bricked foscam fi9828p

Excellent! Well done.
uboot password, but a plaintext string "ipc.fos~".
Click to expand...
When I read this I laughed out load cos I misread fos as pos ...

That's a brave thing to do - the erase before the tftp transfer - or did you already prove out the transfer?
 
Had the password sayed "pos", I might have missed it when reading the ASCII printout of the hexdump.:peaceful:

The procedure is not for the faint of heart, it erases entire flash including the uboot to start with.

Of course before starting the procedure I tested with normal Linux TFTP client that the TFTP server is functioning.
Other than that it was just the ping to test connectivity between the camera and the server.
Uboot is fairly good, had the TFTP transfer failed it should have allowed me to try again.
It is not like I lose the uboot that runs in the memory immediately after the erase.

Of course, had I lost power after the erase command, I'd have a rather expensive wall decoration with very little hope of turning it into something useful again.
 
Hi,
I have the same problem with a bricked FI9821w v2. You have instruction how to recover ()Serial port updating for FI9821W V2 ...) at your dropbox. But the link is not working or the file is somehow distorted. Can you help me out ?
 
abataille said:
Hi,
I have the same problem with a bricked FI9821w v2. You have instruction how to recover ()Serial port updating for FI9821W V2 ...) at your dropbox. But the link is not working or the file is somehow distorted. Can you help me out ?
Click to expand...
I fixed the link in the post.
 
by the way i ripped and took off the poe adaptor from the board in fustration one day,i still have that corpse around somewhere, now with out it i cant recover , if anyone can advice me on how to solder it or recover with out it i would be gratefull! thanks
 
Last edited by a moderator:
Sorry to revive a 2 year old thread, but I have a bricked FI9821w v2. I have the usb ftdi cable hooked up and communicating, tftp server setup, but I am in need of the recover_image.bin file. Does anyone still have the files or access/info on where to get them?
 
You could ask recovery files from Foscam support but given they are probably as helpful as always that could be a difficult route.

Here is a package for FI9821W_V2 I found (the link will expire after 14days or first download...)

The recover_image.bin method didn't work for me, I had to follow the pdf instruction that came with the recovery image zip.
 
  • Like
Reactions: Mark ter Grote
Hello,

Sorry for digging this old topic. But i have Foscam FI9803P v2, it was corrupted after power outage. I connected it sucessfully via USB TTL, and saw there's boot-restart loop. Here's output:

Code: 
]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20030030: 0x00000000 --> 0x00000001
[END]
Kernel: ssp initial ok!
acodec inited!
insert audio
==== Your input Wifi type is 2 ====
rtusb init rtusbSTA --->


=== pAd = c36ab000, size = 860440 ===

<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x8
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x4
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x5
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x6
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x7
RTMP_COM_IoctlHandle():pAd->BulkOutEpAddr=0x9
NVM is EFUSE
Endpoint(8) is for In-band Command
Endpoint(4) is for WMM0 AC0
Endpoint(5) is for WMM0 AC1
Endpoint(6) is for WMM0 AC2
Endpoint(7) is for WMM0 AC3
Endpoint(9) is for WMM1 AC0
Endpoint(84) is for Data-In
Endpoint(85) is for Command Rsp
usbcore: registered new interface driver rtusbSTA
ptz_init start ptz_state[1],HorPos[0],VerPos[0]
setup ptz gpio success
setup zoom gpio success
ptz_init end ptz_state[1],HorPos[-1],VerPos[-1],flag[0]
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=60 sec (nowayout= 0, nodeamon= 0)
Read nRegValA:160,nRegValB:34
the sensor is h22,return 1
#h22 sensor
set rtc time to system time
 #### SYS_VER_0:  1 == 1 ? ####
 #### not need to rewrite sysVer_item0,old: 1 ####
 #### SYS_VER_1: 9 == 9 ? ####
 #### not need to rewrite sysVer_item1,old: 9 ####
 #### SYS_VER_2:  3 == 3 ? ####
 #### not need to rewrite sysVer_item2,old: 3 ####
 #### SYS_VER_3: 18 == 18 ? ####
 #### not need to rewrite sysVer_item3,old: 18 ####
 #### APP_VER_0:  2 == 2 ? ####
 #### not need to rewrite appVer_item0,old: 2 ####
 #### APP_VER_2:  2 == 2 ? ####
 #### not need to rewrite appVer_item2,old: 2 ####
 #### APP_VER_3: 46 == 46 ? ####
 #### not need to rewrite appVer_item3,old: 46 ####

starting pid 1145, tty '': '/sbin/getty -L ttyS000 115200 vt100 -n root -I "Auto login as root ..."'
Auto login as root ...
(none) login: killall: devMng: no process killed
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(-1)
killall: codec: no process killed
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1154)
killall: UDTMediaServer: no process killed
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1156)
killall: webService: no process killed
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1158)
killall: storage: no process killed
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1160)
killall: OnvifAgent: no process killed
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1162)
killall: BaiduRtmp: no process killed
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1164)
set time
year:2017
month:12
date:12
hour:1
minute:45
second:54
killall: CGIProxy.fcgi: no process killed
killall: lighttpd: no process killed


Lighttpd Server BUILD:Dec 10 2015 11:03:08

2017-12-12 01:45:55: (network.c.724) ==1==srv->config_storage[ 0 ]= 0
2017-12-12 01:45:55: (network.c.724) ==1==srv->config_storage[ 1 ]= 1
WARNING: can't open config file: /usr/local/openssl/ssl/openssl.cnf
SMT DEBUG : ERROR : Adapter is NULLdriver: ircut_switch.low:340,ircut_switch.high:600
driver: open IR_LED
########stImageAttr.u16FrameRate=25, SRC_FRAME_RATE=25######
2017-12-12 01:45:55: (network.c.985) ==2==srv->config_storage[ 1 ]= 1
start flag:0 !
2017-12-12 01:45:55: (network.c.456) =========s->ssl_enabled= 0
2017-12-12 01:45:55: (network.c.456) =========s->ssl_enabled= 1
2017-12-12 01:45:55: (log.c.164) server started
***link down status changed***.
PHY: himii:01 - Link is Down
pageaddr:412f9000,dgbaddr:412f9000,size:0
PHY: himii:01 - Link is Up - 100/Full
stVencRcPara.stParamH264VBR.s32DeltaQP=6
netstat: /proc/net/tcp6: No such file or directory
set time
year:2017
month:12
date:12
hour:1
minute:46
second:4
killall: wpa_supplicant: no process killed
PHY: himii:01 - Link is Up - 100/Full
1. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
RTMP_TimerListAdd: add timer obj c372b92c!
RTMP_TimerListAdd: add timer obj c372b944!
RTMP_TimerListAdd: add timer obj c372b95c!
RTMP_TimerListAdd: add timer obj c372b914!
RTMP_TimerListAdd: add timer obj c372b8cc!
RTMP_TimerListAdd: add timer obj c372b8e4!
RTMP_TimerListAdd: add timer obj c36c0764!
RTMP_TimerListAdd: add timer obj c36ad1e0!
RTMP_TimerListAdd: add timer obj c36ad1fc!
RTMP_TimerListAdd: add timer obj c36c07bc!
RTMP_TimerListAdd: add timer obj c36afcf0!
RTMP_TimerListAdd: add timer obj c36af3a0!
RTMP_TimerListAdd: add timer obj c36afcd4!
RTMP_TimerListAdd: add timer obj c36aff14!
RTMP_TimerListAdd: add timer obj c36afd0c!
RTMP_TimerListAdd: add timer obj c36afd28!
RTMP_TimerListAdd: add timer obj c36afd44!
RTMP_TimerListAdd: add timer obj c36c0734!
RTMP_TimerListAdd: add timer obj c36c07a4!
RTMP_TimerListAdd: add timer obj c36aff44!
RTMP_TimerListAdd: add timer obj c36aff5c!
RTMP_TimerListAdd: add timer obj c36aff74!
RTMP_TimerListAdd: add timer obj c36aff8c!
cfg_mode=5
wmode_band_equal(): Band Equal!
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 14
2. Phy Mode = 14
NVM is Efuse and its size =1d[1e0-1fc]
3. Phy Mode = 14
AntCfgInit: primary/secondary ant 0/1
---> InitFrequencyCalibration
InitFrequencyCalibrationMode:Unknow mode = 3
InitFrequencyCalibration: frequency offset in the EEPROM = 111(0x6f)
<--- InitFrequencyCalibration
RTMPSetPhyMode: channel is out of range, use first channel=1
MCS Set = ff 00 00 00 01
<==== rt28xx_init, Status=0
0x1300 = 00064300
RTMPDrvOpen(1):Check if PDMA is idle!
RTMPDrvOpen(2):Check if PDMA is idle!
ERROR!!! MlmeEnqueueForRecv: fRTMP_ADAPTER_HALT_IN_PROGRESS
AsicSendCmdToAndes: !fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD && fRTMP_ADAPTER_IDLE_RADIO_OFF
unlink cmd rsp urb
/bin/sh: /bin/ppp/pppoe-stop: not found
route: ioctl 0x890c failed: No such device
cp: can't stat '/etc/resolv.conf.bak': No such file or directory
1. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
RTMP_TimerListAdd: add timer obj c372b92c!
RTMP_TimerListAdd: add timer obj c372b944!
RTMP_TimerListAdd: add timer obj c372b95c!
RTMP_TimerListAdd: add timer obj c372b914!
RTMP_TimerListAdd: add timer obj c372b8cc!
RTMP_TimerListAdd: add timer obj c372b8e4!
RTMP_TimerListAdd: add timer obj c36c0764!
RTMP_TimerListAdd: add timer obj c36ad1e0!
RTMP_TimerListAdd: add timer obj c36ad1fc!
RTMP_TimerListAdd: add timer obj c36c07bc!
RTMP_TimerListAdd: add timer obj c36afcf0!
RTMP_TimerListAdd: add timer obj c36af3a0!
RTMP_TimerListAdd: add timer obj c36afcd4!
RTMP_TimerListAdd: add timer obj c36aff14!
RTMP_TimerListAdd: add timer obj c36afd0c!
RTMP_TimerListAdd: add timer obj c36afd28!
RTMP_TimerListAdd: add timer obj c36afd44!
RTMP_TimerListAdd: add timer obj c36c0734!
RTMP_TimerListAdd: add timer obj c36c07a4!
RTMP_TimerListAdd: add timer obj c36aff44!
RTMP_TimerListAdd: add timer obj c36aff5c!
RTMP_TimerListAdd: add timer obj c36aff74!
RTMP_TimerListAdd: add timer obj c36aff8c!
cfg_mode=5
wmode_band_equal(): Band Equal!
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 14
2. Phy Mode = 14
NVM is Efuse and its size =1d[1e0-1fc]
3. Phy Mode = 14
AntCfgInit: primary/secondary ant 0/1
---> InitFrequencyCalibration
InitFrequencyCalibrationMode:Unknow mode = 3
InitFrequencyCalibration: frequency offset in the EEPROM = 111(0x6f)
<--- InitFrequencyCalibration
RTMPSetPhyMode: channel is out of range, use first channel=1
MCS Set = ff 00 00 00 01
<==== rt28xx_init, Status=0
0x1300 = 00064300
RTMPDrvOpen(1):Check if PDMA is idle!
RTMPDrvOpen(2):Check if PDMA is idle!
ERROR!!! MlmeEnqueueForRecv: fRTMP_ADAPTER_HALT_IN_PROGRESS
AsicSendCmdToAndes: !fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD && fRTMP_ADAPTER_IDLE_RADIO_OFF
unlink cmd rsp urb
killall: udhcpc: no process killed
udhcpc (v1.21.1) started
Sending discover...
Sending discover...
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1229)
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1168)
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1171)
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1167)
Sending discover...
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1360)
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1362)

starting pid 1364, tty '': '/bin/umount -a -r'

starting pid 1365, tty '': '/sbin/swapoff -a'

The system is going down NOW!

Sent SIGTERM toEnter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1169)
Received SIGTERM
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1170)
killall: ddnsclient: no process killed
Enter OnSignalSIGCHLD
Exit OnSignalSIGCHLD(1166)

Sent SIGKILL to all processes

Requesting system reboot
############# hidog_release 253 #############
############# hidog_release 259 #############
Restarting system.


U-Boot 2010.06 (Dec 11 2014 - 15:55:58)

Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128XX"
MMC:   MMC FLASH INIT: No card on slot!
In:    serial
Out:   serial
Err:   serial
Auto-update from SD Card:
MMC Device 1 not found
MMC Device 2 not found
MMC Device 3 not found
Can't find sd card device!
Can't load upgrade file, aborting sd -update
Auto-update from TFTP: trying update file 'recover_image.bin'
Hisilicon ETH net controler
MAC:   00-00-23-34-45-66
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.233.233; our IP address is 192.168.233.2
Download Filename 'recover_image.bin'.
Download to address: 0x82000000
Downloading: *.T T T
Retry count exceeded; starting again
Can't load update file, aborting auto-update
Hit any key to stop autoboot:  1 ... 0
16384 KiB hi_sfc at 0:0 is now current device

I contacted support@foscam.com, but they said they don't have recovery_image.bin because this model hasn't sd card. I think maybe their first line support guys not know how to solve problem. Anyone here has recovery_image.bin for FI9803P, please share me so i can recovery my fi9803P.

Really thank!

Hien
 
tcp_ack said:
Hello,

Sorry for digging this old topic. But i have Foscam FI9803P v2, it was corrupted after power outage. I connected it sucessfully via USB TTL, and saw there's boot-restart loop.

I contacted support@foscam.com, but they said they don't have recovery_image.bin because this model hasn't sd card. I think maybe their first line support guys not know how to solve problem. Anyone here has recovery_image.bin for FI9803P, please share me so i can recovery my fi9803P.

Really thank!

Hien
Click to expand...

Sadly, I don't know were to get recovery files for 9803P so the only option is to get the serial recovery package from Foscam support or find somebody with a 9803P and try to read the SPI Flash directly from a working camera.
 
GaryTTirn said:
Sadly, I don't know were to get recovery files for 9803P so the only option is to get the serial recovery package from Foscam support or find somebody with a 9803P and try to read the SPI Flash directly from a working camera.
Click to expand...
They just replied to me: There's no recovery package for 9803P :(
 
tcp_ack said:
Hi @GaryTTirn

Seems 404 error link. Btw, do you have recover package for 9803P ?

Thank you.
Click to expand...

file.io only allows a single download, somebody must have already grabbed the file and it got deleted from the server.
And no, I don't know where to get P9803 recovery files.

Unless those can be found online, the only option is to work with Foscam support to get serial recovery files.
 
Hello,
My FI9928P V2 is bricked after a firmware upgrade.
I contacted Foscam support and they accepted to send me the instructions and the files to recover the firmware using a USB/TTL adaptor.
I ordered an adaptor on Amazon and I will try the recovery in a few days:

https://www.amazon.fr/gp/product/B00LODGRV8/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&psc=1

here is a link to download the zip file.
You will find also instructions for a FI9928P ( Recovery with a SD card)

10-FOSCAM

Let me know if you succeed in recovering the firmware
 
You must log in or register to reply here.
Top Bottom