Re: Unbricking IP Camera

Hacking multi-tool. Get one for $30, including worldwide shipping.

Re: Unbricking IP Camera

Postby rvbcrs » Fri Nov 19, 2010 7:39 am

On  top of the register array I measured 3.3 volts!

I now swapped TDO and TDI and now macro mode (2) gives me this:

JTAG>(2)
JTAG INIT CHAIN
JTAGSM: RESET
JTAGSM: RESET->IDLE
JTAGSM: IDLE->Instruction Register (DELAYED ONE BIT FOR TMS)
JTAGSM: IR->IDLE
JTAGSM: IDLE->Data Register
JTAGSM: DR->IDLE
JTAGSM: RESET
JTAGSM: RESET->IDLE
JTAGSM: IDLE->Data Register
0xFA DEVICE(S) IN JTAG CHAIN
0x01 : 0x00 0x00 0x00 0x00
0x02 : 0x00 0x00 0x00 0x00
0x03 : 0x00 0x00 0x00 0x00
0x04 : 0x00 0x00 0x00 0x00
0x05 : 0x00 0x00 0x00 0x00
0x06 : 0x00 0x00 0x00 0x00
0x07 : 0x00 0x00 0x00 0x00
0x08 : 0x00 0x00 0x00 0x00
0x09 : 0x00 0x00 0x00 0x00
0x0A : 0x00 0x00 0x00 0x00
0x0B : 0x00 0x00 0x00 0x00
0x0C : 0x00 0x00 0x00 0x00
0x0D : 0x00 0x00 0x00 0x00
0x0E : 0x00 0x00 0x00 0x00
0x0F : 0x00 0x00 0x00 0x00
0x10 : 0x00 0x00 0x00 0x00
0x11 : 0x00 0x00 0x00 0x00
0x12 : 0x00 0x00 0x00 0x00
0x13 : 0x00 0x00 0x00 0x00
0x14 : 0x00 0x00 0x00 0x00
0x15 : 0x00 0x00 0x00 0x00
0x16 : 0x00 0x00 0x00 0x00
0x17 : 0x00 0x00 0x00 0x00
0x18 : 0x00 0x00 0x00 0x00
0x19 : 0x00 0x00 0x00 0x00
0x1A : 0x00 0x00 0x00 0x00
0x1B : 0x00 0x00 0x00 0x00
0x1C : 0x00 0x00 0x00 0x00
0x1D : 0x00 0x00 0x00 0x00
0x1E : 0x00 0x00 0x00 0x00
0x1F : 0x00 0x00 0x00 0x00
0x20 : 0x00 0x00 0x00 0x00
0x21 : 0x00 0x00 0x00 0x00
0x22 : 0x00 0x00 0x00 0x00
0x23 : 0x00 0x00 0x00 0x00
0x24 : 0x00 0x00 0x00 0x00
0x25 : 0x00 0x00 0x00 0x00
0x26 : 0x00 0x00 0x00 0x00
0x27 : 0x00 0x00 0x00 0x00
0x28 : 0x00 0x00 0x00 0x00
0x29 : 0x00 0x00 0x00 0x00
0x2A : 0x00 0x00 0x00 0x00
0x2B : 0x00 0x00 0x00 0x00
0x2C : 0x00 0x00 0x00 0x00
0x2D : 0x00 0x00 0x00 0x00
0x2E : 0x00 0x00 0x00 0x00
0x2F : 0x00 0x00 0x00 0x00
0x30 : 0x00 0x00 0x00 0x00
0x31 : 0x00 0x00 0x00 0x00
0x32 : 0x00 0x00 0x00 0x00
0x33 : 0x00 0x00 0x00 0x00
0x34 : 0x00 0x00 0x00 0x00
0x35 : 0x00 0x00 0x00 0x00
0x36 : 0x00 0x00 0x00 0x00
0x37 : 0x00 0x00 0x00 0x00
0x38 : 0x00 0x00 0x00 0x00
0x39 : 0x00 0x00 0x00 0x00
0x3A : 0x00 0x00 0x00 0x00
0x3B : 0x00 0x00 0x00 0x00
0x3C : 0x00 0x00 0x00 0x00
0x3D : 0x00 0x00 0x00 0x00
0x3E : 0x00 0x00 0x00 0x00
0x3F : 0x00 0x00 0x00 0x00
0x40 : 0x00 0x00 0x00 0x00
0x41 : 0x00 0x00 0x00 0x00
0x42 : 0x00 0x00 0x00 0x00
0x43 : 0x00 0x00 0x00 0x00
0x44 : 0x00 0x00 0x00 0x00
0x45 : 0x00 0x00 0x00 0x00
0x46 : 0x00 0x00 0x00 0x00
0x47 : 0x00 0x00 0x00 0x00
0x48 : 0x00 0x00 0x00 0x00
0x49 : 0x00 0x00 0x00 0x00
0x4A : 0x00 0x00 0x00 0x00
0x4B : 0x00 0x00 0x00 0x00
0x4C : 0x00 0x00 0x00 0x00
0x4D : 0x00 0x00 0x00 0x00
0x4E : 0x00 0x00 0x00 0x00
0x4F : 0x00 0x00 0x00 0x00
0x50 : 0x00 0x00 0x00 0x00
0x51 : 0x00 0x00 0x00 0x00
0x52 : 0x00 0x00 0x00 0x00
0x53 : 0x00 0x00 0x00 0x00
0x54 : 0x00 0x00 0x00 0x00
0x55 : 0x00 0x00 0x00 0x00
0x56 : 0x00 0x00 0x00 0x00
0x57 : 0x00 0x00 0x00 0x00
0x58 : 0x00 0x00 0x00 0x00
0x59 : 0x00 0x00 0x00 0x00
0x5A : 0x00 0x00 0x00 0x00
0x5B : 0x00 0x00 0x00 0x00
0x5C : 0x00 0x00 0x00 0x00
0x5D : 0x00 0x00 0x00 0x00
0x5E : 0x00 0x00 0x00 0x00
0x5F : 0x00 0x00 0x00 0x00
0x60 : 0x00 0x00 0x00 0x00
0x61 : 0x00 0x00 0x00 0x00
0x62 : 0x00 0x00 0x00 0x00
0x63 : 0x00 0x00 0x00 0x00
0x64 : 0x00 0x00 0x00 0x00
0x65 : 0x00 0x00 0x00 0x00
0x66 : 0x00 0x00 0x00 0x00
0x67 : 0x00 0x00 0x00 0x00
0x68 : 0x00 0x00 0x00 0x00
0x69 : 0x00 0x00 0x00 0x00
0x6A : 0x00 0x00 0x00 0x00
0x6B : 0x00 0x00 0x00 0x00
0x6C : 0x00 0x00 0x00 0x00
0x6D : 0x00 0x00 0x00 0x00
0x6E : 0x00 0x00 0x00 0x00
0x6F : 0x00 0x00 0x00 0x00
0x70 : 0x00 0x00 0x00 0x00
0x71 : 0x00 0x00 0x00 0x00
0x72 : 0x00 0x00 0x00 0x00
0x73 : 0x00 0x00 0x00 0x00
0x74 : 0x00 0x00 0x00 0x00
0x75 : 0x00 0x00 0x00 0x00
0x76 : 0x00 0x00 0x00 0x00
0x77 : 0x00 0x00 0x00 0x00
0x78 : 0x00 0x00 0x00 0x00
0x79 : 0x00 0x00 0x00 0x00
0x7A : 0x00 0x00 0x00 0x00
0x7B : 0x00 0x00 0x00 0x00
0x7C : 0x00 0x00 0x00 0x00
0x7D : 0x00 0x00 0x00 0x00
0x7E : 0x00 0x00 0x00 0x00
0x7F : 0x00 0x00 0x00 0x00
0x80 : 0x00 0x00 0x00 0x00
0x81 : 0x00 0x00 0x00 0x00
0x82 : 0x00 0x00 0x00 0x00
0x83 : 0x00 0x00 0x00 0x00
0x84 : 0x00 0x00 0x00 0x00
0x85 : 0x00 0x00 0x00 0x00
0x86 : 0x00 0x00 0x00 0x00
0x87 : 0x00 0x00 0x00 0x00
0x88 : 0x00 0x00 0x00 0x00
0x89 : 0x00 0x00 0x00 0x00
0x8A : 0x00 0x00 0x00 0x00
0x8B : 0x00 0x00 0x00 0x00
0x8C : 0x00 0x00 0x00 0x00
0x8D : 0x00 0x00 0x00 0x00
0x8E : 0x00 0x00 0x00 0x00
0x8F : 0x00 0x00 0x00 0x00
0x90 : 0x00 0x00 0x00 0x00
0x91 : 0x00 0x00 0x00 0x00
0x92 : 0x00 0x00 0x00 0x00
0x93 : 0x00 0x00 0x00 0x00
0x94 : 0x00 0x00 0x00 0x00
0x95 : 0x00 0x00 0x00 0x00
0x96 : 0x00 0x00 0x00 0x00
0x97 : 0x00 0x00 0x00 0x00
0x98 : 0x00 0x00 0x00 0x00
0x99 : 0x00 0x00 0x00 0x00
0x9A : 0x00 0x00 0x00 0x00
0x9B : 0x00 0x00 0x00 0x00
0x9C : 0x00 0x00 0x00 0x00
0x9D : 0x00 0x00 0x00 0x00
0x9E : 0x00 0x00 0x00 0x00
0x9F : 0x00 0x00 0x00 0x00
0xA0 : 0x00 0x00 0x00 0x00
0xA1 : 0x00 0x00 0x00 0x00
0xA2 : 0x00 0x00 0x00 0x00
0xA3 : 0x00 0x00 0x00 0x00
0xA4 : 0x00 0x00 0x00 0x00
0xA5 : 0x00 0x00 0x00 0x00
0xA6 : 0x00 0x00 0x00 0x00
0xA7 : 0x00 0x00 0x00 0x00
0xA8 : 0x00 0x00 0x00 0x00
0xA9 : 0x00 0x00 0x00 0x00
0xAA : 0x00 0x00 0x00 0x00
0xAB : 0x00 0x00 0x00 0x00
0xAC : 0x00 0x00 0x00 0x00
0xAD : 0x00 0x00 0x00 0x00
0xAE : 0x00 0x00 0x00 0x00
0xAF : 0x00 0x00 0x00 0x00
0xB0 : 0x00 0x00 0x00 0x00
0xB1 : 0x00 0x00 0x00 0x00
0xB2 : 0x00 0x00 0x00 0x00
0xB3 : 0x00 0x00 0x00 0x00
0xB4 : 0x00 0x00 0x00 0x00
0xB5 : 0x00 0x00 0x00 0x00
0xB6 : 0x00 0x00 0x00 0x00
0xB7 : 0x00 0x00 0x00 0x00
0xB8 : 0x00 0x00 0x00 0x00
0xB9 : 0x00 0x00 0x00 0x00
0xBA : 0x00 0x00 0x00 0x00
0xBB : 0x00 0x00 0x00 0x00
0xBC : 0x00 0x00 0x00 0x00
0xBD : 0x00 0x00 0x00 0x00
0xBE : 0x00 0x00 0x00 0x00
0xBF : 0x00 0x00 0x00 0x00
0xC0 : 0x00 0x00 0x00 0x00
0xC1 : 0x00 0x00 0x00 0x00
0xC2 : 0x00 0x00 0x00 0x00
0xC3 : 0x00 0x00 0x00 0x00
0xC4 : 0x00 0x00 0x00 0x00
0xC5 : 0x00 0x00 0x00 0x00
0xC6 : 0x00 0x00 0x00 0x00
0xC7 : 0x00 0x00 0x00 0x00
0xC8 : 0x00 0x00 0x00 0x00
0xC9 : 0x00 0x00 0x00 0x00
0xCA : 0x00 0x00 0x00 0x00
0xCB : 0x00 0x00 0x00 0x00
0xCC : 0x00 0x00 0x00 0x00
0xCD : 0x00 0x00 0x00 0x00
0xCE : 0x00 0x00 0x00 0x00
0xCF : 0x00 0x00 0x00 0x00
0xD0 : 0x00 0x00 0x00 0x00
0xD1 : 0x00 0x00 0x00 0x00
0xD2 : 0x00 0x00 0x00 0x00
0xD3 : 0x00 0x00 0x00 0x00
0xD4 : 0x00 0x00 0x00 0x00
0xD5 : 0x00 0x00 0x00 0x00
0xD6 : 0x00 0x00 0x00 0x00
0xD7 : 0x00 0x00 0x00 0x00
0xD8 : 0x00 0x00 0x00 0x00
0xD9 : 0x00 0x00 0x00 0x00
0xDA : 0x00 0x00 0x00 0x00
0xDB : 0x00 0x00 0x00 0x00
0xDC : 0x00 0x00 0x00 0x00
0xDD : 0x00 0x00 0x00 0x00
0xDE : 0x00 0x00 0x00 0x00
0xDF : 0x00 0x00 0x00 0x00
0xE0 : 0x00 0x00 0x00 0x00
0xE1 : 0x00 0x00 0x00 0x00
0xE2 : 0x00 0x00 0x00 0x00
0xE3 : 0x00 0x00 0x00 0x00
0xE4 : 0x00 0x00 0x00 0x00
0xE5 : 0x00 0x00 0x00 0x00
0xE6 : 0x00 0x00 0x00 0x00
0xE7 : 0x00 0x00 0x00 0x00
0xE8 : 0x00 0x00 0x00 0x00
0xE9 : 0x00 0x00 0x00 0x00
0xEA : 0x00 0x00 0x00 0x00
0xEB : 0x00 0x00 0x00 0x00
0xEC : 0x00 0x00 0x00 0x00
0xED : 0x00 0x00 0x00 0x00
0xEE : 0x00 0x00 0x00 0x00
0xEF : 0x00 0x00 0x00 0x00
0xF0 : 0x00 0x00 0x00 0x00
0xF1 : 0x00 0x00 0x00 0x00
0xF2 : 0x00 0x00 0x00 0x00
0xF3 : 0x00 0x00 0x00 0x00
0xF4 : 0x00 0x00 0x00 0x00
0xF5 : 0x00 0x00 0x00 0x00
0xF6 : 0x00 0x00 0x00 0x00
0xF7 : 0x00 0x00 0x00 0x00
0xF8 : 0x00 0x00 0x00 0x00
0xF9 : 0x00 0x00 0x00 0x00
0xFA : 0x00 0x00 0x00 0x00
JTAGSM: DR->IDLE
JTAG>
rvbcrs
Jr. Member
Jr. Member
 
Posts: 65
Joined: Mon Aug 10, 2009 12:34 am

Re: Unbricking IP Camera

Postby ian » Fri Nov 19, 2010 11:10 am

It looks like that didn't work.

Did you do normal pin type (option 2)?

Since it is an ARM, maybe you'll have better luck with OpenOCD. I've been playing with a windows compile of v4, but I don't know if it has BUs Pirate support (sorry, I couldn't find the link where I downloaded it).
Got a question? Please ask in the forum for the fastest answers.
User avatar
ian
Crew
Crew
 
Posts: 10578
Joined: Mon Jul 06, 2009 6:14 am

Re: Unbricking IP Camera

Postby Fishie » Sun Jan 02, 2011 3:20 pm

Hello,

i own two pieces of this camera from chinavasion. One is bricked. Second is ok.

Beware! This camera is not Foscam clone on hardware basis! This is why you cannot use ordinary Foscam firmwares. Look on board and you'll see IP607SZ or something like that. This clone uses another kernel drivers because of little bit different hardware.
Through support i got original firmware for this camera and through non official sources ;-) i got documentation to bootloader and and development kit on which is camera build upon. Development kit and embedded linux distro is same as for Foscam, but kernel and rootfs image is build differently for each cam due reasons mentioned above.

Here is the link for firmware: http://download.chinavasion.com/downloa ... LM-I33.zip

Enclosing two files with firmware basis, one packed kernel, second rootfs:

Link for recovery files extracted from firmware: http://www.uloz.to/7215855/camera-ip607-zip

linux.zip
romfs.img

Address boundaries parameters for bootloader:
linux.zip-0x7f020000 0x8000(code execution address in RAM), end address is recomputed automatically by bootloader from file size

romfs.img-0x7f0e0000 0x7f0e0000

After uploading it is necessary to execute windows ip cam tool thingy and upload web interface files. Camera should appear in this tool after kernel boots and romfs is mounted. Please watch patiently for output from UART port for messages!

BTW:Those who developed Foscam and IP607 are total noobs!!! They have nice SDK and quite inteligent bootloader can load new firmware to RAM or flash it via TCP/IP. Even bootloader is manageable over telnet session. But its disabled! Enabling few options and opening camera is not necessary. Unbelievable how some hw developers are total (censored word). My bricked camera is because this noobs not locked address space as read only via JTAG, so changing ip address on camera and internal software fault probably damanged bootloader accessing this area for whatever reason. Even when address space is not lockable on hardware basis(some lower arms can't do) then can set address boundaries as kernel parameters for filesystem.
Fishie
Newbie
Newbie
 
Posts: 2
Joined: Sun Jan 02, 2011 1:52 pm

Re: Unbricking IP Camera

Postby rvbcrs » Sun Jan 02, 2011 5:48 pm

Fishie wrote:Hello,

i own two pieces of this camera from chinavasion. One is bricked. Second is ok.

Beware! This camera is not Foscam clone on hardware basis! This is why you cannot use ordinary Foscam firmwares. Look on board and you'll see IP607SZ or something like that. This clone uses another kernel drivers because of little bit different hardware.
Through support i got original firmware for this camera and through non official sources ;-) i got documentation to bootloader and and development kit on which is camera build upon. Development kit and embedded linux distro is same as for Foscam, but kernel and rootfs image is build differently for each cam due reasons mentioned above.

Here is the link for firmware: http://download.chinavasion.com/downloa ... LM-I33.zip

Enclosing two files with firmware basis, one packed kernel, second rootfs:

Link for recovery files extracted from firmware: http://www.uloz.to/7215855/camera-ip607-zip

linux.zip
romfs.img

Address boundaries parameters for bootloader:
linux.zip-0x7f020000 0x8000(code execution address in RAM), end address is recomputed automatically by bootloader from file size

romfs.img-0x7f0e0000 0x7f0e0000

After uploading it is necessary to execute windows ip cam tool thingy and upload web interface files. Camera should appear in this tool after kernel boots and romfs is mounted. Please watch patiently for output from UART port for messages!

BTW:Those who developed Foscam and IP607 are total noobs!!! They have nice SDK and quite inteligent bootloader can load new firmware to RAM or flash it via TCP/IP. Even bootloader is manageable over telnet session. But its disabled! Enabling few options and opening camera is not necessary. Unbelievable how some hw developers are total (censored word). My bricked camera is because this noobs not locked address space as read only via JTAG, so changing ip address on camera and internal software fault probably damanged bootloader accessing this area for whatever reason. Even when address space is not lockable on hardware basis(some lower arms can't do) then can set address boundaries as kernel parameters for filesystem.






Hi Fishie!

Happy new year to you and all other members on this board!

I have tried you restore formware files but unfortunatly it doesn't work for my cam. I bought my cam at www.chinavasion.com. and the board says: ES_IP607_ARM_2.

When I upload the firmware you provided it the camera boots but like with all other firmwares I have tried at the end I get this message:

write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
myreboot

and the camera ends in a loop of reboots. Is it possible that I'm doing something wrong? or do I have a different cam?

Thanks,

Ramon
rvbcrs
Jr. Member
Jr. Member
 
Posts: 65
Joined: Mon Aug 10, 2009 12:34 am

Re: Unbricking IP Camera

Postby Fishie » Wed Jan 05, 2011 6:30 pm

We have probably same cameras and same serries. I am going to send wrong camera back so no experiments will be possible on my side.
Have you tried command del -all in bootloader prior loading images? This deletes all flash memory except bootloader itself. There could be some "dust" remaining in flash memory.  From this point you have to upload firmware images. You can list existing images by "ls". If this table is already damanged please upload firmware images and set attributes(with attrib command).
romfs image have attribute -f and linux image have flags -acxz. But i am not sure because a don't have access to my notes now. Bootloader have good help, you can figure you commands work pretty quicly using "h" command.

Is i2c error after kernel boot or prior it? It means that device can't communicate over internal i2c bus. Which could be also hardware fault. Can you please paste messages before this error message?
Try to reset configuration-press reset for 10secs while camera connected to the power and UART port. Investigate whether error messages was changed.

My camera is bricked harder way. Bootloader cant unzip image and hangs with illegal instruction on the same addres with different firmwares and in different memory areas.. However verification of memory seems to be ok. But even when i move location of kernel image to different area it can't be unpacked. However camera can boot not packed kernel or boot it from network and this means that RAM or part of it is ok. Memory verification tests are also ok.
My proposal is damanged bootloader or flash memory bootloader area. Only way how to diagnose this is JTAG.
Fishie
Newbie
Newbie
 
Posts: 2
Joined: Sun Jan 02, 2011 1:52 pm

Re: Unbricking IP Camera

Postby rvbcrs » Fri Jan 07, 2011 4:38 am

Hi Fishie,

I had 4 cameras of chinavasion, 2 are now bricked because of my wrongfully experimenting. I already tried every firmware I found on the internet, I did it with the parameters you said, but it alwas ends with a myReboot command and the cam reboots. This is the log of a faulty camera:

W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on May 11 2010
Memory Size is 0x1000000 Bytes, Flash Size is 0x400000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

        MAC Address        : 00:0C:5D:75:1C:18
        IP Address          : 0.0.0.0
        DHCP Client        : Enabled
        CACHE              : Enabled
        BL buffer base      : 0x00300000
        BL buffer size      : 0x00100000
        Baud Rate          : -1
        USB Interface      : Disabled
        Serial Number      : 0xFFFFFFFF


For help on the available commands type 'h'

Press ESC to enter debug mode ......
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #1042 Ò» 12ÔÂ 7
05:49:33 CST 2009
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 2048
zone(0): 0 pages.
zone(1): 2048 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 8MB = 8MB total
Memory: 6272KB available (1447K code, 284K data, 40K init)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
PTZ Driver has been installed successfully.
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options en
abled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Winbond W90N7451 Serial driver version 1.0 (2005-08-15) with no serial options e
nabled
ttyS00 at 0xfff80100 (irq = 10) is a W90N7451
I2C Bus Driver has been installed successfully.
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0E0000-7F16CFFF [VIRTUAL 7F0E0000-7F16CFFF] (RO)
S29GL032N Flash Detected
01 eth0 initial ok!
which:0
PPP generic driver version 2.4.2
Linux video capture interface: v1.00
Winbond Audio Driver v1.0 Initialization successfully.
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver audio
audio.c: v1.0.0:USB Audio Class driver
usb.c: registered new driver serial
usbserial.c: USB Serial Driver core v1.4

_____    ____    _    ____
|__  /  _|  _ \  / \  / ___|
  / / | | | | | |/ _ \ \___ \
/ /| |_| | |_| / ___ \ ___) |
/____\__, |____/_/  \_\____/
    |___/
ZD1211B - version 2.24.0.0
usb.c: registered new driver zd1211b
main_usb.c: VIA Networking Wireless LAN USB Driver 1.13
usb.c: registered new driver vntwusb
usb.c: registered new driver rt73
dvm usb cam driver 0.0.0.0 by Maverick Gao in 2006-8-12
usb.c: registered new driver dvm
dvm usb cam driver 0.1 for sonix288 by Maverick Gao in 2009-4-20
usb.c: registered new driver dvm usb cam driver for sonix288
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: /bin/init
Command: mount -t proc none /proc
Command: mount -t ramfs none /usr
Command: mount -t ramfs none /swap
Command: mount -t ramfs none /var/run
Command: mount -t ramfs none /etc
Command: mount -t ramfs none /flash
Command: mount -t ramfs none /home
Command: camera&
[8]
Command: sh

Sash command shell (version 1.1.1)
no support
/> hub.c: connect-debounce failed, port 1 disabled
new USB device :807dce04-7e8640
hub.c: new USB device 1, assigned address 2
dvm cmos successfully initialized
dvm camera registered as video0
new USB device :807cf204-7e8640
hub.c: new USB device 2, assigned address 3
idVendor = 0x148f, idProduct = 0x2573

Wait for auto-negotiation complete...ResetPhyChip Failed
video0 opened
1
1
1
1
1
1
set resolution 4
set brightness 100
set contrast 4
set sharpness 3
set mode 0
__pthread_initial_thread_bos:348000
manage pid:16
audio_dev.state not AU_STATE_RECORDING
wb_audio_start_record
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth0
[29]
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
myreboot

I need to get a way to read the original firmware from a working camera and flash that back to a bricked one. I guess the only two options are through the bootloader (but I don't know how) or via JTAG ( I don't know how) :)

I found a site that describes how to use JTAG to flash back a bootloader with the same ARM chip as the camera is using, but I can't really understand what they are doing.
http://www.wiki.kslemb.com/doku.php/uboot/install
rvbcrs
Jr. Member
Jr. Member
 
Posts: 65
Joined: Mon Aug 10, 2009 12:34 am

Re: Unbricking IP Camera

Postby kslemb » Sat Jan 08, 2011 7:26 am

Try to explain what "they" had in mind...

We created this wiki to facilitate the process of writing programs for ARM7 chips from Nuvoton.
We are not satisfied with WBL bootloader so we decided to port the uBoot bootloader  to our own platform w90p1.
Image
The process of installing uBoot bootloader on our board is shown on the link specified by you.
You can freely use our OpenOCD scripts for work with you camera.

You need to consider the following points:
1. We use W90P710 chip not W90P745 (In my opinion the only difference is the graphics controller presence).
2. You board have another SDRAM configuration (as I see on snapshot, board use only one chip w9812g6).

For read image from CFI flash mounted on board you mast use the Wiggler JTAG or change "interface" section
in the 'w90p710.cfg' script for use FTDI JTAG clone.
Next you must change SDRAM configuration in the 'w90p710_reset' script.
For w9812g6 SDRAM (2M x 16BITS x 4Banks) SDCONF0 must be 0x000090CC (correct if I'm wrong).

Next connect you JTAG to the board
Copy modified w90p710.cfg and w90p710_reset.script to the /usr/local/lib/openocd/target folder.
Start OpenOCD (with '-f' key specify target board script and with '-s' key specify a path to the script file)
    openocd -fw90p710.cfg -s/usr/local/lib/openocd/target
Starting telnet in terminal window for work with OpenOCD
    telnet localhost 4444
Identify the CFI Flash memory connected to you SoC
  flash probe 0
Read this article for understanding flash manipulation:
    http://openocd.berlios.de/doc/html/Flas ... h-Commands
Dump image from the CFI Flash memory
    dump_image filename 0x7F000000 0x400000
Enjoying a file, or asking some questions if something does not happen :-)

I could be wrong so please do not judge strictly...

Konstantin Vovk
Attachments
w90p1.png
kslemb
Newbie
Newbie
 
Posts: 2
Joined: Sat Jan 08, 2011 4:58 am

Re: Unbricking IP Camera

Postby shanghailoz » Sun Jan 23, 2011 1:20 am

@kslemb - heheh :)

@fish -

You need to identify what exact hardware you have.  eg the chipset of the camera ic, and the camera sensor.
If these are not correct, then the driver won't work, and camera will call for a reset.

Suggest read here - http://www.computersolutions.cn/blog/20 ... ng-part-7/

I'll need your VID / PID of the camera for starters, so I can see what hardware you have.

You may need to change the PID of the camera IC or the PID coded into the driver so that they match.

Can you compile your own kernel?  (Check my posts on setting up the BSP environment on my blog if not).  I'd suggest enabling usb debugging in the kernel, removing the camera executable, then  looking at the logs.

http://www.linux-usb.org/FAQ.html#gs4 also has a few tips too that may be useful.

Especially the one about taking a look at /proc/bus/usb

Also whats in /proc/video ?

Whats in yours?

After taking a longish look at code today and last night, I suspect we might be able to use the ov511 driver code to do this with a bit of effort.
Might be worth it so I can write a driver that handles more devices, so that we can have 1 firmware for multiple units.


Lawrence.
shanghailoz
Newbie
Newbie
 
Posts: 4
Joined: Sat Jan 22, 2011 11:46 pm

Re: Unbricking IP Camera

Postby kslemb » Tue Jan 25, 2011 2:41 pm

Not all the camera broke?
If not, then we go to you for help... :-)

Good work Lawrence.
Nice blog about Nuvoton chip and USB camera.

Probably should have joint forces and write open firmware for Webcam and create open hardware.
Can choose spca Linux kernel webcams driver and port it to our platform.
http://mxhaard.free.fr/spca5xx.html
kslemb
Newbie
Newbie
 
Posts: 2
Joined: Sat Jan 08, 2011 4:58 am

Re: Unbricking IP Camera

Postby shanghailoz » Wed Jan 26, 2011 11:45 pm

I'm pretty sure it works already.

Just need to patch the usb in existing BSP, then compile the driver in the module.

cd your ucLinux folder ...linux/drivers/usb folder

wget http://mxhaard.free.fr/spca50x/embedded ... tch.tar.gz
tar -xzvf usb-2.4.31LE06.patch.tar.gz
patch -p1 < usb-2.4.31.patch

Check what if anything else needs to be done as ours is an older kernel in the bsp.

make menuconfig - add in the from USB support ---> USB Multimedia devices
<M> USB SPCA5XX Sunplus Vimicro Sonix Cameras

compile up.
..make, make dep etc
genromfs yadda yadda
write your kernel to your device, boot up.


mknod /dev/video0 c 81 0
insmod spca5xx.o

Should see something similar to

#insmod spca5xx.o
usb.c: registered new driver spca5xx
spca_core.c: USB SPCA5XX camera found. Type Vimicro Zc301P 0x301b
spca_core.c: spca5xx driver 00.57.06LE registered
#

Then have fun...

*Haven't tried it yet, will do so later, but others have it running on Nuvoton/Winbond W90N710, so should work fine on the 745, as they're pretty similar.

Have moved all my (public) work on these models to http://www.openipcam.com for those that are interested in this topic, and want to contribute.

Lawrence.
shanghailoz
Newbie
Newbie
 
Posts: 4
Joined: Sat Jan 22, 2011 11:46 pm

Re: Re: Unbricking IP Camera

Postby casbeto » Mon Mar 14, 2011 7:58 pm

Dear,

I already have the original firmware ES_IP607_ARM2, and you could tell me how to connect and where can I find the pins to connect the TTL serial device to it (v 3.3).

thanks
Carlos Alberto
casbeto
Newbie
Newbie
 
Posts: 4
Joined: Mon Mar 14, 2011 7:22 pm

Re: Unbricking IP Camera

Postby shanghailoz » Mon Mar 14, 2011 10:59 pm

Carlos - Serial I/O is the one cunningly labelled TX,RX, GND and 3.3v on the board.
They made it really hard, I know..

You can check my forum here - http://www.openipcam.com, as I have serial and jtag labelled on there.


Underside:
http://www.openipcam.com/files/generic_arm7_2mflash_motherboard.jpg
(J2 is at the very bottom).

Reverse side:
http://www.flickr.com/photos/sheedl/5496013459/in/set-72157626067653111/lightbox/
(J2 is on the left hand side)


Board # -> rs232/ttl adaptor.
1 -> RX
2 -> TX
3 -> GND
4 -> VCC
shanghailoz
Newbie
Newbie
 
Posts: 4
Joined: Sat Jan 22, 2011 11:46 pm

Re: Re: Unbricking IP Camera

Postby casbeto » Tue Mar 15, 2011 5:19 am

Thanks shanghailoz,

My IPCAM ES_IP607_ARM_2 is equal to the colleague rvbcrs not open it completely, will I have to solder the 4 pin?

Carlos Alberto
Attachments
DSCF2700.jpg
casbeto
Newbie
Newbie
 
Posts: 4
Joined: Mon Mar 14, 2011 7:22 pm

Re: Re: Unbricking IP Camera

Postby shanghailoz » Tue Mar 15, 2011 3:23 pm

If you want serial access, then you'll need to connect a TTL -> Serial adaptor to the correct pins as per my above post.

You need serial access to get at the bootloader, and the linux prompt on the hardware (assuming you're running stock firmware).
shanghailoz
Newbie
Newbie
 
Posts: 4
Joined: Sat Jan 22, 2011 11:46 pm

Re: Re: Unbricking IP Camera

Postby casbeto » Wed Mar 16, 2011 7:10 pm

Dear shanghailoz, weld the 4 pins on J2 as the photo below, Can I use this converter photo below? because in this board 3.5ve this photo I do not know if you have problems with voltage once again thank you for the information.

Thanks
Carlos Alberto
Attachments
rs232plug.jpg
placa.JPG
casbeto
Newbie
Newbie
 
Posts: 4
Joined: Mon Mar 14, 2011 7:22 pm

PreviousNext

Return to Bus Pirate Support