No thanks goes to Foscam for helping with the password but I did find the uboot password. Not too hard, it is not a proper salted SHA-256 uboot password, but a plaintext string "ipc.fos~".
Their recovery image is not encrypted like their normal images, so simple hexdump of the flash_FI9828PV2_1.4.1.10_2.11.1.132.bin revealed the password.
One can even also use binwalk to extract a JFFS2 file system from the recovery image since it is not encrypted.
U-Boot 2010.06 (Jul 21 2014 - 00:36:52)
NAND: Special Nand id table Version 1.35
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found!!!
0 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128XX"
In: serial
Out: serial
Err: serial
Auto-update from
TFTP: trying update file 'recover_image.bin'
Hisilicon ETH net controler
MAC: 00-00-XX-XX-XX-XX
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.233.233; our IP address is 192.168.233.2
Download Filename 'recover_image.bin'.
Download to address: 0x82000000
Downloading: *
Abort
Can't load update file, aborting auto-update
Hit any key to stop autoboot: 0
1st input Passwd:
2st input Passwd:
3st input Pass 0
hisilicon # printenv
bootdelay=1
baudrate=115200
ethaddr=00:00:XX:XX:XX:XX
bootfile="uImage"
bootcmd=sf probe 0;sf read 0x82000000 0x100000 0x400000;go 0x82000000
loadaddr=0x82000000
updatefile=recover_image.bin
serverip=192.168.233.233
ipaddr=192.168.233.2
netmask=255.255.255.0
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Jul 21 2014 - 00:36:52)
Environment size: 353/262140 bytes
hisilicon #
After getting access to the u-boot shell I followed their recovery instructions and attempted to recover the camera :
hisilicon # setenv serverip 192.168.233.233
hisilicon # setenv ipaddr 192.168.233.1
hisilicon # ping 192.168.233.233
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC: 00-00-XX-XX-XX-XX
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
host 192.168.233.233 is alive
hisilicon # sf probe 0
16384 KiB hi_sfc at 0:0 is now current device
hisilicon # sf erase 000000 0x1000000
Erasing at 0x1000000 -- 100% complete.
hisilicon # mw.b 82000000 ff 1000000
hisilicon # tftp 82000000 flash_FI9828PV2_1.4.1.10_2.11.1.132.bin
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC: 00-00-XX-XX-XX-XX
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.233.233; our IP address is 192.168.233.1
Download Filename 'flash_FI9828PV2_1.4.1.10_2.11.1.132.bin'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 16777216 (1000000 hex)
hisilicon # sf write 82000000 000000 1000000
Writing at 0x1000000 -- 100% complete.
hisilicon # reset
resetting ...
And the camera is alive again !