New Xiaomi aqara camera/gateway

Hardware
21

+1 for camera first of all

22

+1. Would be great if we could get this implemented into home assistant.

23

Do you have connect this camera to HA?

24

oh no, i have two of these cameras, is there any future update coming to integrate the camera and gateway?

1 Like
25

Almost same here, but I have only one. The worst is that I canā€™t even use it on motioneye (at least i couldnā€™t figure out how).

26

Did anyone else have issues getting this camera to connectā€¦ at all?

Iā€™ve got the Mi Home app, but I canā€™t find the camera to add it. I see the open wireless access point when I look in the Android settings, but no matter what I do, I canā€™t get it to add, even though the red light is blinking at the top of the camera.

27

Please check if you have Mainland China in your app settings.

28

Hello guys.

I bought Aqara camera hub with gateway like this, https://www.gearbest.com/ip-cameras/pp_978606.html?wid=1433363

When I discovered hidden options I tried to enable lumi mode and it is not possible to save the configuration. I have reached ā€˜request time outā€™. Is there anyone knows how to connect it to hass ?

29

Yep, definitely Mainland China, as I had to do that to set up the gateway (the non-camera Zigbee gateway).

Iā€™m currently pawing through the decompiled APK to try and see how to manually connect it. Port 23 (telnet) is open on the device, so Iā€™m thinking thatā€™s the key to setting this up without needing the app.

1 Like
30

The telnet port is open in original firmware ? Good to hear that If it could be possible to set lumi mode and key by telnet. I will check it this week.

What about UART-Serial connection ? anyone tries ?

btw. Do you have any spacial character in name or password in WiFi configuration ?
Are you using 2,4 GHz ? because 5GHz is not supported

31

Nope, 2.4GHz network. Password has an exclamation point in it, but the Mi Home app never gets to the point where I can pick which WiFi network I want, let alone to the point where I can put my WiFi network password in.

And I think itā€™s the camera which has that port open. I just ran nmap 192.168.1.1 192.168.1.254 to scan the whole subnet, and that port on 192.168.1.1 was the only thing that was returned. I put in my Linux username and password to ensure I wasnā€™t accidentally connecting to my own device, but it didnā€™t accept it, so I assume thatā€™s the camera.

I scoured through the APK to try and find the password, but couldnā€™t find much. When I have a moment I might try and find the firmware file and run it through strings or binwalk or something to see if itā€™s in there. I also tried hooking up my monitor-mode enabled WiFi dongle and capturing some Wireshark packets, but that yielded me nothing of use.

32

I dont knows if it matters but tryb enabling bluetooth in phone - this camera has it build inne and maybe mi home os searching cam via btā€¦
192.168.1.1 od most probably your router.

33

Bluetooth is always switched on (I have a Pebble smartwatch), so it wasnā€™t that. And I was connected directly to the cameraā€™s WiFi access point, so it couldnā€™t have been the router, because the cameraā€™s not connected to the home WiFi yet. Wireshark shows my phone asking who has 192.168.1.1 and telling it to report that to 192.168.1.81, which has no open ports and canā€™t be pinged.

In any case, Iā€™ve posted my question over on their forums. Not sure if Iā€™ll get an answer, but worth a shot.

34

Hmmmā€¦
If i rememember correctly I connected phone to my home wi-fi when i was adding camera to mi home then searched cam. I was not connecting to camera wifi manually at any point.

35

One more thing - i would disconnect with pebble just to be sure it isnā€™t the problem.

36

Do you know what is telnet login and password ?

37

I originally tried connecting via my home WiFi (on both the 2.4ghz and 5ghz connections), but got nothing, so I tried the access point itself, just to rule it out.

I also disconnected my Pebble and tried again, but it made no difference. I thought that would have been the case, as the camera is WiFi, not Bluetooth.

Iā€™m still pawing through the APK, looking for the location of a firmware file so I can try and work out what the telnet password is, but nothing yet.

38

Okay, so I got the camera set up in Mi Home. It took a dozen or more tries, but I got it. The next step is to get the camera to appear in Home Assistant. Hereā€™s a dump of things I know, stuff Iā€™ve tried etc.:

  • The device has two open ports, and several filtered ports (according to a thorough nmap scan I ran). These ports are:
    • 23/tcp open telnet
    • 652/tcp filtered hello-port
    • 8359/tcp filtered unknown
    • 9802/tcp filtered unknown
    • 9803/tcp filtered unknown
    • 10774/tcp filtered unknown
    • 15764/tcp filtered unknown
    • 20251/tcp filtered unknown
    • 22851/tcp filtered unknown
    • 25731/tcp filtered unknown
    • 37506/tcp filtered unknown
    • 38318/tcp filtered unknown
    • 53796/tcp filtered unknown
    • 54180/tcp filtered unknown
    • 54355/tcp open unknown
    • 57775/tcp filtered unknown
    • 62497/tcp filtered unknown
    • 62775/tcp filtered unknown
  • 54355 instantly closes HTTP connections, so I donā€™t know whatā€™s itā€™s for.
  • I believe, like some of the other Xiaomi cameras (Xiaofang etc.), itā€™s running Linux. I havenā€™t tried looking at the micro-SD card slot yet, and I havenā€™t pulled the device apart. Those are outside of my expertise.
  • I donā€™t know the telnet username and password. Itā€™s not in the APK and I canā€™t seem to find a URL for the firmware file. Running file, strings and binwalk on a Xiaofang firmware file suggests that it might be encrypted, because none of those utils returned anything useful.
  • I canā€™t turn on ā€œdeveloper modeā€ on the camera. I can get to the menu item by tapping the firmware version number, but the middle menu item does nothing. Going into the bottom option and hitting the left-hand button takes me to the tickbox where I can enable it and generate a password, but clicking Confirm does nothing.
  • The camera can definitely work without the internet, I opened the camera in Mi Home on my phone, then disconnected the phone line from my modem (cutting off my internet connection entirely). I could still see the live image, take photos, use push-to-talk and such.
  • I tried five different apps to try and work out what the local port / URL / whatever is: Wireshark in monitor mode, Charles Proxy for Windows, cat /proc/net/tcp in an Android terminal, a traffic sniffing app, and an app that shows all open connections on your phone. None of them showed local connections, so I must be doing something wrong here?

Someone with a rooted phone might be of some use here. They could poke around where Mi Home stores itā€™s settings and look through there for some connection info.

EDIT: I think it might use UDP, using one or more of these ports: 54321, 55254, 43921, 40636. Trying to open a UDP stream in VLC does nothing (takes a while to time out) so Iā€™ll keep looking.

EDIT 2: The stream is H.264 (based on running adb logcat from my Windows machine), but it may be encrypted, as thereā€™s mention of hencrypt and hdecrypt in the logs? The APK doesnā€™t mention anything about encryption. Also logcat tells me that trying to turn on the ā€œdeveloper modeā€ times out, but doesnā€™t tell me much more

Has anyone got a rooted device and a little bit of technical know-how? Iā€™m wondering if thereā€™s a database file created by Mi Home that stores encryption keys or connection info or something

3 Likes
39

Watching this with interest I have 7 of these bad boys that I would love to integrate.

40

Is it possible to use token from MiHome app instead of lumi mode and password ? What do you think ?