Wanscam HW0036: same as Digoo BB-M2 with same flaws

Jan 16, 2017


Following my recent uninspiring experience of Digoo BB-M2 and Veskys cameras, I had hopes that the new Wanscam HW0036 would be better, since it's part of the very good HW series.


The sad reality is that Wanscam is just selling its branded version of the uninspiring "Netcam inc" camera that already sells under various names like Digoo BB-M2, Veskys, or Cam360. The front face design is probably just an older and less cost-effective conception with 3 screws holding the globe parts together, while the Digoo/Veskys design needs only 1.













As a Netcam inc product, it comes with a flawed Onvif implementation (known issue for over 2 years now) that will make the port 10080 very unreliable.
It also does not support audio through the RTSP channels, and so in turn, not to ONVIF.
It only affects people who want to use this camera with their own NVR solution.

The Wanscam firmware is slightly older (A70.68.1.16.53E/12.9.7.4-en) than its twins and the web interface lacks some options, like muting the annoying voice prompts when the camera starts, that competitors have in their newer firmware (A70.9.1.16.76E/12.9.7.5-en).

However, the missing options in the GUI can be changed by using the appropriate URL. In the example below, the door_bell_set_language.cgi changes/disables the voice prompts:

http://192.168.x.x:81/door_bell_set_language.cgi?next_url=voice.htm&loginuse=admin&loginpas=password&language=0

Valid "language" values: 0 = none, 1 = Chinese, 2 = English

T10 SoC with Mediatek/B-Link MT7601UN and ULN2803AG

Wanscam promotes the use of its own camera app, e-View7, however it is also entirely compatible with  Netcam360 / Digoocam (both are the same app), and I found this app slightly more complete, and convenient to use with my existing clones from Digoo and Veskys.

Identifying the Wanscam products with Netcam firmware
The HW0036 comes with a unique ID beginning by XHA which has it's own setup category in e-View7 during the setup phase. If you're looking for a model that is fully ONVIF compliant (like most of the HW series has been so far), check for the WXH (HW0041, HW0046, HW0049, HW0050, ....) or HWAA (older generation like HW0026) prefixes. This is sometimes specified on the product page under the P2P specifications.


Conclusion
It is unfortunate that Wanscam included the HW0036 in the reputated HW series. The traditional Wanscam firmware that comes with  models like HW0049 and HW0026 is clearly superior.
For ~20€, it remains a good camera but exclusively for use with eView7 or Netcam360.
For a full review, just read the Veskys and Digoo review.




29 comments:

  1. Thanks!
    Although I have used the voice to indicate when/if the camera got connected successfully, I must admit that it was getting slightly annoying to listen to.
    So thank you for the mute thing.

    I do have a question regarding the HW0036.
    As you mentioned, e-View7 is somewhat the "standard" app for this camera.
    And while I've succeeded in using other apps, e-View7 seems to be the most "straight forward" solution.
    My problem is that no matter what I do, I can only view the stream @5 fps.
    When IR is activated, it can jump to 10fps. But nowhere near the 25-30fps, that the camera is marketed to do.
    I've used "EyeCloud" for PC, tinyCAM pro (android), and a couple more programs for PC - and all those (including the e-View7 app for android) locks the FPS @5/10 fps.

    Did u have encounter the same issue - and if so, do u know how to fix it?
    Atm I have 2x HW0036 cameras..and both of them seems to be limited to 5-10fps.

    (I have tried to change 50/60hz, with no change)

    Kind regards
    Simon

    ReplyDelete
    Replies
    1. Ohh...nevermind, I actually found a solution to it :))
      ONVIF Device Manager (currently: v2.2.250).
      Log in, Video Streaming, Frame rate, fps (5 -> 25)

      And now it runs very smooth with the intended 25fps :))

      Delete
    2. You can also change this from the http interface (port 81). It's on the right side of the main screen, just below the resolution.

      Delete
    3. Yeah, I realized when experimenting with the mute option. But thanks and in any case, probably wouldnt have found out without ur review :)

      Delete
  2. DO you have problems to record on ftp, or received notifications on email?

    ReplyDelete
  3. hi,
    please help me. I have a camera wanscam HW0036. After turning on the camera everything goes ok but after a few minutes, the camera is disconnected from the network. More is not connected to the network. I have to disconnect it from the power supply and reconnect.

    ReplyDelete
  4. Anyone know how to un-brick the Wanscam HW0036? i manage to connect to the serial port on the mainboard and this is to where i can get:


    Anyone know how to un-brick the Wanscam HW0036? i manage to connect to the serial port on the mainboard and this is to where i can get:
    U-Boot SPL 2013.07 (Jun 13 2016 - 21:30:48)
    pll_init:347

    l2cache_clk = 450000000

    pll_cfg.pdiv = 8, pll_cfg.h2div = 4, pll_cfg.h0div = 4, pll_cfg.cdiv = 1, pll_cfg.l2div = 2

    nf=36 nr = 1 od0 = 1 od1 = 1

    cppcr is 02404900

    CPM_CPAPCR 0470890d

    nf=50 nr = 1 od0 = 1 od1 = 1

    cppcr is 03204900

    CPM_CPMPCR 0320490d

    cppcr 0x9a7b5510

    apll_freq 860160000

    mpll_freq 1200000000

    ddr sel mpll, cpu sel apll

    ddrfreq 400000000

    cclk 860160000

    l2clk 430080000

    h0clk 300000000

    h2clk 300000000

    pclk 150000000

    CPM_DDRCDR(0000002c) = a0000002



    U-Boot 2013.07 (Jun 13 2016 - 21:30:48)

    Board: ISVP (Ingenic XBurst T10 SoC)
    DRAM: 64 MiB
    Top of RAM usable for U-Boot at: 84000000
    Reserving 407k for U-Boot at: 83f98000
    Reserving 32784k for malloc() at: 81f94000
    Reserving 32 Bytes for Board Info at: 81f93fe0
    Reserving 124 Bytes for Global Data at: 81f93f64
    Reserving 128k for boot params() at: 81f73f64
    Stack Pointer at: 81f73f48
    Now running in RAM - U-Boot at: 83f98000
    MMC:
    the manufacturer f8
    SF: Detected FM25Q64

    In: serial
    Out: serial
    Err: serial
    Net: CPM_MACCDR(54) = a0000017
    Jz4775-9161
    Hit any key to stop autoboot: 1 0
    run_command_list
    the manufacturer f8
    SF: Detected FM25Q64

    SF: 2883584 bytes @ 0x40000 Read: OK
    ## Booting kernel from Legacy Image at 80600000 ...
    Image Name: Linux-3.10.14
    Image Type: MIPS Linux Kernel Image (gzip compressed)
    Data Size: 2036771 Bytes = 1.9 MiB
    Load Address: 80010000
    Entry Point: 80399e10
    Verifying Checksum ... OK
    Uncompressing Kernel Image ... OK

    Starting kernel ...

    [ 0.000000] Initializing cgroup subsys cpu
    [ 0.000000] Initializing cgroup subsys cpuacct
    [ 0.000000] Linux version 3.10.14 (root@aplink-desktop) (gcc version 4.7.2 (Ingenic 2015.02) ) #28 PREEMPT Thu Jun 16 13:06:04 CST 2016
    [ 0.000000] bootconsole [early0] enabled
    [ 0.000000] CPU0 RESET ERROR PC:801B5E60
    [ 0.000000] [<801b5e60>] 0x801b5e60
    [ 0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)
    [ 0.000000] FPU revision is: 00b70000
    [ 0.000000] CCLK:860MHz L2CLK:430Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
    [ 0.000000] Determined physical RAM map:
    [ 0.000000] memory: 00439000 @ 00010000 (usable)
    [ 0.000000] memory: 00037000 @ 00449000 (usable after init)
    [ 0.515076] jz_mac jz_mac.0: MII Probe failed!
    [ 0.992247] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
    [ 1.002263] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
    [ 1.010924] Rebooting in 3 seconds..Restarting after 4 ms

    ReplyDelete
  5. had to split the message due to character limit... this is part 2 above is part 1...

    U-Boot SPL 2013.07 (Jun 13 2016 - 21:30:48)
    pll_init:347

    l2cache_clk = 450000000

    pll_cfg.pdiv = 8, pll_cfg.h2div = 4, pll_cfg.h0div = 4, pll_cfg.cdiv = 1, pll_cfg.l2div = 2

    nf=36 nr = 1 od0 = 1 od1 = 1

    cppcr is 02404900

    CPM_CPAPCR 0470890d

    nf=50 nr = 1 od0 = 1 od1 = 1

    cppcr is 03204900

    CPM_CPMPCR 0320490d

    cppcr 0x9a7b5510

    apll_freq 860160000

    mpll_freq 1200000000

    ddr sel mpll, cpu sel apll

    ddrfreq 400000000

    cclk 860160000

    l2clk 430080000

    h0clk 300000000

    h2clk 300000000

    pclk 150000000

    CPM_DDRCDR(0000002c) = a0000002



    U-Boot 2013.07 (Jun 13 2016 - 21:30:48)

    Board: ISVP (Ingenic XBurst T10 SoC)
    DRAM: 64 MiB
    Top of RAM usable for U-Boot at: 84000000
    Reserving 407k for U-Boot at: 83f98000
    Reserving 32784k for malloc() at: 81f94000
    Reserving 32 Bytes for Board Info at: 81f93fe0
    Reserving 124 Bytes for Global Data at: 81f93f64
    Reserving 128k for boot params() at: 81f73f64
    Stack Pointer at: 81f73f48
    Now running in RAM - U-Boot at: 83f98000
    MMC:
    the manufacturer f8
    SF: Detected FM25Q64

    In: serial
    Out: serial
    Err: serial
    Net: CPM_MACCDR(54) = a0000017
    Jz4775-9161
    Hit any key to stop autoboot: 1 0
    isvp# help

    Unknown command ' help' - try 'help'
    isvp# help

    ? - alias for 'help'
    base - print or set address offset
    boot - boot default, i.e., run 'bootcmd'
    boota - boot android system
    bootd - boot default, i.e., run 'bootcmd'
    bootm - boot application image from memory
    bootp - boot image via network using BOOTP/TFTP protocol
    chpart - change active partition
    cmp - memory compare
    coninfo - print console devices and information
    cp - memory copy
    crc32 - checksum calculation
    dhcp - boot image via network using DHCP/TFTP protocol
    echo - echo args to console
    env - environment handling commands
    ext4load- load binary file from a Ext4 filesystem
    ext4ls - list files in a directory (default /)
    fatinfo - print information about filesystem
    fatload - load binary file from a dos filesystem
    fatls - list files in a directory (default /)
    gettime - get timer val elapsed,

    go - start application at address 'addr'
    help - print command description/usage
    loadb - load binary file over serial line (kermit mode)
    loads - load S-Record file over serial line
    loady - load binary file over serial line (ymodem mode)
    loop - infinite loop on address range
    md - memory display
    mm - memory modify (auto-incrementing address)
    mmc - MMC sub system
    mmcinfo - display MMC info
    mtdparts- define flash/nand partitions
    mw - memory write (fill)
    nm - memory modify (constant address)
    ping - send ICMP ECHO_REQUEST to network host
    printenv- print environment variables
    reset - Perform RESET of the CPU
    run - run commands in an environment variable
    saveenv - save environment variables to persistent storage
    setenv - set environment variables
    sf - SPI flash sub-system
    sleep - delay execution for some time
    source - run script from memory
    tftpboot- boot image via network using TFTP protocol
    version - print monitor, compiler and linker version
    isvp#

    what should i do after? as you can see the camera is in restart endless loop which happens on this line:
    Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

    what should i do? where it is broken?

    ReplyDelete
    Replies
    1. Hi my friend,

      I have this camera too but from one day to other the camera doesn't work. You solved your problem?

      I want to debug mine too. I saw the 3 pin UART on mainboard but how can i use it to debug? I have to connect only the 3 pins (Gnd, TX and RX) to a Serial Port or i need the RX232/233 chipset to use it on a serial port?

      Thanks and regards.

      Delete
    2. Hi,

      Mine stops long before your loading steps .. But like you, it seems that the memory eprom has fail
      It seems too cheap maybe.
      I ordered another of this camera, and will dump the firmware so maybe you could flash and fix yours.

      Delete
    3. Hi,

      Could be a solution Stef, but how i can send the firmware to the camera? Now it doesn't give any signal of life...

      Only debudgin using the serial no? But you have the wiring?

      Regards

      Delete
    4. Hi. Found this thread by searching the Comet HX-1080 cam serial output. Cant even paste it now. Will inform on advances
      Regards

      Delete
    5. U-Boot SPL 2013.07 (Feb 27 2016 - 10:34:09)
      pll_init:347[0D]
      l2cache_clk = 450000000[0D]
      pll_cfg.pdiv = 8, pll_cfg.h2div = 4, pll_cfg.h0div = 4, pll_cfg.cdiv = 1, pll_cfg.l2div = 3[0D]
      nf=38 nr = 1 od0 = 1 od1 = 1[0D]
      cppcr is 02604900[0D]
      CPM_CPAPCR 04b0890d[0D]
      nf=50 nr = 1 od0 = 1 od1 = 1[0D]
      cppcr is 03204900[0D]
      CPM_CPMPCR 0320490d[0D]
      cppcr 0x9a7b5510[0D]
      apll_freq 909312000 [0D]
      mpll_freq 1200000000 [0D]
      ddr sel mpll, cpu sel apll[0D]
      ddrfreq 400000000[0D]
      cclk 909312000[0D]
      l2clk 303104000[0D]
      h0clk 300000000[0D]
      h2clk 300000000[0D]
      pclk 150000000[0D]
      CPM_DDRCDR(0000002c) = a0000002[0D]


      U-Boot 2013.07 (Feb 27 2016 - 10:34:09)

      Board: ISVP (Ingenic XBurst T10 SoC)
      DRAM: 64 MiB
      Top of RAM usable for U-Boot at: 84000000
      Reserving 402k for U-Boot at: 83f98000
      Reserving 32784k for malloc() at: 81f94000
      Reserving 32 Bytes for Board Info at: 81f93fe0
      Reserving 124 Bytes for Global Data at: 81f93f64
      Reserving 128k for boot params() at: 81f73f64
      Stack Pointer at: 81f73f48
      Now running in RAM - U-Boot at: 83f98000
      MMC:
      the manufacturer c2
      SF: Detected MX25L64**E

      *** Warning - bad CRC, using default environment

      In: serial
      Out: serial
      Err: serial
      Net: CPM_MACCDR(54) = a0000017
      Jz4775-9161
      Hit any key to stop autoboot: 1 [08][08][08] 0
      the manufacturer c2
      SF: Detected MX25L64**E

      SF: 2883584 bytes @ 0x40000 Read: OK
      ## Booting kernel from Legacy Image at 80600000 ...
      Image Name: Linux-3.10.14
      Image Type: MIPS Linux Kernel Image (gzip compressed)
      Data Size: 2344413 Bytes = 2.2 MiB
      Load Address: 80010000
      Entry Point: 80404510
      Verifying Checksum ... OK
      Uncompressing Kernel Image ... OK

      Starting kernel ...

      [ 0.000000] Initializing cgroup subsys cpu
      [ 0.000000] Initializing cgroup subsys cpuacct
      [ 0.000000] Linux version 3.10.14 (root@aplink-desktop) (gcc version 4.7.2 (Ingenic 2015.02) ) #12 PREEMPT Sat Feb 27 10:32:49 CST 2016
      [ 0.000000] bootconsole [early0] enabled
      [ 0.000000] CPU0 RESET ERROR PC:A820D161
      [ 0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)
      [ 0.000000] FPU revision is: 00b70000
      [ 0.000000] CCLK:909MHz L2CLK:454Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
      [ 0.000000] Determined physical RAM map:
      [ 0.000000] memory: 004c8000 @ 00010000 (usable)
      [ 0.000000] memory: 00038000 @ 004d8000 (usable after init)
      [ 0.458466] jz_mac jz_mac.0: MII Probe failed!
      [ 0.926229] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
      [ 0.936087] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
      [ 0.944701] Rebooting in 3 seconds..Restarting after 4 ms

      Delete
    6. Hi my friend,

      I connected the serial and send commands to the board but unfortunely i send the wrong firmware... so now i have to fix the bootloader because i don't have any response from serial port.

      You made any progress? If you got the firmware tell me please or if you know how to fix the boatloader..

      Thanks in advice

      Delete
    7. Hi Guys,

      Good news, i recovered the Camera.

      Like i said when i tried to flash the first time i erased all memory, so the camera don't boot up. Searching online i understood that i have to program the SPI Flash Memory. Online i only found a Parallel Port Programmers to this SPI Flash. Because the new laptops doesn't have the Parallel Port, i found a schematic to use a Raspberry Pi 3 to program it...

      So, hands on Work and i used a old adapter made by me to connect the GPI ports from the RPI to a breadboard. On my breadboard i connect to my SPI Flash connected on the IP Camera Mainbord. I doesn't de-solder the SPI Flash, some people say to de-solder but i tried anyway.

      I lost some hours to trying to connect the RPI to the Flash because wiring problems... the breadboards are good to make this tests, but sometimes the connection is to loose or the wires doesn't make so good contact.. so after some hours i make all connections from the scratch and with all patience.

      After that, oh yeahh.. the RPI detects the SPI Flash and i could finally program a bin that i found in Internet to this Camera (IPcam25x64.bin). It takes around thirty minutes to Read, Erase, Program and Verify but at the end the camera boots up again.

      I disconnected the RPI connection and use again the Serial do see what happens but the camera doesn't fully work, only boots up and try to connect to Wifi but the motors doesn't rotate and nothing..

      So with more search i found the "Noboot.bin" from this forum and yesss finally the camera starts to work, and moving and connecting to wifi and finally to transmit image :)

      Delete
  6. Hi! It's maybe an offtopic, but I am trying to configure this camera through their client software for PC and I cannot set different login and password, so in my case it's always password123:password123 or admin:admin, etc. Also, I didn't manage to save mail settings, it just doesn't save them at all. I see that you are accessing settings on 81 port, which works for me too. Is there a full list of urls that can be used for configuration? Can I make changes by accessing that own camera web server?

    Thanks for any help.

    Best regards,
    Illya

    ReplyDelete
  7. Hi i have tried typing http://192.168.x.x:81/door_bell_set_language.cgi?next_url=voice.htm&loginuse=admin&loginpas=password&language=0 onto my browser while the HW0026 camera is connected. But it says page not found. How do i mute the voice startup?

    ReplyDelete
    Replies
    1. Did you replace .x.x by the actual IP address?

      Delete
  8. i have ordered 2 cameras hw0036 and both are dead after 3 days to use , they dont start after plug to the power , is there a way to fix them? i cant believe that both camera happened the same :(

    ReplyDelete
    Replies
    1. Did you try plugging them to another USB power source? like a power bank? Only a very wrong/unstable power source would fry them (they use 5V2A like most IP cameras). Maybe the power adaptor is faulty? Do not hesitate to open one and see if anything looks (or smell) toasted inside. The 3 units I have (Wanscam+Digoo+Veskys) all worked 24/7 for months and no failure so far.

      Delete
    2. you are lucky , i bought one from gearbest and after 3 days now it is dead , so i got refund , now i ordered it from other store and after 4 days now is dead i have tried to plugged to other adapters but nothinig happen , no voice no moves :(

      Delete
    3. I have the same problem. After some hours mine is also dead. I ordered it from Gearbest.

      Delete
    4. Mine worked during 90days and died.

      The image started to ficking and when i reboot the power never worked again.

      Isn't the power supply so... i don't have any clue do fix it.

      Delete
    5. And was bought on Gearbest to..

      Delete
  9. Bonjour,
    J'ai également acheté 2 caméras sur des sites différents et les deux se sont plantées au même endroit : dans le paramétrage des alarmes par mails, au moment d'appuyer sur le bouton "test".
    les caméras se sont déconnectées et impossible de communiquer.
    Rien avec le reset, plus d'initialisation le chargeur où un autre ne chauffe pas...
    J'ai attendu qu'un des sites me fasse un avoir pour en ouvrir une, à quel endroit faut il se connecter afin d'établir une liaison série?
    Merci pour votre aide

    ReplyDelete
    Replies
    1. Bonjour, il y a habituellement une serie de 4 bornes en ligne (ou 4 trous) sur la carte mere, dans le meme genre que ce qui est illustre dans cet ancien article. La methode reste essentiellement la meme aussi. Le plus difficile est d'obtenir le firmware. Il ne faut pas hesiter a solliciter Wanscam (en pretendant avoir acheté leur modele) ET Digoo (en pretendant avoir acheté ...) car leur firmware est exactement le meme, du moment que l'un d'eux accepte d'envoyer le fichier. Bonne chance.

      Delete
  10. Hi, Thanks for your solution to avoid voice prompt! Worked for me!

    ReplyDelete
  11. May you suggest any software (like e-view7) working outside home network? E-view7 not working on my phone with android 5.0 (THL t100s)?
    I have tried some from play store but all only work in my home network...
    Thanks.

    ReplyDelete