Open IP Camera Forum

General => General Discussion => Topic started by: sergot on March 10, 2011, 02:20:37 am

Title: FOSCAM FI8919W
Post by: sergot on March 10, 2011, 02:20:37 am
Hello .. I bought a camera Fosca 8918 / / / please help change the web interface, I want to add the Russian language in the control of the camera ..... tried to unzip the firmware writes an error about the size of the file, but I managed to unpack 2.4.8.12.bin but this firmware is not installed in the camera??
Title: Re: FOSCAM FI8919W
Post by: admin on March 10, 2011, 01:31:09 pm
The webui is in a hidden partition on the camera.
If you have access to the bootloader via serial, you can reflash webui.

Alternately, you can use the Windows Tools to reflash.

Instructions are here - http://www.openipcam.com/files/Manuals/How%20to%20check%20and%20upgrade%20your%20cameras%20system%20firmware%20version%20or%20Web%20UI%20version.xls (http://www.openipcam.com/files/Manuals/How%20to%20check%20and%20upgrade%20your%20cameras%20system%20firmware%20version%20or%20Web%20UI%20version.xls)

Software required to do that is here - http://www.openipcam.com/files/Software/ (http://www.openipcam.com/files/Software/)
Download the IPCam Find or IPCam Tool software, scan for viruses (I use Mac, so haven't checked the Windows ones), and then run.

They should in theory find the camera, and you can flash the webui.

I have a lot of firmware here - http://www.openipcam.com/files/Firmware/ (http://www.openipcam.com/files/Firmware/)

I've made a new subfolder called webui, might start populating that a bit.

The webui is really just a tar file with a header though. 

Here's an example:  aw_4_3_3_39.bin available here - http://www.openipcam.com/files/Firmware/webui/aw_4_3_3_39.bin (http://www.openipcam.com/files/Firmware/webui/aw_4_3_3_39.bin)

Numbering is little endian.
Header is in 16 bytes, with 4 sections of 4 bytes each.

Header of WebUI is as follows    (example bytes in Hex)
Header    0x00 0x01 0x02 0x03 :  BD 9A 0C 44  = Identification Header (in lieu of any other use I can think of..)
CRC32     0x04 0x05 0x06 0x07 :  5E B6 A5 02  = CRC32 http://en.wikipedia.org/wiki/Cyclic_redundancy_check (http://en.wikipedia.org/wiki/Cyclic_redundancy_check)
Filesize  0x08 0x09 0x0A 0x0B :  4D DC 06 00  = 449613 bytes
WebUI Ver 0x0C 0x0D 0x0E 0x0F :  04 03 03 27  = 4.3.3.39

Lawrence.

Title: FOSCAM FI8918W
Post by: sergot on March 14, 2011, 08:30:56 am
Finally, I did it .. restored my camera 8918 .. all thanks for the help!
now only left to do what I wanted from the beginning ...,,, if anyone can help please write,,, I can not change the firmware web server, I need to add the Russian language in the interface control the camera .... but I can `t unpack it ... please help .... this is a link to the firmware ---http://www.openipcam.com/files/Firmware/Foscam/FI8918%20FI8918W%20sw%20upgrade%20package.rar
Title: Re: FOSCAM FI8919W
Post by: sergot on March 14, 2011, 02:58:48 pm
Yes I have access to botloader. I made ​​a converter and a data cable from a cell phone based on pl2303 chip, I did the firmware of their cameras so ... downloaded from the site Fosca origenalnuyu firmware and I managed to unpack. bin file, I got two files linuks.zip and rumfs.Img . I flashed them and the camera at me again earned ........ but! my problem in another,I need to unpack ---- make changes - and then pack ... bin file for the Web interface, but with fostar.C I nepoluchaetsya unzip it writes an error about the file size, although bin file unpacks the root without any problems? ??
Title: Re: FOSCAM FI8919W
Post by: admin on March 14, 2011, 10:56:39 pm
I explain above how the webui is built.

Once again -

Header of WebUI is as follows    (example bytes in Hex)
Header    0x00 0x01 0x02 0x03 :  BD 9A 0C 44  = Identification Header (in lieu of any other use I can think of..)
CRC32     0x04 0x05 0x06 0x07 :  5E B6 A5 02  = CRC32 http://en.wikipedia.org/wiki/Cyclic_redundancy_check
Filesize  0x08 0x09 0x0A 0x0B :  4D DC 06 00  = 449613 bytes
WebUI Ver 0x0C 0x0D 0x0E 0x0F :  04 03 03 27  = 4.3.3.39

The file then follows in TAR format.



Title: Re: FOSCAM FI8919W
Post by: sergot on March 15, 2011, 05:19:16 am
I do not understand how to unpack and pack and flash the camera, I do not see any BIOS file in botloader,,
Title: Re: FOSCAM FI8919W
Post by: Nocturnal on March 15, 2011, 08:17:09 am
Header of WebUI is as follows    (example bytes in Hex)
Header    0x00 0x01 0x02 0x03 :  BD 9A 0C 44  = Identification Header (in lieu of any other use I can think of..)
CRC32     0x04 0x05 0x06 0x07 :  5E B6 A5 02  = CRC32 http://en.wikipedia.org/wiki/Cyclic_redundancy_check
Filesize  0x08 0x09 0x0A 0x0B :  4D DC 06 00  = 449613 bytes
WebUI Ver 0x0C 0x0D 0x0E 0x0F :  04 03 03 27  = 4.3.3.39


That matches with what I have figured out on mine (a EasyN model). I do wonder if the header is checked / enforced anywhere other than through the web interface. The webui header for mine specifies an incorrect length, it works though, probably because the last files header is within the specified file length. Haven't checked the CRC, but I would not be surprised if it was also off.
Title: Re: FOSCAM FI8919W
Post by: sergot on March 15, 2011, 10:06:27 am
What should I do? How do I unpack and pack this WebUI?
Title: Re: FOSCAM FI8919W
Post by: sergot on March 15, 2011, 10:16:00 am
q@ubuntu:~$ ./fostar -x 2.4.18.15.004.bin ./123/
***      REMEMBER! ALWAYS KEEP A BACKUP OF YOUR ORIGINAL FIRMWARE       ***
*** I AM NOT RESPONSIBLE FOR YOU TURNING YOUR CAMERA INTO A PAPERWEIGHT ***
***              USE OF THIS SOFTWARE IS AT YOUR OWN RISK               ***
***                                                                     ***
***           If you don't agree to this, press 'Ctrl+C' now.           ***

Disassembling firmware file '2.4.18.15.004.bin' to './123/'
File size doesn't match that reported in the header: 1141676733/834358
q@ubuntu:~$
Title: Re: FOSCAM FI8919W
Post by: admin on March 15, 2011, 01:28:12 pm
Sergot, as you're persistent on this, I've written a very quick unpacker for you (mostly ripped from Irish Jesus's code).


Copy the code below.
Call it extractwebui.c

Save it, then
Code: [Select]
gcc extractwebui.c -o extractwebui to compile

Usage

./extractwebui  somewebuifile.bin  .

(to extract a webui file to the current folder)

 
Code: [Select]
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <dirent.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <getopt.h>


/* Extract a Webui fileset from a ipcam
   Author Lawrence Sheed
   Based on Foscam.c (Irish Jesus), which in turn was based on Lawrence's work ;)
   
   This does *very* basic checking on the input file, so make sure you have an actual webui file to extract!

 */

static struct option long_options[] = {{"extract", no_argument, 0, 'x'}};
char *g_file;
char *g_path;


int disassemble(char *org_file, char *dst_path) {
FILE *f = NULL;
int len = 0, type = 0, filesize=0,fs=0;
char webui[4];
char src_file[512], dst_file[512], *data = NULL;
int max_data = 0;

//Open File
if ( (f = fopen(org_file, "rb")) == NULL) {
fprintf(stderr, "Unable to open file: %s\n", org_file);
exit(-1);
}

//Get size
fseek(f, 0, SEEK_END);
        fs = ftell(f);
        rewind (f);

//Seek past header and crc
fseek(f, 8, SEEK_SET);
//Get filesize
fread(&filesize, 1, 4, f);
//Get webui version
fread(&webui,1,4,f);

fprintf (stdout, "FileSize: %d\n", filesize);
fprintf (stdout, "WebUI Version %u.%u.%u.%u\n\n", webui[0], webui[1], webui[2],  webui[3]);

if (filesize != fs) {
fprintf (stderr, "** Warning Filesize doesn't match header, exiting **\n\n");
exit(-1);
}

fprintf(stdout, "Disassembling firmware file '%s' to '%s'\n", org_file, dst_path);


while(!feof(f)) {
memset(src_file, 0, sizeof(src_file));
memset(dst_file, 0, sizeof(dst_file));

fread(&len, 1, 4, f); // read filename length
fread(src_file,1,len,f); // read filename
sprintf(dst_file, "%s%s", dst_path, src_file);

type = 0;
fread(&type, 1, 1, f); // read entry type
if (type == 0) {
if (mkdir(dst_file, 0770) != 0) {
fprintf(stderr, "Unable to write file: %s", dst_file);
exit(-1);
}
} else if (type == 1) {
FILE *f2 = fopen(dst_file, "wb");
if (f2 == NULL) {
fprintf(stderr, "Unable to write file: %s", dst_file);
exit(-1);
}

fread(&len, 1, 4, f); // read data length
if (len > max_data) {
data = realloc(data, len);
max_data = len;
if (data == NULL) {
fprintf(stderr, "Unable to allocate  data necessary to extract file.  Requested: %d bytes.\n", len);
exit(-1);
}
}
fread(data,1,len,f);

fprintf(stdout, "Extracting %s (%d bytes)...\n", src_file, len);
fwrite(data, 1, len, f2);
fclose(f2);
}
}

fclose(f);
free(data);
return 0;
}


int main(int argc, char **argv) {


int option_index = 0;
int tmp[4];
int c = getopt_long(argc, argv, "x", long_options, &option_index);

if (optind == (argc - 2)) {
g_file = strdup(argv[optind++]);
g_path = strdup(argv[optind++]);
disassemble(g_file, g_path);
}
else {
fprintf(stderr, "Usage:  extractwebui filename folder\n");
fprintf(stderr, "eg extractwebui  aw_3_0_5.bin .\n");
exit(-1);
}

}


Direct URL for the Foscam and other ARM7 Camera WebUI unpacker is here - http://www.openipcam.com/files/Reverse%20Engineering/extractwebui.c (http://www.openipcam.com/files/Reverse%20Engineering/extractwebui.c)
Title: Re: FOSCAM FI8919W
Post by: sergot on March 16, 2011, 01:48:43 am
Thank you very much .... The file unpacks :)
 How to pack? (I tried to pack with the help of fostar but when loaded into the camera gives an error ... :'(
Title: Re: FOSCAM FI8919W
Post by: admin on March 16, 2011, 02:38:11 am
Packing I didn't write.

Can write one, basically you need to follow the file structure as I laid out.

Header  x 16 bytes
4 byte header
4 byte crc (need to calculate this)
4 byte file version value

Then repeated for each file

Filename Size x 4 bytes
FileName (length from above field)
Type of File 1 byte (folder, file 0, 1..)
Length of File 4 bytes
File (length from above field)
Title: Re: FOSCAM FI8919W
Post by: sergot on March 16, 2011, 01:20:25 pm
I don `t know this ....... I can `t write this ...... if you can help me please?
Title: Re: FOSCAM FI8919W
Post by: DCContrarian on March 16, 2011, 08:32:20 pm
Packing I didn't write.

Can write one, basically you need to follow the file structure as I laid out.

Header  x 16 bytes
4 byte header
4 byte crc (need to calculate this)

I have been working on a pack program and the only tricky part is the CRC calculation (if that's what it is). I've taken existing files and compared those bytes to a 32-bit CRC calculated a few different ways -- the entire file with the CRC zeroed out, everything after the first 12 bytes, everything after the first 16 bytes, everything after the first 8 bytes, just the contents of the files. None of these agree with what's in the file. Does anyone have any insight into how this is calculated?

Solving this question would be a quantum leap, as then it would be a trivial matter to replace the user interface on the webcam with one of your creation.

Thanks.
Title: Re: FOSCAM FI8919W
Post by: admin on March 16, 2011, 09:16:46 pm
Don't forget, you need to reverse the byte order.
I just noticed something interesting regarding the header


Quote
0x00000000: bd 9a 0c 44

http://www.openipcam.com/forum/index.php?topic=43.0

Code: [Select]
005c34:  440c9abd strmi r9, [ip], -#2749
Its our header value -  bd 9a 0c 44!

I guess I need to take a look at what piece of code loads values from 0x5c34 in the disassembly I made at some point..
Title: Re: FOSCAM FI8919W
Post by: sergot on March 16, 2011, 11:33:10 pm
I've yet to think about ... all files that are archived because they are decompressed web when we load them in the camera's memory ..... so why they can not be downloaded directly into the chamber through port Ewart unpacked ... just need to know where they are stored there .... . I type the command "LS" in botloader but I do not see the Web is only 6-7.flesh (But if it is difficult then it will no
Title: Re: FOSCAM FI8919W
Post by: sergot on March 16, 2011, 11:53:19 pm
Generally, my idea to make a web interface for Aktion + adobe flash script (using this I understand) but I'm not to understand how to pack it in the camera ...
Title: Re: FOSCAM FI8919W
Post by: sergot on March 16, 2011, 11:56:54 pm
using adobe flash can make a digital zoom for camera and volume control from any browser that supports adobe flash ... (do not use active-x)
Title: Re: FOSCAM FI8919W
Post by: Nocturnal on March 17, 2011, 04:27:22 am
Its our header value -  bd 9a 0c 44!

I guess I need to take a look at what piece of code loads values from 0x5c34 in the disassembly I made at some point..

See, 0x5b90. Subroutine starts at around 0x5b70. Of interest there is also this.

Code: [Select]
ROM:0000628C                 LDR     R2, =0x440C9ABD
ROM:00006290                 CMP     R3, R2
ROM:00006294                 BEQ     loc_6310
ROM:00006298                 ORR     R3, R5, #0xBD
ROM:0000629C                 STRB    R3, [R4,R12]
ROM:000062A0                 ORR     R3, R5, #0x9A
ROM:000062A4                 STRB    R3, [R4,LR]
ROM:000062A8                 ORR     R3, R5, #0xC
ROM:000062AC                 STRB    R3, [R4,R0]
ROM:000062B0                 ORR     R3, R5, #0x44
ROM:000062B4                 STRB    R3, [R4,R1]
ROM:000062B8                 ADD     R0, R4, #0xF90
ROM:000062BC                 ADD     R0, R0, #0xA
ROM:000062C0                 MOV     R1, R5

However, if looking for the checksum code (which I am), I think its likely being called somewhere near 0x67cc to 0x6844, where it looks like its reading the header for webui out of the flash.

Unfortunately my arm assembler is extremely weak, and I have only limited experience disassembling things, so I probably wouldn't recognise it even if I found it.
Title: Re: FOSCAM FI8919W
Post by: oliver on March 17, 2011, 07:08:45 am
the swf would have to reside on the camera and flash usually is pretty big. Trying to fit that in the 2MB flash, would be a challange. Kernel being 1MB, userland being say 500kb, leaves only 500kb for the webui (i'm just throwing some numbers around here, i'm guessing userland would be more like 700kb and the kernel more like 1.2MB laving 100kb for the webui )

See what the problem is?

Also flash is horrid! Isn't this all not possible via javascript and http (e.g. jquery) requests?
Title: Re: FOSCAM FI8919W
Post by: sergot on March 17, 2011, 08:35:58 am
WEBIU-2.4.18.15.004.bin=815k
swf flash.bin =700k
Title: Re: FOSCAM FI8919W
Post by: admin on March 17, 2011, 08:44:00 am
Kernel is 1.3M (700-800kb compressed), decompresses into ram on boot.
WebUI is about 500kb mostly, especially if we dump the OCX!
Apps about 800kb.

On the 2M flash its tight, on 4M, plenty of room ;)


You can make the WebUI visible in the bootloader, but its been set to hidden in the default firmwares.

@Sergot

If you want to make the flash, I'll do the repack tool, and integrate.
You'll need to look at the current cgi implementations, and copy that for backward compatibility.

Sound like a plan?


Title: Re: FOSCAM FI8919W
Post by: sergot on March 17, 2011, 09:05:28 am
I'll be very happy! :)
Title: Re: FOSCAM FI8919W
Post by: DCContrarian on April 04, 2011, 10:04:53 pm
Don't forget, you need to reverse the byte order.

Ah, that does it!
Not! (I'm just jerking your chain).

In case anyone looks in this thread, it turns out it's just a simple sum of the bytes. See here:
http://www.openipcam.com/forum/index.php/topic,72.0.html
Title: Re: FOSCAM FI8919W
Post by: alexksak on September 30, 2015, 09:05:13 pm
Admin, sorry for hijacking such an old thread but I've been searching all over the web for the location of the Web UI on the device (I'm customizing the init script and want to append some command out to the web pages/css/images to leak some information, I'm trying to cross compile some binaries for the ARM architecture and to figure out why they don't work I need to debug somehow, I don't want to statically customize the web pages so modifying the web ui firmare is not what I'm looking. I'm looking for the location of the web files on the disk).

After tons of searching, you're literally the only person on the net who seems to know where it is! You mention it's hidden, but do you know the path to the Web UI on the disk? I tried /var/www and the other common ones with no luck.

Unfortunately I don't have the equipment to get a serial connection, but I can now successfully pack custom firmware and upload to the device via the web interface.

My firmware is a x.37.2.x but after checking out the camera binary from several differnt versions it seems to me they are mostly the same.

Any help in locating these web files on the device would be greatly appreciated!! I currently have to debug blind :(