Additional info #16
Comments
|
Did you find the urls of the cloud streams? |
|
get_session_key returns the SIP parameters to start a video connection. I can see it on Wireshark, but I'm not that familiar with how to start a SIP session. It looks very similar to how other doorbell cameras work. |
|
Thanks for you help. I'll have a play and report back what what I can get to work |
|
Awesome folks! Thanks |
|
Hey really cool finds! Does anyone know how the SIP stuff works? |
|
On the Kodak site: And hopefully get a simple integration to work. |
|
Maybe they're more likely to expose how it works now? Who knows. My kids will be old enough to not need this by the time it's solved haha. A simple esp32 cam would be a much better solution |
That is not what it's about haha. |
|
now that the cloud SIP service is no longer available, you'll have to use the local rtsp stream. The camera's has a basic MAC address firewall in the code, so once the camera's are connected to the parent unit, spoof the parent unit's Mac address and you'll be able to do a regular rtsp to the IP of the camera. |
|
This one is not mentioned yet |
Well the android app is still working locally and is not using a spoofed MAC.. I'm having a bit of trouble reading the phones packets with Wireshark. |
|
I have ios. If you have the apk file, there are a couple free android decompilers online. Could run it through one and search for The url’s or connection code sections. |
|
CLOSE_P2P_CMD = "close_p2p_rtsp_stun"; GET_MAC_ADDRESS_CMD = "get_mac_address"; OPEN_P2P_COMBINE_SESSION_PARAMS = "&mode=combine&port1=%d&ip=%s&streamname=%s"; SET_P2P_CHANNEL_MODE_CMD = "p2p_ses_mode_set"; There are 4 modes available Local, Relay, Remote and Combine I'll keep digging |
|
In for solving this, I dont have time to dig like you guys but happy to test potential solutions |
|
Got something new to play with: COMMAND_PANTIL_DOWN = "motor_down"; for example http://xxxxx/?req=motor_left&time=1 Have a play ;) |
|
I hope somebody found something! Now that the cloud access are gone, it would be a really good solution to catch the local stream! |
|
Does anyone has a way to force the android app to function in 'offline mode'? |
|
@sbeukers don't suppose you found the const for melody args did you? I've tried 'set_melody' and 'melody' with 'value=0|1' with no success |
Here you go /?req=melody_vol (show volume) |
|
Also important because there is no official way to connect through your router anymore now. UPDATE_WIFI_INFO_CMD = "change_router_info"; /?req=change_router_info&ssid=MYWIFI&password=TEST /?req=get_url URL_SET_CMD = "url_set"; /?req=url_set&api_url=xxxx&mqtt_url=xxxx&ntp_url=xxxx&rms_url=xxxx&stun_url=xxxx&ana_url=xxxx If you have a repeater. (Can we tap into this?) EDIT |
Hero - thank you, time to get this connected to my Home Assistant + Alexa! |
|
In need of some major help. Had to reset the camera due to the parent unit not connecting and now I have no way to pair to the router since the app is no longer online. Am I SOL or does anyone have a viable work around. |
|
@eightball011854 ughh sorry youre in a mess. I dont have a solution but thanks for raising awareness for the rest of us |
Well I am not going to replicate you ;) but I will try to help you. If you do, is it a secure connection? If you can connect we have to find the ip/range and adress. Then try: Let's see how far you can go with this info |
Amazing, I will give this a shot and report back if it works! |
once I connect to the network, which is unsecured, and have the IP (1.2.168.222.2 and 192.168.222.1), i go into a browere and use the http://foundip/?req=change_router_info&ssid=YOURSSID&password=YOURPASSWORD, but nothing happens |
Ok we got quite far I think on the first try. Can you try: And did/do you get any response or nothing at all? While connected can you do a portscan for all open ports 1-65535 If the app can do it we should also be able to. |
|
anybody found the rtsp stream, or any possiblity to access the video stream? |
Did it work? |
nothing changes in the get_cam_info screen ssid1, 2, and 3 are all still blank |
|
Ok, anyway can you post it? Can compare it with mine, maybe we'll find another issue in it. |
You have to provid 2 ssid's and passwords accoding to the APK. I did try /?req=url_set to get around the random reconnect but it doesn't save. |
Why do you mean that? The number 2 in Base64.encodeToString(str.getBytes(), 2) is a flag named NO_WRAP. See https://developer.android.com/reference/android/util/Base64#encodeToString(byte[],%20int) |
get_caminfo: flicker=60&flipup=0&fliplr=0&brate=500&svol=2&mvol=22&wifi=100&bat=13&hum=64&tem=19&hum_float=64.0&tem_float=19.2&storage=1&md=0:0:3:0&sd=0:2:3:0&td=0:3:1529:0&lbd=1:0:1:0&ir=0&lulla=0&res=720&sdcap=-113&sdfree=0&sdatrm=1&sdnoclips=10&mdled=0&ca=1&charge=1&lulvol=3&isp_idx=1&agc_lvl=3&ssid1=&ssid2=&ssid3=&hw_id=4&puscan=1&pu_ana_en=1&rtscan=1&panel_vox=0&charge_dur=2488&mvr=1&dnsm=8.8.8.8&dnss=120.246.62.0&wifi_env=20011100003000D&lulla_dur=15&localip=192.168.222.1&sync_channel=3&rp_pair=0&rp_conn=disconnect&blue_led_en=1&blue_led_ontime=180&red_led_affect=0&block_pu_upgrade=0&pu_fw_pkg=00.00.00&advise_homemode=1&snapshot_storage=1&soc_ver=517260& |
|
UPDATE_WIFI_INFO_CMD = "change_router_info"; btw: |
|
right i made a temp guest network with a dummy password to be able to share this with yall what am i doing wrong in my command? |
|
Can you try it like this? |
|
That base64 encode is probably/hopefully a URL safe variant, are you all accounting for that? E.g. trailing padding and slashes |
Nice. I see two points. The command only need 1 ssid. In the caminfo are three ssids sure, but in the code can see that we only can one set. http://192.168.222.1/?req=change_router_info&ssid=VFAtTElOS19BRjYz&password=bGV0c2dvZW50OA== Second. In your caminfo I see that your HomeMode is active. That's why you get a direct connection to your camera, but not to the router. You have to disable the HomeMode. In worst case I think you have to reset the camera? I don't know it. URL for disable your Homemode I have no idea what would happen :) P.s. the change_router_info always says 0 ... the command was successfully received from the camera and respond with the 0, but the values could not processed. That's what I think |
remove the "==" at the end. Good one to disable Home mode! the ssid3 in the caminfo is the current ssid. You can definitely set 2. (mine: ssid1=mycurrent&ssid2=Sprookjescamping-339A&ssid3=mycurrent) |
|
Sure there is a way but I don't found it yet. |
|
get_caminfo: flicker=60&flipup=0&fliplr=0&brate=500&svol=2&mvol=22&wifi=100&bat=14&hum=-1&tem=-273&hum_float=-1.0&tem_float=-273.0&storage=1&md=0:0:3:0&sd=0:2:3:0&td=0:3:1529:0&lbd=1:0:1:0&ir=0&lulla=0&res=720&sdcap=-113&sdfree=0&sdatrm=1&sdnoclips=10&mdled=0&ca=1&charge=1&lulvol=3&isp_idx=1&agc_lvl=3&ssid1=&ssid2=&ssid3=&hw_id=4&puscan=1&pu_ana_en=1&rtscan=1&panel_vox=0&charge_dur=307&mvr=1&dnsm=8.8.8.8&dnss=80.244.62.0&wifi_env=20010210004000D&lulla_dur=15&localip=192.168.222.1&sync_channel=3&rp_pair=0&rp_conn=disconnect&blue_led_en=1&blue_led_ontime=180&red_led_affect=0&block_pu_upgrade=0&pu_fw_pkg=00.00.00&advise_homemode=0&snapshot_storage=1&soc_ver=517260& disabled home mode, ran every iteration of change_router (single ssid, multiple ssid, no ==) but this is what i got |
|
@eightball011854 |
get_url: api=&mqtt=&stun=&rms=&ana=&ntp=mt-t01-r2.perimetersafe.com:9100 |
|
Are you familia with http-post data with an authorisation-header? |
now you lost me lol |
|
Ok, I bought me a second camera to test my thoughts and I try to get a little Android-App running to initialize the camera. Maybe there is a way to get things running without an app, but that I have to try later. |
|
Little Update. Programmed an android app so far which get the Wlan credentials to the camera. After a reboot the cam says "Great, connected to router" and in fact it got an IP and is connected. Sadly after 30 seconds it says "Setup failed", do a reboot an clear all credentials. |
Have you tried: /?req=setup_wireless_save |
|
Nope I don't, because it's a generic app for more than the Kodak cam. The setup_wireless_save is the command for a doorbell, so I use another command on that point. I know it's the right command because the cam is connecting to my wlan after that :) |
|
I have started a React Native (iOS and Android apps) project to try and support this community further based upon all the great information in this thread. Feel free to get involved |
|
Does anyone have a breakdown of all the get_caminfo properties? |
|
Thanks @anthonycmain for your project. I'll contribute my learning about the app soon in your project. |
|
Just wanted to mention why I haven't looked more into these cameras. I've recently noticed firewall traffic viewing the camera feeds remotely. I took 2 of the 3 offline completely several weeks ago. I left 1 up just to watch if I could catch anything as a honeypot. Last night there was someone talking back through the last camera I kept online for this. Just a couple seconds, it sounded like they were reading off part of an IP address. My firewall only allows outbound connections to what used to be perimitersafe's IP's and ports. Just out of curiosity does anyone heard what happened to that companies servers and software after bankruptcy? Someone had to have gotten it and used it. |
Very interesting - timing also. My wife's iPhone has quite recently notified her - via Passwords app - that her account / password at kodaksmarthome.com is probably compromised. To quote: 'This password has appeared in a data leak, which puts this account at high risk of compromise. You should change your password immediately.' I'm not sure if this password - not that complicated though, but still - has just been coincidentally matched to this service, or there's more to it...? On the other hand, am 99.9% sure it's not been reused elsewhere. Needless to say, there might be more to this story, with Kodak suddenly winding down this part of their business last year, than meets the eye. |
Does that mean you know what the camera feed urls are? |
|
Just want to add that the c525 camera and official kodak app are still working in Australia. They went down for a few weeks late last year but have been mostly working since then. |
just happened to have stumbeld upon the note on top of that page: |
and others
I know this is a stale project, but I wanted to provide URL’s that are available if you want to add features to this integration. I can’t find anyone else interested in these findings.
These are all local, using the IP of the camera. Works against c525’s.
/?req=get_mac_address
/?req=melody_vol &value=2
/?req=get_caminfo
/?req=get_pu_signal_strength
/?req=set_flipup&value=1 (1=ceiling mount, 0 normal.)
/?req=set_flicker&value=50 (value in hertz 50 or 60)
/?req=set_night_vision&value=0 (0=auto, 1=on, 2=off)
/?req=set_motion_source&value=0&schedule=0 (0=off, 1=on, )
/?req=set_motion_sensitivity&value=1 (low=1, medium=3, high=5)
/?req=set_motion_storage&value=1 (1=cloud, 0=SD)
/?req=set_motion_snapshot_storage&value=1 (1=cloud upload, 0=off)
/?req=auto_rm_clip&value=0&clips=10 (0=don’t delete 1=delete)
/?req=set_sound_detection&value=0&sensitivity=1&schedule=0 (0=off, 1=on, )
/?req=set_sound_detection&value=1&sensitivity=3 (1=low, 3=medium, 5=high)
/?req=set_temp_detection&value=0&type=3 (0=off, 1=on)
/?req=set_resolution&value=480 (480=normal. 720=HD)
/?req=set_blue_led&enable=0&on_time=180&red_led_affect=0 (0=off, 1=on)
/?req=homemode_advise_setting&interval=1440&threshold=20&enable=1 (0=disable, 1=enable)
/?req=pair_stop&silence=1 (restart camera)
/?req=get_temp_humid
req=set_sec_type&value=1
/?req=get_session_key&mode=local&port1=55390&ip=xxx.xxx.xxx.xxx&streamname=C9CBBB22B6E94B43DDD160209C2XXX_8
With the session key URL this returns a valid SIP based live video feed with the key to authenticate with.
The text was updated successfully, but these errors were encountered: