thirtythreeforty / neolink

An RTSP bridge to Reolink IP cameras
https://www.thirtythreeforty.net/posts/2020/05/hacking-reolink-cameras-for-fun-and-profit/
GNU Affero General Public License v3.0
890 stars 149 forks source link

Argus 2 and other battery camera #91

Open surfzoid opened 3 years ago

surfzoid commented 3 years ago

Hi I would like to find an solution to watch the video of my reolink argus 2 camera under linux, wath i know is , those came use only an uid , send to an amazon p2p server whose send back video and info to the oficialy reolink windows or android client. Can you implement an function of connect with only uid ? If needed, i can provide an wireshark file packet . thank

Lanwalker commented 3 years ago

I'll have to keep an eye on it. It worked for a few days before it went into limbo... ( blinking red light showing no network connection )

I would still like their DHCP client to use a unique identifier... that pinging the same name and my router pulling those 3 different addresses ( Wlan0 ) was just weird from a network viewpoint... I do not like weird, intermittent and unknowns

surfzoid commented 3 years ago

In the past i said an mistake, if localy i ping the Cam, i loose the first five or six packet and the Cam is wake up, this is how jd work, by ping and that drain battery à litle,

About the two steps Yes jd connect is working but get only Mjpeg and no sound, also there isn't the options of reolink clients to choice hight or low quality so we loose some frame and litle freeze. We surely can use direct accès to the Cam without aws, rather imitate the cli we should take the part of aws question and cam response.

Other point is the Cam wake up by motion Detection and push an alert to the client and send mail, we can get this signal to get few seconds or minutes of the stream and then save battery

twistedddx commented 3 years ago

video, audio, clear or fluent stream etc will hopefully all be very similar to the other cams.

Neolink and most other NVR/CCTV applications typically connect to a device and once connected they stay connected for a duration determined by the application not the device.. The device does not initiate the connection to Neolink or the NVR/CCTV application. The device also does not typically terminate the stream.

Once Argus is supported how do you see yourself using Neolink? If Neolink is running on a machine on the same network as the camera what do you think Neolink could do for you?

Eg 1)Argus camera detects motion and wakes up to record to SD and push a notifications for email or similar. 2)You can then connect to the camera with Reolink client and see live stream or playback recording.

If Neolink was on your local network, would you do something like this? -Have an application monitor the email account -When email is received, execute Neolink and then NVR recording software -Record event until device turns off -Detect camera loss of connection and close Neolink and NVR software

If it is for remote access, what does Neolink offer you over say the Reolink official apps.

Please explain what you intend to use Neolink for in regards to a self activating camera.

surfzoid commented 3 years ago

make argus 2 an real security cam by ability to save video on an ftp or samba after motion detection, because of baterry cam

Lanwalker commented 3 years ago

I just noticed in the ' new ' Reolink client that the E1 cameras show the UID under CAMERA... INFO but you can't find the UID for the ARGUS cameras in that area or in the network area. I have contacted their support group about the deficiencies of the new user interface and the DHCP showing the same names from their updated firmware DHCP client ( does weird things when pinging the ' name ' instead of the address... moving to the next ' name ' in the DHCP list ) They also took out the ' magnify / zoom ' on the new user interface and replaced it with a ' Clip ' and ' Crop video ' that really sucks compared to the previous client.

surfzoid commented 3 years ago

The android.bc.api namespace sets up callback and commands. I assume the libBCP2P_API.so is the corresponding JNI target, so having a decompiled version of that binary that would be awesome. my other interests would be libIOTCAPIs.so libRDTAPIs.so and libp2pc.so Let me know how we can share the files and/or decompiled binaries. I don't think GH is the right place ;)

@thirtythreeforty please let me know if you think it's worth pursuing the reverse engineering approach and need the binaries and/or the decompiled android code. Unfortunately I don't have the tools/licenses to decompile ARM-based .so binaries, so I would need your help here to proceed further.

to be more happy with X86 rather arm, i suggest you to download the last reolink windows client (8.24), reolink use now "electron", under linux, uncompress the .exe then uncompress the app.7z you will find the BCP2P_API.dll for windows :-)

Iguins commented 3 years ago

Hey guys Thanks for the amazing job on this. How can we contribute on this issue to help the investigation for Batterie Powered Camera? I have a argus pro if needed :)

Morphy99 commented 3 years ago

Reolink have a new solution to local storage with their battery powered cameras. The Reolink Drive supports Samba so this is a way to get the recordings off, albeit at the expense of buying and running another device.

I've been getting into object detection on RTSP devices and it would be great to be able to feed clips into another server for this as I get loads of false positives with my Reolink Argus 2.

surfzoid commented 3 years ago

Reolink have a new solution to local storage with their battery powered cameras. The Reolink Drive supports Samba so this is a way to get the recordings off, albeit at the expense of buying and running another device.

I've been getting into object detection on RTSP devices and it would be great to be able to feed clips into another server for this as I get loads of false positives with my Reolink Argus 2.

Only few new go pt ,not old one and not argus2

Morphy99 commented 3 years ago

Only few new go pt ,not old one and not argus2

Oh yes maybe they will extend support.

Reolink Drive can work with the new version of Reolink Go with the following hardware NO.

Q9X0735S4GEUX Q9X0735S4G

Currently, we have finished the trial production for the new version of Reolink Go. We will start mass production in near future. Please keep an eye on our Facebook page or consult our support team before purchasing.

Morphy99 commented 3 years ago

Actually, looks like there is a "hardware limitation":

Note: just the new hardware version Go (EU version: Q9X0735S4GEUX & US version Q9X0735S4G) could work with this Reolink Drive; the previous version of Go can't work with this driver even after the firmware upgrade.

Still, it would be nice to reverse engineer this device software to be able to incorporate it on another system. If and when it becomes available

Morphy99 commented 3 years ago

I've noticed that the battery cameras now work with Google Home/Alexa to show streams on Chromecasts. Could this be utilised maybe?

QuantumEntangledAndy commented 3 years ago

I actually have a working UDP branch that I'm just trying to polish off. Would you be willing to test it?

QuantumEntangledAndy commented 3 years ago

It's on my fork in the udp_proto branch

The last build artifacts for download are here

There are some other changes in the program such as subcommands.

To get rtsp it is

neolink rtsp --config=config.toml

To get a UDP camera to connect you need to give it the UID of the camera in the toml on the same place you would usually put the IP address

Morphy99 commented 3 years ago

I'm having trouble connecting, is there a default username for the Argus Pro? I can only see the option to change the password in the Reolink app. I've tried Admin, admin, Administrator, administrator.

QuantumEntangledAndy commented 3 years ago

There is yes, @twistedddx knows it and I think he posted it on one of the other issues I will have a search for it

QuantumEntangledAndy commented 3 years ago

Ah here it should be admin 123456

Morphy99 commented 3 years ago

Yeah I've got admin set and my password which I changed in the app but it's still not connecting. Does this look correct?

[[cameras]]
name = "shed"
username = "admin"
password = "mypassword"
address = "MY UID"
QuantumEntangledAndy commented 3 years ago

What exactly is the error you get? Could you post the log?

If you set this first

export RUST_LOG="neolink=debug"

It will debug print more info too

Morphy99 commented 3 years ago

ERROR neolink::rtsp] Error streaming from camera shed, will retry in 1s: ConnectionError(Timeout)

Where's the log file? Do I put that in the toml file?

QuantumEntangledAndy commented 3 years ago

Just the stdout is the log no file persay. Run it with the export and pipe it to file

export RUST_LOG="neolink=debug"
neolink rtsp --config=config.toml 2>&1 | tee logfile.log
Morphy99 commented 3 years ago

Ok thanks, got:

[2021-08-16T09:40:55Z INFO  neolink] Neolink 528f4d0bb70017dede691822d4e3cf482a7269e3 release
Error: Rtsp(Io(Os { code: 2, kind: NotFound, message: "No such file or directory" }))

But now running it as normal I get more errors:

[2021-08-16T09:41:22Z INFO  neolink] Neolink 528f4d0bb70017dede691822d4e3cf482a7269e3 release
[2021-08-16T09:41:22Z DEBUG neolink::rtsp::gst] Permitting anonymous to access /shed, /shed/mainStream
[2021-08-16T09:41:22Z DEBUG neolink::rtsp::gst] Permitting anonymous to access /shed/subStream
[2021-08-16T09:41:22Z DEBUG neolink_core::bc_protocol::resolution] Trying as uid
[2021-08-16T09:41:22Z DEBUG neolink_core::bc_protocol::resolution] Trying as uid
[2021-08-16T09:41:22Z DEBUG neolink_core::bc_protocol] Trying uid myuid
[2021-08-16T09:41:22Z DEBUG neolink_core::bc_protocol] Trying uid myuid
[2021-08-16T09:41:27Z ERROR neolink::rtsp] Error streaming from camera shed, will retry in 1s: ConnectionError(Timeout)
[2021-08-16T09:41:27Z ERROR neolink::rtsp] Error streaming from camera shed, will retry in 1s: ConnectionError(Timeout)
[2021-08-16T09:41:28Z DEBUG neolink_core::bc_protocol::resolution] Trying as uid
[2021-08-16T09:41:28Z DEBUG neolink_core::bc_protocol::resolution] Trying as uid
[2021-08-16T09:41:28Z DEBUG neolink_core::bc_protocol] Trying uid myuid
[2021-08-16T09:41:28Z DEBUG neolink_core::bc_protocol] Trying uid myuid
[2021-08-16T09:41:33Z ERROR neolink::rtsp] Error streaming from camera shed, will retry in 2s: ConnectionError(Timeout)
[2021-08-16T09:41:33Z ERROR neolink::rtsp] Error streaming from camera shed, will retry in 2s: ConnectionError(Timeout)
QuantumEntangledAndy commented 3 years ago

It looks like from the log that the udp broadcast messages are not getting through. Ideally I'd need a wireshark packet capture to identify the issue at this point.... ToT

This may also be a firewall or router issue that is blocking udp broadcasts too

Morphy99 commented 3 years ago

Could my Devolo PLA adapter it's connected to. Had a few issues with it recently. I'll bring it inside and hook up to my Unifi AP.

QuantumEntangledAndy commented 3 years ago

If the official client can connect through this adapter it's probably not that, I'll work out the command to get wireshark on the rpi and post it back to you

QuantumEntangledAndy commented 3 years ago

So wireshark can be done on the rpi like this

sudo apt install tshark
tshark -f '(host CAM_IP or broadcast) and udp' -w capture.pcapng

replace CAM_IP with the ip address of the camera then post the pcapng file

QuantumEntangledAndy commented 3 years ago

You'll need to have two windows open one for neolink and one for tshark

Start tshark first

Then start neolink

Then stop neolink with cntl-c

Then stop tshark with cntl-c

QuantumEntangledAndy commented 3 years ago

Ok so I fired up my raspberry pi and tried it on that, and it gets the same issue, where on my macos it works fine. I need to check whats happening. Might be that raspbi dosen't do broadcast by default

QuantumEntangledAndy commented 3 years ago

I'll see if I can fix it on my rpi and get back to you

Morphy99 commented 3 years ago

OK not having much luck with wireshark on the pi either...

sudo tshark -f 'host 192.168.0.28 and udp' -w ~/capture.pcapng
Running as user "root" and group "root". This could be dangerous.
Capturing on 'eth0'
tshark: The file to which the capture would be saved ("/home/pi/capture.pcapng") could not be opened: Permission denied.
QuantumEntangledAndy commented 3 years ago

Try writing to /tmp instead of home

QuantumEntangledAndy commented 3 years ago

I think I am going to have to re-setup my dev environement on my rpi so I can build from source. This will take a day or so... Nothing ever works first time...

Morphy99 commented 3 years ago

Ok no problem, thanks for looking at it. Out of interest, what system had you tested it with?

QuantumEntangledAndy commented 3 years ago

From my macbook with my E1 camera

QuantumEntangledAndy commented 3 years ago

Ok so I got it working on my rpi. It was just a firewall issue. Usually when you open an outgoing connection to the camera the firewall allows a return connect automatically. However because the first outgoing is a broadcast this is not the case and it treats the incoming as a new connection that needs to be blocked...

Anyways the port range I have set neolink to use is 53500-54000

You can allow it with the following (assuming your using ufw)

ufw allow 53500:54000/udp

Please try and let me know what happens

Morphy99 commented 3 years ago

I'm not using a firewall though? Does raspberry pi os have a firewall on by default?

ufw allow 53500:54000/udp
-bash: ufw: command not found

Reading more I can see it uses iptables which may have blocked it.

So I installed ufw and enabled with the rule you mentioned and it still isn't connecting. Same as before. Wireshark didn't capture anything either.

ljantos commented 3 years ago

I have the same problem on my Mac without any active firewall and an ARGUS 2 Cam:

./neolink rtsp --config=config.toml 2>&1 | tee logfile.log
[2021-08-16T21:59:02Z INFO  neolink] Neolink 627d69216bedf6d1ac3ee128d3132066e4cc7ac4 release
[2021-08-16T21:59:02Z DEBUG neolink::rtsp::gst] Permitting anonymous to access /Ground Cam, /Ground Cam/mainStream
[2021-08-16T21:59:02Z DEBUG neolink::rtsp::gst] Permitting anonymous to access /Ground Cam/subStream
[2021-08-16T21:59:02Z DEBUG neolink_core::bc_protocol::resolution] Trying as uid
[2021-08-16T21:59:02Z DEBUG neolink_core::bc_protocol::resolution] Trying as uid
[2021-08-16T21:59:02Z DEBUG neolink_core::bc_protocol] Trying uid myuid
[2021-08-16T21:59:02Z DEBUG neolink_core::bc_protocol] Trying uid myuid
QuantumEntangledAndy commented 3 years ago

Could you let me know if this program works for you https://github.com/vherrlein/camera_proxy/tree/develop it reportedly supports these cameras and uses the same basic principle I am using.

QuantumEntangledAndy commented 3 years ago

This python app also does discovery against a middle man server while I only implement local discovery.

I have a feeling that I need to use the middle man server for these battery cameras as they are not awake often enough for the local.

ashmckenzie commented 3 years ago

Am following along also @QuantumEntangledAndy 🙂 https://github.com/vherrlein/camera_proxy/tree/develop works for me (albeit a little flakey) but I can't get your build working. My UFW is disabled also:

config.toml

bind = "0.0.0.0"

[[cameras]]
name = "test"
username = "admin"
password = "<password>"
address = "<UID>"

neolink

$ rm -f logfile.log ; RUST_LOG="neolink=debug" ./neolink rtsp --config=config.toml 2>&1 | tee logfile.log
[2021-08-17T03:24:58Z INFO  neolink] Neolink 627d69216bedf6d1ac3ee128d3132066e4cc7ac4 release
[2021-08-17T03:24:58Z DEBUG neolink::rtsp::gst] Permitting anonymous to access /test, /test/mainStream
[2021-08-17T03:24:58Z DEBUG neolink::rtsp::gst] Permitting anonymous to access /test/subStream
[2021-08-17T03:24:58Z DEBUG neolink_core::bc_protocol::resolution] Trying as uid
[2021-08-17T03:24:58Z DEBUG neolink_core::bc_protocol] Trying uid <UID>
[2021-08-17T03:24:58Z DEBUG neolink_core::bc_protocol::resolution] Trying as uid
[2021-08-17T03:24:58Z DEBUG neolink_core::bc_protocol] Trying uid <UID>
[2021-08-17T03:25:03Z ERROR neolink::rtsp] Error streaming from camera test, will retry in 1s: ConnectionError(Timeout)
[2021-08-17T03:25:03Z ERROR neolink::rtsp] Error streaming from camera test, will retry in 1s: ConnectionError(Timeout)
[2021-08-17T03:25:04Z DEBUG neolink_core::bc_protocol::resolution] Trying as uid
[2021-08-17T03:25:04Z DEBUG neolink_core::bc_protocol::resolution] Trying as uid
[2021-08-17T03:25:04Z DEBUG neolink_core::bc_protocol] Trying uid <UID>
[2021-08-17T03:25:04Z DEBUG neolink_core::bc_protocol] Trying uid <UID>
[2021-08-17T03:25:09Z ERROR neolink::rtsp] Error streaming from camera test, will retry in 2s: ConnectionError(Timeout)
[2021-08-17T03:25:09Z ERROR neolink::rtsp] Error streaming from camera test, will retry in 2s: ConnectionError(Timeout)
QuantumEntangledAndy commented 3 years ago

Yep I am starting to feel certain I need to do this remote discovery against the reolink middle man servers. That's a shame one of things I like about neolink is that it's all local and you can block external comms to reolink servers..... Oh well needs must.

This will likely take a few days to implements I'll post back when it's ready.

Morphy99 commented 3 years ago

How does the reolink app work when you block internet access to the camera then?

ljantos commented 3 years ago

That was my thought too. I have blocked the reolink cam on my router firewall, so they haven't access to the internet.

QuantumEntangledAndy commented 3 years ago

Well if you can send me the packets that your client makes when blocked from external access using wireshark I can see what the differences are.

QuantumEntangledAndy commented 3 years ago

I only have my E1 which is not a battery camera and it is working locally with UDP protocol. I also have some packets that @slogen donated that connect to an Argus Eco, which seems to be connecting over this middle man server. If you can provide one with the clients comms without this I can use that to sort out whats happening

Morphy99 commented 3 years ago

Save me faffing about trying things any ideas what kind of filter to use with tshark?

ljantos commented 3 years ago

I will send you a dump.

QuantumEntangledAndy commented 3 years ago

Thanks, please ensure you include the broadcast addresses. Thoses are quite important for udp discovery

QuantumEntangledAndy commented 3 years ago

If your on your win/mac use the full wireshark over tshark for a nice GUI. With this display filter

((ip.dst == 255.255.255.255  || ip.src == 192.168.1.102 || ip.dst == 192.168.1.102) && (ip.proto == 17))

Where 192.168.1.102 is swaped with your cam IP

QuantumEntangledAndy commented 3 years ago

Or if you like terminal stuff like me then the same tshark as before

tshark -f '(host 192.168.1.102 or broadcast) and udp' -w capture.pcapng

Where you replace 192.168.1.102 with your cam ip