Get alarms / events from IP Camera (Hi3518)

▲
1
▼

I'm trying to figure out, how get an alarm message from my IP Camera, using VMS software I can see the packets , I try to replicate it with no luck, i don't the first characters from each packets

wireshark log

    ................d...{ "EncryptType" : "MD5", "LoginType" : "DVRIP-Web", "PassWord" : "tlJwpbo6", "UserName" : "admin" }
....................{ "AliveInterval" : 21, "ChannelNum" : 1, "DeviceType " : "IPC", "ExtraChannel" : 0, "Ret" : 100, "SessionID" : "0x00000001" }
.................6...{ "Name" : "SystemInfo", "SessionID" : "0x00000001" }
................Q...{ "Name" : "SystemInfo", "Ret" : 100, "SessionID" : "0x1", "SystemInfo" : { "AlarmInChannel" : 2, "AlarmOutChannel" : 1, "AudioInChannel" : 1, "BuildTime" : "2016-05-11 15:05:45", "CombineSwitch" : 0, "DeviceRunTime" : "0x00000C6A", "DigChannel" : 0, "EncryptVersion" : "Unknown", "ExtraChannel" : 0, "HardWare" : "53H20L_S39", "HardWareVersion" : "Unknown", "SerialNo" : "74a9251dff8a1b12", "SoftWareVersion" : "V4.02.R11.00002532.10010.240100.00000", "TalkInChannel" : 1, "TalkOutChannel" : 1, "UpdataTime" : "", "UpdataType" : "0x00000000", "VideoInChannel" : 1, "VideoOutChannel" : 1 } }
.................[...{ "Name" : "OPTimeSetting", "OPTimeSetting" : "2017-09-13 12:45:02", "SessionID" : "0x1" }
................5...{ "Name" : "KeepAlive", "SessionID" : "0x00000001" }
................:...{ "Name" : "", "Ret" : 100, "SessionID" : "0x00000001" }
.................C...{ "Name" : "KeepAlive", "Ret" : 100, "SessionID" : "0x00000001" }
.................,...{ "Name" : "", "SessionID" : "0x00000001" }
................6...{ "Name" : "SystemInfo", "SessionID" : "0x00000001" }
................:...{ "Name" : "", "Ret" : 100, "SessionID" : "0x00000001" }
.................Q...{ "Name" : "SystemInfo", "Ret" : 100, "SessionID" : "0x1", "SystemInfo" : { "AlarmInChannel" : 2, "AlarmOutChannel" : 1, "AudioInChannel" : 1, "BuildTime" : "2016-05-11 15:05:45", "CombineSwitch" : 0, "DeviceRunTime" : "0x00000C6C", "DigChannel" : 0, "EncryptVersion" : "Unknown", "ExtraChannel" : 0, "HardWare" : "53H20L_S39", "HardWareVersion" : "Unknown", "SerialNo" : "74a9251dff8a1b12", "SoftWareVersion" : "V4.02.R11.00002532.10010.240100.00000", "TalkInChannel" : 1, "TalkOutChannel" : 1, "UpdataTime" : "", "UpdataType" : "0x00000000", "VideoInChannel" : 1, "VideoOutChannel" : 1 } }
...............P.:...{ "Name" : "SystemFunction", "SessionID" : "0x00000001" }
..............Q.e...{ "Name" : "SystemFunction", "Ret" : 100, "SessionID" : "0x00000001", "SystemFunction" : { "AlarmFunction" : { "AlarmConfig" : true, "BlindDetect" : true, "IPCAlarm" : false, "LossDetect" : true, "MotionDetect" : true, "NetAbort" : true, "NetAbortExtend" : true, "NetAlarm" : true, "NetIpConflict" : true, "StorageFailure" : true, "StorageLowSpace" : true, "StorageNotExist" : true, "VideoAnalyze" : false }, "CommFunction" : { "CommRS232" : true, "CommRS485" : true }, "EncodeFunction" : { "CombineStream" : false, "DoubleStream" : true, "IFrameRange" : false, "LowBitRate" : true, "SnapStream" : true, "WaterMark" : false }, "InputMethod" : { "NoSupportChinese" : false }, "MobileDVR" : { "CarPlateSet" : false, "DVRBootType" : false, "DelaySet" : false, "GpsTiming" : false, "StatusExchange" : false }, "NetServerFunction" : { "MACProtocol" : false, "MonitorPlatform" : false, "NATProtocol" : false, "Net3G" : false, "Net4G" : false, "NetARSP" : true, "NetAlarmCenter" : true, "NetAnJuP2P" : false, "NetBaiduCloud" : false, "NetBjlThy" : false, "NetDAS" : true, "NetDDNS" : true, "NetDHCP" : true, "NetDNS" : true, "NetDataLink" : false, "NetEmail" : true, "NetFTP" : true, "NetGodEyeAlarm" : false, "NetIPFilter" : true, "NetIPv6" : false, "NetKaiCong" : false, "NetKeyboard" : false, "NetLocalSdkPlatform" : false, "NetMobile" : false, "NetMobileWatch" : false, "NetMutliCast" : false, "NetNTP" : true, "NetNat" : true, "NetOpenVPN" : false, "NetPMS" : true, "NetPMSV2" : true, "NetPPPoE" : true, "NetPhoneMultimediaMsg" : false, "NetPhoneShortMsg" : false, "NetPlatMega" : false, "NetPlatShiSou" : false, "NetPlatVVEye" : false, "NetPlatXingWang" : false, "NetRTSP" : true, "NetSPVMN" : false, "NetTUTKIOTC" : false, "NetUPNP" : true, "NetVPN" : false, "NetWifi" : false, "NetWifiMode" : false, "PlatFormGBeyes" : false, "XMHeartBeat" : false }, "OtherFunction" : { "AlterDigitalName" : true, "DownLoadPause" : true, "HddLowSpaceUseMB" : false, "HideDigital" : false, "MusicFilePlay" : false, "NOHDDRECORD" : false, "NotSupportAH" : true, "NotSupportAV" : true, "NotSupportTalk" : false, "SDsupportRecord" : false, "ShowAlarmLevelRegion" : true, "ShowFalseCheckTime" : false, "SupportAbnormitySendMail" : true, "SupportBT" : true, "SupportC7Platform" : false, "SupportCamareStyle" : true, "SupportCameraMotorCtrl" : false, "SupportCfgCloudupgrade" : true, "SupportCloudUpgrade" : true, "SupportCommDataUpload" : false, "SupportCustomOemInfo" : false, "SupportDigitalEncode" : true, "SupportDigitalPre" : false, "SupportDimenCode" : true, "SupportEncodeAddBeep" : false, "SupportFTPTest" : false, "SupportFishEye" : false, "SupportImpRecord" : false, "SupportMailTest" : true, "SupportMaxPlayback" : false, "SupportModifyFrontcfg" : false, "SupportNVR" : false, "SupportNetLocalSearch" : false, "SupportOSDInfo" : false, "SupportOnvifClient" : false, "SupportPOS" : false, "SupportPlayBackExactSeek" : true, "SupportPtzIdleState" : false, "SupportRTSPClient" : false, "SupportResumePtzState" : false, "SupportSPVMNNasServer" : false, "SupportSetDigIP" : false, "SupportShowConnectStatus" : false, "SupportShowProductType" : false, "SupportSmallChnTitleFont" : false, "SupportSnapCfg" : false, "SupportSplitControl" : true, "SupportStorageFailReboot" : true, "SupportSwitchResolution" : false, "SupportTextPassword" : true, "SupportTimeZone" : true, "SupportUserProgram" : false, "SupportWriteLog" : true, "Supportonviftitle" : true, "SuppportChangeOnvifPort" : true, "TitleAndStateUpload" : true, "USBsupportRecord" : false }, "PreviewFunction" : { "GUISet" : false, "Tour" : false }, "TipShow" : { "NoBeepTipShow" : false, "NoEmailTipShow" : false, "NoFTPTipShow" : false } } }
.................;...{ "Name" : "General.General", "SessionID" : "0x00000001" }
....................{ "General.General" : { "AutoLogout" : 0, "FontSize" : 24, "IranCalendarEnable" : 0, "LocalNo" : 0, "MachineName" : "LocalHost", "OverWrite" : "OverWrite", "ScreenAutoShutdown" : 10, "ScreenSaveTime" : 0, "VideoOutPut" : "Auto" }, "Name" : "General.General", "Ret" : 100, "SessionID" : "0x00000001" }
.................<...{ "Name" : "General.Location", "SessionID" : "0x00000001" }
....................{ "General.Location" : { "DSTEnd" : { "Day" : 1, "Hour" : 1, "Minute" : 1, "Month" : 10, "Week" : 0, "Year" : 1970 }, "DSTRule" : "Off", "DSTStart" : { "Day" : 1, "Hour" : 1, "Minute" : 1, "Month" : 5, "Week" : 0, "Year" : 1970 }, "DateFormat" : "MMDDYY", "DateSeparator" : "-", "IranCalendar" : 0, "Language" : "Spanish", "TimeFormat" : "24", "VideoFormat" : "PAL", "WorkDay" : 62 }, "Name" : "General.Location", "Ret" : 100, "SessionID" : "0x00000001" }
.................7...{ "Name" : "OPTimeQuery", "SessionID" : "0x00000001" }
................e...{ "Name" : "OPTimeQuery", "OPTimeQuery" : "2017-09-13 12:45:04", "Ret" : 100, "SessionID" : "0x1" }
.................8...{ "Name" : "ChannelTitle", "SessionID" : "0x00000001" }
................d...{ "ChannelTitle" : [ "CAM01" ], "Name" : "ChannelTitle", "Ret" : 100, "SessionID" : "0x00000001" }
.................5...{ "Name" : "KeepAlive", "SessionID" : "0x00000001" }
................C...{ "Name" : "KeepAlive", "Ret" : 100, "SessionID" : "0x00000001" }
.................5...{ "Name" : "KeepAlive", "SessionID" : "0x00000001" }
................C...{ "Name" : "KeepAlive", "Ret" : 100, "SessionID" : "0x00000001" }

Hex stream from login

6c3b6bf354c77cd1c384f64a0800450000acc4a7400040069dd3c0a82b76c0a82b0ace370457a0731062e2cbd5b680182086272c00000101080a40e824da000055a8ff00000000000000000000000000e803640000007b2022456e63727970745479706522203a20224d4435222c20224c6f67696e5479706522203a202244565249502d576562222c202250617373576f726422203a2022746c4a7770626f36222c2022557365724e616d6522203a202261646d696e22207d0a

Wireshark log

android
tcp
wireshark
ip-camera
asked on Stack Overflow Sep 18, 2017 by Colas • edited Jan 31, 2021 by Machavity

2 Answers

▲
1
▼

Maybe try to solve it via http. Load the camera site and see the alarm log.

You can see how to implement the http get in java: HTTP GET request in java

If the data is ready, you have to parse it. Use a html parser for see the information in the data:

Java : HTML Parsing

What are the pros and cons of the leading Java HTML parsers?

answered on Stack Overflow Sep 18, 2017 by HuMaN
▲
0
▼

I wrote a small tool, that reads out the network configuration of those IP cameras. Maybe it helps you retrieving alarm messages. No third party libraries needed...

First you have to "authenticate". The camera uses a modified md5ish hash function. Afterwards you can request information and also set new configuration parameters. By sniffing the traffic, all necessary information should be available (cmd IDs, json patterns, etc). Don't know yet what the values v1 and v3 are for..

    static final Pattern pattern_initSession = Pattern.compile("\\{ \"AliveInterval\" : ([0-9]+), \"ChannelNum\" : ([0-9]+), \"DeviceType \" : \"([a-zA-Z]+)\", \"ExtraChannel\" : ([0-9]+), \"Ret\" : ([0-9]+), \"SessionID\" : \"0x([0-9A-F]+)\" \\}");
    
    private static String sofia_hash(String msg) throws NoSuchAlgorithmException {
        String hash = "";
        MessageDigest md = MessageDigest.getInstance("MD5");
        md.update(msg.getBytes(StandardCharsets.UTF_8));
        byte[] msg_md5 = md.digest();
        for (int i = 0; i < 8; i++) {
            int n = ((msg_md5[2*i] & 0xFF) + (msg_md5[2*i+1] & 0xFF)) % 0x3e;
            if (n > 9)
                if (n > 35) n += 61; else n += 55;
            else
                n += 0x30;
            hash += (char) n;
        }
        return hash;
    }
                
    private static void sendCmd(int sessionId, int cmdId, String data, OutputStream out) throws IOException {
        byte[] buffer = new byte[20+data.length()];
        ByteBuffer bb = java.nio.ByteBuffer.wrap(buffer);
        bb.order(ByteOrder.LITTLE_ENDIAN);
        bb.putInt(0xFF);
        bb.putInt(sessionId);
        bb.putInt(0);
        bb.putInt(cmdId);
        bb.putInt(data.length());
        bb.put(data.getBytes());
        out.write(buffer);
    }
    
    public static void getNetworkConfig() throws NoSuchAlgorithmException, IOException {
        String password = "yourPassword";
        try (Socket echoSocket = new Socket("yourCamIp", 34567);
                OutputStream out = echoSocket.getOutputStream();
                InputStream in = echoSocket.getInputStream(); ) {
            String initRequestStr = String.format("{ \"EncryptType\" : \"MD5\", \"LoginType\" : \"DVRIP-Web\", \"PassWord\" : \"%s\", \"UserName\" : \"admin\" }\n", sofia_hash(password));
            sendCmd(0, 0x03e80000, initRequestStr, out);
            byte[] buffer = new byte[20+initRequestStr.length()];
            in.read(buffer, 0, 20);
            ByteBuffer bb = java.nio.ByteBuffer.wrap(buffer);
            bb.order(ByteOrder.LITTLE_ENDIAN);
            int v1 = bb.getInt();
            int sessId = bb.getInt();
            int v3 = bb.getInt();
            int v4 = bb.getInt();
            int size = bb.getInt();

            byte[] readBuf = new byte[size];
            in.read(readBuf, 0, size);
            String initResponse = new String(readBuf);
            Matcher m = pattern_initSession.matcher(initResponse.trim());
            if (m.matches()) {
                int aliveInterval = Integer.parseInt(m.group(1));
                int channelNum = Integer.parseInt(m.group(2));
                String deviceType = m.group(3);
                int extraChannel = Integer.parseInt(m.group(4));
                int ret = Integer.parseInt(m.group(5));
                int sessionId = Integer.parseInt(m.group(6), 16);
                System.out.printf("aliveInterval=%d, channelNum=%d, deviceType=%s, extraChannel=%d, ret=%d, SessionId=%08X (%08X)\n", aliveInterval, channelNum, deviceType, extraChannel, ret, sessionId, sessId);
            } else {
                System.err.println("match initResponse failed");
                return;
            }
            String networkConfigRequest = String.format("{ \"Name\" : \"NetWork.NetCommon\", \"SessionID\" : \"0x%08X\" }", sessId);
            sendCmd(sessId, 0x04120000, networkConfigRequest, out);

            in.read(buffer, 0, 20);
            bb = java.nio.ByteBuffer.wrap(buffer);
            bb.order(ByteOrder.LITTLE_ENDIAN);
            v1 = bb.getInt();
            sessId = bb.getInt();
            v3 = bb.getInt();
            v4 = bb.getInt();
            size = bb.getInt();

            readBuf = new byte[size];
            in.read(readBuf, 0, size);
            String networkConfigResponse = new String(readBuf);
            System.out.println("networkConfig: " + networkConfigResponse);
        }
    }
answered on Stack Overflow Jun 26, 2020 by Bjoern

User contributions licensed under CC BY-SA 3.0