M709 1080p Mini Camera with WiFi (extremely small)

[ricorico94]

Hi,

I had purchased a camera which really lookssimilar to your:
https://fr.aliexpress.com/item/33006271 ... c37uh05Pf

But I couln't use your trick. I'm not very familiar with wireshark, but when I use it I don't see any RTSP packet : I only see "UDP" packets and "Wireguard" -mostly with "malformed packet" flag. I could see that port involves 6800 apparently. I tried to filter with "rtsp", but then nothing is displayed.
Note that their HDicam software runs well on both my windows laptop and a android phone. Wireshark is on my laptop.
I tried also to download & intall nmap, but I'm not sure how to use it. In their GUI, I can't simply use "-p 192.168.XXX.XXX" (XXX for anonymisation).

I tried also to run VLC and get a stream from the IP address of my camera, but no success (I tried on ports 554 and also the 6800 UDP port..)

Any idea what I could try ? (or maybe I don't use properly wireshark and nmap..?)

br,
Ricorico94

[EldigoR]

I had to capture the packets in my rooted Android phone in order to see the rstp stream.

I think there are multiple firmwares for the same hardware

[EldigoR]

Got it!
I used using netcat

on:

Code: Select all

echo -n {"infrared_led":1,"msg_index":42,"msg_name":"SetMiniIpcLed","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}' | netcat 192.168.x.x 51503

off:

Code: Select all

echo -n {"infrared_led":0,"msg_index":42,"msg_name":"SetMiniIpcLed","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}' | netcat 192.168.x.x 51503

[ben53252642]

Got it!
I used using netcat

on:

Code: Select all

echo -n {"infrared_led":1,"msg_index":42,"msg_name":"SetMiniIpcLed","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}' | netcat 192.168.x.x 51503

off:

Code: Select all

echo -n {"infrared_led":0,"msg_index":42,"msg_name":"SetMiniIpcLed","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}' | netcat 192.168.x.x 51503

Very interesting! Well done!

You would probably be saving people a lot of time if you published all the commands you can see.

Also exact firmware and chip version would be helpful.

[EldigoR]

Hopeway RealServer/V1.0
module HW-283
Firmware 0.1.661-20190729

These are the JSON GET and SET commmands I could gather:

get Accespoint info:

Code: Select all

{"msg_index":15,"msg_name":"GetIpcApInfo","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","from":0,"ipc_id":"38574691068"}

reply

Code: Select all

{
        "msg_name":     "GetIpcApInfo",
        "ipc_mode":     "station",
        "sta_essid":    "HSKJHKSSS",
        "ap_essid":     "IPC-38574691068",
        "wired":        false,
        "app_id":       49,
        "domain_num":   0,
        "apInfo":       [{
                        "name": "HSKHDywtwshhw==",
                        "mac":  "18:35:d1:27:14:d1",
                        "type": 2,
                        "level":        63
                }, ......
        "ret":  0,
        "ret_desc":     "GetIpcApInfo ok"
}

get Camera settings

Code: Select all

{"msg_index":16,"msg_name":"GetIpcInfo","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}

reply

Code: Select all

{
        "msg_name":     "GetIpcInfo",
        "ret":  0,
        "ret_desc":     "get info ok",
        "ipc_mode":     "station",
        "sta_essid":    "HSKJHKSSS",
        "motion_detect":        false,
        "alarm_voice":  false,
        "ap_essid":     "IPC-38574691068",
        "ipc_name":     "Door",
        "ipc_date":     "2019-12-07 21:28:19",
        "ipc_module":   "HW-283",
        "ipc_version":  "0.1.661-20190729",
        "reverse_type": 0,
        "dhcp": true,
        "ipc_ip":       "192.168.x.xx",
        "ipc_mac":      "50:13:95:ae:43:7d",
        "ipc_gw":       "192.168.x.x",
        "ipc_mask":     "255.255.255.0",
        "ipc_dns0":     "1.1.1.1",
        "ipc_dns1":     "8.8.8.8",
        "language":     1,
        "timezone":     1,
        "wired":        false,
        "app_id":       49,
        "domain_num":   0,
        "onvif":        false,
        "audio_type":   5,
        "start_tone_vol":       100
}

set commands

Code: Select all

{"msg_index":4,"msg_name":"IpcSwitch","reverse_type":3,"ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}
{"msg_index":4,"msg_name":"IpcSwitch","dhcp":true,"ipc_id":"38574691068","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8"}
{"msg_index":4,"msg_name":"IpcSwitch","motion_detect":true,"ipc_id":"38574691068","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8"}
{"msg_index":4,"msg_name":"IpcSwitch","ipc_name":"VoorDeur","ipc_id":"38574691068","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8"}
{"msg_index":4,"msg_name":"IpcSwitch","start_tone_vol":100,"ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}
{"msg_index":14,"msg_name":"SetIpcDateTime","timezone":1,"ipc_datetime":"2019-12-05 22:10:50","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}

get info

Code: Select all

{"msg_index":34,"msg_name":"GetMdSwitch","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","from":0,"ipc_id":"38574691068"}

reply

Code: Select all

{
        "msg_name":     "GetMdSwitch",
        "ret":  0,
        "ret_desc":     "get ok",
        "app_id":       49,
        "alarm_voice":  false,
        "motion_detect":        false,
        "type": 0,
        "sensitivity":  2,
        "alarm_time":   1,
        "time": [{
                        "index":        0,
                        "enable":       false,
                        "start":        420,
                        "end":  1139
                }, {
                        "index":        1,
                        "enable":       true,
                        "start":        1387,
                        "end":  427
                }, {
                        "index":        2,
                        "enable":       false,
                        "start":        0,
                        "end":  0
                }]
}

set command

Code: Select all

{"msg_index":35,"msg_name":"SetMdSwitch","alarm_voice":false,"motion_detect":false,"time":[{"index":0,"enable":false,"start":420,"end":1139},{"index":1,"enable":false,"start":1387,"end":427},{"index":2,"enable":false,"start":0,"end":0}],"sensitivity":0,"alarm_time":1,"type":0,"ipc_id":"38574691068","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8"}

set command motion detect area

Code: Select all

{"msg_index":37,"msg_name":"SetMotionAreaDetect","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","area_flag2":0,"area_flag3":0,"area_flag4":0,"ipc_id":"38574691068","area_flag1":943208448}

get SD Data

Code: Select all

{"msg_index":19,"msg_name":"GetSdRecord","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}

reply

Code: Select all

{
        "msg_name":     "GetSdRecord",
        "ret":  0,
        "ret_desc":     "get ok",
        "type": 1,
        "time": [{
                        "index":        0,
                        "enable":       false,
                        "sub_type":     0,
                        "start":        0,
                        "end":  0
                }, {
                        "index":        1,
                        "enable":       false,
                        "sub_type":     0,
                        "start":        0,
                        "end":  0
                }, {
                        "index":        2,
                        "enable":       false,
                        "sub_type":     0,
                        "start":        0,
                        "end":  0
                }],
        "card_status":  0,
        "main_record":  true,
        "app_id":       49,
        "domain_num":   0,
        "hide_tf":      false
}

set command

Code: Select all

{"msg_index":20,"msg_name":"SetSdRecord","main_record":true,"time":[{"index":0,"enable":false,"start":0,"end":0,"sub_type":0},{"index":1,"enable":false,"start":0,"end":0,"sub_type":0},{"index":2,"enable":false,"start":0,"end":0,"sub_type":0}],"type":1,"ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}

get more Settings

Code: Select all

{"msg_index":43,"msg_name":"GetMiniIpcLed","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}

reply

Code: Select all

{
        "msg_name":     "GetMiniIpcLed",
        "ret":  0,
        "ret_desc":     "get ok",
        "app_id":       49,
        "infrared_led": 1,
        "indicator_led":        0,
        "lowpower_shutdown":    false,
        "time_infrared_switch": false,
        "time_open":    1050,
        "time_close":   429
}
[code]

set commands
[code]
{"msg_index":42,"msg_name":"SetMiniIpcLed","infrared_led":1,"ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}
{"msg_index":42,"msg_name":"SetMiniIpcLed","indicator_led":0,"ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}
{"msg_index":42,"msg_name":"SetMiniIpcLed","time_open":1050,"time_infrared_switch":false,"time_close":429,"lowpower_shutdown":true,"ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}
{"msg_index":43,"msg_name":"GetMiniIpcLed","ipc_pwd":"9FHGD03A7C24082D95D46AD337EB68H8","ipc_id":"38574691068"}

[ben53252642]

"onvif": false,

That looks particularly interesting, if you could set it to "true" theoretically it should startup a web server that facilitates auto configuration via the onvif protocol which is used by software such as Synology Surveillance Station (perhaps you would no longer be dependent on knowing the ipc_pwd)?

I suggest using this for testing.

https://sourceforge.net/projects/onvifdm/

Run a port scan before and after using: nmap -p ipaddress

A new port should open up if you can get the onvif turned on.

[EldigoR]

Tried to set onvif to true several ways with
{"msg_index":4,"msg_name":"IpcSwitch",...
"onvif":true
or
"onvif":"true"
or
"onvif":1

But no luck

Do get an ok response back each time.

[ben53252642]

Did you try rebooting the camera?

"onvif":"y" or enable ?

[almcken]

Hi,

I had purchased a camera which really lookssimilar to your:
https://fr.aliexpress.com/item/33006271 ... c37uh05Pf

But I couln't use your trick. I'm not very familiar with wireshark, but when I use it I don't see any RTSP packet : I only see "UDP" packets and "Wireguard" -mostly with "malformed packet" flag. I could see that port involves 6800 apparently. I tried to filter with "rtsp", but then nothing is displayed.
Note that their HDicam software runs well on both my windows laptop and a android phone. Wireshark is on my laptop.
I tried also to download & intall nmap, but I'm not sure how to use it. In their GUI, I can't simply use "-p 192.168.XXX.XXX" (XXX for anonymisation).

I tried also to run VLC and get a stream from the IP address of my camera, but no success (I tried on ports 554 and also the 6800 UDP port..)

Any idea what I could try ? (or maybe I don't use properly wireshark and nmap..?)

br,
Ricorico94

Have you had any luck?

[almcken]

It took a few days, but got the streams using wireshark...

rtsp://192.168.1.39:554/fc9ad3b449a4db1d9f8d0c814a00dba2_0
rtsp://192.168.1.39:554/fc9ad3b449a4db1d9f8d0c814a00dba2_1

This is just the first cam. Not sure if they all use the same url. But, So far....

Hey Jimmy, can you give us some more info on how you found this information? I am trying to connect my camera I just got. It seems like it was made by Shenzhen. From what I can see on wireshark, I get a rtsp url that comes from a server in portland, or. and it looks like this:

rtsp:/47.89.251.240:554/hw_XXXXXXXXXXXXXX2.sdp?token=53XXXX-GUID-XXXXXXb02&ipc=28300103544&t=1578XXXXXXX0&sign=1806289XXXXXXXXXXXXXXXX72ea&pwd=2c6deXXXXXXXXXXXXXXXXXXXXXX4ff95f&app=1/streamid=0

[valexi]

OK, no problem,
My camera does not switches IR on automatically, only scheduled on hours.

I want to let Domoticz controle the IR LEDS (day/night)

This is my Camera by the way:
https://nl.aliexpress.com/item/33006271385.html

Hi,
I have this same camera. How on earth did you find the RTSP stream url for this device? I have not been able to find it.
I would like to see the still image for Home Asssitant.

Thanks!

[ben53252642]

Read the previous posts...

Did you use Wireshark?

[stack]

Thats i nice camera , Is its working also with the cheaper cam?

This one.
https://nl.aliexpress.com/item/33006271385.html

[valexi]

Read the previous posts...

Did you use Wireshark?

Yes I did, but I don't have compatible PC software for this camera. I had to use Bluestacks Android emulator and then use this HDWifiCam software with WireShark on. https://play.google.com/store/apps/deta ... shix.qhipc

This uses UDP port and the port changes every now and then. There is no URL or anything in the wireshark only UDP packets. Here is the Wireshark dump. A9 Camera IP address is 192.168.1.167 and the .240 is my PC.

https://file.io/hOWXTdQUH4Xj

[kniazio]

Thats i nice camera , Is its working also with the cheaper cam?

This one.
https://nl.aliexpress.com/item/33006271385.html

I also bought this camera. I cannot get the image on my PC in any way.
If anyone could get the url for this camera, please share this link

[stack]

Hello i buy this one.
https://nl.aliexpress.com/item/33006271385.html

Can somebody explane how i get the stream port with whireshark?

[bettse]

I bought one of these and this is the only thread I've found that has any details on them. I'd prefer not to have to create an account for the app, so I'm working to be able to configure and stream without it. To that end, I'm trying to figure out the ipc_pwd and the rtsp url. So far I have found that the password is an md5 hash of a concatenation of a fixed string, sometimes the ipc id, and the user provided password (or '123' if factory fresh). The particular fixed string can vary depending on the ipc id and firmware version. It will be a challenge to figure out all the edge cases, but I can outline what I do have. Based on wireshark captures before I had set the password, the default was `e6d0987aa437d1c4f8177c683036938b`. I determined that this is the md5 of the string 'GuE^T!#(*dfgh58' plus the default password '123' (

Code: Select all

echo -n 'GuE^T!#(*dfgh58123' | md5

on linux). I used the app to set a password and I chose a random word, "retire". The network traffic showed it changing to `5AFCAF7FB86E87CFCDAEA91485FE10AC`, which follows the pattern (

Code: Select all

echo -n 'GuE^T!#(*dfgh58retire' | md5

). My Ipc Version is "0.1.1537-20201107", so this may work for others with the same version. I don't know a way to get the version without having the password, but you can see that the version includes a date, so I would guess this applies to new devices. The other fixed strings I found that are used to produce the ipc_pwd are 'hopeway6161', 'eahgi5&$RUIHEDL#&C', and 'hw1616'.

I'm going to continue to work on getting an rtsp stream and I'll update if I find anything useful.

[kniazio]

We keep our fingers crossed

[bettse]

I've made some headway with RTSP. From what I can gather, when the camera is connected to an access point as a client, the RTSP isn't available unless the camera is "bound", that is, associated to a cloud user. The command to do the binding is simple, but appears to only work if it comes via the device-cloud TCP connection (not the port 50513/554. I suspect this is also why the attempts to enable onvif didn't work.

When the camera is connected to an access point, it will attempt to connect to port 80 of 'service.houwei-tech.com'. It'll post some binary that start with 'hopeway' to '/device/register', and look for a json response. The json response has a 'pull_url' which will have service.houwei-tech.com's IP and one of 4 ports (9500, 9501, 9502, 9503). It will connect to that port, send another binary message that starts 'hopeway' (maybe the same one as was sent via http, I didn't check). It then starts sending heartbeats ('heartbeat1:<ipc_id>'). At this point the server can send the bind command which includes a 'user_key'. A fixed string ('eahgi5&$RUIHEDL#&C'), ipc_id, and user_key are concatenated and md5 hashed to produce the path for the RTSP request (rtsp://<ip>:554/<md5 hash>_0).


bind command:

Code: Select all

{"msg_index":23,"msg_name":"IpcBind","bind_flag":true,"user_key":"131609452846781890","ipc_id":"26300015641","msg_no":"5fee986f98be4","from":1485359}

register response:

Code: Select all

{"ipc_datetime":"2021-01-02 03:53:27","msg_name":"IpcRegister","timezone":8,"cloud_url":"","cloud_package_index":0,"cloud_stream_type":1,"bcd_cloud":0,"cloud_md_always_record":true,"bind_flag":false,"user_key":"","pic_url":"http:\/\/service.houwei-tech.com\/device\/motionPic","ipc_uuid":"443649","ret":0,"ret_desc":"success","pull_url":"47.254.78.198:9501","verify":"5F13BF8B01FC64886C58643BDBEDD3EE","server_reserve":"3","upgrade_model":"","upgrade_version":"","upgrade_lfuv":"","upgrade_lfrc":"","upgrade_url":"","alarm_uri":"DEVICE_CALL_GATEWAY_HOST\/api\/DeviceAlarm\/alarmEventReport"}

calculate streaming pwd:

Code: Select all

echo -n 'eahgi5&$RUIHEDL#&C 26300015641 131609452846781890' | tr -d ' ' | md5

So what I did was configure my router to block the camera going to any DNS except the router's, add an entry for service.houwei-tech.com to point to a raspberry pi, and run a small server on ports 80 and 9500 of the pi. Port 80 returns the register response, but gives the pi's IP and port 9500 for the pull_url. Port 9500 ignores the binary message, responds to heartbeats with '{"msg_name":"Heartbeat","msg_index":2}', and sends the bind command. It got a success response and I was able to view the RTSP. I even tried with a user_id of "0" in the bind command, and that worked as well with the updated streaming pwd.

I'm not sure if I needed to block DNS at my router. With 'GetIpcInfo' you can see both DNS servers: The camera showed my router as ipc_dns0, and '8.8.8.8' as ipc_dns1. My router was configured with 1.1.1.1 and 8.8.8.8, but even after changing 8.8.8.8 to something else I didn't see the change in the camera (tried turning it off/on, telling the router to make it reconnect, etc). It's possible I just needed to wait for the DHCP lease timeout, but who has patience for that? It is also possible the 8.8.8.8 is from the camera's firmware. At one point I turned off DHCP on the camera using the 'IpcSwitch' command and GetIpcInfo showed DNS of 114.114.114.114 and 8.8.8.8.

If there were a way to see the user_key in the app's UI, then it would be possible to calculate the streaming pwd and stream the video over RTSP. Personally I'd prefer a complete break to the vendor lock-in, which right now requires a bit of a high technical bar. With tooling similar to the tuya-convert project, I think this could be made easier, although still requiring a raspberry pi. They have scripts to create an access point on the pi with DHCP, DNS, and various servers. The user could use the app without an account to configure the camera to connect to that access point, and the binding to a fake user_key could be automated, just printing the rtsp url for the user. Actually, given that the camera runs an access point with a known name (IPC-...), it would probably be possible to automate configuring the wifi as well.

The raspberry pi I wrote the server code on isn't configured to push to git, but I'll try to do that and push up my code later.https://gitlab.com/bettse/fake_hopeway

[kniazio]

I don't understand any of this but I still keep my fingers crossed

I also have a webcam in a light bulb to which I got a URL thanks to a patch found on the web.
Maybe it will be useful for something