Live streaming

[miguelalvagarcia]

Hi!

I’m a developer and also user for your blink products. Actually I have several cameras and I wanted to make automatizations and need to connect trhough your API.

So I have this call: (prde for Europe) https://rest.prde.immedia-semi.com/api/v2/network/{{networkID}}/camera/{{cameraID}}/liveview

With this object:

stdClass Object ( [id] => 6327720 [created_at] => 2017-07-17T14:04:49+00:00 [updated_at] => 2017-07-17T14:04:49+00:00 [execute_time] => 2017-07-17T14:04:49+00:00 [command] => lv_relay [state_stage] => rest [stage_rest] => 2017-07-17T14:04:49+00:00 [stage_cs_db] => [stage_cs_sent] => [stage_sm] => [stage_dev] => [stage_is] => [stage_lv] => [stage_vs] => [state_condition] => new [sm_ack] => [lfr_ack] => [sequence] => [attempts] => 0 [transaction] => Wm89T_5wiHEoNAkL [player_transaction] => A475bm7_oQn86UD3 [server] => rtsps://lv-app.prde.immedia-semi.com:443/Wm89T_5wiHEoNAkL [duration] => 300 [by_whom] => [diagnostic] => [debug] => [parent_command_id] => [camera_id] => [siren_id] => [firmware_id] => [network_id] => [account_id] => [sync_module_id] => [continue_interval] => 30 [camera_name] => camara 1 )

In the server field., (“rtsps://lv-app.prde.immedia-semi.com:443/Wm89T_5wiHEoNAkL”) there is some URLs but I can’t open it trough VLC or any related software.

I know this is a strange request but any help would be appreciated.

Regards.

[duangenquan]

Have you got any luck to play the liveview?

[miguelalvagarcia]

No, I have not gotten it to work in the vlc or in other software. I do not need to make it work.

[duangenquan]

Thanks for your reply. Liveview is nice to have for me too. It will be cooler if liveview can be shows as in blink's app.

[miguelalvagarcia]

That would be great. The problem is that I find it a little complicated to create a player for rtsps: // protocol. What I was trying to do was a web application for desktop, to avoid having to use the mobile app, and to be able to see it in full screen.

I downloaded the android app and pulled the code from the app to see the calls from the API, so I saw that it was also "liveview" that I did not know it and when I made the call it returned just in the server parameter the url "rtsps://lv-app.prde.immedia-semi.com:443/Wm89T_5wiHEoNAkL" but I could not play it on desktop. I got stuck and left it on standby.

It would be great to be able to make it work, do you have any ideas?

[duangenquan]

I did a bunch of experiments too, but not success until now. If it is just rtsp url, it will be much easier. but rtsps is rtsp with ssl, and if we do not have the ssl certifications (such as ca-chain.cert.pem, client.cert.pem, client.key.pem), we could not get the data.

[miguelalvagarcia]

And we could get the certificates out of the app, right?

[duangenquan]

I hope so. I am trying to find those certifications. Or, is there any possibilities to check files in iOS/android app?

[miguelalvagarcia]

I do not see any .pem in the data that I have taken from the android app I only see two files and CERT.RSA CERT.SF

[duangenquan]

I am using iPhone and could not get those files. If possible, you can try to set up rtsp over ssl.

Or, we need to guess how to have a url like this: rtsps://myuser:mypass@lv-app.prde.immedia-semi.com:443/Wm89T_5wiHEoNAkL

[miguelalvagarcia]

If I also use iphone, but I downloaded the android app on desktop and decompile it, to see the code and see all the files.

I think you have to send the access key to the header of the request

[jasmas]

Has anyone been able to successfully access the rtsps url? I suspect this is using the same AUTH_TOKEN header? Does anyone know the video and audio codec or characteristics of the stream & authentication logistics? What is the best way to snoop this? On Android where SSL pinning can be bypassed? Can anyone get me decrypted headers of the connections kicked off when you access a live stream from the client?

[jasmas]

@miguelalvagarcia Could you let us know your method for decompiling the Android app or get me the code? I suspect it is passing along the AUTH_TOKEN header used in the rest of the API. SSL is only authenticating the server. I doubt we care about the certs.

[miguelalvagarcia]

@jasmas Hello, I believe the same thing that is sending the AUTH_TOKEN in the headers, but I have not managed to make it work, nor reproduce anything there is something that happens to me in the source code that I have of the apk, it is not the complete code, and I can not see That part of the RSTP, the only thing I discovered are the calls to the webservice. To decompile the apk you just have to use ApkTool there are several guides https://forum.xda-developers.com/showthread.php?t=2213985

[miguelalvagarcia]

Hello, @jasmas @duangenquan @MattTW Has anyone been able to play the videos live with the "rtsps" protocol? have you gotten to send AUTH_TOKEN in the headers? rtsps://lv-app.prde.immedia-semi.com:443/Wm89T_5wiHEoNAkL

[duangenquan]

@miguelalvagarcia , thanks for your asking.

My trials (all were failed):

• add token in the header
• manipulate urls with different protocols / ports / sections etc.
• try to request from postman, play from vlc/ffmpeg etc.

There should be some other setting or changes. The livestream in the blink app works fine though. :)

[init4]

Does this API still work for people?

I'm trying to access:

https://rest.prau.immedia-semi.com/api/v2/network/1234/camera/1234/liveview

Without much success (obviously substituting 1234 for real integers for my account).

I just get a 404 for any variation I can think of.

[amoldeshpande]

try

https://rest.[region].immedia-semi.com/api/v3/networks/[nn]/cameras/[uvwx]/liveview

replace your appropriate numbers and regions. Note the v3 and "cameras" different from your URL. This still works for me to get the RTSP url.

From my inspection of the decompiled apk, I think they're using a custom extension to the RTSP protocol where not all the command sequences are followed, so it won't work with an off-the-shelf RTSP client.

They seem to also be certificate pinning on the client now, so short of recompiling the apk without that support I cannot capture/decrypt the live RTSP request from mobile to be sure. Don't have the tools to do that myself, but if someone else can, feel free to send me a capture from WinPCap (or tcpdump or whatever your sniffer of choice is) and I'll delve deeper into it.