Hacking the Wansview NCS601W IP camera
The Wansview NCS601W is one of these "cloud only" devices which are only configurable with a special piece of software and -unlike "normal" ip cameras- don’t provide any web interface. As I failed to read the item description thoroughly enough, I accidentally bought one of these useless bricks, so what to do with it? A quick search on the internet revealed that the camera stream can be accessed with a web browser under the url "http://IPADDRESS/goform/video" with username and password being admin/admin. While this is at least something, you will still be unable to set a static ip or configure the wifi on this device, still limiting it’s use. Searching a little further, I discovered that the "goform" url scheme is widely used on devices with the ramips architecture, which have software-wise been developed with the Ralink SDK. Often enough, remains of the SDK can be found on these devices, offering more possibilities than the manufacturer intended. Searching for these remains, I indeed found a couple of commands that could be executed. Some of them produced some usable output, such as "goform/getMyMAC", some just threw an error, such as "goform/SetWan", "goform/wirelessBasic" or "goform/storageGetFirmwarePath". I was very pleased to find out that "/goform/syslog" revealed the log of the device:
Jan 1 00:00:17 (none) syslog.info syslogd started: BusyBox v1.12.1
Jan 1 00:00:17 (none) user.debug WebServer[1014]: "klogd 1>/dev/null 2>&1 "
Jan 1 00:00:17 (none) user.notice kernel: klogd started: BusyBox v1.12.1 (2013-01-02 17:42:00 CST)
Jan 1 00:00:17 (none) user.notice kernel: Linux version 2.6.21 (root@qa1) (gcc version 3.4.2) #1246 Wed Jan 2 18:01:07 CST 2013
Jan 1 00:00:17 (none) user.warn kernel:
Jan 1 00:00:17 (none) user.warn kernel: The CPU feqenuce set to 360 MHz
Jan 1 00:00:17 (none) user.warn kernel: CPU revision is: 0001964c
Jan 1 00:00:17 (none) user.warn kernel: Determined physical RAM map:
Jan 1 00:00:17 (none) user.warn kernel: memory: 04000000 @ 00000000 (usable)
Jan 1 00:00:17 (none) user.info kernel: Initrd not found or empty - disabling initrd
Jan 1 00:00:17 (none) user.debug kernel: On node 0 totalpages: 16384
Jan 1 00:00:17 (none) user.debug kernel: DMA zone: 128 pages used for memmap
Jan 1 00:00:17 (none) user.debug kernel: DMA zone: 0 pages reserved
Jan 1 00:00:17 (none) user.debug WebServer[1014]: "killall -q zebra "
Jan 1 00:00:17 (none) user.debug kernel: DMA zone: 16256 pages, LIFO batch:3
Jan 1 00:00:17 (none) user.debug kernel: Normal zone: 0 pages used for memmap
Jan 1 00:00:17 (none) user.warn kernel: Built 1 zonelists. Total pages: 16256
Jan 1 00:00:17 (none) user.notice kernel: Kernel command line: console=ttyS1,57600n8 root=/dev/ram0
Jan 1 00:00:17 (none) user.warn kernel: Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Jan 1 00:00:17 (none) user.warn kernel: Primary data cache 16kB, 4-way, linesize 32 bytes.
Jan 1 00:00:17 (none) user.info kernel: Synthesized TLB refill handler (20 instructions).
Jan 1 00:00:17 (none) user.info kernel: Synthesized TLB load handler fastpath (32 instructions).
Jan 1 00:00:17 (none) user.info kernel: Synthesized TLB store handler fastpath (32 instructions).
Jan 1 00:00:17 (none) user.info kernel: Synthesized TLB modify handler fastpath (31 instructions).
Jan 1 00:00:17 (none) user.info kernel: Cache parity protection disabled
Jan 1 00:00:17 (none) user.warn kernel: cause = d0808060, status = 11000000
Jan 1 00:00:17 (none) user.warn kernel: PID hash table entries: 256 (order: 8, 1024 bytes)
Jan 1 00:00:17 (none) user.warn kernel: calculating r4koff... 0015f900(1440000)
Jan 1 00:00:17 (none) user.warn kernel: CPU frequency 360.00 MHz
Jan 1 00:00:17 (none) user.warn kernel: Using 180.000 MHz high precision timer.
Jan 1 00:00:17 (none) user.warn kernel: Console: colour dummy device 80x25
Jan 1 00:00:17 (none) user.warn kernel: Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Jan 1 00:00:17 (none) user.warn kernel: Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Jan 1 00:00:17 (none) user.info kernel: Memory: 57800k/65536k available (2952k kernel code, 7680k reserved, 803k data, 3240k init, 0k highmem)
Jan 1 00:00:17 (none) user.debug kernel: Calibrating delay loop... 239.61 BogoMIPS (lpj=479232)
Jan 1 00:00:17 (none) user.warn kernel: Mount-cache hash table entries: 512
Jan 1 00:00:17 (none) user.info kernel: NET: Registered protocol family 16
Jan 1 00:00:17 (none) user.notice kernel: SCSI subsystem initialized
Jan 1 00:00:17 (none) user.warn kernel: calling usb_register_driver(usbfs,usbcore).............
Jan 1 00:00:17 (none) user.info kernel: usbcore: registered new interface driver usbfs
Jan 1 00:00:17 (none) user.warn kernel: calling usb_register_driver(hub,usbcore).............
Jan 1 00:00:17 (none) user.info kernel: usbcore: registered new interface driver hub
Jan 1 00:00:17 (none) user.info kernel: usbcore: registered new device driver usb
Jan 1 00:00:17 (none) user.info kernel: NET: Registered protocol family 2
Jan 1 00:00:17 (none) user.info kernel: Time: MIPS clocksource has been installed.
Jan 1 00:00:17 (none) user.warn kernel: IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
Jan 1 00:00:17 (none) user.warn kernel: TCP established hash table entries: 2048 (order: 2, 16384 bytes)
Jan 1 00:00:17 (none) user.warn kernel: TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
Jan 1 00:00:17 (none) user.info kernel: TCP: Hash tables configured (established 2048 bind 2048)
Jan 1 00:00:17 (none) user.info kernel: TCP reno registered
Jan 1 00:00:17 (none) user.warn kernel: detected lzma initramfs
Jan 1 00:00:17 (none) user.notice kernel: detected lzma initramfs
Jan 1 00:00:17 (none) user.notice kernel: initramfs: LZMA lc=3,lp=0,pb=2,dictSize=1048576,origSize=12050432
Jan 1 00:00:17 (none) user.notice kernel: LZMA initramfs by Ming-Ching Tiew <mctiew@yahoo.com>...............................................................................................................................................................................
Jan 1 00:00:17 (none) user.warn kernel: W25Q64BV(ef 40170000) (8192 Kbytes)
Jan 1 00:00:17 (none) user.warn kernel: mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Jan 1 00:00:17 (none) user.notice kernel: Creating 6 MTD partitions on "raspi":
Jan 1 00:00:17 (none) user.notice kernel: 0x00000000-0x00800000 : "ALL"
Jan 1 00:00:17 (none) user.notice kernel: 0x00000000-0x00030000 : "Bootloader"
Jan 1 00:00:17 (none) user.notice kernel: 0x00030000-0x00040000 : "Config"
Jan 1 00:00:17 (none) user.notice kernel: 0x00040000-0x00050000 : "Factory"
Jan 1 00:00:17 (none) user.notice kernel: 0x00050000-0x00620000 : "Kernel"
Jan 1 00:00:17 (none) user.notice kernel: 0x00620000-0x00800000 : "Kernel0"
Jan 1 00:00:17 (none) user.warn kernel: RT3xxx EHCI/OHCI init.
Jan 1 00:00:17 (none) user.info kernel: squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
Jan 1 00:00:17 (none) user.warn kernel: squashfs: LZMA suppport for slax.org by jro
Jan 1 00:00:17 (none) user.warn kernel: fuse init (API version 7.8)
Jan 1 00:00:17 (none) user.info kernel: io scheduler noop registered (default)
Jan 1 00:00:17 (none) user.warn kernel: entering ralink_gpio_init.......
Jan 1 00:00:17 (none) user.warn kernel: has 5124
Jan 1 00:00:17 (none) user.warn kernel: org gpiomode=0x404290
Jan 1 00:00:17 (none) user.warn kernel: Ralink gpio driver initialized
Jan 1 00:00:17 (none) user.info kernel: HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
Jan 1 00:00:17 (none) user.info kernel: N_HDLC line discipline registered.
Jan 1 00:00:17 (none) user.info kernel: Serial: 8250/16550 driver $Revision: 1.7 $ 2 ports, IRQ sharing disabled
Jan 1 00:00:17 (none) user.info kernel: serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
Jan 1 00:00:17 (none) user.info kernel: serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
Jan 1 00:00:17 (none) user.warn kernel: RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
Jan 1 00:00:17 (none) user.info kernel: loop: loaded (max 8 devices)
Jan 1 00:00:17 (none) user.warn kernel: rdm_major = 254
Jan 1 00:00:17 (none) user.warn kernel: MAC_ADRH -- : 0x00000000
Jan 1 00:00:17 (none) user.warn kernel: MAC_ADRL -- : 0x00000000
Jan 1 00:00:17 (none) user.warn kernel: Ralink APSoC Ethernet Driver Initilization. v2.0 256 rx/tx descriptors allocated, mtu = 1500!
Jan 1 00:00:17 (none) user.warn kernel: MAC_ADRH -- : 0x0000xxxx
Jan 1 00:00:17 (none) user.warn kernel: MAC_ADRL -- : 0xdd05xxxx
Jan 1 00:00:17 (none) user.alert kernel: PROC INIT OK!
Jan 1 00:00:17 (none) user.warn kernel:
Jan 1 00:00:17 (none) user.warn kernel:
Jan 1 00:00:17 (none) user.warn kernel: === pAd = c0019000, size = 646704 ===
Jan 1 00:00:17 (none) user.warn kernel:
Jan 1 00:00:17 (none) user.warn kernel: <-- RTMPAllocAdapterBlock, Status=0
Jan 1 00:00:17 (none) user.info kernel:
Jan 1 00:00:17 (none) user.info kernel: Linux video capture interface: v2.00
Jan 1 00:00:17 (none) user.warn kernel: calling usb_register_driver(dabusb,dabusb).............
Jan 1 00:00:17 (none) user.info kernel: usbcore: registered new interface driver dabusb
Jan 1 00:00:17 (none) user.info kernel: drivers/media/video/dabusb.c: v1.54:DAB-USB Interface Driver for Linux (c)1999
Jan 1 00:00:17 (none) user.warn kernel: calling usb_register_driver(uvcvideo,uvcvideo).............
Jan 1 00:00:17 (none) user.info kernel: usbcore: registered new interface driver uvcvideo
Jan 1 00:00:17 (none) user.info kernel: USB Video Class driver (SVN r209)
Jan 1 00:00:17 (none) user.info kernel: block2mtd: version $Revision: 1.1.1.1 $
Jan 1 00:00:17 (none) user.info kernel: rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
Jan 1 00:00:17 (none) user.info kernel: rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
Jan 1 00:00:17 (none) user.info kernel: rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
Jan 1 00:00:17 (none) user.info kernel: rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
Jan 1 00:00:17 (none) user.info kernel: usb usb1: configuration #1 chosen from 1 choice
Jan 1 00:00:17 (none) user.info kernel: hub 1-0:1.0: USB hub found
Jan 1 00:00:17 (none) user.info kernel: hub 1-0:1.0: 1 port detected
Jan 1 00:00:17 (none) user.debug kernel: ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver
Jan 1 00:00:17 (none) user.info kernel: rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
Jan 1 00:00:17 (none) user.info kernel: rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
Jan 1 00:00:17 (none) user.info kernel: rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
Jan 1 00:00:17 (none) user.info kernel: usb usb2: configuration #1 chosen from 1 choice
Jan 1 00:00:17 (none) user.info kernel: hub 2-0:1.0: USB hub found
Jan 1 00:00:17 (none) user.info kernel: hub 2-0:1.0: 1 port detected
Jan 1 00:00:17 (none) user.info kernel: Initializing USB Mass Storage driver...
Jan 1 00:00:17 (none) user.warn kernel: calling usb_register_driver(usb-storage,usb_storage).............
Jan 1 00:00:17 (none) user.info kernel: usb 2-1: new full speed USB device using rt3xxx-ohci and address 2
Jan 1 00:00:17 (none) user.info kernel: usb 2-1: configuration #1 chosen from 1 choice
Jan 1 00:00:17 (none) user.warn kernel: Found format MJPEG.
Jan 1 00:00:17 (none) user.warn kernel: - 640x480 (30.0 fps)
Jan 1 00:00:17 (none) user.warn kernel: - 320x240 (30.0 fps)
Jan 1 00:00:17 (none) user.warn kernel: - 160x120 (30.0 fps)
Jan 1 00:00:17 (none) user.info kernel: uvcvideo: Found UVC 1.00 device <unnamed> (1b3b:2975)
Jan 1 00:00:17 (none) user.warn kernel: uvcvideo: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround.
Jan 1 00:00:17 (none) user.info kernel: input: UVC Camera (1b3b:2975) as /class/input/input0
Jan 1 00:00:17 (none) user.info kernel: usbcore: registered new interface driver usb-storage
Jan 1 00:00:17 (none) user.info kernel: USB Mass Storage support registered.
Jan 1 00:00:17 (none) user.info kernel: Advanced Linux Sound Architecture Driver Version 1.0.14rc3 (Wed Mar 14 07:25:50 2007 UTC).
Jan 1 00:00:17 (none) user.warn kernel: calling usb_register_driver(snd-usb-audio,snd_usb_audio).............
Jan 1 00:00:17 (none) user.info kernel: usbcore: registered new interface driver snd-usb-audio
Jan 1 00:00:17 (none) user.info kernel: ALSA device list:
Jan 1 00:00:17 (none) user.info kernel: #0: USB Device 0x1b3b:0x2975 at usb-rt3xxx-ohci-1, full speed
Jan 1 00:00:17 (none) user.warn kernel: nf_conntrack version 0.5.0 (512 buckets, 4096 max)
Jan 1 00:00:17 (none) user.warn kernel: ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
Jan 1 00:00:17 (none) user.warn kernel: arp_tables: (C) 2002 David S. Miller
Jan 1 00:00:17 (none) user.info kernel: TCP cubic registered
Jan 1 00:00:17 (none) user.info kernel: NET: Registered protocol family 1
Jan 1 00:00:17 (none) user.info kernel: NET: Registered protocol family 17
Jan 1 00:00:17 (none) user.info kernel: 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
Jan 1 00:00:17 (none) user.info kernel: All bugs added by David S. Miller <davem@redhat.com>
Jan 1 00:00:17 (none) user.info kernel: Freeing unused kernel memory: 3240k freed
Jan 1 00:00:17 (none) user.warn kernel: Algorithmics/MIPS FPU Emulator v1.5
Jan 1 00:00:17 (none) user.err kernel: devpts: called with bogus options
Jan 1 00:00:17 (none) user.warn kernel:
Jan 1 00:00:17 (none) user.warn kernel: phy_tx_ring = 0x0056f000, tx_ring = 0xa056f000
Jan 1 00:00:17 (none) user.warn kernel:
Jan 1 00:00:17 (none) user.warn kernel: phy_rx_ring0 = 0x00570000, rx_ring0 = 0xa0570000
Jan 1 00:00:17 (none) user.warn kernel: RT305x_ESW: Link Status Changed
Jan 1 00:00:17 (none) user.debug kernel: eth2.2: add 01:00:5e:00:00:01 mcast address to master interface
Jan 1 00:00:17 (none) user.debug kernel: eth2.2: del 01:00:5e:00:00:01 mcast address from vlan interface
Jan 1 00:00:17 (none) user.debug kernel: eth2.2: del 01:00:5e:00:00:01 mcast address from master interface
Jan 1 00:00:17 (none) user.debug kernel: eth2.2: add 01:00:5e:00:00:01 mcast address to master interface
Jan 1 00:00:17 (none) user.debug WebServer[1014]: "webs: Listening for HTTP requests at address 10.68.68.22 "
Jan 1 00:00:17 (none) user.debug WebServer[1014]: "iwpriv ra0 set SSID=+CAMXXXX "
Jan 1 00:00:19 (none) user.warn kernel: RX DESC a3088000 size = 2048
Jan 1 00:00:19 (none) user.warn kernel: <-- RTMPAllocTxRxRingMemory, Status=0
Jan 1 00:00:20 (none) user.warn kernel: Key1Str is Invalid key length(0) or Type(0)
Jan 1 00:00:20 (none) user.warn kernel: Key2Str is Invalid key length(0) or Type(0)
Jan 1 00:00:20 (none) user.warn kernel: Key3Str is Invalid key length(0) or Type(0)
Jan 1 00:00:20 (none) user.warn kernel: Key4Str is Invalid key length(0) or Type(0)
Jan 1 00:00:20 (none) user.warn kernel: 13:36:ab:37:1a:3b:0d:40:5e:80:6c:a3:bb:b2:6c:03:
Jan 1 00:00:20 (none) user.warn kernel: 4e:52:b0:a0:89:28:d6:3d:ea:bd:e3:3a:5c:f9:b1:10:
Jan 1 00:00:20 (none) user.warn kernel:
Jan 1 00:00:20 (none) user.warn kernel: 1. Phy Mode = 9
Jan 1 00:00:20 (none) user.warn kernel: 2. Phy Mode = 9
Jan 1 00:00:20 (none) user.warn kernel: 3. Phy Mode = 9
Jan 1 00:00:20 (none) user.warn kernel: RTMPSetPhyMode: channel is out of range, use first channel=0
Jan 1 00:00:20 (none) user.warn kernel: MCS Set = ff 00 00 00 01
Jan 1 00:00:20 (none) user.warn kernel: SYNC - BBP R4 to 20MHz.l
Jan 1 00:00:22 (none) user.warn kernel: SYNC - BBP R4 to 20MHz.l
Jan 1 00:00:22 (none) user.warn kernel: SYNC - BBP R4 to 20MHz.l
Jan 1 00:00:22 (none) user.debug WebServer[1014]: " i: Using V4L2 device.: /dev/video0 "
Jan 1 00:00:22 (none) user.debug WebServer[1014]: " i: Desired Resolution: 320 x 240 "
Jan 1 00:00:22 (none) user.debug WebServer[1014]: " i: Frames Per Second.: 10 "
Jan 1 00:00:23 (none) user.warn kernel: SYNC - BBP R4 to 20MHz.l
Jan 1 00:00:23 (none) user.warn kernel: SYNC - BBP R4 to 20MHz.l
Jan 1 00:00:23 (none) user.warn kernel: SYNC - BBP R4 to 20MHz.l
Jan 1 00:00:23 (none) user.warn kernel: SYNC - BBP R4 to 20MHz.l
Jan 1 00:00:24 (none) user.warn kernel: SYNC - BBP R4 to 20MHz.l
Jan 1 00:00:24 (none) user.warn kernel: SYNC - BBP R4 to 20MHz.l
Jan 1 00:00:24 (none) user.debug WebServer[1014]: "----------------initializing motion detection"
Jan 1 00:00:24 (none) user.debug WebServer[1014]: "addr=0xc1, 19"
Jan 1 00:00:24 (none) user.debug WebServer[1014]: "SD_UpdateMotionDetectSettings, FrameInterval=0, MotionYThd=117, MotionBThd=0, MotionBlockSet=0x000000f0, FrameCount=224"
Jan 1 00:00:24 (none) user.warn kernel: SYNC - BBP R4 to 20MHz.l
Jan 1 00:00:25 (none) user.warn kernel: Main bssid = 78:a5:xx:xx:xx:xx
Jan 1 00:00:25 (none) user.warn kernel: <==== rt28xx_init, Status=0
Jan 1 00:00:25 (none) user.warn kernel: 0x1300 = 00064380
Jan 1 00:00:25 (none) user.info kernel: device ra0 entered promiscuous mode
Jan 1 00:00:26 (none) user.info kernel: br0: port 1(ra0) entering learning state
Jan 1 00:00:26 (none) user.debug WebServer[1014]: "grabbing video thread run\n"
Jan 1 00:00:26 (none) user.debug WebServer[1014]: "grabbing audio thread run"
Jan 1 00:00:26 (none) user.debug WebServer[1390]: "sclear.sh ftp "
Jan 1 00:00:26 (none) user.debug WebServer[1391]: "++++++++++++++++++++++++++++++++++++++++++++++++++++++"
Jan 1 00:00:26 (none) user.debug WebServer[1391]: "The init values are:"
Jan 1 00:00:26 (none) user.debug WebServer[1391]: "format = Signed 16 bit Little Endian"
Jan 1 00:00:26 (none) user.debug WebServer[1391]: "channels = 1"
Jan 1 00:00:26 (none) user.debug WebServer[1391]: "framerate = 8000"
Jan 1 00:00:26 (none) user.debug WebServer[1391]: "++++++++++++++++++++++++++++++++++++++++++++++++++++++"
Jan 1 00:00:26 (none) user.debug WebServer[1014]: "event action thread run"
Jan 1 00:00:26 (none) user.debug WebServer[1014]: "send thread run\n"
Jan 1 00:00:26 (none) user.debug WebServer[1393]: "gethostbyname failed to get ip "
Jan 1 00:00:26 (none) user.debug WebServer[1395]: "start running goaheadTick"
Jan 1 00:00:26 (none) user.debug WebServer[1396]: "goaheadDetectStatusThread begin run-------\n"
Jan 1 00:00:26 (none) user.warn kernel: ioctl read, change direction first
Jan 1 00:00:26 (none) user.warn kernel: <<<<<<<<<<<<<<<<<<<<<<<usb_set_interface failed
Jan 1 00:00:26 (none) user.debug WebServer[1391]: "size = 1024"
Jan 1 00:00:30 (none) cron.err crond[1835]: crond (busybox 1.12.1) started, log level 8
Jan 1 00:00:31 (none) user.debug WebServer[1395]: "iwpriv ra0 set SSID=+CAMXXXX "
Jan 1 00:00:36 (none) user.debug WebServer[1395]: "webRegisterThread begin"
Jan 1 00:00:39 (none) user.debug WebServer[2278]: "iwpriv ra0 set SiteSurvey=1 "
Jan 1 00:00:41 (none) user.info kernel: br0: topology change detected, propagating
Jan 1 00:00:41 (none) user.info kernel: br0: port 1(ra0) entering forwarding state
Jan 1 00:00:41 (none) user.debug WebServer[2278]: "sort the ap list by signal strength."
Jan 1 00:00:41 (none) user.debug WebServer[2278]: "output ap list for an special format."
Jan 1 00:10:53 (none) user.debug WebServer[2278]: "webpage register time run out!"
Jan 1 00:10:53 (none) user.debug WebServer[2278]: "Camera===>Seedonk: https://www.seedonk.com/camsetup/result.php?MAC=78:A5:XX:XX:XX:XX&KEY=xxxxxxxxxxxxxxxxxxx&random=xxxxxxxxxx&ACTION=TIMEOUT"
Jan 1 00:11:03 (none) user.debug WebServer[2278]: "webpage register thread quit !!!"
Jan 1 00:18:17 (none) user.info kernel: br0: port 1(ra0) entering disabled state
Jan 1 00:21:59 (none) user.debug WebServer[1014]: "cat /dev/null > /var/system_command.log "Finally, I discoverd that another working url was "goform/SystemCommand". This one got me excited and I tried "goform/SystemCommand?command=telnetd". While I was presented an error, a quick look at the syslog (which fortunately was accessible now) revealed that the device indeed started a telnet server. :-) I was able to telnet into the device with the admin/admin credentials and dropped into a root shell afterwards. I was also able to dump the flash partitions to /tmp and transfer them to my computer with the ftp_put command, but I never got around to do anything further with the device. The flash layout looks like this:
# cat /proc/mtd
dev: size erasesize name
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 005d0000 00010000 "Kernel"
mtd5: 001e0000 00010000 "Kernel0"Update
OpenWRT
I hadn’t played around with the device for quite a while, and in the meantime OpenWRT had been ported to the device, offering the possibility to turn it into something useful after all, e.g. for using it as a "normal" ip camera with motion or mjpeg_streamer. Unfortunately, there is no documentation whatsoever on how to get it installed onto the device. There is an mtd_write command, and you can easily tftp the OpenWRT image to /tmp, but I was unsure how to flash it, especially on which MTD partition (if this is possible at all within the running system). In the end, I decided to open up the device, and voila, I found a nice (though unpopulated) UART connector on the PCB.
After I bought an UART to USB adaptor and soldered a connector to the PCB, I could access the boot loader (U-Boot) from a serial console. If you want to try OpenWRT on the device, you first need the "initramfs" flavour which can be booted via TFTP (option 1 in U-Boot). If it happily boots up, you can boot and flash it in the next step (option 2 in U-Boot). Once installed, you can switch to the "squashfs" flavour of OpenWRT which gives you the opportunity to install additional software packages in the remaining free space. Updating is not possible with the "sysupgrade" command or luci yet, because sysupgrade does not yet support the device. Instead, you will have to wget the image e.g. to /tmp and manually flash it with this command:
# mtd write /tmp/openwrt-ramips-rt305x-ncs601W-squashfs-sysupgrade.bin firmwareAlso note that the OpenWRT images which are available for download are minimal, i.e. without v4l2 kernel module, without snd_usb, motion, mjpeg_streamer and the like. If you intend to use the device for its original purpose, i.e. as a camera, you will have to install those either from packages afterwards or compile OpenWRT yourself and include the desired components.
For now, I have not been able to get the camera to work with motion or mjpeg-streamer yet. Motion always leaves me with an "Unable to find a compatible palette format." error:
root@OpenWrt:~# motion -c /etc/motion.conf
[0] [NTC] [ALL] conf_load: Processing thread 0 - config file /etc/motion.conf
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "ffmpeg_output_movies"
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "ffmpeg_output_debug_movies"
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "ffmpeg_timelapse"
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "ffmpeg_timelapse_mode"
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "ffmpeg_bps"
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "ffmpeg_variable_bitrate"
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "ffmpeg_video_codec"
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "ffmpeg_deinterlace"
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "movie_filename"
[0] [ALR] [ALL] conf_cmdparse: Unknown config option "timelapse_filename"
[0] [NTC] [ALL] motion_startup: Motion 3.4.0-Git-78ba2da Started
[0] [NTC] [ALL] motion_startup: Logging to syslog
[0] [NTC] [ALL] motion_startup: Using log type (ALL) log level (NTC)
[0] [NTC] [ALL] main: Thread 1 is from /etc/motion.conf
[0] [NTC] [ALL] main: Thread 1 is device: /dev/video0 input -1
[0] [NTC] [ALL] main: Stream port 8081
[0] [NTC] [ALL] main: Waiting for threads to finish, pid: 4910
[0] [NTC] [STR] httpd_run: motion-httpd testing : IPV4 addr: 127.0.0.1 port: 8080
[0] [NTC] [STR] httpd_run: motion-httpd Bound : IPV4 addr: 127.0.0.1 port: 8080
[0] [NTC] [STR] httpd_run: motion-httpd/3.4.0-Git-78ba2da running, accepting connections
[0] [NTC] [STR] httpd_run: motion-httpd: waiting for data on 127.0.0.1 port TCP 8080
[1] [NTC] [ALL] motion_init: Thread 1 started , motion detection Enabled
[1] [NTC] [VID] vid_v4lx_start: Using videodevice /dev/video0 and input -1
[1] [NTC] [VID] v4l2_get_capability:
cap.driver: "uvcvideo"
cap.card: "UVC Camera (1b3b:2975)"
cap.bus_info: "usb-101c1000.ohci-1"
cap.capabilities=0x84000001
[1] [NTC] [VID] v4l2_get_capability: - VIDEO_CAPTURE
[1] [NTC] [VID] v4l2_get_capability: - STREAMING
[1] [NTC] [VID] v4l2_select_input: name = "Camera 1", type 0x00000002, status 00000000
[1] [NTC] [VID] v4l2_select_input: - CAMERA
[1] [WRN] [VID] v4l2_select_input: Device doesn't support VIDIOC_G_STD
[1] [NTC] [VID] v4l2_set_pix_format: Config palette index 17 (YU12) doesn't work.
[1] [NTC] [VID] v4l2_set_pix_format: Supported palettes:
[1] [NTC] [VID] v4l2_set_pix_format: (0) MJPG (MJPEG)
[1] [NTC] [VID] v4l2_set_pix_format: 0 - MJPEG (compressed : 1) (0x47504a4d)
[1] [NTC] [VID] v4l2_set_pix_format Selected palette MJPG
[1] [ERR] [VID] VIDIOC_TRY_FMT failed for format v4l2_set_pix_format: Input/output error
[1] [ERR] [VID] v4l2_set_pix_format: Unable to find a compatible palette format.
[1] [NTC] [VID] vid_v4lx_start: Using V4L1
[1] [NTC] [ALL] image_ring_resize: Resizing pre_capture buffer to 1 items
[1] [ERR] [ALL] motion_init: Error capturing first image
[1] [NTC] [STR] http_bindsock: motion-stream testing : IPV4 addr: 127.0.0.1 port: 8081
[1] [NTC] [STR] http_bindsock: motion-stream Bound : IPV4 addr: 127.0.0.1 port: 8081
[1] [NTC] [ALL] motion_init: Started motion-stream server in port 8081 auth Disabled
[1] [ERR] [ALL] motion_loop: Video device fatal error - Closing video device
[1] [NTC] [VID] vid_close: Closing video device /dev/video0I can grab single images with the following command though:
# v4l2-ctl --stream-count=1 --stream-to=/www/webcam/test.jpgThe output of "v4l2-ctl --info --all" is:
Driver Info (not using libv4l2):
Driver name : uvcvideo
Card type : UVC Camera (1b3b:2975)
Bus info : usb-101c1000.ohci-1
Driver version: 3.18.18
Capabilities : 0x84000001
Video Capture
Streaming
Device Capabilities
Device Caps : 0x04000001
Video Capture
Streaming
Priority: 2
Video input : 0 (Camera 1: ok)
Format Video Capture:
Width/Height : 640/480
Pixel Format : 'MJPG'
Field : None
Bytes per Line: 0
Size Image : 307712
Colorspace : SRGB
Crop Capability Video Capture:
Bounds : Left 0, Top 0, Width 640, Height 480
Default : Left 0, Top 0, Width 640, Height 480
Pixel Aspect: 1/1
Streaming Parameters Video Capture:
Capabilities : timeperframe
Frames per second: 30.000 (30/1)
Read buffers : 0
brightness (int) : min=1 max=255 step=1 default=132 value=132
contrast (int) : min=0 max=255 step=1 default=32 value=32
saturation (int) : min=0 max=255 step=1 default=64 value=64
hue (int) : min=-90 max=90 step=1 default=0 value=0
gamma (int) : min=5 max=30 step=5 default=30 value=30
power_line_frequency (menu) : min=0 max=2 default=2 value=2
sharpness (int) : min=0 max=15 step=1 default=2 value=2
backlight_compensation (int) : min=0 max=1 step=1 default=0 value=0
pan_absolute (int) : min=-648000 max=648000 step=3600 default=0 value=0
tilt_absolute (int) : min=-648000 max=648000 step=3600 default=0 value=0
zoom_absolute (int) : min=1 max=3 step=1 default=1 value=1
iris_absolute (int) : min=0 max=6 step=1 default=6 value=6
brightness (int) : min=1 max=255 step=1 default=132 value=132
contrast (int) : min=0 max=255 step=1 default=32 value=32
saturation (int) : min=0 max=255 step=1 default=64 value=64
hue (int) : min=-90 max=90 step=1 default=0 value=0
gamma (int) : min=5 max=30 step=5 default=30 value=30
power_line_frequency (menu) : min=0 max=2 default=2 value=2
sharpness (int) : min=0 max=15 step=1 default=2 value=2
backlight_compensation (int) : min=0 max=1 step=1 default=0 value=0If you have any idea how to get motion to work, please let me know!
Update: How to get motion to work
Using v4l2-compliance, Alwin Stolk found out that VIDIOC_S_FMT is not supported (which motion requires) and developed a workaround, thanks for sharing! You have to patch motion to use the camera’s default format instead of setting it via VIDIOC_S_FMT. In video2.c, change VIDIOC_TRY_FMT & VIDIOC_S_FMT into VIDIOC_G_FMT, recompile and motion will happily start up, giving you a 640x480 image! He also found out that the Belkin Netcam F7D7601v1 works with the OpenWRT image for the NCS601w. The patched motion will give an upside down image on this device, but this should be fixable with the "rotate" parameter in motion.conf.
Update: Controlling the IR LEDs
The IR LEDs are controlled with gpio8. First make it available and set it to output:
# echo 8 > /sys/class/gpio/export
# echo out > /sys/class/gpio/gpio8/directionSwitch the LEDs on:
# echo 1 > /sys/class/gpio/gpio8/valueSwitch the LEDs off:
# echo 0 > /sys/class/gpio/gpio8/valuegpio0 is connected to the "configuration mode" switch on the back of the camera. It has a value of 1 in "on" position and a value of 0 in "off" position. If you want to use it, make it available as an "in" type gpio:
# echo 0 > /sys/class/gpio/export
# echo in > /sys/class/gpio/gpio0/direction
# cat /sys/class/gpio/gpio0/valueThe function of the other GPIOs yet is to be determined. In total, I found the following:
/sys/class/gpio/gpio0
/sys/class/gpio/gpio1
/sys/class/gpio/gpio2
/sys/class/gpio/gpio7
/sys/class/gpio/gpio8
/sys/class/gpio/gpio9
/sys/class/gpio/gpio10
/sys/class/gpio/gpio11
/sys/class/gpio/gpio12
/sys/class/gpio/gpio13
/sys/class/gpio/gpio14
/sys/class/gpio/gpio17
/sys/class/gpio/gpio18
/sys/class/gpio/gpio19
/sys/class/gpio/gpio20
/sys/class/gpio/gpio21What I particularly don’t know yet is how to read the status of the light sensor. If anybody knows, please drop me a line. For now, I wrote a small script that makes it possible to switch on the IR LEDs manually with the "configuration mode" switch on the back of the camera:
#!/bin/sh
# Initialize GPIOs
if [ ! -d /sys/class/gpio/gpio0 ]; then
echo 0 > /sys/class/gpio/export
echo in > /sys/class/gpio/gpio0/direction
fi
if [ ! -d /sys/class/gpio/gpio8 ]; then
echo 8 > /sys/class/gpio/export
echo out > /sys/class/gpio/gpio8/direction
fi
# Infinite loop
while :
do
# read the status of the switch and transfer it to the LED GPIO
cat /sys/class/gpio/gpio0/value > /sys/class/gpio/gpio8/value
sleep 1
done