Skip to content

Instantly share code, notes, and snippets.

@gabonator

gabonator/camera.md

Created June 4, 2016 13:48
Show Gist options
  • Save gabonator/3d2bc36e9eb62c52742d45113126c1ba to your computer and use it in GitHub Desktop.
Save gabonator/3d2bc36e9eb62c52742d45113126c1ba to your computer and use it in GitHub Desktop.
Download ZIP
Cheap chinese IP camera with H264 encoding based on Hisilicon 8M (Hi3518E) chip
Raw
camera.md

Cheap chinese IP camera with H264 encoding based on Hisilicon 8M (Hi3518E) chip

Video stream url for VLC/DVR:

  • rtsp://192.168.1.93:554/user=admin&password=&channel=&stream=.sdp?real_stream--rtp-caching=100

Telnet access

  • telnet 192.168.1.10 23
  • Localhost login: root
  • Password: xmhdipc

Configuration placed at this path:

  • /mnt/mtd/Config

To change static IP Address:

  • armbenv
  • netinit eth0 192.168.1.93

For enabling DHCP

  • echo 1 > mnt/mtd/Config/dhcp.cfg

Interesting links:

# cat /proc/cpuinfo
Processor       : ARM926EJ-S rev 5 (v5l)
BogoMIPS        : 218.72
Features        : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant     : 0x0
CPU part        : 0x926
CPU revision    : 5

Hardware        : hi3518
Revision        : 0000
Serial          : 0000000000000000

# ps
  PID USER       VSZ STAT COMMAND
    1 root      1240 S    init
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 SW   [kworker/0:0]
    5 root         0 SW   [kworker/u:0]
    6 root         0 SW   [rcu_kthread]
    7 root         0 SW<  [khelper]
    8 root         0 SW   [kworker/u:1]
  119 root         0 SW   [sync_supers]
  121 root         0 SW   [bdi-default]
  122 root         0 SW<  [kintegrityd]
  124 root         0 SW<  [kblockd]
  137 root         0 SW   [khubd]
  148 root         0 SW<  [cfg80211]
  149 root         0 SW   [kworker/0:1]
  231 root         0 SW<  [rpciod]
  234 root         0 SW   [kswapd0]
  288 root         0 SW   [fsnotify_mark]
  291 root         0 SW<  [nfsiod]
  302 root         0 SW<  [crypto]
  372 root         0 SW   [mtdblock0]
  377 root         0 SW   [mtdblock1]
  382 root         0 SW   [mtdblock2]
  387 root         0 SW   [mtdblock3]
  392 root         0 SW   [mtdblock4]
  397 root         0 SW   [mtdblock5]
  431 root         0 SW<  [wusbd]
  440 root         0 SW<  [kpsmoused]
  465 root       872 S <  udevd --daemon
  471 root         0 SWN  [jffs2_gcd_mtd5]
  703 root      1552 S    /utils/upgraded
  711 root      2440 S    searchIp
  713 root      9536 S    dvrHelper /lib/modules /usr/bin/Sofia 127.0.0.1 9578 1
  714 root      1244 S    telnetd
  728 root      482m S    /usr/bin/Sofia
  836 root      1264 S    -sh
  853 root      1240 R    ps

# ls /bin
BurnHWID   cat        env        hush       ln         netinit    searchIp   true
[          chmod      false      ip         login      netstat    sed        tty
[[         cp         fgrep      ipaddr     ls         ping       sh         udevd
armbenv    date       free       iplink     mkdir      pppd       sleep      udevinfo
arping     dd         grep       iproute    mkfifo     pppoe      sync       udevstart
ash        dvrHelper  himc       iprule     mknod      ps         sysinit    udpsvd
awk        dvrbox     himd       iptunnel   mount      pwd        test       umount
btools     echo       himd.l     kill       msh        rm         top        upgraded
busybox    egrep      himm       killall    mv         rmdir      touch      xargs

# armbenv -r
LibCrypto : g_cryptotype = 2
**********************************************************************
|                      SYSTEM INFO
|                 ID:           8043420004048425
|       product type:           50H10L
|            product:           HI3518E_50H10L_S39
|      video channel:           1
|      audio channel:           1
|           alarm in:           1
|          alarm out:           1
| forward video chip:           OV9712
|           DSP chip:           HI3518E
|  analog audio mode:           voice codec
|           talkback:           voice codec
|    back video chip:           no chip
|    store interface:           SDIO
|    matrix surpport:           No
| wireless interface:           USB
|    hardware encode:           encode chip
|   hardware version:           1
|    video_interface:           BNC
|      net_interface:           Ethernet
|  hardware info len:           8
**********************************************************************
LIBDVR: Complied at Jun 12 2015 19:34:48 SVN:1028
bootdelay = 1
baudrate = 115200
serverip = 192.168.1.107
ipaddr = 192.168.1.93
netmask = 255.255.255.0
ethaddr = 00:12:13:11:8e:e0
HWID = 8043420004048425
ob_start = 0
ob_data = 82

# cat /etc/init.d/rcS
#! /bin/sh

/etc/init.d/dnode

udevd --daemon
udevstart

mount -t squashfs /dev/mtdblock2 /usr
mount -t squashfs /dev/mtdblock3 /mnt/web
mount -t squashfs /dev/mtdblock4 /mnt/custom
mount -t jffs2 /dev/mtdblock5 /mnt/mtd

mount -t ramfs  /dev/mem        /var/
mkdir -p /var/tmp
mount -t ramfs  /dev/mem2       /utils
mount -t usbfs usbfs /proc/bus/usb/

mkdir -p /mnt/mtd/Config /mnt/mtd/Log /mnt/mtd/Config/ppp /mnt/mtd/Config/Json
if [ -f /mnt/mtd/Config/ppp/3gdigal ]; then
        chmod 777 /mnt/mtd/Config/ppp/3gdigal
fi

/usr/etc/loadmod
netinit
cp /bin/upgraded /utils/ -f
/utils/upgraded &
ifconfig eth2 down
telnetd &
sysinit &
searchIp &
#wlandaemon &
#route_switch &

/bin/pppd pty /etc/ppp/pppoe-start file /etc/ppp/pppoe-options &
if [ -f /mnt/custom/extapp.sh ];then
        /mnt/custom/extapp.sh &
fi
dvrHelper /lib/modules /usr/bin/Sofia 127.0.0.1 9578 1 &
@kxn25
Copy link

kxn25 commented Jun 1, 2020 •
edited
Loading

@kxn25 can you tell me the exact rtsp url for your camera, url which gives you highest (1280*960) resolution stream and also make of your camera, photos of the camera also if possible. I will dump the firmware and tell you the telnet password if you want.

I found the Password. But what can i do with that.
I would rather hack the DVR Recorder in Order to prepair it for my Raspberry Pi to get the Image on there. The DVR is running on a seperate IP Range.

Password Hash:

root:ABgia2Z.lfFhA:0:0::/root:/bin/sh

Telnet:
Usernam: root
Password: j1/_7sxw

U-Boot

#printenv
bootdelay=1
baudrate=115200
ethaddr=00:9A:9B:9C:9D:9E
ipaddr=192.168.1.10
serverip=192.168.1.40
netmask=255.255.255.0
bootargs=mem=40M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:192K(uboot),64K(env),64K(user),384K(conf),1920K(kernel), 4032K(rootfs),1536K(custom) ramdisk_size=4032
bootcmd=sf probe 0;sf read 0x82230000 0xB0000 0x1E0000;sf read 0x82410000 0x290000 0x3F0000;bootm 0x82230000 0x82410000;
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Oct 12 2015 - 21:54:32)

Environment size: 515/65532 bytes

uname -a

Linux (none) 3.4.35 #2 Tue Aug 23 18:55:44 SGT 2016 armv5tejl GNU/Linux

free -m

         total       used       free     shared    buffers     cached

Mem: 35336 34184 1152 0 1784 8408
-/+ buffers/cache: 23992 11344
Swap: 0 0 0

cat /proc/cpuinfo

Processor : ARM926EJ-S rev 5 (v5l)
BogoMIPS : 269.10
Features : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant : 0x0
CPU part : 0x926
CPU revision : 5

Hardware : hi3518ev200
Revision : 0000
Serial : 0000000000000000

IPC

@rtaft
Copy link

rtaft commented Sep 16, 2020

@kxn25 Thanks for this, this password works for my cameras. I made the mistake of updating the s/w version of the cameras from the DVR and it shut off the RTSP port on 2 of them, (they are running /usr/bin/anyka_ipc on 80 and 554), and I have another that looks identical but also has RTSP turned off but runs /usr/share/ipcam/app on 80. I'll be trying to figure out how to either get rtsp back on or run some other software on these.

@kxn25
Copy link

kxn25 commented Sep 17, 2020

@rtaft thank you that would be great.
I am also working on trying to figure out how to ohne the rstp Port and or Port 554.
On my cam's only port 23 and 80 are open.

@rtaft
Copy link

rtaft commented Sep 17, 2020

@kxn25 Looks like the filesystem is read only. I have 4 391806s and 1 57801024 (which is what you have). I was able to find an older firmware download for the 391806, it may not be old enough but I will test it out at some point. I was able to unpack it with 7zip and mount the contents with squashfs. In theory I should be able to make changes to it and repack it, then update the firmware from the DVR and USB. The main issue I'm having is transferring files from the device, tftp always times out (on the 391806 anyway), I was hoping to snag the old anyka_ipc binary from one cam and move it to another. I didn't spend too much time on it though, was just tinkering this morning. In theory, the DVR reaches out to the internet to download the latest firmware, could find out where it's getting it from and see what versions are available, at the very least get a copy of the latest 57801024 image to play with. The alternative is to reverse engineer the N1 protocol. I just need to find some free time to play with it.

@kxn25
Copy link

kxn25 commented Sep 18, 2020 •
edited
Loading

@rtaft
Have a lool at that link:
[(http://mark4h.blogspot.com/2017/07/hi3518-camera-module-part-1-replacing.html)]

I have connected the Cam on the TX0 and RX0 pins to my Computer via a TFDI Adapter, with Arduino IDE i could see the Serial happenings.
But i am not so cloued up what to do with that.
As far as i found out the only way to change things is to download the files with tftp, change an upload again?!
The other thing is the Hilinux System i have no idea but as you syed it is read only.

the N1 protocol

Is it possible to change that into ONVIF?
And do you know the diffrence??? iam so confiused with all these Protocolls and types ????

@kxn25
Copy link

kxn25 commented Sep 20, 2020

@rtaft
I have found this page
http://www.openipcam.com/files/

But cant do anything with it, there are scripts and so on.

Have you tryed on Telnet open the busybox command?
there are also some things you can do, but it´s to much for me.
I cant find a editor like "vi" where i can open or view files.

@ilikenwf
Copy link

https://github.com/667bdrm/sofiactl will cover anything not covered by this.
Info:https://web.archive.org/web/20151002202129/http://www.ipcamtalk.com/showthread.php?1812-Review-TOP-201-Super-Mini-720P-HD-IP-Cam-(The-Cheapest-IP-Cam-So-Far-!!)&p=19789&viewfull=1

@roma6868
Copy link

Hello I have a Chinese IP camera, when it was updated there was a power cut since it requires more: /, it is based on a HI3518E V200.
When starting the camera I read what is happening via the debug port and at the end I get this error

List of all partitions:
1f00 256 mtdblock0 (driver?)
1f01 1600 mtdblock1 (driver?)
1f02 5824 mtdblock2 (driver?)
1f03 512 mtdblock3 (driver?)
1f04 8192 mtdblock4 (driver?)
No filesystem could mount root, tried: squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

Anyone have any idea how to fix the problem? I looked for a new firmware but impossible to find it

thanks in advance.

@rtaft
Copy link

rtaft commented Jan 22, 2021 •
edited
Loading

@kxn25 With the death of Flash I finally started looking into these cheap cameras. The N1 protocol appears to just be an HTTP wrapper for RTSP. In my case http://192.168.1.XXX:80/livestream/11?action=play&media=video_audio_data for all 4 cameras responds with an HTTP header followed by an RTSP header and the streaming content. Using wget to store the output to file, and playing the file with ffplay works fine, I haven't figured out how to play the stream directly in ffplay but it gives me something to work with.

@fumpi1988
Copy link

@rtaft i tried this a while ago, but I always get a 401.

@rtaft
Copy link

rtaft commented Jan 26, 2021 •
edited
Loading

@fumpi1988 The wget command looks like so wget --auth-no-challenge --user='admin' --password='thepassword' http://192.168.1.XXX/livestream/11?action=play&media=video_audio_data. I had manually generated the auth header before, but I figured out I was just missing the --auth-no-challenge Just remember its downloading in the background, you need to kill it manually.

@fumpi1988
Copy link

I've tried a bit using the following:
wget --auth-no-challenge --user='admin' --password='' http://192.168.2.99/livestream/11?action=play

but this gives an error that there isn't any data.

If I use the param &media=video_audio_data behind the adress, there seems to be some output, at least wget creates a file, but this file is only 4kb.

What am I doing wrong?

@rtaft
Copy link

rtaft commented Feb 8, 2021

@fumpi1988 I accidentally left off that param the second time, i just fixed that. It actually creates 2 files, wget.log and 11?action=play, with the 11?action=play having the video. Hopefully you just overlooked the second file.

I haven't put together a wrapper to play the video directly yet. I found this by plugging my DVR directly to my laptop, and shared the network via the WiFi on the laptop with it. Then I used Wireshark to view the HTTP data.

@AysadKozanoglu
Copy link

AysadKozanoglu commented Jul 21, 2021 •
edited
Loading

rstp link works by default on following PTZ device .

codec: h264 Model: XM530_R80X20-PQL-8M Firmware: V5.00.R02

(i changed the default pw for admin access)
Thank you.

@ThinkPadNL
Copy link

ThinkPadNL commented Jun 13, 2023 •
edited
Loading

This camera can be flashed with OpenIPC: https://openipc.org/cameras/vendors/hisilicon/socs/hi3518ev100
I tried it a few days ago, you need to open it up and solder three wires (RX,TX,GND) to UART and setup a TFTP-server at your PC.
Install process is not that hard actually as the OpenIPC site provides excellent instructions.

However i didn't find any options to set exposure/lighting for image quality in the OpenIPC firmware. As i have the camera looking through the glass of my frontdoor, the image quality was bad (over-exposed, bright white spot). I reverted back to stock firmware as i had set the exposure correctly using some vague Chinese software tool (ActiveX plugin or so?) years ago.

I use it in Node-RED to send me a snapshot when the doorbell is rang. With the original firmware the url is http://ipofdevice/webcapture.jpg?command=snap&channel=0

@robot00f
Copy link

I'm looking for a way to install ngrok, could anyone?

@dhruvilshah30
Copy link

This camera can be flashed with OpenIPC: https://openipc.org/cameras/vendors/hisilicon/socs/hi3518ev100 I tried it a few days ago, you need to open it up and solder three wires (RX,TX,GND) to UART and setup a TFTP-server at your PC. Install process is not that hard actually as the OpenIPC site provides excellent instructions.

However i didn't find any options to set exposure/lighting for image quality in the OpenIPC firmware. As i have the camera looking through the glass of my frontdoor, the image quality was bad (over-exposed, bright white spot). I reverted back to stock firmware as i had set the exposure correctly using some vague Chinese software tool (ActiveX plugin or so?) years ago.

I use it in Node-RED to send me a snapshot when the doorbell is rang. With the original firmware the url is http://ipofdevice/webcapture.jpg?command=snap&channel=0

What old software did you use? I am looking to get PQTools. I wish openipc will let you do ISP Tuning.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment