Excellent! Well done. uboot password, but a plaintext string "ipc.fos~". When I read this I laughed out load cos I misread fos as pos ... That's a brave thing to do - the erase before the tftp transfer - or did you already prove out the transfer?
I saw your great post about the foscam 9828p and I'm in the uboot console now. Flashed a .bin image and then it struck me: I don't have the right file!
Yours said 16mb, mine is FI9828P V2_app_2.x.1.132
I can't find the flash_FI9828PV2_188.8.131.52_184.108.40.206.bin file...can you tell me where I can find it, or do you have it? My camera is still on and I did not reset so I can still rescue it...