Hacking the XiaomiFang Wifi camera

Only a FAT filesystem will work, FAT32 will not work (at least in my case).

I couldn’t get it working with FAT32, and I couldn’t format a 16 GB SD card with FAT, so I made a 100 mb partition at the front of the SD card, formatted that with FAT, and was able to get my camera flashed.

Thank you very much for such interesting idea… but probably I’ve found a “bug”.

When the rtspserver is not running there is not any PID and never their state change would be “off” in your code. Is it correct?

Code might not be 100% perfect (this is actually not mine, it is @lolouk44), but it still works properly.

Try it, but if I stop v4l2rtspserver-master manually, Home Assistant switch is updated correspondingly.

i think i missing something, how can i get a flipped stream? there is now toggle for that on camera page.

what do you mean by “flipped stream”?

my camera is upside down, so i need to flip stream. i can get flipped image, but not the stream

the test is on the length of the PID.
If the rtspserver is not running then there is no PID and therefore the string that would otherwise contain the PID is empty,(so with a length of 0).
Hope that makes sense.

I now understand. This is one of the reasons I use motion to pull the stream from the dafang cameras. There’s a built-in function to rotate the feed.
if you use ffmpeg, you can use these parameters -vf "transpose=2,transpose=2" though not sure if it’s directly supported within HA

1 Like

There is the possibility to downgrade to older firmware and upload the hack using an SD card only in currently available versions of the camera? For example https://www.banggood.com/Original-Xiaomi-Mijia-XiaoFang-Smart-Home-WIFI-IP-Camera-110-Degree-1080P-FHD-IR-cut-Motion-Detectio-p-1209061.html

Not sure I fully understand your question, but the Xiaomi DaFang camera is different than the XiaoFang. If you want to hack the XiaoFang, you need to follow instructions on this thread:

Yes, but in issues discussions there is a lot information that Chinese-only version of cameras have new software so you can not hack camera using an SD card and you need to use a serial connection to downgrade version of firmware. I am just wondering whether the newly purchased camera can be hacked using the SD card only?

That’s a good question, one that I do not know the answer to. I’ve bought my DaFang cameras last summer and not had any issues, but not sure about new cams. I know @Bob_NL had an issue trying to flash one of his cams, but not sure if it was due to a newer version of the cam that was locked down or something else. You may want to ask him directly.

I was having some trouble flashing the firmware on one of the cameras. Thanks to the help of @lolouk44 I fanally managed to flash the firmware on a different camera (which I bought several months later). This camera is running firmware Unfortunately I was not able to start the RTSP stream (page simply wasn’t available) and I didn’t find the time yet to really dive into it.

The camera which I was not able to flash is running the same firmware…


It’s working, thanks a lot!

Someone is able to create a custom ui for this camera ?
for example by adding the keys for controlling the motor or leds

I thought I’d update you all on improvements to the custom firmware on the Dafang, there is now an MQTT function allowing the control of the camera, much better than my “hacked” shell files.
You’ll need to edit the file firmware_mod\config\mqtt.dist to add your MQTT settings, then rename the file into mqtt
Once done, browse to your camera IP address and click on manage scripts
Then start and enable scripts for both mqtt-control and mqtt-status:

Now head over to your config file in HA and add these:

- platform: mqtt
  name: "DaFang Living Room RTSP"
  state_topic: "LivingRoom/DaFang/status"
  value_template: "{% if value_json[\"RTSP-Server\"] == 'running' %}h264_noseg_start{% else %}rtsp_stop{% endif %}"
  command_topic: "LivingRoom/DaFang/set"
  payload_on: "h264_noseg_start"
  payload_off: "rtsp_stop"
  optimistic: false

- platform: mqtt
  name: "Dafang Living Room Blue LED"
  state_topic: "LivingRoom/DaFang/status"
  value_template: "{% if value_json.LEDs.Blue == 'on' %}blue_led_on{% else %}blue_led_off{% endif %}"
  command_topic: "LivingRoom/DaFang/set"
  payload_on: "blue_led_on"
  payload_off: "blue_led_off"
  optimistic: false

- platform: mqtt
  name: "Dafang Living Room Yellow LED"
  state_topic: "LivingRoom/DaFang/status"
  value_template: "{% if value_json.LEDs.Yellow == 'on' %}yellow_led_on{% else %}yellow_led_off{% endif %}"
  command_topic: "LivingRoom/DaFang/set"
  payload_on: "yellow_led_on"
  payload_off: "yellow_led_off"
  optimistic: false

I’ve not added the IR-Cut or IR-LED, but the process is the same
and the same can be done to control the motor. Technically there would be no need for state_topic nor value_template, but then the switch would be rendered differently (the flash icon set) and would not revert back to off once pressed, though that could always be changed with an automation…
so here is the code I’m using for the down command:

- platform: mqtt
  name: "Dafang Kitchen Down"
  state_topic: "Kitchen/DaFang/status"
  command_topic: "Kitchen/DaFang/set"
  payload_on: "motor_down"
  optimistic: false

Note it takes about 1 sec for the switch to go back to off, so maybe an automation is needed for impatient users :slight_smile:
alternatively, removing the state_topic and value_template will show flash icons for controls, so it’s technically possible to use just 1 switch to control both directions: off = left, on = right. Only thing is I don’t know if if it is possible to change these icons, but here’s how I’ve down it:

- platform: mqtt
 name: "Dafang Living Room Left Right"
 command_topic: "LivingRoom/DaFang/set"
 payload_off: "motor_left"
 payload_on: "motor_right"
 optimistic: false

Here’s the result:


So @lolouk44 I followed your instructions.


and in motion:

netcam_url rtsp://192.168.x.x:8554/unicast

And its not working… Am I doing something wrong? o.o

If it’s not working you probably did something wrong :wink:
Let’s see… First of all, if you’ve set up motion, you should then be able to see the stream by going to the ip of the box where motion runs, use port 8080.
If you do, then click on the stream and you’ll get the stream ip address. That’s the address you need to enter in HA
Let me know how this goes

So the IP, I put in my motion.conf is the ip i find on the Webpage off my hacked Dafang right? Do I have to change anything else in that motion.conf file?

Where did u find dafang Matt? I’m running dafang hqcackk but have no mqtt …could u link me to thus repo?