is 1280x720, built @ May 15 2012 15:43:33
MCP100 driver with CPU for VG,
GM8126 MPEG4 with CPU for VG, decoder ver: 3.2.2, encoder ver: 3.2.8, built @ May 14 2012 15:30:49
GM8126 MJPEG with CPU for VG, encoder ver: 3.2.5, decoder ver: 3.1.4, built @ May 14 2012 15:30:35

FTDI210 registers 32 entities to video graph!
FTDI210 Driver v1.4 (1 engine(s))
ft-32ssp: common[ver:0.3.4] INIT OK!
card->cardno = 2
card->pbase = 98a00000
card->vbase = c8efc000
card->irq = 11
my_card->capture.dma_ch = 4
my_card->playback.dma_ch = 5
AHB DMA Interrupt Mode
AHB DMA Interrupt Mode
ft-32ssp: SoundCard(2) attached OK (c14239d0)
I2S probe ok in Slave mode.
ftrtc011_init()
ftrtc011 ftrtc011: rtc core: registered ftrtc011 as rtc0
rtusb init --->
usbcore: registered new interface driver rt2870
usb 1-1: configuration #1 chosen from 1 choice


=== pAd = c9202000, size = 502944 ===

<-- RTMPAllocAdapterBlock, Status=0
ADDR: 00:84:14:81:26:00
ftmac110_link_change:2113 <SPEED100>
ftmac110_link_change:2127 <FULL>
/mnt/mtd/boot.sh: line 51: can't create /proc/isp0/ae/ev_mode: nonexistent directory
mke2fs 1.41.12 (17-May-2010)
ext2fs_check_if_mount: Can't check if filesystem is mounted due to missing mtab file while determining whether /dev/ram0 is mounted.
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
Stride=0 blocks, Stripe width=0 blocks
1024 inodes, 4096 blocks
204 blocks (4.98%) reserved for the super user
First data block=1
Maximum filesystem blocks=4194304
1 block group
8192 blocks per group, 8192 fragments per group
1024 inodes per group

Writing inode tables: done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 35 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
WDT base virtual address = c8fd4000
*** TAS-Tech IPCAM/DVS
*** Version: 1.2.0.3
*** Release date: 2012-12-21 15:02:04
esam auth ok.
Unsupported stop bits
CTP Server Started at  9999
killall: udhcpc: no process killed
<-- RTMPAllocTxRxRingMemory, Status=0
-->RTUSBVenderReset
<--RTUSBVenderReset
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 5
2. Phy Mode = 5
NVM is Efuse and its size =2d[2d0-2fc]
phy mode> Error! The chip does not support 5G band 5!
RTMPSetPhyMode: channel is out of range, use first channel=1
3. Phy Mode = 9
MCS Set = ff 00 00 00 01
<==== rt28xx_init, Status=0
0x1300 = 00064300
ip of ra0= 6301A8C0
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 ra0
0.0.0.0         192.168.1.254   0.0.0.0         UG    0      0        0 ra0
IOTC version: 1070300, AVApi version: 1020800
All ervices started.
ntpclient: cann't resolve host time.nist.gov
Title: Re: Hacking the IPRobot3
Post by: SpockieTech on June 22, 2013, 02:25:11 am
Yes, thanks for the dump, I figured out the serial port no problem.

Unfortunately, what Im looking for is the GPIO pins from the GM8126 chip so I can find out if any of them are triggered by the webgui "light" button, or from IPCamViewers Relay function.   

I want to add relay control functionality to the IPRobot to switch exterior lights on and off.  If I can find a pin that toggles, I can add a buffered relay driver to it.   An external input for a PIR trigger would be nice as well, since noise on the image makes the motion sensing function a bit sketchy.   

So, hopefully, the I/O pins are still in there, and just not used.

From this part of the dump, it looks like they might be, just need to know the physical pins so I can trace where they are going.

probe ftgpio010.0 OK!!, at c8814000
probe ftgpio010.1 OK!!, at c8818000
probe ftgpio010.2 OK!!, at c881c000

regards
Brett
Title: Re: Disabling the IR LEDs
Post by: roller on July 14, 2013, 08:03:44 pm
Disabling the IR LEDs

If you have an IPRobot3 from Tenvis and you are waiting for new firmware that will control the IR LEDs, but keep the Lens filter enabled (this is the clicking sound), then you are in for a long wait! Tenvis claims it is a hardware issue and can not be controlled with firmware.  I needed the camera to work behind glass at night, so I covered the IR LEDs with aluminum tape.  It did hide the red hue of the LEDs, but still behind glass, there was some IR reflection in the shape of a crescent moon that was escaping from camera lens area.  Next I opened the optics housing and took a closer look at the sensor PCB.  U501 is the MPU that controls the IR LEDs and the lens filter. Pin 1 of U501 is the input from the photo sensor.  Pin 3 is the output control.  So, there is a case to be made that a firmware update could be made that turns off the IR Cut mode, hence, the IR LEDs would be controllable, however, it would also turn off the lens filter (that famous clicking sound) that gives the IPRobot 3 night vision.  Well for those of you like me that want night vision mode without IR LEDs, you do to next best thing, you hack the PCB with minimal alteration.  Q501 is the driver control for the IR LEDs.  A small trace cut between between Q501 and the solder point of LED6, disables the IR LED and the lens filter of the IR cut still works.  See photos bellow.  As you can see, my cut went through the top of the "5" of the Q501 silkscreen text, 

(Note: You have to be logged in openipcam to see the images)

(http://www.openipcam.com/forum/index.php?action=dlattach;topic=565.0;attach=454)

(http://www.openipcam.com/forum/index.php?action=dlattach;topic=565.0;attach=456)

Word of caution.  This will void your warranty and, like in a Mission Imposable Assignment Mr. Phelps,  one slip of your cutting tool and the camera will self destruct in seconds.  So be sure your up for the challenge.     

If you have a fine point soldering iron, you could install a switch to have a manual IR LED enable.  In my case, I do not want the IR LEDs on, so until I do, I am holding off installing a switch. When the day comes that I need it, I plan on soldering to the middle pin of Q501 and the LED6 solder pad (the green dots in the photo).   

Thanks for this post Robo
i have a question for you
I want to use the IpRobot 3 looking through the bedroom window at my driveway I don't need nightvision as there is a 500 watt pir floodlight outside, how do I disable ir led's and night vision (the clicking noise will keep me awake) plus power led.
When i say how do I disable them I should say it will  be done by a friend who repairs pc's and laptops as a business so is a wizard with the soldering iron.
TIA
roller
Title: Re: Hacking the IPRobot3
Post by: hatoscano on August 03, 2013, 04:39:29 am
Please, wich is the serial port in my iprobot3 (GM8126)?
I add two photos. Blue o Red?
Thanks.

https://docs.google.com/file/d/0BzAOUATrz_3JbjRBTkpwOVNXeGM/edit?usp=sharing (https://docs.google.com/file/d/0BzAOUATrz_3JbjRBTkpwOVNXeGM/edit?usp=sharing)
https://docs.google.com/file/d/0BzAOUATrz_3JY0hIWHVxZkFvaVU/edit?usp=sharing (https://docs.google.com/file/d/0BzAOUATrz_3JY0hIWHVxZkFvaVU/edit?usp=sharing)
Title: Re: Hacking the IPRobot3
Post by: hatoscano on August 03, 2013, 05:16:59 pm
which is the red o blue, in the fhoto? you have the same camera, iprobot3 (GM8126)?
Title: Re: Hacking the IPRobot3
Post by: mrc333777 on August 04, 2013, 06:59:29 am
none of those two photos
the bottom of the board, not the top

from the bottom, j9 with the mic facing you and ethernet away from you at 38400 8n1

left to right

+3.3v , ground , receive , transmit - J9
make a photo of the bottom
Title: Re: Hacking the IPRobot3
Post by: wiredcharlie on August 06, 2013, 06:48:15 am
Does anyone know the telnet user/password or have a suggestion as to how to get them, please?
Title: Re: Hacking the IPRobot3
Post by: roller on August 10, 2013, 02:00:28 pm
Robo didnt reply so I'm posting my question again, if I can't get an answer soon the iprobot 3 will be going on Ebay and I'll buy a Foscam.
I want to use the IpRobot 3 looking through the bedroom window at my driveway I don't need nightvision as there is a 500 watt pir floodlight outside, how do I disable ir led's and night vision (the clicking noise will keep me awake) plus power led.
When i say how do I disable them I should say it will  be done by a friend who repairs pc's and laptops as a business so is a wizard with the soldering iron.
TIA
roller
Title: Re: Hacking the IPRobot3
Post by: zaspany on August 22, 2013, 01:12:01 pm
I repeat the question if anyone has the password for telnet and can send them to me at PM.
The guys from Tenvis not write the amendment and I wanted to write a script to remove old films of sd
Title: Re: Hacking the IPRobot3
Post by: Robo on September 16, 2013, 03:23:23 am
To stop the IR Filter, open the camera case at the ir leds. There is a plug/cable red/black wires that runs from the filter relay to the camera pcb. You can unplug one of them to stop the relay.
Robo 
Title: Re: Hacking the IPRobot3
Post by: Robo on September 16, 2013, 03:30:58 am
Someone please confirm which plug is the IR Filter Relay.  If it is not J3, it is the other plug with red/black wires.  My camera's are in service and I do not have a camera open to confirm it.  I do recall that one plug is the IR Filter Relay and the other is for a IR led that could not be soldered to the PCB.
Robo
Title: Re: Hacking the IPRobot3
Post by: Robo on September 16, 2013, 06:58:06 pm
I opened an IPRobot3 camera housing.   If you short the photo sensor, next to the Q506 silkscreen, it keeps the IR Night Mode off. 
 
As a follow up, the IR Filter relay is the red/black wire with the heat shrink on it next to J502 silkscreen. J3 is the IR LED that was not soldered.
Robo
Title: Re: Hacking the IPRobot3
Post by: Moony on October 06, 2013, 05:13:28 pm
To stop the IR Filter, open the camera case at the ir leds. There is a plug/cable red/black wires that runs from the filter relay to the camera pcb J3 that you can unplug to stop the relay.
Robo

I'm new to this forum - but have just bought an IPRobot3 and came across this discussion whilst looking for information regarding the poor IR picture quality.

The IR filter (or whatever it is) seems to degrade the picture quality significantly.  I have observed whilst viewing the camera output that immediately after turning the lights out - the IR LEDs come on and the picture quality is crystal clear (albeit without colour).  After a delay of a second or so - I hear the click (presumably as the filter moves across the sensor) and the picture quality degrades significantly.

I tried your suggestion about opening up the case and disconnecting the red/black cable plug at PCB J3 - but after doing so - I still get the clicking sound when I turn the lights off and the behaviour of camera seems identical to what I observed before disconnecting it.
Title: Re: Hacking the IPRobot3
Post by: Robo on October 08, 2013, 03:30:05 am
Moony, The filter is the other plug, not the j3 one.  I now short the Photo Sensor when I need to turn off the night mode.  One other note, I have seen what seemed to be poor video where it was grainy and found it was not the camera. It was my web browser trying to size down the video to fit in a smaller area.   
Title: Re: Hacking the IPRobot3
Post by: fant30 on October 10, 2013, 03:15:03 am
Hi

Recently i purchased a new IPRobot3.I am trying to connect my camera with my laptop with no success.SpockieTech seems to be right about the candidate serial port (J7) since this must a new
version of the camera.I would really need some help with the connection since i am new to this.I have attached two photos from left to right seems to be +5V ,transmit? ,receive? , ground.Is this going to work if i attached a usb cable?If anyone is kind enough please do pm me.

Thanks in advance.
Title: Re: Hacking the IPRobot3
Post by: cmkessell on October 11, 2013, 10:15:00 am
Hi,

I've also just bought an IProbot3 and just spent an hour poking around J7 using an oscilloscope ... and would NOT try to connect to it!  This connector just connects to a couple of pins on U9 (a SyncMOS SM59R02G1 8-bit microcontroller located on the back of the board underneath J7).  For the record the pins on J7 are arranged pin 1 = connects to U9 pin 26, pin 2 = +5V, pin 3 = connects to U9 pin 27, pin 4 = Ground.  Aside from a continuous 3.7MHz signal on pin 3, I couldn't see any activity on the J7 pins.

Anyway, I just noticed that my my board has J9 after all!  I'd completely overlooked it as it's tucked in amongst a tight cluster of surface-mount components.  Your board looks the same as mine; I suggest you double-check to see if it has J9.  I've attached a photo with J9 marked.

Chris
Title: Re: Hacking the IPRobot3
Post by: cmkessell on October 11, 2013, 11:29:28 am
I just succeeded in establishing communication between my IProbot3 and PC via J9.  I used a cheap Chinese USB-to-TTL serial adapter cable http://www.ebay.co.uk/itm/271232344799 (http://www.ebay.co.uk/itm/271232344799) - note that this is not just an ordinary USB cable!

The attached photo shows the interconnections.
Title: Re: Hacking the IPRobot3
Post by: fant30 on October 11, 2013, 03:39:48 pm
This is awesome!!! Thank you.I will try this and tell you my results.Thanks again.
Title: Re: Hacking the IPRobot3
Post by: cmkessell on October 12, 2013, 03:35:53 pm
A bit more info.  I used good old Windows HyperTerminal to connect to the USB/COM port (at 38400 baud as posted previously by mrc333777).  As the camera started up I could see all the Linux boot information.  Once this had finished pressing Ctrl-C brought up the login prompt ... and that's as far as I could get because I don't know the username/password :(

A couple of questions:

- Does anyone know the login username and password?  (Please PM me if necessary)

- Does anyone have a datasheet showing the pinout of the LQFP version of the GM8126 as used in the IProbot3?  The only datasheet I can find has only the pinout of the BGA package.

Title: Re: Hacking the IPRobot3
Post by: cmkessell on October 26, 2013, 02:24:32 pm
Can anyone explain how to get the camera casing apart? I've tried removing the 2 small screws on the back of the casing but it still seems to be firmly held together (and I don't want to force it open!).

Thanks

Title: Re: Hacking the IPRobot3
Post by: slowfellow on December 01, 2013, 08:54:15 am
I am also struggeling with opening the (upper/camera part) casing of the TENVIS iprobot 3?

Could someone please explain,

Thanks

Vincent
Title: Re: Hacking the IPRobot3
Post by: Robo on December 01, 2013, 10:04:02 pm
I do not cut all the LED's.  Just one leg of the green led is what I cut and then shorted the photo sensor.

To open the sensor area, remove the two screws behind the LED's and pull the half with the LED's out.  The other half stays with the base.  I did not need much force, just pull on the LED half.  Be careful of the wires still connected to the PCB. Just pull it out under about an inch to pivot it around.

At this point you can unscrew the PCB from the removed half.

Good Luck
Title: Re: Hacking the IPRobot3
Post by: pedrovski on December 02, 2013, 12:55:12 pm
Telnet, root's password and other camera internals.

The telnet daemon on the IPRobot3 cannot be disabled and is open to anyone that knows root's password. This is not acceptable to me so I did something about it!

To fix this you need a TTL <-> USB (RS232) cable properly connected to the camera (see above for details).

Once you have that working boot the camera from a GM8126 SDK image on an sdcard (see above for details).

The camera will boot to a shell prompt and from here we can make the necessary changes.

The camera startup process is handled by /mnt/mtd/boot.sh which is writeable and survives reboots:

/dev/mtdblock1 on /mnt/mtd type jffs2 (rw)

The camera uses a shadow password file /etc/shadow containing the encrypted (and salted) hash of the password. It is highly unlikely anyone could reasonably decrypt it so we shall replace it instead.

At the shell prompt, change root's password - just type 'passwd' (without the quotes) and type in your new password when asked.
Now copy the shadow password file containing your new password to /mnt/mtd:

cp /etc/shadow /mnt/mtd/shadow

Next, make a copy of the boot.sh script (just in case)

cp /mnt/mtd/boot.sh /mnt/mtd/boot.sh.orig

Next edit boot.sh (vi is available) and at the top add:

if [ -f /mnt/mtd/shadow ]; then
  cp /mnt/mtd/shadow /etc/shadow
fi

Save the modified boot.sh and reboot the camera.

You should now be able to telnet into the camera using username root and the password you chose.

Now what?

I find the default auto exposure settings utterly inadequate for my night viewing requirements. Time to fix that...

At night, with the camera view live so you can see the difference enter the following commands (cut and paste if needed):

echo 1 > /proc/isp0/ae/ev_mode
echo w denoise 0 > /proc/isp0/command
echo w dpc 0 > /proc/isp0/command
echo w crosstalk 0 > /proc/isp0/command
echo w sharpness 0 > /proc/isp0/command

You can revert to fully auto mode (the default) with the following:

echo 0 > /proc/isp0/ae/ev_mode

You can put the camera into fully manual mode (user mode) with the following:

echo 2 > /proc/isp0/ae/ev_mode

There are a ton of other parameters you can play with see the bottom of this post for details.

Wireless just does not work on my camera using the (laughable) web interface and anyway I prefer to configure it manually.

For a typical wpa or wpa2 network all you need do is the following (substitute your ssid, passphrase and IP details)

ifconfig ra0 up
iwpriv ra0 set NetworkType=Infra
iwpriv ra0 set AuthMode=WPAPSK
iwpriv ra0 set EncrypType=AES
iwpriv ra0 set SSID="your SSID"
iwpriv ra0 set WPAPSK="your wpa-preshared key"

ifconfig ra0 10.0.5.20 netmask 255.255.255.0

Now, you have probably realised that we can put all of these changes into the boot.sh script too, thus we can configure the camera settings and wireless / wired network and have those settings be re-applied at every boot. This post is already too long so I can post about that (and much more we can do) in another post if it would be useful.

Have fun!

Camera configuration parameters:

 r brightness            - Get current brightness
 w brightness VALUE      - Set brightness as VALUE, 0~100
 r contrast              - Get current contrast
 w contrast VALUE        - Set contrast as VALUE, 0~100
 r hue                   - Get current hue
 w hue VALUE             - Set hue as VALUE, 0~100
 r saturation            - Get current saturation
 w saturation VALUE      - Set saturation as VALUE, 0~100
 r gamma                 - Get current gamma setting
 w gamma VALUE           - Set gamma as VALUE
 r dpc                   - Get current defect pixel correction level
 w dpc VALUE             - Set defect pixel correction level as VALUE, 0~100
 r crosstalk             - Get current crosstalk reduction level
 w crosstalk VALUE       - Set defect crosstalk reduction level as VALUE, 0~100
 r denoise               - Get current noise reduction level
 w denoise VALUE         - Set noise reduction level as VALUE, 0~100
 r sharpness             - Get current sharpness level
 w sharpness VALUE       - Set sharpness level as VALUE, 0~100
 r auto_adj_en           - Get enable/disable status of auto adjustment function
 w auto_adj_en VALUE     - Enable or disable auto adjustment function VALUE
 r auto_cs_en            - Get enable/disable status of auto chroma suppression
 w auto_cs_en VALUE      - Enable or disable auto chroma suppression VALUE
 r auto_cs_th            - Get auto chroma suppression threshold
 w auto_cs_th VALUE      - Set auto chroma suppression threshold as VALUE
 r auto_cs_gain          - Get chroma suppression ratio
 w auto_cs_gain VALUE    - Set chroma suppression ratio as VALUE
 r sen_exp               - Get current sensor exposure time in us
 w sen_exp VALUE         - Set sensor exposure time as VALUE in us
 r sen_gain              - Get current sensor gain (2¡¦s complement fixed point Format:10)
 w sen_gain VALUE        - Set sensor gain as VALUE (2¡¦s complement fixed point Format:10)
 r mirror                - Get enable/disable status of sensor mirror function
 w mirror VALUE          - Enable or disable sensor mirror function VALUE
 r flip                  - Get enable/disable status of sensor flip function
 w flip VALUE            - Enable or disable sensor flip function VALUE
 r ae_en                 - Get enable/disable status of ISP AE
 w ae_en VALUE           - Enable or disable ISP AE function VALUE
 r awb_en                - Get enable/disable status of ISP AWB
 w awb_en VALUE          - Enable or disable ISP AWB function VALUE
 r af_en                 - Get enable/disable status of ISP AF
 w af_en VALUE           - Enable or disable ISP AF function VALUE
 r md_en                 - Get enable/disable status of ISP MD
 w md_en VALUE           - Enable or disable ISP MD function VALUE
 r knee_en               - Get enable/disable status of ISP Knee function
 w knee_en VALUE         - Enable or disable ISP Knee function VALUE
 r knee_point_x          - Get X value of knee poin
 w knee_point_x VALUE    - Set X value of knee point as VALUE, 0~4095
 r knee_point_y          - Get Y value of knee point
 w knee_point_y VALUE    - Set Y value of knee point as VALUE, 0~1023
 r shdc_ref              - Show SHDC informations
 w reload_cfg [PATHNAME] - Reload cfg file
 r reg ADDR [COUNT]      - Read ISP registers ADDR
 w reg ADDR VALUE        - Set ISP register ADDR as VALUE
 r sen_reg ADDR          - Read sensor register ADDR
 w sen_reg ADDR VALUE    - Set sensor register ADDR as VALUE
 w grab [PATHNAME]       - Grab one frame and save as PATHNAME
Title: Re: Hacking the IPRobot3
Post by: RSexton on January 01, 2014, 04:43:41 am
This post is already too long so I can post about that (and much more we can do) in another post if it would be useful.


  I have not tested any of your posted information, nor am I an *nix person, but it sure seems to me that the information is most useful / helpful.  I may be stepping out of line here being a newbie on this site, but if you have more you could post, by all means do so PLEASE!
Thank you for what you have done!
Robert
Title: Re: Hacking the IPRobot3
Post by: piecesmel on January 04, 2014, 04:29:42 pm
Telnet, root's password and other camera internals.

To fix this you need a TTL <-> USB (RS232) cable properly connected to the camera (see above for details).

A big thanks to Robo pedrovski & mrc333777 and others for the progress.

I have done a foolish thing and bricked my IPROBOT 3 early version with even ending firmware .Is it possible to reload original firmware using a sd micro card or just copy files from a good copy from a donor camera  using the methods used in this thread .

Many thanks in advance  .

Title: Re: Hacking the IPRobot3
Post by: piecesmel on January 24, 2014, 06:51:07 am
I have made progress . I have no booting at all its all gone so the serial port is useless ATM . With nothing to loose I read some documentation about the GM8126 and how it can the load the SPI flash via USB . After checking the pins I was delighted to find the USB had been implemented and was being used for the wireless board .After removing the wireless board and connecting a USB cable to the PC the MP tool found the SPI flash and I can write to it .

I can now watch a boot using the serial port again but need the correct bin files for camera operations. The burn in program allows a "(77) Burn fresh spi flash " but not one big block . ????
Looks as tho it can be done through U-boot .
Would anyone be good enough to post or Email dumps of the SPI flash partitions ???? Mines the old camera with the alarm connector on the back .


/ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 0067f000 00001000 "Linux Section"
mtd1: 00100000 00001000 "User Section"
mtd2: 0000f000 00001000 "Loader Section"
mtd3: 00050000 00001000 "BurnIn Section"
mtd4: 00020000 00001000 "UBoot Section"
mtd5: 00020000 00001000 "CFG Section"


I hope this help others with the same problem .


Title: Re: Hacking the IPRobot3
Post by: piecesmel on January 31, 2014, 04:30:02 pm
I have loaded a bin for linux and other files from a firmware update file mentioned here. http://www.openipcam.com/forum/index.php/topic,386.msg3495.html#msg3495.
Im getting to here in the boot.sh
_______________________________________________
/usr/sbin/telnetd
mke2fs /dev/ram0
mount -t ext2 /dev/ram0 /mnt/mtd/rd
mkdir /mnt/mtd/rd/jpeg
if [ -f /mnt/mtd/html.tgz ]; then
   tar -xzf /mnt/mtd/html.tgz -C /mnt
fi

cd /mnt/
./ipc8126
sleep 5
RETVAL=$?
if [ $RETVAL != 1 ]; then
echo ------- Start uploader --------
/mnt/uploader 0
#/mnt/uploader $?
echo ------- Uploader terminated --------
fi

reboot
______________________________________________
/mnt/mtd/boot.sh: line 51: mke2fs: not found
mount: mounting /dev/ram0 on /mnt/mtd/rd failed: No such file or directory
mkdir: cannot create directory '/mnt/mtd/rd/jpeg': No such file or directory
/mnt/mtd/boot.sh: line 56: tar: not found
/mnt/mtd/boot.sh: line 59: ./ipc8126: not found
______________________________________________
And seem to be missing some files mainly mke2fs , tar , ipc8126, uploader . I added the sleep 5 to allow easy exit from the endless rebooting

Anyone out there check theirs and check what im missing ????
Title: Re: Hacking the IPRobot3
Post by: bmb85 on February 02, 2014, 09:24:30 am
Hi there, ive got a Tenvis IP391w-HD camera based on the same hardware as the iprobot 3 i have flashed the iprobot firmware on suggestion from tenvis support and it worked fine. But this camera has always had a problem with dropouts even when connected to a wired ethernet connection, it worked well for an hour then drops out and creates continuous events on my zoneminder setup.

I went to downgrade the firmware from 1.3.3.3 to 1.2.8.3 (apparently the most reliable according to users) and last night the connection dropped out whilst upgrading the firmware.

 Now it wont log on to the network, I can't find it with hd camera search tool on my vm. Connected to computer or router. im guessing its bricked, seems like a boot loop i get the green network light come on then yellow network light flashes for 3-4 mins then turns off and yellow light. Tried reset for +1 minute same result. I'm not new to modifying devices or firmwire, but ive never jtagged anything, running ubuntu and fairly competent with terminal, so if i could extract the firmware should be able to just write the missing firmware files using DD i guess using the j9 or the usb pinout on the wireless card. Any ideas?

 I have high res photos of the board i will try to attach them.

Thanks in advance b =]
Title: Re: Hacking the IPRobot3
Post by: piecesmel on February 02, 2014, 04:45:24 pm
But this camera has always had a problem with dropouts even when connected to a wired ethernet connection, it worked well for an hour then drops out and creates continuous events on my zoneminder setup.

Your camera looks to be very unstable not a good time to upgrade !. I would first check the power plug pack ive had capacitors die in mine with in a few weeks of getting it .If your lucky it might work then .


Once thats checked I would try the RS232 first telnet method mentioned earlier in this thread   jtagg method would be a last resort .

Looks as tho you have the newer 2013 model by the look of the firmware your using ( no green connector on the back ?.

Title: Re: Hacking the IPRobot3
Post by: piecesmel on February 21, 2014, 04:59:38 pm
Update
       Working again after loading the Linux & User partitions from a donor Iprobot3 using uboot. Then doing a firmware upgrade with the upgrade tool fixed the SETUP not working in the browser.

Title: Re: Hacking the IPRobot3
Post by: mrc333777 on February 28, 2014, 01:48:14 am
dont b!tch if you brick your sh!t.

telnet ip address
login: root
pass: blossom2012

now has anyone figured out how to make the pan/tilt faster than that lame crap they have the fastest set to?  way to slow for me!
Title: Re: Hacking the IPRobot3
Post by: CapnBob on March 25, 2014, 03:26:05 am
Hi there, ive got a Tenvis IP391w-HD camera based on the same hardware as the iprobot 3 i have flashed the iprobot firmware on suggestion from tenvis support and it worked fine. But this camera has always had a problem with dropouts even when connected to a wired ethernet connection, it worked well for an hour then drops out and creates continuous events on my zoneminder setup.

I went to downgrade the firmware from 1.3.3.3 to 1.2.8.3 (apparently the most reliable according to users) and last night the connection dropped out whilst upgrading the firmware.

 Now it wont log on to the network, I can't find it with hd camera search tool on my vm. Connected to computer or router. im guessing its bricked, seems like a boot loop i get the green network light come on then yellow network light flashes for 3-4 mins then turns off and yellow light. Tried reset for +1 minute same result. I'm not new to modifying devices or firmwire, but ive never jtagged anything, running ubuntu and fairly competent with terminal, so if i could extract the firmware should be able to just write the missing firmware files using DD i guess using the j9 or the usb pinout on the wireless card. Any ideas?

 I have high res photos of the board i will try to attach them.

Thanks in advance b =]

The exact same thing happened to me trying to downgrade to 1.2.8.3 on a Veevocam V200HD, a rebranded iprobot3.  Now the green network led flashes, but the amber is continuously solid.  Tried all the resets, and it's stuck in a boot cycle so that every minute or so, both network leds go out, then back on, and you hear a click. On and on, ad nauseum.  Did you ever get yours back to normal?
Title: Re: Hacking the IPRobot3
Post by: charmin on May 07, 2014, 01:23:18 pm
I've just disabled the IR leds simply by soldering a link wire across the front pins  of the sensor. The two very small contacts either side of the sensor (front) need the very thin lacquer coat scrapping off, a small modelling knife is ideal, then tin a thin piece of wire with solder and very carefully solder across  contacts. This is a fiddly job and a fine tip iron is crucial, also a steady hand and magnifier is useful...  saves taking the whole unit apart.
Title: Re: Hacking the IPRobot3
Post by: 7074 on July 21, 2014, 08:30:05 am
Hello!
Does anyone has full dump file from flash memory, which contains firmware and loader?
The version is IPROBOT3 2013, PCB v1.2.
Thank you!
Title: Re: Hacking the IPRobot3
Post by: Kozma on August 26, 2014, 05:52:40 am
Firmware 1.2.8.3 no video in IE, does not work Wi-Fi.
Trying to update to 1.2.5.3, 1.3.1.3 or 1.3.3.3 results in an error FAILED.

Current System Information
Software Ver.   1.2.8.3
Release Date   2013-04-18 13:27:34
Hardware Ver.   GM8126
(http://91.215.90.212:81/photo/MB.jpg)

How to flash \ recover?
Or please give full dump file from flash memory.
Title: Re: Hacking the IPRobot3
Post by: marekop on September 01, 2014, 01:10:06 pm
For someone who would like to solve IPROBOT3 freezing when pan/tild problem:
model: IPROBOT3 ver. 2013 (selling in 2013 Yr)
firmware: 1.3.3.3
Problem: camera freezing when pressing pan/tild arrows on web GUI.

I my case this solution soled this problem. Silicon chip is overheating in some models of IPROBOT3 cameras, so I put aluminium tape on the camera motor and silicon paste on that. The camera motor with silicon paste contact to the chip and is cooling that chip. I think this solution is good for others IPROBOT3 unstable behaviors. New version of IPROBOT (2014 Yr -black version) has improved GUI and functionality and they are stable.
Title: Re: Hacking the IPRobot3
Post by: 7074 on October 22, 2014, 01:19:06 pm
Hello!
Would You be so kind to help me and give iprobot3 flash full dump, so I make my iprobot work again?
Thank You!
Title: Re: Hacking the IPRobot3
Post by: Robo on August 04, 2017, 09:21:15 pm
Unbricking a bricked IProbot3 ver1. 2013 with firmware 1.1.6  :)

This is a bit old news since the version of the camera has changed, but after a few years and many months of trial and error, I finally found a combination of steps that let me unbrick my old Tenvis IPRobot3 camera.  It looks that some people were able to use Telnet for this, I used the USB method.  I am ending my work on these cameras and will not be able to support those of you that try this nor will not be able to give out the firmware.  You might be able to find old  firmware on the web and the tools to extract the pk2 files.   Also, this procedure might only work on older discontinued versions of cameras and on a limited number of instances when the camera had a bad firmware update and it became unresponsive.  Specifically in my case, it failed during a firmware update when the Ethernet cable got unplugged and wifi was used for the update by accident. If this has happened to you too, then there is a good chance the steps below could help you.   

In order to complete the procedure, you will need to remove the camera bottom cover and connect a 3.3v USB converter to J9 by soldering wires to the camera's pcb, then use a terminal program to interact with the boot-loader. You will also need a fat32 formatted TIFF SD memory card and a copy of the firmware that has been uncompressed and renamed from “mtdblock0.new” to “linux”.  I also copied all the other files in the uncompressed gm8126-tenvis-1-1-6-2-2012-11-08.pk2 to the SD card then renamed them removing “.new” from each, but it seemed unnecessary.  If your camera is newer, use a version of firmware that is intended for that model of camera and J9 maybe different as well.

The steps are to copy Linux to the TIFF SD card and then put the SD into the camera. Then connect an Ethernet cable and the U9/USB port to a computer.  Now power up the camera and launch your Hyper Terminal program at 38400 baud N81 with the correct com port setting. Next power off and on the camera and press “.” in the terminal program during the first two seconds of the camera's startup. Then from the bootloader menu, do option 78 to boot from SD. The camera should load Linux from the sd.  Next find the IP address of the camera. The IP address of the camera is listed in hex format at the end of the linux boot log seen on the terminal screen.  To resolve the IP address of the camera, convert the hex numbers to decimal. Lastly, log into the camera with a web browser and do a normal firmware update. 

Notes: There are post regarding what wires to connect to J9 already and you will have to search for them. You will have to manually set your computer's IP address in the same subnet of your camera, but as a different IP address in that subnet.  I also found that Hyper Terminal would not recognize the USB com port unless I connect the USB converter to the computer and camera first, then power on the camera before I launched Hyper Terminal.  I suggest getting comfortable with the boot-loader via Hyper Terminal after connecting to J9 and insuring you have working USB drivers for the USB converter first. 

Good Luck!


Title: Re: Hacking the IPRobot3 iprobot3 2014 B26TVS_V1.2.1.4(720P) .pkg
Post by: mrc333777 on January 23, 2019, 12:39:52 am
i know its been a while, but i hacked this firmware to enable telnet if anyone wants it

login = root
pass =

this is for the 2014 model of the iprobot3