Hello everybody, this is my first post here, so i hope that the section is correct.
I’m a computer science student that loves home automation 
Some month ago i bought 2 cheap chinese outdoor IP cameras for my parents and i would like to integrate them with a home assistant server that i made at their house. However, due to the lack of any REST API, is quite hard to generate the URL to access the camera’s images or video.
Description
The aim of this project is to understand how the INKERSCOOP cameras or in general the cameras managed by the MIPC platform communicates, in order to integrate them into Home Assistant. playstore, apk, mipc website.
MIPC is a chinese software used to controll some security cameras.
The camera that i bought is an INKERSCOOP 720P IP Outdoor WIFI camera, the installation procedure went smoothly, the build quality is good and the image quality (both in day and night mode) is pretty good for the price, so I’m overall satisfied of my purchase. The only main drawback is that it is extremely hard to connect the camera to other platforms due to the lack of any public API.
Progress so far
I’m still not capable of opening the video stream, but i made some progress with the snapshot (single frame).
I discovered that the URL of the image has this format:
http://<IP>/ccm/ccm_pic_get.jpg?hfrom_handle=887330&dsess=1&dsess_nid=<TOKEN>&dsess_sn=<USERNAME>&dtoken=p0_xxxxxxxxxx
If I use the link above into the generic ip camera component of Home Assistant i can obtain around 2fps, obviously not as smooth as a video but still quite useful for a security camera
Parameter Explanation
- hfrom_handle => no idea but it seams to be not important. The value is hard coded in the javascript files
- dsess => again, no idea and not important (value is hard coded)
- dsess_nid => most important parameter and the most difficult to extract, it is a token for the session and it expires in around 1 or 2 days, so it must be regenerated frequently
- dsess_sn => username of the camera or the mipc account, i guess. (i only tried to connect directly with my camera)
- dtoken => represent the quality of the image queried. p0_xxxxxxxxxx=(1280x720), p1_xxxxxxxxxx=(640x360), p2_xxxxxxxxxx=(320x180)
While most of the parameters can be easily determined, the dsess_nid is impossible to guess and it has to be generated following their procedure.
First I tried to inspect the mipc website, but due to the minification of the files, it was almost impossible to extract something useful.
Then i tried to decompile the apk file using an online tool http://www.javadecompilers.com/apk, and i finally found some clues.
Inside the apk there is an asset folder full of non minified html and javascript files.
One file in particular has been very helpful:assets/add_device_html/get.html. ‘Get.html’ is probably a test file used to develope their software. I slightly modified it to generate the dsess_nid and other parameters specifying only the ip, username and password of the camera.
What is missing
Right now i just created a webpage that can generate the URL of a camera with a refreshed dsess_nid, so, not much. The webpage uses the same javascript library used in the MIPC website but I still not completely understood all the procedures involved.
The library are quite complex and I would need some help to fully understand them and create a python script, or hassio addon capable of renewing the URL and maybe control other functionalities such as the motion detection and day/night mode.
Since what I did is a small modification of a decompiled software, i’m not sure that I can legally share the code on github, however, if you just need to find the dsess_nid, you can just add this line
console.log(agent.create_nid())
inside the agent.sign_in function in the get.html file.
I hope that someone with a lot of patience and a mipc camera wants to help me in this reverse engineering project
and I learned a company to avoid for future projects
