[Contributed] How to: get root on a Foscam FI9831W (2017)

Note: this is a contributed post by Jens Heine <binbash@gmx.net> – please reach out to him if there any questions or comments! And a big “thank you” from me (Rink) for your contribution!

This firmware modification is mainly inspired from another HOWTO from Rink’s blog where he hacked a FI9853EP.

First get access to a TTY console on the mainboard of the cam. There are 4 contacts in the picture: RX, GND, TX.

Connect a usb-uart adapter to it and run picocom (or minicom or what you like)

First check which usb device is the one with dmesg and the connect. You will see the console output and can gather some information which will be very useful later on:

But there is only a login prompt and I have no clue what the user/password is…

So we need to fix this. First we will need to know about the flash partitions or better the addresses.

This info comes somewhere in the boot messages (the lines that start with 0x00...):

Bingo. Now reboot that thing and hit a key when starting to interrupt u-boot. Now we have a u-boot prompt and can extract the jffs2 firmware to a TFTP server (that we have installed earlier on another machine in the network).

Let’s load the jffs2 partition to memory. Initialize the flash memory controller first:

And copy the jffs2 data (in sum 0xb00000 bytes starting from 0x000000500000) to memory:

Then set up out network environment to be able to access the TFTP server:

And push the jffs2 data from memory to the server into a file called flash0

Let’s have a look into the TFTP directory:

That worked.

NOTE: I recommend to not only copy the jffs2 data but the whole flash data and save it to our TFTP server. When something goes wrong, we can restore the complete flash from the backup.

If you have extracted the full firmware to a file called flash_full, you can restore it like this:

Now we need a tool called Jefferson to extract the filesystem. Just get it from github:

or install it with python3 pip:

After digging a bit around I decided to modify the file jffs2-root-mod/boot.sh. I appended this to the end after this:

Ok, put it all back together and create a nice jffs2 from the modified folder:

I decided to create a small erase block size just in case the expected erase block size is below the default which is 64k. The new created filesystem is smaller than the extracted one but this is ok (padded in the end).

Now we can pull the firmware mod to our Foscam device:

Nice, the file is in our Foscam memory. Let’s push it to the flash device.

Initialize the flash controller always first.

Do not forget to erase the target space before writing:

And now copy the fresh mod:

Tension now, reboot the device and look what happens…

As we can see, our user has been added And the telnet server has been started also!! Let’s try it:

Bingo!