M709 1080p Mini Camera with WiFi (extremely small)

[bettse]

I've made a bit more progress. I saw the device emit some broadcast packets, and after a little more work I've found the key to decrypt them (in hex)

Code: Select all

676E3B6E677133347569796837754748262A4F232447247475687571696F68333437387479386F6740404C4845573A464A482A307570346A6839686867756973

Happily, they include the user_key, which means they can be used to calculate the rtsp password. I wrote a script that attempts this (https://gitlab.com/bettse/fake_hopeway/ ... oadcast.js). I also noticed something interesting, although not useful, about the user keys. They contain a timestamp. For example, 131609452846781890 breaks down into '13 1609452846 781890'. 1609452846 is Thu Dec 31 14:14:06 PST 2020, when I created the account.

[chris24walsh]

@bettse You genius! That decrypt_broadcast.js script you wrote worked perfectly with the couple of cameras I bought on the cheap a while ago. Time to get some more Good thread indeed, it's really the only place on the internet where I've found anything useful about these Hopeway cams.
If it's alright with you, perhaps I could port the script to python, and try to wrap it in a Home Assistant(!) integration. It would make a great addition for HA people who want to add some cheap RTSP cameras to the mix. It's just what I was looking for myself.
By the way, I would really like to understand exactly how you cracked the encryption on the network traffic from those cameras. I really want to reverse engineer some other cheap, no-name IoT devices I've picked up from aliexpress/banggood etc, particularly this video doorbell I got a year or two ago. I wasn't even able to sniff the RTSP url with Wireshark from the Hopeway cameras though, so I'm clearly lacking skills here. Please guide me a bit if you can!

[garycooper]

Hello, I don't understand how to see streaming on domoticz with this round camera. Does someone could explain how to do that ?
Thanks a lot

[bettse]

Sorry for the delay, I haven't checked on the thread in months

If it's alright with you, perhaps I could port the script to python, and try to wrap it in a Home Assistant(!) integration.

Absolutely!

By the way, I would really like to understand exactly how you cracked the encryption on the network traffic from those cameras.

It has been months, so I don't recall the specifics, but I generally do a lot of static analysis of the apk (recompile, attempt to read the 'source', as well as writing scripts to test/validate.

[WildLucifero]

Yes I did, but I don't have compatible PC software for this camera.
...cut...

Hello, you can try the P2PCamWin. It runs well with my A9 CAM. it needs the UID and the password (the default is hk123456)
But I don't know how the get stream from VLC or any NVR SWs.
Ciao

Michele

[WildLucifero]

Ended up doing a few hardware mods:
1) Remove LEDs
2) Modify switch so the camera starts automatically on power restore
3) Remove Lithium Ion battery
...cut...

Hello ben5325642, how did you modify the switch? In true it is a button, not properly a "switch".
Thanks
Michele

[webyou]

Hi,
Yes it generates the url every time you (re)connect it to your WiFi. So after resetting to factory defaults and reconnecting it, it is:

rtsp://192.168.1.39:554/005a8f514b7a61782da336f201d10299_0
rtsp://192.168.1.39:554/005a8f514b7a61782da336f201d10299_1

Never mind, as long as it's not resetted to defaults there's no problem. I will change common setting with the app and IR switches on automaticly when it's to dark. I connected it to NetcamStudio and from there we go to Domoticz. Works like a charm.

Tnx for helping out!

do you explain to me how do you do get rtsp?
Tnx

[leumasme2]

Has anyone tried inspecting these Hopeway RealServer cameras on a hardware level? Debug ports, Dumping firmware, ...

[valexi]

I set up a simple server to RPi to send JSON data to camera I forwarded all traffic to port 80 from Mini Camera to my RPi.
Camera never connects to RPi server.

Then I captured traffic from the camera from boot until I have a connection with cellphone HDWifiCamPro. I have disabled all access to internet from camera.

Here is dump. I hope you guys see something new from it.

Code: Select all

root@OpenWrt:~# tcpdump | grep 192.168.1.167
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br-lan, link-type EN10MB (Ethernet), capture size 262144 bytes
10:31:43.283609 IP OpenWrt.lan.67 > 192.168.1.167.68: BOOTP/DHCP, Reply, length 300
10:31:43.293186 IP OpenWrt.lan.67 > 192.168.1.167.68: BOOTP/DHCP, Reply, length 300
10:31:43.533498 ARP, Request who-has OpenWrt.lan tell 192.168.1.167, length 46
10:31:43.537440 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:43.537495 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:43.744558 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:43.744596 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:43.953371 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:43.953440 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:44.162484 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:44.162554 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:44.372620 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:44.372678 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:44.584752 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:44.584792 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:44.633173 IP 192.168.1.167.52311 > OpenWrt.lan.53: 8+ A? openapi.xg.qq.com. (35)
10:31:44.633223 IP 192.168.1.167.59843 > OpenWrt.lan.53: 9+ A? fcm.googleapis.com. (36)
10:31:44.633635 IP 192.168.1.167.34081 > OpenWrt.lan.53: 10+ A? ntp.sjtu.edu.cn. (33)
10:31:44.654814 IP OpenWrt.lan.53 > 192.168.1.167.52311: 8 NXDomain 0/1/0 (89)
10:31:44.657767 IP 192.168.1.167.36355 > OpenWrt.lan.53: 9+ A? openapi.xg.qq.com.lan. (39)
10:31:44.657879 IP OpenWrt.lan.53 > 192.168.1.167.36355: 9 NXDomain 0/0/0 (39)
10:31:44.666508 IP OpenWrt.lan.53 > 192.168.1.167.59843: 9 1/0/0 A 216.239.36.55 (52)
10:31:44.666629 IP OpenWrt.lan.53 > 192.168.1.167.34081: 10 6/0/0 CNAME ntp.ecslb.sjtu.edu.cn., CNAME pool.ntp.org., A 162.159.200.123, A 162.159.200.1, A 188.165.138.207, A 192.26.105.26 (147)
10:31:44.793454 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:44.793495 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:45.002368 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:45.212431 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:45.422319 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:45.633713 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:45.633754 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:45.842327 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:46.052312 IP 192.168.1.167.17299 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:48.342936 ARP, Request who-has 192.168.1.167 tell OpenWrt.lan, length 28
10:31:48.345462 ARP, Reply 192.168.1.167 is-at 38:01:46:19:24:cd (oui Unknown), length 46
10:31:54.673541 IP 192.168.1.167.37410 > time.cloudflare.com.123: NTPv3, Client, length 48
10:31:54.673584 IP OpenWrt.lan > 192.168.1.167: ICMP time.cloudflare.com udp port 123 unreachable, length 84
10:31:56.062348 IP 192.168.1.167.60791 > OpenWrt.lan.53: 10+ A? p2p2.hdwificampro.com. (39)
10:31:56.062494 IP OpenWrt.lan.53 > 192.168.1.167.60791: 10 1/0/0 A 139.9.86.167 (55)
10:31:56.064409 IP 192.168.1.167.34292 > OpenWrt.lan.53: 11+ A? p2p3.hdwificampro.com. (39)
10:31:56.064504 IP OpenWrt.lan.53 > 192.168.1.167.34292: 11 1/0/0 A 3.227.45.161 (55)
10:31:56.067159 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:56.067171 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:56.067211 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:56.067216 IP OpenWrt.lan > 192.168.1.167: ICMP ecs-139-9-86-167.compute.hwclouds-dns.com udp port 32100 unreachable, length 40
10:31:56.067235 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:56.067273 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-227-45-161.compute-1.amazonaws.com udp port 32100 unreachable, length 40
10:31:56.274418 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:56.274422 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:56.274462 IP OpenWrt.lan > 192.168.1.167: ICMP ecs-139-9-86-167.compute.hwclouds-dns.com udp port 32100 unreachable, length 40
10:31:56.274475 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:56.274970 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:56.275008 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-227-45-161.compute-1.amazonaws.com udp port 32100 unreachable, length 40
10:31:56.482375 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:56.482393 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:56.482423 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:56.692636 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:56.692646 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:56.692684 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:56.902454 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:56.902465 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:56.902503 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:57.113190 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:57.113201 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:57.113228 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:57.113251 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:57.322292 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:57.322302 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:57.322340 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:57.532311 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:57.532324 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:57.532361 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:57.742395 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:57.742406 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:57.742443 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:57.953086 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:57.953098 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:57.953134 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:58.162465 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:58.162480 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:58.162505 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:58.162528 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:58.372605 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:58.372630 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:58.372655 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:58.582405 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:58.582415 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:58.582454 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:58.793056 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:58.793066 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:58.793105 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:59.002614 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:59.002625 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:59.002664 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:59.212290 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:59.212300 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:59.212333 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:31:59.212358 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:59.422256 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:59.422279 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:59.422304 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:59.632735 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:59.632747 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:59.632783 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:31:59.842404 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:31:59.842415 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:31:59.842452 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:00.052264 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:00.052275 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:00.052312 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:00.266212 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:00.266223 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:00.266256 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:32:00.266280 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:00.472235 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:00.472253 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:00.472284 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:00.682268 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:00.682276 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:00.682316 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:00.892247 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:00.892259 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:00.892296 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:01.102330 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:01.102339 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:01.102367 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:32:01.102389 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:01.312949 IP 192.168.1.167.29899 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:01.312958 IP 192.168.1.167.29899 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:01.313007 IP 192.168.1.167.29899 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:04.682137 IP 192.168.1.167.60721 > time.cloudflare.com.123: NTPv3, Client, length 48
10:32:04.682184 IP OpenWrt.lan > 192.168.1.167: ICMP time.cloudflare.com udp port 123 unreachable, length 84
10:32:04.835097 ARP, Request who-has 192.168.1.138 tell 192.168.1.167, length 46
10:32:05.162828 IP 192.168.1.167.28677 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 88
10:32:05.162838 IP 192.168.1.167.28677 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 88
10:32:05.162879 IP OpenWrt.lan > 192.168.1.167: ICMP ecs-139-9-86-167.compute.hwclouds-dns.com udp port 32100 unreachable, length 124
10:32:05.162880 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 124
10:32:05.162910 IP 192.168.1.167.28677 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 88
10:32:05.162957 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-227-45-161.compute-1.amazonaws.com udp port 32100 unreachable, length 124
10:32:05.579669 IP 192.168.1.167.23064 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:05.579678 IP 192.168.1.167.23064 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:05.579726 IP 192.168.1.167.23064 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 48
10:32:05.579728 IP 192.168.1.167.23064 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:05.579729 IP 192.168.1.167.23064 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 48
10:32:05.579729 IP 192.168.1.167.23064 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 48
10:32:06.683104 IP 192.168.1.167.23064 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 48
10:32:06.683118 IP 192.168.1.167.23064 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 48
10:32:06.683154 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 84
10:32:06.683184 IP 192.168.1.167.23064 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 48
10:32:08.881359 IP 192.168.1.167.23064 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 48
10:32:08.881415 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 84
10:32:08.882267 IP 192.168.1.167.23064 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 48
10:32:08.882273 IP 192.168.1.167.23064 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 48
10:32:08.882310 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-227-45-161.compute-1.amazonaws.com udp port 32100 unreachable, length 84
10:32:11.323309 IP 192.168.1.167.55371 > OpenWrt.lan.53: 12+ A? p2p2.hdwificampro.com. (39)
10:32:11.323463 IP OpenWrt.lan.53 > 192.168.1.167.55371: 12 1/0/0 A 139.9.86.167 (55)
10:32:11.325823 IP 192.168.1.167.38728 > OpenWrt.lan.53: 13+ A? p2p3.hdwificampro.com. (39)
10:32:11.325927 IP OpenWrt.lan.53 > 192.168.1.167.38728: 13 1/0/0 A 3.227.45.161 (55)
10:32:11.328409 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:11.328428 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:11.328458 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:32:11.328475 IP OpenWrt.lan > 192.168.1.167: ICMP ecs-139-9-86-167.compute.hwclouds-dns.com udp port 32100 unreachable, length 40
10:32:11.328480 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:11.328517 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-227-45-161.compute-1.amazonaws.com udp port 32100 unreachable, length 40
10:32:11.531948 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:11.531958 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:11.531996 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:11.742069 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:11.742082 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:11.742118 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:11.951917 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:11.951929 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:11.951965 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:12.162043 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:12.162053 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:12.162084 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:32:12.162107 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:12.372061 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:12.372066 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:12.372061 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:12.582007 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:12.582019 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:12.582056 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:12.792374 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:12.792385 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:12.792422 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:13.002185 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:13.002197 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:13.002234 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:13.212456 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:13.212467 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:13.212497 IP OpenWrt.lan > 192.168.1.167: ICMP ec2-3-10-99-101.eu-west-2.compute.amazonaws.com udp port 32100 unreachable, length 40
10:32:13.212520 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:13.422054 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:13.422057 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:13.422057 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:13.631794 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:13.631804 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:13.632547 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:13.842548 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:13.842559 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:13.842597 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:14.051896 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:14.051907 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
10:32:14.051945 IP 192.168.1.167.14143 > ec2-3-227-45-161.compute-1.amazonaws.com.32100: UDP, length 4
10:32:14.261944 IP 192.168.1.167.14143 > ec2-3-10-99-101.eu-west-2.compute.amazonaws.com.32100: UDP, length 4
10:32:14.261955 IP 192.168.1.167.14143 > ecs-139-9-86-167.compute.hwclouds-dns.com.32100: UDP, length 4
^C2600 packets captured
2613 packets received by filter
0 packets dropped by kernel

EDIT:
I was able to enable FTP server to this minicam. Use telnet to login, username: root password is empty.
Then run command:

Code: Select all

busybox tcpsvd -vE 0.0.0.0 21 ftpd /mnt/sd

This starts FTP server and you can browse SD card files and recordings.

Then I went to /mnt/userdata/config
Create new file: ftpserver.sh with content:

Code: Select all

#!/bin/sh
busybox tcpsvd -vE 0.0.0.0 21 ftpd /mnt/sd

Then use command:

Code: Select all

chmod +x ftpserver.sh

Then add startup script to start.sh in the same folder in the end after "/usrsys/app/appUpgrade.sh &":

Code: Select all

/mnt/userdata/config/ftpserver.sh &

Then type reboot and FTP server will be started on every boot.
Still have not been able to enable RTSP.

[trincea554]

i think we have similar camera, i'm trying to enter into UART to try to dump the firmware and hopefully modding it, my first objective is to access the UART and then try to enable ftp,onvif and rtsp (i will attach some some photo of the board and the pin for the uart)
https:// imgur. com/a/b4qQvEG

[crockysam]

I've made a bit more progress. I saw the device emit some broadcast packets, and after a little more work I've found the key to decrypt them (in hex)

Code: Select all

676E3B6E677133347569796837754748262A4F232447247475687571696F68333437387479386F6740404C4845573A464A482A307570346A6839686867756973

I'm curious, how did you figure out the decryption key?