Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Cheap chinese IP camera with H264 encoding based on Hisilicon 8M (Hi3518E) chip

Cheap chinese IP camera with H264 encoding based on Hisilicon 8M (Hi3518E) chip

Video stream url for VLC/DVR:

  • rtsp://192.168.1.93:554/user=admin&password=&channel=&stream=.sdp?real_stream--rtp-caching=100

Telnet access

  • telnet 192.168.1.10 23
  • Localhost login: root
  • Password: xmhdipc

Configuration placed at this path:

  • /mnt/mtd/Config

To change static IP Address:

  • armbenv
  • netinit eth0 192.168.1.93

For enabling DHCP

  • echo 1 > mnt/mtd/Config/dhcp.cfg

Interesting links:

# cat /proc/cpuinfo
Processor       : ARM926EJ-S rev 5 (v5l)
BogoMIPS        : 218.72
Features        : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant     : 0x0
CPU part        : 0x926
CPU revision    : 5

Hardware        : hi3518
Revision        : 0000
Serial          : 0000000000000000
# ps
  PID USER       VSZ STAT COMMAND
    1 root      1240 S    init
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 SW   [kworker/0:0]
    5 root         0 SW   [kworker/u:0]
    6 root         0 SW   [rcu_kthread]
    7 root         0 SW<  [khelper]
    8 root         0 SW   [kworker/u:1]
  119 root         0 SW   [sync_supers]
  121 root         0 SW   [bdi-default]
  122 root         0 SW<  [kintegrityd]
  124 root         0 SW<  [kblockd]
  137 root         0 SW   [khubd]
  148 root         0 SW<  [cfg80211]
  149 root         0 SW   [kworker/0:1]
  231 root         0 SW<  [rpciod]
  234 root         0 SW   [kswapd0]
  288 root         0 SW   [fsnotify_mark]
  291 root         0 SW<  [nfsiod]
  302 root         0 SW<  [crypto]
  372 root         0 SW   [mtdblock0]
  377 root         0 SW   [mtdblock1]
  382 root         0 SW   [mtdblock2]
  387 root         0 SW   [mtdblock3]
  392 root         0 SW   [mtdblock4]
  397 root         0 SW   [mtdblock5]
  431 root         0 SW<  [wusbd]
  440 root         0 SW<  [kpsmoused]
  465 root       872 S <  udevd --daemon
  471 root         0 SWN  [jffs2_gcd_mtd5]
  703 root      1552 S    /utils/upgraded
  711 root      2440 S    searchIp
  713 root      9536 S    dvrHelper /lib/modules /usr/bin/Sofia 127.0.0.1 9578 1
  714 root      1244 S    telnetd
  728 root      482m S    /usr/bin/Sofia
  836 root      1264 S    -sh
  853 root      1240 R    ps
# ls /bin
BurnHWID   cat        env        hush       ln         netinit    searchIp   true
[          chmod      false      ip         login      netstat    sed        tty
[[         cp         fgrep      ipaddr     ls         ping       sh         udevd
armbenv    date       free       iplink     mkdir      pppd       sleep      udevinfo
arping     dd         grep       iproute    mkfifo     pppoe      sync       udevstart
ash        dvrHelper  himc       iprule     mknod      ps         sysinit    udpsvd
awk        dvrbox     himd       iptunnel   mount      pwd        test       umount
btools     echo       himd.l     kill       msh        rm         top        upgraded
busybox    egrep      himm       killall    mv         rmdir      touch      xargs
# armbenv -r
LibCrypto : g_cryptotype = 2
**********************************************************************
|                      SYSTEM INFO
|                 ID:           8043420004048425
|       product type:           50H10L
|            product:           HI3518E_50H10L_S39
|      video channel:           1
|      audio channel:           1
|           alarm in:           1
|          alarm out:           1
| forward video chip:           OV9712
|           DSP chip:           HI3518E
|  analog audio mode:           voice codec
|           talkback:           voice codec
|    back video chip:           no chip
|    store interface:           SDIO
|    matrix surpport:           No
| wireless interface:           USB
|    hardware encode:           encode chip
|   hardware version:           1
|    video_interface:           BNC
|      net_interface:           Ethernet
|  hardware info len:           8
**********************************************************************
LIBDVR: Complied at Jun 12 2015 19:34:48 SVN:1028
bootdelay = 1
baudrate = 115200
serverip = 192.168.1.107
ipaddr = 192.168.1.93
netmask = 255.255.255.0
ethaddr = 00:12:13:11:8e:e0
HWID = 8043420004048425
ob_start = 0
ob_data = 82
# cat /etc/init.d/rcS
#! /bin/sh

/etc/init.d/dnode

udevd --daemon
udevstart

mount -t squashfs /dev/mtdblock2 /usr
mount -t squashfs /dev/mtdblock3 /mnt/web
mount -t squashfs /dev/mtdblock4 /mnt/custom
mount -t jffs2 /dev/mtdblock5 /mnt/mtd

mount -t ramfs  /dev/mem        /var/
mkdir -p /var/tmp
mount -t ramfs  /dev/mem2       /utils
mount -t usbfs usbfs /proc/bus/usb/

mkdir -p /mnt/mtd/Config /mnt/mtd/Log /mnt/mtd/Config/ppp /mnt/mtd/Config/Json
if [ -f /mnt/mtd/Config/ppp/3gdigal ]; then
        chmod 777 /mnt/mtd/Config/ppp/3gdigal
fi

/usr/etc/loadmod
netinit
cp /bin/upgraded /utils/ -f
/utils/upgraded &
ifconfig eth2 down
telnetd &
sysinit &
searchIp &
#wlandaemon &
#route_switch &

/bin/pppd pty /etc/ppp/pppoe-start file /etc/ppp/pppoe-options &
if [ -f /mnt/custom/extapp.sh ];then
        /mnt/custom/extapp.sh &
fi
dvrHelper /lib/modules /usr/bin/Sofia 127.0.0.1 9578 1 &
@canaula

This comment has been minimized.

Copy link

@canaula canaula commented Aug 22, 2017

Hello!
For this camera, what is the URL to show an image capture?

I need to insert the image into a web.

The problem of this camera with this firmware is that it does not fuciona neither sending by mail nor the sending by ftp. It's a mess, I'm 2 years old with headaches.

@ovisopa

This comment has been minimized.

Copy link

@ovisopa ovisopa commented Sep 5, 2017

I also want to get an image capture and everything I tried so far didn't worked :( If anyone can give us some help, regarding this feature, how to check for sure if it's implemented in the firmware, I'll be thankful

http://192.168.1.86/webcapture.jpg?command=snap&channel=1
http://192.168.1.86/webcapture.jpg?user=admin&password=*****&command=snap&channel=1
http://user:pwd@192.168.1.86/webcapture.jpg?command=snap&channel=1

Some details from the telnet connection:
cat /proc/cpuinfo
Processor : ARM926EJ-S rev 5 (v5l)
BogoMIPS : 218.72
Features : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant : 0x0
CPU part : 0x926
CPU revision : 5

Hardware : hi3518
Revision : 0000
Serial : 0000000000000000


| SYSTEM INFO
| ID: 8043420004048425
| product type: 50H10L
| product: HI3518E_50H10L_S39
| video channel: 1
| audio channel: 1
| alarm in: 1
| alarm out: 1
| forward video chip: OV9712
| DSP chip: HI3518E
| analog audio mode: voice codec
| talkback: voice codec
| back video chip: no chip
| store interface: SDIO
| matrix surpport: No
| wireless interface: USB
| hardware encode: encode chip
| hardware version: 1
| video_interface: BNC
| net_interface: Ethernet
| hardware info len: 8


LIBDVR: Complied at Oct 22 2014 09:50:09 SVN:887

Build Date:2014/10/23 16:54:2
System: V4.02.R12.00006510.10010.1407

Thank you.

@PeterEmbedded

This comment has been minimized.

Copy link

@PeterEmbedded PeterEmbedded commented Oct 11, 2017

Use this to capture a single frame:
http://192.168.1.123/webcapture.jpg?command=snap&chanel=1
Note the typo in "chanel"

@PetrJakes

This comment has been minimized.

Copy link

@PetrJakes PetrJakes commented Nov 27, 2017

About mentioned solution (http://...) reads low resolution channel only.
Try to use ffmpeg to capture still image from the video stream:
ffmpeg -f rtsp -rtsp_transport tcp -y -i "rtsp://xxx.xxx.xxx.xxx:port/user=admin&password=yourPass&channel=1&stream=0.sdp?real_stream" -f image2 -vframes 1 -vsync 2 -pix_fmt yuvj420p "/path/to/the/picture/photo_$(date +%Y.%m.%d_%H:%M:%S).jpg"

@sony87

This comment has been minimized.

Copy link

@sony87 sony87 commented Feb 26, 2018

I'm trying to configure such camera HI3518E_50H10L_S39 to NVR software (Genius Vision NVR). When installed locally in the network where the camera is it finds the camera and add it via onvif protocol with username root and password which i don't know. It's working locally. Tried to access it remotely vie the external IP, port forwarding on 8899 port is set but it's refusing to connect. Not sure which password to use... any help ?

@rocklaam

This comment has been minimized.

Copy link

@rocklaam rocklaam commented Mar 20, 2018

I have a IP camera using HI351E, model: IPC-Z06HL and trying to get a video link ? Can you show me the way in detail ? I'm just a newbie! Thanks in advance ! :D

@AntonOrlov

This comment has been minimized.

Copy link

@AntonOrlov AntonOrlov commented Apr 18, 2018

@neeqkowlah

This comment has been minimized.

Copy link

@neeqkowlah neeqkowlah commented May 22, 2018

Hi, I have a camera wifi with the hi3518E chip. the IPC-BT511SW-1.3
The FTP service was not working so I tried to update the firmware with some of the list given in the previous message.
But since i update it, The Wifi connection doesn't work anymore :(
the camera is always working, i see the picture but olnly whent it is connected with ethernet cable.

I have a doubt on something : when i saw the version on the web interface I think i have seen
4.0.R12.00006510
but when i connected with telnet, i saw 53H13 in product type:

is it possible ? how can i recover wifi connection ? is there any old firmware ? does anyone had the same pb ?

thank you very much

@Suncatcher

This comment has been minimized.

Copy link

@Suncatcher Suncatcher commented May 22, 2018

Hi guys!
Do you know does this camera support PoE (Power over Ethernet)?

@JanLoebel

This comment has been minimized.

Copy link

@JanLoebel JanLoebel commented Jun 20, 2018

I've wrote something about the Hikam S6 (based on HI3518E):

https://gist.github.com/JanLoebel/b5dafcda555323785d32ccb7d643dbcd

@kxn25

This comment has been minimized.

Copy link

@kxn25 kxn25 commented Aug 20, 2019

Hello i need help with my ipcam.
The Protocoll type is N1 what ever that means.
i cant connect via telnet. the port 23 is open but no username or password.

Zwischenablage01

How can i access the cam?
and can i flash an diffrend software on it to maybe use onvif?

I finally found it
Telnet:
Usernam: root
Password: j1/_7sxw

This is for Sannce Ip Cam

@needPizza

This comment has been minimized.

Copy link

@needPizza needPizza commented Sep 3, 2019

Hey guys, anyone has any idea how to pan/tilt those cameras using POST/GET calls?

@fdellutri

This comment has been minimized.

Copy link

@fdellutri fdellutri commented Nov 23, 2019

@kxn25 did you find the credentials to connect via tenet?

@kxn25

This comment has been minimized.

Copy link

@kxn25 kxn25 commented Nov 23, 2019

No it needs user/password i dont have.
Is there a way to re Flash there a System on?

@420pootang69

This comment has been minimized.

Copy link

@420pootang69 420pootang69 commented Jan 12, 2020

About mentioned solution (http://...) reads low resolution channel only.
Try to use ffmpeg to capture still image from the video stream:
ffmpeg -f rtsp -rtsp_transport tcp -y -i "rtsp://xxx.xxx.xxx.xxx:port/user=admin&password=yourPass&channel=1&stream=0.sdp?real_stream" -f image2 -vframes 1 -vsync 2 -pix_fmt yuvj420p "/path/to/the/picture/photo_$(date +%Y.%m.%d_%H:%M:%S).jpg"

I just want to throw this on the web somewhere, and part of my search led me here, so this seems relevant.

I've been tearing my hair out for the last three days trying to get reliable images off one of the cheaper hisilicon based cameras I have and it took a lot of faffing about to get here, so I'm hoping this can help someone else. (I've used the above line on all my other cameras and it has worked fine).

Long story short, could not get a 100% reliable frame grab off one of the cameras I have. I had to specify -vsync 2 on both the output and input. I then had to specify only iframes on the output.

The line I'm using looks like this:
ffmpeg -y -rtsp_transport tcp -vsync 2 -i rtsp://192.168.178.106:554/user=admin_password=PASSWORD_channel=1_stream=0.sdp?real_stream -vframes 1 -vf "select='eq(pict_type,PICT_TYPE_I)'" -vsync 2 /home/pi/node-red-static/grab1.jpg

I've set the encoder on the camera to use an iframe every second, so it doesn't hold up the command too much.

Hope this helps someone else!

@anked9

This comment has been minimized.

Copy link

@anked9 anked9 commented May 31, 2020

@kxn25 can you tell me the exact rtsp url for your camera, url which gives you highest (1280*960) resolution stream and also make of your camera, photos of the camera also if possible. I will dump the firmware and tell you the telnet password if you want.

@kxn25

This comment has been minimized.

Copy link

@kxn25 kxn25 commented Jun 1, 2020

@kxn25 can you tell me the exact rtsp url for your camera, url which gives you highest (1280*960) resolution stream and also make of your camera, photos of the camera also if possible. I will dump the firmware and tell you the telnet password if you want.

I found the Password. But what can i do with that.
I would rather hack the DVR Recorder in Order to prepair it for my Raspberry Pi to get the Image on there. The DVR is running on a seperate IP Range.

Password Hash:

root:ABgia2Z.lfFhA:0:0::/root:/bin/sh

Telnet:
Usernam: root
Password: j1/_7sxw

U-Boot

#printenv
bootdelay=1
baudrate=115200
ethaddr=00:9A:9B:9C:9D:9E
ipaddr=192.168.1.10
serverip=192.168.1.40
netmask=255.255.255.0
bootargs=mem=40M console=ttyAMA0,115200 root=0100 init=/linuxrc mtdparts=hi_sfc:192K(uboot),64K(env),64K(user),384K(conf),1920K(kernel), 4032K(rootfs),1536K(custom) ramdisk_size=4032
bootcmd=sf probe 0;sf read 0x82230000 0xB0000 0x1E0000;sf read 0x82410000 0x290000 0x3F0000;bootm 0x82230000 0x82410000;
stdin=serial
stdout=serial
stderr=serial
verify=n
ver=U-Boot 2010.06 (Oct 12 2015 - 21:54:32)

Environment size: 515/65532 bytes

uname -a

Linux (none) 3.4.35 #2 Tue Aug 23 18:55:44 SGT 2016 armv5tejl GNU/Linux

free -m

         total       used       free     shared    buffers     cached

Mem: 35336 34184 1152 0 1784 8408
-/+ buffers/cache: 23992 11344
Swap: 0 0 0

cat /proc/cpuinfo

Processor : ARM926EJ-S rev 5 (v5l)
BogoMIPS : 269.10
Features : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant : 0x0
CPU part : 0x926
CPU revision : 5

Hardware : hi3518ev200
Revision : 0000
Serial : 0000000000000000

IPC

@rtaft

This comment has been minimized.

Copy link

@rtaft rtaft commented Sep 16, 2020

@kxn25 Thanks for this, this password works for my cameras. I made the mistake of updating the s/w version of the cameras from the DVR and it shut off the RTSP port on 2 of them, (they are running /usr/bin/anyka_ipc on 80 and 554), and I have another that looks identical but also has RTSP turned off but runs /usr/share/ipcam/app on 80. I'll be trying to figure out how to either get rtsp back on or run some other software on these.

@kxn25

This comment has been minimized.

Copy link

@kxn25 kxn25 commented Sep 17, 2020

@rtaft thank you that would be great.
I am also working on trying to figure out how to ohne the rstp Port and or Port 554.
On my cam's only port 23 and 80 are open.

@rtaft

This comment has been minimized.

Copy link

@rtaft rtaft commented Sep 17, 2020

@kxn25 Looks like the filesystem is read only. I have 4 391806s and 1 57801024 (which is what you have). I was able to find an older firmware download for the 391806, it may not be old enough but I will test it out at some point. I was able to unpack it with 7zip and mount the contents with squashfs. In theory I should be able to make changes to it and repack it, then update the firmware from the DVR and USB. The main issue I'm having is transferring files from the device, tftp always times out (on the 391806 anyway), I was hoping to snag the old anyka_ipc binary from one cam and move it to another. I didn't spend too much time on it though, was just tinkering this morning. In theory, the DVR reaches out to the internet to download the latest firmware, could find out where it's getting it from and see what versions are available, at the very least get a copy of the latest 57801024 image to play with. The alternative is to reverse engineer the N1 protocol. I just need to find some free time to play with it.

@kxn25

This comment has been minimized.

Copy link

@kxn25 kxn25 commented Sep 18, 2020

@rtaft
Have a lool at that link:
[(http://mark4h.blogspot.com/2017/07/hi3518-camera-module-part-1-replacing.html)]

I have connected the Cam on the TX0 and RX0 pins to my Computer via a TFDI Adapter, with Arduino IDE i could see the Serial happenings.
But i am not so cloued up what to do with that.
As far as i found out the only way to change things is to download the files with tftp, change an upload again?!
The other thing is the Hilinux System i have no idea but as you syed it is read only.

the N1 protocol

Is it possible to change that into ONVIF?
And do you know the diffrence??? iam so confiused with all these Protocolls and types ????

@kxn25

This comment has been minimized.

Copy link

@kxn25 kxn25 commented Sep 20, 2020

@rtaft
I have found this page
http://www.openipcam.com/files/

But cant do anything with it, there are scripts and so on.

Have you tryed on Telnet open the busybox command?
there are also some things you can do, but it´s to much for me.
I cant find a editor like "vi" where i can open or view files.

@roma6868

This comment has been minimized.

Copy link

@roma6868 roma6868 commented Dec 19, 2020

Hello I have a Chinese IP camera, when it was updated there was a power cut since it requires more: /, it is based on a HI3518E V200.
When starting the camera I read what is happening via the debug port and at the end I get this error

List of all partitions:
1f00 256 mtdblock0 (driver?)
1f01 1600 mtdblock1 (driver?)
1f02 5824 mtdblock2 (driver?)
1f03 512 mtdblock3 (driver?)
1f04 8192 mtdblock4 (driver?)
No filesystem could mount root, tried: squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

Anyone have any idea how to fix the problem? I looked for a new firmware but impossible to find it

thanks in advance.

@rtaft

This comment has been minimized.

Copy link

@rtaft rtaft commented Jan 22, 2021

@kxn25 With the death of Flash I finally started looking into these cheap cameras. The N1 protocol appears to just be an HTTP wrapper for RTSP. In my case http://192.168.1.XXX:80/livestream/11?action=play&media=video_audio_data for all 4 cameras responds with an HTTP header followed by an RTSP header and the streaming content. Using wget to store the output to file, and playing the file with ffplay works fine, I haven't figured out how to play the stream directly in ffplay but it gives me something to work with.

@fumpi1988

This comment has been minimized.

Copy link

@fumpi1988 fumpi1988 commented Jan 26, 2021

@rtaft i tried this a while ago, but I always get a 401.

@rtaft

This comment has been minimized.

Copy link

@rtaft rtaft commented Jan 26, 2021

@fumpi1988 The wget command looks like so wget --auth-no-challenge --user='admin' --password='thepassword' http://192.168.1.XXX/livestream/11?action=play&media=video_audio_data. I had manually generated the auth header before, but I figured out I was just missing the --auth-no-challenge Just remember its downloading in the background, you need to kill it manually.

@fumpi1988

This comment has been minimized.

Copy link

@fumpi1988 fumpi1988 commented Feb 8, 2021

I've tried a bit using the following:
wget --auth-no-challenge --user='admin' --password='' http://192.168.2.99/livestream/11?action=play

but this gives an error that there isn't any data.

If I use the param &media=video_audio_data behind the adress, there seems to be some output, at least wget creates a file, but this file is only 4kb.

What am I doing wrong?

@rtaft

This comment has been minimized.

Copy link

@rtaft rtaft commented Feb 8, 2021

@fumpi1988 I accidentally left off that param the second time, i just fixed that. It actually creates 2 files, wget.log and 11?action=play, with the 11?action=play having the video. Hopefully you just overlooked the second file.

I haven't put together a wrapper to play the video directly yet. I found this by plugging my DVR directly to my laptop, and shared the network via the WiFi on the laptop with it. Then I used Wireshark to view the HTTP data.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment