Tosee app and video doorbell wifi

Fabien_Nalin · April 13, 2019, 4:56pm

Hello is there a possibility to see a component for tosee app products like video wifi doorbell ?

Marra · April 17, 2019, 8:20pm

Asking the same?

keerttttt · April 21, 2019, 2:33am

Me also the same!!

frans · May 31, 2019, 10:56pm

I am also looking for this

KJG · August 1, 2019, 9:56am

asking the same

46ache · August 5, 2019, 10:37am

Same request here.
Thanks

Gismo · November 8, 2019, 3:11pm

I am also interested in this. I tried to decompile the APK in order to see authentication/streaming protocols but I did not find anything useful. Main problem is that decompiling the APK results in a bunch of .smali files which are hard to read.

Does anyone have experience with reverse engineering?

Vasastan168 · February 20, 2020, 6:34am

YES, i need this one too!!!

rexkani · March 12, 2020, 8:18am

also want a tosee component!

mantaalex · April 7, 2020, 9:12pm

me to but i guess there will not come one?

krisgalle · April 25, 2020, 11:05am

another vote for tosee integration

fragtion · June 16, 2020, 10:54pm

Also looking for this. Does anyone know how to retrieve the video feed? Is it authenticated RTSP?
Regards

avernali · July 3, 2020, 10:38pm

Nobody? It would be really good.
I have an Yiroka doorbell and I have got to say it’s pretty useless.
They have an issue with the app (that is terribly slow) with notifications that they never solved.
I have been in touch with their support, actually helping them finding out what the issue was about. They were very kind and all…but finally they said they could not fix the issue. I even asked them if they would ever release an API or something but they say they would not. They don’t even sell the device anymore and they stopped updating the app 7 months ago…so it’s not looking good…

The doorbell kinda works meaning the chime inside the house rings but I get no notification on my mobile… Basically I am giving it the same use you give to a radio based doorbell that would have costed 10 bucks or less.

My “dream” would be to have this integrated so that when someone is at the door and they ring the doorbell I get notfied, can see the camera image in my tileboard (I am using this: https://github.com/resoai/TileBoard/) and press the button on the tileboard to open the door…
I am sure I am dreaming too much haha

Anyways…I wish we can actually get this integration but I doubt it as the product/app are not very popular and looks like they will be disappearing soon.

ldanicel · July 22, 2020, 2:38pm

+1 for tosee doorbell

inspgadget · August 28, 2020, 8:06am

+1. It would be awesome

gangrif · February 8, 2021, 10:10pm

I have one of these doorbells. Got it for Christmas a few years ago from someone who had no idea what they were buying, figured I’d explore how it works.

I’d love to see it work with Home Assistant. But here’s what I’ve found.

It’s not a direct wifi connection from the doorbell to your phone, which I guess we should expect, since it says it’ll work even if you’re not at home. The doorbell button press goes directly out to some external IP addresses, which must then notify the app. I’m guessing that it also pipes the video through there, or else that wouldn’t work when you’re away either.

This makes me a little leary of the device, because you never (or at least I cant remember doing it) setup an account with any cloud or whatever. So it seems unlikely that you;d be able to intercept that with Home assistant, unless you deconstruct their app and make HA act as the app. Even still, I don’t love the external component.

I may continue digging on this little guy, but I don’t feel hopeful.

gangrif · February 9, 2021, 12:13am

OK! So… I took it apart.

I found a few interesting things. Mainly what I think is the SOC for the unit. The Hi3518

Even an open firmware initiative: https://openipc.org/about/

Unfortunately, this is all a bit out of my skillset. But I wanted to share it in case someone else can take it and run a little more.

gangrif · February 9, 2021, 1:50am

One more thing. In digging for information about doorbells based on this SOC, i found the following:

gist.github.com

https://gist.github.com/JanLoebel/b5dafcda555323785d32ccb7d643dbcd

README.md

# Reverse Engineering of Hikam S6 (HI3518 E)

## Why?

I wanted to integrate the camera into my home security system. The only problem is that I want to toggle the alarm of the camera based on the security system status. Currently, this is only available via the app or a time trigger which is booth not sufficient for me. So the main target was to change the alarm status without the app.

## What I've done so far:

My first try was to capture the TCP packages between the Android app and the camera. Soon I realized that they are only TCP+SSL (not pinned) requests to a cloud service of Hikam. So I installed an emulator with the Hikam app and Wireshark. I've seen some packages but the payload is very strange and even if I send the UDP commands again the status won't change. So this was a dead end for me.

This file has been truncated. show original

debug-msg-alarm.log

ALARM ON:

/mnt # normal msg_type[60]len[112] peer[3]
night  auto  on  1
send msg:0x3d len[112] to peer:3
normal msg_type[18]len[44] peer[3]
send msg:0x18 len[48] to peer:3
send msg:0x25 len[52] to peer:3
send msg:0x3f len[112] to peer:3
send msg:0x51 len[48] to peer:3

This file has been truncated. show original

other-information.log

####### U-BOOT
hisilicon # printenv
bootdelay=1
baudrate=115200
ethaddr=00:00:23:34:45:66
ipaddr=192.168.1.10
serverip=192.168.1.2
netmask=255.255.255.0
bootfile="uImage"
bootargs=mem=38M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=hi_sfc:512k(boot),2816k(kernel),7M(rootfs),4M(app),512k(master),1280k(log)

This file has been truncated. show original

There are more than three files. show original

I have purchased a serial adapter once it arrives I intend to see if I can get this little doorbell to tell me all of its secrets.

linuxgeek · February 11, 2021, 4:11pm

Did anyone have any joy with this
I bought got one this week its linked to tuya app on my phone, but not seen on HA

gangrif · February 15, 2021, 3:34am

well, my serial adapter arrived, and I’ve hard-wired it to the serial port terminals on the doorbell’s board. I can now get a shell on the doorbell! The real question is… Now what.

I can say that My doorbell is running Huawei LiteOS, and once its configured it’s pretty much a black box, i cant get anything useful out of it.

I can see it connected to my wifi

Huawei LiteOS # ifconfig
wlan0   ip:192.168.86.59 netmask:255.255.255.0 gateway:192.168.86.1
        HWaddr fc:6b:f0:2c:f1:71 MTU:1500 Runing Default Link UP
lo      ip:127.0.0.1 netmask:255.0.0.0 gateway:127.0.0.1
        HWaddr 00 MTU:0 Runing Link Down

I can also see that it keeps a consistent tcp connection out to a few external IP’s.

Huawei LiteOS # netstat
========== total sockets 128 ======  unused sockets 124 ==========
Proto   Recv-Q      Send-Q      Local Address           Foreign Address         State
tcp     0           36          192.168.86.59:40003     39.108.53.180:12306     ESTABLISHED
tcp     0           36          192.168.86.59:40001     18.216.54.20:12306      ESTABLISHED
tcp     0           36          192.168.86.59:40000     18.185.250.10:12306     ESTABLISHED

Proto   Recv-Q      Send-Q      Local Address           Foreign Address
udp     0           0           0.0.0.0:68              0.0.0.0:67

Not all that cool.
Looks like one Chinese IP, and two amazon ec2.

If netstat isnt lieing to me, it makes it look like it’s got three open local ports, but I cannot connect to them.
40000, 40001, 40003

rebooting the device though… seems like those ports change? I cant really tell whats going on.

I can say that the OS seems to be a very limited and purpose build embedded linux. I cant seem to get it to do much, or even get it to give me any of its secrets. I cant even find its configuration, its like its in some other filesystem, or… i dunno, compiled? not sure yet.

Here is the command list:

Huawei LiteOS # help
*******************shell commands:*************************

ap_mode       arp           call          cat           cat_logmpp    cd            client        close_ch14
cp            cpup          dns           ex            excInfo       findsym       format        free
getid         hcc_set_para  help          hiddrs        himd          himm          hipriv        hwi
i2c_read      i2c_write     ifconfig      lddrop        ls            mclose        mcu_reset     memcheck
mkdir         mopen         mount         nand_bad      netcfg        netstat       ntpdate       open_ch14
partinfo      partition     ping          pir           pwd           readreg       reset         rm
rmdir         rmid          rssi          rtsp          sem           set_cfg       set_keep_alive  set_log_level
set_video_flip  setid         sf_read       sf_write      ssp_read      ssp_read      ssp_write     start_pq
statfs        steam_debug   swtmr         sync          systeminfo    task          telnet        tftp
touch         uart_close    uart_config   uart_read     uart_write    umount        uname         usb
wifi_debug    wifi_exit     writeproc     writereg

im still poking around at it, we’ll see what I can come up with.