Open jilleb opened 2 years ago
guino
commented
2 years ago The telnet url says it works but never does because there’s no telnet binary in the firmware (had tried it way back). The others can probably go in the wiki.
EDIT: @jilleb I've created a page in the WIKI which links to this issue with the information posted.
jilleb
commented
2 years ago 👍🏼 I have some more to add, I'll put them in the first post. Currently recovering my device, after formatting it by accident (one of the URLs does that 😉 ) Maybe I can cook up a simple portal that holds all URLs, with a description so users can access them easily.
almirus
commented
2 years ago /proc/self/root/home/cfg/tuya_config.json
"version": 1, "sleep_mode": 0, "alarm_fun_onoff": 0, "alarm_fun_sensitivity": 1, "alarm_fun_mode_switch": 0, "alarm_fun_time_start": 0, "alarm_fun_time_end": 0, "flip_onoff": 0, "light_onoff": 1, "night_mode": 1, "sound_detect_onoff": 0, "sound_detect_sensitivity": 1, "watermark_onoff": 1, "event_record_time": 60, "enable_event_record": 2, "record_enable": 1, "motion_trace": 1, "motion_area_switch": 0, "motion_area": "", "motion_tracking": 0, "cry_detection_switch": 0, "humanoid_filter": 0, "loudspeaker_vol_pct": 100, "onvif_enable": 0, "onvif_pwd": "admin" }
almirus
commented
2 years ago /proc/mounts
rootfs / rootfs rw 0 0 proc /proc proc rw,relatime 0 0 sysfs /sys sysfs rw,relatime 0 0 tmpfs /dev tmpfs rw,relatime 0 0 devpts /dev/pts devpts rw,relatime,mode=600,ptmxmode=000 0 0 /dev/mtdblock6 /home/cfg jffs2 rw,relatime 0 0 /dev/mmcblk0p1 /mnt/mmc01 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,usefree,errors=continue 0 0
youribonnaffe
commented
2 years ago Some URLs from the CloudEdge application
127.0.0.1/devices/charm/pair
127.0.0.1/devices/charm/unpair
127.0.0.1/devices/firmware_upgrade
127.0.0.1/devices/led/all
127.0.0.1/devices/music/id/%s/start
127.0.0.1/devices/music/play/
127.0.0.1/devices/music/play/next
127.0.0.1/devices/music/play/pause
127.0.0.1/devices/music/play/prev
127.0.0.1/devices/music/play/state
127.0.0.1/devices/network
127.0.0.1/devices/reboot
127.0.0.1/devices/record/search_by_day
127.0.0.1/devices/sd_event
127.0.0.1/devices/settings
127.0.0.1/devices/storage
127.0.0.1/devices/temp_humidity/value
127.0.0.1/devices/upgradeprecent
127.0.0.1/devices/voicemail
127.0.0.1/media/audio/output/volume
127.0.0.1/media/audio/output/volume/And the code from the app to see how they are called: https://github.com/youribonnaffe/iegeek-security-camera/blob/main/MeariDeviceController.java
I have not checked if they all work.
youribonnaffe
commented
2 years ago Even more URLs extracted from https://github.com/Mearitek/MeariSdk/tree/master/Android/library/x86_64 (libsppsdk):
http://%s/devices/ntp
http://%s/devices/timezone
http://%s/devices/network
http://%s/devices/reboot
http://%s/devices/setpasswd
http://%s/devices/voicetalk
http://%s/devices/record/stop
http://%s/devices/playback
http://%s/devices/setptzmove
http://%s/devices/setptzstop
http://%s/devices/upgrade
http://%s/devices/lte/online
http://%s/devices/wifi
http://%s/devices/deviceinfo
http://%s/devices/devicecaps
http://%s/devices/storage
http://%s/devices/netlink
http://%s/devices/lte/status
http://%s/devices/energy
http://%s/devices/lte/info
http://%s/devices/snapshot
http://%s/devices/daytonightlevel?videoid=%d
http://%s/devices/videosourceconfig?videoid=%d
http://%s/devices/audiosourceconfig?audioid=%d
http://%s/devices/factoryreset
http://%s/devices/record/search_by_day
http://%s/devices/record/search_by_month
http://%s/devices/record/start
http://%s/devices/record/schedule
http://%s/devices/playback/control
http://%s/devices/firmware_upgrade
http://%s/devices/storageformat
http://%s/devices/mirror?videoid=%d&mirror=%d
http://%s/devices/ftpcfg?videoid=%d
http://%s/devices/alarm/open?videoid=%d&alarmtype=%d
http://%s/devices/alarm/close?videoid=%d
http://%s/devices/lte/offline
http://%s/devices/videosourcecaps?videoid=%d
http://%s/devices/audiosourcecaps?audioid=%d
http://%s/devices/upgradeprecent
http://%s/devices/formatpercent
http://%s/devices/alarm/get?videoid=%d
http://%s/devices/mirror?videoid=%d
Not an issue, merely some research which should end up in the wiki when it's done, I guess. I took a dive into the ppsapp binary, and found a lot of endpoints the doorbell is publishing on its internal webserver, as well as some additional variables for tuya_config.json which could be useful.
Warning, some of these URLs can mess up your camera.
Here you go:
Telnetd service started ok{"devname":"Smart Home Camera","model":"Bell 8S","serialno":"xxxxxxxxxx","softwareversion":"2.9.7","hardwareversion":"BE8S_H1_V10_433","firmwareversion":"ppstrong-c51-tuya2_lcs-2.9.7.20201020","authkey":"xxxxxxxxxx","deviceid":"xxxxxxxxxx","identity":"xxxxxxxxxx","pid":"aaa","WiFi MAC":"xxxxxxxxxx"}{"formatpercent":100}{"temperature_c":256,"temperature_error":256,"humidity":256,"humidity_error":256,"cpu_temperature_c":256,"cpu_temperature_error":256}Upgrade from ppstrong release package.{"deviceName":"xxxxxxxxxx","serialno":"xxxxxxxxxx","sn":"xxxxxxxxxx","licenseUsed":1,"licenseId":"xxxxxxxxxx","p2p_uuid":"v2-xxxxxxxxxx","factory_code":0,"factory_code_str":"","model":"Bell 8S","ip":"xxxxxxxxxx","mask":"255.255.255.0","gw":"192.168.1.1","mac":"xxxxxxxxxx","interface":"wlan0","version":"2.9.7"}{"percent":-1,"upgrade_percent":-1,"download_percent":-1}{"volume":35}{"volume":90}{"cpu":8,"mem":83,"uptime":"1m16s","abnormal_reboot":0}{"firmwareversion":"ppstrong-c51-tuya2_lcs-2.9.7.20201020","madeup_state":0,"abnormal_reboot":0,"WiFi_MAC":"xxxxxxxx","tp":""}"identity": "MR200xxxxxxxxxxxxxx"No visible output./dsp/debug/isp/ldc/ldcopen/0x1/ldctype/0x0/CenterXOffset/0/CenterYOffset/70/Ratio/90/ /dsp/debug/isp/ldc/ldcopen/0x1/ldctype/0x0/CenterXOffset/0/CenterYOffset/40/Ratio/35/ | Error in dmesg: MMB LEAK(pid=1067): 0x4353C000, 8192 bytes, 'AO(0,0) CirBuf' | Makes the device crash, needs to be rebooted. /proc/ppshal/dev_info | -kernel_build_svn 20190403 -kernel_version 264485 -flash 8 -total 64 -hw_id 0 -sensor gc2063mipi -osmem 37 -mmz:27 -pcbname BE8S_H1_V10_433 -factoryname PPSTRONG -platform C5 -btnup 0 -btndown 0 -btnpresstime 0 -pcbversion BELL5S_H1_V10 -viewmirror default -inputvolumn none -ouputvolumn none -micphonemode none -distortion none -modename Bell^8S -lensinfo f2.4A -halinfo 3518ev300 | /dsp/debug/cmd__/ | No visible output. /dsp/debug/setstreamfile/ | No visible output. /proc/net/pps_wifi_check/wifi_run_sta | wifi_ok | wifi status /proc/net/wireless | Table with wlan interfaces |
More to be added.