Following my recent uninspiring experience of Digoo BB-M2 and Veskys cameras, I had hopes that the new Wanscam HW0036 would be better, since it's part of the very good HW series.The sad reality is that Wanscam is just selling its branded version of the uninspiring "Netcam inc" camera that already sells under various names like Digoo BB-M2, Veskys, or Cam360. The front face design is probably just an older and less cost-effective conception with 3 screws holding the globe parts together, while the Digoo/Veskys design needs only 1.
As a Netcam inc product, it comes with a flawed Onvif implementation (known issue for over 2 years now) that will make the port 10080 very unreliable.
It also does not support audio through the RTSP channels, and so in turn, not to ONVIF.
It only affects people who want to use this camera with their own NVR solution.
The Wanscam firmware is slightly older (A70.68.1.16.53E/12.9.7.4-en) than its twins and the web interface lacks some options, like muting the annoying voice prompts when the camera starts, that competitors have in their newer firmware (A70.9.1.16.76E/12.9.7.5-en).
However, the missing options in the GUI can be changed by using the appropriate URL. In the example below, the door_bell_set_language.cgi changes/disables the voice prompts:
http://192.168.x.x:81/door_bell_set_language.cgi?next_url=voice.htm&loginuse=admin&loginpas=password&language=0
Valid "language" values: 0 = none, 1 = Chinese, 2 = English
 |
| T10 SoC with Mediatek/B-Link MT7601UN and ULN2803AG |
Wanscam promotes the use of its own camera app, e-View7, however it is also entirely compatible with Netcam360 / Digoocam (both are the same app), and I found this app slightly more complete, and convenient to use with my existing clones from Digoo and Veskys.
Identifying the Wanscam products with Netcam firmware
The HW0036 comes with a unique ID beginning by XHA which has it's own setup category in e-View7 during the setup phase. If you're looking for a model that is fully ONVIF compliant (like most of the HW series has been so far), check for the WXH (HW0041, HW0046, HW0049, HW0050, ....) or HWAA (older generation like HW0026) prefixes. This is sometimes specified on the product page under the P2P specifications.
Conclusion
It is unfortunate that Wanscam included the HW0036 in the reputated HW series. The traditional Wanscam firmware that comes with models like HW0049 and HW0026 is clearly superior.
For ~20€, it remains a good camera but exclusively for use with eView7 or Netcam360.
For a full review, just read the Veskys and Digoo review.
65 comments:
Thanks!
Although I have used the voice to indicate when/if the camera got connected successfully, I must admit that it was getting slightly annoying to listen to.
So thank you for the mute thing.
I do have a question regarding the HW0036.
As you mentioned, e-View7 is somewhat the "standard" app for this camera.
And while I've succeeded in using other apps, e-View7 seems to be the most "straight forward" solution.
My problem is that no matter what I do, I can only view the stream @5 fps.
When IR is activated, it can jump to 10fps. But nowhere near the 25-30fps, that the camera is marketed to do.
I've used "EyeCloud" for PC, tinyCAM pro (android), and a couple more programs for PC - and all those (including the e-View7 app for android) locks the FPS @5/10 fps.
Did u have encounter the same issue - and if so, do u know how to fix it?
Atm I have 2x HW0036 cameras..and both of them seems to be limited to 5-10fps.
(I have tried to change 50/60hz, with no change)
Kind regards
Simon
Ohh...nevermind, I actually found a solution to it :))
ONVIF Device Manager (currently: v2.2.250).
Log in, Video Streaming, Frame rate, fps (5 -> 25)
And now it runs very smooth with the intended 25fps :))
You can also change this from the http interface (port 81). It's on the right side of the main screen, just below the resolution.
Yeah, I realized when experimenting with the mute option. But thanks and in any case, probably wouldnt have found out without ur review :)
DO you have problems to record on ftp, or received notifications on email?
hi,
please help me. I have a camera wanscam HW0036. After turning on the camera everything goes ok but after a few minutes, the camera is disconnected from the network. More is not connected to the network. I have to disconnect it from the power supply and reconnect.
Anyone know how to un-brick the Wanscam HW0036? i manage to connect to the serial port on the mainboard and this is to where i can get:
Anyone know how to un-brick the Wanscam HW0036? i manage to connect to the serial port on the mainboard and this is to where i can get:
U-Boot SPL 2013.07 (Jun 13 2016 - 21:30:48)
pll_init:347
l2cache_clk = 450000000
pll_cfg.pdiv = 8, pll_cfg.h2div = 4, pll_cfg.h0div = 4, pll_cfg.cdiv = 1, pll_cfg.l2div = 2
nf=36 nr = 1 od0 = 1 od1 = 1
cppcr is 02404900
CPM_CPAPCR 0470890d
nf=50 nr = 1 od0 = 1 od1 = 1
cppcr is 03204900
CPM_CPMPCR 0320490d
cppcr 0x9a7b5510
apll_freq 860160000
mpll_freq 1200000000
ddr sel mpll, cpu sel apll
ddrfreq 400000000
cclk 860160000
l2clk 430080000
h0clk 300000000
h2clk 300000000
pclk 150000000
CPM_DDRCDR(0000002c) = a0000002
U-Boot 2013.07 (Jun 13 2016 - 21:30:48)
Board: ISVP (Ingenic XBurst T10 SoC)
DRAM: 64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 407k for U-Boot at: 83f98000
Reserving 32784k for malloc() at: 81f94000
Reserving 32 Bytes for Board Info at: 81f93fe0
Reserving 124 Bytes for Global Data at: 81f93f64
Reserving 128k for boot params() at: 81f73f64
Stack Pointer at: 81f73f48
Now running in RAM - U-Boot at: 83f98000
MMC:
the manufacturer f8
SF: Detected FM25Q64
In: serial
Out: serial
Err: serial
Net: CPM_MACCDR(54) = a0000017
Jz4775-9161
Hit any key to stop autoboot: 1 0
run_command_list
the manufacturer f8
SF: Detected FM25Q64
SF: 2883584 bytes @ 0x40000 Read: OK
## Booting kernel from Legacy Image at 80600000 ...
Image Name: Linux-3.10.14
Image Type: MIPS Linux Kernel Image (gzip compressed)
Data Size: 2036771 Bytes = 1.9 MiB
Load Address: 80010000
Entry Point: 80399e10
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 3.10.14 (root@aplink-desktop) (gcc version 4.7.2 (Ingenic 2015.02) ) #28 PREEMPT Thu Jun 16 13:06:04 CST 2016
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 RESET ERROR PC:801B5E60
[ 0.000000] [<801b5e60>] 0x801b5e60
[ 0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)
[ 0.000000] FPU revision is: 00b70000
[ 0.000000] CCLK:860MHz L2CLK:430Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 00439000 @ 00010000 (usable)
[ 0.000000] memory: 00037000 @ 00449000 (usable after init)
[ 0.515076] jz_mac jz_mac.0: MII Probe failed!
[ 0.992247] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[ 1.002263] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
[ 1.010924] Rebooting in 3 seconds..Restarting after 4 ms
had to split the message due to character limit... this is part 2 above is part 1...
U-Boot SPL 2013.07 (Jun 13 2016 - 21:30:48)
pll_init:347
l2cache_clk = 450000000
pll_cfg.pdiv = 8, pll_cfg.h2div = 4, pll_cfg.h0div = 4, pll_cfg.cdiv = 1, pll_cfg.l2div = 2
nf=36 nr = 1 od0 = 1 od1 = 1
cppcr is 02404900
CPM_CPAPCR 0470890d
nf=50 nr = 1 od0 = 1 od1 = 1
cppcr is 03204900
CPM_CPMPCR 0320490d
cppcr 0x9a7b5510
apll_freq 860160000
mpll_freq 1200000000
ddr sel mpll, cpu sel apll
ddrfreq 400000000
cclk 860160000
l2clk 430080000
h0clk 300000000
h2clk 300000000
pclk 150000000
CPM_DDRCDR(0000002c) = a0000002
U-Boot 2013.07 (Jun 13 2016 - 21:30:48)
Board: ISVP (Ingenic XBurst T10 SoC)
DRAM: 64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 407k for U-Boot at: 83f98000
Reserving 32784k for malloc() at: 81f94000
Reserving 32 Bytes for Board Info at: 81f93fe0
Reserving 124 Bytes for Global Data at: 81f93f64
Reserving 128k for boot params() at: 81f73f64
Stack Pointer at: 81f73f48
Now running in RAM - U-Boot at: 83f98000
MMC:
the manufacturer f8
SF: Detected FM25Q64
In: serial
Out: serial
Err: serial
Net: CPM_MACCDR(54) = a0000017
Jz4775-9161
Hit any key to stop autoboot: 1 0
isvp# help
Unknown command ' help' - try 'help'
isvp# help
? - alias for 'help'
base - print or set address offset
boot - boot default, i.e., run 'bootcmd'
boota - boot android system
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
chpart - change active partition
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
env - environment handling commands
ext4load- load binary file from a Ext4 filesystem
ext4ls - list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
gettime - get timer val elapsed,
go - start application at address 'addr'
help - print command description/usage
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
sleep - delay execution for some time
source - run script from memory
tftpboot- boot image via network using TFTP protocol
version - print monitor, compiler and linker version
isvp#
what should i do after? as you can see the camera is in restart endless loop which happens on this line:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
what should i do? where it is broken?
Hi! It's maybe an offtopic, but I am trying to configure this camera through their client software for PC and I cannot set different login and password, so in my case it's always password123:password123 or admin:admin, etc. Also, I didn't manage to save mail settings, it just doesn't save them at all. I see that you are accessing settings on 81 port, which works for me too. Is there a full list of urls that can be used for configuration? Can I make changes by accessing that own camera web server?
Thanks for any help.
Best regards,
Illya
Ok, sorry, got it :)
Hi i have tried typing http://192.168.x.x:81/door_bell_set_language.cgi?next_url=voice.htm&loginuse=admin&loginpas=password&language=0 onto my browser while the HW0026 camera is connected. But it says page not found. How do i mute the voice startup?
Did you replace .x.x by the actual IP address?
i have ordered 2 cameras hw0036 and both are dead after 3 days to use , they dont start after plug to the power , is there a way to fix them? i cant believe that both camera happened the same :(
Did you try plugging them to another USB power source? like a power bank? Only a very wrong/unstable power source would fry them (they use 5V2A like most IP cameras). Maybe the power adaptor is faulty? Do not hesitate to open one and see if anything looks (or smell) toasted inside. The 3 units I have (Wanscam+Digoo+Veskys) all worked 24/7 for months and no failure so far.
you are lucky , i bought one from gearbest and after 3 days now it is dead , so i got refund , now i ordered it from other store and after 4 days now is dead i have tried to plugged to other adapters but nothinig happen , no voice no moves :(
Hi my friend,
I have this camera too but from one day to other the camera doesn't work. You solved your problem?
I want to debug mine too. I saw the 3 pin UART on mainboard but how can i use it to debug? I have to connect only the 3 pins (Gnd, TX and RX) to a Serial Port or i need the RX232/233 chipset to use it on a serial port?
Thanks and regards.
I have the same problem. After some hours mine is also dead. I ordered it from Gearbest.
Hi,
Mine stops long before your loading steps .. But like you, it seems that the memory eprom has fail
It seems too cheap maybe.
I ordered another of this camera, and will dump the firmware so maybe you could flash and fix yours.
Hi,
Could be a solution Stef, but how i can send the firmware to the camera? Now it doesn't give any signal of life...
Only debudgin using the serial no? But you have the wiring?
Regards
Mine worked during 90days and died.
The image started to ficking and when i reboot the power never worked again.
Isn't the power supply so... i don't have any clue do fix it.
And was bought on Gearbest to..
Hi. Found this thread by searching the Comet HX-1080 cam serial output. Cant even paste it now. Will inform on advances
Regards
U-Boot SPL 2013.07 (Feb 27 2016 - 10:34:09)
pll_init:347[0D]
l2cache_clk = 450000000[0D]
pll_cfg.pdiv = 8, pll_cfg.h2div = 4, pll_cfg.h0div = 4, pll_cfg.cdiv = 1, pll_cfg.l2div = 3[0D]
nf=38 nr = 1 od0 = 1 od1 = 1[0D]
cppcr is 02604900[0D]
CPM_CPAPCR 04b0890d[0D]
nf=50 nr = 1 od0 = 1 od1 = 1[0D]
cppcr is 03204900[0D]
CPM_CPMPCR 0320490d[0D]
cppcr 0x9a7b5510[0D]
apll_freq 909312000 [0D]
mpll_freq 1200000000 [0D]
ddr sel mpll, cpu sel apll[0D]
ddrfreq 400000000[0D]
cclk 909312000[0D]
l2clk 303104000[0D]
h0clk 300000000[0D]
h2clk 300000000[0D]
pclk 150000000[0D]
CPM_DDRCDR(0000002c) = a0000002[0D]
U-Boot 2013.07 (Feb 27 2016 - 10:34:09)
Board: ISVP (Ingenic XBurst T10 SoC)
DRAM: 64 MiB
Top of RAM usable for U-Boot at: 84000000
Reserving 402k for U-Boot at: 83f98000
Reserving 32784k for malloc() at: 81f94000
Reserving 32 Bytes for Board Info at: 81f93fe0
Reserving 124 Bytes for Global Data at: 81f93f64
Reserving 128k for boot params() at: 81f73f64
Stack Pointer at: 81f73f48
Now running in RAM - U-Boot at: 83f98000
MMC:
the manufacturer c2
SF: Detected MX25L64**E
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
Net: CPM_MACCDR(54) = a0000017
Jz4775-9161
Hit any key to stop autoboot: 1 [08][08][08] 0
the manufacturer c2
SF: Detected MX25L64**E
SF: 2883584 bytes @ 0x40000 Read: OK
## Booting kernel from Legacy Image at 80600000 ...
Image Name: Linux-3.10.14
Image Type: MIPS Linux Kernel Image (gzip compressed)
Data Size: 2344413 Bytes = 2.2 MiB
Load Address: 80010000
Entry Point: 80404510
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 3.10.14 (root@aplink-desktop) (gcc version 4.7.2 (Ingenic 2015.02) ) #12 PREEMPT Sat Feb 27 10:32:49 CST 2016
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 RESET ERROR PC:A820D161
[ 0.000000] CPU0 revision is: 00d00100 (Ingenic Xburst)
[ 0.000000] FPU revision is: 00b70000
[ 0.000000] CCLK:909MHz L2CLK:454Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 004c8000 @ 00010000 (usable)
[ 0.000000] memory: 00038000 @ 004d8000 (usable after init)
[ 0.458466] jz_mac jz_mac.0: MII Probe failed!
[ 0.926229] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[ 0.936087] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
[ 0.944701] Rebooting in 3 seconds..Restarting after 4 ms
Bonjour,
J'ai également acheté 2 caméras sur des sites différents et les deux se sont plantées au même endroit : dans le paramétrage des alarmes par mails, au moment d'appuyer sur le bouton "test".
les caméras se sont déconnectées et impossible de communiquer.
Rien avec le reset, plus d'initialisation le chargeur où un autre ne chauffe pas...
J'ai attendu qu'un des sites me fasse un avoir pour en ouvrir une, à quel endroit faut il se connecter afin d'établir une liaison série?
Merci pour votre aide
Bonjour, il y a habituellement une serie de 4 bornes en ligne (ou 4 trous) sur la carte mere, dans le meme genre que ce qui est illustre dans cet ancien article. La methode reste essentiellement la meme aussi. Le plus difficile est d'obtenir le firmware. Il ne faut pas hesiter a solliciter Wanscam (en pretendant avoir acheté leur modele) ET Digoo (en pretendant avoir acheté ...) car leur firmware est exactement le meme, du moment que l'un d'eux accepte d'envoyer le fichier. Bonne chance.
Hi my friend,
I connected the serial and send commands to the board but unfortunely i send the wrong firmware... so now i have to fix the bootloader because i don't have any response from serial port.
You made any progress? If you got the firmware tell me please or if you know how to fix the boatloader..
Thanks in advice
Hi Guys,
Good news, i recovered the Camera.
Like i said when i tried to flash the first time i erased all memory, so the camera don't boot up. Searching online i understood that i have to program the SPI Flash Memory. Online i only found a Parallel Port Programmers to this SPI Flash. Because the new laptops doesn't have the Parallel Port, i found a schematic to use a Raspberry Pi 3 to program it...
So, hands on Work and i used a old adapter made by me to connect the GPI ports from the RPI to a breadboard. On my breadboard i connect to my SPI Flash connected on the IP Camera Mainbord. I doesn't de-solder the SPI Flash, some people say to de-solder but i tried anyway.
I lost some hours to trying to connect the RPI to the Flash because wiring problems... the breadboards are good to make this tests, but sometimes the connection is to loose or the wires doesn't make so good contact.. so after some hours i make all connections from the scratch and with all patience.
After that, oh yeahh.. the RPI detects the SPI Flash and i could finally program a bin that i found in Internet to this Camera (IPcam25x64.bin). It takes around thirty minutes to Read, Erase, Program and Verify but at the end the camera boots up again.
I disconnected the RPI connection and use again the Serial do see what happens but the camera doesn't fully work, only boots up and try to connect to Wifi but the motors doesn't rotate and nothing..
So with more search i found the "Noboot.bin" from this forum and yesss finally the camera starts to work, and moving and connecting to wifi and finally to transmit image :)
Hi, Thanks for your solution to avoid voice prompt! Worked for me!
May you suggest any software (like e-view7) working outside home network? E-view7 not working on my phone with android 5.0 (THL t100s)?
I have tried some from play store but all only work in my home network...
Thanks.
I have the same camera that was remotely hacked - they probably erased the filesystem - and now it does not give any sign of life.
I've managed to dissasemble the camera completely but I cannot find the serial port on the mainboard; only some TPXX solder pins.
Do you have any picture of the mainboard showing where the serial port is and how to connect it in order to erase the SPI flash? I also have an RPi3 and a USBasp programmer.
Many thanks in advance for your help.
Hi my friend,
Yes, i took some pictures about my "adventure" with the wiring connection on Mainboard and also the connection with the Raspberry Pi.
My idea is to make a Youtube video or a manual to help who have the same problem that i had, but unfortunately i really don't have to make a coordinated thing... so.. i send bellow a We Transfer link with the pictures.
You can see a the pictures the wiring used, the RPI pinout and also some educational pictures :)
Your Serial connector is near the SD Card support, i don't remember the TPxxx, but you will see three wholes to make the wiring as can you see easily in the picture "DSC_0336.JPG" attached.
** We Transfer Link-> https://wetransfer.com/downloads/c911db70ea8f736ae8bef4eb3a0fc14f20170924212027/643dabc29f1936a2c42b22d37002898c20170924212027/31f66e
Regards,
The alias link is better -> https://we.tl/BBBL1bYOwy
Thank you very much for the pictures.
Fortunately, my bootloader was intact so I flashed the generic Noboot.img image and the camera started working again.
The only issue I have now is that I cannot log-on to the Web interface; tried many combinations (admin with no password, admin/admin, admin/12345 etc), nothing. I need to log-on to the camera in order to change it's ID on factory.ini.
Do you know the default password of the Generic Noboot.img?
Again, thank you very much for your help.
Greetings from Greece.
Hi my friend,
Glad to hear that worked fine. My camera had the bootloader intact too, but unfortunately i erased all memory and sent a wrong firmware... my mistake.
About the web interface i really don't remember, but if you use an Android/IOS App in your phone when you try to add new device normally use the login "admin/none" and then it prompts you to define a new password. You already made this?
You already tried to reset the camera using the push button?
Other option is using a telnet interface, the login to Telnet is different, normally is:
User: root
Password: hslwificam
I hope you get it.
Regards
hello can you help me? can you give your mail? mine is fullrecargasfae@gmail.com
Hi Carlos,
What kind of help you need? We can discuss with all in this forum if you want.
Regards
yes my problem its that i dont know wicht programmer i have to use and the device can you have a schematic for the device, wich programmer is better , i have 2 file ipcam25x64.bin and noboot.bin its only i need??? regards
hello antonio dou you have the schematic to build the device?? and wich prograr did you use for flash the cam?? thank you
Hi Carlos,
Sorry about my delay. As i said before, i used a Raspberry Pi 3 to program the Flash. To use in a Raspberry programmer you need the whole Flash, so you should use the ipcam25x64.bin.
But in your case you have access to the camera using the Serial Interface or have any error?
Regards
the mproblem its that i dont know how to build the serial interface i have used ponyprog to program chips for cartdridges printers i guess this programos would works but the serial interface do you have the schematic or for any contact in the camera (3 pins) what are their values? thank you
Hi Carlos,
When i was searching about programming the Flash i had the same problem. I found a lot of schematics to use in a Parallel port (could be a solution to you if you have this possibility) but using Serial i only found one site with the schematic but it uses a PIC Microcontroller. I don't saved the site because the Hex file was unable to download and after i found the Raspberry Pi solution. You can try but i don't have so much faith on it.
If you have the possibility to use a Raspberry i send the link to download my Photos and you take a look on it (Link-> https://we.tl/te5sabDBQI)
But my question remains... you can't connect the board to a RS232 serial interface to access the command line or you erased the flash as i have done?
Regards
Hi Carlos,
Reading better your comment i think that you are mixed the question. The 3 pins in the board that you can access using the RSR232 interface isn't to directly program the Flash, it's to access the Linux Command Line and if you abort the loading you can Send the new firmware to repair the camera.
If this is your real problem you can make a RS232 schematic between the Serial Port and the Camera Board like this example (https://www.superdroidrobots.com/images/rs232-ttl-schematic.png). Exists a lot of solutions, in my case i used a RSR233 interface, it's a little more simple :)
In your board side i don't remember all but looking for this three pins you should use the first one (Square) to connect the Ground of your RS232 board and the others two are the RX and TX to connect also with the board. You can try mix the wiring if doesn't appear nothing in your Serial interface program like Teraterm or Putty. You also should use the 115200 Baudrate on program.
Regards
A correction. I used the RS233 interface. It doesn't require capacitors.
hello miky actually i have not done anything because i dont know how i mean my cameras are totally deaths so i need to upgrade the firmware im correct? the how can i do that? i have not erased the flash if the 3 pins dont let me upgrade de firmware so what do i have to do to fix my cams??? regards
Hi Carlos,
If you was aware to my previous post i told you the ways to bring the camera back to like and i see a lot of doubts in your speech, so let me try to clarify.
1) First of all you will need some electronic skills to make this happen, either using the serial interface or program the flash. If you are able to straight forward so let's do it. If not it's better to ask from some help to a friend.
2) You will need to take some electronic components such a RS232 or 233 chips. You need to place it them on a breadboard and make some wiring connections as the schematics in my previous post.
3) With the RS232 or 233 correctly wired in a breadboard you will need to connect them to a Serial Interface port in a Computer.
4) Then, you can test the correct wiring making a shunt between the RX and TX ports in a RS232/233 and using a properly software in a computer to access the Serial Interface.
5) After this confirmation you can connect 3 wires from the breadboard (TX, RX and Gnd) to the IP Camera board. The connection should be made in the three holes that i show in the pictures from my previous post.
6) With this all connection made you should be able to see the Linux boot log and abort the boot loader process to flash the camera using the Kermit protocol with you .bin file using specific commands from the serial interface software. But when you arrive in this step i could gave you the correct commands and sequence to make the camera works again, but firstly you will need to make the previous steps.
I hope could be clear my post.
Thanks and regards.
Hello,
First of all thank you for your great plans and your forum.
So my problem is this, I have two HW0036 that worked very well there is little with
Jeedom, tinycam, chrome and imperihome however for about 1 month they do not broadcast any image after a few hours of ignition and even after a report and a tank settings, the only way for me to see the flow is to use E-view7.
I have a freebox revolution and my cameras have been working perfectly for over a year.
Thank you in advance for your help
Gendo
did you fix it?
Hi my friend,
Yes, as said in my posts. I use the serial interface to send a new firmware to the camera.
If you need some help begin to read my post on Oct,28 2017, 1:02:00AM and if you have doubt please tell me.
Thanks and regards
Hi, I want to learn how to fix my two cameras, can I flash the firmware via a ftdi programmer? I was checking the links of miky to see the diagrams and pictures but the links are expired
can you post the pictures again? to see the schematic to use a Rpi .please
Hi my Friend,
I uploaded again using WeTransfer. I hope it helps you to fix the camera.
Link -> https://we.tl/b9SOFg4RQq
Best Regards
Hi my friend,
Yes you can if you already has the bootloader in the flash. If not you need to program first the flash memory and then you can use the serial interface (ftdi is a USB to Serial interface converter).
Best Regards
thank you for reply, I have some questions, 1. when you say "flash" do you mean a chip? 2.how can I know that the flash has the bootloader?
sorry I am a noob,( I have used the ftdi to install firmware to devices for Drones following tutorials ) what software is used with the RPI and for ftdi? this is interesting to learn.
Hi my friend;
1) Yes the flash is the chip. With the code W25Q64 i think.
2) Using the serial port to make debug.
3) To access the serial interface and send the firmware to the flash any simple serial interface program is enough, like putty, but i used "Teraterm 4.95". If you can't access the flash using the serial interface you should program the chip flash directly using the raspberry or any other programmer.
Best Regards
Dear friend, I could to send the firmware ipcam25x64.bin via RPI after that I was able to access to serial interface and I sent the NOBOOT. bin to the camera with Tera term following the steps everything finished like the steps but when i power the camera à don't see any signal of life any clue
Hi my friend Jasson,
Glad to see that you are to close :)
Your problem was the Noboot file. Like the name says, the firmware as no bootloader, so the camera doesn't boot.
You have to use the Full Dump. I don't if you already have one, but o send you the link to download the generic one (link-> https://we.tl/t-oqpQzWhw3h)
Best Regards and hope to get successful :)
Dear friend, thank you so much for your help , one of my cameras is working now , i have accessed to the web interface and installed the original firmware and i put a better password.
My mistake when i bought the cameras is that i forgot to change the default password "admin-admin" so i guess it was too easy to hack it and damage the firmware :(.
Now i have to try to fix the other one that i think i have to fix the bootloader , do you have a link of a video or tutorial that you followed to flash this chip with the RPI? i dont understand why some diagram use resistors to connect the chip to the RPI and others connect the chip directly to the RPI without resistor to be sure.(i did without resistors because it did not work with the resistor) . Thank you again my friend
Hi my friend,
Very good news :) Yes i think that i had this problem too, not because the user/password but because this firmware by default allows remote access and provide to much connections that should be supposed to have. After i repaired my camera, by curiosity i made debug of the packets that passed in my Router from/to the camera and saw to strange connections and to suspicious addresses, so i blocked all traffic to the camera on my Router. I only allowed the NTP server address. After that my camera only can be accesses inside my home network, via my router or via my VPN access. No more remoted accesses from outside my network to the camera :)
To your other camera, to be honest i don't have to much time, and now the camera is in use, so it's hard to take new pictures or make a video.
The diagram that i sent you should be enough. Some schematics resistances to protect the chip from current peaks, but normally the people connect straight forward without any protection..
Sometimes doesn't make any difference.
In my case, at the beginning i started to use resistances, but i was lost maybe 4-5hours to get successful connection because my breadboard was damaged... and the wiring was not perfect, so at some point i didn't used resistances and the final result, as you can see at the pictures, i don't have any resistance and the camera works fine.
I recommend you to follow this steps:
1) Solder some wires at the 8 pins from the Flash Memory
2) Connect this 8 wires to correspondent raspberry ports. 2 of this wires should be connected to VCC and other 2 to the ground.
3) At your raspberry should follow this coding steps:
sudo nano /etc/modules
sudo modprobe spi-bcm2835
sudo modprobe spi-bcm2708
sudo modprobe spidev
sudo modprobe spi-dev
sudo echo "spi-bcm2835" >> "/etc/modules"
lsmod
flashrom -p linux_spi:dev=/dev/spidev0.0
flashrom -E -V -p linux_spi:dev=/dev/spidev0.0
flashrom -w /root/boot.img -p linux_spi:dev=/dev/spidev0.0
flashrom -p linux_spi:dev=/dev/spidev0.0 -w /path/to/libreboot.rom
#To erase the chip (not needed on most chips) run:
flashrom -E -V -p linux_spi:dev=/dev/spidev0.0
#To begin flashing run:
flashrom -w /XXXXXX -V -p linux_spi:dev=/dev/spidev0.0a
To be honest, i didn't remember all that i have done, but i had this notes in this project :)
Best Regards
Dear friend, thank you for your time, I will try to fix my other camera,the diagrams and pictures you sent me are enough, :) but at least one of the camera is working and this is good for me because I had no idea how could i fix it, I was going to throw it away but I am happy that I could make it work again, thanks to your info. I need to find out how to make a debug to the packets that pass through my router, and do the same like you.
do you have more IP cameras? if Yes, does this happen in others cameras? I have three different models wanscam cameras and no problem yet. I need to have access to the cameras from my phone when I am not home.
Hi my friend,
Glad to see that i could help in something :)
When this camera was broken, i got another different one from my job the Trust Smart IPCAM-2000, it's a simple model that doesn't rotate, only speaker and micro.
The main difference is that you couldn't access the web browser, is a login protected that Trust doesn't share to the users .. (i tried without successful). So, with this camera the IP should fixed on the router and not in the camera, for me it's a shame this behaviour but okay..
The "trash packets" are to similar, it generates a lot of traffic in your network, so i blocked all traffic too in my router like the other one, except the NTP server.
I think all this cameras have the same linux strategy, but this one it's a closed system, you only can access using the Trust app, not like the others, but at the end works in a same mode.
Best Regards
Dear friend,finally i could fix my second camera :) ,i read about access to the camera remotly using ddns and opening an port to the router to access to the camera online, do you know if this way is more secure than access to the camera via p2p protocol with the wanscam app?
Hi Jasson,
Accessing the camera remotely using VPN is the better option.
Best Regards
Post a Comment
Note: Only a member of this blog may post a comment.