Notes on Quelima R3 WiFi Camera

readme.md

First

• Install the app "Sports DV" and change WiFi SSID and password

URLs

• Wifi and Cam settings are seperated and have different port numbers.
• Wifi-Settings (just login withoug username and password): http://192.168.25.1
• Cam LiveStream: http://192.168.25.1:8080/?action=stream
• Not sure how the configuration is made really... Would need a Man-In-The-Middle-Attack or send the initial ICMP package

Change AP (Cam is the access point) to Station (Cam is a normal WiFi Client)

• Log into http://192.168.25.1 without entering user and password
• Go to the second tab, there you can change the access mode vom "AP" to "Station", enter the SSID of your home WiFi, Encryption mode and password (works with Windows 10 mobile hotspot, too, just notice it only works with 2.4 GHz networks). The cam will guess the channel when you saved the settings.
• Don't worry, if the connection fails, the camera will offer you the configured AP again
• Better give it a fixed IP through your router (identified by MAC address)

Other Information

• The connection between the app and the cam is made through an initial ICMP package with the payload "99 bottles of beer on the wall"
• looks like "MJPG-Streamer" was used when googleing for the url structure

Button configuration

• Reset: Press Mode first and then On/Off

Good evening to all.
I also have a problem with the sq23 camera. when I register on the mobile (ios, iphone) photo or video, I can not find the files on the mobile. does anyone know where I find them?

Has anyone found out if the SQ13 can be streamed via USB at 1080p?
When plugged to the PC it automatically creates a UVC driver but all camera programs can only use it as 720p. is that the real native format?

FYI about getting SQ23 video stream from a PC in Wi-Fi :

• First connect the PC to the SQ23_XXXX Wi-Fi. By default, it seems only 1 PC can be connected to it at a time. The camera acts as a DHCP server 192.168.33.1/24 and appears to provide an IP similar to 192.168.33.101. In case you try to play with eth/Wi-Fi bridges between the PC and the camera, it appears that the DHCP server only gives an IP to 1 interface at a time (and only that one will be used as destination of the UDP video stream packets), so you might have to use static IP for the intermediate devices if you need them.
• A Wireshark network capture during a communication between a smartphone with the Sports Camera app and the camera showed that 2 UDP control links need to be established and maintain the stream alive, see sq23control sample code for that on https://www.ensta-bretagne.fr/lebars/Share/sq23.zip . Unfortunately, the video stream appears to not be fully supported by OpenCV, see mjpeg.py, which gives partial images on Windows with Python 3.8.2 and pip install opencv-contrib-python==4.2.0.34 . It appears to be some kind of MJPEG over UDP 10900 (images of 640x384), start of packets appears to have this hex format : lowbytefilenumberrstartingfrom1 highbytefilenumberrstartingfrom1 nbofpackets packetnumberstartingfrom0 31 14 00 00 varyingbytes, see sq23video for an attempt to decode it a little bit better…

I have SQ23 camera and can see interface at http://192.168.33.1/, but I have refuse connection at http://192.168.33.1:8080/?action=stream .
There is even no 8080 port in nmap output

Nmap scan report for 192.168.33.1
Host is up (0.0097s latency).
Not shown: 997 closed tcp ports (reset)
PORT      STATE SERVICE
80/tcp    open  http
8081/tcp  open  blackice-icecap
30000/tcp open  ndmps

How can I access stream?

I have SQ23 camera
...
How can I access stream?

The code I propose in the previous comment might be what you want?

I have SQ23 camera
...
How can I access stream?

The code I propose in the previous comment might be what you want?

I tried your code(Python and exe) and it doesn't work too.

If I remember well, assuming only your PC is connected to the camera Wi-Fi (and without firewall, antivirus, etc.), first you need to run sq23control.exe (and leave it running, it keeps the stream alive through UDP 20000 and 20001 communication), then sq23video.exe (the Python code was not working well and also needs sq23control.exe to be running), which should display something (through another communication on UDP port 10900)...

If I remember well, assuming only your PC is connected to the camera Wi-Fi (and without firewall, antivirus, etc.), first you need to run sq23control.exe (and leave it running, it keeps the stream alive through UDP 20000 and 20001 communication), then sq23video.exe (the Python code was not working well and also needs sq23control.exe to be running), which should display something (through another communication on UDP port 10900)...

It works! Thanks!

Does anyone know how to start recording or turn on IR via wifi?

i'm not a pro at reverse engineering, i've just followed some tutorials and stuff, and got a 17k lines with some mix of assembly, xml and some funny comments mentioning stack overflow, i think some of the broken characters appearing is because of some language pack missing (MAYBE), i'm looking after some commands to toggle recording and toogle IR through the wifi.

wishin i could understand more about the code, i would love to create a better interface, the need to download a individual app on my phone just looks wrong, even my own router has a web interface thats sound perfectly fine, why create another step when you currently trying to configure your camera?

@WilliamD-s
this content is coming from a chip dump, right?

@vinibali not exatly, what really happens was that a friend come to me with this sq camera that he changed the password and could not remember it, then found this post with the equivalent model firmware, i tried and it worked fine , my friend doe's not have interest on the camera then i can freely try some improvement

the comment with the firmware i've used is:
kdevkdev commented on Apr 14, 2020

this week i'll try to find a compatible charset to the one that were broken on my previous screenshots.

I made a video about how to reset the camera a while back if anyone is still struggling
https://youtu.be/oDpBJmrp2FU

@WilliamD-s
I though you would like to spend some time to develop a new FW, based on this:
https://gist.github.com/gitfvb/09085fd0cd4993549feb7470430d40e9?permalink_comment_id=3356708#gistcomment-3356708

I'll take a closer look on those codes, but this may take a while, for now i'm kinda of focusing into other priorities, but i'm surely coming back help with this project.
My career it's all focused on web development and process automation, then i' would be another study charge to remove the rusty from my c skills, or even if i dare to use C# or Java to the new version this totally different from what i'm used to, not impossible.
But for the next 2 months i cant promise to starting something beyond reading the code you mentioned

Hello there again!
I've spent some time with my SQ23 camera. According to the labels on the PCB, 7668A is the project/product name for which we should search for.
Unfortunately none of repos are having that string at https://github.com/yilanjueding123
There is also a SV6030P single-chip WLAN board can be found, so if we want to do something with the sources we need to lift over some code from other repos, as some of them at yilanjueding's repo are having WIFI set up.
I walked trough all the Generalplus datasheets and according to the specifications, like:

• LQFP64 package
• JPEG codec
• MMC and CMOS interface
• MIC interface
  and according to that SQ23 is supposed to have a GP327902B processor, but the physical wiring not matches.
  I've found two other projects and this pinout for GPCV1247A_64PIN is more likely matches to the 7668A PCB.
  Wiring diagram can be found here:
  https://github.com/lionyhw/JHDH-8412_1247/blob/master/8412/JHDH-8412_1247.pdf
  https://github.com/yilanjueding123/mypdf/blob/master/pdf/JH_7612%20V1_SCH.pdf
  I was also trying to compile the firmware and added some steps to do it with Linux and arm-none-eabi-gcc package:
  https://gitlab.com/vinibali/7682-v010/
  So if we found something which is a bit more close to the SQ23, that shouldn't be a big deal to play with the sources.

This small camera is really interesting, as you could see I damaged the small 0 Ohm fuse for the wifi module while I was disassembling it.
The functions of the buttons literally have gone at all, the only thing I could do was to power it up and reset with the two button combination. Sometime the switch to the WIFI mode was working, but nothing really else.
I also spent some time with searching for all the sources, but it seems only those two can be used. Nothing really else contains the code.
Another thing is that GPCV1248 is the closest chip to the GPCV1247A, which might be a lower pin count chip.

I have SQ23 camera and can see interface at http://192.168.33.1/, but I have refuse connection at http://192.168.33.1:8080/?action=stream . There is even no 8080 port in nmap output

Nmap scan report for 192.168.33.1
Host is up (0.0097s latency).
Not shown: 997 closed tcp ports (reset)
PORT      STATE SERVICE
80/tcp    open  http
8081/tcp  open  blackice-icecap
30000/tcp open  ndmps

How can I access stream?

run this

import requests

url = "http://192.168.25.1:8080/?action=stream"
headers = {
    "User-Agent": "Lavf/58.12.100",
    "Accept": "*/*",
    "Range": "bytes=0-",
    "Connection": "close",
    "Icy-MetaData": "1"
}

response = requests.get(url, headers=headers)
print(response)

and then you will get a 200 as a response and the stream will work
but i don't it think it does anything. if you don't have a stream a thing to do is to restart it over and over till it works

I have SQ23 camera and can see interface at http://192.168.33.1/, but I have refuse connection at http://192.168.33.1:8080/?action=stream . There is even no 8080 port in nmap output

Nmap scan report for 192.168.33.1
Host is up (0.0097s latency).
Not shown: 997 closed tcp ports (reset)
PORT      STATE SERVICE
80/tcp    open  http
8081/tcp  open  blackice-icecap
30000/tcp open  ndmps

How can I access stream?

run this

import requests

url = "http://192.168.25.1:8080/?action=stream"
headers = {
    "User-Agent": "Lavf/58.12.100",
    "Accept": "*/*",
    "Range": "bytes=0-",
    "Connection": "close",
    "Icy-MetaData": "1"
}

response = requests.get(url, headers=headers)
print(response)

and then you will get a 200 as a response and the stream will work but i don't it think it does anything. if you don't have a stream a thing to do is to restart it over and over till it works

That's Python, right?

Pakete mithilfe von "Packet Manager" auf Android analysiert.

@lebarsfa @vinibali

Hello

I bought a SQ 13,23 as a wireless camera to use on my Raspberry Pi.
I have a problem with the camera not connecting to wifi on my laptop, so I can't access the strwam url either.
But can connect on my cell phone.