Re-organized the forum to more cleanly delineate the development section, as the end user support side appears to have taken a life of its own!

Author Topic: HELP: Heden CAMHED02IPW continous reboot  (Read 4402 times)

April 07, 2013, 03:05:41 am
Hello Openipcam' Community,

First, before posting I've read many posts related to FOSCAM & FOSCAM clone recovery.
I have a Heden CAMHED02IPW cam (Serial 201004 - NEOPCA10-001). 
After upgraded it by error through WiFi the cam was dead and yesterday I was able to upload a new & romfs.img.
The cam now successfully boots but continuously reboots until I enter in Debug mode.
Unpluging the network cable at boot to setup Wifi (that would cancel any future reboot as mentionned in a forum) does not fix this issue.

At each reboot, I can hear a brief noise in the speaker.
FYI, I didn't see any popular "i2C write error" too.

The Heden Cam is detected 2 seconds by IP Camera Tool but too short to change any settings.
I've finally tried to manually set through CLI (Terminal) a fixed IP en disable DHCP: same reboot issue.

I did not uploaded any WEBUI.bin as it's not a native FOSCAM: I was planing to do it through IP Camera Tool. Am I right?
Any idea to move forward will be welcome.
If any of you could attach to this thread a working & romfs.img for this Cam, I would appreciate.
bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000048 exec:0x7F010000 -f
Image: 7 base:0x7F020000 size:0x000BF880 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0E0000 size:0x0008FC00 exec:0x7F0E0000 -a
bootloader > d
Displaying memory at 0x0
[00000000] E59FF018 E59FF018 - E59FF018 E59FF018  ................
[00000010] E59FF018 E1A00000 - E59FF018 E59FF018  ................
[00000020] 7F000168 00000040 - 7F0088E4 00000048  h.@.....H...
[00000030] 0000007C 00000000 - 000000A4 000000A8  |...............
[00000040] EAFFFFFE EAFFFFFE - E92D0003 E59F0058  ..........-.X...
[00000050] E3A01008 E5801000 - E59F0050 E24E1004  ........P.....N.
[00000060] E5801000 E59FE048 - E35E0000 0A0010B8  ....H.....^.....
[00000070] E8BD0003 E59F0038 - E25EF000 E92D0003  ....8.....^...-.
[00000080] E59F0024 E3A01010 - E5801000 E59F001C  $...............
[00000090] E24E1008 E5801000 - E8BD0003 E25EF004  ..N...........^.
[000000A0] EAFFFFF5 EAFFFFFE - EAFFFFFE 000060DC  .............`..
[000000B0] 000060E0 7F000884 - E3A01000 E2412AFF  .`.........*A.
[000000C0] E5923004 E20334FF - E35304FC 03A01001  .0...4....S.....
[000000D0] E3500008 0A00000A - E3500010 0A000013  ..P.......P.....
[000000E0] E3500020 1A000023 - E3510000 0A00001B  ..P.#.....Q.....
[000000F0] E5920024 E3A01003 - E1D10000 1A00001D  $...............
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:
        MAC Address         : 00:60:6E:5D:EE:7A
        IP Address          :
        DHCP Client         : Disabled
        CACHE               : Enabled
        BL buffer base      : 0x00300000
        BL buffer size      : 0x00100000
        Baud Rate           : 115200
        USB Interface       : Enabled
        Serial Number       : 0xFFFFFFFF
For help on the available commands type 'h'
Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #1162 Áù 12ÔÂ 12 17:13:00 CST 2009
 Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 2048
zone(0): 0 pages.
zone(1): 2048 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 8MB = 8MB total
Memory: 6248KB available (1470K code, 286K data, 40K init)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
PTZ Driver has been installed successfully.
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
 ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options enabled
 ttyS00 at 0xfff80100 (irq = 10) is a W90N7451
I2C Bus Driver has been installed successfully.
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0E0000-7F16FBFF [VIRTUAL 7F0E0000-7F16FBFF] (RO)
S29GL032N Flash Detected
01 eth0 initial ok!
PPP generic driver version 2.4.2
Linux video capture interface: v1.00
Winbond Audio Driver v1.0 Initialization successfully.
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
usb-ohci.c: AMD756 erratum 4 workaround
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver audio
audio.c: v1.0.0:USB Audio Class driver
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4
 _____     ____    _    ____
|__  /   _|  _ \  / \  / ___|
  / / | | | | | |/ _ \ \___ \
 / /| |_| | |_| / ___ \ ___) |
/____\__, |____/_/   \_\____/
ZD1211B - version
usb.c: registered new driver zd1211b
main_usb.c: VIA Networking Wireless LAN USB Driver 1.20.04
usb.c: registered new driver vntwusb
usb.c: registered new driver rt73
dvm usb cam driver by Maverick Gao in 2006-8-12
usb.c: registered new driver dvm
dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20
usb.c: registered new driver dvm usb cam driver for sonix288
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: /bin/init
Command: mount -t proc none /proc
Command: mount -t ramfs none /usr
Command: mount -t ramfs none /swap
Command: mount -t ramfs none /var/run
Command: mount -t ramfs none /etc
Command: mount -t ramfs none /flash
Command: mount -t ramfs none /home
Command: mount -t ramfs none /tmp
Command: mkdir /tmp/run
Command: camera&
Command: sh
[#f0000e]no support
Sash command shell (version 1.1.1)
/> hub.c: connect-debounce failed, port 1 disabled
new USB device :807b5004-7e86c0
hub.c: new USB device 1, assigned address 2
dvm cmos successfully initialized
dvm camera registered as video0
new USB device :807b5404-7e86c0
hub.c: new USB device 2, assigned address 3
idVendor = 0x148f, idProduct = 0x2573
aw version is
aw not exist !
aw version is
Wait for auto-negotiation complete...OK
100MB - FULL
video0 opened
set resolution 4
set brightness 100
set contrast 4
set sharpness 3
set mode 0
unknown command
manage pid:16
audio_dev.state not AU_STATE_RECORDING
inet_sr.c INET_rinput 321
inet_sr.c INET_setroute 75

  • No avatar
  • *****
April 09, 2013, 07:36:28 am

"upload a new & romfs.img" is very scarse info. Did you take fw files for the heden cams? This version "aw version is" does not look like heden to me ... but on the other hand the bootlog shows 4MB flash and I've never seen 4MB fw for heden, too.

There exist 2 different fw that I know of. Do a little forumsearch with "heden" and you should find something ... (for the search to work you have to be at top level of forum) maybe it will work ymmv

April 12, 2013, 08:23:32 am
Yes I took the heden firmware available here:

May 23, 2013, 08:36:22 pm
Greetings from Greece,

I just registered to this brilliant forum only to write my success story bringing back my HEDEN back to life after a really long time.
Camera is a Heden "CAMHED02IP 4.0" without WiFi.
None of the existing firmware sets works for me!
I ended up combining files from different sets and my camera works perfectly now.

This is what we end up like:
Device Firmware Version
Device Embedded Web UI Version

bootloader > ls
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af
Image: 7 name:linux base:0x7F020000 size:0x000BF700 exec:0x00008000 -acxz
Image: 6 name:romfs base:0x7F0E0000 size:0x0008C800 exec:0x7F0E0000 -a
Image: 8 name:webui base:0x7F200000 size:0x000E5C00 exec:0x7F200000 -a

Let's start by cleaning up previous attempts:
bootloader > del 6
bootloader > del 7
bootloader > del 8

We only use (~766 KB) which is contained in "541cpu Foscam clone" file from:
bootloader > fx 7 linux 0x7f020000 0x8000 -acxz

Upload the rom (~562 KB) from:
bootloader > fx 6 romfs 0x7F0E0000 0x7F0E0000 -a

Camera should be booting fine by now even without the Web interface. Try it:
bootloader > boot

We can upload the WebUI after rebooting with the "IP Camera Tool" (IPcamera.exe):

We use generic WebUI : aw_0_3_2_5.bin (~379 KB) from:

WebUI "aw_0_3_1_36.bin" and "aw_4_3_3_39.bin" do NOT seem to work fine.

Pin out note : square pin hole is pin 1 (Opposite from the "J2" typed label position)
pin4 is next to typed J2 label, pin1 is next to the mic
1=connect to RXD
2=connect to TXD
3=connect to ground
4=not used (+5v)

I hope this post will help other "doomed" owners too!