foscam-utils - tools for manipulating Foscam firmware images

I've written a small utility to work with Foscam firmware images. Instead of doing everything by hand, this tool can help do the work automatically.

It's available under the GPLv2 in the github repository named foscam-utils. For now, it just displays information found in the firmware header. As the system firmware contains a ZIP file and a ROMFS images, it also displays informations found in the ZIP header and ROMFS header.

There's not much left to write code to automatically extract the ZIP file and ROMFS image.

Example:

$ fcimg system_11.14.2.28.bin

[0x00000000] FIRMWARE HEADER

----------------------------------------

[+0x0C] romfs start     0x000bf7ae

[+0x10] romfs length    722944

----------------------------------------

[0x00000014] ZIP HEADER

----------------------------------------

[+0x0C] lastmod         03-24-10 05:57

[+0x0E] crc32           0x34a595cb

[+0x12] compsize        784186

[+0x16] ucompsize       1666336

[+0x1E] filename        linux.bin

----------------------------------------

[0x000BF7C2] ROMFS HEADER

----------------------------------------

[+0x08] size            722288

[+0x0C] checksum        0xc9e6e53c

[+0x10] name            rom 4cdf0ba4

----------------------------------------

Foscam FI8908W #7

IPCAM CGI SDK 2.1
http://www.foscam.es/descarga/ipcam_cgi_sdk.pdf

Foscam FI8908W #6

$ strings linux.bin | grep -E "Linux version"

Linux version 2.4.20-uc0 (root@maverick-linux) (gcc version 3.0) #1334

Linux 2.4.20 with patch from uClinux
http://www.kernel.org/pub/linux/kernel/v2.4/linux-2.4.20.tar.bz2
http://www.uclinux.org/pub/uClinux/uClinux-2.4.x/uClinux-2.4.20-uc0.diff.gz

Foscam FI8908W #5

$ deezee ./bin/camera

Scanning file ./bin/camera for compressed components

Compressed size: 267621 bytes

Compressed segment found at 0x41. Expanded to 577480 bytes

$ deezee ./bin/dhcpc

Scanning file ./bin/dhcpc for compressed components

Compressed size: 40713 bytes

Compressed segment found at 0x41. Expanded to 82420 bytes

$ strings ./bin/dhcpc.0 | grep -E "v.[0-9]\.[0-9]\.[0-9]{2}"

DHCP Client Daemon v.1.3.20-pl0

dhcpcd 1.3.20-pl0
http://www.phystech.com/download/dhcpcd.html

$ deezee ./bin/ifconfig

Scanning file ./bin/ifconfig for compressed components

Compressed size: 21610 bytes

Compressed segment found at 0x41. Expanded to 44132 bytes

$ strings ./bin/ifconfig.0 | grep -E "[0-9]\.[0-9]{2}"

net-tools 1.52

ifconfig 1.39 (1999-03-18)

net-tools 1.52
http://www.tazenda.demon.co.uk/phil/net-tools/net-tools-1.52.tar.bz2

$ deezee ./bin/iwconfig

Scanning file ./bin/iwconfig for compressed components

Compressed size: 38300 bytes

Compressed segment found at 0x41. Expanded to 74644 bytes

$ deezee ./bin/iwpriv

Scanning file ./bin/iwpriv for compressed components

Compressed size: 33630 bytes

Compressed segment found at 0x41. Expanded to 64484 bytes

$ deezee ./bin/route

Scanning file ./bin/route for compressed components

Compressed size: 28824 bytes

Compressed segment found at 0x41. Expanded to 56776 bytes

$ strings ./bin/route.0 | grep -E "[0-9]\.[0-9]{2}"

net-tools 1.52

route 1.96 (1999-01-01)

net-tools 1.52
http://www.tazenda.demon.co.uk/phil/net-tools/net-tools-1.52.tar.bz2

$ deezee ./bin/sh

Scanning file ./bin/sh for compressed components

Compressed size: 31043 bytes

Compressed segment found at 0x41. Expanded to 59928 bytes

$ strings ./bin/sh.0 | grep -E "Sash|[0-9]\.[0-9]\.[0-9]"

Sash command shell (version %s)

1.1.1

Sash 1.1.1

$ deezee ./bin/wpa_supplicant

Scanning file ./bin/wpa_supplicant for compressed components

Compressed size: 96327 bytes

Compressed segment found at 0x41. Expanded to 190048 bytes

$ strings ./bin/wpa_supplicant.0 | grep -E "v[0-9]\.[0-9]\.[0-9]"

wpa_supplicant v0.4.7

wpa_supplicant 0.4.7
http://hostap.epitest.fi/releases/wpa_supplicant-0.4.7.tar.gz

Foscam FI8908W #4

$ find .

.

./swap

./etc

./usr

./proc

./bin

./bin/wpa_supplicant

./bin/ifconfig

./bin/fcc_ce.wlan

./bin/route

./bin/wetctl

./bin/camera

./bin/.init.swo

./bin/iwpriv

./bin/sh

./bin/mypppd

./bin/mypppd/chap-secrets

./bin/mypppd/pppd

./bin/mypppd/options

./bin/mypppd/pap-secrets

./bin/init

./bin/rt73.bin

./bin/iwconfig

./bin/dhcpc

./flash

./home

./dev

./dev/usb

./dev/usb/lp.sh

./dev/pts

./tmp

./var

./var/run

$ file ./bin/camera

./bin/camera: BFLT executable - version 4 ram gzip

$ cat ./bin/init

mount -t proc none /proc

mount -t ramfs none /usr

mount -t ramfs none /swap

mount -t ramfs none /var/run

mount -t ramfs none /etc

mount -t ramfs none /flash

mount -t ramfs none /home

mount -t ramfs none /tmp

mkdir /tmp/run

camera&

sh

Foscam FI8908W #3

$ mkdir 4cdf0ba4

$ cd 4cdf0ba4/

$ romfsck ../4cdf0ba4.romfs

+= 16 + 16

romfs image name: `rom 4cdf0ba4'

romfs image size: 722288

==========================

parse_node(32/0x20)

.: directory

name invalid!!

nextfh=64

==========================

parse_node(64/0x40)

..: hard link

nextfh=96

==========================

parse_node(96/0x60)

swap: directory

==========================

parse_node(128/0x80)

.: hard link

nextfh=160

==========================

parse_node(160/0xa0)

..: hard link

nextfh=192

==========================

parse_node(192/0xc0)

etc: directory

==========================

parse_node(224/0xe0)

.: hard link

nextfh=256

==========================

parse_node(256/0x100)

..: hard link

nextfh=288

==========================

parse_node(288/0x120)

proc: directory

==========================

parse_node(320/0x140)

.: hard link

nextfh=352

==========================

parse_node(352/0x160)

..: hard link

nextfh=384

==========================

parse_node(384/0x180)

dev: directory

==========================

parse_node(416/0x1a0)

.: hard link

nextfh=448

==========================

parse_node(448/0x1c0)

..: hard link

nextfh=480

==========================

parse_node(480/0x1e0)

sda2: block device

nextfh=512

==========================

parse_node(512/0x200)

ttyS0: character device

nextfh=544

==========================

parse_node(544/0x220)

i2c0: character device

nextfh=576

==========================

parse_node(576/0x240)

mtd0: character device

nextfh=608

==========================

parse_node(608/0x260)

smartcard0: character device

nextfh=640

==========================

parse_node(640/0x280)

ppp1: character device

nextfh=672

==========================

parse_node(672/0x2a0)

ttyp5: character device

nextfh=704

==========================

parse_node(704/0x2c0)

tty: character device

nextfh=736

==========================

parse_node(736/0x2e0)

sdb1: block device

nextfh=768

==========================

parse_node(768/0x300)

rom2: block device

nextfh=800

==========================

parse_node(800/0x320)

mixer1: character device

nextfh=832

==========================

parse_node(832/0x340)

ttyp2: character device

nextfh=864

==========================

parse_node(864/0x360)

nftlA1: block device

nextfh=896

==========================

parse_node(896/0x380)

ptyp1: character device

nextfh=928

==========================

parse_node(928/0x3a0)

ttyp9: character device

nextfh=960

==========================

parse_node(960/0x3c0)

ttyS1: character device

nextfh=992

==========================

parse_node(992/0x3e0)

ptyp8: character device

nextfh=1024

==========================

parse_node(1024/0x400)

ttyp6: character device

nextfh=1056

==========================

parse_node(1056/0x420)

mixer0: character device

nextfh=1088

==========================

parse_node(1088/0x440)

mtd1: character device

nextfh=1120

==========================

parse_node(1120/0x460)

key: character device

nextfh=1152

==========================

parse_node(1152/0x480)

ptmx: character device

nextfh=1184

==========================

parse_node(1184/0x4a0)

ppp: character device

nextfh=1216

==========================

parse_node(1216/0x4c0)

rom0: block device

nextfh=1248

==========================

parse_node(1248/0x4e0)

sdb2: block device

nextfh=1280

==========================

parse_node(1280/0x500)

sda1: block device

nextfh=1312

==========================

parse_node(1312/0x520)

hda2: block device

nextfh=1344

==========================

parse_node(1344/0x540)

keypad: character device

nextfh=1376

==========================

parse_node(1376/0x560)

null: character device

nextfh=1408

==========================

parse_node(1408/0x580)

ttyS2: character device

nextfh=1440

==========================

parse_node(1440/0x5a0)

smartcard1: character device

nextfh=1472

==========================

parse_node(1472/0x5c0)

ttyp4: character device

nextfh=1504

==========================

parse_node(1504/0x5e0)

mtdblock1: block device

nextfh=1536

==========================

parse_node(1536/0x600)

ttyS3: character device

nextfh=1568

==========================

parse_node(1568/0x620)

ptyp2: character device

nextfh=1600

==========================

parse_node(1600/0x640)

console: character device

nextfh=1632

==========================

parse_node(1632/0x660)

tty1: character device

nextfh=1664

==========================

parse_node(1664/0x680)

display: character device

nextfh=1696

==========================

parse_node(1696/0x6a0)

ttyp0: character device

nextfh=1728

==========================

parse_node(1728/0x6c0)

ptyp4: character device

nextfh=1760

==========================

parse_node(1760/0x6e0)

lp0: character device

nextfh=1792

==========================

parse_node(1792/0x700)

ptyp0: character device

nextfh=1824

==========================

parse_node(1824/0x720)

ptyp7: character device

nextfh=1856

==========================

parse_node(1856/0x740)

usb: directory

==========================

parse_node(1888/0x760)

.: hard link

nextfh=1920

==========================

parse_node(1920/0x780)

..: hard link

nextfh=1952

==========================

parse_node(1952/0x7a0)

lp2: character device

nextfh=1984

==========================

parse_node(1984/0x7c0)

lp.sh: regular file

nextfh=2128

==========================

parse_node(2128/0x850)

lp3: character device

nextfh=2160

==========================

parse_node(2160/0x870)

lp4: character device

nextfh=2192

==========================

parse_node(2192/0x890)

lp6: character device

nextfh=2224

==========================

parse_node(2224/0x8b0)

lp9: character device

nextfh=2256

==========================

parse_node(2256/0x8d0)

lp1: character device

nextfh=2288

==========================

parse_node(2288/0x8f0)

lp0: character device

nextfh=2320

==========================

parse_node(2320/0x910)

lp8: character device

nextfh=2352

==========================

parse_node(2352/0x930)

lp7: character device

nextfh=2384

==========================

parse_node(2384/0x950)

lp5: character device

nextfh=2416

==========================

parse_node(2416/0x970)

nftla: block device

nextfh=2448

==========================

parse_node(2448/0x990)

ttyp7: character device

nextfh=2480

==========================

parse_node(2480/0x9b0)

i2c1: character device

nextfh=2512

==========================

parse_node(2512/0x9d0)

rom1: block device

nextfh=2544

==========================

parse_node(2544/0x9f0)

mouse: character device

nextfh=2576

==========================

parse_node(2576/0xa10)

hda1: block device

nextfh=2608

==========================

parse_node(2608/0xa30)

ptyp9: character device

nextfh=2640

==========================

parse_node(2640/0xa50)

ttyp1: character device

nextfh=2672

==========================

parse_node(2672/0xa70)

pts: directory

==========================

parse_node(2704/0xa90)

.: hard link

nextfh=2736

==========================

parse_node(2736/0xab0)

..: hard link

nextfh=2768

==========================

parse_node(2768/0xad0)

hdb: block device

nextfh=2800

==========================

parse_node(2800/0xaf0)

dsp0: character device

nextfh=2832

==========================

parse_node(2832/0xb10)

ptyp6: character device

nextfh=2864

==========================

parse_node(2864/0xb30)

ttyp3: character device

nextfh=2896

==========================

parse_node(2896/0xb50)

ttyp8: character device

nextfh=2928

==========================

parse_node(2928/0xb70)

dsp1: character device

nextfh=2960

==========================

parse_node(2960/0xb90)

hda: block device

nextfh=2992

==========================

parse_node(2992/0xbb0)

fb0: character device

nextfh=3024

==========================

parse_node(3024/0xbd0)

ptyp3: character device

nextfh=3056

==========================

parse_node(3056/0xbf0)

ptyp5: character device

nextfh=3088

==========================

parse_node(3088/0xc10)

mtdblock0: block device

nextfh=3120

==========================

parse_node(3120/0xc30)

sda: block device

nextfh=3152

==========================

parse_node(3152/0xc50)

sdb: block device

nextfh=3184

==========================

parse_node(3184/0xc70)

mixer: symbolic link

nextfh=3232

==========================

parse_node(3232/0xca0)

dsp: symbolic link

nextfh=3280

==========================

parse_node(3280/0xcd0)

usi: character device

nextfh=3312

==========================

parse_node(3312/0xcf0)

video0: character device

nextfh=3344

==========================

parse_node(3344/0xd10)

video1: character device

nextfh=3376

==========================

parse_node(3376/0xd30)

urandom: character device

nextfh=3408

==========================

parse_node(3408/0xd50)

ptz0: character device

nextfh=3440

==========================

parse_node(3440/0xd70)

dsp2: character device

nextfh=3472

==========================

parse_node(3472/0xd90)

mixer2: character device

nextfh=3504

==========================

parse_node(3504/0xdb0)

bin: directory

==========================

parse_node(3536/0xdd0)

.: hard link

nextfh=3568

==========================

parse_node(3568/0xdf0)

..: hard link

nextfh=3600

==========================

parse_node(3600/0xe10)

dhcpc: regular file

nextfh=44352

==========================

parse_node(44352/0xad40)

init: regular file

nextfh=44624

==========================

parse_node(44624/0xae50)

sh: regular file

nextfh=75712

==========================

parse_node(75712/0x127c0)

ifconfig: regular file

nextfh=97360

==========================

parse_node(97360/0x17c50)

route: regular file

nextfh=126224

==========================

parse_node(126224/0x1ed10)

.init.swo: regular file

nextfh=138544

==========================

parse_node(138544/0x21d30)

wetctl: regular file

nextfh=187104

==========================

parse_node(187104/0x2dae0)

camera: regular file

nextfh=454768

==========================

parse_node(454768/0x6f070)

iwpriv: regular file

nextfh=488432

==========================

parse_node(488432/0x773f0)

iwconfig: regular file

nextfh=526768

==========================

parse_node(526768/0x809b0)

wpa_supplicant: regular file

nextfh=623136

==========================

parse_node(623136/0x98220)

rt73.bin: regular file

nextfh=625216

==========================

parse_node(625216/0x98a40)

mypppd: directory

==========================

parse_node(625248/0x98a60)

.: hard link

nextfh=625280

==========================

parse_node(625280/0x98a80)

..: hard link

nextfh=625312

==========================

parse_node(625312/0x98aa0)

chap-secrets: regular file

nextfh=625424

==========================

parse_node(625424/0x98b10)

options: regular file

nextfh=625584

==========================

parse_node(625584/0x98bb0)

pap-secrets: regular file

nextfh=625696

==========================

parse_node(625696/0x98c20)

pppd: regular file

nextfh=720736

==========================

parse_node(720736/0xaff60)

fcc_ce.wlan: regular file

nextfh=721712

==========================

parse_node(721712/0xb0330)

flash: directory

==========================

parse_node(721744/0xb0350)

.: hard link

nextfh=721776

==========================

parse_node(721776/0xb0370)

..: hard link

nextfh=721808

==========================

parse_node(721808/0xb0390)

tmp: directory

==========================

parse_node(721840/0xb03b0)

.: hard link

nextfh=721872

==========================

parse_node(721872/0xb03d0)

..: hard link

nextfh=721904

==========================

parse_node(721904/0xb03f0)

var: directory

==========================

parse_node(721936/0xb0410)

.: hard link

nextfh=721968

==========================

parse_node(721968/0xb0430)

..: hard link

nextfh=722000

==========================

parse_node(722000/0xb0450)

run: directory

==========================

parse_node(722032/0xb0470)

.: hard link

nextfh=722064

==========================

parse_node(722064/0xb0490)

..: hard link

nextfh=722096

==========================

parse_node(722096/0xb04b0)

usr: directory

==========================

parse_node(722128/0xb04d0)

.: hard link

nextfh=722160

==========================

parse_node(722160/0xb04f0)

..: hard link

nextfh=722192

==========================

parse_node(722192/0xb0510)

home: directory

==========================

parse_node(722224/0xb0530)

.: hard link

nextfh=722256

==========================

parse_node(722256/0xb0550)

..: hard link

Foscam FI8908W #2

$ hd -n 32 system_11.14.2.28.bin

00000000 42 4e 45 47 01 00 00 00 01 00 00 00 ae f7 0b 00 |BNEG........®÷..|

00000010 00 08 0b 00 50 4b 03 04 14 00 02 00 08 00 37 2f |....PK........7/|

00000020

$ dd if=system_11.14.2.28.bin ibs=1 skip=20 2> /dev/null | file -

/dev/stdin: Zip archive data, at least v2.0 to extract

$ hd -n 20 system_11.14.2.28.bin

00000000 42 4e 45 47 01 00 00 00 01 00 00 00 ae f7 0b 00 |BNEG........®÷..|

00000010 00 08 0b 00                                     |....|

00000014

$ du -b system_11.14.2.28.bin | cut -f1

1507266

$ echo $((0x0bf7ae + 0x0b0800))

1507246

$ dd if=system_11.14.2.28.bin ibs=1 skip=$((0x0bf7ae + 20)) 2> /dev/null | file -

/dev/stdin: romfs filesystem, version 1 722288 bytes, named rom 4cdf0ba4.

$ dd if=system_11.14.2.28.bin of=4cdf0ba4.romfs ibs=1 skip=$((0x0bf7ae+20))

722944+0 records in

1412+0 records out

722944 bytes (723 kB) copied, 0.234873 s, 3.1 MB/s

$ dd if=system_11.14.2.28.bin of=file.zip ibs=1 skip=20

1507246+0 records in

2943+1 records out

1507246 bytes (1.5 MB) copied, 0.486474 s, 3.1 MB/s

$ zipinfo file.zip

Archive: file.zip

Zip file size: 1507246 bytes, number of entries: 1

-rw------- 2.0 fat 1666336 b- defX 10-Mar-24 05:57 linux.bin

1 file, 1666336 bytes uncompressed, 784186 bytes compressed: 52.9%

$ rm file.zip

$ echo $((0x0bf7ae))

784302

$ dd if=system_11.14.2.28.bin of=linux.bin.zip ibs=1 skip=20 count=784302

784302+0 records in

1531+1 records out

784302 bytes (784 kB) copied, 0.260929 s, 3.0 MB/s

$ du -b linux.bin.zip | cut -f1
784302

$ unzip linux.bin.zip

Archive: linux.bin.zip

inflating: linux.bin

$ du -b linux.bin | cut -f1

1666336

Foscam FI8908W #1

$ wget http://foscam.com/down/FI8908 FI8908W/FI8908%20FI8908W%20sw%20upgrade%20package.rar

$ unrar-nonfree x FI8908\ FI8908W\ sw\ upgrade\ package.rar

UNRAR 4.00 beta 3 freeware Copyright (c) 1993-2010 Alexander Roshal

Extracting from FI8908 FI8908W sw upgrade package.rar

Creating FI8908 FI8908W sw upgrade package OK

Extracting FI8908 FI8908W sw upgrade package/read me.txt OK

Creating FI8908 FI8908W sw upgrade package/webUI firmware OK

Extracting FI8908 FI8908W sw upgrade package/webUI firmware/2.4.8.15.bin OK

Creating FI8908 FI8908W sw upgrade package/system firmware OK

Extracting FI8908 FI8908W sw upgrade package/system firmware/lr_cmos_11_14_2_28.bin OK

Extracting FI8908 FI8908W sw upgrade package/Upgrade guidance for FI8908W new.pdf OK

All OK

$ mv FI8908\ FI8908W\ sw\ upgrade\ package/webUI\ firmware/2.4.8.15.bin webui_2.4.8.15.bin

$ mv FI8908\ FI8908W\ sw\ upgrade\ package/system\ firmware/lr_cmos_11_14_2_28.bin system_11.14.2.28.bin