guino / WR301CH1KW

WR301CH1KW 3MP Cheap Chinese IP Camera Pentest and customization
18 stars 0 forks source link

Has the format been changed? #3

Open qumuq-til opened 2 years ago

qumuq-til commented 2 years ago

Firmware V19.1.61.16.19-20210508 updated from V19.1.11.15.19-20201230 and the model is C6F0SoZ3N0PcL2 Can't unpack the .bin backup, it doesn't appear to be gzip packed... Care to take a look? config_backup.bin.zip

guino commented 2 years ago

@qumuq-til your file is partially decompressing (some ini files are extracted, but not all) -- usually this is an indication that the bin file is in the same format but your file is likely incomplete/corrupt. Your file seems to be almost the same size as mine though.

I would attempt the following: 1-Save config_backup.bin file again to see if you get a bigger file (and try the script again) -- this is in case there was an issue downloading the file the first time. 2-Try a FACTORY RESET of the device then try saving the config_backup.bin again (without any modified settings) and try the unpack script again) -- this is in case one of your settings is causing something to be saved incorrectly by the backup. 3-Try modifying lots of settings (the most you can in the web interface) and try saving the config_backup.bin again -- this is in case some default file is causing an issue in the backup and perhaps saving new settings could fix it.

If all above fails you could try LOADING my config_backup.bin file -- it was made with V20.1.18.11.1-20200322 so you have to keep in mind it may not be exactly 'compatible' and could potentially brick your device (I would hope that a factory reset could fix it in that case but there's no guarantee). If you want to try my config backup file here it is: guinoconfig.zip

Assuming your device has ethernet (wired LAN) -- that's what you should be using as my backup file will overwrite your wifi settings (with bogus wifi ID and password from my file) unless you edit wifi.conf file with your wifi information before loading it.

qumuq-til commented 2 years ago

Interestingly, I cannot restore any backup at all, not yours or even the ones I just made myself. Always getting "Error 400: Bad Request" after several seconds, no reboot, no config changes. I've tried resetting the camera, rebooting between config restores, same error.

Ultimately I'm interested in suppressing the video filters, such as sharpening that are added to the stream and getting the unfiltered video output just after demosaicing is done. Do you happen to know maybe if it is configurable somewhere in the depths? I don't even know how exacly that may be implemented, whether it's a single binary/process, or a filter pipeline, whether those accept config parameters or everything is hard-coded...

And I cannot uncompress my own configs, including the one made right after reset. gunzip always says "uncompress failed", but I can sucessfully gunzip the file you attached. Maybe they did change something in the firmware after all.

guino commented 2 years ago

@qumuq-til you said you updated your firmware -- is the config backup you posted at the top from the NEW firmware (V19.1.61...) or from the old one (V19.1.11...) ?

If you saved the backup from the old firmware it is expected it won't load on the new firmware, but saving the backup with the new firmware and loading it back (without changes) on the new firmware should work -- if this isn't working then possibly the firmware update broke something and you'll need to get in touch with the manufacturer and let them know this feature isn't working and request a different firmware update to hopefully fix the issue.

The different firmware versions definitely change format/behavior of the backup feature (save and load). I have seen relatively different backup formats -- older formats didn't even gzip the files (it was only a tar with no compression).

You may want to read the information on this issue: https://github.com/guino/WR301CH1KW/issues/1 -- there's a URL that may be give some clue as to why the restore is failing (log/config_backup.bin I think).

Regarding the video feed, these are very low power and low performance CPUs so I highly doubt they have any software-side filters -- everything is likely done in the video chip, so the settings that can be enabled/disabled would be limited and defined by the video chip. On my device I have these settings: image

image

I am pretty sure all the above is done on the video hardware (not a software filter), so if you're looking to change something else I doubt it will be possible as any image processing is being done by the video chip using the above parameters (so even if you read the video buffers directly they would already have been processed using the above parameters). That said I think the range or options provided by the hardware are pretty decent and I believe the hardware also encodes a JPG frame in parallel to the video (which I can read on a snapshot URL) -- there's no need to root the device to access any of these settings on my device.

qumuq-til commented 2 years ago

Ah. Unfortunately it won't let me downgrade to an older firmware now. I can't unpack the config files at all, both gzip and tar complain that the file is not a gzip format. But even if I could extract something from it, packing it back would be a challenge since it doesn't appear to be standard. So I guess the only way is via UART then.

I'm of course familar with those image settings. Unfortunately those don't contain a key option for me, which is sharpness (unsharp mask). It has to be configurable somewhere as I've seen it on other (non-chinese-oem) cameras.

I don't even know who the manufacturer is. With China it's a very weird thing where they take a reference design and then there are a million people who make their own slightly customized versions of a(ny) product, then on top of that another million of people selling those slightly customized versions (even sometimes to bigger international dealers) and the true origin along with the intermediaries get lost in this chain. Those people don't tend to stay for long either, changing their names and rebrading constantly, essentially "disappearing" to avoid prolonged support, because their intention is to sell cheap sub-par products as many as they can because life in China is too short and unfair to build a solid foundation.

guino commented 2 years ago

@qumuq-til you're right about that: I never ever expect actual 'support' from any product I buy from China -- at most I'd hope to find some firmware updates.

You should be able to see all the settings/configurations available on the device by unpacking the config back I posted -- if the setting you need is not listed anywhere I'm not sure it would even be worth the effort trying to root the device using UART, hardware programmer, etc. If you have a firmware update file (i.e. some package/file you downloaded and pushed to the device instead of an automatic online update), then it may be worth checking to see what kind of protection/packaging they put into it and perhaps trying to make changes to the update itself in order to get root access (this can take longer than UART/hardware programmer route though).

The root password hash on my device is $1$ocmTTAhE$v.q2/jwr4BS.20KYshYQZ1 (like many similar devices) but I have not found the password corresponding to that hash, so it's not much of any use.

qumuq-til commented 2 years ago

I've actually found the "sharpness" parameter. Could you try it for me on your camera to see if it indeed disables unsharp masking? It's in config_image.ini under [color] section, called "sharpness". Unsharp masking produces halos outside and inside constrasty areas such as building edges or wires. A bit like in this image unsharp radius 50

guino commented 2 years ago

@qumuq-til I changed that setting on both the blackwhite and in the color sections to try it out and did not notice any difference in the snapshot images -- I fully rebooted the device after each change to be sure it would load up any saved settings.

If you email me directly (my email is on my github profile) I can send you the snapshots I took with values 65 (default), 99 and 1, like I said: I could not make out any difference.

qumuq-til commented 2 years ago

Sent you a message on 29.06. It's most likely in the spam right now.

qumuq-til commented 2 years ago

You're right. There's no difference. When you download the config back, do you see that your sharpness parameter is set as you set it?

guino commented 2 years ago

@qumuq-til I just tested that: yes when I download the config_backup.bin it does show the sharpness parameter as I set in the ini file.