Hardware & System Software

I have had a look at the source code provided by Edimax to work out what the device is, and had a poke around Inside The Case.  The findings so far are:

Hardware

 Item    Description   
 Notes / Source of information
 System Board    
Prolific Pl-1029
29/src/ipcam/web talk about Pl-1029, and the top level instructions say you should install the toolchain in /opt/prolific.  This is confirmed by more recent look Inside The Case.
 CPU ARM9  Both from Prolific web site and the provided toolchain is for an ARM processor, using uClibc.
 USB Support
 No connector installed, but the Prolific web site suggests that the hardware is present.
 Need to gain telnet access to device to check - not done yet.    
There is no sign of a USB connector on the main circuit board, which is a shame.
 Wireless LAN Adapter
Ralinktek RT61
 Edimax supplied source code for RT61.o/RT61.ko module


System Software

 Item Description Notes / Source of Information
 Kernel Linux 2.4.19
 Edimax supplied source code
 System Binaries 
 Busybox 1.01
 Busybox is also the init process, called as /linuxrc
   
   

The dmesg output from the device has been de-coded and posted here.   The output is re-produced on this site as dmesg Output.

Firmware File Structure

The table below is my first go at working out the structure of the firmware.  More recently someone else has made much more progress and got telnet working by modifying the firmware file, as described at http://www.suborbital.org.uk/canofworms/index.php?/archives/3-Getting-telnet-access-on-an-Edimax-IC3010-webcam.html.    

The firmware file is arranged in 4 sections, an 8 byte identifier, 768k of kernel space, 3200k of cramfs image and a single byte checksum. 


 Bytes Description Notes / Source of Information
1-8
Character Description
"IC3010  " or "IC3010WG" - from ./29/img/mkImage.sh in source code provided by Edimax.
9- 768k
   or
9- 767k
Kernel image
mkImage.sh suggests this goes to 768k (=786432), but my testing suggests it ends at byte number 767k (=786370)
768k- (786432-)
   or
767k- (786370-)
 Cramfs root filesystem (3580k when mounted)
Again mkImage.sh suggests 768k, but my testing suggests it starts at byte number 767k.  This looks like the root filesystem for the device.
   

CanOfWorms has made really good progress and decoded the firmware as described here.
I have copied his information to this site as Getting Telnet Access.