Unknown "wanscam" clone IP camera - Power LED lit; no activity

[fuxxy]

This is an unknown IP camera. Most likely a Wanscam clone, PCB has www.wanscam.com silkscreened but board design doesn't match any known boards in the google database.

Board ID#: AJ118-7A

CPU: Nuvoton W90N745CDG
RAM: Winbond W9812G6JH-6
Flash: Spansion S29GL032N90TF104

So this camera worked fine until I installed it on the house. Its non-POE, so I ran two cables (ethernet and power) power was terminated on each end with barrel Jack's, positive to center electrode. 200% sure it was wired correctly. Unit was powered with the same 12v 1.5A brick that it was supplied with, and what I used for bench testing/initial setup.

The only LEDs on this unit are a red and amber on the ethernet jack on the end of the cable.

Once installed, unit would show the Green LED, but no amber. My POE switch showed 100M HALF DUPLEX. Ethernet cable tested good, I was also able to plug my laptop into the same run and establish a connection.

I then powered the unit locally with a mains extension cord. This time the green and amber LEDs lit, but did not request an IP from the router. A packet dump of the interface shows ZERO packets being sent from the Camera.

Removed camera from its installation, tried again on the bench. Both LEDs light, again no ethernet packets sent.

This unit has an unpopulated serial header. Verified the TX and RX pins on the header are connected to the UART0 pins on the SoC. Connected my TTL<->USB converter to the serial header on the board. Powered unit on. No serial output AT ALL (Tried at 115200 and 9600).

At this point I'm out of ideas.

[stj]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

check that 1117 voltage regulator - as it's an easy start.

[fuxxy]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

check that 1117 voltage regulator - as it's an easy start.

Thanks, I'll do that tomorrow after work.

It appears that the AP2952 SOIC8 buck regulator takes the ~12vDC input power and is configured to output +5vDC. (R47=26.1k & R46=10k).

I'll test the output pin 3 and see if it is, in fact putting out +5v.

I'm honestly not sure how the +5v gets to the 1117 on the other side of the board, but I'll trace it out when I get the housing off.

[CapLeaker]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

Sounds like something died... just like my function generator that ran for 30mins before it croaked.
Looking at the regulator, is where to start for sure. Also recheck the UART port whith an oscilloscope to see if the CPU is really doing something or not. You should find one pin where there is some data running.If you power this camera externally you should only need 3 pins on the UART. GND, RXD and TXD. If you get weird letters and things on the screen, it means you got the wrong baud setting. If you get nothing, well either it is dead, or not hooked up correctly.

[fuxxy]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

check that 1117 voltage regulator - as it's an easy start.

Okay, so:

The 2952A IC:
Pin 2 (Input) - 12.23 vDC (same as wallwart output)
Pin 3 (Output) - 5.18 vDC

There are two 1117 regulators on this board.

1117-D33 (TO-252):
Pin 1 (ADJ/GND) - GND
Pin 2 (OUT) - 3.27
Pin 3 (IN) - 5.01
Tab (OUT) - 3.27

AMS1117 (SOT-223):
Pin 1 (GND) - GND
Pin 2 (vOUT) - 3.28
Pin 3 (vIN) - 5.01
Tab (OUT) - 3.28

Also recheck the UART port whith an oscilloscope to see if the CPU is really doing something or not. You should find one pin where there is some data running.

I don't have an oscilloscope. I do have a USB-UART board that registers on the computer as a serial port. I've used it in the past to communicate with routers.
On this board, RX and VCC are clearly marked. Google brings up convincing pinouts for this type of camera. The only thing I'm unclear about is the RX labelling being receive for the camera, or receive for the device attached to the camera - I'm taking a leap that the USBUART TX pin should attach to the camera's RX pin.

[fuxxy]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

All the websites I see for 'wanscam serial' reference a baud rate of 115200 8n1.

When I connect TX>RX on the USBserial converter, I get all kinds of garbage output. Once I connect GND, it stops.

[CapLeaker]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

go back where you got the garbage output. When you get that gibberish, play with the baud rate. 115200 8n1 and 9600 8n1 are pretty standard. However, since you are actually getting some crap on the display, means the CPU works. Probably the CPU halts because of a kernel panic, there is a bad block on the S29 flash, or buggy firmware on the flash (reflash it). So maybe reflash and factory reset that thing.

[fuxxy]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

I use RealTerm. There is a dropdown with about 10 different baud rates, from 115200 all the way down to 300 baud. Realterm Llows you to switch the baudrate on the fly, easily trying different baudrates.


None of the baudrates listed in Realterm give me readable output. I'm thinking it's just signal noise that's picked up until I connect GND.

[CapLeaker]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

Can you use your TTL on a 2nd camera and see what it does?

[fuxxy]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

This is the only camera I have in this model.

I did use the same USB/TTL convertor on a ubuiqiti picostation last night to recover firmware at 115200 baud.

[fuxxy]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

Decided to revisit the pinout of the UART pin header "J2".

I have four pins, but only two of which are labelled:
J2-1 is labelled 3.3V
J2-2
J2-3
J2-4 is labelled RX

The RX pin is also significant because it's got a square pin pad and the others have circular pads. Is the square pad supposed to be JP2-1, or the pin beside the "J2" silkscreen?

This would imply that the two unlabelled pins would be TX and GND

When probing the pins with a DMM attached to a known ground plane,
J2-1 (3.3V) - 3.27vDC
J2-2 (unlabelled) - 0v
J2-3 (unlabelled) - 0.41-0.43 vDC (fluctuating)
J2-4 (RX) - 3.26 vDC (steady)

I think it's odd that the RX would have steady voltage. Does this signify anything to you guys?

[CapLeaker]

Re: Unknown "wanscam" clone IP camera - Power LED lit; no activity

GND is the easiest to find. The 3.3V rail we don't need, since you power this thing externally. RX is marked and the TX is usually next to the RX pin.
Basically you should have RX, TX, GND, 3.3V.

All you'd need is RX, TX and GND.

I was hoping you see valid data on the RX pin, but you reported that you got rubbish at 9600 8,n,1 and @ 115200 8,n,1. No flow control.
To me rubbish data means that you need to reset or reflash the firmware / clear the NVRAM (if you could get the UART to work properly). Try setting the com port on the device manager, not only on the serial program.