bricked foscam fi9828p

[mrcam]

Think you need to contact support as your model is not even listed on their webpage.
Most likely you can use a firmware of similar device as long as you know which one.

 

[kitoxel]

Hello and greetings from germany!

After digging around, I am unable to find the proper firmware binary for a FP9900P - it boots up successfully with the 9928 firmware - but then things pretty much end.

Does anyone have the recovery file for a FI9900P for usage with the "serial" method using tftp?

Thank you!

 

[Kaneda]

Hello and greetings from germany!

After digging around, I am unable to find the proper firmware binary for a FP9900P - it boots up successfully with the 9928 firmware - but then things pretty much end.

Does anyone have the recovery file for a FI9900P for usage with the "serial" method using tftp?

Thank you!

I contacted Foscam support for my recovery, and they sent me the flash file.

 

[kitoxel]

Hey!

I contacted Foscam support, too! And: Success! With the proper file they provided, everything is back to a working state.

Thanks again!

 

[ms1958]

Google translate: (My Eglish is not the yollow from the egg)

Hello everyone,
I received the file for the FI9900p, but without a password and without instructions.
To help, I then took the instructions from post #98 for the FI9928p
but with the Firmwaredadei that I got from Foscam for the FI9900p.
The flash process ends with

"hook_post_memfwprog"

I can't type anything with the keyboard.
But maybe I just have to wait?
In any case, the camera now only boots with error messages
and is no longer in the boot loop containing "recover_image_amba.bin"
to want to load via tftp.
So I started the flash process again and left the camera
after the notification
"hook_post_memfwprog "
something else to work on......
Greetings, ms1958
----------------------------------------------------------------------------------------------------------------------
amboot> ping 192.168.233.233
alive!
amboot> tftp program flash_FI9900P_1.11.1.5_2.74.1.7_p1.bin
downloading [flash_FI9900P_1.11.1.5_2.74.1.7_p1.bin]:
................................................................
................................................................
................................................................
................................ got 58823612 bytes
Jumping to 0x00100000


------------------------------------------------------
In-memory Firmware Flash Programming Utility (by C.C.)
Ambarella(R) Copyright (C) 2004-2008
------------------------------------------------------
Boot From: NAND 2048 RC BCH 6bit
SYS_CONFIG: 0x3007005B POC: 101
Cortex freq: 600000000
iDSP freq: 216000000
Dram freq: 528000000
Core freq: 216000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 24000000
SD freq: 48000000
SDIO freq: 48000000
SDXC freq: 48000000

hook_pre_memfwprog

bst code found in firmware!
crc32: 0xEEEE8933
ver_num: 1.3
ver_date: 2015/7/18
img_len: 2048
mem_addr: 0x00000000
flag: 0x00000001
magic: 0xA324EB90
verifying image crc ... done
program bst into NAND
progress: 100%
program ok

bld code found in firmware!
crc32: 0xFE8A0C25
ver_num: 1.3
ver_date: 2015/7/18
img_len: 168556
mem_addr: 0x00000000
flag: 0x00000000
magic: 0xA324EB90
verifying image crc ... done
program bld into NAND
progress: 100%
program ok

pba code found in firmware!
crc32: 0x8B0EB0BF
ver_num: 0.1
ver_date: 2015/7/18
img_len: 15202128
mem_addr: 0x00208000
flag: 0x00000002
magic: 0xA324EB90
verifying image crc ... done
program pba into NAND
progress: 100%
program ok

pri code found in firmware!
crc32: 0xBD021CBF
ver_num: 0.1
ver_date: 2015/7/18
img_len: 5183312
mem_addr: 0x00208000
flag: 0x00000000
magic: 0xA324EB90
verifying image crc ... done
program pri into NAND
progress: 100%
program ok

lnx code found in firmware!
crc32: 0xF3808F01
ver_num: 0.1
ver_date: 2015/7/18
img_len: 36044800
mem_addr: 0x00000000
flag: 0x00000001
magic: 0xA324EB90
verifying image crc ... done
program lnx into NAND
progress: 100%
program ok

add code found in firmware!
crc32: 0x9126EE1D
ver_num: 0.1
ver_date: 2015/7/18
img_len: 2097152
mem_addr: 0x00208000
flag: 0x00000002
magic: 0xA324EB90
verifying image crc ... done
program add into NAND
progress: 100%
program ok

DTB found in firmware!

program ok

------ Report ------
bst: success
bld: success
pba: success
pri: success
lnx: success
add: success

hook_post_memfwprog

 

[ms1958]

nach dem Reboot befinde ich mich in diesem LOOP:
after the reboot I am in this LOOP:

......
[ 102.176515] ambarella-i2c e8003000.i2c: No ACK from address 0x6c, 0:0!
[ 102.183308] ov4689_write_reg(65): VIN: failed(-16): [0x3307:0x4]
Sending discover...
[ 105.186508] ambarella-i2c e8003000.i2c: No ACK from address 0x6c, 0:0!
[ 105.193238] ov4689_write_reg(65): VIN: failed(-16): [0x3309:0x29]
Sending discover...
[ 108.196508] ambarella-i2c e8003000.i2c: No ACK from address 0x6c, 0:0!
[ 108.203376] ov4689_write_reg(65): VIN: failed(-16): [0x3500:0x0]
No lease, forking to background
[ 111.206742] ambarella-i2c e8003000.i2c: No ACK from address 0x6c, 0:0!
[ 111.213545] ov4689_write_reg(65): VIN: failed(-16): [0x3501:0x60]
[ 114.216513] ambarella-i2c e8003000.i2c: No ACK from address 0x6c, 0:0!
[ 114.223325] ov4689_write_reg(65): VIN: failed(-16): [0x3502:0x0]
udhcpc (v1.22.1) started
Sending discover...
[ 117.226506] ambarella-i2c e8003000.i2c: No ACK from address 0x6c, 0:0!
[ 117.233309] ov4689_write_reg(65): VIN: failed(-16): [0x3503:0x4]
Sending discover...
[ 120.236509] ambarella-i2c e8003000.i2c: No ACK from address 0x6c, 0:0!
[ 120.243181] ov4689_write_reg(65): VIN: failed(-16): [0x3504:0x0]
Sending discover...
[ 123.246509] ambarella-i2c e8003000.i2c: No ACK from address 0x6c, 0:0!
[ 123.253360] ov4689_write_reg(65): VIN: failed(-16): [0x3505:0x0]
No lease, forking to background
[ 126.256508] ambarella-i2c e8003000.i2c: No ACK from address 0x6c, 0:0!
[ 126.263316] ov4689_write_reg(65): VIN: failed(-16): [0x3506:0x0]
[ 129.266510] ambarella-i2c e8003000.i2c: No ACK from address 0x6c, 0:0!
[ 129.273286] ov4689_write_reg(65): VIN: failed(-16): [0x3507:0x0]
udhcpc (v1.22.1) started
......

 

[ms1958]

Now the FI9900p is finally broken. No more output at the serial TTL interface ......

......
Addendum:
You shouldn't post your results too quickly .....
Now the ttl output is still alive, I had to reset the USB adapter ....
I connected the camera to my network.... it was found ....
also got an IP via DHCP The search tool showed me the camera with IP:88, but:
1.) it no longer has a MAC address: 00:00:00:00:00:01
2.) The web front end complains that the plugin is not loaded
3.) ok, vms doesn't need the plugin, I could connect them but no picture

....... So flash it again, give the camera more time......
How can I reactivate the old Mac address?
because I didn't specify 00:00:00:00:00:01 for flashing
or do I have to set everything to 0 using setenv?
The camera has retained these settings.

I'm afraid I got the wrong firmware flash_FI9900P_1.11.1.5_2.74.1.7_p1.bin
The flash process in post #98 for the FI9928 is also very different
from that in post #95 for the FI9828.

Because you don't have to delete anything before flashing (according to the PDF) .....

so, flashed again, reboot .......
according to the serial interface the camera is (now without network cable) quite busy.
a number of setup routines seem to run off there. So let's let the camera do its work.....

an "EasySetupFW" is now running again and again and ends in a timeout ....

Greetings, ms1958