Comments on Gadget Victims: Wanscam HW0036: same as Digoo BB-M2 with same flaws

Hi Jasson, Accessing the camera remotely using VP...

2018-09-17T00:10:14.251+01:00

Hi Jasson,

Accessing the camera remotely using VPN is the better option.

Best Regards

Dear friend,finally i could fix my second camera ...

2018-09-16T00:53:33.781+01:00

Dear friend,finally i could fix my second camera :) ,i read about access to the camera remotly using ddns and opening an port to the router to access to the camera online, do you know if this way is more secure than access to the camera via p2p protocol with the wanscam app?

Hi my friend, Glad to see that i could help in so...

2018-08-25T02:22:04.948+01:00

Hi my friend,

Glad to see that i could help in something :)

When this camera was broken, i got another different one from my job the Trust Smart IPCAM-2000, it's a simple model that doesn't rotate, only speaker and micro.

The main difference is that you couldn't access the web browser, is a login protected that Trust doesn't share to the users .. (i tried without successful). So, with this camera the IP should fixed on the router and not in the camera, for me it's a shame this behaviour but okay..

The "trash packets" are to similar, it generates a lot of traffic in your network, so i blocked all traffic too in my router like the other one, except the NTP server.

I think all this cameras have the same linux strategy, but this one it's a closed system, you only can access using the Trust app, not like the others, but at the end works in a same mode.

Best Regards

Dear friend, thank you for your time, I will try t...

2018-08-23T09:35:00.917+01:00

Dear friend, thank you for your time, I will try to fix my other camera,the diagrams and pictures you sent me are enough, :) but at least one of the camera is working and this is good for me because I had no idea how could i fix it, I was going to throw it away but I am happy that I could make it work again, thanks to your info. I need to find out how to make a debug to the packets that pass through my router, and do the same like you.
do you have more IP cameras? if Yes, does this happen in others cameras? I have three different models wanscam cameras and no problem yet. I need to have access to the cameras from my phone when I am not home.

Hi my friend, Very good news :) Yes i think that...

2018-08-23T01:04:58.962+01:00

Hi my friend,

Very good news :) Yes i think that i had this problem too, not because the user/password but because this firmware by default allows remote access and provide to much connections that should be supposed to have. After i repaired my camera, by curiosity i made debug of the packets that passed in my Router from/to the camera and saw to strange connections and to suspicious addresses, so i blocked all traffic to the camera on my Router. I only allowed the NTP server address. After that my camera only can be accesses inside my home network, via my router or via my VPN access. No more remoted accesses from outside my network to the camera :)

To your other camera, to be honest i don't have to much time, and now the camera is in use, so it's hard to take new pictures or make a video.

The diagram that i sent you should be enough. Some schematics resistances to protect the chip from current peaks, but normally the people connect straight forward without any protection..
Sometimes doesn't make any difference.
In my case, at the beginning i started to use resistances, but i was lost maybe 4-5hours to get successful connection because my breadboard was damaged... and the wiring was not perfect, so at some point i didn't used resistances and the final result, as you can see at the pictures, i don't have any resistance and the camera works fine.

I recommend you to follow this steps:

1) Solder some wires at the 8 pins from the Flash Memory
2) Connect this 8 wires to correspondent raspberry ports. 2 of this wires should be connected to VCC and other 2 to the ground.
3) At your raspberry should follow this coding steps:

sudo nano /etc/modules
sudo modprobe spi-bcm2835
sudo modprobe spi-bcm2708
sudo modprobe spidev
sudo modprobe spi-dev

sudo echo "spi-bcm2835" >> "/etc/modules"

lsmod

flashrom -p linux_spi:dev=/dev/spidev0.0

flashrom -E -V -p linux_spi:dev=/dev/spidev0.0

flashrom -w /root/boot.img -p linux_spi:dev=/dev/spidev0.0

flashrom -p linux_spi:dev=/dev/spidev0.0 -w /path/to/libreboot.rom

#To erase the chip (not needed on most chips) run:

flashrom -E -V -p linux_spi:dev=/dev/spidev0.0

#To begin flashing run:

flashrom -w /XXXXXX -V -p linux_spi:dev=/dev/spidev0.0a

To be honest, i didn't remember all that i have done, but i had this notes in this project :)

Best Regards

Dear friend, thank you so much for your help , one...

2018-08-22T21:40:53.661+01:00

Dear friend, thank you so much for your help , one of my cameras is working now , i have accessed to the web interface and installed the original firmware and i put a better password.
My mistake when i bought the cameras is that i forgot to change the default password "admin-admin" so i guess it was too easy to hack it and damage the firmware :(.
Now i have to try to fix the other one that i think i have to fix the bootloader , do you have a link of a video or tutorial that you followed to flash this chip with the RPI? i dont understand why some diagram use resistors to connect the chip to the RPI and others connect the chip directly to the RPI without resistor to be sure.(i did without resistors because it did not work with the resistor) . Thank you again my friend

2018-08-21T23:14:25.197+01:00

This comment has been removed by the author.

Hi my friend Jasson, Glad to see that you are to ...

2018-08-20T23:31:03.046+01:00

Hi my friend Jasson,

Glad to see that you are to close :)

Your problem was the Noboot file. Like the name says, the firmware as no bootloader, so the camera doesn't boot.

You have to use the Full Dump. I don't if you already have one, but o send you the link to download the generic one (link-> https://we.tl/t-oqpQzWhw3h)

Best Regards and hope to get successful :)

Dear friend, I could to send the firmware ipcam25x...

2018-08-20T08:59:00.230+01:00

Dear friend, I could to send the firmware ipcam25x64.bin via RPI after that I was able to access to serial interface and I sent the NOBOOT. bin to the camera with Tera term following the steps everything finished like the steps but when i power the camera í don't see any signal of life any clue

2018-08-19T23:25:39.754+01:00

This comment has been removed by the author.

Hi my friend; 1) Yes the flash is the chip. With ...

2018-08-16T22:39:11.641+01:00

Hi my friend;

1) Yes the flash is the chip. With the code W25Q64 i think.
2) Using the serial port to make debug.
3) To access the serial interface and send the firmware to the flash any simple serial interface program is enough, like putty, but i used "Teraterm 4.95". If you can't access the flash using the serial interface you should program the chip flash directly using the raspberry or any other programmer.

Best Regards

thank you for reply, I have some questions, 1. whe...

2018-08-15T11:01:45.817+01:00

thank you for reply, I have some questions, 1. when you say "flash" do you mean a chip? 2.how can I know that the flash has the bootloader?
sorry I am a noob,( I have used the ftdi to install firmware to devices for Drones following tutorials ) what software is used with the RPI and for ftdi? this is interesting to learn.

Hi my friend, Yes you can if you already has the ...

2018-08-14T23:17:13.882+01:00

Hi my friend,

Yes you can if you already has the bootloader in the flash. If not you need to program first the flash memory and then you can use the serial interface (ftdi is a USB to Serial interface converter).

Best Regards

Hi my Friend, I uploaded again using WeTransfer. ...

2018-08-14T23:11:38.178+01:00

Hi my Friend,

I uploaded again using WeTransfer. I hope it helps you to fix the camera.

Link -> https://we.tl/b9SOFg4RQq

Best Regards

can you post the pictures again? to see the schema...

2018-08-14T23:05:48.311+01:00

can you post the pictures again? to see the schematic to use a Rpi .please

Hi, I want to learn how to fix my two cameras, can...

2018-08-13T14:04:33.268+01:00

Hi, I want to learn how to fix my two cameras, can I flash the firmware via a ftdi programmer? I was checking the links of miky to see the diagrams and pictures but the links are expired

Hi my friend, Yes, as said in my posts. I use the...

2018-08-03T23:05:12.079+01:00

Hi my friend,

Yes, as said in my posts. I use the serial interface to send a new firmware to the camera.

If you need some help begin to read my post on Oct,28 2017, 1:02:00AM and if you have doubt please tell me.

Thanks and regards

did you fix it?

2018-08-03T11:45:05.757+01:00

did you fix it?

Hello, First of all thank you for your great plan...

2017-11-08T21:51:55.292+00:00

Hello,

First of all thank you for your great plans and your forum.

So my problem is this, I have two HW0036 that worked very well there is little with
Jeedom, tinycam, chrome and imperihome however for about 1 month they do not broadcast any image after a few hours of ignition and even after a report and a tank settings, the only way for me to see the flow is to use E-view7.
I have a freebox revolution and my cameras have been working perfectly for over a year.
Thank you in advance for your help
Gendo

Hi Carlos, If you was aware to my previous post i...

2017-10-28T01:02:55.386+01:00

Hi Carlos,

If you was aware to my previous post i told you the ways to bring the camera back to like and i see a lot of doubts in your speech, so let me try to clarify.

1) First of all you will need some electronic skills to make this happen, either using the serial interface or program the flash. If you are able to straight forward so let's do it. If not it's better to ask from some help to a friend.

2) You will need to take some electronic components such a RS232 or 233 chips. You need to place it them on a breadboard and make some wiring connections as the schematics in my previous post.

3) With the RS232 or 233 correctly wired in a breadboard you will need to connect them to a Serial Interface port in a Computer.

4) Then, you can test the correct wiring making a shunt between the RX and TX ports in a RS232/233 and using a properly software in a computer to access the Serial Interface.

5) After this confirmation you can connect 3 wires from the breadboard (TX, RX and Gnd) to the IP Camera board. The connection should be made in the three holes that i show in the pictures from my previous post.

6) With this all connection made you should be able to see the Linux boot log and abort the boot loader process to flash the camera using the Kermit protocol with you .bin file using specific commands from the serial interface software. But when you arrive in this step i could gave you the correct commands and sequence to make the camera works again, but firstly you will need to make the previous steps.

I hope could be clear my post.
Thanks and regards.

hello miky actually i have not done anything becau...

2017-10-26T23:32:22.076+01:00

hello miky actually i have not done anything because i dont know how i mean my cameras are totally deaths so i need to upgrade the firmware im correct? the how can i do that? i have not erased the flash if the 3 pins dont let me upgrade de firmware so what do i have to do to fix my cams??? regards

A correction. I used the RS233 interface. It doesn...

2017-10-26T00:03:45.507+01:00

A correction. I used the RS233 interface. It doesn't require capacitors.

Hi Carlos, Reading better your comment i think th...

2017-10-26T00:01:39.970+01:00

Hi Carlos,

Reading better your comment i think that you are mixed the question. The 3 pins in the board that you can access using the RSR232 interface isn't to directly program the Flash, it's to access the Linux Command Line and if you abort the loading you can Send the new firmware to repair the camera.

If this is your real problem you can make a RS232 schematic between the Serial Port and the Camera Board like this example (https://www.superdroidrobots.com/images/rs232-ttl-schematic.png). Exists a lot of solutions, in my case i used a RSR233 interface, it's a little more simple :)

In your board side i don't remember all but looking for this three pins you should use the first one (Square) to connect the Ground of your RS232 board and the others two are the RX and TX to connect also with the board. You can try mix the wiring if doesn't appear nothing in your Serial interface program like Teraterm or Putty. You also should use the 115200 Baudrate on program.

Regards

Hi Carlos, When i was searching about programming...

2017-10-25T23:49:13.733+01:00

Hi Carlos,

When i was searching about programming the Flash i had the same problem. I found a lot of schematics to use in a Parallel port (could be a solution to you if you have this possibility) but using Serial i only found one site with the schematic but it uses a PIC Microcontroller. I don't saved the site because the Hex file was unable to download and after i found the Raspberry Pi solution. You can try but i don't have so much faith on it.

If you have the possibility to use a Raspberry i send the link to download my Photos and you take a look on it (Link-> https://we.tl/te5sabDBQI)

But my question remains... you can't connect the board to a RS232 serial interface to access the command line or you erased the flash as i have done?

Regards

the mproblem its that i dont know how to build the...

2017-10-25T16:02:14.503+01:00

the mproblem its that i dont know how to build the serial interface i have used ponyprog to program chips for cartdridges printers i guess this programos would works but the serial interface do you have the schematic or for any contact in the camera (3 pins) what are their values? thank you