Hacking the XiaomiFang Wifi camera

runtman · April 13, 2018, 5:53pm

Hello, so I have the camera setup (Thank you!) However I appear to be struggling with the home assistant controls.

The image is working however the motor and lights are not.

When watching my MQTT monitor, I can see the camera posting to the server, and if I use the home assistant tool I can post to the server and also see it, however my switches do not work.

Here are my switches:

  - platform: mqtt
name: "DaFang Living Room RTSP"
state_topic: "Downstairs/HomeCamera1/status"
value_template: "{% if value_json[\"RTSP-Server\"] == 'running' %}h264_noseg_start{% else %}rtsp_stop{% endif %}"
command_topic: "Downstairs/HomeCamera1/set"
payload_on: "h264_noseg_start"
payload_off: "rtsp_stop"
optimistic: false

  - platform: mqtt
    name: "Dafang Living Room Up Down"
    command_topic: "Downstairs/HomeCamera1/set"
    payload_off: "motor_up"
    payload_on: "motor_down"
    optimistic: false

  - platform: mqtt
    name: "Dafang Living Room Left Right"
    command_topic: "Downstairs/HomeCamera1/set"
    payload_off: "motor_left"
    payload_on: "motor_right"
    optimistic: false


    light:
      - platform: mqtt
        name: "Dafang Living Room Blue LED"
        state_topic: "Downstairs/HomeCamera1/status"
        value_template: "{% if value_json.LEDs.Blue == 'on' %}blue_led_on{% else %}blue_led_off{% endif %}"
        command_topic: "Downstairs/HomeCamera1/set"
        payload_on: "blue_led_on"
        payload_off: "blue_led_off"
        optimistic: false
      - platform: mqtt
        name: "Dafang Living Room Yellow LED"
        state_topic: "Downstairs/HomeCamera1/status"
        value_template: "{% if value_json.LEDs.Yellow == 'on' %}yellow_led_on{% else %}yellow_led_off{% endif %}"
        command_topic: "Downstairs/HomeCamera1/set"
        payload_on: "yellow_led_on"
        payload_off: "yellow_led_off"
        optimistic: false

Does anyone have any idea why the buttons don’t appear to move the camera?

jmtatsch · April 14, 2018, 7:41am

In automations.yaml define something like this:

- action:
  - data:
      message: detected
      title: motion
    service: notify.me
  alias: motion detector
  condition: []
  id: '9522507257594'
  trigger:
  - payload: 'ON'
    platform: mqtt
    topic: myhome/dafang3/motion

jmtatsch · April 14, 2018, 7:51am

To control leds and rtsp please use the new mqtt autodiscovery feature. You may need my open PR to publish the configuration though.

Concerning the motor controls, it should still work from what i see. you may need to debug into it.

runtman · April 14, 2018, 1:07pm

Can I see your PR? I am using mosquitto currently, are you suggesting to not use this anymore? The auto discovery appears to bind to 0.0.0.0, which I rather it find to the internal IP of the server.

jmtatsch · April 15, 2018, 7:08am

My PR was already merged, so I guess everything should work out of the box now. Of course you can use mosquitto as broker (i do too), just make sure your host, port etc is set accordingly in mqtt.conf.

runtman · April 15, 2018, 9:43am

The broker appears to work fine and I can see the cameras connecting to the broke and disconnecting in the mosquito log, for some reason the topics are not co-operating.

I have the topic in homeassistant as: command_topic: "Downstairs/HomeCamera2/set

I have the topic on the camera as:

# Define a location
LOCATION="Downstairs"

# Define device name
DEVICE_NAME="HomeCamera2"

# Define the base topic used by the camera
# send a message to myhome/dafang/set with the payload help for help.
# Results will be placed in myhome/dafang/${command} or topic/dafang/error - so please subscribe topic/dafang/# for testing purposes
TOPIC="$LOCATION/$DEVICE_NAME"

jmtatsch · April 15, 2018, 12:00pm

Please have a look on my new tutorial for home assistant integration:

github.com

jmtatsch/Xiaomi-Dafang-Hacks/blob/1933217a2fabeb4e312a8865146fb217eed76878/integration/homeassistant/homeassistant.md

## Xiaomi Dafang Integration in Home Assistant





### On the Home Assistant side

First let's set up your camera stream. Make sure the rtsp-h264 service in the [service control panel](http://dafang/cgi-bin/scripts.cgi) is running and you can connect to [it](rtsp://dafang:8554/unicast) via e.g. vlc player.

![service control panel](services_panel.png)

Then you can integrate the rtsp stream using the camera ffmpeg component by adding the following lines to your camera.yaml:

```yaml
- platform: ffmpeg
  name: DaFang3
  input: -rtsp_transport tcp -i rtsp://dafang:8554/unicast
```

This file has been truncated. show original

I will look into the motor control issue

jmtatsch · April 15, 2018, 12:40pm

I now understand your problem. For general commands like motor_up mqtt_control will call:
/system/sdcard/bin/curl -m 2 "${CURLOPTS}" -s http://127.0.0.1/cgi-bin/action.cgi?cmd="${COMMAND}" -o /dev/null 2>/dev/null
Calling on cgis sometimes seems to need credentials now, as a workaround in mqtt.conf set the following curl options
CURLOPTS="–user root:ismart12"
and restart mqtt-control
that should help.

thawizard · April 16, 2018, 3:01pm

Thanks everyone getting me this far for trying to connect Dafang with HA, especially @jmtatsch and his manual. I got rtsp working, but now i am stuck with establishing an mqtt connection from dafang. HA is telling me following

Invalid connection from (client @=dafang:53256) : [MQTT-3.1.2-1] Incorrect protocol name: "MQIsdp"

any ideas?

ladaowner · April 16, 2018, 5:09pm

getting this under services when I try to add MQTT services

Running script ‘mqtt-control’…
MQTT autodiscovery is enabled - now publishing initial configurations
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Warning: Unable to locate configuration directory, default config not loaded.
Error: The connection was lost.
Starting MQTT - Control

then I get no additional cameras (part from rtsp-h264) states

ladaowner · April 16, 2018, 5:12pm

me too

[MQTT-3.1.2-1] Incorrect protocol name: “MQIsdp”

however my MQTT tasmota light switches work fine so I know the inbuilt home assistant MQTT servers is working

Paxy · April 16, 2018, 5:14pm

Solved by installing separate MQTT server instance and connected HASS to it:

apt install mosquitto

Conf changed to:

mqtt:
broker: 127.0.0.1
discovery: true
discovery_prefix: homeassistant

ladaowner · April 16, 2018, 5:53pm

so to check you are saying that I will need to run my own MQTT server and not the home assistant inbuilt one. Pants because I just swapped from Mosquito to the inbuilt one.

Paxy · April 16, 2018, 6:07pm

That’s what I did to get Discovery working. You need to reset both mqtt services on dafang after each HASS reset.

ladaowner · April 16, 2018, 6:09pm

Confirmed switching back to Mosquito MQTT worked

Although this is a good work around not sure that it is the prefect answer.

runtman · April 16, 2018, 8:41pm

Thanks for the reply, I feel we are a step forward. Neither the LEDS or motors are working though, see below for some debugging on the motor.

If I look at the camera’s log when using home assistant and it’s own GUI I see this:

Using HomeAssistant (Does not work)

127.0.0.1 - - [16/Apr/2018:20:31:16 +0000] "GET /cgi-bin/action.cgi?cmd=motor_down&val=100 HTTP/1.1" 401 0 "-" "curl/7.59.0-DEV"
auth_check_userpass(Root,ismart12,...);

Using GUI (works)

192.168.0.100 - - [16/Apr/2018:20:31:47 +0000] "GET /cgi-bin/action.cgi?cmd=motor_down&val=100 HTTP/1.1" 200 169 "http://192.168.0.112/cgi-bin/status.cgi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36"
auth_check_userpass(Root,ismart12,...);

The only meaningful difference I notice is the source IP is localhost on the request from HA which doesn’t make much sense to me.

Regarding lights.
I see no log when using homeassistant but below is the working log from the cameras GUI

192.168.0.100 - - [16/Apr/2018:20:36:36 +0000] "GET /cgi-bin/action.cgi?cmd=blue_led_on HTTP/1.1" 200 108 "http://192.168.0.112/cgi-bin/status.cgi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36"
auth_check_userpass(Root,ismart12,...);

Here is my mqtt config (HA and camera) and my switches:

CameraConfig (MQTT)

CURLOPTS="–user root:ismart12"

export LD_LIBRARY_PATH='/thirdlib:/system/lib:/system/sdcard/lib'

# Options for mosquitto_sub & mosquitto_pub
USER=
PASS=
HOST=192.168.0.106
PORT=1883

# Define a location
LOCATION="Downstairs"

# Define device name
DEVICE_NAME="HomeCamera2"

# Define the base topic used by the camera
# send a message to myhome/dafang/set with the payload help for help.
# Results will be placed in myhome/dafang/${command} or topic/dafang/error - so please subscribe topic/dafang/# for testing purposes
TOPIC="$LOCATION/$DEVICE_NAME"

# Define an autodiscovery prefix, if autodiscovery is desired:
AUTODISCOVERY_PREFIX="homeassistant"

MOSQUITTOOPTS=""
# add Options for Mosquitto here. For example --cafile /system/sdcard/config/DST_Root_CA_X3.pem --tls-version tlsv1
# or using a special id to connect to brokers like azure
MOSQUITTOPUBOPTS=""
# add options for mosquitto_pub like -r for retaining messages
CURLOPTS=""
# add options for curl here e.g --user user:password
FIFO=/var/run/mqtt-sub
# the FIFO used. Change it if you like to
STATUSINTERVAL=30
# Send a mqtt statusupdate every 30 seconds
STATUSFORMAT=json
# Configure format of status. Standard is text, uncomment this line for json

Home Assistant MQTT Broker

mqtt:
  broker: 192.168.0.106
  port: 1883
  discovery: true
  discovery_prefix: homeassistant

HA Switches

  - platform: mqtt
    name: "Kitchen Blue LED"
    state_topic: "Downstairs/HomeCamera2/status"
    value_template: "{% if value_json.LEDs.Blue == 'on' %}blue_led_on{% else %}blue_led_off{% endif %}"
    command_topic: "Downstairs/HomeCamera1/set"
    payload_on: "blue_led_on"
    payload_off: "blue_led_off"
    optimistic: false
  - platform: mqtt
    name: "Kitchen Yellow LED"
    state_topic: "Downstairs/HomeCamera2/status"
    value_template: "{% if value_json.LEDs.Yellow == 'on' %}yellow_led_on{% else %}yellow_led_off{% endif %}"
    command_topic: "Downstairs/HomeCamera1/set"
    payload_on: "yellow_led_on"
    payload_off: "yellow_led_off"
    optimistic: false


  - platform: mqtt
    name: "Kitchen Up Down"
    command_topic: "Downstairs/HomeCamera2/set"
    payload_off: "motor_up&val=100"
    payload_on: "motor_down&val=100"
    optimistic: false

  - platform: mqtt
    name: "Kitchen Left Right"
    command_topic: "Downstairs/HomeCamera2/set"
    payload_off: "motor_left"
    payload_on: "motor_right"
    optimistic: false

Worth noting I had to use mosquito as I saw this error when leaving out the broker ip

Invalid connection from (client @=dafang:53256) : [MQTT-3.1.2-1] Incorrect protocol name: "MQIsdp"

thawizard · April 16, 2018, 10:08pm

It says 401, that means access was unauthorized. HA is not able to send commands because the camera is pass-protected. I had the same error as well.
You need to edit following to mqtt.conf in Dafang…

# Add options for curl here e.g --user user:password
CURLOPTS="--user root:ismart12"

This will work

thawizard · April 16, 2018, 10:16pm

@runtman I see you already had

# CURLOPTS="–user root:ismart12"

“-user” needs to be with 2 dashes (–user) though. Further down you have it again

# Add options for curl here e.g --user user:password
CURLOPTS=""

Better replace with the first line or comment it out.

runtman · April 16, 2018, 10:32pm

Good spot.

I just changed it, it’s gotten even more strange now:

GUI Working

192.168.0.100 - - [16/Apr/2018:22:30:24 +0000] "GET /cgi-bin/action.cgi?cmd=motor_down&val=100 HTTP/1.1" 200 168 "http://192.168.0.112/cgi-bin/status.cgi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36"
auth_check_userpass(Root,ismart12,...);

Home Assistant (Not working)

127.0.0.1 - - [16/Apr/2018:22:30:41 +0000] "GET /cgi-bin/action.cgi?cmd=motor_down&val=100 HTTP/1.1" 401 0 "-" "curl/7.59.0-DEV"

Config:

############################################################
# edit this file and move it to /system/sdcard/config/mqtt.conf #
############################################################

export LD_LIBRARY_PATH='/thirdlib:/system/lib:/system/sdcard/lib'

# Options for mosquitto_sub & mosquitto_pub
USER=
PASS=
HOST=192.168.0.106
PORT=1883

# Define a location
LOCATION="Downstairs"

# Define device name
DEVICE_NAME="HomeCamera2"

# Define the base topic used by the camera
# send a message to myhome/dafang/set with the payload help for help.
# Results will be placed in myhome/dafang/${command} or topic/dafang/error - so please subscribe topic/dafang/# for testing purposes
TOPIC="$LOCATION/$DEVICE_NAME"

# Define an autodiscovery prefix, if autodiscovery is desired:
AUTODISCOVERY_PREFIX="homeassistant"

MOSQUITTOOPTS=""
# add Options for Mosquitto here. For example --cafile /system/sdcard/config/DST_Root_CA_X3.pem --tls-version tlsv1
# or using a special id to connect to brokers like azure
MOSQUITTOPUBOPTS=""
# add options for mosquitto_pub like -r for retaining messages

CURLOPTS="–-user root:ismart12"

FIFO=/var/run/mqtt-sub
# the FIFO used. Change it if you like to
STATUSINTERVAL=30
# Send a mqtt statusupdate every 30 seconds
STATUSFORMAT=json
# Configure format of status. Standard is text, uncomment this line for json

runtman · April 16, 2018, 10:39pm

After a reboot of HA, it’s working! Now it’s only the LED buttons that don’t work.

Edit: It was a minor config error however if I enable the blue LED it only stays on for like 3 seconds then goes back to Yellow.