I had 4 cameras of chinavasion, 2 are now bricked because of my wrongfully experimenting. I already tried every firmware I found on the internet, I did it with the parameters you said, but it alwas ends with a myReboot command and the cam reboots. This is the log of a faulty camera:
W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010 Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes Board designed by Winbond Hardware support provided at Winbond Copyright (c) Winbond Limited 2001 - 2006. All rights reserved. Boot Loader Configuration:
MAC Address : 00:0C:5D:75:1C:18 IP Address : 0.0.0.0 DHCP Client : Enabled CACHE : Enabled BL buffer base : 0x00300000 BL buffer size : 0x00100000 Baud Rate : -1 USB Interface : Disabled Serial Number : 0xFFFFFFFF
For help on the available commands type 'h'
Press ESC to enter debug mode ...... Cache enabled! Processing image 1 ... Processing image 2 ... Processing image 3 ... Processing image 4 ... Processing image 5 ... Processing image 6 ... Processing image 7 ... Unzip image 7 ... Executing image 7 ... Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #1042 Ò» 12ÔÂ 7 05:49:33 CST 2009 Processor: Winbond W90N745 revision 1 Architecture: W90N745 On node 0 totalpages: 2048 zone(0): 0 pages. zone(1): 2048 pages. zone(2): 0 pages. Kernel command line: root=/dev/rom0 rw Calibrating delay loop... 39.83 BogoMIPS Memory: 8MB = 8MB total Memory: 6272KB available (1447K code, 284K data, 40K init) Dentry cache hash table entries: 1024 (order: 1, 8192 bytes) Inode cache hash table entries: 512 (order: 0, 4096 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 2048 (order: 1, 8192 bytes) POSIX conformance testing by UNIFIX Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd PTZ Driver has been installed successfully. Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options en abled ttyS00 at 0xfff80000 (irq = 9) is a W90N745 Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options e nabled ttyS00 at 0xfff80100 (irq = 10) is a W90N7451 I2C Bus Driver has been installed successfully. Blkmem copyright 1998,1999 D. Jeff Dionne Blkmem copyright 1998 Kenneth Albanowski Blkmem 1 disk images: 0: 7F0E0000-7F16CFFF [VIRTUAL 7F0E0000-7F16CFFF] (RO) S29GL032N Flash Detected 01 eth0 initial ok! which:0 PPP generic driver version 2.4.2 Linux video capture interface: v1.00 Winbond Audio Driver v1.0 Initialization successfully. usb.c: registered new driver hub add a static ohci host controller device : USB OHCI at membase 0xfff05000, IRQ 15 hc_alloc_ohci usb-ohci.c: AMD756 erratum 4 workaround hc_reset usb.c: new USB bus registered, assigned bus number 1 hub.c: USB hub found hub.c: 2 ports detected usb.c: registered new driver audio audio.c: v1.0.0:USB Audio Class driver usb.c: registered new driver serial usbserial.c: USB Serial Driver core v1.4
_____ ____ _ ____ |__ / _| _ / / ___| / / | | | | | |/ _ ___ / /| |_| | |_| / ___ ___) | /______, |____/_/ _____/ |___/ ZD1211B - version 2.24.0.0 usb.c: registered new driver zd1211b main_usb.c: VIA Networking Wireless LAN USB Driver 1.13 usb.c: registered new driver vntwusb usb.c: registered new driver rt73 dvm usb cam driver 0.0.0.0 by Maverick Gao in 2006-8-12 usb.c: registered new driver dvm dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20 usb.c: registered new driver dvm usb cam driver for sonix288 NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) VFS: Mounted root (romfs filesystem) readonly. Freeing init memory: 40K BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4) BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4) Shell invoked to run file: /bin/init Command: mount -t proc none /proc Command: mount -t ramfs none /usr Command: mount -t ramfs none /swap Command: mount -t ramfs none /var/run Command: mount -t ramfs none /etc Command: mount -t ramfs none /flash Command: mount -t ramfs none /home Command: camera& [8] Command: sh
Sash command shell (version 1.1.1) no support /> hub.c: connect-debounce failed, port 1 disabled new USB device :807dce04-7e8640 hub.c: new USB device 1, assigned address 2 dvm cmos successfully initialized dvm camera registered as video0 new USB device :807cf204-7e8640 hub.c: new USB device 2, assigned address 3 idVendor = 0x148f, idProduct = 0x2573
Wait for auto-negotiation complete...ResetPhyChip Failed video0 opened 1 1 1 1 1 1 set resolution 4 set brightness 100 set contrast 4 set sharpness 3 set mode 0 __pthread_initial_thread_bos:348000 manage pid:16 audio_dev.state not AU_STATE_RECORDING wb_audio_start_record inet_sr.c INET_rinput 321 action===1 options==33 inet_sr.c INET_setroute 75 *args===255.255.255.255 *args===netmask *args===eth0 [29] write i2c error write i2c error write i2c error write i2c error write i2c error write i2c error write i2c error write i2c error write i2c error write i2c error myreboot
I need to get a way to read the original firmware from a working camera and flash that back to a bricked one. I guess the only two options are through the bootloader (but I don't know how) or via JTAG ( I don't know how)
I found a site that describes how to use JTAG to flash back a bootloader with the same ARM chip as the camera is using, but I can't really understand what they are doing. http://www.wiki.kslemb.com/doku.php/uboot/install
i own two pieces of this camera from chinavasion. One is bricked. Second is ok.
Beware! This camera is not Foscam clone on hardware basis! This is why you cannot use ordinary Foscam firmwares. Look on board and you'll see IP607SZ or something like that. This clone uses another kernel drivers because of little bit different hardware. Through support i got original firmware for this camera and through non official sources ;-) i got documentation to bootloader and and development kit on which is camera build upon. Development kit and embedded linux distro is same as for Foscam, but kernel and rootfs image is build differently for each cam due reasons mentioned above.
Address boundaries parameters for bootloader: linux.zip-0x7f020000 0x8000(code execution address in RAM), end address is recomputed automatically by bootloader from file size
romfs.img-0x7f0e0000 0x7f0e0000
After uploading it is necessary to execute windows ip cam tool thingy and upload web interface files. Camera should appear in this tool after kernel boots and romfs is mounted. Please watch patiently for output from UART port for messages!
BTW:Those who developed Foscam and IP607 are total noobs!!! They have nice SDK and quite inteligent bootloader can load new firmware to RAM or flash it via TCP/IP. Even bootloader is manageable over telnet session. But its disabled! Enabling few options and opening camera is not necessary. Unbelievable how some hw developers are total (censored word). My bricked camera is because this noobs not locked address space as read only via JTAG, so changing ip address on camera and internal software fault probably damanged bootloader accessing this area for whatever reason. Even when address space is not lockable on hardware basis(some lower arms can't do) then can set address boundaries as kernel parameters for filesystem.
[/quote]
Hi Fishie!
Happy new year to you and all other members on this board!
I have tried you restore formware files but unfortunatly it doesn't work for my cam. I bought my cam at www.chinavasion.com. and the board says: ES_IP607_ARM_2.
When I upload the firmware you provided it the camera boots but like with all other firmwares I have tried at the end I get this message:
Flashed the 4.5 firmware, I connected the JTAG connector and ran macro (2) in the JTAG menu, this is the response: JTAG>(2) JTAG INIT CHAIN JTAGSM: RESET JTAGSM: RESET->IDLE JTAGSM: IDLE->Instruction Register (DELAYED ONE BIT FOR TMS) JTAGSM: IR->IDLE JTAGSM: IDLE->Data Register JTAGSM: DR->IDLE JTAGSM: RESET JTAGSM: RESET->IDLE JTAGSM: IDLE->Data Register 0x00 DEVICE(S) IN JTAG CHAIN JTAGSM: DR->IDLE JTAG>
Hi Ian! Thanks for the reply, I soldered the connections to the board and want to try to scan JTAG with the buspirate to see if it detects anything. Sorry for the noob question, but do I need to power up the IP Camera to use JTAG? and where can I find the BusPirate 4 firmware with JTAG support? I now have 5.9 loaded on the BP.
As I looked at the pinout of the chip I saw there are JTAG PINS:
Can someone please tell me if I can get the content of the board through JTAG with the Bus Pirate and OpenOCD? If so is the pinout on the picture enough? And do I need to remove the resistor array R2 and the resistor R14 as shown on the picture?
[quote author="villamany"] any proggress reading the firm? [/quote]
Unfortunately no, I have no idea how to connect the BP to the chip so I can dump the firmware. I do not have any idea how to start That's why I hope to trigger the interest of a hardware guru who can help me out All I need is a dump of the firmware, the "bricked" cam is still responsive through the bootloader on it, so if I have the original firmware I can put it on the "bricked" cam through the bootloader.
Thank you for your response, unfortunately I have tried about every single possibility that I found on the internet and I also found that blog. I have connected the serial debug interface on the camera with a RS232 device and uploaded about every firmware I found. Nothing worked. The problem I think is that Foscam the original maker of the cams have made a protection in there firmware that checks if a specific chip is available and if not it reboots. That is what is happening now to the cam I uploaded new firmware to the cam it boots I can follow the process through the terminal window and then the last message I see is "I2C write error, myReboot". That is the reason why i want to read the original firmware from a working cam so I can upload it to the bricked cam. The thing is I don't know how I can dump the firmware form the working cam. As far as I can see there is no possibility through the bootloader.
[quote author="villamany"] Hello Ramon, i reply your private message by this way. I also have the FI8908W camera (the original foscam with wifi). Have you tried to upload the original foscam firmware by UART?
I can send you the c# sources of application that I use for SPI flash memory reading/writing. But it is not finished and I can not guarantee you work. I got what I needed (my camera MD80 without timestamp) and i leave the application.
I would recommend you to use FlashROMto read / write memory in your camera because it is a more reliable application.
If you still want the c# sources let me know. Good luck.
Greetings ...
[/quote]
Hi Villamany,
Thanks for your reply! I have tried about every Foscam firmware there is to be found on the internet, none of them work on my cam. I suspect that foscam has added a hardware check in the firmware and if a specific part is not found it resets the camera, thats what happens with my camera if I load the Focam recovery firmware it completely boots up but when it is almost finished it says i2c write error and sends a reboot signal. If you are willing to share the source that would be very cool!
After all recent unbricking success story's I hope you can help me with something. I have recently bought 4 IP Cameras from here: http://www.chinavasion.com/product_info.php/pName/ip-surveillance-camera-with-angle-control-and-motion-detection/ It is a so called Foscam Camera Clone from China I tried to update a camera with an original Foscam firmware with the result of bricking the camera. I have tried averything I could find on the internet to debrick a Foscam Clone, but nothing helps. It is not totally bricked I can connect a serial (TTL) device to it (3.3v) and can access the bootloader, only I do not have an original ChinaVasion firmware.
The thing I want to do is this: I want to get the original firmware of a camera that still workes and put it on the bricked one! I hope I can do this with the Bus Pirate, but I really do not have a clue how I can do this! I hope you guys can help me out here.
Some more info:
The FLASH chip: SPANSION S19GL032ATFA00B0 it is a obsolete chip and all I could find was its replacement is the SPANSION S29GL032
The CPU is a ARM7 Nuvoton:
I really hope someone can help me reading out the content of the SPANSION FLASH chip somehow!
Thanks Ian! There are more and more people discovering those Sure Electronics screens, I have found various code samples, but most of them are for Arduino like systems. I have attached 4 files. The SourceSample.txt is from Sure Electronics. The ht1632_write_Commands.h, ht1632_Commands and Source file.txt are from: http://pasanmicroprojects.wordpress.com/2010/02/18/ht1632-successfully-interfaced-with-pic-mcu/ But is written in MikroC.
Can't wait Ian, oh by the way, we both have the Sure Electronics 24x16 boards, but I just ordered 10 8x32 displays so if there is anyway you could support thos too that would be supurb!
Unfortunatly I'm not an electrical engineer by far! I like electronics and even more I like led's The code I posted earlier is code from the manufacturer of the displays (Sure Electronics) They don't really provided much info for these displays, but thanks to the guys at the arduino forums I could finally use the displays. But the final goal (for me) was always to use them in combination with the Web Platform, I'm just a big sucker for big led displays controlled over the intenernet
