search

thirtythreeforty / neolink

An RTSP bridge to Reolink IP cameras
https://www.thirtythreeforty.net/posts/2020/05/hacking-reolink-cameras-for-fun-and-profit/
GNU Affero General Public License v3.0
895 stars 151 forks source link

Question: Is it possible to determine why Neolink is not connecting? #77

Closed Diablosblizz closed 3 years ago

Diablosblizz commented 4 years ago

Describe the bug Neolink is not able to connect to my Swann NVW-485CAM cameras. They do have port 9000 open.

[2020-09-24T01:52:09Z ERROR neolink] Error streaming from camera Cars, will retry in 2s: Timeout [2020-09-24T01:52:09Z ERROR neolink] Error streaming from camera Cars, will retry in 2s: Timeout

I am just trying to get an understanding of if my cameras do not support the standard Baichuan protocol or if it is something else.

To Reproduce

Expected behavior

Versions NVR software: Swann NVR-485 Neolink software: 0.3.0 (Unknown Commit) Reolink camera model and firmware: These are SWANN NVW-485CAM. According to SwannView link there is additional information:

Hardware Ver: IPC_36S8M Config Ver: v2.0.0.0 Firmware Ver 1029_16061700

I was hoping SWANN cameras were also supported since they are mentioned in the README, but looking for clarification on if I can confirm if they are compatible.

QuantumEntangledAndy commented 4 years ago

I believe we do have someone already who uses SWANN cameras @twistedddx, perhaps there is something else going on. (I think they had to set neolink to use h264 format)

Could you set the following environental variables

RUST_LOG = debug GST_DEBUG = 3

Run it again with those variables set and post the results here and If you are not sure how to set the env variable please let me know,

twistedddx commented 4 years ago

For Neolink with Swann cameras I have tested: NHD-818 - Works (Firmware 170518) NHD-805 - Does not work NHD-806 - Does not work NVR-7400 - Works (Reolink Firmware 190823)

805/806 have very similar BC media format as 818. Same 00dc, 01dc BC headers etc. All are h264 video. 818 has adpcm audio, 805/806 have no audio. I no longer actually use my 805 or 806 cameras. They are just in storage now. I had a quick look in a packet capture and the BC protocol looks similar but I have no interest in support due their age and not even using them any more.

"Hardware Ver: IPC_36S8M Config Ver: v2.0.0.0 Firmware Ver 1029_16061700" That looks exactly like the other BC products. Eg NHD-818 is IPC_388M, same config ver and same firmware version format.

I believe the Swann BC family is: NVR-7072, NVR-7085, NVR-7285, NVR-7300, NVR-7400 NHD-805, NHD-806, NHD-810, NHD-811, NHD-815, NHD-815AF, NHD-816, NHD-817, NHD-818, NHD-819 https://www.swann.com/media/wysiwyg/docs/swann-camera-compatibility.pdf

QuantumEntangledAndy commented 4 years ago

Thanks. I think we should add known supported and unsupported Swann cameras to the readme

QuantumEntangledAndy commented 4 years ago

I hope that @Diablosblizz issue is just from not using h264 because from his error message it seems it was able to get passed the login step. But if he can post the log with the environment variables set we can be sure.

twistedddx commented 4 years ago

NHD-805 Hw: H18C01 Cfg: 1.0.0.1 Fw:

NHD-806 Hw: H18C01-A Cfg: 1.0.0.1 Fw: H18C01-A.995

nhd805.pcapng - Neolink to NHD805 (does not work) nhd805_nvr.pcapng - Reolink client to NHD805 (works) Login: admin/12345 NHD805.zip PS- Filename has NVR by mistake. Nothing NVR was involved. In both cases it is direct to camera via lan. Camera was not connected to NVR at all.

set GST_DEBUG=3 set RUST_LOG=debug

D:\gstreamer\1.0\x86_64\bin>D:\Code\Neolink\neolink\target\release\neolink.exe --config neolink_config.toml [2020-09-24T11:05:32Z INFO neolink] Neolink v0.3.0-123-gaffc0d9 release [2020-09-24T11:05:32Z DEBUG neolink::gst] Permitting anonymous to access /IPC0, /IPC0/mainStream [2020-09-24T11:05:32Z INFO neolink] IPC0: Connecting to camera at 192.168.93.192:9000 [2020-09-24T11:05:37Z DEBUG neolink::bc_protocol::connection] Shutting down BcConnection... [2020-09-24T11:05:37Z DEBUG neolink::bc_protocol::connection] Shutdown finished OK [2020-09-24T11:05:37Z ERROR neolink] Error streaming from camera IPC0, will retry in 1s: Timeout

Diablosblizz commented 4 years ago

Hey there @QuantumEntangledAndy and @twistedddx, appreciate the responses here.

I am not super familiar with setting environment variables on Ubuntu, but I tried following instructions in the link below and adding the values to /etc/environment as well as running set GST_DEBUG=3 and set RUST_LOG=debug. I don't seem to get any more additional information from the logs. Rebooted as well. Maybe a quick how-to would be helpful here, I appreciate it.

Worth mentioning, maybe it matters, I am running on Ubuntu 20.04.1. Based on the release file name including 18.04, do you think it could be a compatibility issue with the newer version of Ubuntu?

Just in case my config file is wrong, below is what I have configured. I did try h264 unfortunately with no dice. It is separated with line breaks, not sure why Github isn't respecting that.

[[cameras]] name = "Cars" username = "admin" password = "password" address = "192.168.1.221:9000" format = "h264"

twistedddx commented 4 years ago

To me it looks like in these older Swann devices a different scrambler phrase is used.

The encrypted XML can not be decrypted by the wireshark disector.

twistedddx commented 4 years ago

I can find "Charlie is the designer of P2P!!" in SwannView Link 1.0.2.22 IOTCAPIs.dll from 2013. That phrase has been in use for a very long....

twistedddx commented 4 years ago

IOTCAPIs.dll is part of Throughtek Co p2p module.

The Charlie phrase isn't a BC phrase it is from Charlie @ Throughtek in 2010-211. https://github.com/leejansq/p2p/blob/master/Include/IOTCAPIs.h

The phrase appears within all kinds of camera products: https://jelmertiete.com/2016/03/14/IoT-IP-camera-teardown-and-getting-root-password/

QuantumEntangledAndy commented 4 years ago

To set the variable I also need to know if your doing it through docker. 

export RUST_LOG=debug
export GST_DEBUG=3
./neolink --config=....
docker run \
  -p 8554:8554 \
  -e RUST_LOG=debug \
  -e GST_DEBUG=3 \
  --restart=on-failure \
  --volume=$PWD/config.toml:/etc/neolink.toml \
  thirtythreeforty/neolink
QuantumEntangledAndy commented 4 years ago

P.s. to get github to respect code formats put it inside triple backticks

``` Code here

```

QuantumEntangledAndy commented 4 years ago

P.p.s you can also get github to syntab highlight it if you know the name of the language

```python

if know_name:
    python_code = can.highlight()

```

By adding the name after the opening backticks

```rust

if know_name {
    let rust_code: Can = be.highlighted();
}

```

In your case it should be toml

```toml

[[cameras]]
name = "Cars"
username = "admin"
password = "password"
address = "192.168.1.221:9000"
format = "h264"

```

QuantumEntangledAndy commented 4 years ago

Also you should revert the changes you made to /etc/environment as that will make the environment vars permeant and you probably don't want debug logs for every rust code on your machine.

Diablosblizz commented 4 years ago

Thanks for the additional information. Just running Ubuntu, no docker. The export commands worked, I am getting more information now but it doesn't mean much to me.

[2020-09-24T13:23:08Z INFO  neolink] Neolink 0.3.0 (unknown commit) release
[2020-09-24T13:23:08Z DEBUG neolink::gst] Permitting anonymous to access /Cars, /Cars/mainStream
[2020-09-24T13:23:08Z DEBUG neolink::gst] Permitting anonymous to access /Cars/subStream
[2020-09-24T13:23:08Z INFO  neolink] Cars: Connecting to camera at 192.168.1.221:9000
[2020-09-24T13:23:08Z INFO  neolink] Cars: Connecting to camera at 192.168.1.221:9000
[2020-09-24T13:23:08Z DEBUG neolink::bc_protocol::connection] Shutting down BcConnection...
[2020-09-24T13:23:08Z DEBUG neolink::bc_protocol::connection] Shutdown finished OK
[2020-09-24T13:23:08Z ERROR neolink] Error streaming from camera Cars, will retry in 1s: Timeout
[2020-09-24T13:23:08Z DEBUG neolink::bc_protocol::connection] Shutting down BcConnection...
[2020-09-24T13:23:08Z DEBUG neolink::bc_protocol::connection] Shutdown finished OK
[2020-09-24T13:23:08Z ERROR neolink] Error streaming from camera Cars, will retry in 1s: Timeout
[2020-09-24T13:23:09Z INFO  neolink] Cars: Connecting to camera at 192.168.1.221:9000
[2020-09-24T13:23:09Z INFO  neolink] Cars: Connecting to camera at 192.168.1.221:9000
[2020-09-24T13:23:09Z DEBUG neolink::bc_protocol::connection] Shutting down BcConnection...
[2020-09-24T13:23:09Z DEBUG neolink::bc_protocol::connection] Shutdown finished OK
[2020-09-24T13:23:09Z ERROR neolink] Error streaming from camera Cars, will retry in 2s: Timeout
[2020-09-24T13:23:09Z DEBUG neolink::bc_protocol::connection] Shutting down BcConnection...
[2020-09-24T13:23:09Z DEBUG neolink::bc_protocol::connection] Shutdown finished OK
[2020-09-24T13:23:09Z ERROR neolink] Error streaming from camera Cars, will retry in 2s: Timeout
[2020-09-24T13:23:11Z INFO  neolink] Cars: Connecting to camera at 192.168.1.221:9000
[2020-09-24T13:23:11Z DEBUG neolink::bc_protocol::connection] Shutting down BcConnection...
[2020-09-24T13:23:11Z DEBUG neolink::bc_protocol::connection] Shutdown finished OK
[2020-09-24T13:23:11Z ERROR neolink] Error streaming from camera Cars, will retry in 4s: Timeout
[2020-09-24T13:23:11Z INFO  neolink] Cars: Connecting to camera at 192.168.1.221:9000
[2020-09-24T13:23:11Z DEBUG neolink::bc_protocol::connection] Shutting down BcConnection...
[2020-09-24T13:23:11Z DEBUG neolink::bc_protocol::connection] Shutdown finished OK
[2020-09-24T13:23:11Z ERROR neolink] Error streaming from camera Cars, will retry in 4s: Timeout
QuantumEntangledAndy commented 4 years ago

Ok so we are not getting the message Connected and logged in so we have yet to reach login :(

We are not getting the error about a failed login :( so...

... We are failing to connect at all

Without a more detailed analysis (access to the camera) I cannot say for certain but it seems it is not a BC format we recognise.

I will have a look at the wireshark dump @twistedddx sent maybe theres something in that

twistedddx commented 4 years ago

Is Nets_XmlEncrytpion inside the dvr app? These are the oldest dvr apps I have IPC_388M.541_16081000.ov4689.3MP.SW_AUS.pak contains: https://www.wasteofcash.com/BCConvert/dvr_IPC_388M_541_16081000 HI3535_NVR_8IP_SWANN_L300_1224_3438_1103.pak (151224) contains: https://www.wasteofcash.com/BCConvert/dvr_HI3535_NVR_8IP_SWANN_L300_1224_3438_1103

QuantumEntangledAndy commented 4 years ago

So as twistedddx pointed out that camera can't be read by the unscrambler in the wireshark plugin. The one in the wireshark uses the non-charlie scrambler i.e. the Nets_XmlEncrytpion perhaps these older cameras use the charlie phrase one

QuantumEntangledAndy commented 4 years ago

My lua foo is not up to scratch enough to implement the charlie phrase scambler to test, and its getting late where I am so I am signing off, sorry can't help more just yet

QuantumEntangledAndy commented 4 years ago

Format of these older packets (according to twistedddx dump) is quite different from the one we use. Where there should be the binary offset data instead there is a string saying "0000" (0x30 0x30 0x30 0x30). Where we should have encrypted payload xml is just plain text. This will probably require too many changes to be easily supported sorry.

twistedddx commented 4 years ago

From my reading of my wireshark captures the older Swann cameras completely use the legacy messaging system which Neolink only briefly uses to upgrade to the modern XML based system. Neolink otherwise does not support the legacy messaging system.

It appears the swap to the modern protocol might be around the early 2017 era. 2017 is where much of the product rapidly changes. Swann(and others) to solely Reolink ADPCM to AAC AVI to MP4

nhd-805/806 protocol: Send legacy login 1 Receive plain text basic camera description. Send bag of C struct's Receive bag of C struct's Send bag of C struct's Receive plain text more detailed camera description Receive bag of C struct's Send bag of C struct's Receive bag of C struct's Receive BC media data

nhd-818 protocol: Send legacy login Receive XML with nonce Send XML login Receive XML DeviceInfo, VideoInfo, Serial Send XML AbilitySupport Receive XML AbilitySupport Send XML desired features Receive XML StreamInfoList Receive bag of C struct's Send bag of C struct's Receive bag of C struct's Send XML for video preview Receive XML video preview with BC media data

twistedddx commented 4 years ago

There may be hope if your device is simply not encrypting modern messages. I opened issue #79 regarding that particular issue.

I had foolishly been testing my Swann NHD-818 via my NVR. Direct Neolink connection to my NHD-818 fails also.

Diablosblizz commented 3 years ago

I am very happy to report that my NVW-485CAM cameras are now working since #79 being closed.

Awesome work, thank you so much!