JanLoebel

Reverse Engineering of Hikam S6 (HI3518 E)

Why?

I wanted to integrate the camera into my home security system. The only problem is that I want to toggle the alarm of the camera based on the security system status. Currently, this is only available via the app or a time trigger which is booth not sufficient for me. So the main target was to change the alarm status without the app.

What I've done so far:

My first try was to capture the TCP packages between the Android app and the camera. Soon I realized that they are only TCP+SSL (not pinned) requests to a cloud service of Hikam. So I installed an emulator with the Hikam app and Wireshark. I've seen some packages but the payload is very strange and even if I send the UDP commands again the status won't change. So this was a dead end for me.

gabonator

Summary of passwords by sperglord8008s, updated November 1. 2020. For login try "root", "default", "defaul" or "root"

00000000
059AnkJ
4uvdzKqBkj.jg
7ujMko0admin
7ujMko0vizxv
123
1111
1234

gabonator

Cheap chinese IP camera with H264 encoding based on Hisilicon 8M (Hi3518E) chip

Video stream url for VLC/DVR:

• rtsp://192.168.1.93:554/user=admin&password=&channel=&stream=.sdp?real_stream--rtp-caching=100

Telnet access

• telnet 192.168.1.10 23
• Localhost login: root
• Password: xmhdipc

florabtw

// TKK = hours since epoch
var window = {
  TKK: parseInt(new Date().getTime() / 1000 / 60 / 60)
};

var t  = "a";
var dd = ".";
var Vb = "+-a^+6";
var Tb = "+";
var Ub = "+-3^+b+-f";