Reverse Engineering of Hikam S6 (HI3518 E)
I wanted to integrate the camera into my home security system. The only problem is that I want to toggle the alarm of the camera based on the security system status. Currently, this is only available via the app or a time trigger which is booth not sufficient for me. So the main target was to change the alarm status without the app.
What I've done so far:
My first try was to capture the TCP packages between the Android app and the camera. Soon I realized that they are only TCP+SSL (not pinned) requests to a cloud service of Hikam. So I installed an emulator with the Hikam app and Wireshark. I've seen some packages but the payload is very strange and even if I send the UDP commands again the status won't change. So this was a dead end for me.