Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for Imou Cell 3C - IPC-K9DCP-3T0WE-V2 #1540

Closed
acolombier opened this issue Jan 7, 2025 · 3 comments
Closed

Support for Imou Cell 3C - IPC-K9DCP-3T0WE-V2 #1540

acolombier opened this issue Jan 7, 2025 · 3 comments
Labels
question Further information is requested

Comments

@acolombier
Copy link

Hi team, thank you for all your effort to support these pesky little devices.

I have recently acquired an Imou Cell 3C and I'm trying to make them work without IMOU shady cloud. Using the Dahua console, I was able to extract the DVRIP config, which I seem to be able to edit

{
    "params": {
        "table": {
            "TCPPort": 37777,
            "UDPPort": 37778,
            "MCASTAddress": "",
            "MCASTEnable": false,
            "MCASTPort": 0,
            "MaxConnections": 10,
            "RegisterServer": {
                "DeviceID": "(omitted, S/N)",
                "Enable": true,
                "Servers": [
                    {
                        "Address": "10.42.0.1",
                        "Port": 9500
                    }
                ]
            },
            "StreamPolicy": "None"
        }
    }
}

On 10.42.0.1, I ran a netcat on 9500 and every time the camera activate itself due to motion, I get the following data over TCP (prettify with xxd)

00000000: b400 0078 4000 0000 0700 0000 0000 0000  ...x@...........
00000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000020: .... .... .... .... .... .... .... ..00  (omitted, S/N ).
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................

Does that look like anything I can use? Other than this, the device seem to perform service discovery on an API over HTTPS, and connect to an arbitrary MQTT server in plain text, although messages seems to be encrypted. Once a detection is performed, it seems to send the video clip via and HTTP POST to a web server in clear (yuk), alongside an MQTT message.

If I can use that DVRIP-like protocol, my plan is to block the connectivity to public internet to the device and just collect video clip

Appreciate this is not much to go about, but I'd thought I'll give it a go before I send those monsters back to the retailer.

@acolombier
Copy link
Author

acolombier commented Jan 7, 2025

Some more progress on my quest to get this working - this appears to indeed be a DAHUA/DVRIP protocol initialisation - when using the Dahua ConfigTool, I can see every packet starting with b400 0078 as well. Furthermore, while streaming in ConfigTool, when I login on the DahuaCOnsole, I can see the following

{
  "result": true,
  "params": {
    "users": [
      {
        "Id": 1,
        "Name": "admin",
        "Group": "admin",
        "ClientType": "RemoteRPC",
        "ClientAddress": "<myIp>",
        "LoginTime": "2025-01-07 01:13:57"
      },
      {
        "Id": 2,
        "Name": "admin",
        "Group": "admin",
        "ClientType": "DVRIP",
        "ClientAddress": "<ConfigToolHostIP>",
        "LoginTime": "2025-01-07 01:05:41"
      }
    ]
  },
  "id": 2,
  "session": 2345242923
}

So by the looks of it, there seem to be a listener mode for DVRIP. Is that something you are supporting/have some tip to help me implementing it?

@AlexxIT AlexxIT added the question Further information is requested label Jan 7, 2025
@AlexxIT
Copy link
Owner

AlexxIT commented Jan 7, 2025

Every supported DVRIP chunk starts with 0xFF

go2rtc/pkg/dvrip/client.go

Lines 155 to 170 in 33e0ccd

b = make([]byte, 20)
if _, err = io.ReadFull(c.rd, b); err != nil {
return
}
if b[0] != 255 {
return nil, errors.New("read error")
}
c.session = binary.LittleEndian.Uint32(b[4:])
size := binary.LittleEndian.Uint32(b[16:])
b = make([]byte, size)
if _, err = io.ReadFull(c.rd, b); err != nil {
return
}

@acolombier
Copy link
Author

Thanks for your reply! I continued the reverse engineer, and this seems to be indeed a Dahua DVRIP socket which can be used to acquire video stream when the camera wakes up. I have published a gist with a PoC, in case you/someone from the community would you like to add support for this listening/consumer approach model in go2rtc.

Personally, I have decided to get rid of these devices because the rest of the configuration, event management and status seems to follow a fully bespoke protocol, over the IMOU MQTT, and the not the standard Dahua system (although the device embed it...). For anyone reading this, I suspect the MQTT encoded messages should be fairly trivial to de-cypher since messages appear to be using a static salt.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

2 participants