Hacking the IPRobot3

I have made progress . I have no booting at all its all gone so the serial port is useless ATM . With nothing to loose I read some documentation about the GM8126 and how it can the load the SPI flash via USB . After checking the pins I was delighted to find the USB had been implemented and was being used for the wireless board .After removing the wireless board and connecting a USB cable to the PC the MP tool found the SPI flash and I can write to it .

I can now watch a boot using the serial port again but need the correct bin files for camera operations. The burn in program allows a "(77) Burn fresh spi flash " but not one big block . ?
Looks as tho it can be done through U-boot .
Would anyone be good enough to post or Email dumps of the SPI flash partitions ? Mines the old camera with the alarm connector on the back .


/ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 0067f000 00001000 "Linux Section"
mtd1: 00100000 00001000 "User Section"
mtd2: 0000f000 00001000 "Loader Section"
mtd3: 00050000 00001000 "BurnIn Section"
mtd4: 00020000 00001000 "UBoot Section"
mtd5: 00020000 00001000 "CFG Section"


I hope this help others with the same problem .

I have loaded a bin for linux and other files from a firmware update file mentioned here. http://www.openipcam.com/forum/index.php/topic,386.msg3495.html#msg3495.
Im getting to here in the boot.sh
_______________________________________________
/usr/sbin/telnetd
mke2fs /dev/ram0
mount -t ext2 /dev/ram0 /mnt/mtd/rd
mkdir /mnt/mtd/rd/jpeg
if [ -f /mnt/mtd/html.tgz ]; then
   tar -xzf /mnt/mtd/html.tgz -C /mnt
fi

cd /mnt/
./ipc8126
sleep 5
RETVAL=$?
if [ $RETVAL != 1 ]; then
echo ------- Start uploader --------
/mnt/uploader 0
#/mnt/uploader $?
echo ------- Uploader terminated --------
fi

reboot
______________________________________________
/mnt/mtd/boot.sh: line 51: mke2fs: not found
mount: mounting /dev/ram0 on /mnt/mtd/rd failed: No such file or directory
mkdir: cannot create directory '/mnt/mtd/rd/jpeg': No such file or directory
/mnt/mtd/boot.sh: line 56: tar: not found
/mnt/mtd/boot.sh: line 59: ./ipc8126: not found
______________________________________________
And seem to be missing some files mainly mke2fs , tar , ipc8126, uploader . I added the sleep 5 to allow easy exit from the endless rebooting

Anyone out there check theirs and check what im missing ?

Hi there, ive got a Tenvis IP391w-HD camera based on the same hardware as the iprobot 3 i have flashed the iprobot firmware on suggestion from tenvis support and it worked fine. But this camera has always had a problem with dropouts even when connected to a wired ethernet connection, it worked well for an hour then drops out and creates continuous events on my zoneminder setup.

I went to downgrade the firmware from 1.3.3.3 to 1.2.8.3 (apparently the most reliable according to users) and last night the connection dropped out whilst upgrading the firmware.

 Now it wont log on to the network, I can't find it with hd camera search tool on my vm. Connected to computer or router. im guessing its bricked, seems like a boot loop i get the green network light come on then yellow network light flashes for 3-4 mins then turns off and yellow light. Tried reset for +1 minute same result. I'm not new to modifying devices or firmwire, but ive never jtagged anything, running ubuntu and fairly competent with terminal, so if i could extract the firmware should be able to just write the missing firmware files using DD i guess using the j9 or the usb pinout on the wireless card. Any ideas?

 I have high res photos of the board i will try to attach them.

Thanks in advance b =]

But this camera has always had a problem with dropouts even when connected to a wired ethernet connection, it worked well for an hour then drops out and creates continuous events on my zoneminder setup.

Your camera looks to be very unstable not a good time to upgrade !. I would first check the power plug pack ive had capacitors die in mine with in a few weeks of getting it .If your lucky it might work then .


Once thats checked I would try the RS232 first telnet method mentioned earlier in this thread   jtagg method would be a last resort .

Looks as tho you have the newer 2013 model by the look of the firmware your using ( no green connector on the back ?.

Update
       Working again after loading the Linux & User partitions from a donor Iprobot3 using uboot. Then doing a firmware upgrade with the upgrade tool fixed the SETUP not working in the browser.

dont b!tch if you brick your sh!t.

telnet ip address
login: root
pass: blossom2012

now has anyone figured out how to make the pan/tilt faster than that lame crap they have the fastest set to?  way to slow for me!

Hi there, ive got a Tenvis IP391w-HD camera based on the same hardware as the iprobot 3 i have flashed the iprobot firmware on suggestion from tenvis support and it worked fine. But this camera has always had a problem with dropouts even when connected to a wired ethernet connection, it worked well for an hour then drops out and creates continuous events on my zoneminder setup.

I went to downgrade the firmware from 1.3.3.3 to 1.2.8.3 (apparently the most reliable according to users) and last night the connection dropped out whilst upgrading the firmware.

 Now it wont log on to the network, I can't find it with hd camera search tool on my vm. Connected to computer or router. im guessing its bricked, seems like a boot loop i get the green network light come on then yellow network light flashes for 3-4 mins then turns off and yellow light. Tried reset for +1 minute same result. I'm not new to modifying devices or firmwire, but ive never jtagged anything, running ubuntu and fairly competent with terminal, so if i could extract the firmware should be able to just write the missing firmware files using DD i guess using the j9 or the usb pinout on the wireless card. Any ideas?

 I have high res photos of the board i will try to attach them.

Thanks in advance b =]

The exact same thing happened to me trying to downgrade to 1.2.8.3 on a Veevocam V200HD, a rebranded iprobot3.  Now the green network led flashes, but the amber is continuously solid.  Tried all the resets, and it's stuck in a boot cycle so that every minute or so, both network leds go out, then back on, and you hear a click. On and on, ad nauseum.  Did you ever get yours back to normal?

I've just disabled the IR leds simply by soldering a link wire across the front pins  of the sensor. The two very small contacts either side of the sensor (front) need the very thin lacquer coat scrapping off, a small modelling knife is ideal, then tin a thin piece of wire with solder and very carefully solder across  contacts. This is a fiddly job and a fine tip iron is crucial, also a steady hand and magnifier is useful...  saves taking the whole unit apart.

Hello!
Does anyone has full dump file from flash memory, which contains firmware and loader?
The version is IPROBOT3 2013, PCB v1.2.
Thank you!

Firmware 1.2.8.3 no video in IE, does not work Wi-Fi.
Trying to update to 1.2.5.3, 1.3.1.3 or 1.3.3.3 results in an error FAILED.

Current System Information
Software Ver.   1.2.8.3
Release Date   2013-04-18 13:27:34
Hardware Ver.   GM8126


How to flash \ recover?
Or please give full dump file from flash memory.

For someone who would like to solve IPROBOT3 freezing when pan/tild problem:
model: IPROBOT3 ver. 2013 (selling in 2013 Yr)
firmware: 1.3.3.3
Problem: camera freezing when pressing pan/tild arrows on web GUI.

I my case this solution soled this problem. Silicon chip is overheating in some models of IPROBOT3 cameras, so I put aluminium tape on the camera motor and silicon paste on that. The camera motor with silicon paste contact to the chip and is cooling that chip. I think this solution is good for others IPROBOT3 unstable behaviors. New version of IPROBOT (2014 Yr -black version) has improved GUI and functionality and they are stable.

Hello!
Would You be so kind to help me and give iprobot3 flash full dump, so I make my iprobot work again?
Thank You!

Unbricking a bricked IProbot3 ver1. 2013 with firmware 1.1.6 

This is a bit old news since the version of the camera has changed, but after a few years and many months of trial and error, I finally found a combination of steps that let me unbrick my old Tenvis IPRobot3 camera.  It looks that some people were able to use Telnet for this, I used the USB method.  I am ending my work on these cameras and will not be able to support those of you that try this nor will not be able to give out the firmware.  You might be able to find old  firmware on the web and the tools to extract the pk2 files.   Also, this procedure might only work on older discontinued versions of cameras and on a limited number of instances when the camera had a bad firmware update and it became unresponsive.  Specifically in my case, it failed during a firmware update when the Ethernet cable got unplugged and wifi was used for the update by accident. If this has happened to you too, then there is a good chance the steps below could help you.   

In order to complete the procedure, you will need to remove the camera bottom cover and connect a 3.3v USB converter to J9 by soldering wires to the camera's pcb, then use a terminal program to interact with the boot-loader. You will also need a fat32 formatted TIFF SD memory card and a copy of the firmware that has been uncompressed and renamed from “mtdblock0.new” to “linux”.  I also copied all the other files in the uncompressed gm8126-tenvis-1-1-6-2-2012-11-08.pk2 to the SD card then renamed them removing “.new” from each, but it seemed unnecessary.  If your camera is newer, use a version of firmware that is intended for that model of camera and J9 maybe different as well.

The steps are to copy Linux to the TIFF SD card and then put the SD into the camera. Then connect an Ethernet cable and the U9/USB port to a computer.  Now power up the camera and launch your Hyper Terminal program at 38400 baud N81 with the correct com port setting. Next power off and on the camera and press “.” in the terminal program during the first two seconds of the camera's startup. Then from the bootloader menu, do option 78 to boot from SD. The camera should load Linux from the sd.  Next find the IP address of the camera. The IP address of the camera is listed in hex format at the end of the linux boot log seen on the terminal screen.  To resolve the IP address of the camera, convert the hex numbers to decimal. Lastly, log into the camera with a web browser and do a normal firmware update. 

Notes: There are post regarding what wires to connect to J9 already and you will have to search for them. You will have to manually set your computer's IP address in the same subnet of your camera, but as a different IP address in that subnet.  I also found that Hyper Terminal would not recognize the USB com port unless I connect the USB converter to the computer and camera first, then power on the camera before I launched Hyper Terminal.  I suggest getting comfortable with the boot-loader via Hyper Terminal after connecting to J9 and insuring you have working USB drivers for the USB converter first. 

Good Luck!

i know its been a while, but i hacked this firmware to enable telnet if anyone wants it

login = root
pass =

this is for the 2014 model of the iprobot3