News:

Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at http://www.computersolutions.cn/blog

Author Topic: "hootoo" brand sold in Germany  (Read 12703 times)

  • No avatar
  • *****
May 04, 2011, 05:53:40 am
Hi!

I recently bought that IP-cam via Amazon Germany. Vendor doesn't give any support.
Find attached pictures from the box, PCB and GUI.
I'll try to dump the fw maybe next week...

Could be similar to Apexis or 7Links (looking at GUI) has white! front led.
Seems to have 4MB flash (looking at part#), USB-WLAN is Ralink.

Any thoughts/comments on that piece of HW?

Maybe it would be good to have a list of PCB names/pictures ?

P.S.: the WLAN can't pick up ch12 & ch13. Is this a common problem? Would it be fixable by modding the existing fw by e.g. setting some shell variable?

P.P.S: it is/was Apexis OEM, so if your unknown cam has white LED and similar webui chances are good that apexis fw for APM-J011-WS will work.
« Last Edit: September 13, 2011, 02:49:24 am by schufti »

  • No avatar
  • *****
May 09, 2011, 05:22:26 am
ok, here are some bootlogs and dumped fw:

Code: [Select]
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000048 exec:0x7F010000 -f
Image: 7 name:linux base:0x7F020000 size:0x000BF718 exec:0x00008000 -acxz 
Image: 6 name:romfs base:0x7F0E0000 size:0x00090400 exec:0x7F0E0000 -a     
Image: X name:webui base:0x7F200000 size:0x000A4806 exec:0x7F200000 -a -nofooter


W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

        MAC Address         : 00:0x:xx:xx:xx:yy
        IP Address          : 0.0.0.0
        DHCP Client         : Enabled
        CACHE               : Enabled
        BL buffer base      : 0x00300000
        BL buffer size      : 0x00100000
        Baud Rate           : 115200
        USB Interface       : Enabled
        Serial Number       : 0x00XXXXYY


For help on the available commands type 'h'

Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #1220 ¶þ 12ÔÂ 15 09:22:11 CST 2009
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 4096
zone(0): 0 pages.
zone(1): 4096 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 16MB = 16MB total
Memory: 14344KB available (1470K code, 287K data, 40K init)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
PTZ Driver has been installed successfully.
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80100 (irq = 10) is a W90N7451
I2C Bus Driver has been installed successfully.
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0E0000-7F1703FF [VIRTUAL 7F0E0000-7F1703FF] (RO)
S29GL032N Flash Detected
01 eth0 initial ok!
which:0
PPP generic driver version 2.4.2
Linux video capture interface: v1.00
Winbond Audio Driver v1.0 Initialization successfully.
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver audio
audio.c: v1.0.0:USB Audio Class driver
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4

 _____     ____    _    ____
|__  /   _|  _ \  / \  / ___|
  / / | | | | | |/ _ \ \___ \
 / /| |_| | |_| / ___ \ ___) |
/____\__, |____/_/   \_\____/
     |___/
ZD1211B - version 2.24.0.0
usb.c: registered new driver zd1211b
main_usb.c: VIA Networking Wireless LAN USB Driver 1.20.04
usb.c: registered new driver vntwusb
usb.c: registered new driver rt73
dvm usb cam driver 0.0.0.0 by Maverick Gao in 2006-8-12
usb.c: registered new driver dvm
dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20
usb.c: registered new driver dvm usb cam driver for sonix288
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: /bin/init
Command: mount -t proc none /proc
Command: mount -t ramfs none /usr
Command: mount -t ramfs none /swap
Command: mount -t ramfs none /var/run
Command: mount -t ramfs none /etc
Command: mount -t ramfs none /flash
Command: mount -t ramfs none /home
Command: mount -t ramfs none /tmp
Command: mkdir /tmp/run
Command: camera&
[8]
Command: sh

Sash command shell (version 1.1.1)
no support
/> hub.c: connect-debounce failed, port 1 disabled
new USB device :80fb2004-fed6c0
hub.c: new USB device 1, assigned address 2
dvm cmos successfully initialized
dvm camera registered as video0
new USB device :80fb2404-fed6c0
hub.c: new USB device 2, assigned address 3
idVendor = 0x148f, idProduct = 0x2573
aw version is 0.22.2.20
aw version is 20.8.4.23
Wait for auto-negotiation complete...ResetPhyChip Failed
video0 opened
1
1
1
1
1
1
set resolution 5
set brightness 80
set contrast 4
set sharpness 3
set mode 2
unknown command
_i2c_write: write i2c error
_i2c_write: write i2c error
__pthread_initial_thread_bos:360000
manage pid:16
audio_dev.state not AU_STATE_RECORDING
wb_audio_start_record
=> usb_rtusb_open
ntpc.c: can not resolve ntpserver(at.pool.ntp.org)'s ip
can not get dyndns server ip
check_ipid_shat_net: can not get ip of ipid.shat.net
will update 7988
update_7988: can not get server www.aipcam.com ip
[26]
_i2c_write: write i2c error
_i2c_write: write i2c error
write i2c error
can not get dyndns server ip
check_ipid_shat_net: can not get ip of ipid.shat.net
will update 7988
update_7988: can not get server www.aipcam.com ip
ntpc.c: can not resolve ntpserver(pool.ntp.org)'s ip
MlmeAssocReqAction(): WPA/WPAPSK, Fill the ReqVarIEs with CipherTmp!
3
3
3
3
3
3
ntpc.c: can not resolve ntpserver(pool.ntp.org)'s ip
can not get dyndns server ip
check_ipid_shat_net: can not get ip of ipid.shat.net
will update 7988
update_7988: can not get server www.aipcam.com ip
ntpc adjust ok
will update 7988
update_7988: update ok

the cmos sensor seems to be an micron mi360, so it should be possible to get 800x600.
For me, the webui is faulty, because if I switch to a lower resolution, I expect the area of the picture to stay the same, only to be more "unsharp". Instead the size of picture gets smaller and smaller surounded by a black frame ....

some thoughts on the webui:
it looks like some ppl have problems with the webui, because it was flashed to the wrong address. There seem to be two locations where the webui is expected to be and this locations most likely have to be regarded either in the kernel or some binary in the romfs. So it might depend on what kernel/romfs one uses where one has to place the webui

some hint on the kermit dump script:
it allways does 1 block too many.

rgds, schufti
« Last Edit: June 18, 2011, 07:58:12 am by schufti »

May 09, 2011, 09:46:30 am
some thoughts on the webui:
it looks like some ppl have problems with the webui, because it was flashed to the wrong address. There seem to be two locations where the webui is expected to be and this locations most likely have to be regarded either in the kernel or some binary in the romfs. So it might depend on what kernel/romfs one uses where one has to place the webui

The camera binary in the romfs definately has to be pointing to the right place. I suspect its actually the size of the flash chip (2meg or 4meg), that is the determining factor as to where the images are.

the cmos sensor seems to be an micron mi360, so it should be possible to get 800x600.

You could try the following, but I doubt it will work.
Code: [Select]
http://your_camera_address/camera_control.cgi?param=0&value=64
For me, the webui is faulty, because if I switch to a lower resolution, I expect the area of the picture to stay the same, only to be more "unsharp". Instead the size of picture gets smaller and smaller surounded by a black frame ....

To me that would be changing the DPI (though technically, it would be changing both). You can probably achieve this effect by creating a custom webui, and changing the bit that goes something like...
Code: [Select]
<img src="videostream.cgi">to something more like this
Code: [Select]
<img src="videostream.cgi" width=640 height=480>but I haven't tested it, so I cant be absolutely certain it would work.

Edit: That wouldn't work for IE. I haven't looked at the html for that part, but since it uses active x, it will probably require a different solution.

« Last Edit: May 09, 2011, 11:59:46 am by Nocturnal »

May 18, 2011, 05:10:58 am
ok, here are some bootlogs and dumped fw:

Hello,

I got the same cam and wondering how you get into the debug mode?

Greetings,
UnknownX

  • No avatar
  • *****