0

I have 2 p2p wifi spy cameras modules. They work inside local LAN but not outside because there is problem with the servers they used. They work via the BVCAM for Android or similar for windows and IOS but nothing for Linux. I try to understand the way they work and use them with Linux. I tried to work BVCAM with wine without succeed also they havent web interface. The camera module is FH-W1 V1.1, with wifi chip 88W8801 from Fullhan and DSP BL-R8801 from Bilian Electronics. There arent datasheets for them. I capture the UDP packets inside LAN with wireshark and try to understanding the way they communicate with APP. As i understand they exchange some small packets to communicate and after the camera sends bigger packets. I think they are the video stream. It isn't RTP, it is byte stream and i want to understand it and to decode it. I post the first "big" packet (i have removed the eth and ip headers), i left the udp header the first 8 bytes, from 9th 0x03 and after i think is the stream

c002bebf0078c8a4003006a010100000001000000d82000004a01000045010000010000004001f000705a0d0003000001a000000001419a0006000c233f0378aa3c658b4c96d4c46a3b5e8ae077097cc1de446be78425c892df1088882bf3fd2eb02b1446b5e61fc46df7f99566286cbdd572c0be7137ce6a377472e4a18be26feded27666fd40ddfe8568c3dcbe846d698843f1b74cfd6d716c6f52864c3ae66895e7d5d62ba7628e869f1cbdc185c97fc2c002a0ffe2fe546cd0a9f914a6fa8ff97d8ca0f313d0fa0d955c979be97aed6a7489e36ea8b99eb50cb1e67a4431bc1a4e0d1cbb91544297aafe69b64c5a4f6067bd4d55328ab638f110a0a4242153459d7f433ede364f62af0fcf78c62d5fc3e56742eb48320c7a542cfba9406c7ced098268c5c49364cb5b42c00aaceb8ccf837c41a2b88188691363917d6742e362cb4a9770bbefa8bb267bddc302e50fd344b147b879f98985aaf144099b04aa88ce474c3fe5c1075f3f2b06e7c9939ece598859ac0

The small packets exchanged at both devices ports 10210 and 17900, the stream at 49154 from camera and random port near 49000 from mobile phone. The small packets exchanged between camera and application i think is for "meet each other" the devices and after some ACKS from the APP so the camera will continue to transmit else it stops transmission. I think if we decode the stream after is simple to copy the messages and send them with an application. My question is Can someone help me to understand the protocol the chinese uses? Where the NAL starts etc. I have decompile the APP and i saw the H264/AVC in one function but the main decoding they make it with a libZGP2PComm.so a c lib for Android.

There is sound too, so i think about mp4 stream.

Forgive please my poor english. Also iam computer technician but no a programmer.

lakis
  • 21
  • 5
  • Can you share the pcap file ( only few packet) ? if not ,you can check for the H.264 Start code ( 3 or 4 bytes) 00 00 01 SPS 00 00 01 PPS 00 00 01 NALU . – mail2subhajit Nov 03 '19 at 19:11
  • you see the first packet in the message, the start codes are visible 00 00 00 01 but after follows 00. All the other packets are the same motive. – lakis Nov 03 '19 at 20:13
  • check this link : https://www.ispyconnect.com/man.aspx?n=Bvcam. it says it support RTSP based streaming. – mail2subhajit Nov 04 '19 at 06:20
  • thank you for your advice. i have tried it before doesnt work. Camera needs to get some udp messages to start transmission. do you think the packet i capture is in ASF format? I havent windows only Linux. – lakis Nov 04 '19 at 07:01
  • Also i think that they dont transmit syncronization data, like bps, height etc, because they are fixed and they passed them by theirs app to android decoder at final step. – lakis Nov 04 '19 at 07:06
  • Can you share the pcap file , then i can check it properly – mail2subhajit Nov 04 '19 at 09:19
  • where to post it? i will try – lakis Nov 04 '19 at 09:46
  • i upload the capture file https://gofile.io/?c=iUjomM – lakis Nov 04 '19 at 10:22

2 Answers2

0

Network Dump Analysis :

  1. There are redundant/duplicate packet send from camera source for each packets.

  2. There is a 9 byte of header before the H.264 data starts - need further analysis (libZGP2PComm.so - Peer 2 Peer communication) - Can be proprietary protocol.

  3. Start code is there for all the Video packet (00 00 00 01 NALU data).

  4. SPS & PPS video data is also available for video decoding.

I will update the answer based on further analysis.

mail2subhajit
  • 1,106
  • 5
  • 16
  • Thank you, i wait to see what we will do finally. Keep in mind that they transmit and audio not only video. – lakis Nov 05 '19 at 09:45
  • Audio data is transmitted in separate packets (smaller size one). it will be pcm data most likely. – mail2subhajit Nov 05 '19 at 16:47
  • I cut the first 24 bytes and merged the rest into a file. After i removed everything till the first 00000067 and made the file binary. It played good with VLC and with h264 demuxer preference d. So i think the first 23 bytes are header of something. Need more investigation. – lakis Nov 07 '19 at 06:28
0

I have a very similar camera, it uses the same ports, and the android application uses the library. Reading the manual it says that there is a PC application and that it is compatible with VLC, but it does not give details. Looking for the application for PC I get says to download http://112.124.40.254:808/PCTools.zip, looking for that in google I always get to the same ip, but that ip does not respond. (another link that talks about them https://support.titathink.com/knowledgebase/hdminicam-app-cant-be-found-on-app-store/) I think if we can see the Windows application we can see some other configuration to see how it connects.

Gerardo Ibarra
  • 21
  • 1
  • update, this is app windows and mac https://support.titathink.com/downloads/software/pctools.zip but try add camera and connect and display wrong password (https://www.youtube.com/watch?v=r-sPJR0zleE) – Gerardo Ibarra May 21 '20 at 16:38
  • Thank you for your reply. I havent windows only linux. As i remember i can read the big network packets and joining them i could watch the video, but i couldnt find the commands to start the camera transmitting. As i remeber the chinese had said they will make a new application for it, have you read something? – lakis May 23 '20 at 03:31