RTSP stops working without access to the Internet. #3
Comments
|
@hubaksis Chances are this is some code in the device that is preventing it from working without access to the tuya servers. Since you have telnet access the first thing I would try is to see if disabling the internet causes telnet to stop working as well (i.e. when RTSP stops working), then restoring internet access to see if telnet stays working when RTSP comes back. The point of this test is to check if the device is rebooting, or disconnecting from the network in any fashion, so if the telnet stays running the whole time it is likely something in the main application code that we would have to review with ghidra (and hopefully disable). It could be very helpful to execute You can post a zip of your main application here if you'd like me to take a quick look at it. Based on the information you posted above I expect you can copy it to the SD card with this telnet command: |
|
@jelteswinnen I need a copy of the dgiot application file to be able to look at it, otherwise I can’t do anything. |
|
--deleted-- |
|
@rhamdoud I haven't had much time lately to look at this project but I'll try to take a look as soon as I have a chance. |
|
@rhamdoud I spent some time looking at the main application provided and noticed it constantly monitored the mqtt status from the tuya server and performed different functions based on that. I made a patch to disable that monitoring in case you wish to try it: You can try it like this:
If it crashes/reboots when attempting the above I'm afraid the only way to move forward would be if you wanted to re-flash the device (which requires opening it, requires the right tools, etc) -- basically use 'Option 1' to modify the boot script so it mounts/runs dgiot from the SD card, then we can try different patches. Without the device I'm limited on testing/investigation since I can't look at all the boot scripts and try to make changes to find anything we can use to modify it. |
|
The patched What I havent tried is to cut off the connection to aws:8883 and/or aws:1443 after it has been established. My firewall can't do something like this, but it might be something to try. |
|
Oh, I got the camera back and can continue experiments with it.
|
|
@guino @michaelkleinhenz Also, there is some addition to my message above. |
|
Ok, interesting, I need to try it with waiting a bit to see if the rtsp stream reappears. The IPS file is a binary patch. You'll need the original binary and an IPS patch tool for your operating system. There are also a bunch of online tools available. |
|
@hubaksis you can use this online tool to patch the file with the steps listed: Here's how to patch:
|
|
Thank you. I have applied the patch.
Camera reboots almost immediately after running a new version. I started to use this one just in case:
and got the following dump. |
|
There are clearly errors with reading data from a config file, so I took the content of the file from After restarting the camera, killing the original dgiot, starting the patched one the result is below. |
|
Oh, and the last test. |
|
@hubaksis from the log, it looks like the watchdog isn't being 'freed' when you kill the application, so basically if you kill dgiot the device will restart because you won't be able to open the watchdog (to prevent it from restarting). We'd have to take a look at your startup files to see if there's a way to execute dgiot from the SD card directly, that is, without running the one from the internal flash. You'd have to provide a zip of the firmware dump or just zip the / into a file in the SD card so I could review them -- either way there's no guarantee we can find a way to do it. |
|
Thanks for looking into it. |
|
@hubaksis that command should be fine, then you'll have to zip it to post it on github. |
|
I'm working on the same problem. And reached the same point now. It's so frustrating... happy to hear of any success in this regard. Greetings Fred |
|
I had the following idea: Do you think it might be possible? Let everything run as it was, but additionally start a new process, which reads the camera data and offers it as rtsp stream. |
|
"start a new process, which reads the camera data and offers it as rtsp stream." - That is what I tried at first, I even wrote some code (you can see it here: https://github.com/guino/BazzDoorbell/tree/master/streamer) but it still requires looking at the code in ghidra to find the ring buffer address, plus you have an extra process on a device with limited amount of memory... bottom line is: it was much easier to 'mod' the existing application to provide RTSP than write it from scratch. It is not impossible, just requires someone with a lot of time. |
|
I tried intalling mediamtx and ffmpeg. The "ring buffer"? I guess that's where the video-data is stored? |
|
dgiot-7.6.32.zip I had another idea: The hosts file is read-only though. But maybe the traffic can be re-routed inside the router? |
|
These devices usually have a hardware/chip encoding function which gets the camera feed, encodes it and places it in a 'ring buffer' (circular buffer) where it keeps writing to the end of it until it runs out then it goes back to writing at the start. It's usually not that hard to find the memory in the application where it's stored, but the application usually gets 'notified' when new data arrives and an outside application would simply have to 'monitor' it which can be tricky and CPU intensive. You should be able to use I have seen some SDKs floating around for these boards, and it may be easier to use an SDK to write a whole new application that will just serve RTSP than to do any of stuff mentioned above. It's sad but I think they just do this on purpose, I mean: they sell you a cheap device which only works with their cloud stuff so you're locked in to their services. There are some projects like open_ipc that aim to flash a whole new firmware without manufacturer cloud, but hardware support is very limited. I personally stopped buying these devices -- if I need something I just get on aliexpress and look for anything with RTSP readily available, pay a little more and not have to deal with any cloud stuff. |
Hi there,
Sorry, maybe this is the wrong place to ask the question, but this is the best I could find so far.
Issue: my camera has ONVIF support, but as soon as I turn off it's access to the Internet - RTSP and ONVIF stop working in a short period of time. RTSP can be accessed on
rtsp://IP:8554/mainandrtsp://IP:8554/sub. No sound.As this is a camera in the bedroom, I prefer it to be disconnected from the internet and connected only to local Zoneminder server.
This is the camera:
Works with the app Smart Life.
Version: V8.37.5
I could turn on ONVIF support and get urls via Onvif Device Manager. VLC shows streams without sound.
When I thought that setup is finished and cut the internet for the camera - in a short while everything stopped working. It seems that the camera tries to get settings from the server and goes back to defaults when it can't connect.
I couldn't find the way to enable http access on 80 or 8090 as described here: guino/BazzDoorbell#2
However, I managed to enable telnet by uploading the file 'product.cof' with
telnet=1option.Login
rootpassworddgiot010got me the access to the system.There I can see
BusyBox v1.26.2 (2022-06-29 19:04:37 CST) built-in shell (ash)So, I'm asking questions here as this is the first place where I could to something with this camera :)
Can you please point me to the direction where I can find out and maybe fix the issue?
Thanks.
The text was updated successfully, but these errors were encountered: