Stream VTech Baby Pro (RM series) cameras into Frigate/Home Assistant - local only!

Share your Projects!
1

Like many HA users, I’ve longed for a baby monitor that I could also pull into HA. I gave up on that until recently, the VTech baby monitor that I own had no RTSP, no ONVIF, no integration of any kind. sharing the result in case anyone else has one of these:

Repo: https://github.com/JonGilmore/vtech-baby-pro-bridge

what works:

  • 1920×1080 @ 15fps H.264 in Frigate via go2rtc
  • Pure LAN - no VTech cloud, no phone app at runtime
  • Containerized for ARM64 (tested on Pi 3/debian)

technical: the camera uses ThroughTek’s TUTK/Kalay P2P SDK with a VTech-custom X25519 + ChaCha20-Poly1305 auth/decrypt layer on top. I reimplemented that layer in C, dlopen TUTK’s bionic-only .so files inside a bionic chroot, and serve the resulting plaintext H.264 to go2rtc. The last piece was finding a specific post-handshake IOCtrl (0x719) the app sends to flip the camera from its default 1fps preview into proper live HD streaming.

What you’ll need (one-time setup):

  • Camera paired via the official app (so it has a UID/password assigned)
  • Rooted Android phone with KernelSU — used once to extract your camera’s TUTK license key + the AV-channel password via kernel uprobes
  • An aarch64 host on the cameras vlan (Pi 3B+ class works fine)
  • The camera’s .xapk or apk

Happy to help if anyone hits snags.

2

Does the official app and monitor still work while this is running?

3

Not sure about the official app. As soon as I got this working, I killed the internet connection to the camera and base station screen. The screen still works, whether its on “local” mode or connecting through the LAN.

4

Thanks for the original research and native bridge. I adapted and extended it for the VM901:

The main difference is credential provisioning: this version recovers the TUTK license and OAuth application values directly from libsecrets.so and retrieves the UID/AV password through the VTech cloud flow.

5

Awesome, I’m stoked that this was able to help somebody else free their locked down device up! Thanks for sharing the repo

6

Hi, really sorry if im being silly but I have tried following the steps on your repo but im not able to open the vtech app once the device is rooted so not able to launche the camera. Are you able to provide a bit more clearer steps if im missing something please.

Many thanks

7

are you getting any errors? can you document what you’ve done/tried so far?

8

I am actually using the instructions on from here vtech-baby-pro-bridge/CAMERA_BRIDGE_SOP.md at 54774a6f08c1a68bd5656e7653464aeccb82991a · rinosaur681/vtech-baby-pro-bridge · GitHub and have done everything up to 5a. But when doing 5b it just closes the app immedietly. As root detection is killing it before probes fire. Tried all magisks bits deny list etc but no luck fireing the app. I am using a Oneplus Nord CE 2

9

Boy, sorry - I don’t have a lot of ideas on this one. I’m not super familiar with the android rooting world these days and had to rely heavily on AI when it came to that. Any chance you have setenforce 0 set? Only other thing I’d say to try is to use KernelSU if its possible on your device.