Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Topics - celem

Pages: 1 2 [3] 4
General Discussion / Serial Number in SET Command
« on: July 04, 2011, 09:51:46 am »
Recently, I was documenting the "BOOT INFO" image for the wiki and noticed that available documentation differed concerning some of the fields. One difference of interest is the 4 byte serial number field at location 0x7F010040. I am curious as to which cameras contain the SET -sn command? For example:
Code: [Select]
bootloader > set -?
Usage: SET -[mac0 [addr],ip0 [addr],dhcp [0,1],cache [on, off],buffer [base] [size],baudrate [baud rate setting],sn [serial number]]
 -mac0 [addr] Set MAC  Address
 -ip0 [ip addr] IP Address
 -dhcp [1,0] Enable/Disable Dhcp client
 -cache [on,off] Enable/Disable cache when processing images
 -buffer [base] [size] Set the buffer used by UNZIP and TFTP server
 -baudrate [baud rate setting] Set the default baud rate
 -sn [serial number] Set the serial number

bootloader >

If readers would check their camera and post the result, it might prove interesting.

The mac1 and ip1 fields are also of interest. My wansview NC-541/W refers to mac0 and ip0 but not mac1 and ip1 in the set command, and the "BOOT INFO" image 0 contains empty fields for mac1 and ip1 - sort of semi-included.

General Discussion / Msoft IPcamera Programming kit
« on: July 04, 2011, 09:23:49 am »
EasyN currently has a free SDK titled "MICROSOFT FOUNDATION CLASS LIBRARY : IPCam". Close examination may yield something of value concerning external control. For what it is worth, see:

General Discussion / Recover the password
« on: July 02, 2011, 06:05:35 pm »
If you forgot the password, boot into the bootloader's debug mode and enter:
Code: [Select]
bootloader > d 0x7F1F0036
Displaying memory at 0x7F1F0036
[7F1F0034]          006E696D - 00000000 31000000    admin........1
[7F1F0044] 35343332 00000036 - 00000000 6F636502  23456...........

The passwords are stored in clear text. In this example, the admin password is "admin" and the password is "123456"

General Discussion / WansView changes model numbers
« on: June 30, 2011, 06:15:53 pm »
FYI, this week WansView announced that they are changing their model numbers. Foe example, the NC541/W model is now named NCB-541W. The "/" at the end is removed and after the "NC" is a series identifier - Q, B, H or Z. They say that this is being done to standardize models between Chinese and English brands for the second half of this year. Hmmm, sounds like something is in the works. I also noticed that the Foscam website is down for "upgrades". coincidental?

Similar Hardware / EasyN FS-613B-M1661
« on: June 16, 2011, 03:56:26 pm »
When I saw that EasyN was now selling a new camera model with an automatically switching IR-Cut filter, I just had to test it. So, I purchased on on eBay for $69.95, including postage. The manufacturer's link for the camera is

I have had the camera all of 30-minutes but here are my quick observations. The build quality looks good. The plastic is shiny with a metallic look to it. The green relay contact has a removable connector. The wall-plug power supply is different from any of the previous IP-cameras - it looks similar to what comes with Motorola cellular telephones, and it has, what looks like, a molded-in ferrite surge suppressor. The webui is quite different. This transformer is marked 2A versus the more typical 1.5A I have attached a few desktop snapshots. Just like the wansview, this EasyN camera ships with a fixed IP address. I prefer this as it is what I normally use, anyway - and it is more Linux friendly since the IP discovery software is unneeded.

I have not yet opened up the camera to see what is inside.
I have not yet tested the color quality, which is the whole point of the IR-Cut filter.

The camera has a problem, so I'll be attempting to exchange it for a replacement. The video is flashing, so something is wrong - possibly with the sensor. A video of what I see is at:

Also, the color green doesn't look much better than with a foscam so I am suspicious of the validity of the IR-Cut filter claim.

General Discussion / EasyN model e/w IR Cut Filter?
« on: June 08, 2011, 12:27:52 pm »
I noticed a new EasyN camera, model FS-613B-M166I, which claims to have a switchable IR cut filter that renders good daylight colors but automatically switches out at night for use with the IR light. I am wondering if the cut filter is actually mechanically switched, like an AXIS camera, or is this just some sort of software trick. Does anyone have one of these cameras that can advise on its true capabilities?

I contacted a seller of this camera and he states that the IR Cut filter is optical and is switched out mechanically. Wansview has a similar model. Also, a non-PTZ outdoor model by EasyN is being advertised that contains a cut filter.

Here is a mechanism for the waterproof camera that is being sold separately:

uCLinux / uClinux-dev Discussion List
« on: May 26, 2011, 11:03:30 pm »
I just stumbled across this. Seemed interesting.

General Discussion / Disassembly Photo Guide
« on: May 22, 2011, 03:20:25 pm »
I disassembled a Wansview NC541/W camera amd photographed most steps and anointed the photos with some disassembly tips. After I put the camera back together I was especially pleased that it still worked and that I broke nothing.

The link to the photo guide is:

FYI - I used to own a Foscam FI8908W (gave to a friend) and the WansView NC541/W ( is extremely similar (as in virtually the same). Foscam's customer support is better than Wansview's in that Foscam posts firmware updates on their web page while Wansview only posts user manuals. Wansview will email you updates to the webui but they were not forthcoming with the remainder of the firmware. I now have all firmware (, romfs.bin & webui.bin) so this isn't an issue for me. The Wansview is very well constructed. I was plesantly surprised at all of the little quality steps taken, like tie-wraps to neaten wire bundles, hot-glue restraints to prevent parts loosening, etc. After breaking down the camera I am quite surprised that it can be built and sold for such a low price. I was really surprised to find that the turret is supported on a steel ball bearing assembly. In summary, I am very pleased with the WansView build quality and I especially like the fact that it is cheaper than an equivalent Foscam - $10 to $15 cheaper.

General Discussion / check_user.cgi
« on: May 19, 2011, 02:01:09 pm »
I was looking at the webui code for my wansview NC541 and also the webui for the apaxis camera. Both have a call to the check_user.cgi. The check_user.cgi call is not documented in the IPCAMCGISDKV1.7.PDF or C1002_CGI_ProgrammingGuide.pdf in the files/manuals section of this site. This call is not found in the foscam webui, which explains why it is not found in the manuals. Does anyone have cgi programming manuals for non-foscam cameras that contain the check_user.cgi call and possibly others not found in foscams?

General Discussion / Stepper motor speed
« on: May 17, 2011, 04:14:49 pm »
I used to have a foscam FI8909W and now I have a couple of similar WansView NC541/W cameras. Maybe my memory is failing, but I do not remember the foscam FI8909W having a pan/tilt speed anywhere near as fast as that of the WansView NC541/W. Would one/some of you with a foscam FI8909W compare your pan/tilt speed to that of the WansView NC541/W? See the video at the link below to see the WansView NC541/W's speed.


General Discussion / Webui complexity
« on: May 16, 2011, 08:06:19 pm »
An observation:
I was just comparing some of the source for the webui of my FOSCAM and my WansView. Since both cameras are virtually identical in appearance and function, except that the webui has a different physical appearance, I am surprised at the difference in complexity. The foscam webui appears to have been mostly hand crafted - probably to save space, or at least hand simplified, while the WansView code is at least double in size, appearing to be the output of some website creation program. And to top it off, the Foscam code looks more attractive!

General Discussion / Making the serial connection
« on: May 14, 2011, 04:24:44 pm »
I have two wansview NC541/W that I use for hacking. For my serial to usb conversion I use a USB to serial UART FTDI interface Board to interface between the camera and the computer ( The camera's serial connector had no header installed so I just solder tacked the leands as needed. However, going back and forth between the cameras was tiresome and would eventually damage the solder pads, so I decided to make a better connection arrangement. The camera's four serial header pads have 2mm spacing, which is not typical. I ended up ordering from a Chinese eBay supplier, a lifetime supply of "2mm 40 Pin Male Single Row Pin Header Strips", which I can easily snap into 4-pin units. I soldered a 4-pin unit into each camera's serial connector pads. To connect between the camera and the FTDI serial adapter, I used breadboard jumper wires from Gravitech. I selected the Male/Female version but I now see that if I had ordered the Female/Female version then no soldering would have been required. See
The female end is designed to tightly slip over header pins, making a good, but temporary electrical connection. I bent the camera ends of the jumper cables at 90-degrees to fit the bottom clearance.

General Discussion / Hidden DDNS?
« on: May 13, 2011, 08:05:53 pm »
WIth my wansview nc541/w, I have the DDNS setting set to NONE. However, I notice that the serial port constantly outputs the fillowing:
Code: [Select]
audio_dev.state not AU_STATE_RECORDING
inet_sr.c INET_rinput 321
inet_sr.c INET_setroute 75
update_smarteye_ddns: can not get server  ip
ntpc adjust ok
bonjour callback: service registered
update_smarteye_ddns: can not get server  ip
update_smarteye_ddns: can not get server  ip
update_smarteye_ddns: can not get server  ip
update_smarteye_ddns: can not get server  ip
update_smarteye_ddns: can not get server  ip
The smarteye_ddns is a ddns service run by wansview. I do not like the fact that it appears to constantly try to "phone home" even though I have ddns set to NONE!

Firmware / Memory - 4MB
« on: May 03, 2011, 05:48:44 pm »
I have attached a memory map of the 4MB device (S29GL032N) used in my WansView NC541/W. The map appears to be virtually the same as a Foscam. I like pictures - it helps me see things that I would otherwise miss.
I updated the attached map

General Discussion / Where to put webui??
« on: April 29, 2011, 01:10:47 pm »
I loaded the webui with:

Code: [Select]
fx 8 webui.bin 0x7f200000 0x7f200000 -a
I notice in Lawarence's post "Firmware Recovery - method #2" that he loads to 0x7F180000

Which is right?

Pages: 1 2 [3] 4