Ipcam

From TAMI
Jump to navigationJump to search

for the tami streaming see Spacecam


misc cams

links and info to all kind of other camera hacks

xiaomi action cam

dG41swa.png

APK

get APK from xiaomi, the one in the app store will switch to chinese if it detect a chinese cam (even on bought in IL from mdk.coil) - note its an older version 1.3 (the current is 2.6.1) but works in english and we dont actull need it. cuz we use ftp and shit.
just hit the back button when you get the warning instead of aggree .

firmware

i didnt update firmware as its the latest, there is a modded one the "unlocks" some higher res/bandwidth recording. don't need it.

scripts

manmy many tweaks, most are just one liners you add to an autoexec.sh file running at startup
MAKE SURE YOU HAVE A BLANK LINE AT THE END OF THE AUTOEXEC.ASH FILE

both these are telnet configurators, telnet as root

usually the camera will start its own network (when you press the side button) and the android app connects to it. but for my use i needed it as client mode. theres a script for that.

  • YiScriptConf - recommended android app to mount scripts , gui spanish. didnt use

wireless charging

Wireless_Power_Supply used in this mod


some images of the insides and connector of a qi wireless charger
(not what we are using here)
ValhdSbs.png onpya91s.png

more blogs and links

xiaoyi

r186cu4m.png
also known as "xiaomi yi home camera" and "ANTSCAM"

shit is crzy, you can

  • telnet
  • ftpd, ftpput, gtpget
  • rtsp (non secure)
    • HD Stream: rtsp://<ipaddr>:554/ch0_0.h264
    • SD stream: rtsp://<ipaddr>:554/ch0_1.h264
  • FPS 20fps(1280 * 720)
  • server on 80
    • http:80
    • eVUyzyA.jpg
  • low light (comes in regular and night version, with 8 IR LEDS)
  • microSD recording
  • movement detection
  • time lapse (with scripts!) only one the action model.
  • Camera Angle: Horizontal/Vertical/Diagonal 92.7°/48.7°/111.2°
  • 2way voice


buy for 30$ 55$ on AE
gpinhTh.jpg

firmware instructions

this configurator is for the action model, but still has some interesting stuff to try.

teardown

thanks to this sources


running telnet 192.168.1.110 root/1234qwer

also check /etc/init.sh for startup scripts

#nmap -O 192.168.1.110
Starting Nmap 7.01 ( https://nmap.org ) at 2016-02-24 12:41 SGT
Nmap scan report for 192.168.1.110
Host is up (0.0083s latency).
Not shown: 996 closed ports
PORT    STATE SERVICE
21/tcp  open  ftp
23/tcp  open  telnet
80/tcp  open  http
554/tcp open  rtsp
MAC Address: B0:D5:9D:4C:65:71 (Shenzhen Zowee Technology)
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.5
Network Distance: 1 hop

# id
uid=0(root) gid=0(root) groups=0(root)
# free
              total         used         free       shared      buffers
  Mem:        35212        33472         1740            0          404
 Swap:            0            0            0
Total:        35212        33472         1740

# uname -a
Linux (none) 3.0.8 #1 Wed Apr 30 16:56:49 CST 2014 armv5tejl GNU/Linux

# cat /proc/cpuinfo 
Processor       : ARM926EJ-S rev 5 (v5l)
BogoMIPS        : 218.72
Features        : swp half thumb fastmult edsp java 
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant     : 0x0
CPU part        : 0x926
CPU revision    : 5

Hardware        : hi3518
Revision        : 0000
Serial          : 0000000000000000

# netstat -tualn
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
tcp        0      0 0.0.0.0:38888           0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:8554            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:554             0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:18554           0.0.0.0:*               LISTEN      
tcp        0      0 192.168.1.110:54273     52.76.22.225:28622      ESTABLISHED 
tcp        0      0 192.168.1.110:554       192.168.1.114:45924     ESTABLISHED 
tcp        0      0 :::80                   :::*                    LISTEN      
tcp        0      0 :::23                   :::*                    LISTEN      
tcp        0      0 ::ffff:192.168.1.110:23 ::ffff:192.168.1.114:52982 ESTABLISHED 
udp        0      0 0.0.0.0:20233           0.0.0.0:*                           
udp        0      0 0.0.0.0:46603           0.0.0.0:*                           
udp        0      0 0.0.0.0:6978            0.0.0.0:*                           
udp        0      0 0.0.0.0:6980            0.0.0.0:*                           
udp        0      0 0.0.0.0:48027           0.0.0.0:*                           
udp        0      0 0.0.0.0:1500            0.0.0.0:*                           

# cat /proc/mtd     
dev:    size   erasesize  name
mtd0: 00040000 00010000 "boot"
mtd1: 00020000 00010000 "env"
mtd2: 00020000 00010000 "conf"
mtd3: 00300000 00010000 "os"
mtd4: 00380000 00010000 "rootfs"
mtd5: 008e0000 00010000 "home"
mtd6: 00020000 00010000 "vd"


following details and images from xuxiaobo archive link

  • SOC HISILICON Hi3518 / ARMv5

nDuZAn1.jpg

U-boot dump from here


securing your rtsp stream