Hacking the Foscam FI8903W Linux Based IP Camera

deece — Thu, 03/12/2009 - 8:26am

I recently purchased a Foscam FI8903W IP Camera on Ebay to watch over my new solar system. It only draws 2.6W (as measured on the AC side of the plug pack), so it is relatively lightweight.

I'd like to hack it so I can use the existing motion detection on camera to send a UDP packet to Zoneminder. I've documented what I had to do to get it working with Zoneminder on my blog. The camera itself appears to run Linux, but I have yet to figure out the format of their archive (.bin) files that the firmware is stored in, so any work on it at this point would be difficult.

I grabbed a copy of the firmware from GadgetVictims (this is acutally older than what is on my camera) - extracting it presents you with 2 BIN files, one contains the web UI for the camera, and the other contains the kernel and other pieces.

The archive format is uncompressed, as there is much clear text, so it should be relatively easy to decode. I have thrown tar, cpio & zip at it, but they could not extract (and more importantly, recreate) the archive. Running file against the archive just reports "data".

The next step forward would be to write a script to decode the firmware. There appears to be a header preceding each file, containing the filename and other data.

I've attached the firmware to this post, in case anyone wants to have a crack at it.

Attachment	Size
FI8903W-fw11.15.1.42.zip	1.57 MB

Login or register to post comments
Printer-friendly version

FI8903W-fw11.15.1.42.zip contents

Owen — Mon, 14/12/2009 - 9:44pm

The 2.4.9.11.bin seems to be a html file, rename and open in a browser, it wants to reboot the system I guess

The other I don't know. running strings I get a few intelligent words

linux.bin

#!/bin/sh

declare -i j=0

while [ $j != 10 ]

mknod --m=777 lp$j c 18 $j

j=$j+1

done

+ a whole stack of devices

init
mount -t proc none /proc
mount -t ramfs none /usr
mount -t ramfs none /swap
mount -t ramfs none /var/run
mount -t ramfs none /etc
mount -t ramfs none /flash
mount -t ramfs none /home
camera&

+ a whole stack of error messages etc
I guess it is the operating system
You would probably have more clue than me on that

I just bought one of these

IrishHayZeus — Tue, 30/03/2010 - 4:20am

I just bought one of these cameras too, and am interested in hacking it.

reviewing the bin files, it is clearly running linux. Also, the web interface seems to offer a way to access the filesystem. I'm going to see if I can dig into the bin files with a hex editor and figure out what is going on with them. It can't be a terribly complicated archive format, and modifying the web interface filesystem is probably the easiest way to get on the camera. Once that is done, I'm sure telnet is available, if not SSH.

Will try and keep you posted to what I find out (but feel free to email me if I forgot to post anything).

I was having a hard time

IrishHayZeus — Wed, 31/03/2010 - 4:09am

I was having a hard time posting all of this here, do to some formatting/HTML restrictions, so I decided to post it on my blog instead.

http://irishjesus.wordpress.com/2010/03/30/hacking-the-foscam-fi8908w/

Foscam / Generic Camera

computersolutions — Thu, 29/04/2010 - 11:06pm

Also been doing some work on this Camera.

My own work here - http://www.computersolutions.cn/blog (under ip cam posts).

So far - serial into the device, documented the bootloader, and almost at the point where I can test firmware stuff.

Changing the rom.img (aka 2.4.9.11.bin in the zip file) is fairly easy.

The hardware is ARM7 running on ucLinux 2.4.20 (which is the standard BSP ucLinux version provided for the chip).

Tool download links etc on my blog. Irishjesus also has some good stuff on his, I've been commenting on there also.

Foscam Clone

rvbcrs — Mon, 16/08/2010 - 4:17am

Hi!

I have recently bought a few Foscam clones, I bought them from ChinaVasion. Without thinking I flashed the firmware of one of the cams with official Foscam firmware, turning it into a paperweight I have attached a RS232 TTL thingy to the JTAG port on the cam and can go into the bootloader of the cam. I tried several firmwares, but none of them can revive my bricked cam.

Is there any way you think to get the firmware of one of my good camera's and flash it into the bricked one? how can I dump the firmware?

I really hope someone can help me get my camera working again!

Thanks for the help!

RvBCrS

Firmware

computersolutions — Fri, 30/04/2010 - 9:49pm

Worked out the firmware layout. Full description in my blog post (see below)

http://www.computersolutions.cn/blog/2010/04/ip-cam-hacking-pt4/

Currently I can build binaries, and make my own rom image with extras (see the next post below for how to do that, and some sample arm7 bflt binaries)

http://www.computersolutions.cn/blog/2010/04/ip-cam-hacking-pt5/

Group Projects

Members' Projects