Bring your FI8908W paperweight back to life

If you're part of the numerous people who bricked their ip camera at any stage, maybe you kept it (as a door stopper, a paperweight or a dummy camera). In that case, there is one last thing you can try to make your camera functional again. It requires a small investment of less than €15 so I think it's really worth trying.

I obtained some information recently, thanks to Foscam tech support for most part, on a serial upgrade method that would fix cameras for which the firmware upgrade went bad.


A word of caution first: 
- I've only tested this method with the oldest FI8908W, not the Foscam "Logo" FI8908W  (fw v.11.14.2.26 and up).
- this should be experimented only if you exhausted your other options, like claiming a replacement under the warranty.
- this is also not guaranteed to work for all. It suppose that the boot loader in the camera is still intact.
- the recovery files are not normal firmware upgrade files and cannot be uploaded to the camera using the normal firmware upgrade procedure.

What you need:

- a USB to serial UART interface that does 3.3v logic (see photos). If dual 3.3v/5v is not specified, assume it does 5v only and don't buy. This should not cost you more than €15.

- some wires and female crimp pins to make the connections easier. I reused those from an audio cable for CD-ROM.

- the Foscam  FI8908W Recovery files (+ mirror) - They contain instructions and binaries to upload.
2011 Update: I've received these other recovery files (+ mirror) from Foscam and should work with newer FI8908W AND FI8918W

- a terminal software if you don't have HyperTerminal on your version of Windows. I suggest RealTerm.
- I also used some adhesive putty to help keeping the wires in place and isolate the wires from each other.

You have to unscrew the bottom cover of the camera to access the JTAG connector (marked J2). On some cameras the connector is there but without the pins; In this case, add a solder iron to the "What you need" list. The only challenging task will be to achieve a stable connection to it for the length of the operation.





In the documentation, the file IPCAM_PCB_Connection.xls shows where to connect the wires. The 4 pins, from right to left are used as follow:
Pin #1 - INPUT
Pin #2 - OUTPUT
Pin #3 - GROUND
Pin #4 - POWER (not needed)

The serial interface you buy may have more than 4 pins but the corresponding ones will usually be labeled as TXD, RXD, GRD and VCC. One important point is that you need to cross INPUT with TXD, and OUTPUT with RXD.

The file IpCam serial upgrade.pdf will tell you how to initiate the connection with the boot loader of the camera and what commands to issue in order to upload the recovery files, linux_4Mx16Bit_new.zip and romfs_cmos_11_14_2_17.img (for FI8908W and FI8904W)  into the camera. (included W90N745 uClinux BSP User Manual.pdf documents the uClinux commands).

Once your wires are connected, power on the camera, and if you see a screen like the one below, the rest should be straightforward.

Below is the documented procedure as it worked for me. In bold is what you type and in italic what is returned (don't forget to press ESC to enter debug mode as told on screen).

You can also watch this video as an example to make yourself familiar with the procedure.

---

bootloader > del 6
ERROR: Image 6 is not existed   (there was obviously nothing to delete in my case)

bootloader > del 7
ERROR: Image 7 is not existed

with the new recovery files the address to use below has changed

bootloader > fx 6 romfs_cmos_11_14_2_17.img 0x7f0e0000 0x7f0e0000 -a
Waiting for download
Press Ctrl-x to cancel ...  (while it waits, you have to select Transfer > Send File in Hyperterminal menu, choose the Xmodem protocol and select the file romfs_cmos_11_14_1_37.img)
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Flash programming ...
.........
bootloader > fx 7 linux_4Mx16Bit_new.zip 0x7f020000 0x8000 -acxz
Waiting for download
Press Ctrl-x to cancel ...  (while it waits, you have to select Transfer > Send File in Hyperterminal menu, choose the Xmodem protocol and select the file linux.zip)
CCCC
Flash programming ...
..........
bootloader > del b31 (Clears the flash parameters)

bootloader > boot

Rebooting the system ...

---

The camera will boot and probably start moving during the initial check up phase, it's back !

The camera may report that no Web-UI is present. In that case, use the IP Camera Tool to flash a normal WebUI file the traditional way (don't use the recovery file for this).

---

Something for non-Foscam devices:
I don't want to be Foscam-centric, it's just that I only have Foscam devices at the moment, so I'll put here similar recovery packages for non-Foscam cameras when available and to the limit of my free storage (mainly FileFactory & Google Docs). They're provided as is and I have no way to test them.

IP607 (EyeSight) found @ Chinavasion: This recovery package is the result of concerted efforts of the ip cam hackers
commenting below this post. It's been  made available by Admin  (mirror) and contains the adjustments to the fx 6... line. Please follow the instructions in the help.txt.

EasyNP FS 613A M136: Check this very detailed recovery guide from Oskys!

Changing the MAC address
Some clones, mostly from DealExtreme.com apparently came with the same MAC address, making it impossible to use them together in the same network. An easy way is documented here (mirror). I didn't test it, but according to the feedbacks on Ted's blog, it seems to work great.