Hacking the XiaomiFang Wifi camera

you won’t see anything while you hold the button if I remember well (been a couple of months now)
Hold the button, power the camera, wait like 5 sec and release the button, then wait
when the camera spins, take power off and that should be it.

how long will this approx. take?

Thank you for your help but I have one question:

Which one is the port in this URL?
mjpeg_url: http://192.168.x.x:808x

Hacked camera is working always in 8854 port. Isn’t?

Hi @Pharizna,

It all depends on what you use to get the initial feed. In my post I wrote this:
If connecting from HA directly, use this config:

- platform: ffmpeg
  name: Cam
  input: -rtsp_transport tcp -i rtsp://192.168.x.x:8554/unicast

if using motion in the middle, your config should look like this:

- platform: mjpeg
  mjpeg_url: http://192.168.x.x:808x
  name: Cam

(If you use motion you’ll have to set rtsp://192.168.x.x:8554/unicast as your camera feed for the netcam_url setting

so it you use motion you can set the port on which you’ll stream with setting stream_port

Following your great ideas, I did a more lightweight solution.

I have abandoned scrape sensors (every time a timeout occurred, HASS log was terribly polluted), and used a single command_line sensor using curl with a scan_interval of 60 seconds (even though scrape sensors are usually refreshed every 30 seconds, I thought 60 was more than enough).

In my all.cgi file (placed in the same folder as yours), I bundled everything you had in your separate cgi files and outputted a list of all values separated by commas:

#!/bin/sh

echo "Content-type: text/plain"
echo ""

getgpio(){
GPIOPIN=$1
cat /sys/class/gpio/gpio$GPIOPIN/value
}

# Blue Led
blue=$(getgpio 39)
# Yellow Led
yellow=$(getgpio 38)
# IR Cut
ir_cut=$(getgpio 26)
# IR Led
ir_led=$(getgpio 49)
# RTSP status
string=$(pidof v4l2rtspserver-master)
if [[ ${#string} == "0" ]]; then
  rtsp="off"
else
  rstp="on"
fi
echo $blue,$yellow,$ir_cut,$ir_led,$rstp

and then in terms of HA configuration:

  - platform: command_line
    name: dafang_status
    command: "/usr/bin/curl -s -X GET -H\"Content-Type:text/plain\" http://Dafang_IP/cgi-bin/all.cgi"
    scan_interval: 60

  - platform: template
    sensors:
      dafang_blue_led_status:
        value_template: "{{ states.sensor.dafang_status.state.split(',')[0] }}"
      dafang_yellow_led_status:
        value_template: "{{ states.sensor.dafang_status.state.split(',')[1] }}"
      dafang_ir_led_status:
        value_template: "{{ states.sensor.dafang_status.state.split(',')[2] }}"
      dafang_ir_cut_status:
        value_template: "{{ states.sensor.dafang_status.state.split(',')[3] }}"
      dafang_rtsp_status:
        value_template: "{{ states.sensor.dafang_status.state.split(',')[4] }}"

In terms of the remaining (switch templates + command line/scripts), I followed your idea.

This way, we can achieve the same you have but with a single curl call every minute, instead of call per scrape sensor every 30 seconds.

Hope this is useful.

1 Like

Would you be able to share a bit more about the motion implementation you did? Settings, etc.

I’m curious to see how it behaves.

Btw, where are you saving motion’s detections (pictures/videos)? In the camera SD card or in some other place (Rpi SD card)?

Thanks for any insights.

For motion, settings depend on what you want to do. Best is to start with stock settings and add / amend as per your needs.
Check motion’s github page: https://github.com/Motion-Project/motion
All you’ll need is to add the RTSP Stream in the settings (rtsp://192.168.x.x:8554/unicast). You can define where you want the videos to be saved. I save them in my dropbox folder for added redundancy.

Only a FAT filesystem will work, FAT32 will not work (at least in my case).

I couldn’t get it working with FAT32, and I couldn’t format a 16 GB SD card with FAT, so I made a 100 mb partition at the front of the SD card, formatted that with FAT, and was able to get my camera flashed.

Thank you very much for such interesting idea… but probably I’ve found a “bug”.

When the rtspserver is not running there is not any PID and never their state change would be “off” in your code. Is it correct?

Code might not be 100% perfect (this is actually not mine, it is @lolouk44), but it still works properly.

Try it, but if I stop v4l2rtspserver-master manually, Home Assistant switch is updated correspondingly.

i think i missing something, how can i get a flipped stream? there is now toggle for that on camera page.

what do you mean by “flipped stream”?

my camera is upside down, so i need to flip stream. i can get flipped image, but not the stream

the test is on the length of the PID.
If the rtspserver is not running then there is no PID and therefore the string that would otherwise contain the PID is empty,(so with a length of 0).
Hope that makes sense.

I now understand. This is one of the reasons I use motion to pull the stream from the dafang cameras. There’s a built-in function to rotate the feed.
if you use ffmpeg, you can use these parameters -vf "transpose=2,transpose=2" though not sure if it’s directly supported within HA

1 Like

There is the possibility to downgrade to older firmware and upload the hack using an SD card only in currently available versions of the camera? For example https://www.banggood.com/Original-Xiaomi-Mijia-XiaoFang-Smart-Home-WIFI-IP-Camera-110-Degree-1080P-FHD-IR-cut-Motion-Detectio-p-1209061.html

Not sure I fully understand your question, but the Xiaomi DaFang camera is different than the XiaoFang. If you want to hack the XiaoFang, you need to follow instructions on this thread:

Yes, but in issues discussions there is a lot information that Chinese-only version of cameras have new software so you can not hack camera using an SD card and you need to use a serial connection to downgrade version of firmware. I am just wondering whether the newly purchased camera can be hacked using the SD card only?

That’s a good question, one that I do not know the answer to. I’ve bought my DaFang cameras last summer and not had any issues, but not sure about new cams. I know @Bob_NL had an issue trying to flash one of his cams, but not sure if it was due to a newer version of the cam that was locked down or something else. You may want to ask him directly.