search

guino / LSC1080P

13 stars 1 forks source link

RTSP on Kruidvat Smart Indoor Camera #1

Open McPrapor opened 1 year ago

McPrapor commented 1 year ago

I got 3 of those: prd-front-5314128-1-600x600 And found that FW structure is very much like you described in this repo. Putting product.cof on sdcard helped with obtaining telnet and creds are working. Current FW version is 5.2.7(MCU as well). You mentioned RTSP is already working for your device. Could you maybe help obtaining RTSP for my device as well? Here is the firmware I dumped: https://mega.nz/folder/eeZk0QSB#HUh2Q7p-OytEX52cmvk68g

guino commented 1 year ago

@McPrapor at a quick look this seems to automatically start the RTSP server on rtsp://IP:8554 (similar to older tuya devices I've seen) -- based on the parameters it doesn't seem like it would need patching to get the RTSP server running.

Try that on VLC or check it on a linux computer with nmap IP to see which ports are open.

McPrapor commented 1 year ago

nmap says only telnet and irc are listening. Pity, I thought that might be just a little setting somewhere, but looks like this one is a tough nut, no way to run custom scripts even.

guino commented 1 year ago

@McPrapor I thought you said telnet is working with creds ? If so you should be able to kill the running dgiot and run a patched one ? I would try it without patching to see if it works, then we can possibly make a patch to 'force' RTSP to start since you say it isn't running. More importantly: this would give you the log output from dgiot which would be really helpful in patching and/or viewing any information as far as what may be running. The RTSP server may be running on UDP only (no TCP) which is not something nmap would list.

McPrapor commented 1 year ago

Checked with netstat and vlc additionally, nothing on rtsp related port unfortunately. I tried to run there patched dgiot but device goes to reboot. By some reason killing the original dgiot and running even stock dgiot again leads to device reboot. cjj25 has similar hardware and was so kind to try to flash this fw and check what can be done.

guino commented 1 year ago

@McPrapor is the phone app tuya based ? or some other cloud thing ? cause in the code it looks like there's tuya support (with RTSP startup) but then it looks like it has some other main code (without tuya/RTSP startup) which is what seems to be in use. With some investigation and time to try it could be possible to run the RTSP code but it would require flash changes to start the patched dgiot (instead of having to kill and run it -- since that doesn't seem to work), so the first step would be to get the flash modified so it 1-mounts the SD card, 2-checks if there's a patched dgiot on the SD card and if so, runs that 3-if no patched dgiot on the SD card, run the normal one --- that would allow you to play with changes to the application.

McPrapor commented 1 year ago

It's "kruidvat smart home" app, so looks like it's like you wrote, it uses another main function. Let's wait for results from cjj25, he has that hw with removable flash chip, so can find a proper way to reflash it without danger to brick it.