720p网络摄像头福斯康姆Foscam C1拆机
福斯康姆Foscam C1是一款不贵的家用无线WiFi网络摄像头，产品在国外售价大约400人民币 (US$60)。福斯康姆Foscam的摄像头产品在国外受欢迎，主要得益于公司有用户论坛，可带来巨大流量，用户通过论坛提供的技术支持来DIY福斯康姆Foscam摄像头从而满足自己监控要求。
其中FI8918W摇头机非常受国外用户的欢迎，其产品支持远程水平和垂直旋转。后来福斯康姆根据市场需求推出了C系列高清网络摄像头产品包括C2, 以及今天要拆解的C1。 C1是一款支持720p分辨率带广角镜头，内置人体感应红外探测器的网络摄像头，外形与我司D1000非常相似，采用镜面，颜色黑。而C2采用的是相同造型，不过支持1080p全高清分辨率，产品颜色为白色。
拆解福斯康姆Foscam C1非常简单，其产品集成度很高，主要包括主板，红外板，塑料壳组成。卸下前红外遮光板，就可以看到固定螺丝，卸下螺丝即可看见里面的结构。
因为C1不带WiFi天线，所以在内置的天线被安装在摄像机的外壳上，拆卸的时候必须小心。当然，你也可以使用带uFL接口的外置SMA天线来获得更好的WiFi信号。
在拆解镜头部分前，必须卸下红外灯板，红外灯板最上面的那个器件是PIR人体感应红外，这是这款摄像头特殊设计，也是其卖点。PIR人体感应红外可以探测人体的移动，做到精准探测报警。其它LED灯为夜视用红外灯，其次你也可以看到一个麦克风被安置在摄像头前面板上。
下图是拆下来的主板+镜头， 镜头下的基座其实就是红外滤光片切换器，俗称IR-CUT，或ICR filter。当摄像头工作在夜晚的实时，红外滤光片将隐藏起来，这样各种光学可以通过镜头进入到图像传感器，提高摄像头夜视效果。
主板上面红色的模块是WiFi模块，通过上面的标记，C1使用的是MediaTek MT7601UN芯片。
卸下镜头，通过滤光片切换器，我们可以看到图像传感器，通过外观，发现其图像传感器为豪威OV9712，是一款1/4” 逐行扫描CMOS图像传感器，支持720p@30fps视频拍摄。
主板的反面就是摄像头的主芯片，同样采用的是海思Hi3518E, 主流720p高清视频处理方案处理器。芯片上面带散热片，另一旁是TF卡槽，以及USB充电接口，和复位按键。 而没有标记的接口，我猜应该是编程串口RS232。
该连接器为PicoBlade51021-0400，可输出Linux启动信息 （115200 bps, 3.3V)
U-Boot 2010.06 (Dec 11 2014 - 15:55:58)
Check spi flash controller v350... Found
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
Spi(cs1): Block:64KB Chip:16MB Name:"MX25L128XX"
MMC: MMC FLASH INIT: No card on slot!
In: serial
Out: serial
Err: serial
Auto-update from SD Card:
MMC Device 1 not found
MMC Device 2 not found
MMC Device 3 not found
Can't find sd card device!
Can't load upgrade file, aborting sd -update
Auto-update from TFTP: trying update file 'recover_image.bin'
Hisilicon ETH net controler
MAC: *redacted*
Up/Down PHY not link.
Can't load update file, aborting auto-update
Hit any key to stop autoboot: 1 0
16384 KiB hi_sfc at 0:0 is now current device
## Starting application at 0x82000000 ...
Uncompressing Linux... done, booting the kernel.
Linux version 3.0.8 (root@foscam-virtual-machine) (gcc version 4.4.1 (Hisilicon_v100(gcc4.4-290+uclibc_0.9.32.1+eabi+linuxpthread)) ) #5 Sat Sep 13 12:38:53 CST 2014
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: hi3518
Memory policy: ECC disabled, Data cache writeback
AXI bus clock 200000000.
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 10922
Kernel command line: mem=43M console=ttyAMA0,115200 mtdparts=hi_sfc:512K(boot),3M(kernel),6M(app),6M(app_ext),512K(para)
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 43MB = 43MB total
Memory: 37244k/37244k available, 6788k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
vmalloc : 0xc3000000 - 0xfe000000 ( 944 MB)
lowmem : 0xc0000000 - 0xc2b00000 ( 43 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.init : 0xc0008000 - 0xc0273000 (2476 kB)
.text : 0xc0273000 - 0xc060c000 (3684 kB)
.data : 0xc060c000 - 0xc0622540 ( 90 kB)
.bss : 0xc0622564 - 0xc06328cc ( 65 kB)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:32 nr_irqs:32 32
sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms
Calibrating delay loop... 218.72 BogoMIPS (lpj=1093632)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Serial: AMBA PL011 UART driver
uart:0: ttyAMA0 at MMIO 0x20080000 (irq = 5) is a PL011 rev2
console [ttyAMA0] enabled
uart:1: ttyAMA1 at MMIO 0x20090000 (irq = 5) is a PL011 rev2
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.16)
msgmni has been set to 72
io scheduler noop registered
io scheduler deadline registered (default)
io scheduler cfq registered
Spi id table Version 1.22
Spi(cs1) ID: 0xC2 0x20 0x18 0xC2 0x20 0x18
SPI FLASH start_up_mode is 3 Bytes
Spi(cs1):
Block:64KB
Chip:16MB
Name:"MX25L128XX"
spi size: 16MB
chip num: 1
5 cmdlinepart partitions found on MTD device hi_sfc
Creating 5 MTD partitions on "hi_sfc":
0x000000000000-0x000000080000 : "boot"
0x000000080000-0x000000380000 : "kernel"
0x000000380000-0x000000980000 : "app"
0x000000980000-0x000000f80000 : "app_ext"
0x000000f80000-0x000001000000 : "para"
Fixed MDIO Bus: probed
himii: probed
Invalid HW-MAC Address: 00:00:00:00:00:00
Set Random MAC address: *redacted*
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
hiusb-ehci hiusb-ehci.0: HIUSB EHCI
hiusb-ehci hiusb-ehci.0: new USB bus registered, assigned bus number 1
hiusb-ehci hiusb-ehci.0: irq 15, io mem 0x100b0000
hiusb-ehci hiusb-ehci.0: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
hiusb-ohci hiusb-ohci.0: HIUSB OHCI
hiusb-ohci hiusb-ohci.0: new USB bus registered, assigned bus number 2
hiusb-ohci hiusb-ohci.0: irq 16, io mem 0x100a0000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
TCP cubic registered
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
øFreeing init memory: 2476K
init started: BusyBox v1.21.1 (2015-01-07 16:46:55 CST)
starting pid 271, tty '': '/etc/init.d/rcS'
mount: mounting tmpfs on /dev failed: Invalid argument
_ _ _ _ _ _ _ _ _ _ _ _
\ _ _ _ _ _ ___
/ /__/ \ |_/
/ __ / - _ ___
/ / / / / /
_ _ _ _/ / / \_/ \_ ______
___________\___\__________________
[RCS]: /etc/init.d/S00devs
mknod: /dev/console: File exists
mknod: /dev/ttyAMA0: File exists
mknod: /dev/ttyAMA1: File exists
mknod: /dev/ttyS000: File exists
[RCS]: /etc/init.d/S01udev
udevd (304): /proc/304/oom_adj is deprecated, please use /proc/304/oom_score_adj instead.
[RCS]: /etc/init.d/S80network
[RCS]: /etc/init.d/S90init
[ver_get_oldver.212]:1.9.1.12,2.52.2.5.
local mac: *redacted*
broadcast ioctl error![99-Cannot assign requested address]
Can not find broadcast client!
[exit_main.26]:exit app[99.Cannot assign requested address].
can't find /dev/mmcblk0p1
sd card vfat32 system don't need fix.
/mnt/para/etc/sm_cn_private.pem exist !
/mnt/para/etc/RT2870AP.dat exist !
/mnt/para/etc/udhcpd.conf exist !
/mnt/para/etc/logo.argb4444 exist !
/mnt/para/etc/logo_vga.argb4444 exist !
can't find /mnt/para/config/Rom.dat.
ln -sf /mnt/para/etc/Rom.dat /mnt/para/config/Rom.dat
---- Your model name is C1 SENSOR=7 WIFI=2 LANGUAGE=2 MODELVERSION=52----
---- Your input model name is C1 ----
mem=39720
Hisilicon Media Memory Zone Manager
hi3518_base: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Hisilicon UMAP device driver interface: v3.00
pa:82b00000, va:c31c0000
load sys.ko for Hi3518...OK!
load viu.ko for Hi3518...OK!
ISP Mod init!
load vpss.ko ....OK!
load venc.ko for Hi3518...OK!
load group.ko for Hi3518...OK!
load chnl.ko for Hi3518...OK!
load h264e.ko for Hi3518...OK!
load jpege.ko for Hi3518...OK!
load rc.ko for Hi3518...OK!
load region.ko ....OK!
load vda.ko ....OK!
hi_i2c init is ok!
insmod: can't insert 'extdrv/gpioi2c_ex.ko': No such file or directory
initialized adc driver success
---- Your input Sensor type is 7 ----
*** Board tools : ver0.0.1_20120501 ***
[debug]: {source/utils/cmdshell.c:166}cmdstr:himm
0x20030030: 0x00000000 --> 0x00000001
[END]
Kernel: ssp initial ok!
acodec inited!
insert audio
---- Your input Wifi type is 2 ----
rtusb init rtusbSTA --->
usbcore: registered new interface driver rtusbSTA
ptz_init start ptz_state[1],HorPos[0],VerPos[0]
setup ptz gpio success
setup zoom gpio success
ptz_init end ptz_state[1],HorPos[-1],VerPos[-1],flag[0]
Hisilicon Watchdog Timer: 0.01 initialized. default_margin=5 sec (nowayout= 0, nodeamon= 0)
set rtc time to system time
starting pid 831, tty '': '/sbin/getty -L ttyS000 115200 vt100 -n root -I "Auto login as root ..."'
Auto login as root ...
(none) login: killall: devMng: no process killed
killall: codec: no process killed
killall: UDTMediaServer: no process killed
killall: webService: no process killed
killall: storage: no process killed
killall: FirmwareUpgrade: no process killed
killall: OnvifAgent: no process killed
set time
year:2015
month:9
date:1
hour:22
minute:16
second:11
time.nist.gov: Unknown host
mkdir: can't create directory '/usr/local/pureftpd': File exists
mkdir: can't create directory '/usr/local/pureftpd/etc': File exists
creatSystemUser
Changing password for ftpuser1
New password:
Retype password:
Password for ftpuser1 changed by root
creatVirtualUser
Password:
Enter it again:
usb 1-1: new high speed USB device number 2 using hiusb-ehci
killall: CGIProxy.fcgi: no process killed
killall: lighttpd: no process killed
--= pAd = c3691000, size = 860440 --=
<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
RTMP\_COM\_IoctlHandle():pAd->BulkOutEpAddr=0x8
RTMP\_COM\_IoctlHandle():pAd->BulkOutEpAddr=0x4
RTMP\_COM\_IoctlHandle():pAd->BulkOutEpAddr=0x5
RTMP\_COM\_IoctlHandle():pAd->BulkOutEpAddr=0x6
RTMP\_COM\_IoctlHandle():pAd->BulkOutEpAddr=0x7
RTMP\_COM\_IoctlHandle():pAd->BulkOutEpAddr=0x9
NVM is EFUSE
Endpoint(8) is for In-band Command
Endpoint(4) is for WMM0 AC0
Endpoint(5) is for WMM0 AC1
Endpoint(6) is for WMM0 AC2
Endpoint(7) is for WMM0 AC3
Endpoint(9) is for WMM1 AC0
Endpoint(84) is for Data-In
Endpoint(85) is for Command Rsp
Lighttpd Server BUILD:May 5 2015 15:12:46
2015-09-01 22:16:12: (network.c.724) --1--srv->config_storage[ 0 ]= 0
2015-09-01 22:16:12: (network.c.724) --1--srv->config_storage[ 1 ]= 1
WARNING: can't open config file: /usr/local/openssl/ssl/openssl.cnf
2015-09-01 22:16:12: (network.c.985) --2--srv->config_storage[ 1 ]= 1
2015-09-01 22:16:12: (network.c.456) --------=s->ssl_enabled= 0
2015-09-01 22:16:12: (network.c.456) --------=s->ssl_enabled= 1
2015-09-01 22:16:12: (log.c.164) server started
killall: pure-ftpd: no process killed
SMT DEBUG : ERROR : Adapter is NULLdriver: ircut_switch.low:250,ircut_switch.high:580
netstat: /proc/net/tcp6: No such file or directory
driver: close IR_LED
MaxQp=34...........................
stVencRcPara.stParamH264VBR.s32DeltaQP=2
1. LDO_CTR0(6c) = a64799, PMU_OCLEVEL c
2. LDO_CTR0(6c) = a6478d, PMU_OCLEVEL 6
FW Version:0.1.00 Build:7640
Build Time:201308222153____
ILM Length = 47000(bytes)
DLM Length = 0(bytes)
Loading FW....
#
RTMP_TimerListAdd: add timer obj c371192c!
RTMP_TimerListAdd: add timer obj c3711944!
RTMP_TimerListAdd: add timer obj c371195c!
RTMP_TimerListAdd: add timer obj c3711914!
RTMP_TimerListAdd: add timer obj c37118cc!
RTMP_TimerListAdd: add timer obj c37118e4!
RTMP_TimerListAdd: add timer obj c36a6764!
RTMP_TimerListAdd: add timer obj c36931e0!
RTMP_TimerListAdd: add timer obj c36931fc!
RTMP_TimerListAdd: add timer obj c36a67bc!
RTMP_TimerListAdd: add timer obj c3695cf0!
RTMP_TimerListAdd: add timer obj c36953a0!
RTMP_TimerListAdd: add timer obj c3695cd4!
RTMP_TimerListAdd: add timer obj c3695f14!
RTMP_TimerListAdd: add timer obj c3695d0c!
RTMP_TimerListAdd: add timer obj c3695d28!
RTMP_TimerListAdd: add timer obj c3695d44!
RTMP_TimerListAdd: add timer obj c36a6734!
RTMP_TimerListAdd: add timer obj c36a67a4!
RTMP_TimerListAdd: add timer obj c3695f44!
RTMP_TimerListAdd: add timer obj c3695f5c!
RTMP_TimerListAdd: add timer obj c3695f74!
RTMP_TimerListAdd: add timer obj c3695f8c!
cfg_mode=5
wmode\_band\_equal(): Band Equal!
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 14
2. Phy Mode = 14
NVM is Efuse and its size =1d[1e0-1fc]
3. Phy Mode = 14
AntCfgInit: primary/secondary ant 0/1
---> InitFrequencyCalibration
InitFrequencyCalibrationMode:Unknow mode = 3
InitFrequencyCalibration: frequency offset in the EEPROM = 108(0x6c)
<--- InitFrequencyCalibration
RTMPSetPhyMode: channel is out of range, use first channel=1
MCS Set = ff 00 00 00 01
<---- rt28xx_init, Status=0
0x1300 = 00064300
RTMPDrvOpen(1):Check if PDMA is idle!
RTMPDrvOpen(2):Check if PDMA is idle!
RTMP_TimerListAdd: add timer obj bf362748!
smtcn\_channel\_switch\_init
smtcn\_channel\_switch\_start
SMT_DEBUG: _pfsm_rst:0,0
SMT DEBUG smtcn_flag: 1
smtcn\_channel\_switch\_timeout
smtcn\_channel\_switch\_start
...
Login timed out
process '/sbin/getty -L ttyS000 115200 vt100 -n root -I "Auto login as root ..."' (pid 831) exited. Scheduling for restart.
starting pid 1092, tty '': '/sbin/getty -L ttyS000 115200 vt100 -n root -I "Auto login as root ..."'
Auto login as root ...
(none) login: smtcn_channel_switch_timeout
smtcn\_channel\_switch\_start
smtcn\_channel\_switch\_timeout
...