Support for Security Camera System via NVR - ESeeCloud/dvr163

Feature Requests
30

I downloaded the firmware from anrans homepage and browsed it using 7zip, the passwords were stored with a standard encryption which various websites will decrypt in a couple of seconds

31

i have this same nvr with 8 cameras but i am not able to get its rtsp feeds

can anyone help me ?

32

can u help me find the user pass and get the rtsp feeds ?

33

Was u able to integrate this system with HA ?

34

Likely it is default

default user name is “admin” and default password no password (blank)

35

Thanks, these worked for the “XMart-O” 8-camera NVR system I bought off Amazon. I suspect a lot of no-name systems use the same hardware, or at least the same firmware.

Where I’m drawing a blank is resizing the video or snapshots. I’ve been able to put a video stream in a Lovelace card, but it’s cropped (“zoomed in”) so I can’t see the whole thing. Searching the web, I’ve found other camera systems which have “width” and “height” parameters passed in the URL, but they don’t seem to work for my system.

1 Like
36

this link worked for me too ,

For video stream: http://ip:port/cgi-bin/sp.cgi?chn=0&u=USER&p=PASSWORD

but when ever i try to open this link in my chrome , my NVR hangs and restart , what is the problem and solution ?

37

r u using ur NVR system with HA ?

can u give some configuration details ?

38

Has anyone found any more parameters to pass in the URL?

The above works, but I’d like to set the height, width and/or resolution of the video stream and stills.

39

r u able to configure it with home assistant ?

can u give some details of configurations ?

40

For video stream: http://ip:port/cgi-bin/sp.cgi?chn=0&u=USER&p=PASSWORD
work but the fps is quite low compared to the mobile app

After digging a bit with wireshark it seems the [adobe]flash app on the root of website (view2.html) is connecting with rtmp to the nvr. But i still can’t find the complete URL

1 Like
41

how to connect it with HA ?

42

Taking your lead, I tried “view1.html” through “view4.html.” Got some interesting results.
view1.html is looking for a control called " WebClient.exe." I’ve downloaded it but will wait until I’m feeling brave to install it.

View3.html got me some good data. It shows a very different interface. It’s not showing any usable image on my system, but it uses this URL:
http://[NVR IP]/cgi-bin/sp.cgi?chn=1&quality=2&rate=10&u=[UserID]&p=[Password]

I imagine you can play around with “quality” and “rate” and maybe get something out of that.

View4.html is similar but uses Flash. RTMP is a Flash protocol, not sure if they’re using the proprietary Adobe version or the open version, but either way it’s to be avoided at all costs as far as I’m concerned.

43

Here’s what I did:

  • Go into the Lovelace UI
  • Select “Configure UI” from the three dots at the top right
  • Select “Add Card” (+ sign at lower right)
  • Select “IFRAME”
  • Give it a title and type in the following URL:
    http://[your.nvr.ip.address]/cgi-bin/sp.cgi?chn=[channel #]&u=[UserID]&p=[Password]
    replacing the parts in [brackets] with your values. Camera numbers start at zero.
  • Scroll up and down in the “Aspect Ratio” selection until you get one that works OK.
1 Like
44

the sp cgi is not able to handle properly camera data, at some point it just freeze the nvr interface and force a reboot… i think both cam and nvr use rtmp for continuous viewing but it seems encrypted and need auth with digest so makes things quite complex, i wouldnt mind letting nvr do is job if it could call a web service when motion is detected but email is the only options …

45

Oh! You just reminded me view2.html downloads a JaViewer.swf which I had decompiled, there’s a file called jaVideo.as with connection info.

This is in a function called ConnectRTMP

this.nc = new NetConnection();
this.nc.connect(this.stream_url, this.ja_flash_ver, this.nonce, this.username, 
this._md5.hash((this.nonce + ":") + this.userpwd));
this.nc.addEventListener(NetStatusEvent.NET_STATUS, this.netStatusListener);

This is ConnectFLV

this.nc = new NetConnection();
this.nc.addEventListener(NetStatusEvent.NET_STATUS, this.netStatusListener);
this.nc.connect(null);

I was not able to do anything with this though :frowning: NetConnection seems like it’s Flash only https://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/net/NetConnection.html

I can’t tell if “quality” does anything but “rate” is a nice find! 1 is definitely a lower frame rate than 10.

46

Interesing let me show you what wireshark give :slight_smile:

http://192.168.3.49/JaViewer.swf?player_max=4..tcUrl...rtmp://[email protected][email protected].@o.......

videoFunction.?.........pageUrl..(http:.//192.168.3.49/view2.html?type=main..objectEncoding.@......... [email protected].. 8aa586f98d7771651fd0336ac917131e

later
...)..|........nlogin?method=md5&nonce=f647c49c2eb129712384a1ea6feff568&username=admin&digest=1e5f8e6981d06826b123b05323ed845.@.....

later

.Z............play............ ch2_0.264.........

for security reason i change nonce=f647c49c2eb129712384a1ea6feff568 and digest=1e5f8e6981d06826b123b05323ed845

cause the password is encoded with those… to be honest with the encoding method i think we need a flash client to connect to it … but seems possible to make a proxy which gonna trancode rtmp to rtsp

47

Yeah, .swf is flash. That’s a dead end as far as I’m concerned. Very disappointed if there’s no other way.

That’s bad. On my system the sp.cgi does work, just that I have very little control over it; couldn’t get rate or quality parameters to do anything. But I haven’t thoroughly tested with a direct connection, only through HA which seems to slow down the rate anyway.

48

I had not considered a proxy to convert it, I wonder how much CPU that would use. I am running HA on a Pi, I don’t have any extra computers lying around. I’m okay with using the sp.cgi though it is good enough for me.

I would still like motion detection in HA. I have a separate “alert” email account for the NVR. I was thinking of writing a script that simply checked the inbox every X seconds. If it finds an email it can tell HA.

49

i am not able to use this link many time , as this link crashes my NVR and it reboots .

http://192.168.9.108:80/cgi-bin/sp.cgi?chn=1&u=xxxxx&p=xxxxx

after trying to open this link , why the NVR reboots ?