bricked foscam fi9828p

@xavier00, so your seller gave you all the tools, but not the actual firmware image that is needed for recovery, the recover_image.bin ?

Without the image the tools won't help and most of the tools should not be even needed for TFTP recovery.
Maybe the serial flash image in the zips can be renamed to recovery_image.bin and uploaded via TFTP.
I'll try to see if it matches with the recovery_image.bin when Foscam provides me with one.

Thanks for sharing the tools, those might become handy if the camera bricks beyond current state.
I'll certainly let you know if I succeed recovering mine after I get my hand on the recovery image.

What you could do is send email to tech@foscam.com and ask for the recover_image.bin-file,
just in case it happens to be different from the image in the zips.

Be prepared for long wait, for me it took about 3 weeks and several emails to get reply.
I still haven't got the recover_image.bin from Foscam, just a tech support ticket number and the request for the camera MAC address.

These Foscams are utter rubbish, I wanted to upgrade the firmware as the camera suffered from bad focus that was supposed to be fixed in new software (a reboot also helped)

No consumer camera should be so badly design that it can be bricked by bad firmware upgrade.
There should be two flash banks, one that is kept as read-only factory default so that in case of bad upgrade one can at least boot to old software and try again.
Of course that would mean they'd have to double the size of flash and that increases cost but for 200e web camera, 1 euro extra shouldn't matter ;)
 
Last edited by a moderator:
  • Like
Reactions: alastairstevenson
Now that's the firmware for serial update as far as I understand.

Chances are it is different from the recover_image.bin used for plain TFTP recovery (no serial connection needed), where the device automatically fetches the recover_image.bin from TFTP server at boot.
Serial update procedure requires manual fetch and the procedure will wipe the MAC address and DDNS settings from the camera, resetting those to factory defaults and there is a separate tool to restore those after the serial update.

You have the "DDNS restore tool for 3518A & 3518C(1).zip" and the instructions and the tool itself (FoscamRecoverTools.exe) are inside the zip to do that.
However, the DDNS cannot be recovered without Foscam's help as per their instructions they need to dig up the DDNS password from their database based on the MAC.
Depending on the case, losing DDNS may not be a great loss...

Since the Foscam C1 recovery instructions don't mention using any tools to restore anything after restoring firmware from SD card with recover_image.bin, I assume there are two options for the recover_image.bin.
1*It doesn't wipe MAC & DDNS details as it is not as complete firmware update as the one used in serial update.
2*It is a custom, device specific firmware made by Foscam tech support and already contains those needed details.

I cannot tell which is the case without having a recover_image.bin at hand.

Thus I'll wait a while in case I do get the recover_image.bin from Foscam tech support for my camera to see if just uploading that recover_image.bin via TFTP is enough to recover the camera and if I don't get it, I'll go for the serial recovery with the tools you kindly shared.
 
Last edited by a moderator:
  • Like
Reactions: alastairstevenson
i think the poe adapter in my camera is not working, light does not blink or shows on pc net, or is it normal in a bricked camera?
 
On mine the Ethernet link and activity LEDs light up normally when power is on and the camera is sending ARP Request for the TFTP server IP to network.

In case you're running windows you can also use Wireshark on it to confirm if there is something coming to the network from the camera. Obviously the LEDs should light up before this happens.

On my linux it looks like this (I did remove MAC details from the trace... I'm not into the habit of sharing those details to entire Internet :) :
kari@ubuntu-tftp-server:~$ sudo tshark -i eth0 arp
Running as user "root" and group "root". This could be dangerous.
tshark: Lua: Error during loading:
[string "/usr/share/wireshark/init.lua"]:44: dofile has been disabled due to running Wireshark as superuser. See https://wiki.wireshark.org/CaptureSetup/CapturePrivileges for help in running Wireshark as an unprivileged user.
Capturing on 'eth0'
5 28.236488435 AbbIndus_ -> Broadcast ARP 60 Who has 192.168.233.233? Tell 192.168.233.2
6 28.401174923 AbbIndus_ -> Broadcast ARP 60 Who has 192.168.233.233? Tell 192.168.233.2
7 28.565859562 AbbIndus_ -> Broadcast ARP 60 Who has 192.168.233.233? Tell 192.168.233.2
8 28.730540108 AbbIndus_ -> Broadcast ARP 60 Who has 192.168.233.233? Tell 192.168.233.2
9 28.895226407 AbbIndus_ -> Broadcast ARP 60 Who has 192.168.233.233? Tell 192.168.233.2
10 29.059914086 AbbIndus_ -> Broadcast ARP 60 Who has 192.168.233.233? Tell 192.168.233.2

Since you have the serial console you might be able to tell if there is still some lifesigns there from the camera, but if the serial is also silent I think that camera is permanently bricked as the uboot-bootloader is gone.

Reflashing the bootloader means desoldering the flash chip, getting flash jig and appropriate bootloader binary as I don't think there is a JTAG interface on the camera that could be used to flash the bootloader binary without direct access to the flash chip. Getting that bootloader binary from Foscam is probably more effort that trying a RMA procedure with their tech support (tech@foscam.com). They might be willing to send you a new circuit board or exchange the entire camera if they are reasonable and want to provide proper customer support.

By the way, I don't think FI9828P supports normal POE as such, think you need to inject power via the DIN connector from the Foscam supplied power source and you cannot use a generic POE injector.
At least here it says 9828 doesn't support POE.
 
Could be, but for now I cannot download anything from your Dropbox as Dropbox tells :

"Error (429) - This account's links are generating too much traffic and have been temporarily disabled!"

So, I'll have to wait a while to see...
 
i think the poe adapter in my camera is not working, light does not blink or shows on pc net, or is it normal in a bricked camera?
But you are able to see the Amboot and Linux startup and paste the contents on the forum here.
The camera may be partly bricked, but it certainly doesn't lack power.
 
Uboot set to bootdelay 0 or enabled password protection is generally there to prevent people from accessing the uboot.
It may very well be a deliberate setting by Foscam do just that.

Giving Ctlr-C right at the power on might still force the uboot to halt booting. Probably better to give the Ctrl-C many times.
 
does anybody has the same problem with uboot? delay set at 0 and cant interrupt?
As helpfully described in this thread - the tftp recovery method is also available.
What results did you get from that?
It seems very straightforward, the required IP addresses are documented, as is the method.
 
yeah, works, but i accidentally broke the wire to board connector on my cam and cant use lan, will try to solder it some how but im glad this problem was solved, thanks to everyone!!!
 
I got fed up waiting for Foscam tech support and decided to give flash_FI9828PV2_1.4.1.10_2.11.1.131.bin from @xavier00 zip a go.
I renamed it recover_image.bin and setup TFTP server to serve it out.

It went smoothly but ended up in the same old boot loop, so I set up serial console.
I actually abused the alarm connector, it has same 4-pin header (green, purple, orange and yellow wires) as the serial header on the PCB,
so now I have serial permanently available via the external alarm connector.

In this serial setup, External alarm connector pin 4 is TX, pin 3 GND and pin 2 RX as labelled on the connector. Pin 1 is +3,3v, so do not ever connect that to anything, especially GND.

Looks like there is difference between the flash_FI9828PV2_1.4.1.10_2.11.1.131.bin and recover_image.bin as this one was not accepted.


U-Boot 2010.06 (Jul 21 2014 - 00:36:52)


NAND: Special Nand id table Version 1.35
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found!!!
0 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128XX"
In: serial
Out: serial
Err: serial
Auto-update from TFTP: trying update file 'recover_image.bin'
Hisilicon ETH net controler
MAC: 00-00-23-34-45-66
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.233.233; our IP address is 192.168.233.2
Download Filename 'recover_image.bin'.
Download to address: 0x82000000
Downloading: #################################################
done
Bytes transferred = 16777216 (1000000 hex)
Unkonw update file or Bad Platform !!!!!!!!
Hit any key to stop autoboot: 0

So back to the waiting game and hoping Foscam tech support delivers something that works.

By the way I didn't know there was a micro-sd slot inside the FI9828P.
I wonder if it can be enabled for use just by putting in a micro-sd...

Just for the heck of it I checked what would happen if recover_image.bin is not available :
U-Boot 2010.06 (Jul 21 2014 - 00:36:52)


NAND: Special Nand id table Version 1.35
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found!!!
0 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128XX"
In: serial
Out: serial
Err: serial
Auto-update from TFTP: trying update file 'recover_image.bin'
Hisilicon ETH net controler
MAC: 00-00-23-34-45-66
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.233.233; our IP address is 192.168.233.2
Download Filename 'recover_image.bin'.
Download to address: 0x82000000
Downloading: *
Abort
Can't load update file, aborting auto-update
Hit any key to stop autoboot: 0
1st input Passwd:
2st input Passwd:

So uboot is locked down with password and thus access to the uboot command line for manual serial upgrade requires help from Foscam. Bummer.
 
Last edited by a moderator:
No thanks goes to Foscam for helping with the password but I did find the uboot password. Not too hard, it is not a proper salted SHA-256 uboot password, but a plaintext string "ipc.fos~".
Their recovery image is not encrypted like their normal images, so simple hexdump of the flash_FI9828PV2_1.4.1.10_2.11.1.132.bin revealed the password.

One can even also use binwalk to extract a JFFS2 file system from the recovery image since it is not encrypted.

U-Boot 2010.06 (Jul 21 2014 - 00:36:52)

NAND: Special Nand id table Version 1.35
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found!!!
0 MiB
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128XX"
In: serial
Out: serial
Err: serial
Auto-update from TFTP: trying update file 'recover_image.bin'
Hisilicon ETH net controler
MAC: 00-00-XX-XX-XX-XX
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.233.233; our IP address is 192.168.233.2
Download Filename 'recover_image.bin'.
Download to address: 0x82000000
Downloading: *
Abort
Can't load update file, aborting auto-update
Hit any key to stop autoboot: 0
1st input Passwd:
2st input Passwd:
3st input Pass 0
hisilicon # printenv
bootdelay=1
baudrate=115200
ethaddr=00:00:XX:XX:XX:XX
bootfile="uImage"
bootcmd=sf probe 0;sf read 0x82000000 0x100000 0x400000;go 0x82000000
loadaddr=0x82000000
updatefile=recover_image.bin
serverip=192.168.233.233
ipaddr=192.168.233.2
netmask=255.255.255.0
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Jul 21 2014 - 00:36:52)


Environment size: 353/262140 bytes
hisilicon #

After getting access to the u-boot shell I followed their recovery instructions and attempted to recover the camera :

hisilicon # setenv serverip 192.168.233.233
hisilicon # setenv ipaddr 192.168.233.1
hisilicon # ping 192.168.233.233
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC: 00-00-XX-XX-XX-XX
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
host 192.168.233.233 is alive
hisilicon # sf probe 0
16384 KiB hi_sfc at 0:0 is now current device
hisilicon # sf erase 000000 0x1000000
Erasing at 0x1000000 -- 100% complete.
hisilicon # mw.b 82000000 ff 1000000
hisilicon # tftp 82000000 flash_FI9828PV2_1.4.1.10_2.11.1.132.bin
Hisilicon ETH net controler
miiphy_register: non unique device name '0:1'
miiphy_register: non unique device name '0:2'
MAC: 00-00-XX-XX-XX-XX
UP_PORT : phy status change : LINK=UP : DUPLEX=FULL : SPEED=100M
TFTP from server 192.168.233.233; our IP address is 192.168.233.1
Download Filename 'flash_FI9828PV2_1.4.1.10_2.11.1.132.bin'.
Download to address: 0x82000000


Downloading: #################################################
done
Bytes transferred = 16777216 (1000000 hex)
hisilicon # sf write 82000000 000000 1000000
Writing at 0x1000000 -- 100% complete.
hisilicon # reset
resetting ...

And the camera is alive again !
 
Last edited by a moderator: