Hacking Winbond Linux-based IP/Network Cameras

Hacking Winbond Linux-based IP/Network Cameras
Introduction

An interesting item that's turned up lately are a gaggle of cheap network cameras, all bearing a striking similarity. Examples are the O-Rite IC-300 IP Cam, the VCenter NC1000 / NC1000W, and I'm sure many more. The fun thing I've discovered is that these are all based on Linux running on a Winbond W90N740 ARM processor - suggesting that hacking the firmware for greater and grander functionality is within our grasp. The O-Rite looks like the camera controller (Winbond 99682) is connected via USB. That, unfortunately, though, is about all I know at the moment, other than the majority of the filesystem is ROMFS. If you grab the "firmware update" for the VCenter units from this page, you can mount the ROMFS image for yourself given any suitable Linux box. Just use:

losetup -o 491379 /dev/loop0 20040722-VC-L10.bin mount /dev/loop0 -t romfs /mnt

Tada! There's the camera's filesystem, complete with all the HTML files. The only other reference I've found to it is on the Winbond Japan site here. Unfortunately, I don't speak Japanese, so can anybody else read that and get anything useful out of it?

I've gotten a phenominal numbers of emails about this, so I'm going to add some stuff here. Since the ROM image I use is no longer available, here's how to find the offset number: As you know, the filesystem is type ROMFS. ROMFS starts with an 8 byte header, which, in ASCII, is "-rom1fs-" (not including the quotes). Look for the first byte of that inside the image with a hex editor - there's your offset and things should mount up just fine. This page will give you the basics of ROMFS.

Also, for those of you just wanting to grab the latest JPEG image off these cameras and not mess with all the MJPEG/ActiveX crap, just use:

http://camera.address/Jpeg/CamImg.jpg

Another fine, undocumented feature that makes these little jewels more valuable.

Call For Help - I can't sort out the rest of the .bin yet. Anybody up for helping me? Just drop me an email.

  Questions? Email Nathan Holmes
© NDHolmes, but freely usable under a Creative Commons Attribution-NonCommercial-ShareAlike 2.5 License.
Last modified on March 07, 2006, at 09:05 PM
Edit Page | Page History