Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Yngwie Mangosteen
Aug 23, 2007

jonathan posted:

Thanks, I have the IP's and mac addresses. I can see them through the router and the supplied camera detection software they came with. They report back the IP, HTTP port of 80 and "video" port 9300. In the camera detection software there is a quicklink button to open the camera's website configuration utility, but through chrome or any other browser I just get "Google Chrome's connection attempt to 192.168.1.102 was rejected. The website may be down, or your network may not be properly configured." This makes me wonder how the hell the software is connecting. I can record and view video just fine, but only from the crappy software.

Actually, I didn't notice a small pinhole reset button. Going to try that.

Forgive me if you mentioned it upthread but I'm phone posting. What's the brand and model number of those cameras? I'll ask my guy at work tomorrow if I can't locate anything on it in our knowledge base. We integrate with something like 2000 different models into our software so there are a few people at our company who know a loooot about even random obscure or cheapo cameras.

Adbot
ADBOT LOVES YOU

Rexxed
May 1, 2010

Dis is amazing!
I gotta try dis!

nucleicmaxid posted:

Forgive me if you mentioned it upthread but I'm phone posting. What's the brand and model number of those cameras? I'll ask my guy at work tomorrow if I can't locate anything on it in our knowledge base. We integrate with something like 2000 different models into our software so there are a few people at our company who know a loooot about even random obscure or cheapo cameras.

From jonathan's earlier posts I found that the ebay link for the sale was here but doesn't have a lot about the manufacturer.
http://www.ebay.com/itm/New-Wireless-CCTV-IP-Camera-WiFi-Security-Surveillance-System-Night-Vision-IR/181557716762

The specific model is:
http://zmvideo.en.alibaba.com/product/60027577005-218297790/QQZM_CCTV_night_vision_indoor_IR_Cut_wireless_ip_camera_300k_Pixel_webcam.html

I haven't received mine yet but I like to tinker so I'm curious to find out more as well if there is any more information.

Laranzu
Jan 18, 2002
Any thoughts on these? Haven't seen it recommended in the thread, but its been a good and cheap day/night indoor/outdoor camera for me. I was thinking of picking up a few more for expanded coverage when I move, but I'd like to get other opinions first.

I have one of the 1MP model and it survived outside for an entire Colorado winter. I was using it aimed at the driveway and front walk to trigger record if something walked into frame, it would also kick off the indoor camera in the front room.

The IR would detect motion from bugs during the summer a bit more often than I'd desire.

http://www.amazon.com/gp/product/B0098OG8YG/ref=oh_aui_detailpage_o04_s00?ie=UTF8&psc=1
http://www.amazon.com/Dahua-IPC-HFW4300S-Eco-Savvy-Weatherproof-Security/dp/B00H2VSTG2/ref=pd_cp_pc_0

jonathon posted:

So, anyone feel like taking a stab at diagnosing how these magical cheap cameras communicate ? They actually work pretty drat well. They've been exposed to -30 degrees outside for a couple weeks now with no issues at all.

The supplied software works perfectly fine with them, as does the supplied camera ip address checker. nmap gets a response on a few different ports, but trying to get any response through a browser comes back with nothing.

I've spent the last 6 months staring at networking protocols and wireshark transfers. If you want to send me the .pcap file I might be able to dig out something.

Thomamelas
Mar 11, 2009

KillHour posted:

The only reason they have that in there is because when you go over 250 cameras, they try to push you towards Corporate, which is, of course, more expensive. We have Enterprise deployments out there with thousands of cameras, and they work just fine (not all on one server, of course...). Sure, the Corporate feature set would be helpful for management, but there is no technical reason you can't put as many cameras as you want on an Enterprise system.

And you'll note I suggested more then one server. I'm also curious to know how you were doing that with server side motion detection only, since I had to point out to you that Milestone supports camera side a few pages back.

Thomamelas fucked around with this message at 17:38 on Nov 20, 2014

Thomamelas
Mar 11, 2009

Laranzu posted:

Any thoughts on these? Haven't seen it recommended in the thread, but its been a good and cheap day/night indoor/outdoor camera for me. I was thinking of picking up a few more for expanded coverage when I move, but I'd like to get other opinions first.

I have one of the 1MP model and it survived outside for an entire Colorado winter. I was using it aimed at the driveway and front walk to trigger record if something walked into frame, it would also kick off the indoor camera in the front room.

The IR would detect motion from bugs during the summer a bit more often than I'd desire.

http://www.amazon.com/gp/product/B0098OG8YG/ref=oh_aui_detailpage_o04_s00?ie=UTF8&psc=1
http://www.amazon.com/Dahua-IPC-HFW4300S-Eco-Savvy-Weatherproof-Security/dp/B00H2VSTG2/ref=pd_cp_pc_0


I've spent the last 6 months staring at networking protocols and wireshark transfers. If you want to send me the .pcap file I might be able to dig out something.

The Dahua stuff is in the solid performing part of the low end. It's not gonna blow your socks off but you aren't throwing away money either. In that space I prefer Hikvision but that's mostly due to UI stuff rather then image quality. And IR is going to attract bugs, it's pretty much a given. So you'll want to make sure that you occasionally clean the camera.

KillHour
Oct 28, 2007


Thomamelas posted:

And you'll note I suggested more then one server. I'm also curious to know how you were doing that with server side motion detection only, since I had to point out to you that Milestone supports camera side a few pages back.

Our largest single server is running Milestone Enterprise with 198 cameras. Most of the cameras are a mix of 3 and 5 megapixel, with a few 1.3 thrown in. Many of them are the Mobotix dual dome cameras, so the real number is probably closer to ~250 cameras.

Server-side motion is working fine. That particular server is a dual-proc system with 16 total cores @ 2.8Ghz. CPU utilization is around 45%. Throughput, if you're curious, averages around 600 Mbps.

Yngwie Mangosteen
Aug 23, 2007

jonathan posted:

Thanks, I have the IP's and mac addresses. I can see them through the router and the supplied camera detection software they came with. They report back the IP, HTTP port of 80 and "video" port 9300. In the camera detection software there is a quicklink button to open the camera's website configuration utility, but through chrome or any other browser I just get "Google Chrome's connection attempt to 192.168.1.102 was rejected. The website may be down, or your network may not be properly configured." This makes me wonder how the hell the software is connecting. I can record and view video just fine, but only from the crappy software.

Actually, I didn't notice a small pinhole reset button. Going to try that.

Ok. A few more questions and suggestions.

1. Can you ping the ip addresses that the camera finder tool is reporting? If it doesn't ping back then let me know.

2. You're using a super cheap Chinese camera. You're almost certainly going to have to use IE and likely put it into compatibility mode for the address and also make it to 100% unregulated, no security mode.

3. If you have a user guide you might be able to see if the camera is just an RTSP feed, with no actual webpage programmed into it. So I'd look and see if that's the case. I'm phone posting again as I'm out at lunch with a dev asking for more info.

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN

Laranzu posted:

I've spent the last 6 months staring at networking protocols and wireshark transfers. If you want to send me the .pcap file I might be able to dig out something.

I'm going to try the suggestions just above this post first. As a last resort I'll PM you and perhaps we can go through it.Thanks for the offer.

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN

nucleicmaxid posted:

Ok. A few more questions and suggestions.

1. Can you ping the ip addresses that the camera finder tool is reporting? If it doesn't ping back then let me know.

2. You're using a super cheap Chinese camera. You're almost certainly going to have to use IE and likely put it into compatibility mode for the address and also make it to 100% unregulated, no security mode.

3. If you have a user guide you might be able to see if the camera is just an RTSP feed, with no actual webpage programmed into it. So I'd look and see if that's the case. I'm phone posting again as I'm out at lunch with a dev asking for more info.

1. Yes I can, with a 2.x ms response. Side note, they obtain the ip through dhcp, but at the router I assigned them a static ip via dhcp.

2. I will try that. Nope, I don't get any response. I tried connecting via telnet, and was promtped with a user name and password, but couldn't get passed it. Tried the default passwords and lots of others.

3. The user guide is very very basic. Tells how to operate the camera network detection utility and get it set up on wifi.

KillHour
Oct 28, 2007


2-3ms is pretty abysmal for something on your local network.

Yngwie Mangosteen
Aug 23, 2007

jonathan posted:

1. Yes I can, with a 2.x ms response. Side note, they obtain the ip through dhcp, but at the router I assigned them a static ip via dhcp.

2. I will try that. Nope, I don't get any response. I tried connecting via telnet, and was promtped with a user name and password, but couldn't get passed it. Tried the default passwords and lots of others.

3. The user guide is very very basic. Tells how to operate the camera network detection utility and get it set up on wifi.

Ok. Going to offer further advice, noting that this camera looks like it uses the ONVIF protocol.

Try this in IE, compatibility mode, no security, etc. - http://ip address/onvif/events or http://ip address/onvif/media_service

If it asks for a username and password then it is for certain using ONVIF. That means you may need to download an ONVIF compatible client, which you can get at onvif.com as well as like a dozen other places with a google search.

If it doesn't ask for a username/password then something else might be up. It may not have firmware, for example - you can usually install that via the camera finder utility, and it may have come with the firmware on a disc or something.

If none of that works, let me know and I'll delve a little more. It could be that the network is too slow, so the webpage is timing out, or I dunno, a lot of other things.




edit: https://play.google.com/store/apps/details?id=camviewer.mobi.for_qqzm&hl=en might work too? One star reviews though, ick. http://www.amazon.com/Viewer-for-QQZM-ip-cameras/dp/B00IMA34OY is also an option.

Yngwie Mangosteen fucked around with this message at 18:39 on Nov 24, 2014

melon cat
Jan 21, 2010

Nap Ghost
Hi there, KillHour (or anyone who can help me with this!)

I want to set up a a remote home monitoring system using my LifeCam. I want it to be live-feed that I can log into and view at any time, especially when I'm out of town. But I really don't know where to start. Any recommended guides for this type of project? We have multiple laptops, one webcam (willing to buy a second), and we'd like to set up the webcams for two specific rooms. I just don't know where to start for this type of project!

EDIT: I just learned about Dropcam. Reviews seem to be pretty decent. Any thoughts on this product?

melon cat fucked around with this message at 19:53 on Nov 22, 2014

Yngwie Mangosteen
Aug 23, 2007
Looks like, after checking out Dropcam, it's pretty much exactly what you need, and would require little to no setup outside of buying it and doing what the instructions say.

Plus it looks like a decent product for a webcam. It probably won't give you great quality on distant objects if its a particularly big room, and $150 or $200 is kinda steep, but it also seems almost idiotproof. But it also seems like it's more focused for stuff like child monitoring and skype-like contacts. Nest is a pretty good company though from what I've heard.

Yngwie Mangosteen fucked around with this message at 09:27 on Nov 23, 2014

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN
however, it only does cloud recording, which requires a paid subscription. Id buy 5 of them tomorrow if I could record locally or at least for free.

Yngwie Mangosteen
Aug 23, 2007

jonathan posted:

however, it only does cloud recording, which requires a paid subscription. Id buy 5 of them tomorrow if I could record locally or at least for free.

Yeah but the way he was talking he just needs a live stream. If he's looking for recorded video, then the Dropcam subscription is the only option. Though, cloud recording is really lovely in general right now. The U.S. doesn't have the infrastructure to support widescale use of cloud based storage for streaming video, sadly. Or at least, not everywhere, not consistently, and not whenever you want.

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN
Ok so after living out of my work truck for the past week, I am home for the day and spent some time loving with my Nest thermostat and digging into these chineseum cameras.

I downloaded something called Fiddler which is similar to wireshark. Upon starting the IPCamV.exe program which currently is the only way to view the cameras, I see that it connects to http://ipcup5.zmvideo.net/WebS/Service1.asmx

If I try to go to those via my browser I just get asian text and/or Microsoft IIS generated web errors in Chinese.

1)Why is my Cameras on my local network connecting to an external website
2)I wonder if this is some sort of dynDNS service to allow external viewing of the cams.

Doing some searches got me to this datasheet on the internals of the camera,
http://www.dfrobot.com/image/data/SEN0099/camera%20module.pdf

Im pretty much done with troubleshooting these. They sure seem to be built sturdy. It's currently -25 outside, and one camera is buried in snow, and it working perfectly fine.

If they were working correctly, I could have figured out who came and shoveled my 100' long driveway yesterday while I was out of town.

Can anyone link me to a cheap camera similar to these that has been verified to work with iSpy or BlueIris ?

jonathan fucked around with this message at 21:47 on Nov 28, 2014

Motronic
Nov 6, 2009

jonathan posted:

If they were working correctly, I could have figured out who came and shoveled my 100' long driveway yesterday while I was out of town.

THE STOLE YOUR DRIVEWAY SNOW?!

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN

Motronic posted:

THE STOLE YOUR DRIVEWAY SNOW?!

Well, they placed it beside the driveway. But I didn't know who to thank.

Rexxed
May 1, 2010

Dis is amazing!
I gotta try dis!

jonathan posted:

Well, they placed it beside the driveway. But I didn't know who to thank.

I got my Chinese camera and it's doing the same thing as yours so far. I'm checking it out. Seems like it sends that one web request to ipcup5.zmvideo.net/Web/Service1.asmx where the content is a SOAPaction for "http://tempuri.org/GetVer" so my guess is that it's was supposed to have that uri replaced and pointed to the correct server to get software updates, but the developers just left a placeholder in and shipped it. I'm not a web developer but it doesn't seem like it's sending all of my video to China or anything, just making the one request which seems to fail and then going on its merry way.

I may disassemble it a bit to look at what embedded board they have doing the network connections and streaming the data from the camera.

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN

Rexxed posted:

I got my Chinese camera and it's doing the same thing as yours so far. I'm checking it out. Seems like it sends that one web request to ipcup5.zmvideo.net/Web/Service1.asmx where the content is a SOAPaction for "http://tempuri.org/GetVer" so my guess is that it's was supposed to have that uri replaced and pointed to the correct server to get software updates, but the developers just left a placeholder in and shipped it. I'm not a web developer but it doesn't seem like it's sending all of my video to China or anything, just making the one request which seems to fail and then going on its merry way.

I may disassemble it a bit to look at what embedded board they have doing the network connections and streaming the data from the camera.

Thanks!I posted a .pdf above with info on the board. It's a technical paper.

Rexxed
May 1, 2010

Dis is amazing!
I gotta try dis!

jonathan posted:

Thanks!I posted a .pdf above with info on the board. It's a technical paper.

Yeah that paper is good and describes the camera module. It attaches to the computer onboard which in turn connects to the sd card slot and wifi and ethernet adapters. So far I've found that it's got a Hi3518 embedded linux system on a chip. The Wifi unit is a mediatek mt7601un which is pretty common. TCP ports 23, 7788 and 9300 are open. 23 is the telnet port but I haven't been able to figure out the login yet (I've tried all the suggested ones as well as the model number and some various stuff from the camera labeling, I may try brute forcing it but it would take some time). 9300 looks like streaming from the camera, but I'm not sure about 7788. I can't get a rtsp stream from it with VLC.

It looks like there's an accessible serial port header on the board which might let me into the console so I can break into the boot sequence and maybe dump the flash and/or password file, but I can't remember if I have a serial to usb board around or not, I thought I did but I can't find it yet. Still looking around.

The Hi3518 is used in a ton of these cheap IP Cameras and a lot of folks have been messing around with different models, for example: https://acassis.wordpress.com/2014/05/25/boot-log-for-a-cheap-hi3518-chinese-ip-camera/ . I'm not sure why this one doesn't support blueiris when so many others do. For example the IpCameraV software that gets its streaming also runs these cameras that this guy is reselling:
http://www.hosafe.com/
but he's got instructions on his site for blueiris to work with his HD cams which is basically just "put in the IP and autodetect" which doesn't work with this particular camera. It's weird that either they're especially locked down, or I'm just overlooking something I don't know about.

Anyway my degree's in CS, I work IT and I just tinker around with electronics but I'm learning some stuff.

UDP port 3322 is also open but that didn't help much trying to get it working with blueiris. Still playing around with it, I think I know where my rs232 to usb adapter is but I haven't gotten it yet.

edit: been sick this week so I ran some dictionary attacks on the telnet login but didn't get in yet. I'll get my soldering iron warmed up and put headers in the serial port when I feel better. The main problem this camera has is that despite being listed as Onvif it doesn't meet any of the basic communications standards that onvif cameras are supposed to have.
Onvif is a set of standards that are supposed to make various IP cameras work in a somewhat standardized way so you can access them with the same software:
http://www.onvif.org/Portals/0/documents/WhitePapers/ONVIF_WG-APG-Application_Programmer%27s_Guide.pdf
unfortunately this camera isn't recognized by a generic onvif viewer like:
http://sourceforge.net/projects/onvifdm/

Rexxed fucked around with this message at 06:59 on Dec 6, 2014

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN
Just read all this now. I got an email contact to the manufacturer, should I post it here, or in PM or just email him myself ?

Rexxed
May 1, 2010

Dis is amazing!
I gotta try dis!

jonathan posted:

Just read all this now. I got an email contact to the manufacturer, should I post it here, or in PM or just email him myself ?

I'd just go ahead and contact them yourself if you like. You might ask them if there are firmware updates and if so how to apply them since there's no web interface. You could also ask them for the telnet login but they might not give it to you. It would be useful if they did, though. You might also ask them how to set up the camera with BlueIris or iSpy because they may know the correct configuration to do so.

The good news is it streams and we just don't know what settings are required to get the stream to display on software that isn't the native software. I've tried everything from an educated guess, and it took a lot of time for no results so I've decided that I need a cheat sheet now. The bad news is that it's not obvious and it's possible it will require a lot of effort to actually get the camera to behave like a proper onvif camera. However since your goal is just compatibility with alternative recording software, it may be possible to find a configuration for that that I just haven't tried yet.

I think reverse engineering the firmware on the embedded chip and producing a patched version that includes more services is probably going to be the only way to expand functionality of the unit and while I've read about doing it, it's not something I've tried before. It seems a bit complicated but it may be a fun project, it's just not going to be fast for me since I understand the subject generally but haven't done anything specific like it.

I have played with every stream type and port combination I could think of with BlueIris and iSpy but haven't had any luck using anything but the included software. The connection config it uses is:
code:
<?xml version="1.0" encoding="utf-8"?>
<Cameras>
  <Group id="1" name="IPC" desc="" />
  <Camera id="1" name="B4300302B" desc="" NetType="2" deviceId="B4300302B" lanIp="192.168.0.162" ipSubnet="255.255.255.0" 
gatewayIp="192.168.0.1" dnsService="192.168.0.1" version="orange_sun_basic_e328_1.0.7R
" DNS="" source="192.168.0.162" 
password="123456" httpPort="80" videoPort="9300" ServerTCP="" ServerTCPPort="5500" ServerUDP="" ServerUDPPort="5150" ServerTCP2=""
 ServerTCPPort2="5500" ServerUDP2="" ServerUDPPort2="5150" ServerTCP3="" ServerTCPPort3="5500" ServerUDP3="" ServerUDPPort3="5150" 
PlayMode="1" ConnectionType="0" ChannelNums="0." FirstUse="0" />
</Cameras>
in the cameras.config file but most of those ports aren't open except for 9300 so it's kind of amazing that it works at all. We know of course that the software isn't just reading a stream but also controlling the camera in some way because it can tell the camera how to connect to wifi and change the password on it.

I'm taking a look at the android .apk they provided right now to see if there are any hints as to how to connect to the camera in there. I've done a lot of java programming so I may have more luck but I just decompiled it tonight and haven't had much time with it.

If you want to use the camera really soon I'd setup recording from their IpCameraV software or buy a different camera that you know will be supported by the software you want to use. I'm kind of amazed that it's working for you in the weather you described; there's no kind of water protection on the PCB, everything's open to the air, and the Alibaba listing says it's only good down to 14'F. Even the metal strip along the top part is just a sticker.

edit: added breaks into the code block, it was breaking tables.

KillHour
Oct 28, 2007


Goddamn, you guys are putting a lot of effort into getting this camera to work. :golfclap:

I do like how this is turning into a case study on price vs. convenience.

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN

KillHour posted:

Goddamn, you guys are putting a lot of effort into getting this camera to work. :golfclap:

I do like how this is turning into a case study on price vs. convenience.

I feel guilty for side tracking the thread, however if it could get it's features enabled, it would enable people to get a lot of cameras "working" for very cheap.

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN

Rexxed posted:

I'd just go ahead and contact them yourself if you like. You might ask them if there are firmware updates and if so how to apply them since there's no web interface. You could also ask them for the telnet login but they might not give it to you. It would be useful if they did, though. You might also ask them how to set up the camera with BlueIris or iSpy because they may know the correct configuration to do so.


Hrmm, so I emailed and received an auto response.

quote:

Does My e-mail is a dustbin? No!!! So,pls stop!!!!!

Fuckers. :(

Edit: Got an actual response but the only useful info is the last answer.

quote:

Dear Jonathan:
Thanks for your order from our store.
About your questions:
1. the camera software include PC software(IPCameraV) and Mobile Software(Oview), the moblile software just can work on smart mobile phone.

2. the camera not support Onvif, so we do not marked on the page(if you need onvif camera), the price will be higher a little.

3. the user name is admin, password is 123456, pls note the ID number is CAP words, such as: B47003036 If you agree, you can connect the camera with router by internet cable, and give me the ID number, I will check it.
Best regards
Marco

jonathan fucked around with this message at 04:31 on Dec 10, 2014

Squish
Nov 22, 2007

Unrelenting.
Lipstick Apathy
This sidetrack is really drat interesting, so you've got my vote to keep the posts coming.
It'd be great to see you crack this little bastard wide open. Who knows, you might even instigate a mass camera buying if it turns out that the camera can do much more with custom firmware rather than what's included in the vanilla firmware.

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN

Squish posted:

This sidetrack is really drat interesting, so you've got my vote to keep the posts coming.
It'd be great to see you crack this little bastard wide open. Who knows, you might even instigate a mass camera buying if it turns out that the camera can do much more with custom firmware rather than what's included in the vanilla firmware.

I don't even think it's a matter of custom firmware. I think it's just more like, figure out password for telnet
run apache


(I don't even remember linux stuff but I think it just doesn't have services configured to start)

Rexxed
May 1, 2010

Dis is amazing!
I gotta try dis!

jonathan posted:

I don't even think it's a matter of custom firmware. I think it's just more like, figure out password for telnet
run apache


(I don't even remember linux stuff but I think it just doesn't have services configured to start)
I've got a little update on the qqzm f3006 camera because I made a little progress but not a ton.

I figured out the serial port pinout mostly following this as a guide:
http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/

Here's a gallery of pictures I took of the internals. The serial port is the four pads on the board that is square circle circle circle. It runs on 3.3v.
https://imgur.com/a/JQqGm


square is rx, then vcc, then tx, then gnd.

I hooked up a usb to serial FTDI adapter and so far I haven't been able to break the boot sequence for some reason. It might be a problem with my adapter or something, but I figure I'll solder headers to the port before I play with it any more since I'm just kind of jamming jumper pins in there right now which isn't the most reliable connection.

Here's the text log of the boot. You'll see at the end where it fails to reach a bunch of addresses because it's not connected to the network. It basically keeps trying to get in touch over and over. I assume the connection to L1.zmvideo.net is the "cloud functions" of the device, letting you see your camera remotely through firewalls or whatever by arranging the connection through the remote server. Or maybe china is spying on all the cameras, although it seems unlikely :tinfoil:
http://pastebin.com/KKk1iV5T

The next step is breaking into boot sequence and grabbing files or the whole filesystem like this guy did:
http://felipe.astroza.cl/hacking-hi3518-based-ip-camera/

jonathan
Jul 3, 2005

by LITERALLY AN ADMIN

Rexxed posted:

I've got a little update on the qqzm f3006 camera because I made a little progress but not a ton.

I figured out the serial port pinout mostly following this as a guide:
http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/

Here's a gallery of pictures I took of the internals. The serial port is the four pads on the board that is square circle circle circle. It runs on 3.3v.
https://imgur.com/a/JQqGm


square is rx, then vcc, then tx, then gnd.

I hooked up a usb to serial FTDI adapter and so far I haven't been able to break the boot sequence for some reason. It might be a problem with my adapter or something, but I figure I'll solder headers to the port before I play with it any more since I'm just kind of jamming jumper pins in there right now which isn't the most reliable connection.

Here's the text log of the boot. You'll see at the end where it fails to reach a bunch of addresses because it's not connected to the network. It basically keeps trying to get in touch over and over. I assume the connection to L1.zmvideo.net is the "cloud functions" of the device, letting you see your camera remotely through firewalls or whatever by arranging the connection through the remote server. Or maybe china is spying on all the cameras, although it seems unlikely :tinfoil:
http://pastebin.com/KKk1iV5T

The next step is breaking into boot sequence and grabbing files or the whole filesystem like this guy did:
http://felipe.astroza.cl/hacking-hi3518-based-ip-camera/

LoL wow this is beyond me now. But if we (mostly you) can get these to work, you should definitely publish a step by step on how to get them working. I know I'll order like 6 more.

KillHour
Oct 28, 2007


I got off my lazy rear end and wrote the blog post on irises!

http://dssvideo.com/blog/technology/irises-in-depth.html

As always, feedback is appreciated. I feel like this one might be too short, but I'm really not sure how deep in the mud I want to get with it.

KillHour
Oct 28, 2007


Here's the last post on camera hardware for now - sensors:

http://dssvideo.com/blog/technology/sensors-in-depth.html

This one was pretty hard to get the main points across without going too deep in the weeds. Hopefully, it's easy to follow.

Squish
Nov 22, 2007

Unrelenting.
Lipstick Apathy

KillHour posted:

Here's the last post on camera hardware for now - sensors:

http://dssvideo.com/blog/technology/sensors-in-depth.html

This one was pretty hard to get the main points across without going too deep in the weeds. Hopefully, it's easy to follow.

Nice guides you have there. I actually didn't know that about how CCDs read vs CMOS. I hope that you keep writing these.

KillHour
Oct 28, 2007


Squish posted:

Nice guides you have there. I actually didn't know that about how CCDs read vs CMOS. I hope that you keep writing these.

CCDs are basically a bunch of shift-registers stacked next to each other in columns, which blew my mind when I found out about it. I'm definitely going to keep going - a huge part of sales is getting industry visibility and this is the most fun way I can think of to do that.

My next one is probably going to be a basic overview of RAID types, with an opinion piece to follow. I have a bone to pick with my industry over the use of RAID. :)

Squish
Nov 22, 2007

Unrelenting.
Lipstick Apathy
Actually, I only really have/had the barest of understanding how CCDs work, and "series of shift registers" only raises more questions.

So, a couple of videos on YouTube make it a LOT clearer:

https://www.youtube.com/watch?v=iE6Pnga8AIY
And
https://www.youtube.com/watch?v=Xkput-1xNYE

KillHour
Oct 28, 2007


Hey! Someone stuck a post about RAID in a security blog. Bastards. :argh:

Rexxed
May 1, 2010

Dis is amazing!
I gotta try dis!

jonathan posted:

LoL wow this is beyond me now. But if we (mostly you) can get these to work, you should definitely publish a step by step on how to get them working. I know I'll order like 6 more.

I've been kind of busy with other projects but I think the issue with not being able to break into the boot sequence is just them making it non-interactive for when they ship it. So, that's not great. There are a couple of jumpers set on the board so I may try changing their position to see if either one of them unlocks it, but there's a good chance that the jumpers don't control that specifically. If they don't, then they could do stuff as bad as wiping the firmware, as benign as resetting it to defaults, or just change up how the device works. I'll play with it a bit after I get a couple of other things done. I haven't had much luck with the android software yet, and I ran some telnet dictionary attacks on it but wasn't able to break into the board, so it's likely that the password is not easy to find, or the user account isn't "root" or "admin" which are what I was trying. The big dictionary attack I tried was going to take 100 days to complete so I stopped after a few days.

Ultimately I know a lot more about the camera but can't yet actually log into it or change how it works, or discover its streaming output url/format.

KillHour
Oct 28, 2007


Here's the rant I've been promising.

http://dssvideo.com/blog/opinion/is-it-time-to-finally-kill-raid-5-for-surveillance.html

Squish
Nov 22, 2007

Unrelenting.
Lipstick Apathy
It's pretty interesting stuff really. When you start to talk about 100's of multi-megapixel cameras, or even just 10's of them for that matter - the economics of scale really start to show.

Adbot
ADBOT LOVES YOU

KillHour
Oct 28, 2007


This one has a really nerdy title. Sorry.

  • Locked thread