Hacking the XiaomiFang Wifi camera

Yes, but in issues discussions there is a lot information that Chinese-only version of cameras have new software so you can not hack camera using an SD card and you need to use a serial connection to downgrade version of firmware. I am just wondering whether the newly purchased camera can be hacked using the SD card only?

That’s a good question, one that I do not know the answer to. I’ve bought my DaFang cameras last summer and not had any issues, but not sure about new cams. I know @Bob_NL had an issue trying to flash one of his cams, but not sure if it was due to a newer version of the cam that was locked down or something else. You may want to ask him directly.

I was having some trouble flashing the firmware on one of the cameras. Thanks to the help of @lolouk44 I fanally managed to flash the firmware on a different camera (which I bought several months later). This camera is running firmware Unfortunately I was not able to start the RTSP stream (page simply wasn’t available) and I didn’t find the time yet to really dive into it.

The camera which I was not able to flash is running the same firmware…


It’s working, thanks a lot!

Someone is able to create a custom ui for this camera ?
for example by adding the keys for controlling the motor or leds

I thought I’d update you all on improvements to the custom firmware on the Dafang, there is now an MQTT function allowing the control of the camera, much better than my “hacked” shell files.
You’ll need to edit the file firmware_mod\config\mqtt.dist to add your MQTT settings, then rename the file into mqtt
Once done, browse to your camera IP address and click on manage scripts
Then start and enable scripts for both mqtt-control and mqtt-status:

Now head over to your config file in HA and add these:

- platform: mqtt
  name: "DaFang Living Room RTSP"
  state_topic: "LivingRoom/DaFang/status"
  value_template: "{% if value_json[\"RTSP-Server\"] == 'running' %}h264_noseg_start{% else %}rtsp_stop{% endif %}"
  command_topic: "LivingRoom/DaFang/set"
  payload_on: "h264_noseg_start"
  payload_off: "rtsp_stop"
  optimistic: false

- platform: mqtt
  name: "Dafang Living Room Blue LED"
  state_topic: "LivingRoom/DaFang/status"
  value_template: "{% if value_json.LEDs.Blue == 'on' %}blue_led_on{% else %}blue_led_off{% endif %}"
  command_topic: "LivingRoom/DaFang/set"
  payload_on: "blue_led_on"
  payload_off: "blue_led_off"
  optimistic: false

- platform: mqtt
  name: "Dafang Living Room Yellow LED"
  state_topic: "LivingRoom/DaFang/status"
  value_template: "{% if value_json.LEDs.Yellow == 'on' %}yellow_led_on{% else %}yellow_led_off{% endif %}"
  command_topic: "LivingRoom/DaFang/set"
  payload_on: "yellow_led_on"
  payload_off: "yellow_led_off"
  optimistic: false

I’ve not added the IR-Cut or IR-LED, but the process is the same
and the same can be done to control the motor. Technically there would be no need for state_topic nor value_template, but then the switch would be rendered differently (the flash icon set) and would not revert back to off once pressed, though that could always be changed with an automation…
so here is the code I’m using for the down command:

- platform: mqtt
  name: "Dafang Kitchen Down"
  state_topic: "Kitchen/DaFang/status"
  command_topic: "Kitchen/DaFang/set"
  payload_on: "motor_down"
  optimistic: false

Note it takes about 1 sec for the switch to go back to off, so maybe an automation is needed for impatient users :slight_smile:
alternatively, removing the state_topic and value_template will show flash icons for controls, so it’s technically possible to use just 1 switch to control both directions: off = left, on = right. Only thing is I don’t know if if it is possible to change these icons, but here’s how I’ve down it:

- platform: mqtt
 name: "Dafang Living Room Left Right"
 command_topic: "LivingRoom/DaFang/set"
 payload_off: "motor_left"
 payload_on: "motor_right"
 optimistic: false

Here’s the result:


So @lolouk44 I followed your instructions.


and in motion:

netcam_url rtsp://192.168.x.x:8554/unicast

And its not working… Am I doing something wrong? o.o

If it’s not working you probably did something wrong :wink:
Let’s see… First of all, if you’ve set up motion, you should then be able to see the stream by going to the ip of the box where motion runs, use port 8080.
If you do, then click on the stream and you’ll get the stream ip address. That’s the address you need to enter in HA
Let me know how this goes

So the IP, I put in my motion.conf is the ip i find on the Webpage off my hacked Dafang right? Do I have to change anything else in that motion.conf file?

Where did u find dafang Matt? I’m running dafang hqcackk but have no mqtt …could u link me to thus repo?

The main settings that you need would be (these are examples):

netcam_url rtsp:// (IP of the Dafang)
stream_port 8081(1 port per camera, so next cam would 8082 for example)
stream_maxrate 5 this is the max frame rate for the stream (the recording would be at full frame rate)
stream_localhost off this is to ensure you can also access the stream on a different machine than the one where motion is running.

The other options you can change to suit your needs (e.g. record on motion detection or not, whether you want text / timestamp etc to be displayed on the video, where you’ll save the recordings,…)
Probably best to check this page for more info on the config options.

Hi @thundergreen

Check the content of the firmware_mod\config\mqtt.dist file for more info

Sorry…my dumb fault. I don’t have dafang… But I’ll buy some right now …absolutely great with mqtt.thanks a lot!

Yea… everything is configured that way… Could there be a problem with me having a ssl certificate?

I started motion via “sudo motion start” and then tried to open “http://raspberryip:8081/” and it’s says ERR_CONNECTION_REFUSED.

if you get a connection refused it’s either before your stream is limited to localhost, so make sure you have stream_localhost off.
Another way to check is to log on the server that runs motion, open a web browser then see if you can access http://localhost:8080 and if you can access http://IP-Address:8080
If both fail, make sure you’ve restricted access to registered users (see here) at least for setup. You can always lock down later as you wish

Yea both are not working still “ERR_CONNECTION_REFUSED”.

So I have to set a passowrd for webcontrol_authentication? I have done that and it’s still not working… I am still thinking it’s not working cause off HTTPS?

By default motion is not using https… So yes try without https…

So the thing is my HA is using https by default, so i can use it secure when i am not at home, so how could I do it without https?

Hi Wibias,

Just invited you to discord for a chat, would be easier.
In the meantime, https from HA has nothing to do with motion
For now you need to forget HA while trying to set motion up.
I’m logged on discord now if you’re available.


Hi I have order a Dafang camera its in the way.
When I read the install it says:
The microSD card you have to format in FAT
I have a 8GB sdcard I can’t format in FAT but in FAT32 should it work?