guino / lsc1080p Goto Github PK

Hi there,
Sorry, maybe this is the wrong place to ask the question, but this is the best I could find so far.

Issue: my camera has ONVIF support, but as soon as I turn off it's access to the Internet - RTSP and ONVIF stop working in a short period of time. RTSP can be accessed on rtsp://IP:8554/main and rtsp://IP:8554/sub. No sound.
As this is a camera in the bedroom, I prefer it to be disconnected from the internet and connected only to local Zoneminder server.

This is the camera:

Works with the app Smart Life.
Version: V8.37.5

I could turn on ONVIF support and get urls via Onvif Device Manager. VLC shows streams without sound.
When I thought that setup is finished and cut the internet for the camera - in a short while everything stopped working. It seems that the camera tries to get settings from the server and goes back to defaults when it can't connect.

I couldn't find the way to enable http access on 80 or 8090 as described here: guino/BazzDoorbell#2

However, I managed to enable telnet by uploading the file 'product.cof' with telnet=1 option.
Login root password dgiot010 got me the access to the system.
There I can see BusyBox v1.26.2 (2022-06-29 19:04:37 CST) built-in shell (ash)

So, I'm asking questions here as this is the first place where I could to something with this camera :)

Can you please point me to the direction where I can find out and maybe fix the issue?
Thanks.

Hey. I have been following your work lately. I was able to patch some lines in order to use the camera offline.
Seems you have more experience reverse engineering stuff. I am frustrated that the vendor did not added an audio stream to the RTSP stream. I also found out it is using the LIVE555 library to provide RTSP functionality. Furthermore I found the lines where the streams are created using Ghidra, but sadly not enough experience to patch some audio in it.

If you interested I can donate one camera for you, since you have bricked yours.
By the way I was able to get into uboot, to flash the chip. Just short 2 pins during boot and you get into the bootloader.

I don't know where things went wrong. I played around a bit with some of these sd-card based hacks. But it seems I completely locked myself out, although the device still works in the tuya (smart-life) app. I know that before I started, I could get some data using http://admin:admin@IP:8090/devices/deviceinfo, and similar addresses. Now those don't work anymore.

To be clear, I'm not certain it was this mod/hack that caused it, but as it addresses the exact model I got, I thought I'd ask here if anybody knows how I could get it working again?

I also ran NMap, and it only reports port 6668 (irc).

I got 3 of those:

And found that FW structure is very much like you described in this repo. Putting product.cof on sdcard helped with obtaining telnet and creds are working. Current FW version is 5.2.7(MCU as well). You mentioned RTSP is already working for your device. Could you maybe help obtaining RTSP for my device as well?
Here is the firmware I dumped: https://mega.nz/folder/eeZk0QSB#HUh2Q7p-OytEX52cmvk68g

Hi, first of all thanks for all the work you've done.
The procedure works fine except there is an error in the custom.sh
on line 4: mnt/busybox httpd -c /mnt/httpd.conf -h /mnt/ -p 8080
should be /mnt/busybox httpd -c /mnt/httpd.conf -h /mnt/ -p 8080

Also you might want to mention in the decription that the files on the SD should be made read-only as all files are wiped otherwise (as least on the version I bought today).

It's a shame there isn't a way to make the script start automatically. I have a scheduled script running on my raspberry for it so it works, but it's not ideal.
Thank you for it tho!