19 ms·
Reverse engineering a camera protocol for fun and profit
- syntaxing 6y agoThat was a super fun read! I was super impressed with the content! It seems like the "mastering embedded Linux" is extremely rich too [1]! [1] https://www.thirtythreeforty.net/posts/2019/08/mastering-embedded-linux-part-1-concepts/ https://www.thirtythreeforty.net/posts/2019/08/mastering-emb...
- ponker 6y agoHuh, this gives me the same kind of frisson that a middle school football-crazy boy must experience when his dad takes him to a football game when Tom Brady is in town.
- ngcc_hk 6y agoOr you do not know who is tom Brady and American football or even the rule, but still enjoy it very much the whole analysts. Would read the embedded one. Great work. Great read.
- guiambros 6y agoOh wow, what a great read. When you thought it was over, there was another entire level deeper in the rabbit hole. Fascinating post. HN at its best.
- skeletonjelly 6y agoFantastic read. I feel very stupid now though xD
- Polylactic_acid 6y agoThese reverse engineering posts always do that. I'm pretty good at developing software but I see people pull off insane reverse engineering efforts like extracting encryption keys from a chip with 1000 security measures and I wonder if I know anything.
- enchiridion 6y agoSame here! Then I remember that problem to solution only takes a sentence or two in the article, but might be few days of dead ends irl.
- el_oni 6y agoAbsolutely. I found myself wondering while reading the article what the guys notes look like. Does he screenshot everything and bullet point as he goes along? Or does he hit a logical stopping point and write up what worked from A-B, B-C etc.? It's massively inspiring though.
- WrtCdEvrydy 6y agoThese blogs kinda downplay the problem being broken down little by little. Forensics work is the same... you don't naturally get a report that says the person did something, it's basically a list of things you try that lead to other things that lead to dead ends or an answer.
- kingosticks 6y agoI'd like to know this too. Lately when I've been getting into something new or trying to solve a non-trivial bug/problem I've tried to keep notes as I go along in the hope of finally creating some blog content. I keep finding this extra step really slows me down and I forget to keep doing it at some points so what I end up with isn't even very good. I think this is just another skill I have not mastered (or even fundamentally grasped).
- el_oni 6y agoMy other wonder was how long it took to go from "i've got this camera" to "i've written this software". I imagine it's on the order of weeks. Which means you could probably do a daily journalling exercise. What you tried, what worked etc. It's interesting to wonder about, but i imagine the dead ends, looking up docs, writing debugging tools is too boring to put in a blog
- mobilio 6y agoUsing binwalk you can unpack existing firmware and later you can build some exec for same architecture (can be MIPS or ARM) and repack in new firmware.
- FL33TW00D 6y agoBrilliant.
- 4x5-Guy 6y agoDefinitely a blog I'll have to keep track of.
- peter_d_sherman 6y ago>"The only thing that jumped out to me was the appearance of a sync word at the beginning of each packet, 0xf0debc0a. (In little endian, this is 0x0abcdef0.) On a lark, I Googled this, and actually found a project on GitHub from 2015..." That is some excellent Google-Fu! I had never thought about Googling the reversed-endian versions of hexadecimal constants -- until you wrote about doing this; I think it's a brilliant idea, so I'm adding it to my search engine technique toolbox. In summation, it's a great idea! It's both simple and elegant!
- londons_explore 6y agoWhat surprises me is that there aren't more users of this constant...
- ejolto 6y agoI usually see constants that are easier to read like 0xdeadbeef, 0x0c0ffee0 or 0xcafecafe
- archi42 6y agoAlso works with function names: I regularly read assembly for which I don't have the source, only debug info. If the routine I'm interested in looks like a library or framework, there is some chance it's open source - so I'll throw it into Google and see what it brings up. Even if I don't get the exact same source (e.g. don't know the exact libc version), I get an idea what the routine should do, which tremendously cuts the time I need to understand what's going on.
- maxioatic 6y agoSuper cool! I've never done any embedded device work but have an interest. Seeing the layout of the flash in a straight forward image like this is pretty inspirational honestly. Definitely will be checking out more of his work.
- ponker 6y agoOne thing that I'd like to mention is that the author of this post attended Mississippi State University. I mention this because there is a widespread stereotype of the Deep South as a place teeming with racists, rubes, the willfully uneducated, etc... and I want to draw attention to the fact that there are also technology geniuses that come from there too.
- deleted 6y ago[deleted]
- simmons 6y agoMany great people have come from Mississippi, or passed through on their journey in life. Sadly, I think most of these great people end up leaving, thus re-enforcing some of the problems the area faces. I was thrilled to see a rigorous reverse engineering article. It's exactly the sort of thing I always hope to find when I browse HN. But I have to admit, it was a special delight to get to the end and find that the author was a fellow MSU alum. :)
- ponker 6y agoI think addressing the perception gap is part of this. No doubt that a lot of people equate "Southern accent" with "stupid." I've seen many lists of "Top 20 black engineers" or "Rising female executives in tech" but haven't seen something similar for Southerners, although I'd guess that in a typical FAANG interview the Southerner is starting out with more unconscious bias against them.
- hoseja 6y agoPoor Charlie. Does anyone know of a wireshark dissector tutorial similar to the one in the article, but for proper C?
- kanobo 6y agoTo the author: This site has major scrolling issues on Mac Safari in certain dimensions. For example, my window width is at 1347px and when I scroll quickly the layout goes crazy and everything flashes in different locations until the scrolling or overscroll stops. Occurs on any page on this site and in many other dimensions. Doesn't happen in Chrome though.
- gspr 6y agoI had weird similar-sounding issues with Firefox ESR on Linux. I didn't try to narrow it down to the exact conditions though.
- thrtythreeforty 6y agoAuthor here. How bizarre. Thanks for the report. I'll see if I can reproduce the behavior (I don't normally use Macs so I have to test ad-hoc).
- mschuster91 6y agoOn Android (Chrome/SM-T719 tablet in portrait) the sidebar occupies over half the screen.
- gspr 6y agoThese articles always make me feel two conflicting emotions at the same time: "I feel so inadequate because I couldn't do this reverse engineering myself" and "it feels good knowing that I'd do a better job than Charlie even though I don't even work in that industry". Poor Charlie.
- asddubs 6y agocharlie is a double agent who intentionally made the security weak so it could be hacked and opened. i salute you charlie, fight the power!
- consp 6y agoCharlie apparently also works at a large US car manufacturer as they do some bit mashing as well as a form of "encryption" in their software tooling (though only for the key as they then decrypt everything with the unmashed key with salted 3DES so no xor there at least).
- ryandrake 6y agoI would love to understand the software process breakdowns that allow that "Charlie" code to make it into production! Almost everywhere I've worked, this would have been instantly caught during code review and Charlie would have had to answer to at least his peers for his crimes! Or, it would have been caught during the integration phase, as there had to be some other team consuming the byte stream and implementing the reverse to "decrypt" it. How on earth does this make it through all the gates and out into the field?? 1. Were the requirements just vague? e.g. PRD just says "Encrypt the payload somehow, lol" and junior engineer Charlie, not being a crypto expert, just made something up? If so, that should have been caught and corrected by a code review. More eyes than Charlie would have at least looked at it and should have raised an alarm. 2. Did the requirements actually say "The payload shall be XOR'ed with the string 'Charlie is the designer of P2P!!' and then the bytes shuffled around as such: [...]" and everyone agreed this would be great? Where is engineering/security leadership push-back during the design phase, in that case? 3. Did the requirements call for proper encryption, and Charlie just ran out of time and cobbled this together? Again--code review, maybe insufficient project planning? I mean, bugs slip in to code all the time, but this seems like something deliberately done this way and deliberately ignored through the entire design, development, test, and deploy process!
- ChrisMarshallNY 6y agoThis is a story after my own heart. I have written a lot of ONVIF stuff, and have done pretty similar stuff with WireShark and Cocoa Packet Analyzer. Video is still surprisingly proprietary, even after all this time. I got the ONVIF stuff sorted, but the challenges I deal with, these days, is providing the video in a realtime streaming format that can be interpreted by as many clients as possible (especially Apple). RT[S]P doesn’t really cut it.
- londons_explore 6y agoMake Youtube or twitch live feed... Now its someone elses problem transcoding the data into millions of formats for every device under the sun...
- ChrisMarshallNY 6y agoNot for internal surveillance stuff. I'm working on a platform to commoditize IP cameras and NVRs.
- imtringued 6y agoWhat prevents you from simply using Kurento with the Playerendpoint and broadcasting the stream via WebRTC? There is even a nice sample application that you can try out without having to write any code. https://github.com/Kurento/kurento-tutorial-java/tree/master/kurento-player https://github.com/Kurento/kurento-tutorial-java/tree/master...
- ChrisMarshallNY 6y agoWell...this is for Apple systems. As you probably know, Apple is not just badly supported in the surveillance industry, it is actively hated. As I was working on the ONVIF stuff, I encountered this quite often. As soon as people found out I was working on Apple stuff, the relationship would go belly-up. I ended up not bothering to renew my ONVIF membership, because it didn’t really buy me anything. I created a “breadboard” streaming server for ffmpeg[0], but I’ve put my ONVIF stuff aside for a while, as I work on Bluetooth projects. [0] https://github.com/RiftValleySoftware/RVS_MediaServer https://github.com/RiftValleySoftware/RVS_MediaServer
- Retr0spectrum 6y agoWhere can I purchase one of those SOIC sockets?
- dillonmckay 6y agohttps://www.adafruit.com/product/1284 https://www.adafruit.com/product/1284
- ce4 6y agoLooks like this is not the drop in solution that the article used. Apparently the mentioned white small drop-in socket is from TaoBao but I couldnt find it there, neither on ebay...
- kogepathic 6y agoI found someone selling them on AliExpress, though at a high price point: https://www.aliexpress.com/item/4000990317952.html https://www.aliexpress.com/item/4000990317952.html If you don't mind a different style (clam shell), you can get them for significantly less: https://www.aliexpress.com/item/33025755888.html https://www.aliexpress.com/item/33025755888.html I suspect both AliExpress listings are an order of magnitude more expensive than they can be purchased on Taobao, but then you have to A) find it on Taobao, and B) use a shipping agent in China to export it. Found a US-based seller who has them for $3/each (min quantity 10): http://siliconkit.com/ocart/index.php?route=product/product&product_id=81 http://siliconkit.com/ocart/index.php?route=product/product&... Ah, the model number is listed on the flashrom wiki: https://www.flashrom.org/Technology#SO8.2FSOIC8:_Small-Outline_Integrated_Circuit.2C_8_pins https://www.flashrom.org/Technology#SO8.2FSOIC8:_Small-Outli... Edit: Here's the Taobao link: https://item.taobao.com/item.htm?id=576521466919 https://item.taobao.com/item.htm?id=576521466919
- myself248 6y agoThank you, I've been drooling over them on Dediprog for a while: https://www.dediprog.com/category/smt-sockets https://www.dediprog.com/category/smt-sockets but their MOQ is slightly offputting; I'd like just a few of each style to have on-hand.
- nvella 6y agoI must say, out of all the things to happen on a Thursday night I wouldn't have expected to read an article where someone referenced my own code that I wrote when I was 15. (5 years ago now... time flies) Here's the file I presumed he looked at; https://github.com/nvella/sdvr/blob/master/pk.c https://github.com/nvella/sdvr/blob/master/pk.c I was trying to reverse-engineer my parent's network CCTV DVR so I could hopefully integrate it with Home Assistant - as far as I'm aware the sluggish smartphone apps are still the only way to access those boxes. I wasn't ever able to get as far as George did with his IP cameras; I hit a snag on trying to correctly reassemble the H264 streams, so all I ever got out of it was mostly corrupt still frames. If you're reading this George, well done! :D
- sokoloff 6y agoI love these “it’s a small world” interactions on news.yc.
- cbanek 6y agoAmen! It's really touching when someone finds a bit of code that you thought would never be interesting and uses it! I've actually started a few friendships by asking questions, reporting bugs, writing random thank you notes on little code things. It's special to be reminded that you're part of the general network of humanity doing neat things, even if many things go unnoticed. :) Also very impressive code OP!
- knodi123 6y agolol, and then hacker celebrity Cliff Stoll chimes in with some nice words. This website truly is kinda special.
- thrtythreeforty 6y agoHi! Author here. You saved me a good day of figuring out what all the header fields meant. I definitely appreciated finding your code!
- thrtythreeforty 6y ago
- AnnoyingSwede 6y agoNice work dude!!
- melbourne_mat 6y agoIt's nice work. I always thought it would be a pain to implement a Wireshark decoder but I was wrong! One other approach that could have been taken: to add the desired protocols into the camera directly. I assume you're just adding a control channel and the video stream encapsulation would be minimal.
- mhaberl 6y agoI wonder did the Great Scrambler Charlie read this post. Proper encryption takes time, just XOR it, XOR it all he always says :) Great job and realy well written post.
- veaxvoid 6y agoHow do you have motivation to do this kind of stuff in your free time?
- osamagirl69 6y agoFor me it was that I stopped reading the news, and generally 'consuming' the media. Not only did it clear out several hours in the day, but it also generally allowed me to focus on being productive instead of being outraged or saddened by whatever was being peddled that day.
- petargyurov 6y ago"To begin, begin." ― William Wordsworth
- Already__Taken 6y agoI have a SWANN camera (some do rtsp, others not) only has port 900 open, wonder if this would work on all these "proprietary" cameras. The camera industry is shady AF with everything listed as call-for-price. I hate trying to source anything for it.
- hownottowrite 6y ago"Charlie is the designer of P2P!!" should be on a shirt.
- thrtythreeforty 6y agoHa - sort of a shitty version of the DeCSS T-shirts, huh? I love it. Pity nobody would know why it's funny... Or maybe that's part of the appeal. I can't decide.
- hownottowrite 6y agoYou’d be surprised how many people would get it. This thread has some legs.
- enchiridion 6y agoI don't really understand the busybox step? Can someone expand on what is happening there?
- enchiridion 6y agoI don't really understand the busybox step. Can someone expand on what is happening there?
- liones 6y agowonderfull idea
- tpmx 6y ago> As a quick aside, it’s natural to wonder why this camera doesn’t support RTSP and/or ONVIF. After all, plenty of other Reolink cameras do. Because I’d like to give them the benefit of the doubt, I’ll propose the possibility that Reolink ran out of storage on this camera and had to axe some features. After all, a 16MB flash chip would cost a whole 20 cents extra. This is just a cost-saving measure and definitely not vendor lock-in, hmmm? Don't underestimate the licensing cost of the software. Afaik most camera vendors use http://www.live555.com/mediaServer/ http://www.live555.com/mediaServer/ for the RTSP server software. There's a licensing cost for commercial use.
- hunter2_ 6y agoFWIW, Wyze manages to offer RTSP firmware (not pre-installed, but freely available on their website) for their $25 cameras.
- ctrager 6y agoI tried using their RTSP for my own motion detection logic (python, opencv, pointing at my birdfeeder) but the stream is too glitchy. So far the Amcrest IP2M-841 is working best for me.
- deleted 6y ago[deleted]
- rasz 6y ago8Mpix is their top of the line "premium" product. Forcing bundle with own NAS is a no brainer. btw I wouldnt be surprised if they didnt even pay HEVC royalties.
- systemshutdown 6y agoFor those of us interested in beginning to do RE, what does everyone suggest?
- dilly_bar 6y agoHow can I get started doing something like this? Maybe there is an ASK HN about this. Can someone point me to that? I bombed digital systems classes (I didn't actually fail, but I really suck at it) and I want to get better. I give out this info just to relay my feeble grasp at what is happening here.
- justinlloyd 6y agoThings I have reverse engineered in recent memory, that perhaps deserve a write-up. Nextwave Piranha CNC protocol -- easy, about three days of work Virtucache for VMWare ESXi -- easy-ish, about five days of work to completey take apart SONY camera firmware -- quite hard, about two weeks of work Loc8tor tracking tags - easy once I understood how active RFID works
- hunter2_ 6y agoHey, I'm in the market for some ONVIF/RTSP IPcams and saw Reolink highly recommended time and time again. Upon seeing how their 8MP cams don't have ONVIF but <=5MP do, I found this write-up just a week or two ago. Really cool work! I hate to say it with the author in the room, but I pretty quickly decided on 5MP to have everything work natively without also running bleeding edge middleware ;)
- ctrager 6y agoI'm a retired software dev. Before the pandemic I hadn't coded in 4 years, but somehow got the itch. One of the things I've been playing with is pointing a security camera at my birdfeeder, but I'm not so interested in clips of boring brown sparrows. Instead I want clips of bright red cardinals and bright yellow goldfinches. So I wrote some python opencv code that reacts to color changes: https://github.com/ctrager/opencv_py/blob/master/red_yellow_blue.py https://github.com/ctrager/opencv_py/blob/master/red_yellow_... This is working for me with an Amcrest camera, but I also got a Reolink E1 thinking it supported RTSP and felt cheated when I learned it didn't. I'll be playing with Neolink the rest of the day. Thanks.
- ngcc_hk 6y agoGreat job!!! open some eyes on video world. Would start to hack my video camera.