Categories and Search Box

Thursday, December 24, 2009

Bring your FI8908W paperweight back to life

If you're part of the numerous people who bricked their ip camera at any stage, maybe you kept it (as a door stopper, a paperweight or a dummy camera). In that case, there is one last thing you can try to make your camera functional again. It requires a small investment of less than €15 so I think it's really worth trying.

I obtained some information recently, thanks to Foscam tech support for most part, on a serial upgrade method that would fix cameras for which the firmware upgrade went bad.


A word of caution first: 
- I've only tested this method with the oldest FI8908W, not the Foscam "Logo" FI8908W  (fw v.11.14.2.26 and up).
- this should be experimented only if you exhausted your other options, like claiming a replacement under the warranty.
- this is also not guaranteed to work for all. It suppose that the boot loader in the camera is still intact.
- the recovery files are not normal firmware upgrade files and cannot be uploaded to the camera using the normal firmware upgrade procedure.



What you need:

- a USB to serial UART interface that does 3.3v logic (see photos). If dual 3.3v/5v is not specified, assume it does 5v only and don't buy. This should not cost you more than €15.

- some wires and female crimp pins to make the connections easier. I reused those from an audio cable for CD-ROM.

- the Foscam  FI8908W Recovery files (+ mirror) - They contain instructions and binaries to upload.
2011 Update: I've received these other recovery files (+ mirror) from Foscam and should work with newer FI8908W AND FI8918W

- a terminal software if you don't have HyperTerminal on your version of Windows. I suggest RealTerm.
- I also used some adhesive putty to help keeping the wires in place and isolate the wires from each other.


You have to unscrew the bottom cover of the camera to access the JTAG connector (marked J2). On some cameras the connector is there but without the pins; In this case, add a solder iron to the "What you need" list. The only challenging task will be to achieve a stable connection to it for the length of the operation.





In the documentation, the file IPCAM_PCB_Connection.xls shows where to connect the wires. The 4 pins, from right to left are used as follow:
Pin #1 - INPUT
Pin #2 - OUTPUT
Pin #3 - GROUND
Pin #4 - POWER (not needed)

The serial interface you buy may have more than 4 pins but the corresponding ones will usually be labeled as TXD, RXD, GRD and VCC. One important point is that you need to cross INPUT with TXD, and OUTPUT with RXD.

The file IpCam serial upgrade.pdf will tell you how to initiate the connection with the boot loader of the camera and what commands to issue in order to upload the recovery files, linux_4Mx16Bit_new.zip and romfs_cmos_11_14_2_17.img (for FI8908W and FI8904W)  into the camera. (included W90N745 uClinux BSP User Manual.pdf documents the uClinux commands).

Once your wires are connected, power on the camera, and if you see a screen like the one below, the rest should be straightforward.

Below is the documented procedure as it worked for me. In bold is what you type and in italic what is returned (don't forget to press ESC to enter debug mode as told on screen).


bootloader > del 6
ERROR: Image 6 is not existed   (there was obviously nothing to delete in my case)

bootloader > del 7
ERROR: Image 7 is not existed
with the new recovery files the address to use below has changed
bootloader > fx 6 romfs_cmos_11_14_2_17.img 0x7f0e0000 0x7f0e0000 -a
Waiting for download
Press Ctrl-x to cancel ...  (while it waits, you have to select Transfer > Send File in Hyperterminal menu, choose the Xmodem protocol and select the file romfs_cmos_11_14_1_37.img)
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Flash programming ...
.........
bootloader > fx 7 linux_4Mx16Bit_new.zip 0x7f020000 0x8000 -acxz
Waiting for download
Press Ctrl-x to cancel ...  (while it waits, you have to select Transfer > Send File in Hyperterminal menu, choose the Xmodem protocol and select the file linux.zip)
CCCC
Flash programming ...
..........
bootloader > del b31 (Clears the flash parameters)

bootloader > boot

Rebooting the system ...


The camera will boot and probably start moving during the initial check up phase, it's back !


The camera may report that no Web-UI is present. In that case, use the IP Camera Tool to flash a normal WebUI file the traditional way (don't use the recovery file for this).

Something for non-Foscam devices:
I don't want to be Foscam-centric, it's just that I only have Foscam devices at the moment, so I'll put here similar recovery packages for non-Foscam cameras when available and to the limit of my free storage (mainly FileFactory & Google Docs). They're provided as is and I have no way to test them.

Please also note the new "Recommended Readings..." section on the right column with links to some outstanding web sites on IP cam hacking.

IP607 (EyeSight) found @ Chinavasion: This recovery package is the result of concerted efforts of the ip cam hackers
commenting below this post. It's been  made available by Admin  (mirror) and contains the adjustments to the fx 6... line. Please follow the instructions in the help.txt.

EasyNP FS 613A M136: Check this very detailed recovery guide from Oskys!

Changing the MAC address
Some clones, mostly from DealExtreme.com apparently came with the same MAC address, making it impossible to use them together in the same network. An easy way is documented here (mirror). I didn't test it, but according to the feedbacks on Ted's blog, it seems to work great.

348 comments:

  1. Very goooooood !!Thanks a lot !!

    ReplyDelete
  2. I have seen the documentation is very complete. But I do not have the skills to understand exactly how to do, and then, I do not speak English. I did the firmware update to version 1.14.1.43. . Simple. There is no FW that can easily load and change the MAC? Thanks for the answers.

    ReplyDelete
  3. @pietro

    The mac address is loaded in the wifi module like this http://picasaweb.google.com/lh/photo/59iS7gRMPnznjZcSzh2FCA?feat=directlink . So you can't change it with an fw upgrade.

    ReplyDelete
  4. I want use my original foscam FI8908W buyed from andy.lig.I must use upnp but I have this message in administrator panel: UPnP Failed: Errors in Chat with UPnP Device.
    The firmware is
    Device Firmware Version 11.14.1.46
    Device Embeded Web UI Version 2.4.8.12

    Dyndns is ok. I have enabled upnp on router and use a lot of varius port (80, 81, 8080, 8005) but I don't access the ipcamera in internet.
    I add a virtual map function on router Dlink G604t dls but I don't access the ipcamera in internet. How can I solve?

    Thanks. Bye

    ReplyDelete
  5. @Cherubino
    upnp has never worked on the fi8908w as far as I know. Hopefully Foscam we eventually fix it in a future fw.

    ReplyDelete
  6. Thank you for your reply. I solved the iusse: public ip of webcam don't work from my lan, but it works from internet. Is it ok?

    Thanks

    ReplyDelete
  7. Hi. Is there a way to fix the position of the camera that also withstands the reboot? Thanks. Bye.

    ReplyDelete
  8. @Cherubino
    Check topic #4 on the FAQ page for your solution.

    ReplyDelete
  9. Thanks for your reply. Does it work when I power off the camera?
    To return to old working, must I write http://IPCamURL/set_misc.cgi?ptz_center_onstart=1 ?

    Thanks
    Bye

    ReplyDelete
  10. @Cherubino
    Yes to both your questions. The setting is persistent.
    cheers

    ReplyDelete
  11. Wonderful! Thank you very much for your help.
    Are there other useful settings not written in the manual?

    Thanks.
    Bye

    ReplyDelete
  12. @Cherubino
    take a look at the documentation section of the Firmware history page. You'll find all the supported commands in the SDK documents.

    ReplyDelete
  13. Thank you very much. Is there a program that command the camera to track a object (man or thing) in movement? Thanks. Bye

    ReplyDelete
  14. not that I know of Cherubino. I doubt the camera resolution is high enough for that.

    ReplyDelete
  15. Hey Bubbah! Love reading the blog! I'm considering purchasing the Focam camera but don't really want to spend $100USD and be disappointed when I get it. Is there anything I should know prior to buying it? Is there anyway I could view someone's live feed to get a sense of how it is? All the demos I can find online seem to be dead.

    Thanks!

    ReplyDelete
  16. @Aaron,
    You can have a good idea of the features and bugs in the firmware history page.
    One of the most ennoying pending issue is the camera being unable to re-connect by itself when the connection has been lost for any reason (router restart, interference,...).
    There were many complains about the colour rendering in the early production but Foscam said they now fitted a better lens. I have only older fi8908w but I replaced the lens for 5 bucks and it imporved the image quality a lot! see here. There's also some screenshots on that page.

    As it's difficult to know if you're really buying a Foscam on eBay (some advertise openly Foscam products and their screenshots show a completely different UI, like this guy here), they posted the names of some resellers on this page.

    I'm afraid there's no more live demo available

    ReplyDelete
  17. @Bubbah & Aaron

    I'm in process setting up a live cam at my place! I will post the link here, as soon the cam is mounted to the roof and the wifi is working ;-)
    But I still fight with the webpage, because the javascript on it does not submitt the username and passwort for the cam-user.
    I will post my code later. Maybe somone can help me solve the problem.

    @Bubbah
    Are there any (original) lenses with IR Filter so we can get the "regular" color from outside?? I do not need the IR since the cam is on top of our house :-)

    Thanks
    Stefan

    ReplyDelete
  18. @Stefan,
    the only alternative lenses I know are the ones from DX (and eBay) mentioned on this page. They give a much better image but have IR filter. It's not perfect for colors, but I found the tree to render a bit less pinkish.

    ReplyDelete
  19. @Bubbah & Stefan

    Thanks for the info! I'm doing some more research before I make the purchase :)

    Stefan, I'm looking forward to checking out your camera! Good luck!

    ReplyDelete
  20. Can somebody help me with my bricked camera living in holland ?
    I did make a update and now only lan light burn,

    Ferry

    ReplyDelete
  21. Great work I finally restored my ip cam that I bought from DealExtreme. I can, if you want, to help my Italian friends who have the same problem. Email to dbtre (@) dbtre.com for information.

    ReplyDelete
  22. Bonjour

    il existe un code pour couper le son du micro???

    ReplyDelete
  23. Good morning

    there is a code to cut the sound of the microphone???

    j use version in 11.14.1.46

    ReplyDelete
  24. Hello there,

    I have install my foscam at home with UPnP enabled in my router and also port forward. DDNS works but still,
    "UPnP Failed: Errors in Chat with UPnP Device" and I cannot access my camera from office.

    Anyone manage to access the camera from outside the same network?

    ReplyDelete
  25. @6p00e54f8ae8238833

    It's a known pending bug, this is the usual error I also get, since the very first firmware

    ReplyDelete
  26. My camera has the following type: ES-IP607W ARM_V1.0 090318.
    (Chinavasion)

    - The camera has the following firmware information:
    Device ID 000C5D7508CB
    Device Firmware Version 12.23.2.5
    Device Embeded Web UI Version 2.2.0.4

    I have updated my camera with:
    - system 11.14.1.46 + Web UI 2.4.8.12 from this website:
    http://www.drivehq.com/file/df.aspx/publish/bubbah/PublicFolder/FI8908W-fw11.14.1.46.zip (Foscam)

    Since I updated my camera, I can see with the “IP camera tool” that the device firmwire is loaded to the system 11.14.1.46 and the Web UI shows 0.0.0.0.the camera from the network (ping).
    The camera is restarting everything 15 seconds.
    I have 2 seconds to connect with

    Have anyone the good firmware?
    Can i use this update whit uart?

    Greets Rob,

    ReplyDelete
  27. @Rob,
    If you're going UART, the files linux.zip and romfs_cmos_11_14_1_37.img which are part of the recovery files downloadable in the post above must be used, the usual firmware files won't do.
    Before that, you could try the cgi command upgrade_htmls.cgi(url would look like http://ipcam/upgrade_htmls.cgi)
    to try re-uploading the webui file (all versions available here)

    see the CGI documentation on the firmware page for details.

    ReplyDelete
  28. Hello Bubbah,

    Thanks a lot for your answer.
    I can`t use the uprade_html.cgi
    It is whit the POST method.
    My cam has 2 sec. to load the firmware.
    I think its not enough.

    Can i use this also for the ES-IP607W because it is NOT a Foscam?

    Rob,

    ReplyDelete
  29. @Rob,
    yes, that's true, it's POST only, I think there's an example of code in the ip camera manual (see firmware page again).
    Firmware-wise, these cameras are different, but I believe it's possible to jtag it with the recovery files from this post (it would turn it into an illegal Foscam copy, but that'd be just one more in a million :)) .

    You could still run this through Chinavasion under warranty, but don't tell them you flashed your camera with a 3rd party fw of course.

    ReplyDelete
  30. @ Bubbah,

    Yes ;) . When he is working, its oke ;)

    I don`t now how i can send a POST without using webserver of the camera.

    I think i go use the JTAG and recover files from this post

    Rob

    ReplyDelete
  31. Hi Bubbah,

    What can be done to bring the camera back t life if the boot loader doesn't load in Hyperterminal? Does this mean the camera has died and is beyond repair?

    ReplyDelete
  32. @orionsm,
    that bootloader is the only way (afaik) to get some control over the camera when things go wrong. I recovered mine from a very bad flashing experience, so it looks like the bootloader is likely to survive to that.
    It took me some time to get a stable enough connection. Make sure that you connected all the wires properly (and crossed tx with rx's) and that your ttl module does 3.3v, not 5v like many. Don't give up too quickly.
    Good luck.

    ReplyDelete
  33. @Bubbah
    Thanks for the quick reply. I am using the USB to serial UART as you linked to on e-bay. Connecting a serial cable from the pc to a serial socket on the UART. Then using a hard wired connection as shown in the above diagrams and downloadable .PDF to the cam. I hope I have followed the instructions correctly? Once connected all I seem to get in Hyperterminal is a few random and strange letters & shapes.
    Thanks for your help and time on this.

    ReplyDelete
  34. @orionsm
    It took me quite a while to get a clean connection. I was about to use a solering iron (could still be an option for you) but I eventually manage to keep the 4 wires on the pcb by using some blu-tack putty. Quite a dirty job, but it worked. I too got scrambled letters at times, but that's probably when the wires a in contact with each other. Of course, don't forget to power the camera on only when you think the wires are in place and the terminal ready.

    ReplyDelete
  35. @Bubbah
    Thanks for all your time and knowledge on this one. I'm glad I wasn't the only one getting scrambled letters. The wires have been soldered onto the camera board whilst it's still attached to the camera. Would this pose a problem? I still can't believe I was foolish enough after all these years with PC's to attempt firmware over WIFI..... A lesson I should of known better.I'll persevre with the above instructions and hopefully get past the scambled letters

    ReplyDelete
  36. @orionsm,
    yep, that exactly how I bricked mine,and I could recover it, so there's still hope for you!

    ReplyDelete
  37. Hi Bubbah,

    Yesterday my camera got bricked, just wondering do I need to buy USB2UART interface and why I can not connect it directly to RS232 (COM1) on my computer?

    ReplyDelete
  38. @Anton,

    the specification of RS232 on your PC are not compatible with the TTL level in the camera. So you need a TTL level converter. Also make sure that you get a module that does 3.3v. If it's not specified, assume it's 5v and don't buy.

    A more concise explanation can be found on seattlerobotics.org

    ReplyDelete
  39. @Anton

    You can use max3232

    http://cgi.ebay.it/ws/eBayISAPI.dll?ViewItem&item=190287516150

    ReplyDelete
  40. My camera was not bricked, but i buy the interface posted by bubbah for testing purposes (http://cgi.ebay.ie/CP2102-USB-TTL-RS232-Serial-Port-Converter-Transceiver_W0QQitemZ350292739492QQcmdZViewItemQQptZUK_Computing_NetworkingCables_RL?hash=item518f1305a4) for about 9-10 euro with shiping to Spain and work great, i conect only 3 wires Tx,Rx and GND, because it drain power from usb. This interface is another gadget for me, and it is userful for comunicate with other devices because it convert USB to: db9Male, db9Female, Rs232 pinouts, ttl3.3v pinouts and ttl5v pinouts.

    ReplyDelete
  41. @Rob,

    Rob, Looks like I have similar issue to you. I have (had) Foscam clone, which I tried to upgrade over wifi (very stupid thing). Currently it turned into piece of brick, however what you can do - you can create simple html page with 5 rows inside put you ip address of your camera there and you can try to upload web gui. I can post this html here if it's OK. For me it does not work anyway, I'm waiting my adapter USB 2 UART 3.3v adapter to put firmware.

    ReplyDelete
  42. @Anton,

    Can you post it? Maybe it help me by updating.
    ( berichtenvoorrob@hotmail.com)
    I think the last option was the UART OPTION.

    Rob,

    ReplyDelete
  43. Hsa anyone attempted this using a USB conenction rather than a serial cable? If so could you please share your information as to how you conencted it all up?

    ReplyDelete
  44. @orionsm
    my operation described in this post was done using USB with item #160380454276 from eBay
    In a comment earlier here, I understand that villamany made a successful connection to his camera with this other item.
    It's quite plug 'n play, the drivers are generally installed automatically through Windows update and the virtual COM port appears. Just make sure it's set for 115200 bps 8N1 and no flow control.

    ReplyDelete
  45. yes, sureelectronics interface work fine with only 3 wires conected. Bubbah do you know any way for download/upload files to uClinux filesystem by serialPort? I want to modify the web interface files located on /home folder.

    ReplyDelete
  46. @Bubbah

    Great I'll give it a spin using the USB on the same item that Villamany used. Still trying to get past those random symbols & letters and I'll be there (hopefully). Lesson learned, NEVER flash over wifi again, however good the wifi connection is. :-D

    ReplyDelete
  47. @villamany,
    I've included the file W90N745 uClinux BSP User Manual.pdf with the recovery files but I didn't really look much into it. Maybe something of use in there?
    I was wondering if it could be instead possible to mount and tweak the linux.bin to enable telnetd, then flash it back to the camera. That would give some access to the files... but just thinking.

    ReplyDelete
  48. Spoke to Easynp they confirmed that hardware is identical to Foscam. Also they mention that Foscam is not a manufacturer of the camera, it's just a brand, or a company with it's own firmware.

    ReplyDelete
  49. @ Bubbah

    Many thanks for all your help on this, finally got the cam up and running after using the USB UART block. Used a USB cable and followed the supplied instructions, after finding the correct COM port on Hyperterminal and the step by step instructions finally performed the resurection. Couldn't of done it without you ...... Thanks again!

    ReplyDelete
  50. @orionsm
    I'm delighted it worked for you!

    @Anton
    I suspect the manufacturer could be netwave.cn, or at least they are at the origin of the firmwares used by Foscam.

    ReplyDelete
  51. @Rob
    Can't put html here, posted to you. It did not work for me, camera is dead, will use USB2UART method.

    ReplyDelete
  52. @Bubbah,

    Hi mate, Can you do a favour? Can you please go to your bootloader and type i. It will show WBL information (number, board information and processor name) of your camera board. I'm trying to use Foscam firmware, but it looks like my camera not compatible with Foscam. Just wondering do you have the same hardware like mine or not.
    PS. With this problem I can change my Oracle DBA position to Linux embedded software designer soon...

    ReplyDelete
  53. Guys, it will be very useful for all of us if you report WBL information, this is the compatibility question. How to report in bootloader just type i and post it here.

    ReplyDelete
  54. @Anton,
    I may not have the opportunity to re-open my camera soon but I saved the log of my recovery operation and some info can be extracted from there:
    W90N745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Jun 19 2006
    Memory Size is 0x800000 Bytes, Flash Size is 0x400000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #467
    19:24:28 CST 2007
    Processor: Winbond W90N745 revision 1
    Architecture: W90N745
    On node 0 totalpages: 2048
    zone(0): 0 pages.
    zone(1): 2048 pages.
    zone(2): 0 pages.
    Kernel command line: root=/dev/rom0 rw
    Calibrating delay loop... 39.83 BogoMIPS
    DVM Wireless LAN USB DVM_WL_U_2007_A Driver Ver. 1.2 upgrade in 2007-2-5

    Maybe your memory size is different ? Do you have an idea who's the maker of your camera (easynp, maygion, apexis, ...?)

    ReplyDelete
  55. Bubbah, I have this log:

    W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
    Memory Size is 0x1000000 Bytes, Flash Size is 0x200000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 00:A8:F1:00:5C:62
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Disabled
    BL buffer base : 0x00300000
    BL buffer size : 0x00100000
    Baud Rate : 115200
    USB Interface : Enabled
    Serial Number : 0xFFFFFFFF

    XMODEM can not send LINUX.zip and romfs.img :-(
    Look at photo:
    http://tinyurl.com/yjm3qfj
    and photo before delete img and linux from camera
    http://tinyurl.com/yb6lma2
    could you help me? My camera is broken :-(

    ReplyDelete
  56. @Komornick,
    Flash size if half of what I have on my Foscam. I guess you need a specific recovery file from the manufacturer of your camera. You'd probably also need a specific address to flash the files with the fx command.

    ReplyDelete
  57. Yeah, here is a trick I've got the same Memory Size is 0x1000000 Bytes, Flash Size is 0x200000 Bytes.
    0x1000000 = 16mb, 0x200000 = 2Mb, I think it gonna work, but we need to find correct memory addresses (and sizes) during flash operation.

    ReplyDelete
  58. Also very interesting, my bootloader says
    W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
    Memory Size is 0x1000000 Bytes, Flash Size is 0x200000 Bytes
    but linux during startup says
    Memory: 8MB = 8MB total
    Memory: 6688KB available (1120K code, 198K data, 40K init

    ReplyDelete
  59. @Anton
    when you will find right memory address please tell.
    I have the same problem like you :-(

    ReplyDelete
  60. @ Bubbah

    Is there an easy way to change the MAC code on the camera ? Having changed router from a Speedtouch ST585 to A Netgear DG834G the port fowarding will not work on two camera with the same MAC address.

    ReplyDelete
  61. @orionsm
    There's still the option of having one camera wired and the other one wireless, so 2 different MAC addresses are reported.
    Also, in the recovery package from the post above, I've included an auto-translation of a txt file with upgrade instructions, and at the end of it it says something like:
    "Press ESC to set MAC address
    set-mac0 00:11:22:33:55:66"
    So it seems possible but I'm not sure which Wi-fi or Ethernet address it changes and if it works at all.

    ReplyDelete
  62. Im geting general failure when i send file, any ideas??

    ReplyDelete
  63. Anton @ Komernick, may have the same problem as you did you get addresses

    W90N745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Jun 19 2006
    Memory Size is 0x800000 Bytes, Flash Size is 0x200000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    Any help and i would be very greatful.

    ReplyDelete
  64. Is it safe to say A winbond componet with 11.14.1.37 firmware is a clone ?, also wont take any set_misc.cgi? or will his only happen with updated firmware ?

    Tnx.

    ReplyDelete
  65. @Dragon
    set_misc.cgi has actually been implemented from 11.14.1.41. Your version is from April last year, but it's a good sign already if it responds to a command like get_params.cgi
    In doubt of the origin, contact Foscam with your DeviceID to find out.

    ReplyDelete
  66. Bubbah

    Thanks for you quick answer!!!
    I gave Foscam my Device ID. and pictures of box,all they could say is loojs like ours? :-) I can get command get_params.cgi maybe we will give it a shot???

    Tnx

    ReplyDelete
  67. "looks like ours"? strange answer. They're usually more specific.
    Just make sure to do the update through the Ethernet cable, not through wireless, and it should work fine.

    ReplyDelete
  68. Bubbah

    I updated firmware and web UI all went Great !!!

    Thank You for all your help and for having a great site to come to !!!

    ps:will send a cold one your way :-)

    Thanks again
    Dragon

    ReplyDelete
  69. I have a Foscam clone (Maygion/DX SKU29918) which has turned it's back on me. I tested the camera some time ago and probably must have changed the deafult user /password as the camera will not let me log on any longer. There is no error message, the logon screen just reappears.
    As this is an outdoor edition, there is no Reset button to be found. Anyone having hints/tips how to get past this?

    ReplyDelete
  70. @Biscaya:
    If this is the IP-603, I would assume that you have 3 ends to the cable coming from the camera: one is for the power, another is Ethernet and on the third one should be the reset button? This is the case for the Foscam FI8904W.

    ReplyDelete
  71. Bubbah, the Maygion manual is somewhat on the poor side. I was at the impression that the third cable was for motion detection alarm output. Will try to short the two ends of the third cable and see if the camera defaults back to factory settings

    ReplyDelete
  72. @Biscaya:
    don't you have a button on that third cable ?
    You can get the equivalent Foscam manual here, but I don't know how better it is.

    ReplyDelete
  73. The cables / connectors can be seen here: http://www.dealextreme.com/photogallery.dx/sku.29918~seQ.1. As you can see there is no button on the "third" cable, just a connector.

    ReplyDelete
  74. @Biscaya:
    they probably decided to assign this cable to the +5v alarm output instead. You'll probably find an unused connector on the camera pcb marked something like RST, that you could try to short (for 5 sec) to factory-reset the device.

    ReplyDelete
  75. Bubba, do you know what voltage there will be across the wires if this is where the reset button connects? (3.3V?)

    ReplyDelete
  76. I'd say, exept for the jtag connector which is 3.3v, the rest should read 5v.

    ReplyDelete
  77. Hm, I was hoping to be able to distinguish reset button wires from alarm output by voltage. I'll see if I can find a suitable resistor to short circuit the connector, just in case if wires are alarm output in stead of Reset.

    ReplyDelete
  78. Bubbah, I shorted the wires on the connector and the camera reset. Thanks for helping me out!
    BTW: the voltage across the wires is 2.2V

    ReplyDelete
  79. Hi,I'm Having trouble with the uart way after a bad Wi-Fi upgrade!!This how far I got so far,Deleted 6&7,Re FX'ed Recovery Files,Re Booted,and this is what I get in the Hyper terminal Window See Below thanks Erik


    W90N745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Jun 19 2006
    Memory Size is 0x800000 Bytes, Flash Size is 0x200000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 00:A8:F1:00:47:0A
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Enabled
    BL buffer base : 0x00300000
    BL buffer size : 0x00100000
    Baud Rate : 115200
    USB Interface : Enabled
    Serial Number : 0x00BC614E


    For help on the available commands type 'h'

    Press ESC to enter debug mode ......
    Cache enabled!
    Processing image 1 ...
    Processing image 2 ...
    Processing image 3 ...
    Processing image 4 ...
    Processing image 5 ...
    Processing image 6 ...
    Processing image 7 ...
    Unzip image 7 ...
    Executing image 7 ...
    Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #467 ¶þ 12ÔÂ 25
    19:24:28 CST 2007
    Processor: Winbond W90N745 revision 1
    Architecture: W90N745
    On node 0 totalpages: 2048
    zone(0): 0 pages.
    zone(1): 2048 pages.
    zone(2): 0 pages.
    Kernel command line: root=/dev/rom0 rw
    Calibrating delay loop... 39.83 BogoMIPS
    Memory: 8MB = 8MB total
    Memory: 6688KB available (1120K code, 198K data, 40K init)
    Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
    Inode cache hash table entries: 512 (order: 0, 4096 bytes)
    Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
    Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
    Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
    POSIX conformance testing by UNIFIX
    Linux NET4.0 for Linux 2.4
    Based upon Swansea University Computer Society NET3.039
    Initializing RT netlink socket
    Starting kswapd
    Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options en
    abled
    ttyS00 at 0xfff80000 (irq = 9) is a W90N745
    I2C Bus Driver has been installed successfully.
    Blkmem copyright 1998,1999 D. Jeff Dionne
    Blkmem copyright 1998 Kenneth Albanowski
    Blkmem 1 disk images:
    0: 7F0D0000-7F159FFF [VIRTUAL 7F0D0000-7F159FFF] (RO)
    AM29LV160DB Flash Detected
    01 eth0 initial ok!
    which:0
    PPP generic driver version 2.4.2
    Linux video capture interface: v1.00
    SCSI subsystem driver Revision: 1.00
    Winbond Audio Driver v1.0 Initialization successfully.
    usb.c: registered new driver hub
    add a static ohci host controller device
    : USB OHCI at membase 0xfff05000, IRQ 15
    hc_alloc_ohci
    usb-ohci.c: AMD756 erratum 4 workaround
    hc_reset
    usb.c: new USB bus registered, assigned bus number 1
    hub.c: USB hub found
    hub.c: 2 ports detected
    usb.c: registered new driver audio
    audio.c: v1.0.0:USB Audio Class driver
    usb.c: registered new driver serial
    usbserial.c: USB Serial Driver core v1.4
    Initializing USB Mass Storage driver...
    usb.c: registered new driver usb-storage
    USB Mass Storage support registered.
    dvm usb cam driver 0.0.0.0 by Maverick Gao in 2006-8-12
    usb.c: registered new driver dvm
    main_usb.c: DVM Wireless LAN USB DVM_WL_U_2007_A Driver 1.2 upgrade in 2007-2-5

    ReplyDelete
  80. usb.c: registered new driver DVM Wireless LAN USB DVM_WL_U_2007_A
    NET4: Linux TCP/IP 1.0 for NET4.0
    IP Protocols: ICMP, UDP, TCP
    IP: routing cache hash table of 512 buckets, 4Kbytes
    TCP: Hash tables configured (established 512 bind 1024)
    FAT: bogus logical sector size 51888
    FAT: bogus logical sector size 51888
    VFS: Mounted root (romfs filesystem) readonly.
    Freeing init memory: 40K
    BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
    BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
    Shell invoked to run file: /bin/init
    Command: mount -t proc none /proc
    Command: mount -t ramfs none /usr
    Command: mount -t ramfs none /swap
    Command: mount -t ramfs none /var/run
    Command: mount -t ramfs none /etc
    Command: mount -t ramfs none /flash
    Command: mount -t ramfs none /home
    Command: camera&
    [8]
    Command: sh
    no support

    Sash command shell (version 1.1.1)
    /> hub.c: connect-debounce failed, port 1 disabled
    new USB device :807dce04-7e8640
    hub.c: new USB device 1, assigned address 2
    dvm cmos successfully initialized
    dvm camera registered as video0
    new USB device :807b4204-7e8640
    hub.c: new USB device 2, assigned address 3
    DVM Wireless LAN USB DVM_WL_U_2007_A Driver Ver. 1.2 upgrade in 2007-2-5
    Unhandled fault: alignment exception (13) at 0x00000001
    fault-common.c(97): start_code=0x17f040, start_stack=0x2def98)
    Internal error: Oops: 0
    CPU: 0
    pc : [<0010c978>] lr : [<0006bfd8>] Not tainted
    sp : 007b1f80 ip : 00000000 fp : 007b1fac
    r10: 001b3aa4 r9 : 000000e1 r8 : 00012980
    r7 : 007b0000 r6 : 00000001 r5 : 00132808 r4 : 00000004
    r3 : 00132818 r2 : 00000000 r1 : 7f200000 r0 : 001c1890
    Flags: nZCv IRQs on FIQs on Mode SVC_32 Segment kernel
    Control: 0
    Process camera (pid: 8, stackpage=007b1000)
    Stack:
    007b1f60: 0006bfd8 0010c978 60000013 ffffff
    ff
    007b1f80: 00000004 00000004 00132808 00000001 007b0000 0006bfd8 7f200000 000000
    00
    007b1fa0: 00000000 007b1fb0 000127e0 0006bf80 7f200000 00017e80 7f200000 000000
    04
    007b1fc0: 001c1890 001c1890 7f200000 00000000 00000001 002defa4 00000001 000000
    00
    007b1fe0: 001b3aa4 002def04 00000004 002deef4 001839dc 0018187c 20000010 7f2000
    00
    Backtrace:
    Function entered at [<0006bf70>] from [<000127e0>]
    r5 = 00000000 r4 = 7F200000
    Code: 4282c004 4a00001b (e4913004) e4a03004 e1a0ca00

    ReplyDelete
  81. @pfauto
    You should check uClinux communities for the following entries:
    Unhandled fault: alignment exception (13) at 0x00000001
    fault-common.c(97): start_code=0x17f040, start_stack=0x2def98)
    Internal error: Oops: 0

    I see many returns via Google with similar entries, unfortunately didn't see anyone coming with a sort of solution yet.

    ReplyDelete
  82. Hello Bubbah ;o)

    Do you know where i can found many pictures of the FI8908w's PCB
    like that http://lh5.ggpht.com/_m16_YxsBJsw/SzMsY2aqfMI/AAAAAAAANbE/cLNGHmKnd-E/s1600/J2closeup.JPG ?

    I really want to understand how is connected de I/O PINS 1 & 2 ...

    Thanks
    Best Regards
    Stephane

    ReplyDelete
  83. Salut Paillassou,

    I've done a short description of how the RS485 connector could be used in my very first post on fi8908w. Maybe it will help ?
    I'll try to remember to take more pictures next time I open my camera.

    ReplyDelete
  84. @pfauto

    Are you pressing ESC quickly after you power on the camera?? I believe that you are NOT entering on the bootloader... Because, if you do not press ESC, the serial connection act as a console and displays the boot process.. and it seens that your romfs.bin is broken, causing the kernel oops that you are seening on the console. Read carrefully the serial upgrade instructions to check when to press ESC and enter the bootloader.

    Best Regards,
    Shadowbr

    ReplyDelete
  85. @Anton, @Komornick, @bdveit

    Can you try these addresses? These addresses are supposed to work with cameras with 2MB Flash (Foscam Clones)

    fx 7 linux.zip 0x7f020000 0x8000 -acxz
    fx 6 romfs.img 0x7f0e0000 0x7f0e0000 -a

    Let me know if it worked for you.

    Best Regards,
    Shadowbr

    ReplyDelete
  86. I had similar problem like Pfauto (same HW = same flash size = probably same clone), but erasing flash settings (by using "del b31" in debugging bootloader console) helped me to move next. Now the camera makes initial movement but after that the "myreboot" command is self executed and the board reboots in infinite loop - boot, initial movement, reboot.

    During initial boot the camera requests IP address from DHCP server and strarts responding to ping. Also the IP Camera Tool detect the camera with no Web GUI installed...but it takes some seconds and camera reboots.

    There is no difference between flashing the romfs image into Foscam advised address space and Fernando's advise.

    ReplyDelete
  87. The serial output:

    (OMITTED)
    Shell invoked to run file: /bin/init
    Command: mount -t proc none /proc
    Command: mount -t ramfs none /usr
    Command: mount -t ramfs none /swap
    Command: mount -t ramfs none /var/run
    Command: mount -t ramfs none /etc
    Command: mount -t ramfs none /flash
    Command: mount -t ramfs none /home
    Command: camera&
    [8]
    Command: sh
    no support

    Sash command shell (version 1.1.1)
    /> hub.c: connect-debounce failed, port 1 disabled
    new USB device :807dce04-7e8640
    hub.c: new USB device 1, assigned address 2
    dvm cmos successfully initialized
    dvm camera registered as video0

    Wait for auto-negotiation complete...ResetPhyChip Failed <= UNPLUGGED ETHERNET CABLE (NORMAL BEHAVIOUR)
    video0 opened
    1
    1
    1
    1
    1
    1
    set resolution 4
    set brightness 100
    set contrast 4
    set sharpness 3
    set mode 0
    unknown command
    __pthread_initial_thread_bos:2d4000
    manage pid:14 <= HERE CAMERA DO INITIAL MOVEMENT
    inet_sr.c INET_rinput 321
    action===1
    options==33
    inet_sr.c INET_setroute 75
    *args===255.255.255.255
    *args===netmask
    *args===eth0
    [27]
    myreboot <= COMMAND CAUSING REBOOT



    W90N745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Jun 19 2006
    Memory Size is 0x800000 Bytes, Flash Size is 0x200000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 00:A8:F1:00:42:1A
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Enabled
    BL buffer base : 0x00300000
    BL buffer size : 0x00100000
    Baud Rate : 115200
    USB Interface : Enabled
    Serial Number : 0xFFFFFFFF


    For help on the available commands type 'h'

    Press ESC to enter debug mode ......
    Cache enabled!
    Processing image 1 ...
    Processing image 2 ...
    Processing image 3 ...
    Processing image 4 ...
    Processing image 5 ...
    Processing image 6 ...
    Processing image 7 ...
    Unzip image 7 ...
    (OMITTED)

    ReplyDelete
  88. My guess is that the number in [] brackets before "myreboot" command is an error code and the camera process trying to recover using the board's new boot...

    ReplyDelete
  89. @IntEx

    The message [27] is normal. See above(snipet from a normal boot):
    (...)
    *args===255.255.255.255
    *args===netmask
    *args===eth0
    [27]
    ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
    ntpc.c: can not resolve ntpserver(time.nist.gov)'s ip
    (...)

    Probably this is from an internal process called by the "camera" app running in background (I can check it later).

    The message "myboot" is used during the firmware update process, after the firmware has been received and burned into flash; As far I understood, somehow your cam thinks it has been upgraded and is looping into this process.

    Have you tried to erase the linux.zip and romfs.img from flash and sending it again?

    I'm cooking some new firmware to this cam (with a better watchdog, telnet and busybox)... and I can send you another version of linux.zip and romfs.img if you want to try to see if it fix your cam.

    Best Regards,
    Shadowbr

    ReplyDelete
  90. Hello Fernando, thank you for your reply.

    I have tried to flash both files many times to standard and to different address spaces but with same result. I think that there is any flash parameter that causing the "camera" process to think that the state is not standard and it tries to reboot (as you said).

    I have been making firmwares for similar embedded platforms (RTL8181 and RTL8186 - wireless AP's) so I have some experience with compiling customised binaries with linux SDK's (with BusyBox) but I did not find any useful information about compiling the uClinux for this kind of devices (and absolutely no info about the "camera" process).

    I will very appreciate if you send me another precompiled linux.zip and romfs.img to try recover my camera. And I will be very pleased if you'll share your knowledge about this platform and its SDK for me to help you make the firmware better than it is ;-)

    My contact e-mail is intex@seznam.cz .

    I would like to publish the firmware to some public storage if I will successfully recover my camera with it.

    Thank you,
    IntEx

    ReplyDelete
  91. I'm having some really weired problems with my FI8908W camera from DX. The image it produced turned completely white at some point and adjusting brightness or contrast did not help. Rebooting (soft/cold) did not return the image. I decided to restore factory defaults via web GUI and now the camera works OK, except that it can no longer connect via WLAN using WPA/WPA2. Yes, I'm pretty certain the WLAN setting are correct, as I have tried about everything.

    My Fonera AP which used to work just fine with WPA & FI8908W now reports: "Fonera user.warn kernel: Replay Counter Different in pairwise msg 2 of 4-way handshake!" and no connection is established.

    So I just ordered a USB to serial UART in order to try if the procedure described here would do the trick and restore normal operation. Firmware upgrades or downgrades via the web GUI have no impact on the WLAN behavior.

    Has anyone else seen this? Do you have any suggestions?

    Regards,
    Mika

    ReplyDelete
  92. Hi fernando,
    Sorry for not replying sooner ,sometimes I have alot of play time and then not so much at times.
    Yes I have entered the bootLoader before and have deleted the img and re uploaded the recovery files as stated in the first post,I just posted my log of a normal boot to show someone my problems and codes ,but I'm not into uclinux at all so error codes I'm at a loss,looks like a address space alignment problem or something like that,there is no info on how a person determines the correct address apace to load the files for me to check against so I 'm just going by what was on this site ,this all happened after a wifi update,and before I upgraded everything was fine and I had the foscam user GUI and firmware identical to foscams I did buy this from a ebayer(world_brands)or something lilke that,but mine looked like a foscam to the TEE.After messing around one night I'd try too tim tyler it so I upgraded the firmware and now a Brick for the firePlace so here I am trying to fix the oops :)

    Erik

    ReplyDelete
  93. Hi,
    I have a FI8901W. I tried to update the firmware but since that it doesn't respond at all, not even reset.
    Where can I find the recovery files?

    Dave

    ReplyDelete
  94. Hi,
    I already had an USB to UART interface that I've used for another application. I connected to my FI8901W and it works, I can have the communication.
    My problem is now to find the recovery file for this camera. I have contacted Foscam, but I don't have any answer yet.

    ReplyDelete
  95. Could the #2 (Output) pin from the IP Cam's circuit board (seen in the image on top of this page) be used to recover the serial bit-stream from a command such as http://[ip_addres]/comm_write.cgi?port=&baud=&bytes=&data= as shown in the SDK ? This would be a very useful thing. This command works for me, however there is no serial (RS232) port/connector on the camera and therefore I cant recover this serial data.
    Thx. Joel

    ReplyDelete
  96. @David
    the recovery files are provided in the post above.

    ReplyDelete
  97. Sorry, I read again all the posts but I didn't see any recovery file for the FI8901W but only for the FI8908W.

    ReplyDelete
  98. @David
    Sorry David I mis-read the model. All i know about my recovery files is that they can work on FI8908W and FI8904W.
    the model FI8901W is particular as there are 2 hardware versions requiring different firmwares.You should contact Foscam directly with your DeviceID to get the appropriate files.

    ReplyDelete
  99. @Bubbah
    Foscam has been very helpful with me. I have exchange a lot of emails with Doris from their sales support who has sent me A LOT of different recovery files.
    You're right, there has been a lot of different models and mine is the Zaapa version. My camera was like dead, but thanks to your information I succeeded to reload a similar firmware to be able to update the right firmware and Web UI.
    Today I did the last update and now it works again. Thanks to your Blog and big thanks to Foscam!

    Fin_David

    ReplyDelete
  100. Hi, here a easy way to modify the mac address, dont need cost one cent


    not ad
    http://www.sosocool.com/?p=21

    ReplyDelete
  101. have a similar problem with analog foscam

    W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Dec 10 2009
    Memory Size is 0x1000000 Bytes, Flash Size is 0x200000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 0E:F2:B3:DC:03:BB
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Enabled
    CACHE : Enabled
    BL buffer size : 0x00100000
    Baud Rate : -1
    USB Interface : Disabled
    Serial Number : 0xFFFFFFFF


    For help on the available commands type 'h'

    Press ESC to enter debug mode

    bootloader > del 6
    ERROR: Image 6 is not existed

    bootloader > del 7
    ERROR: Image 7 is not existed

    bootloader > fx 6 romfs.img 0x7f0d0000 0x7f0d0000 -a
    Waiting for download
    Press Ctrl-x to cancel ...
    C
    Flash programming ...
    .........ERROR: Write failed.

    Please give if a solution is found. panason2008@yandex.ru

    ReplyDelete
  102. Hi!

    Glad to find out that my foscam clone is not completely useless yet!
    I bricked it trying to updat over WiFi, grrrr...

    Now, when I connect it, the IP Cam tool does see it after a few seconds, and it says 'wrong subnet mask'. By right clicking, I can change that quickly, just before the camera resets itself. Then, I shows up again, saying that the UI is not present. I can try to update, but it gets to about 75% as it resets itself again. This resetting can go on for hours!
    Is there any other option than your rescue method?

    Thanks!
    Regards,

    Marcel

    ReplyDelete
  103. W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
    Memory Size is 0x1000000 Bytes, Flash Size is 0x200000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 00:00:00:00:00:01
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Disabled
    BL buffer base : 0x00300000
    BL buffer size : 0x00100000
    Baud Rate : 115200
    USB Interface : Enabled
    Serial Number : 0x00000000

    yes another clone ..tried all known posted address upgrade keeps failling i can not load the files mentioned above i tried
    fx 7 linux.zip 0x7f020000 0x8000 -acxz
    Description: upload the linux.zip file

    fx 6 romfs.img 0x7f0d0000 0x7f0d0000 -a
    Description: upload the romfs.img file
    After confirmation will be prompted to choose to send the file - Agreement election Xmodem - Send

    del b31 Description

    also tried

    fx 7 linux.zip 0x7f020000 0x8000 -acxz
    fx 6 romfs.img 0x7f0e0000 0x7f0e0000 -a


    any suggestions .. ido have 3 more camers tha work fine i was thinking if i can copy data from the other ones.
    Cameras are black no name no stickers

    ReplyDelete
  104. I too am having IntEx's same issue with the constant reboots...

    If you ever created the enw linux.zip and romfs.img please send me a copy so I can see if they fix my issue.

    tacob71@yahoo.com

    Thanks!!

    Wait for auto-negotiation complete...OK
    100MB - FULL
    video0 opened
    1
    1
    1
    1
    1
    1
    set resolution 4
    set brightness 100
    set contrast 4
    set sharpness 3
    set mode 0
    unknown command
    __pthread_initial_thread_bos:2d4000
    manage pid:14
    2
    2
    2
    2
    2
    2
    inet_sr.c INET_rinput 321
    action===1
    options==33
    inet_sr.c INET_setroute 75
    *args===255.255.255.255
    *args===netmask
    *args===eth0
    [27]
    myreboot



    W90N745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Jun 19 2006
    Memory Size is 0x800000 Bytes, Flash Size is 0x200000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 00:60:6E:5E:9F:E0
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Enabled
    BL buffer base : 0x00300000
    BL buffer size : 0x00100000
    Baud Rate : -1
    USB Interface : Disabled
    Serial Number : 0xFFFFFFFF

    ReplyDelete
  105. I've been too brave and flashed my Foscam clone with Foscam firmware...got a brick..
    I flashed the FW, never got to flash the web UI.
    It comes up in the IP camera Tool for a few seconds, and complains that I need to flash the webui, but I can never finish the flash as the cam resets before it can finish.

    Photos of the cam and the PCB:
    http://www.imagebam.com/gallery/bae3a5053b91854549e8c1bd223e006c/

    ReplyDelete
  106. I should also add that the original firmware had a version number 3.23.2.4 or very similar.
    I have no idea how or where to get a compatible firmware...
    Maybe one of you guys who have clones could contribute.

    To sum it up: flashed FW, now turns on for 3-4sec, reboots, turns on and reboots.
    Visible in IP cam tool at moments.

    I have a Max3232 chip (needed it for flashing my BT GPS) I could use to flash it through jtag but need help on how to wire it (have serial ports and a usb->serial dongle).

    ReplyDelete
  107. I have the firmware and webui for es-ip607 but i dont how to put in my bricked camera via jtag no body can help me? its a fosscam clone with board identified by es-ip607

    ReplyDelete
  108. Zazpi:
    I saw a demo of interface in es-ip607 and it looks same as mine before flashing.

    Could you, please, upload that firmware somewhere on the web?

    Thank you!

    ReplyDelete
  109. Zazpi:
    Could you please post a screenshot with the interface? Also a dump pf the firmware would be much appreciated.
    Thanks!

    ReplyDelete
  110. here is the firm. http://rapidshare.com/files/380407514/IP607.rar.html
    Anybody can help me to make a tutorial for recover the ip camera?because a have a dead camera.....

    ReplyDelete
  111. This comment has been removed by the author.

    ReplyDelete
  112. Zazpi:
    I have extracted recovery files from your firmware, they are here:
    http://rapidshare.com/files/380841211/IP607-recovery.zip.html

    Use recovery steps on the top of this page to make it work ;-)

    Unfortunately this firmware is not for wireless cameras so it does not work on mine :-(

    ReplyDelete
  113. Hi!

    I have contact with Eye Sight for ES Ip607 ( clone ) and they have send me this
    firmware
    http://rapidshare.com/files/380866906/IP607ZC0301_V1.2_Updated_software090905.rar

    Can you extract recovery files from this firmware ?

    Thank you!

    ReplyDelete
  114. This is exact the same firmware as Zazpi sent, so use the same files as I've posted before.

    ReplyDelete
  115. Hi,
    I looked at he firmware zappi posted and the version number don't correlate with mine.
    Could someone please take a look at the photos I posted a few posts before and help me identify the camera?
    Thanks

    ReplyDelete
  116. Hi,
    I try to upload this files with :
    fx 6 romfs.img 0x7f0d0000 0x7f0d0000 -a
    fx 7 linux.zip 0x7f020000 0x8000 -acxz
    and i take this error :Flash programming ...
    ERROR: Write failed.
    When i upload with :
    ft 6 romfs.zip 0x7F0C0000 0x700000 –acz
    or
    fx 6 romfs.img 0x7f0e0000 0x7f0e0000 -a

    upload it is ok but on boot i take this error :

    IP: routing cache hash table of 512 buckets, 4Kbytes
    TCP: Hash tables configured (established 512 bind 1024)
    Blkmem: bad access: block=0, count=2 (pos=400, len=0)
    end_request: I/O error, dev 1f:00 (Blkmem), sector 0
    romfs: unable to read superblock
    Kernel panic: VFS: Unable to mount root fs on 1f:00


    I have upload log file: http://rapidshare.com/files/381178973/Log.txt

    ReplyDelete
  117. 1. try to delete user flash memory area by "del all" (don't worry, bootloader would stay intact)
    2. upload linux.zip by "fx 7 linux.zip 0x7f020000 0x8000 -acxz"
    3. upload romfs.img (always upload unzipped) by "fx 6 romfs.img 0x7f0d0000 0x7f0d0000 -a"

    If the write error message at romfs.img uploading appear, try to use another adress like "0x7f0e0000".


    I hope that this help you to make it work again.

    IntEx

    ReplyDelete
  118. Hi IntEx ,
    Thank you for you help but i take the same error :

    romfs: unable to read superblock
    Kernel panic: VFS: Unable to mount root fs on 1f:00

    Thanks

    ReplyDelete
  119. Hi
    I have the same problem with this cam:
    http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=220579553310

    boot errors:
    FAT: unable to read boot sector
    Blkmem: bad access: block=0, count=1 (pos=200, len=0)
    end_request: I/O error, dev 1f:00 (Blkmem), sector 0
    FAT: unable to read boot sector
    Blkmem: bad access: block=0, count=2 (pos=400, len=0)
    end_request: I/O error, dev 1f:00 (Blkmem), sector 0
    romfs: unable to read superblock
    Kernel panic: VFS: Unable to mount root fs on 1f:00

    Any ideas?
    Thanks
    Martin

    ReplyDelete
  120. Hello Bubbah ;o)

    Many PCB pictures of my WHITE FI8908W FOSCAM IP camera
    http://picasaweb.google.fr/paillassou/FI8908WPCB#

    Best Regards

    ReplyDelete
  121. Hi ,

    I have finally make IP607 (clone) work again .
    I have upload the recovery files :http://rapidshare.com/files/384315178/IP607FINAL.zip

    1. upload linux.zip by "fx 7 linux.zip 0x7f020000 0x8000 -acxz"
    2. upload romfs.img by "fx 6 romfs.img 0x7f0e0000 0x7f0e0000 -a"
    3. boot the camera and update Web Ui ( from IP camera tool)

    I hope that this help you to make it work again.

    For the recovery files I will like to thank Gadgetvictims and IntEx
    and
    http://www.computersolutions.cn/blog/2010/05/ip-cam-hacking-%E2%80%93-pt6/ for the working LINUX.zip

    Admin

    ReplyDelete
  122. @ IntEx

    Hello ,
    How do you extract the romfs.bin and the linux.zip from the original firmware?
    i try to do the same for easynp

    thanks

    ReplyDelete
  123. @all
    I Managed to split up the firmware for easynp
    files can be found here:
    http://www.dolkfm.tk/webcamrecovery/click.php?id=1

    ReplyDelete
  124. @ Jasper

    Jasper, you are great!
    The Easynp firmware works in my camera!

    Thank you!!

    IntEx

    ReplyDelete
  125. I Found this how to extract the linux.zip and the romfs.img

    http://www.computersolutions.cn/blog/


    Melksleper

    ReplyDelete
  126. @ all

    Hi ,

    After i change lan dns server camera reboot and the i take this error:

    Processing image 1 ...
    Processing image 2 ...
    Processing image 3 ...
    Processing image 4 ...
    Processing image 5 ...
    Processing image 6 ...
    Processing image 7 ...
    Unzip image 7 ...

    ERROR: unzip failed! -3

    I have upload the linux.zip and romfs.img again but same error
    I have del -all but again the same error.

    Any idea ?

    Thanks

    ReplyDelete
  127. for Jasper:
    I have two easynp FS-613A-M136 cameras with different version of firmware:
    1.firmware 4.23.2.5 and webUI 4.3.3.39
    2.firmware 4.11.2.5 and webUI 4.3.3.38
    I want to save somehow the firmware 4.23.2.5 firmware from the first camera and flash to second camera.I already have webUI 4.3.3.39 from your link http://www.dolkfm.tk/webcamrecovery/click.php?id=1 .is there a easy way to extract the firmware :) ? Or ,do you have the 4.23.2.5 firmware?I don't know if the 4.3.3.39 webUI works with 4,11,2,5 firmware.Pls help...

    ReplyDelete
  128. Int?????
    I Guess we have the same cams from your previous reply and I agree same cams ,my question what address spaces did you use.
    Thanks Erik

    ReplyDelete
  129. Hi all,
    got my cam back running after using easynp files from intex website,only thing is this isn't the firmware and webUI that was on the cam,seems all the cams are the same maybe one MFG making them as thought of by others as well ,My UI was identical to foscams except it was on the opposite side as foscams,other than that looked identical,now this easynp ui is nothing like what I had befor it's red with a slide out window for the pic.anyone have any clue to what is going on here??
    Also to get this to work I had to use a different linux.zip from lawerences site to make it boot ,it kept locking at image 7 for a while then after the new image it booted,although it takes longer after image 6 gets processed then to 7 is where it takes a while,but does boot.
    Thanks Erik

    ReplyDelete
  130. @ vlad,
    This is the only firmware i've got from easynp. I think it would be possible to download the romfs and linux.zip from your working camera. You shoud connect it the same way that's described on the top of this tread. (i used an old nokia data cable from a cel phone). If you manage to receive the files from the camera.. i would like to try them in my cam too.. and update the download link with this newer version.
    My cam now runs on fw 4.11.2.15 and webui 4.3.3.39

    ReplyDelete
  131. @ pfauto

    I have used the 0x7f0e0000 instead of 0x7f0d0000, because EasyNP's linux.zip is little bigger than Foscam's, so here advised address space (7f0d0) was used by that.


    My advise to flash with EasyNP firmware:

    1.) "del -all" (erase whole flash except bootloader)
    2.) "fx 7 linux.zip" 0x7f020000 0x8000 -acxz" (flash uClinux OS)
    3.) "fx 6 romfs.img 0x7f0e0000 0x7f0e0000 -a" (flash ROM file system)
    4.) After successfull boot use IP Camera software supplied with EasyNP
    firmware (important!) to flash WebUI

    IntEx

    ReplyDelete
  132. @ intex

    I wonder how I had a foscam looking web UI that looked Identical,or is there another oem with a FosCam look A Like Web Ui ,That I might of had installed when I got the cam,Which will also take the EasyNP Files??

    Thanks Erik

    ReplyDelete
  133. @ Intex

    Also forgot to mention in last post,I wonder why I had to use larwerences Linux.zip inplace of the Easynp,also now I don't have sound or acess to the mic,it says no such feature on the cam from within the web UI?

    Thanks Erik

    ReplyDelete
  134. @all
    I've updated my post above with the recovery package from Admin for the IP607 clone. I don't know if the same is usable for EasyNP (It seems to share the same flashing addresses as the IP607 but I don't know for the firmware files).
    Would someone (Intex?, pfauto?,...) make a specific ready-to-use package?
    Also added a "Recommended readings..." section with some remarkable links mentioned in the comments.
    Thanks guys!

    ReplyDelete
  135. A "ready-to-use" package was posted by Jasper ( http://www.dolkfm.tk/webcamrecovery/click.php?id=1 ) or I have uploaded it to my server at http://ipcam.intexcz.net .

    How to recover I have written before.

    ReplyDelete
  136. It worked with fw 4.11.2.15 and webui 4.3.3.39. Tnx a lot.

    ReplyDelete
  137. Hi!

    I managed to upload both files and it seems succesful, but the cam still keeps resetting itself before I can update the UI, or even ajust the IP settings.

    i think I have read about anything available, but maybe I have missed something? It is a clone from Chinavasion.

    Any help is appreciated.

    ReplyDelete
  138. @Lightshirt

    I had same issue with my camera (tried a lot of different firmwares with no success until I tried to flash EasyNP's firmware).

    Try it - http://ipcam.intexcz.net ;-)

    ReplyDelete
  139. @ IntEx

    I just tried it. Unfortunately no succes!
    It keeps rebooting. Somehow the camera encounters the 'myreboot'.

    This is the end of the sequence:
    ----------------------
    Wait for auto-negotiation complete...ResetPhyChip Failed
    video0 opened
    1
    1
    1
    1
    1
    1
    set resolution 4
    set brightness 100
    set contrast 4
    set sharpness 3
    set mode 0
    unknown command
    __pthread_initial_thread_bos:354000
    manage pid:16
    audio_dev.state not AU_STATE_RECORDING
    wb_audio_start_record
    inet_sr.c INET_rinput 321
    action===1
    options==33
    inet_sr.c INET_setroute 75
    *args===255.255.255.255
    *args===netmask
    *args===eth0
    [28]
    myreboot

    ------------------------

    And it reboots....
    Are there any options or is this camera lost maybe?

    ReplyDelete
  140. @Lightshirt

    Yes, I had same problem (solved with EasyNP's firmware).

    Camera's HW does not correspond with "camera"'s requests, so it tries to "recover" by initiating device reboot.

    The only thing that you can do is trying different firmwares and hope that you will find suitable one :-(

    So try another firmware from my server...

    IntEx

    ReplyDelete
  141. Hi, I'm a first time poster and was led to this site from a link on the deal extreme user comments.

    I have also managed to screw up my camera, but I'm not sure if it's totally bricked or just partially.

    My old firmware was:
    Device Firmware Version 11.14.1.34
    Device Embeded Web UI Version 2.4.8.9

    I tried to update to the latest firmware using the camera's web interface. The Firmware went on - but I could no longer access the camera through the web interface to complete the webUI upgrade.

    The device is up, it's got an IP address and I can access it using the direct CGI commands. I can also stream video and audio using the CGI.

    http://192.168.1.200/get_params.cgi shows:

    var id='000DC5D047D9';
    var sys_ver='11.14.2.17';
    var app_ver='0.0.0.0';

    It looks like the system firmware was upgraded but in the process it messed up the webUI.

    I want to try and load the webUI using the CGI post method, but don't know how to do. Have read through the documentation but can't find an example.

    Would appreciate any help or pointers. Don't want to go down the JTAG route if I can upgrade/load the WebUI using some other method.

    Thanks in advance.

    ReplyDelete
  142. @Uplitaar
    Is your camera still detected by the IP Camera Tool ?
    You could then try upgrading the webui using that software.

    ReplyDelete
  143. Bubbah, thanks very much for your help. Upgrading the webUI using the IP Camera Tool worked!

    I did try doing it yesterday aswell, except at that time I was getting an error message saying image refused by camera or words to that effect. But I did have the browser running yesterday at the same time. Whatever it was a reboot and a fresh try worked.

    Thanks for your help!

    ReplyDelete
  144. Thanks Bubbah ;)
    it works fine for me for an other clone.
    My clone camera has a "LOW" white LED instead of the normal green LED
    MODEL: APM-J011-WS
    http://www.apexis.com.cn/Products_List.asp?id=1385
    I've used your tools-package with the FI8908W recovery files => OK.
    IPCamTool has found the clone over the LAN
    I've upload, with IPCamTool, into the Winbond CHIP,
    the correct fw files from the manufacter:
    http://www.apexis.com.cn/dow.asp
    => J011_Upgrade System Firmware.rar
    => Upgrade Web UI Firmware.rar
    There are 3 versions into the rar package corresponding
    to the 3 versions of PCB of clone, so be careful...
    GOOD ;)
    Bye

    ReplyDelete
  145. @Paillassou,
    nice one Paillassou. I think I'd have to start building some sort of database with all these cameras and their respective recovery procedure & files. Might be a delicate and lengthy process though.
    So far I have EasyNP, EyeSight, Heden, Maygion,...

    ReplyDelete
  146. Yes Bubbah ;)
    but [MODE JOKE "ON"]
    I think it will be very difficult to do, because creating "clones" in China
    is the same as making wine in FRANCE;)
    MODE JOKE "OFF"]

    IntEx has done a very great works, thanks to him.

    => http://ipcam.intexcz.net/

    ReplyDelete
  147. I have same problem as Uplitaar (var app_ver='0.0.0.0') except IP Camera Tool does not detect the camera. Having trouble figuring out to reinstall the WebUI firmware using the "upgrade_htmls.cgi". I understand "http://192.168.1.104/upgrade_htmls.cgi?next_url=" it is what goes after "url=" I cannot figure out.
    Something like...
    "http://192.168.1.102/upgrade_htmls.cgi?next_url=\Documents and Settings\AAA\My Documents\Foscam\WEBUI\2.4.8.14.bin"
    Thank you in advance for any help.

    ReplyDelete
  148. I'm having the same problem as Dan and Uplitaar. After upgrading my Cam i can no longer access the UI and it errors me with a 404.

    Accessing the cam by CGI works fine, the get_params.cgi shows the following Firmware and web UI:
    var sys_ver='11.14.2.17';
    var app_ver='0.0.0.0';

    Accessing the cam with the IP Cam Tool works but when i try to upload a new UI version i get the following error: Error File of web UI. And when i try to upload an older Firmware or UI it says: Refused by camera!

    Seeing i also have very little experiance with CGI commands i was hoping someone could tell Dan and me what the upgrade_htmls.cgi command should look like or how to use it...

    Thanks in advance!

    FB20k

    ReplyDelete
  149. I have a clone wich I think it is an Easynp but its the B-series it seems. Thats what the manual says and everything I can find seems to reflect that. Does anyone have the firmware for this, the fosscam firmare is the similar as I at least get a small pan and tilt action but then it just reboots again. I've tried all other firmware with no luck.

    ReplyDelete
  150. Try with this version:
    http://www.webcam4.eu/wp-content/uploads/download/IP%20cam%20tools_7.5.32.zip

    ReplyDelete
  151. I would try it but I need the files sperated into the linu.zip and rom file as I have to install them through the serial interface.

    ReplyDelete
  152. I would like to try the Serial method of accessing the camera but cannot seem to find the serial update document stated in the above article. Please point to the right direction to get the document. I am not sure if the document name written in bold is supposed to be a link but it doesn't work for me.

    ReplyDelete
  153. @faisala
    the links are on the line:
    - the Recovery files - Mirror (FileFactory) - They contain ...

    I've checked both links and they're still valid.
    The file factory mirror is: http://www.filefactory.com/file/a1148b2/n/FI8908W_Recovery.zip

    ReplyDelete
  154. Here is what Foscam had to say about the WebUI firmware problem...

    "I have forwarded this to our software engineers,they said it is impossible to use cgi strings to update firmware in rencent software.
    If Web UI is lost,pls dbclik the error information appeared in the IP Camera Tool and update the web UI."

    Guess they missed the part in which I said IP Camera does not recognize the camera at all, so no ip address populates the list.

    ReplyDelete
  155. I have received another two cameras (real Foscam) for my friend and I must say, that Foscam's Web UI is total crap in comparison with EasyNP's UI.

    It has only ActiveX and Push interface (instead of additional JavaScript interface for mobile phones in EasyNP's UI) with stupid method of authorization (need to re-login after page refresh instead of browser authentication)...furthermore you cannot define in Foscam's UI the speed of movement as in EasyNP's FW.

    So I am working on porting EasyNP's Web UI into Foscam cameras for the best experience of these great gadgets ;-) (but it is relatively problematic, because UI is dependent on the "camera" process of the FW which is not inter-compatible)

    IntEx

    ReplyDelete
  156. Does anyone have any clue what my cam is. Like I said I get pan and tilt for a couple seconds with the Fosscam firmware but it reboots with the code [27] and then Myreboot. I got it on Ebay all I know is it says B-series I believe it's and EasyNP but it doesn't work with the EasyNP firmware.

    W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
    Memory Size is 0×1000000 Bytes, Flash Size is 0×200000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 – 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 00:30:10:C1:D0:39
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Enabled
    BL buffer base : 0×00300000
    BL buffer size : 0×00100000
    Baud Rate : -1
    USB Interface : Disabled
    Serial Number : 0xFFFFFFFF

    For help on the available commands type ‘h’

    Press ESC to enter debug mode …

    ReplyDelete
  157. Identify the cam http://picasaweb.google.ru/shel32/NoNameIpCam#5478551678508500322. Tried all the firmware, none is not suitable.
    All but sees only 8 megabytes of RAM should be 16 megabytes.
    CAMHED02IPW sees 16 megabytes but crashes with an error: (
    Before rebooting the relay clicks.

    W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
    Memory Size is 0x1000000 Bytes, Flash Size is 0x200000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 00:A8:F0:00:23:0F
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Enabled
    BL buffer base : 0x00300000
    BL buffer size : 0x00100000
    Baud Rate : -1
    USB Interface : Disabled
    Serial Number : 0xFFFFFFFF


    For help on the available commands type 'h'

    ReplyDelete
  158. http://picasaweb.google.ru/shel32/NoNameIpCam#

    ReplyDelete
  159. Very goooooood !!Thanks a lot !!

    ReplyDelete
  160. Hello everyone,
    could someone tell me what IPcamera clone
    has this interface
    http://3.bp.blogspot.com/_m16_YxsBJsw/Spz7r7ZV-zI/AAAAAAAAKc8/tIOyVl8GT8g/s1600-h/notFoscam2.jpg
    and what is the manufacturer?
    THANK

    ReplyDelete
  161. Salut BUBBAH ;)

    tiens, si tu veux partager: je suis sûr que cela pourra aider certains

    http://www.dailymotion.com/video/xdnsq3_ip-camera-recovery-foscam-fi8908w-r_tech

    @+

    ReplyDelete
  162. Salut paillassou,
    merci, j'ai mis à jour le post avec ta vidéo
    a+

    ReplyDelete
  163. Recovery files for Foscam FI8904W? Anyone?

    Tried to upgrade the FW with Wi-Fi and now i cannot connect to the camera. LAN led i on all the time and IP Camera Tools shows nothing... :(

    ReplyDelete
  164. @Tare
    accoridng to Foscam, you can use the same recovery files for FI8908W and FI8904W. Once recovered.
    You'll just have to flash the latest FI8904W firmware the normal way.

    ReplyDelete
  165. petites infos sympas ;)

    http://forum.hardware.fr/hfr/HardwarePeripheriques/Webcam/fi8908w-vision-nocturne-sujet_50586_53.htm#t610005

    Bye Bubbah

    ReplyDelete
  166. merci paillassou, très sympa la bidouille pour contrôler les LED avec le relais!

    ReplyDelete
  167. To aurilius, Dan, and others who have experienced the problem where the system firmware is successfully updated, the Web UI is wiped out in the process, and the IPCamera tool no longer finds the camera on the network... I found a solution after the same thing happened when I flashed the new 8908w I got today.

    First, confirm you have this problem by accessing http://YOUR_CAM_IP/get_params.cgi (replace YOUR_CAM_IP with the IP address of your camera). You should see something like this in the report:
    var sys_ver='11.14.2.17';
    var app_ver='0.0.0.0';
    If you do not receive any response at all, then the below fix is probably not going to work. Double check the IP address you used. Otherwise, if app_ver reads 0 as above, then that is a clear indication that (somehow) the Web UI got wiped out and needs to be restored. Hopefully the fix below will work for you as it just did for me...

    The fix (note: Foscam was mistaken that it is "impossible" to use cgi to update firmware):
    1) Download curl (http://curl.haxx.se) for your OS. I'm running Windows, so I used this one: http://www.gknw.net/mirror/curl/win32/curl-7.21.0-ssl-sspi-zlib-static-bin-w32.zip.
    2) Extract the curl .zip file to the same directory as the Foscam firmware files that you downloaded and used to flash your camera.
    3) Open a command prompt and navigate to the directory containing curl and the firmware files.
    4) Type the following command (be sure to substitute your information as appropriate):

    curl -u admin -F file=@2.4.8.14.bin YOUR_CAM_IP/upgrade_htmls.cgi

    Obviously, you must replace the username "admin" with your own if you have changed the default. You will be prompted for your password when you enter the command. Also, be sure to replace "2.4.8.14.bin" with the filename of the Web UI firmware included with the version you downloaded.

    If everything goes well, the result of the above command will be a simple "ok." You can verify that it worked by checking to see if the "get_params.cgi" command now reports a non-zero "app_ver" and by trying to access the Web UI of your camera. With any luck, you will be back in business!

    ReplyDelete
  168. Can't believe they're doing this 640x480 video using ARM7 without any codec.

    Also, this ARM7 does have MAC built-in, so they only need Davicon's PHY but why do they need Trxcom's Ethernet module still?

    which wifi-chip is used? I saw VIA in the picture and why is that...

    ReplyDelete
  169. Can someone help me, I have a clone cam that I think I may have finally gotten the firmware for as the ones already listed wouldn't work with mine. Can someone email me a cyberm1477@aol.com as I need someone to extract the firmware files so I can upload them via serial link.

    ReplyDelete
  170. How to know if the bootloader in my 607 is ok !? I tried all solder combinations with my 3.3 ttl usb and no luck at all =[

    ReplyDelete
  171. W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Dec 15 2009
    Memory Size is 0x800000 Bytes, Flash Size is 0x400000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 00:60:6E:8C:1B:E3
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Enabled
    BL buffer base : 0x00300000
    BL buffer size : 0x00100000
    Baud Rate : 115200
    USB Interface : Enabled
    Serial Number : 0xFFFFFFFF

    My PCB is saying IPCAM_PT2_V3.31f_sc

    Any clue which adresses I should use?
    Everytime I try to upload a file via xmodem the upload is aborted. Why???

    ReplyDelete
  172. OMG, after reading the entire comment list and developing my soldering skills :D ! i tested EVERY linux.zip and romfs.img of Intex site (Thank you so much for your efforts!) Finally, i found that my camera is a CAMHED02IPW ! I sucessfully restored the camera ! Thanks to Bubba, Intex and all other members involved =D !

    PS. To those who have problems sending the linux.zip and romfs.img, try to switch the fx 6 for the fx 7 instead, linux and then romfs or romfs and then linux.

    ReplyDelete
  173. Good Morning
    Somebody can verify these two devices and to verify if they communicate with the Foscam?
    http://cgi.ebay.com/USB-2-0-UART-TTL-6PIN-Module-Serial-Converter-CP2102-/180528593122?cmd=ViewItem&pt=LH_DefaultDomain_2&hash=item2a0857b8e2
    http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=110423840510&ssPageName=ADME:X:AAQ:US:1123
    Thanks in advance.

    ReplyDelete
  174. @aoperusso
    I think they both do. But I personally have and recommend the second one (CP1202)

    ReplyDelete
  175. Hello! This is my first post in this blog. A month ago I bought three cameras W90P745 model (from Chinavasion.) Everything worked perfectly until one day a camera stopped working.
    The camera turned on, but the green light on the front is not lit, either with the cable or wifi.
    I decided to buy the cable and try to come back to life using your method.

    I can connect successfully to the camera, I have completed the first two steps:

    del 7
    del 6

    But both the rise of file romfs.img linux.zip as 30% I get a message "General failure" (I select the file and put Xmodem protocol.
    That may be happening?

    ReplyDelete
  176. @Jose,
    did you download the recovery files suitable for your IP607 (EyeSight)? (See the paragraph for non-Foscam models)
    Your ipcamera uses a smaller firmware and can't hold the Foscam files. Also you need to adjust the fx commands as per the provided help.txt

    btw, please don't double-post

    ReplyDelete
  177. Bubbah sorry I didn't know where to post. And yes I downloaded the recovery package (IP607FINAL.zip) of Eyesight, which includes a help file that is for expecifica clone FOSTCAM, IP607 model.

    755KB is the size linux.zip

    This is the message log

    W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Dec 10 2009
    Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 00:0C:5D:75:14:83
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Enabled
    BL buffer base : 0x00300000
    BL buffer size : 0x00100000
    Baud Rate : 115200
    USB Interface : Enabled
    Serial Number : 0xFFFFFFFF


    For help on the available commands type 'h'

    Press ESC to enter debug mode ....

    bootloader > del 7
    ERROR: Image 7 is not existed

    bootloader > del 6
    ERROR: Image 6 is not existed

    bootloader > fx 7 linux.zip 0x7f020000 0x8000 -acxz
    Waiting for download
    Press Ctrl-x to cancel ...
    C
    Download error!

    bootloader > BB0BB0

    The Upload screen finish at 30% and sometimes don't work. I try with HyperTerminal and Putty (this I don't know how upload file).

    Any ideas? Thanks!

    ReplyDelete
  178. @Jose,
    I don't have this model so my experience with it is limited, but I see these two hackers web sites where you may get some help:
    http://www.computersolutions.cn/blog/tag/foscam/
    http://irishjesus.wordpress.com/2010/03/30/hacking-the-foscam-fi8908w/
    There are several ref to W90P745. I hope they can help you,
    good luck

    ReplyDelete
  179. @John - You are an absolute legend - thankyou thankyou thankyou :D

    ReplyDelete
  180. Friend buddab, am of the brasil and I am not understanding the part of doing the cable.
    Does that cable have linked port to be COM 1> usb to serial uart> Ipcam???.
    And in that sequence???

    ReplyDelete
  181. @sanbruce
    You need one usb-to-uart interface as presented in the article. The usb side goes to the PC usb port where it will create a "virtual serial port".
    With the other side, you need to connect wires from TX,RX and GND to the J2 port on the camera board (you need to open it to see this). The 3.3 power is facultative since your camera has a power source already.
    Only for illustration purpose, you can see a bit more pictures in this other article

    ReplyDelete
  182. Bubbah, I am not understanding as doing the cable. If you can happen images of the complete cable it would be thankful.

    ReplyDelete
  183. @sanbruce
    have you check that other article I indicated earlier ? There's a clear picture of the cabling there!
    I'm afraid I can't do much better myself. I'll try to add pictures on my post next time I jtag my camera.

    ReplyDelete
  184. please see where I am wandering:
    http://img443.imageshack.us/img443/4743/dsc08279a.jpg
    http://img835.imageshack.us/img835/3350/dsc08284.jpg
    http://img832.imageshack.us/img832/9025/dsc08286s.jpg
    http://img832.imageshack.us/img832/9025/dsc08286s.jpg
    http://img299.imageshack.us/img299/3456/dsc08285s.jpg

    ReplyDelete
  185. @sanbruce
    (omg!) well yes, that much clearer now!
    You are trying to interface a TTL directly to the RS232 of your PC. This is not gonna work.
    That's why I mention those converters at the top of my article. You can find them eBay. You need to ensure that whatever model you buy will do 3.3v logic and not 5v like most of them.

    ReplyDelete
  186. Now I understood friend Bubbah. I will see here in Brazil if I find that conversor. thank you again.

    ReplyDelete
  187. Hi all,

    This site is great, i built the serial interface max232 and tried all the firmware on the site h**p://ipcam.intexcz.net but all do not work and the camera is reset continuously.
    The camera is identical to this one (same colour too):
    http://www.netwave.cn/en/productShow.asp?ArticleID=Q7R07RU638
    But in the site there is no way to download anything !!!
    Here are the logs from the terminal:
    ....
    *args===eth0
    [27]
    write i2c error
    write i2c error
    write i2c error
    write i2c error
    write i2c error
    write i2c error
    write i2c error
    write i2c error
    write i2c error
    write i2c error
    myreboot

    I have not tried the firmware for the apexis, anyone can divide me in linux.zip and romfs.img?
    That's my last chance :(
    Thanks a lot!
    Giampaolo

    ReplyDelete
  188. A few weeks ago I found this site and had hope for my recently bricked FI8908W (bricked updating via LAN.) I picked up a SURE CP2102 USB to RS232 gizmo, opened the Foscam up today, got a terminal going, and this is what I see when I power up:

    *****START*****

    W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Aug 19 2009
    Memory Size is 0x800000 Bytes, Flash Size is 0x400000 Bytes
    Board designed by Winbond
    Hardware support provided at Winbond
    Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
    Boot Loader Configuration:

    MAC Address : 00:60:6E:83:6B:03
    IP Address : 0.0.0.0
    DHCP Client : Enabled
    CACHE : Enabled
    BL buffer base : 0x00300000
    BL buffer size : 0x00100000
    Baud Rate : -1
    USB Interface : Disabled
    Serial Number : 0xFFFFFFFF


    For help on the available commands type 'h'

    Press ESC to enter debug mode ......
    Cache enabled!
    Processing image 1 ...
    Processing image 2 ...
    Processing image 3 ...
    Processing image 4 ...
    Processing image 5 ...
    Processing image 6 ...
    Processing image 7 ...

    bootloader >

    *****END*****

    And it freezes up there. Try as I might, I can't get "ESC" sent to the device to stop the boot process and follow the debrick instructions. I find it suspicious that the boot message says "Baud Rate : -1" but I've seen boot logs from working Foscams posted here and there and it seems like a common thing. However, the fact remains that I can't send any keystrokes down the wire. Any suggestions?

    ReplyDelete
  189. Hi,

    Purchaced a FI8908W about 6 months ago and set up all the users and wrote them down, since then I have lost said account details so resorted to pressing the reset button so I could use the factory set username 'admin' with no password. But this does not work and I can no longer login. Anyone came across this before and if so what was the fix.

    ReplyDelete
  190. @ken.nessworthy
    It's not just pressing the reset button, the right procedure is:
    - with camera not powered, keep the reset button pressed
    - power on the camera while keeping the reset button pressed!
    - do not release the reset button before the camera starts giving signs of booting (self rotation, green led on, click from the speaker ...)
    It should then be set to factory state

    ReplyDelete
  191. Hi people,
    I bought a camera in dealextreme, http://www.dealextreme.com/details.dx/sku.26358
    could someone tell me which is the model of my camera?
    My camera is bricked, im trying to flash with a lot firmwares, but nothings happens.
    This is mi camera.
    http://picasaweb.google.es/joseramonlopez/IpCamara#

    I thought that is a EasyNP camere.
    Boot Log:
    new USB device :807dce04-7e8640
    hub.c: new USB device 1, assigned address 2
    dvm cmos successfully initialized
    dvm camera registered as video0
    new USB device :807cf204-7e8640
    hub.c: new USB device 2, assigned address 3
    VIA Networking Wireless LAN USB Driver Ver. 1.13
    Copyright (c) 2004 VIA Networking Technologies, Inc.

    Wait for auto-negotiation complete...ResetPhyChip Failed
    video0 opened
    1
    1
    1
    1
    1
    1
    set resolution 4
    set brightness 100
    set contrast 4
    set sharpness 3
    set mode 0
    __pthread_initial_thread_bos:348000
    manage pid:14
    audio_dev.state not AU_STATE_RECORDING
    wb_audio_start_record
    inet_sr.c INET_rinput 321
    action===1
    options==33
    inet_sr.c INET_setroute 75
    *args===255.255.255.255
    *args===netmask
    *args===eth0
    [27]
    myreboot

    I hope you could help me, I'm going crazy

    ReplyDelete
  192. @J.Ramon
    If they didn't change the specs of this camera, it was able to use the Foscam firmware. The bootloader should then report Mem Size 0x800000 Bytes and Flash size 0x400000 Bytes.
    I'd say you should try the recovery files + instructions made for Foscam.

    ReplyDelete