-
Notifications
You must be signed in to change notification settings - Fork 571
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for Imou Cell 3C - IPC-K9DCP-3T0WE-V2 #1540
Comments
Some more progress on my quest to get this working - this appears to indeed be a DAHUA/DVRIP protocol initialisation - when using the Dahua ConfigTool, I can see every packet starting with {
"result": true,
"params": {
"users": [
{
"Id": 1,
"Name": "admin",
"Group": "admin",
"ClientType": "RemoteRPC",
"ClientAddress": "<myIp>",
"LoginTime": "2025-01-07 01:13:57"
},
{
"Id": 2,
"Name": "admin",
"Group": "admin",
"ClientType": "DVRIP",
"ClientAddress": "<ConfigToolHostIP>",
"LoginTime": "2025-01-07 01:05:41"
}
]
},
"id": 2,
"session": 2345242923
}
So by the looks of it, there seem to be a listener mode for DVRIP. Is that something you are supporting/have some tip to help me implementing it? |
Every supported DVRIP chunk starts with Lines 155 to 170 in 33e0ccd
|
Thanks for your reply! I continued the reverse engineer, and this seems to be indeed a Dahua DVRIP socket which can be used to acquire video stream when the camera wakes up. I have published a gist with a PoC, in case you/someone from the community would you like to add support for this listening/consumer approach model in go2rtc. Personally, I have decided to get rid of these devices because the rest of the configuration, event management and status seems to follow a fully bespoke protocol, over the IMOU MQTT, and the not the standard Dahua system (although the device embed it...). For anyone reading this, I suspect the MQTT encoded messages should be fairly trivial to de-cypher since messages appear to be using a static salt. |
Hi team, thank you for all your effort to support these pesky little devices.
I have recently acquired an Imou Cell 3C and I'm trying to make them work without IMOU shady cloud. Using the Dahua console, I was able to extract the
DVRIP
config, which I seem to be able to editOn
10.42.0.1
, I ran anetcat
on9500
and every time the camera activate itself due to motion, I get the following data over TCP (prettify withxxd
)Does that look like anything I can use? Other than this, the device seem to perform service discovery on an API over HTTPS, and connect to an arbitrary MQTT server in plain text, although messages seems to be encrypted. Once a detection is performed, it seems to send the video clip via and HTTP POST to a web server in clear (yuk), alongside an MQTT message.
If I can use that DVRIP-like protocol, my plan is to block the connectivity to public internet to the device and just collect video clip
Appreciate this is not much to go about, but I'd thought I'll give it a go before I send those monsters back to the retailer.
The text was updated successfully, but these errors were encountered: