Added post about camera firmware hacking.

know-how/hacking/_posts/2016-11-13-crossgrade-firmware-smarteye-ip-camera.md

@@ -0,0 +1,340 @@
+---
+title: Crossgrade firmware in SmartEye IP camera
+language: en
+layout: default
+created: 2016-11-13 23:31:43 +0100
+updated: 2016-11-13 23:31:43 +0100
+toc: true
+tags:
+  - know-how
+  - hacking
+  - firmware
+  - ip-camera
+  - smarteye
+  - wansview
+  - instar
+---
+A few years ago, I got a [Wansview](http://www.wansview.com/) NCH-536MW IP
+camera. That was one of the first 720p cameras with night-vision, motion and
+all features you could wish for.
+
+![]({{ site.url }}/assets/wansview-nch536mw.jpg)
+
+One problem, though: The user interface looks awfully outdated and half of the
+setup only works in Microsoft Internet Explorer and only if you have some
+Chinese OCX browser plugin installed. (Compared to Foscam, however, you can at
+least setup most things without that plugin. With Foscam cameras, you can't even
+login if you don't have their plugin installed.)
+
+![]({{ site.url }}/assets/wansview-start.png){: height="160px"}
+![]({{ site.url }}/assets/wansview-admin.png){: height="160px"}
+
+While that works, once you have everything set up, it's always a hassle to
+change a setting - especially as a Linux user. I need to power up a Windows VM
+to change anything. And I don't like that.
+
+However, the German company [Instar](http://www.instar.com/) developed an
+awesome HTML5 interface which works like a charm and is cross-browser
+compatible. It even works from Linux. And you can setup everything without the
+need for any plugin.
+
+![]({{ site.url }}/assets/instar-admin.jpg){: height="200px"}
+
+
+Brothers in spirit (and hardware)
+=================================
+
+The problem is: There are various different models of IP cameras out there and
+while they may share the same body, they can have totally different hardware
+inside. (Camera bodies are re-used amongst companies to not having to spend
+resources on designing one.)
+
+But luckily that's not the case with the NCH-536MW. Because the company behind
+it, Wansview, is also known as *Shenzhen Smarteye Digital Electronics Co.*. And
+under the [SmartEye](http://www.smarteyegroup.com/) branch, they sell these
+cameras to OEMs. And those OEMs may use the original firmware, or, provide their
+customers with a customised one.
+
+The hardware I have is sold under these product names:
+
+* Wansview NCH-536MW
+* AGASIO A522W (original UI)
+* DERICAM H501W (customised UI)
+* Foscam FI9820W (customised UI)
+* INSTAR IN-6011HD (customised UI)
+
+There's a HiSilicon Hi3511-compatible SoC with a 16MB Flash memory in it.
+
+
+Firmwares
+=========
+
+Firmware updates come in form of a `.pkg` file. For the Wansview variant, the
+latest one is `B12SE_V1.4.0.1.9_536mP1.pkg`. The INSTAR one is named
+`B12SE_V60.1.1.4_536mP1_60.11.1.2.18.pkg` and Foscam's latest firmware for the
+FI9820W is `B12FC_V3.2.6.1.1_0807Hd9820P1.pkg`. (`SE` = SmartEye/Wansview, `FC`
+= Foscam)
+
+If you take a closer look at those files, you'll notice that they consist of
+144 Bytes header data (188 Bytes in older versions) and the rest is a JFFS2
+image, around 9-point-something MiB in (compressed) size.
+
+You can get the plain JFFS2 file by running, e.g.:
+
+    dd if=B12SE_V60.1.1.4_536mP1_60.11.1.2.18.pkg bs=1 skip=144 of=root.jffs2
+
+You can then mount it with [these commands](https://www.kutukupret.com/2010/09/16/mounting-a-jffs2-filesystem-in-linux/)
+(you probably have to use `sudo` with each of them):
+
+    mknod /tmp/mtdblock0 b 31 0
+    modprobe mtd
+    modprobe jffs2
+    modprobe mtdram total_size=32767
+    modprobe mtdblock
+
+    dd if="root.jffs2" of=/dev/mtd0
+
+    mount -t jffs2 /tmp/mtdblock0 /mnt/jffs2
+
+However, this isn't much use as we want to get the files onto the camera, not
+on our desktop PC.
+
+Sadly, the normal firmware updater doesn't allow files from a different
+reseller. So we have to find another way. And there is one.
+
+
+Hardware
+========
+
+<p><div class="noteclassic" markdown="1">
+To continue, you'll need a USB-to-TTL serial adapter. I've got [this one](https://www.amazon.co.uk/gp/product/B00AFRXKFU/)
+which works great. Make sure to get one with a CP2102 as there are a lot of fake
+PL2303 and FT232RL chips around and drivers might block them.
+</div></p>
+
+If you open up the camera, you'll notice several unpopulated connectors on the
+PCB. What you're looking for is the (mostly) 4-pin console port. A serial port
+which acts as the main input/output interface to the system. And this is it:
+
+![]({{ site.url }}/assets/wansview-console-port.jpg){: height="260px"}
+
+Only 3 pins are important to us: Rx (green), Tx (red) and the GND (white) pin.
+The fourth is supplying 3.3V which we don't need.
+
+Once you've wired everything correctly and connected the serial adapter to your
+computer, a new serial port should show up. Connect to it using a terminal
+program, e.g. [minicom](https://alioth.debian.org/projects/minicom) or [KiTTY](http://kitty.9bis.net/).
+The comm parameters are: 115200 8 N 1, e.g. `minicom -b 115200 -D /dev/ttyUSB0`.
+After you've set up everything, plug in the camera.
+
+You should see the boot process, [U-Boot](http://www.denx.de/wiki/view/U-Boot)
+first followed by the linux kernel. The first few lines look like this:
+
+~~~
+U-Boot 1.1.4 (Apr  8 2009 - 11:41:01)
+U-Boot code: E0500000 -> E0517540  BSS: -> E051E2BC
+ HI_VERSION=U_BOOT_1_1_4-M08C0305B0301 @Hi3511v110_OSDrv_1_0_0_7 2009-03-18 20:44:35
+RAM Configuration:
+Bank #0: e0000000 128 MB
+Flash: 16 MB
+In:    serial
+Out:   serial
+Err:   serial
+MAC:   00-25-07-00-00-3B
+Hit any key to stop autoboot:  0
+
+Memory policy: ECC disabled, Data cache writeback
+CPU0: D VIVT write-back cache
+CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
+CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
+Built 1 zonelists
+Kernel command line: mem=72M console=ttyAMA0,115200 root=1f01 rootfstype=jffs2 mtdparts=phys_mapped_flash:2M(boot),13M(rootfs),1M(setting)
+PID hash table entries: 512 (order: 9, 8192 bytes)
+Console: colour dummy device 80x30
+Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
+Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
+Memory: 72MB = 72MB total
+Memory: 71168KB available (1461K code, 175K data, 76K init)
+~~~
+
+
+U-Boot Basics
+=============
+
+Notice the *"Hit any key to stop autoboot"* message. If you press any key at
+that step, you'll be dropped into the U-Boot bootloader. That's where we want
+to be.
+
+Type `help` to get a list of supported commands:
+
+```
+hilinux # help
+
+?       - alias for 'help'
+base    - print or set address offset
+bdinfo  - print Board Info structure
+bootm   - boot application image from memory
+bootp   - boot image via network using BootP/TFTP protocol
+cmp     - memory compare
+cp      - memory copy
+crc32   - checksum calculation
+dhcp    - invoke DHCP client to obtain IP/boot params
+echo    - echo args to console
+erase   - erase FLASH memory
+flinfo  - print FLASH memory information
+go      - start application at address 'addr'
+help    - print online help
+loadb   - load binary file over serial line (kermit mode)
+loop    - infinite loop on address range
+md      - memory display
+mm      - memory modify (auto-incrementing)
+mtest   - simple RAM test
+mw      - memory write (fill)
+nm      - memory modify (constant address)
+ping    - send ICMP ECHO_REQUEST to network host
+printenv- print environment variables
+protect - enable or disable FLASH write protection
+rarpboot- boot image via network using RARP/TFTP protocol
+reset   - Perform RESET of the CPU
+saveenv - save environment variables to persistent storage
+setenv  - set environment variables
+tftp    - download or upload image via network using TFTP protocol
+version - print monitor version
+```
+
+Of those, we need three commands: `setenv`, `tftp` and `erase`.
+
+
+Setting up the TFTP connection
+==============================
+
+First, we need to setup the connection to the PC. Make sure to connect the
+camera via ethernet cable to your network. And you need to setup a tftp server
+on your PC. I used [atftpd](https://sourceforge.net/projects/atftp/). For
+Windows, there's [tftpd32](http://tftpd32.jounin.net/tftpd32.html).
+
+Now, we need to configure the IPv4 settings. Use these commands:
+
+```
+setenv ipaddr 172.16.99.9
+setenv netmask 255.255.0.0
+setenv serverip 172.16.1.2
+```
+
+`ipaddr` is the IP address of your camera (or some other unused IP address in
+your network). `serverip` is the IP address of your PC (or where your TFTP
+server is running). And `netmask` is, of course, the netmask of your network.
+
+
+Memory layout
+=============
+
+The 16M flash memory is located at address 0x34000000 until 0x34ffffff and
+partitioned like this:
+
+* 0x34000000 - 0x341fffff = boot area
+  * 0x34000000 is the U-Boot start area
+  * 0x34100000 is the linux kernel
+* 0x34200000 - 0x34efffff = JFFS2 root filesystem
+* 0x34f00000 - 0x34ffffff = settings
+
+And yes, the JFFS2 root filesystem is the JFFS2 data from the firmware update
+files (see above).
+
+
+Making a backup
+===============
+
+If you check the help for the `tftp` command, its syntax is like this:
+
+    tftp address filename [length]
+
+If `[length]` is given, it will **UPLOAD** a file to your TFTP server, if it
+is omitted, it will **DOWNLOAD** a file from your TFTP server and flash that
+into the memory.
+
+So, since we know the memory layout, a complete backup of everything but the
+bootloader (to not risk corrupting it) is as easy as:
+
+    tftp 0x34100000 recovery.bin 0xf00000 
+
+This will upload a file named `recovery.bin` with the linux kernel and JFFS2
+image to your TFTP server.
+
+If you should run into problems, you can recover by entering:
+
+    erase 0x34100000 +0xf00000
+    tftp 0x34100000 recovery.bin
+
+
+Flashing new firmware
+=====================
+
+If you read until here, it should be clear what to do. After extracting the
+JFFS2 image file from, e.g. the INSTAR firmware (see above), you just have to
+put it on your TFTP server to make it accessible to the camera. Let's say you
+named it `instar.jffs2`.
+
+Since we know the memory area for the JFFS2 image, we can first erase it by
+issuing the command:
+
+    erase 0x34200000 +0xd00000
+
+This erases the whole JFFS2 memory area, i.e. it sets all bits to `1`. 
+
+After this is complete, you just have to flash the file from the TFTP server:
+
+    tftp 0x34200000 instar.jffs2
+
+That's it. You can now reboot the camera into the INSTAR firmware:
+
+    bootm 0x34100000
+
+(This boots from memory at address 0x3410000 - the linux kernel, which will then
+mount the JFFS2 image and continue booting from there.)
+
+
+Problems
+========
+
+If you see something like this on bootup of a newly flashed firmware:
+
+```
+jffs2_scan_dirent_node(): Node CRC failed on node at 0x0000000c: Read 0x41c0224d, calculated 0x97e7f5c5
+jffs2_scan_inode_node(): CRC failed on node at 0x00000038: Read 0x5a000025, calculated 0x1b754c4d
+jffs2_scan_dirent_node(): Node CRC failed on node at 0x0000007c: Read 0x53804006, calculated 0x88f20f93
+jffs2_scan_inode_node(): CRC failed on node at 0x000000a8: Read 0x1a180001, calculated 0x05c7cb76
+jffs2_scan_dirent_node(): Node CRC failed on node at 0x000000ec: Read 0x130c0000, calculated 0x84df6ac9
+jffs2_scan_inode_node(): CRC failed on node at 0x00000118: Read 0xeb290421, calculated 0x5025ee1e
+jffs2_scan_dirent_node(): Node CRC failed on node at 0x0000015c: Read 0x00006680, calculated 0x061da826
+jffs2_scan_inode_node(): CRC failed on node at 0x00000188: Read 0xaa620051, calculated 0x4e976925
+jffs2_scan_dirent_node(): Node CRC failed on node at 0x000001cc: Read 0x91724800, calculated 0x6a08a595
+jffs2_scan_inode_node(): CRC failed on node at 0x000001f8: Read 0x10481681, calculated 0xceb194da
+jffs2_scan_dirent_node(): Node CRC failed on node at 0x0000023c: Read 0x041c0010, calculated 0x936f78f5
+jffs2_scan_inode_node(): CRC failed on node at 0x00000268: Read 0xadab3105, calculated 0x16f7db7a
+jffs2_scan_dirent_node(): Node CRC failed on node at 0x000002ac: Read 0x0108e480, calculated 0xc7802b02
+jffs2_scan_inode_node(): CRC failed on node at 0x000002dc: Read 0x13e23050, calculated 0xb31f5628
+jffs2_scan_dirent_node(): Node CRC failed on node at 0x00000320: Read 0x0005c825, calculated 0x9bdee4df
+jffs2_scan_inode_node(): CRC failed on node at 0x0000034c: Read 0x44643000, calculated 0xc2233f22
+jffs2_scan_dirent_node(): Node CRC failed on node at 0x00000390: Read 0x0b70408d, calculated 0xd00bb938
+jffs2_scan_inode_node(): CRC failed on node at 0x000003c0: Read 0x18509440, calculated 0xe7085f3d
+jffs2_scan_dirent_node(): Node CRC failed on node at 0x00000410: Read 0x13400000, calculated 0xac90de05
+jffs2_scan_inode_node(): CRC failed on node at 0x0000043c: Read 0x6d822094, calculated 0xd6ce08ab
+```
+
+This means that you forgot to erase the memory area before flashing a new
+firmware. Since "flashing" can only change bits from `1` to `0`, it runs into
+problems when there should be a `1` where there already is a `0`, e.g.:
+
+      Old data: 0101 0101
+      New data: 1100 1100
+    Flash data: 0100 0100
+
+Using the `erase` command resets all bits to `1`.
+
+
+Read more
+=========
+
+* [forum.hardware.fr](http://forum.hardware.fr/hfr/HardwarePeripheriques/webcam-camera-ip/unique-wansview-camera-sujet_56652_12.htm#t701130)
+* [openipcam.com](http://www.openipcam.com/forum/index.php?topic=342.0)