jan
14
2011
.NET // Electronics // Gadgets

Foscam Clone Recovery (Part 2)

Author An article by Ramon van Bruggen    Comments 18 Comments

To follow up on my previous post, the news is that I have successfully dumped all firmware parts of my camera. The bad news is that it didn’t work on my camera.

The problem is this:

audio_dev.state not AU_STATE_RECORDING
wb_audio_start_record
inet_sr.c INET_rinput 321
action===1
options==33
inet_sr.c INET_setroute 75
*args===255.255.255.255
*args===netmask
*args===eth0
[29]
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
write i2c error
myreboot

Every time the camera is almost at the end of the boot process it try’s to read “something” and after that fails it reboots itself!! The problem is that this is exact the same problem I have with all firmware’s I tried.

I start to think that in the newest revisions of the camera’s there is some sort of security chip build in the camera and if the firmware doesn’t detect this chip or some kind of CRC code it reboots!

Another strange thing I have seen is that when you flash the “romfs.img” part to the camera it changes. I made a dump of the “romfs.img” part and it is different then the image I flashed to it, but is exactly the same as what is on the camera.

I’m going to attach my tool to this post for others to experiment with it. You have to remember that this is “total, your on your own software!!” I’m not responsible for any form of damage the tool might cause to your camera! Ok well with that out of the way, a little bit of explanation of how the tool works.

Step 1

Step1

Press the browse button to select a folder to dump the firmware to.

Step2

Step 2

Choose the port where you RS232 device is and select “Open Port”

Step3

Step 3

After you clicked on the “Open Port” button you have to connect your camera, if all goes well you will see the message “Camera is in ‘Bootloader’ mode”

 

 

Step4

Step 4

Click on the “Dump Firmware button

Step5

Step 5

Choose the firmware images you want to dump and click the “Dump” button

Step7

Step 6

The tool will start dumping the selected images and if all goes well you will end up with a working copy of your firmware.

Step8

I have to say, because the tool uses RS232 serial communication to dump the firmware it is not very stable, it is very likely that you won’t succeed to dump the firmware straight away, it will probably take a few times to get it right, but I wanted to share the tool for those who might find it useful.

You can download the tool here:

Foscam Clone Recovery Tool (2031)

Cheers,

Ramon

About the Author: Ramon van Bruggen

18 Comments + Add Comment

  • JoaoPaulo januari 14, 2011 om 5:32 pm

    Nice work. I will dump the firmware from my IP Camera (my office room) and try to recover my own IP camera.

    I will keep posted this blog with my result.

    Thanks !!!

  • Lawrence januari 22, 2011 om 1:06 pm

    The Camera executable reboots the camera if it can’t talk to the hardware.

    Which, in this case, it can’t. (hence the i2c errors).

    Also, depending on your flash size, you may find the webui is flashed into an existing romfs image (at the end where there is lots of free space).

    Have you taken a look at the bin and the rom file you dumped for comparison in a hex editor?

    Suggest do a diff of both to see where its different.

    Unix is much easier to do that with, than windows.

    I don’t recommend people futzing with random firmware on camera’s – the factory makes these for a number of different companies, and you do get variations on the hardware. eg CMOS camera vs CCD camera, less flash, more flash, no wifi, with wifi etc.
    You’ll need to identify what camera module you are using to see what firmware is right for you.

    I’ll be putting some more info up on my computersolution blog soonish – bought new tools to replace the stolen ones..

    Lawrence.

  • Wan januari 30, 2011 om 11:22 am

    Hi guys,

    Glad to see the progress thats been reached so far. I believe I may have the factory firmware as well as the factory webui for the clone foscam (Nuvoton chip) and was wondering if it could help with the unbricking process. I have not attempted to flash my bricked clone foscam as I have yet to figure out how to go abt soldering the necessary wires needed to access the bootloader etc.

    I have however tried via the IP Cam Tool app and managed to get abt half way through but the update failed. I also made the mistake of flashing mine with a Foscam fw update which bricked my camera.

    You might or might not have this firmware but feel free to check it out. Good luck and keep us posted!

    http://rapidshare.com/files/445273400/camera_IP607.zip
    http://rapidshare.com/files/445275566/Updated_software_of_the_item_CVLM-I33.zip

    Cheers,

    Wan

  • Lawrence februari 2, 2011 om 5:04 pm

    I’ve registered a new domain to collect all the various bits of info in one place, and to have a place to discuss this stuff.

    I’ll be updating on http://www.openipcam.com from now on (vs my computersolutions.cn/blog ipcam posts ).

    Ramon, I’ve added your download tool to the site, let me know if you want it taken off or not.

    Lawrence.

  • Ramon van Bruggen februari 2, 2011 om 5:52 pm


    Lawrence:

    I’ve registered a new domain to collect all the various bits of info in one place, and to have a place to discuss this stuff.

    I’ll be updating on http://www.openipcam.com from now on (vs my computersolutions.cn/blog ipcam posts ).

    Ramon, I’ve added your download tool to the site, let me know if you want it taken off or not.

    Lawrence.

    No problem! I’m glad you made the site, now all I hope is that we can revive the two dead camera’s I still have :)

  • everst februari 7, 2011 om 9:20 am

    Hi,
    has a big problem with clone fosca camera, I tried a few firmware or i / o error or i2c error. at this link some photos of the boards and boxes. If anyone of you have similar or knows a solution please help. http://img16.imageshack.us/g/20110207014.jpg/

  • giuseppe februari 14, 2011 om 7:37 pm

    Hi ,
    I am newby and also have a bricked camera togheter a new working camera ( both are Foscam clones).
    I used the above “Foscam recovery too” to recover the good firmware from the good camera.Everything is gone Ok .But now what shall I do ? I got 2 romfs files :o ne is called romfs and the other romfs.dat. Furthermore I got 2 linux file: “linux” and linux.dat files . Total are 4 files .Excuse me but which is the next step ??Thanks

  • giuseppe februari 14, 2011 om 8:53 pm

    Hi to everybody in this forum,
    I am newby but I found interesting this argument about Foscam recovery tool (above).Since I have a bricked foscam clone camera and also a working one, I tried the above tool to recover the firmware (linux.zip and cmos file)from the working camera.The problem is that I got 2 +2 files: linux and linux.dat + cmos +cmos.dat.Total are 4 files from working camera.Now I ask how shall I manage these 4 files .Shall I zip them in 2 files ?? prior to upload them via JTAG port ? Thanks for now .

  • vvi april 13, 2011 om 4:14 am

    Hello. Who did dump their firmware? Share files. Thank you.

  • miriam april 15, 2011 om 10:50 am

    Hello
    I need linux.zip and romfs.img to restore my cam. I had try maygion file but not working, somebody can help me??? i see over my cam and see this IPCAM_PT2_v3.3F_sc. I make a mistake after upgrade firmware :(
    i have try too romfs.img and receive the i2c error error :( please help me!!

  • Tonino mei 29, 2011 om 1:58 pm

    Hi,
    I have the same problem.
    I had upload romfs.img and linux.zip via serial cable with JTAG connector, but I received I2C Error.
    I tried various files found online.
    Someone can help us?

    Thanks.
    Tonino

  • Bubbag juni 30, 2011 om 6:43 pm

    According to some of my blog visitors, the i2c error is indeed caused by a hardware protection. The early Foscams and possibly their copy from dx.com might not have that.

  • Ramon van Bruggen juli 6, 2011 om 6:54 pm

    Yes I have read that to, now we only need a solution for it.. Because up until today I still have two bricked cams!

  • Frank oktober 26, 2011 om 7:23 pm

    Benötige für die Foscam FI8918
    das linux.zip und romfs.img
    Wer hat diese schon mit dem Clone rausgezogen und kann diese mir senden?
    DANKE

  • ely maart 3, 2012 om 5:33 pm

    hello friends. I have the same problem with my camera foscam fi8904w, I so far have not been able to retrieve my camera. I tried to make a copy of the image of another camera identical, but in the time of the udgrade my camera, an error in the Linux unzip.

    some of you have a detailed procedure on how can I make the image of a camera and then make the follower in the other chamber udgrade ..

  • ely maart 3, 2012 om 6:25 pm

    write i2c error
    myreboot

    hi friend, I have the same problem in my new camera FI8904w, I can`t put the new dump linux.zip after that I did the imagen the other same new camera foscam. When I put the image linux in the new camera, the console show this error :
    ” Processing image 7 …
    Unzip image 7 …
    ERROR: unzip failed! -5,

    How I do new linux image that work ?

  • Enricosoft juli 24, 2012 om 9:37 am

    Hi,
    i dumped my camera firmware using this tool but i see there are 4 files.. (linux + linux.dat and romfs + romfs.dat)… why? Are they HEX files o BIN files? How can i convert these files to .BIN?
    Thanks!
  • Giuseppe oktober 14, 2012 om 12:28 pm

    Hi,

    I’ve a briched foscam clone ES-IP607W, with :
    – I2C Error and myreboot at the end.

    Someone has firmware for this model ?.

    Many Thanks !.

Leave a comment