Motorola Cameras

Success! For the last months I have been able to stream from my camera using a local stream! I have a non-downgradeable camera (the working, older, firmware is not valid for my version of the device) so the normal route was not valid for me.

Anyhow, What I did was simply redirecting all hubble.in traffic to a node.js application that I threw together. It listens to all the vhosts used, imitates and proxies all the calls, modifies where needed and dump all certificates, secrets etc to files on disk. Using the p2p secrets I am then able to stream from the camera. The secrets expire about every four weeks or so, but then I just update the information and continue to stream.

Perhaps someone is keen on making this more stable or rafining it to a home assistant module (I dont have the time and it works good enough for me) please feel fre to do so by contributing or by forking it or just stealing the codeā€¦ :stuck_out_tongue_winking_eye:

DSorlov/hubble-mitm: Used to create a proxy to intercept messages and alter traffic to hubble (github.com)

2 Likes

Now that the stream component supports audio has anyone managed to get audio working with these cameras? I can get audio working on all my other Unifi cameras in HA, and I can hear the audio when viewing the Motorola camera feeds via VLC or other RTSP apps but not in HA.

What codec type does VLC show for the audio stream?
Some security cameras use old codecs such as G.711 which is primarily used for things like VoIP and are not really supported in most file container types such as .mp4 or .ts. Since http streaming uses those containers, we canā€™t use these audio codecs unless we transcode them. We may decide to implement audio transcoding in the future, but as of now this is not supported.

VLC says the audio stream is ā€œPCM ALAW (alaw)ā€, is that one of the old ones that would have to be transcoded?

Interestingly when I expose these cameras to Homekit via the HA integration the audio comes through (although itā€™s choppy).

Yes, PCM a-law is G.711: https://en.wikipedia.org/wiki/A-law_algorithm
From this chart you can see that G.711 isnā€™t supported in the container formats we need (http video streaming on the web uses either TS or MP4 formats): https://en.wikipedia.org/wiki/Comparison_of_video_container_formats#Audio_coding_formats_support .
The reason the audio works with HomeKit is that the homekit component passes the stream through ffmpeg, and ffmpeg is transcoding the audio. The stream component only repackages the stream and does not do any transcoding.

Thanks @uvjustin as you said these are old cameras (in tech at least), canā€™t wait to replace them for something better to be honest.

Just tried setting this up, and Iā€™m having issues. You mention that *.hubble.in traffic needs to be forwarded to the proxy youā€™ve setup. I changed the DNS entries for the *.hubble.in domain to the proxy, but the proxy doesnā€™t seem to be forwarding anything. Iā€™m assuming the devices are using my DNS server and Iā€™ve verified the proxy is using 8.8.8.8. I can get 404 errors by using app.hubble.in, so I know itā€™s configured correctly. I just feel like Iā€™m missing something.

Thank you for putting this together. Once I have the keys and certs how would I go about accessing the camera rtsp feed?

The basic idea here is that you connect via the mobile app and let this connect to the proxy. The phone should use a dns that points *hubble.in to the proxy, and the proxy and everything else should use 8.8.8.8 as dns.

This thread has helped me get an rtsp stream for my focus 88 camera so for that I just wanted to say thanks everyone!
While doing some packet sniffing I found some commands that I didnā€™t see mentioned anywhere on the web so just wanted to throw them up here in case they were useful to anyone. They worked for my focus 88, model 2855, fw version 03.10.11.

Night vision: 2 = off, 1 = on, 0 = auto
http://IPADDRESS/?action=command&command=set_night_vision&value=2
http://IPADDRESS/?action=command&command=set_night_vision&value=1
http://IPADDRESS/?action=command&command=set_night_vision&value=0

Move the camera for a specific length of time. For example 1500 = 1.5sec
http://IPADDRESS/?action=command&command=move_right_duration&value=1500
http://IPADDRESS/?action=command&command=move_left_duration&value=1500
http://IPADDRESS/?action=command&command=move_forward_duration&value=1500
http://IPADDRESS/?action=command&command=move_backward_duration&value=1500

Great information about the firmware downgrade. I was using an older Motorola 667 wifi camera (firmware 03.10.26) with only the temperature sensor working.
After the downgrade I was able to see a video stream using the video.cgi http link, the RTSP stream wonā€™t work. Are there any other users with this issue?

An other thing I noticed is that the temperature sensor (the camera does feel warm as well) is acting weird after the downgrade:
temp
The sudden spike and weird spiky readings started right after the downgrade (before that you see the correct temperature with small waves when the heating started and the room cooled down again). Is this a know issue with the .11 firmware or is the camera acting up?

Did you ever find a solution to the infrared issue? Iā€™ve been unable to find a command to turn on/off/auto the ir leds but when opening the test_infra.html site on the camera it seems to enable the leds (need to do some more testing to make sure this fixed the issue).

The weird spikes somehow stopped a few days ago (Iā€™ve got these weird reading for about 1 month). Not sure what happened but it seemed like an issue with the camera (the reading was weird when using the web interface as well)ā€¦

I believe the IR LEDs are controlled by the night vision commands I posted above:
Night vision: 2 = off, 1 = on, 0 = auto
http://IPADDRESS/?action=command&command=set_night_vision&value=2
http://IPADDRESS/?action=command&command=set_night_vision&value=1
http://IPADDRESS/?action=command&command=set_night_vision&value=0

A bit of a long shot but does anyone have a copy of the FW mentioned in previous posts?
https://ota.hubble.in/ota1/2855_patch/2855-03.10.11.fw.pkg

This above link is now giving a ā€œ404 Not Foundā€
Thanks!

1 Like

I still got it if you want. Send me a private message :slight_smile:

4 Likes

Yep here: https://www.beatlenut.com/1662-03.10.11.fw.pkg

2 Likes

how about the pins on the bottom of the camera? Did someone manage to hook it to a serial interface?
https://fccid.io/VLJ-MBP88/Internal-Photos/Internal-Photos-3377321
TP201, TP213, TP214, TP212 and TP204 look suspicious to me :grin:

Does anyone know where I can get older firmware for camera Id 1854.

Below returns 404.

https://ota.hubble.in/ota1/1854_patch/1854-03.10.21.sig
https://ota.hubble.in/ota1/1854_patch/1854-03.10.21.tar.gz

:smiley:

1854-03.10.21 Firmware:

1 Like

Thank you so much Warren!