Cheap chinese IP camera with H264 encoding based on Hisilicon 8M (Hi3518E) chip

camera.md

Cheap chinese IP camera with H264 encoding based on Hisilicon 8M (Hi3518E) chip

Video stream url for VLC/DVR:

• rtsp://192.168.1.93:554/user=admin&password=&channel=&stream=.sdp?real_stream--rtp-caching=100

Telnet access

• telnet 192.168.1.10 23
• Localhost login: root
• Password: xmhdipc

Configuration placed at this path:

• /mnt/mtd/Config

To change static IP Address:

• armbenv
• netinit eth0 192.168.1.93

For enabling DHCP

• echo 1 > mnt/mtd/Config/dhcp.cfg

Interesting links:

• http://marcusjenkins.com/linux/hacking-cheap-ebay-ip-camera/
• http://www.hkvstar.com/technology-news/china-ip-camera-configuration-firmware.html

# cat /proc/cpuinfo
Processor       : ARM926EJ-S rev 5 (v5l)
BogoMIPS        : 218.72
Features        : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant     : 0x0
CPU part        : 0x926
CPU revision    : 5

Hardware        : hi3518
Revision        : 0000
Serial          : 0000000000000000

# ps
  PID USER       VSZ STAT COMMAND
    1 root      1240 S    init
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 SW   [kworker/0:0]
    5 root         0 SW   [kworker/u:0]
    6 root         0 SW   [rcu_kthread]
    7 root         0 SW<  [khelper]
    8 root         0 SW   [kworker/u:1]
  119 root         0 SW   [sync_supers]
  121 root         0 SW   [bdi-default]
  122 root         0 SW<  [kintegrityd]
  124 root         0 SW<  [kblockd]
  137 root         0 SW   [khubd]
  148 root         0 SW<  [cfg80211]
  149 root         0 SW   [kworker/0:1]
  231 root         0 SW<  [rpciod]
  234 root         0 SW   [kswapd0]
  288 root         0 SW   [fsnotify_mark]
  291 root         0 SW<  [nfsiod]
  302 root         0 SW<  [crypto]
  372 root         0 SW   [mtdblock0]
  377 root         0 SW   [mtdblock1]
  382 root         0 SW   [mtdblock2]
  387 root         0 SW   [mtdblock3]
  392 root         0 SW   [mtdblock4]
  397 root         0 SW   [mtdblock5]
  431 root         0 SW<  [wusbd]
  440 root         0 SW<  [kpsmoused]
  465 root       872 S <  udevd --daemon
  471 root         0 SWN  [jffs2_gcd_mtd5]
  703 root      1552 S    /utils/upgraded
  711 root      2440 S    searchIp
  713 root      9536 S    dvrHelper /lib/modules /usr/bin/Sofia 127.0.0.1 9578 1
  714 root      1244 S    telnetd
  728 root      482m S    /usr/bin/Sofia
  836 root      1264 S    -sh
  853 root      1240 R    ps

# ls /bin
BurnHWID   cat        env        hush       ln         netinit    searchIp   true
[          chmod      false      ip         login      netstat    sed        tty
[[         cp         fgrep      ipaddr     ls         ping       sh         udevd
armbenv    date       free       iplink     mkdir      pppd       sleep      udevinfo
arping     dd         grep       iproute    mkfifo     pppoe      sync       udevstart
ash        dvrHelper  himc       iprule     mknod      ps         sysinit    udpsvd
awk        dvrbox     himd       iptunnel   mount      pwd        test       umount
btools     echo       himd.l     kill       msh        rm         top        upgraded
busybox    egrep      himm       killall    mv         rmdir      touch      xargs

# armbenv -r
LibCrypto : g_cryptotype = 2
**********************************************************************
|                      SYSTEM INFO
|                 ID:           8043420004048425
|       product type:           50H10L
|            product:           HI3518E_50H10L_S39
|      video channel:           1
|      audio channel:           1
|           alarm in:           1
|          alarm out:           1
| forward video chip:           OV9712
|           DSP chip:           HI3518E
|  analog audio mode:           voice codec
|           talkback:           voice codec
|    back video chip:           no chip
|    store interface:           SDIO
|    matrix surpport:           No
| wireless interface:           USB
|    hardware encode:           encode chip
|   hardware version:           1
|    video_interface:           BNC
|      net_interface:           Ethernet
|  hardware info len:           8
**********************************************************************
LIBDVR: Complied at Jun 12 2015 19:34:48 SVN:1028
bootdelay = 1
baudrate = 115200
serverip = 192.168.1.107
ipaddr = 192.168.1.93
netmask = 255.255.255.0
ethaddr = 00:12:13:11:8e:e0
HWID = 8043420004048425
ob_start = 0
ob_data = 82

# cat /etc/init.d/rcS
#! /bin/sh

/etc/init.d/dnode

udevd --daemon
udevstart

mount -t squashfs /dev/mtdblock2 /usr
mount -t squashfs /dev/mtdblock3 /mnt/web
mount -t squashfs /dev/mtdblock4 /mnt/custom
mount -t jffs2 /dev/mtdblock5 /mnt/mtd

mount -t ramfs  /dev/mem        /var/
mkdir -p /var/tmp
mount -t ramfs  /dev/mem2       /utils
mount -t usbfs usbfs /proc/bus/usb/

mkdir -p /mnt/mtd/Config /mnt/mtd/Log /mnt/mtd/Config/ppp /mnt/mtd/Config/Json
if [ -f /mnt/mtd/Config/ppp/3gdigal ]; then
        chmod 777 /mnt/mtd/Config/ppp/3gdigal
fi

/usr/etc/loadmod
netinit
cp /bin/upgraded /utils/ -f
/utils/upgraded &
ifconfig eth2 down
telnetd &
sysinit &
searchIp &
#wlandaemon &
#route_switch &

/bin/pppd pty /etc/ppp/pppoe-start file /etc/ppp/pppoe-options &
if [ -f /mnt/custom/extapp.sh ];then
        /mnt/custom/extapp.sh &
fi
dvrHelper /lib/modules /usr/bin/Sofia 127.0.0.1 9578 1 &

Hi, I have a camera wifi with the hi3518E chip. the IPC-BT511SW-1.3
The FTP service was not working so I tried to update the firmware with some of the list given in the previous message.
But since i update it, The Wifi connection doesn't work anymore :(
the camera is always working, i see the picture but olnly whent it is connected with ethernet cable.

I have a doubt on something : when i saw the version on the web interface I think i have seen
4.0.R12.00006510
but when i connected with telnet, i saw 53H13 in product type:

is it possible ? how can i recover wifi connection ? is there any old firmware ? does anyone had the same pb ?

thank you very much

Hi guys!
Do you know does this camera support PoE (Power over Ethernet)?

I've wrote something about the Hikam S6 (based on HI3518E):

https://gist.github.com/JanLoebel/b5dafcda555323785d32ccb7d643dbcd

Hello i need help with my ipcam.
The Protocoll type is N1 what ever that means.
i cant connect via telnet. the port 23 is open but no username or password.

How can i access the cam?
and can i flash an diffrend software on it to maybe use onvif?

I finally found it
Telnet:
Usernam: root
Password: j1/_7sxw

This is for Sannce Ip Cam

Hey guys, anyone has any idea how to pan/tilt those cameras using POST/GET calls?

@kxn25 did you find the credentials to connect via tenet?

No it needs user/password i dont have.
Is there a way to re Flash there a System on?

About mentioned solution (http://...) reads low resolution channel only.
Try to use ffmpeg to capture still image from the video stream:
ffmpeg -f rtsp -rtsp_transport tcp -y -i "rtsp://xxx.xxx.xxx.xxx:port/user=admin&password=yourPass&channel=1&stream=0.sdp?real_stream" -f image2 -vframes 1 -vsync 2 -pix_fmt yuvj420p "/path/to/the/picture/photo_$(date +%Y.%m.%d_%H:%M:%S).jpg"

I just want to throw this on the web somewhere, and part of my search led me here, so this seems relevant.

I've been tearing my hair out for the last three days trying to get reliable images off one of the cheaper hisilicon based cameras I have and it took a lot of faffing about to get here, so I'm hoping this can help someone else. (I've used the above line on all my other cameras and it has worked fine).

Long story short, could not get a 100% reliable frame grab off one of the cameras I have. I had to specify -vsync 2 on both the output and input. I then had to specify only iframes on the output.

The line I'm using looks like this:
ffmpeg -y -rtsp_transport tcp -vsync 2 -i rtsp://192.168.178.106:554/user=admin_password=PASSWORD_channel=1_stream=0.sdp?real_stream -vframes 1 -vf "select='eq(pict_type,PICT_TYPE_I)'" -vsync 2 /home/pi/node-red-static/grab1.jpg

I've set the encoder on the camera to use an iframe every second, so it doesn't hold up the command too much.

Hope this helps someone else!

@kxn25 can you tell me the exact rtsp url for your camera, url which gives you highest (1280*960) resolution stream and also make of your camera, photos of the camera also if possible. I will dump the firmware and tell you the telnet password if you want.

@kxn25 can you tell me the exact rtsp url for your camera, url which gives you highest (1280*960) resolution stream and also make of your camera, photos of the camera also if possible. I will dump the firmware and tell you the telnet password if you want.

I found the Password. But what can i do with that.
I would rather hack the DVR Recorder in Order to prepair it for my Raspberry Pi to get the Image on there. The DVR is running on a seperate IP Range.

Password Hash:

root:ABgia2Z.lfFhA:0:0::/root:/bin/sh

Telnet:
Usernam: root
Password: j1/_7sxw

U-Boot

#printenv
bootdelay=1
baudrate=115200
ethaddr=00:9A:9B:9C:9D:9E
ipaddr=192.168.1.10
serverip=192.168.1.40
netmask=255.255.255.0
bootargs=mem=40M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:192K(uboot),64K(env),64K(user),384K(conf),1920K(kernel), 4032K(rootfs),1536K(custom) ramdisk_size=4032
bootcmd=sf probe 0;sf read 0x82230000 0xB0000 0x1E0000;sf read 0x82410000 0x290000 0x3F0000;bootm 0x82230000 0x82410000;
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Oct 12 2015 - 21:54:32)

Environment size: 515/65532 bytes

uname -a

Linux (none) 3.4.35 #2 Tue Aug 23 18:55:44 SGT 2016 armv5tejl GNU/Linux

free -m

         total       used       free     shared    buffers     cached

Mem: 35336 34184 1152 0 1784 8408
-/+ buffers/cache: 23992 11344
Swap: 0 0 0

cat /proc/cpuinfo

Processor : ARM926EJ-S rev 5 (v5l)
BogoMIPS : 269.10
Features : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant : 0x0
CPU part : 0x926
CPU revision : 5

Hardware : hi3518ev200
Revision : 0000
Serial : 0000000000000000

@kxn25 Thanks for this, this password works for my cameras. I made the mistake of updating the s/w version of the cameras from the DVR and it shut off the RTSP port on 2 of them, (they are running /usr/bin/anyka_ipc on 80 and 554), and I have another that looks identical but also has RTSP turned off but runs /usr/share/ipcam/app on 80. I'll be trying to figure out how to either get rtsp back on or run some other software on these.

@rtaft thank you that would be great.
I am also working on trying to figure out how to ohne the rstp Port and or Port 554.
On my cam's only port 23 and 80 are open.

@kxn25 Looks like the filesystem is read only. I have 4 391806s and 1 57801024 (which is what you have). I was able to find an older firmware download for the 391806, it may not be old enough but I will test it out at some point. I was able to unpack it with 7zip and mount the contents with squashfs. In theory I should be able to make changes to it and repack it, then update the firmware from the DVR and USB. The main issue I'm having is transferring files from the device, tftp always times out (on the 391806 anyway), I was hoping to snag the old anyka_ipc binary from one cam and move it to another. I didn't spend too much time on it though, was just tinkering this morning. In theory, the DVR reaches out to the internet to download the latest firmware, could find out where it's getting it from and see what versions are available, at the very least get a copy of the latest 57801024 image to play with. The alternative is to reverse engineer the N1 protocol. I just need to find some free time to play with it.

@rtaft
Have a lool at that link:
[(http://mark4h.blogspot.com/2017/07/hi3518-camera-module-part-1-replacing.html)]

I have connected the Cam on the TX0 and RX0 pins to my Computer via a TFDI Adapter, with Arduino IDE i could see the Serial happenings.
But i am not so cloued up what to do with that.
As far as i found out the only way to change things is to download the files with tftp, change an upload again?!
The other thing is the Hilinux System i have no idea but as you syed it is read only.

the N1 protocol

Is it possible to change that into ONVIF?
And do you know the diffrence??? iam so confiused with all these Protocolls and types ????

@rtaft
I have found this page
http://www.openipcam.com/files/

But cant do anything with it, there are scripts and so on.

Have you tryed on Telnet open the busybox command?
there are also some things you can do, but it´s to much for me.
I cant find a editor like "vi" where i can open or view files.

https://github.com/667bdrm/sofiactl will cover anything not covered by this.
Info:https://web.archive.org/web/20151002202129/http://www.ipcamtalk.com/showthread.php?1812-Review-TOP-201-Super-Mini-720P-HD-IP-Cam-(The-Cheapest-IP-Cam-So-Far-!!)&p=19789&viewfull=1

Hello I have a Chinese IP camera, when it was updated there was a power cut since it requires more: /, it is based on a HI3518E V200.
When starting the camera I read what is happening via the debug port and at the end I get this error

List of all partitions:
1f00 256 mtdblock0 (driver?)
1f01 1600 mtdblock1 (driver?)
1f02 5824 mtdblock2 (driver?)
1f03 512 mtdblock3 (driver?)
1f04 8192 mtdblock4 (driver?)
No filesystem could mount root, tried: squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

Anyone have any idea how to fix the problem? I looked for a new firmware but impossible to find it

thanks in advance.

@kxn25 With the death of Flash I finally started looking into these cheap cameras. The N1 protocol appears to just be an HTTP wrapper for RTSP. In my case http://192.168.1.XXX:80/livestream/11?action=play&media=video_audio_data for all 4 cameras responds with an HTTP header followed by an RTSP header and the streaming content. Using wget to store the output to file, and playing the file with ffplay works fine, I haven't figured out how to play the stream directly in ffplay but it gives me something to work with.

@rtaft i tried this a while ago, but I always get a 401.

@fumpi1988 The wget command looks like so wget --auth-no-challenge --user='admin' --password='thepassword' http://192.168.1.XXX/livestream/11?action=play&media=video_audio_data. I had manually generated the auth header before, but I figured out I was just missing the --auth-no-challenge Just remember its downloading in the background, you need to kill it manually.

I've tried a bit using the following:
wget --auth-no-challenge --user='admin' --password='' http://192.168.2.99/livestream/11?action=play

but this gives an error that there isn't any data.

If I use the param &media=video_audio_data behind the adress, there seems to be some output, at least wget creates a file, but this file is only 4kb.

What am I doing wrong?

@fumpi1988 I accidentally left off that param the second time, i just fixed that. It actually creates 2 files, wget.log and 11?action=play, with the 11?action=play having the video. Hopefully you just overlooked the second file.

I haven't put together a wrapper to play the video directly yet. I found this by plugging my DVR directly to my laptop, and shared the network via the WiFi on the laptop with it. Then I used Wireshark to view the HTTP data.

rstp link works by default on following PTZ device .

codec: h264 Model: XM530_R80X20-PQL-8M Firmware: V5.00.R02

(i changed the default pw for admin access)
Thank you.

This camera can be flashed with OpenIPC: https://openipc.org/cameras/vendors/hisilicon/socs/hi3518ev100
I tried it a few days ago, you need to open it up and solder three wires (RX,TX,GND) to UART and setup a TFTP-server at your PC.
Install process is not that hard actually as the OpenIPC site provides excellent instructions.

However i didn't find any options to set exposure/lighting for image quality in the OpenIPC firmware. As i have the camera looking through the glass of my frontdoor, the image quality was bad (over-exposed, bright white spot). I reverted back to stock firmware as i had set the exposure correctly using some vague Chinese software tool (ActiveX plugin or so?) years ago.

I use it in Node-RED to send me a snapshot when the doorbell is rang. With the original firmware the url is http://ipofdevice/webcapture.jpg?command=snap&channel=0

I'm looking for a way to install ngrok, could anyone?

This camera can be flashed with OpenIPC: https://openipc.org/cameras/vendors/hisilicon/socs/hi3518ev100 I tried it a few days ago, you need to open it up and solder three wires (RX,TX,GND) to UART and setup a TFTP-server at your PC. Install process is not that hard actually as the OpenIPC site provides excellent instructions.

However i didn't find any options to set exposure/lighting for image quality in the OpenIPC firmware. As i have the camera looking through the glass of my frontdoor, the image quality was bad (over-exposed, bright white spot). I reverted back to stock firmware as i had set the exposure correctly using some vague Chinese software tool (ActiveX plugin or so?) years ago.

I use it in Node-RED to send me a snapshot when the doorbell is rang. With the original firmware the url is http://ipofdevice/webcapture.jpg?command=snap&channel=0

What old software did you use? I am looking to get PQTools. I wish openipc will let you do ISP Tuning.