As it seems to be on pre-order I doubt anyone has made it work.
How would you charge an outdoor camera?
Anyway, the advertising is rather light on technical detail. It is not a cheap purchase, however I am sure some technical details will emerge once it ships. In the meantime, I wouldn’t be buying unless it was viable for me to hack it, and at my level of skill, that is not viable.
You remove the battery and charge it? Like the Arlo-cameras? It’s to avoid installing power or POE cable to inaccessible places where you want the camera.
I understand the idea of what the battery is for, but the charging port is on the back of the camera. There is no mention of being able to remove the battery (although that would solve the problem).
What can I do to hack it?
Is there any kind of guide, or testing I can do? I am a programmer, although I have little experience with hardware analysis.
A little camera review:
Has a microphone.
Has a speaker. (I found the sound a bit low, but I think it was expected.)
Has infrared.
Has an internal battery.
Besides the camera, it also comes with a kind of receiver.
This receiver has a memory card slot, a wired network slot and a micro usb slot.
The receiver creates a new Wireless Network.
In Mi Home app, it was not possible to access the camera directly, only via the receiver.
I need to do more testing to see if it is possible to use the camera without the receiver.
I have recently received it, and started “looking around” to see what can be done
Before I describe what I have found, I want to explain the biggest issues with this camera (and some similiar “cloud” or p2p cameras running on batteries):
The Xiaomi Mi App for Android needs ALOT of permissions! You must use the app in order for you to setup the gateway and camera properly.
During setup, the App and gateway access the internet. You cannot setup without internet connection.
Even after initial setup, you MUST have active internet connection, or else app cannot access the gateway (as opposed to the Reolink Argus 2, where internet is needed only for initial setup, after that its accessible on wifi even without internet).
These types of cameras aren’t meant to be viewed for more than a few minutes (in order to save batteries)
No external integration what so ever! No IFTTT, RTSP or ONVIF support
The gateway unit is using a Mediatek Mt7628NN SOC, running a customized version of OpenWrt (version 14, if I recall).
It has 64MB of RAM and 8MB of flash (as far as I could tell).
There is a serial (UART) console connector, close to the usb power port, connect at speed 57600 bps.
When you login, you see a banner that says Hodor-Hub (moobox)
It appears that this product has some common hardware with the Moobox product, see: https://www.mooboxcam.co.uk/
After gateway is setup, and connected to your Wifi, the camera unit also connects to the gateway using Wifi (pretty silly if you ask me).
The problem is that this Wifi is encrypted with WPA2 and I wasn’t able to find the password that the camera connects with.
If I had the password, then I could sniff the communication between the gateway and camera, and find more info.
There are a few proprietary executables running on the gateway which are in charge of communication with the camera, recording etc…
I need to look into these more.
Thats about it for now.
My goal is to hack away at the gateway so that I could connect to the camera, without Mi App, and without need for internet connection (only local Wifi LAN), for example using MJPEG or RTSP. Maybe get notifications using mqtt (I think that I saw some mqtt client installed on the gateway).
Anyways, does anyone have any idea how I can get the WPA2 password the camera uses, given that I have full access to the gateway?
I know that there are methids to do this, but most of them involve brute force cracking, using a dictionary of possible words. Because I have no idea what the password could be, I think its not that feasible to do in this case.
BTW, I also have the Reolink Argus 2, which is similar to the EC2, except doesn’t use a gateway.
I also tried to “snoop around”, and sniffed communication between the camera and the App which controls it. After many hours of examining and sniffing, it seems like Reolink are using some proprietary way of sending the video to the App (using UDP). But that’s only after some sort of p2p handshake the app does with the camera, in which the camera knows what IP and port the app is listening on. I was unable to decipher how this handshake works and what exactly the app sends (in Wireshark it was just a bunch of bytes with no obvious format, maybe even encrypted).
These p2p cameras are hard to “open”, and pretty difficult to hack for an inexperienced guy like me
But I haven’t given up yet, just need to find the time to continue snooping around.
I’m optimistic about the Imilab EC2, because it uses the gateway, and I have been able to get console access. And because its running OpenWrt, I hope I will be able to “open” it up for a more general use.
Well, a small update: It seems that while I can get console prompt on the gateway, the filesystem is loaded as readonly. Meaning that I can’t change anything on it. I suppose its possible to load the filesystem as read-write, but they are using some weird (custom) version of u-boot, which doesn’t have all the regular u-boot commands/paramters.