easylinux/cam-reverse
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add braindumps

Browse Source
This commit is contained in:
DavidVentura
2024-01-26 17:49:36 +01:00
parent 9da66ecafc
commit 15f763800f
2 changed files with 275 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cam.md
-144
View File
@@ -1,144 +0,0 @@
dst port 32108 udp
src port 49512 ?
data:
1st byte always f1
examples
f1 e1 00 00
f1 30 00 00
```
undefined8 create_LanSearch(undefined2 *param_1)
{
*param_1 = 0x30f1;
param_1[1] = 0;
return 4;
}
```
f1 30 00 00 = lan search
checksum??
```
if (((uint)(auStack_5c8[0] >> 8) | (auStack_5c8[0] & 0xff00ff) << 8) != 0xf141)
goto LAB_004a9fb0;
```
out[4] = pkt[2]
out[6]
## Data flow?
1. P2PInit = Open socket
2. Push params?
```
for (PushBean SynCmdSend : pushParams) {
IlnkApiMgr.SynCmdSend(p2pParam.getP2pID(), -1, 6, 4, SynCmdSend);
}
```
3. SendCMD ?
a. friendMsgSend
16 bytes fixed header
data=20
len vv
0000 f1 d0 00 10 d1 00 00 0f 11 0a 08 10 04 00 00 00
0010 65 51 46 36
data=28
len vv
0000 f1 d0 00 18 d1 00 00 0a 11 0a 18 30 0c 00 00 00
0010 65 51 46 36 03 01 01 01 00 01 01 01
data=204
len vv
0000 f1 d0 00 c8 d1 00 00 0e 11 0a ff 50 bc 00 00 00
0010 65 51 46 36 00 0b 51 6a 01 ad fe fe 01 01 01 01
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00c0 00 00 00 00 00 00 00 00 b5 01 01 01
# start of frame?
0000 f1 d0 00 24 d1 01 00 00 55 aa 15 a8 03 00 40 3f
0010 08 74 a0 65 d1 09 00 00 94 4c 00 00 00 00 00 00
0020 00 00 00 00 00 00 00 00
^# 3f 08 = 1016 = frame length next
# 8th byte = pkt count; frames only?
len vv
0000 f1 d0 04 04 d1 01 00 01 ff d8 ff db 00 84 00 07
0010 05 05 06 05 04 07 06 06 06 08 08 07 09 0b 13 0c
0020 0b 0a 0a 0b 18 11 12 0e 13 1c 19 1e 1d 1c 19 1b
0030 1b 1f 22 2c 25 1f 20 2a 21 1b 1b 26 35 27 2a 2e
0040 2f 32 32 32 1e 25 37 3b 36 30 3a 2c 31 32 30 01
0050 08 08 08 0b 0a 0b 17 0c 0c 17 30 1f 1b 1f 30 30
0060 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30
0070 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30
0080 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30
0090 ff c0 00 11 08 01 e0 02 80 03 01 22 00 02 11 01
00a0 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01
00b0 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07
00c0 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04
00d0 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41
00e0 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1
00f0 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19
0100 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44
0110 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64
0120 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84
0130 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2
0140 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9
0150 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7
0160 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3
0170 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 01 01 01 01 01
0180 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07
0190 08 09 0a 0b 11 00 02 01 02 04 04 03 04 07 05 04
01a0 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12
01b0 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1
01c0 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1
01d0 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43
01e0 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63
01f0 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82
0200 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99
0210 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7
0220 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5
0230 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3
0240 f4 f5 f6 f7 f8 f9 fa ff dd 00 04 00 28 ff da 00
0250 0c 03 01 00 02 11 03 11 00 3f 00 e8 0a 00 7a 50
0260 17 26 a6 61 92 69 a0 60 d7 9e d6 a7 ab 72 3f 2f
0270 d2 94 ae 05 49 8a 50 05 01 75 d0 62 70 6a 75 19
0280 15 1f 19 ab 11 8e 29 5a e3 57 1a 54 62 9a 07 35
0290 23 75 a0 0c d2 b5 b6 09 68 34 28 eb 4a 06 4d 2a
02a0 8e 69 70 41 a4 17 62 6d e6 8d b5 26 41 a4 a2 cc
02b0 77 d0 40 05 05 79 a7 aa d0 7a d4 a4 c7 7b 0d 0b
02c0 9a 53 81 4a 05 01 79 a6 d0 b9 86 ed e7 8a 4d a4
02d0 9a 90 9e 68 c0 a1 8d 31 9b 31 40 4c d4 bd 68 e8
02e0 68 68 9b ea 44 13 06 9c 13 9a 7e 32 68 e9 49 a2
02f0 b9 86 81 cd 29 5a 70 22 94 1a 12 b8 36 c6 6d a0
0300 ae 4d 3f 83 4a 05 2b 05 c6 15 a3 65 3c 9c 1f 5a
0310 7e 78 a1 a1 dd a2 2c 63 b5 2e 29 f8 cd 27 4a 49
0320 58 39 88 a6 3b 50 9a f2 ef 1a 5d 17 ba 61 9c e7
0330 bd 7a 56 a7 32 c7 68 dc f3 5e 3b e2 0b bf 3e f2
0340 4c 0e 37 1e d8 ab 86 e3 bb 67 33 70 c0 b1 a8 71
0350 8e 3a d4 f3 2e 5b 8a 66 de 6b b3 63 06 ee c6 32
0360 8c 55 7c fe f2 ac 4a 70 2a 14 42 5b 26 9a 7d 48
0370 96 e4 8d 82 95 59 57 f7 9e d5 66 5c 60 0a 84 29
0380 dc 2a b5 16 97 2c b6 16 3a aa 06 64 ab 2d f7 7a
0390 d4 41 7e 6c 8a 5e a5 49 db 61 c5 38 c5 30 26 0d
03a0 48 c7 9a 0f 2b 9a 4d eb a0 6d b9 56 51 52 42 9c
03b0 74 a4 23 26 a6 87 38 aa 6f 42 63 b9 1b 2e 0d 33
03c0 6f 35 2c 99 53 c5 08 b9 3c d1 7e c3 49 5e e2 32
03d0 e0 53 76 a9 a9 dc 54 44 64 f0 69 5c 7c a9 b1 e8
03e0 bf 2f 14 c9 33 53 20 c2 d4 32 e6 95 c2 49 15 ba
03f0 bd 24 a6 a4 45 e7 35 14 a7 e6 ad 0e 76 ec 22 8c
0400 9a 47 5a 7c 4d 93 d2 92
proto
+275
View File
@@ -0,0 +1,275 @@
Discovery:
SEND LanSearch
SEND P2pReq
SEND LstReq
SEND LanSearch
RECV PunchPkt
SEND P2pRdy
SEND P2pReq
SEND P2PAlive
SEND P2pReq
RECV P2pRdy
RECV P2PAlive
SEND P2PAliveAck
SEND LstReq
SEND Drw
RECV DrwAck
RECV Drw
SEND DrwAck
SEND LanSearchExt
SEND LanSearch
SEND Drw
RECV DrwAck
RECV Drw
SEND DrwAck
RECV Drw
SEND DrwAck
RECV Drw
SEND DrwAck
RECV P2PAlive
SEND P2PAliveAck
On Drw
-> cmd = inbuf+10
-> chan = inbuf+9
-> param2 = lock ? 0xd1 : 0xd2 (never lock branch) => 0xd2
-> Send_Pkt_DrwAck(10,0xd2,channel,1,&cmd_,sock_fd,ipaddr_);
-> create_DrwAck(bare_drwack, 0xd2, chan, halflen??, inbuf)
-> pack_P2pHdr(bare_drwack, pkt_hdr)
-> pack_DrwAck(bare_drwack+4, len = swapped(bare_drwack[1]), pkt_hdr + hdr_len)
-> send_udp(pkt_hdr, max(hdr_len, 0x20)??)
peerPlayBackTh
UDP PKT RECV, cmd=Drw, 0xf1d0, ret=0x3e8
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 f1 d0 03 e4 d1 01 00 00 55 aa 15 a8 06 02 00 00 ........U.......
...
000003e0 d0 d1 d6 d7 d4 d4 d4 d4 ........
0x03e4 = pkt len (wihtout 4b header?)
"type" is 0x3?? (0xf1 0xd0 _0x03_)
frame indicator is "0xa815aa55"
acc_pkt_multi starts on "0x55" (first 8 bytes skipped?)
- check for:
- NOT 0x2 as uint on +5 offset (video?? longer packets)
- NOT 0x6 as 1 byte at +4 offset => AUDIO !!
https://usermanual.wiki/Document/C20Series20CGI20Guide.1745954698.pdf
frame len is the 4th uint32 on acc_pkt_multi = bytes 0x18-0x1B
frame maybe starts at 0x28?
##############################
liveVideoRcvTh
for video
00000000 f1 d0 04 04 d1 01 00 ce ff d8 ff db 00 84 00 06 ................
0x0404 len?
ff d8 ff db = jpeg
#tail --bytes=+9 maybe.bin > out
incomeplte (out1.png)
the 8th byte (0xce) is a sequence. restart on new jpeg header?
and EOF
0000 f1 d0 00 8c d1 01 01 82 c8 a6 03 b4 f3 4e 04 11
0010 4d 61 48 b6 32 42 3a d4 3d 4d 48 fd 6a 31 d6 a9
0020 3b 19 ca c2 f5 a7 27 06 93 02 94 1e 68 b0 87 9a
0030 05 27 7a 70 3d a9 0d 83 74 a8 19 4e ee b5 2b 36
0040 2a 36 a1 0a 4f 99 0d 20 53 0f 06 82 4e 69 bc e6
0050 9a 33 6e e4 80 e7 a5 3d 4e 2a 35 e2 9c 3a d0 c6
0060 a4 90 fd b9 6a 93 70 5e 05 43 c8 34 e5 e5 a9 bf
0070 74 71 77 2c 29 e2 9c 1f 11 c9 c9 24 a9 a8 49 c7
0080 15 2c 44 6f 14 9e a6 91 69 49 5c ff d9 00 00 00
where `ff d9` marks end of stream
DrwAck =
0000 f1 d1 00 12 d2 01 00 07 00 00 00 01 00 02 00 03 ................
0010 00 04 00 05 00 06 00 00 00 00 00 00 00 00 00 00 ................
=>
0xf1d1 DrwAck
0x0012 "copy len + 4" => byte# after 0x00 0x07 = 0x7*2
0xd2 = type?ack? unclear
0x1 = stream probably
0x7 = item count
0x0 - 0x6 = ack'd packets
0x0 ... = padding til 0x20?
Another DrwAck =
0000 f1 d1 00 18 d2 01 00 0a 00 03 00 04 00 05 00 06 ................
0010 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 00 00 00 ................
0x18 = ???? "copy len +4" = 0x14 = 0xa*2
0xa = item count
0x0 ... = padding til 0x20?
ACK packets go out every 10ms
each packets acknowledges.. 18ms? => have seen up to 9 acked packets, 12 max
how to trigger video transfer?
0xf1 d0?
### other shit uhld/vhoenvr/bnl = add/remove 1 "encryption"
### => https://bitsandbinaries.wordpress.com/net-programming/windows-forms/encryption-software-the-art-of-encrypting/
### => 'time.windows.com'
certain commands (5th byte after 0xa11 >= 5?) are encrypted (4 byte rotation):
```
if (*(ushort *)((long)also_pkt + 4) < 5) {
m_pkt_len = *(ushort *)((long)also_pkt + 2);
}
else {
XqBytesDec((ushort *)((long)also_pkt + 0xc),*(ushort *)((long)also_pkt + 4) - 4,4);
m_pkt_len = *(ushort *)((long)also_pkt + 2);
}
```
0x3000....0x3041 NON CONTIGUOUS = parseFileInfo
0x3018 = parseCameraCtrl
0xf1d0
commands (CmdSndPush)
hdr: CmdHdrBuild:
id: 0xa11
cmdtype (0x1020)
len+4 (+4 from ExtCmdHdrBuild)
dest (0x00ff)
cmdtypes:
- 0x1020: SendUsrChk
SessionGet:session id is BATC-609531-EXLVS,gParam.sessionNmb=8
->
Send_Pkt_P2PRdy buf
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 42 41 54 43 00 00 00 00 00 09 4c fb 45 58 4c 56 BATC......L.EXLV
00000010 53 00 00 00
where the 8 bytes 00 00 00 00 00 09 4c fb = 609531
no trailing S?
UDP PKT RECV, cmd=PunchPkt, 0xf141, ret=0x18
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 f1 41 00 14 42 41 54 43 00 00 00 00 00 09 4c fb .A..BATC......L.
00000010 45 58 4c 56 53 00 00 00 EXLVS...
cmtypes:
0x0a11 = "CMD_START_CODE"
IOCmdRecvProcess, pkt = 0x0a11
encrypted = (*(ushort *)((long)also_pkt + 4) < 5)
= payload_len > 5 ??
BECAUSE IT ROTATES BY 4
=> decrypt starting at 0xc
if (cmd >> 8) & 1 == 0 => cmd else ack
cmd (/ack) RcvProc:
- cmd >> 12:
- 1: Sys
- 0x1008: no idea
- 0x1108: no idea ack?
- 0x1020: ListenUserCheck - send admin creds
- 0x1120: ConnectUserCheckAck
- 0x1040: parseDateTime (send NTP) => CmdExecute
- 0x1141: RcvNTP ?
- 2: Sd
- 3: Av
- 0x3010: start video
- 0x3011: stop video
- 4: File
- 5: Pass
- 0x50ff
- 6: Net
- 7: Msg
dataRcv: CSession_DataPkt_Proc
f1 d0 04 04 d1 01 <seq short>
^ data? when 0 cmd
to trigger, AvCmd
AvCmd 0x7cb0eed0b0 BATC609531EXLVS 0 3018 0x7fef46821c
AvCmd 0x3018 ret: 20
AvCmd 0x7cb0eed0b0 BATC609531EXLVS 0 3018 0x7fef46821c
AvCmd 0x3018 ret: 20
AvCmd 0x7cb0eed0b0 BATC609531EXLVS 0 3010 0x7fef46821c
AvCmd 0x3010 ret: 272
AvCmd 0x7cb0f232f0 BATC609531EXLVS 0 3019 0x0
AvCmd 0x7cb0fca6b0 BATC609531EXLVS 0 3010 0x7b23a03dbc
AvCmd 0x7cb0f01530 BATC609531EXLVS 0 3005 0x0
AvCmd 0x3019 ret: 12
AvCmd 0x3005 ret: 12
AvCmd 0x3010 ret: 272
AvCmd 0x7cb0f05cb0 BATC609531EXLVS 0 3026 0x7b479836ec
AvCmd 0x3026 ret: 0
still works after disabling:
0x3018
0x3019
0x3005
0x3026
0x3001
0x3003
disabling 3010 = no video
disabling 3011 = video does not stop when hitting back
-- just sending the 3010 pkt is not enough, maybe setup?
BinCmd
0x1020 adminadmin
0x50ff some bcast?
SysCmd necessary:
0x1008 ?
0x1040 - ntp
CmdSndPush 0x7d30f4b9a0 ff 1020 0x7bdf1a7a18 160
CmdSndPush 0x1020 ret: 172
CmdSndPush 0x7d30f4b9a0 0 1040 0x7b44169790 80
CmdSndPush 0x1040 ret: 92
CmdSndPush 0x7d30f4b9a0 0 50ff 0x7cd0f36920 552
CmdSndPush 0x50ff ret: 564
CmdSndPush 0x7d30f4b9a0 0 1008 0x0 0
CmdSndPush 0x1008 ret: 12
disabling 0x1020, never move past off P2PRdy (DrwAck missing)
SystemCmd 0x7cb0f3f5f0 BATC609531EXLVS 0 1040 0x7b4448971c
SystemCmd 0x7cb0f4c850 BATC609531EXLVS 0 1008 0x0
AvcLIB = src/object_jni.cpp, line 653, SystemCmd:[p2pID=BATC609531EXLVS]SystemCmd=0x1008
AvcLIB = src/object_jni.cpp, line 653, SystemCmd:[p2pID=BATC609531EXLVS]SystemCmd=0x1040
SystemCmd 0x1008 ret: 12
SystemCmd 0x1040 ret: 92