From 15f763800fdf374f562c04b2eeff944e6056afa1 Mon Sep 17 00:00:00 2001 From: DavidVentura Date: Fri, 26 Jan 2024 17:49:36 +0100 Subject: [PATCH] add braindumps --- cam.md | 144 ------------------------------ proto | 275 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 275 insertions(+), 144 deletions(-) delete mode 100644 cam.md create mode 100644 proto diff --git a/cam.md b/cam.md deleted file mode 100644 index 2c95027..0000000 --- a/cam.md +++ /dev/null @@ -1,144 +0,0 @@ -dst port 32108 udp -src port 49512 ? - -data: -1st byte always f1 - -examples -f1 e1 00 00 -f1 30 00 00 - -``` -undefined8 create_LanSearch(undefined2 *param_1) - -{ - *param_1 = 0x30f1; - param_1[1] = 0; - return 4; -} -``` -f1 30 00 00 = lan search - -checksum?? -``` - if (((uint)(auStack_5c8[0] >> 8) | (auStack_5c8[0] & 0xff00ff) << 8) != 0xf141) - goto LAB_004a9fb0; - ``` -out[4] = pkt[2] -out[6] - -## Data flow? - -1. P2PInit = Open socket -2. Push params? -``` -for (PushBean SynCmdSend : pushParams) { - IlnkApiMgr.SynCmdSend(p2pParam.getP2pID(), -1, 6, 4, SynCmdSend); -} -``` -3. SendCMD ? - a. friendMsgSend - -16 bytes fixed header -data=20 - len vv -0000 f1 d0 00 10 d1 00 00 0f 11 0a 08 10 04 00 00 00 -0010 65 51 46 36 - - -data=28 - len vv -0000 f1 d0 00 18 d1 00 00 0a 11 0a 18 30 0c 00 00 00 -0010 65 51 46 36 03 01 01 01 00 01 01 01 - -data=204 - len vv -0000 f1 d0 00 c8 d1 00 00 0e 11 0a ff 50 bc 00 00 00 -0010 65 51 46 36 00 0b 51 6a 01 ad fe fe 01 01 01 01 -0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -00c0 00 00 00 00 00 00 00 00 b5 01 01 01 - -# start of frame? -0000 f1 d0 00 24 d1 01 00 00 55 aa 15 a8 03 00 40 3f -0010 08 74 a0 65 d1 09 00 00 94 4c 00 00 00 00 00 00 -0020 00 00 00 00 00 00 00 00 - -^# 3f 08 = 1016 = frame length next - -# 8th byte = pkt count; frames only? - len vv -0000 f1 d0 04 04 d1 01 00 01 ff d8 ff db 00 84 00 07 -0010 05 05 06 05 04 07 06 06 06 08 08 07 09 0b 13 0c -0020 0b 0a 0a 0b 18 11 12 0e 13 1c 19 1e 1d 1c 19 1b -0030 1b 1f 22 2c 25 1f 20 2a 21 1b 1b 26 35 27 2a 2e -0040 2f 32 32 32 1e 25 37 3b 36 30 3a 2c 31 32 30 01 -0050 08 08 08 0b 0a 0b 17 0c 0c 17 30 1f 1b 1f 30 30 -0060 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 -0070 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 -0080 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 -0090 ff c0 00 11 08 01 e0 02 80 03 01 22 00 02 11 01 -00a0 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 -00b0 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 -00c0 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 -00d0 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 -00e0 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 -00f0 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 -0100 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 -0110 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 -0120 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 -0130 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 -0140 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 -0150 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 -0160 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 -0170 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 01 01 01 01 01 -0180 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 -0190 08 09 0a 0b 11 00 02 01 02 04 04 03 04 07 05 04 -01a0 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 -01b0 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 -01c0 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 -01d0 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 -01e0 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 -01f0 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 -0200 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 -0210 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 -0220 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 -0230 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 -0240 f4 f5 f6 f7 f8 f9 fa ff dd 00 04 00 28 ff da 00 -0250 0c 03 01 00 02 11 03 11 00 3f 00 e8 0a 00 7a 50 -0260 17 26 a6 61 92 69 a0 60 d7 9e d6 a7 ab 72 3f 2f -0270 d2 94 ae 05 49 8a 50 05 01 75 d0 62 70 6a 75 19 -0280 15 1f 19 ab 11 8e 29 5a e3 57 1a 54 62 9a 07 35 -0290 23 75 a0 0c d2 b5 b6 09 68 34 28 eb 4a 06 4d 2a -02a0 8e 69 70 41 a4 17 62 6d e6 8d b5 26 41 a4 a2 cc -02b0 77 d0 40 05 05 79 a7 aa d0 7a d4 a4 c7 7b 0d 0b -02c0 9a 53 81 4a 05 01 79 a6 d0 b9 86 ed e7 8a 4d a4 -02d0 9a 90 9e 68 c0 a1 8d 31 9b 31 40 4c d4 bd 68 e8 -02e0 68 68 9b ea 44 13 06 9c 13 9a 7e 32 68 e9 49 a2 -02f0 b9 86 81 cd 29 5a 70 22 94 1a 12 b8 36 c6 6d a0 -0300 ae 4d 3f 83 4a 05 2b 05 c6 15 a3 65 3c 9c 1f 5a -0310 7e 78 a1 a1 dd a2 2c 63 b5 2e 29 f8 cd 27 4a 49 -0320 58 39 88 a6 3b 50 9a f2 ef 1a 5d 17 ba 61 9c e7 -0330 bd 7a 56 a7 32 c7 68 dc f3 5e 3b e2 0b bf 3e f2 -0340 4c 0e 37 1e d8 ab 86 e3 bb 67 33 70 c0 b1 a8 71 -0350 8e 3a d4 f3 2e 5b 8a 66 de 6b b3 63 06 ee c6 32 -0360 8c 55 7c fe f2 ac 4a 70 2a 14 42 5b 26 9a 7d 48 -0370 96 e4 8d 82 95 59 57 f7 9e d5 66 5c 60 0a 84 29 -0380 dc 2a b5 16 97 2c b6 16 3a aa 06 64 ab 2d f7 7a -0390 d4 41 7e 6c 8a 5e a5 49 db 61 c5 38 c5 30 26 0d -03a0 48 c7 9a 0f 2b 9a 4d eb a0 6d b9 56 51 52 42 9c -03b0 74 a4 23 26 a6 87 38 aa 6f 42 63 b9 1b 2e 0d 33 -03c0 6f 35 2c 99 53 c5 08 b9 3c d1 7e c3 49 5e e2 32 -03d0 e0 53 76 a9 a9 dc 54 44 64 f0 69 5c 7c a9 b1 e8 -03e0 bf 2f 14 c9 33 53 20 c2 d4 32 e6 95 c2 49 15 ba -03f0 bd 24 a6 a4 45 e7 35 14 a7 e6 ad 0e 76 ec 22 8c -0400 9a 47 5a 7c 4d 93 d2 92 - diff --git a/proto b/proto new file mode 100644 index 0000000..419ebad --- /dev/null +++ b/proto @@ -0,0 +1,275 @@ +Discovery: + +SEND LanSearch +SEND P2pReq +SEND LstReq +SEND LanSearch +RECV PunchPkt +SEND P2pRdy +SEND P2pReq +SEND P2PAlive +SEND P2pReq +RECV P2pRdy +RECV P2PAlive +SEND P2PAliveAck +SEND LstReq +SEND Drw +RECV DrwAck +RECV Drw +SEND DrwAck +SEND LanSearchExt +SEND LanSearch +SEND Drw +RECV DrwAck +RECV Drw +SEND DrwAck +RECV Drw +SEND DrwAck +RECV Drw +SEND DrwAck +RECV P2PAlive +SEND P2PAliveAck + + + +On Drw +-> cmd = inbuf+10 +-> chan = inbuf+9 +-> param2 = lock ? 0xd1 : 0xd2 (never lock branch) => 0xd2 +-> Send_Pkt_DrwAck(10,0xd2,channel,1,&cmd_,sock_fd,ipaddr_); + -> create_DrwAck(bare_drwack, 0xd2, chan, halflen??, inbuf) + -> pack_P2pHdr(bare_drwack, pkt_hdr) + -> pack_DrwAck(bare_drwack+4, len = swapped(bare_drwack[1]), pkt_hdr + hdr_len) + -> send_udp(pkt_hdr, max(hdr_len, 0x20)??) + + +peerPlayBackTh + UDP PKT RECV, cmd=Drw, 0xf1d0, ret=0x3e8 + 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF + 00000000 f1 d0 03 e4 d1 01 00 00 55 aa 15 a8 06 02 00 00 ........U....... + ... + 000003e0 d0 d1 d6 d7 d4 d4 d4 d4 ........ + + +0x03e4 = pkt len (wihtout 4b header?) + +"type" is 0x3?? (0xf1 0xd0 _0x03_) +frame indicator is "0xa815aa55" +acc_pkt_multi starts on "0x55" (first 8 bytes skipped?) +- check for: + - NOT 0x2 as uint on +5 offset (video?? longer packets) + - NOT 0x6 as 1 byte at +4 offset => AUDIO !! +https://usermanual.wiki/Document/C20Series20CGI20Guide.1745954698.pdf + +frame len is the 4th uint32 on acc_pkt_multi = bytes 0x18-0x1B + +frame maybe starts at 0x28? + + +############################## +liveVideoRcvTh + +for video + 00000000 f1 d0 04 04 d1 01 00 ce ff d8 ff db 00 84 00 06 ................ + +0x0404 len? +ff d8 ff db = jpeg + +#tail --bytes=+9 maybe.bin > out +incomeplte (out1.png) + +the 8th byte (0xce) is a sequence. restart on new jpeg header? + + +and EOF +0000 f1 d0 00 8c d1 01 01 82 c8 a6 03 b4 f3 4e 04 11 +0010 4d 61 48 b6 32 42 3a d4 3d 4d 48 fd 6a 31 d6 a9 +0020 3b 19 ca c2 f5 a7 27 06 93 02 94 1e 68 b0 87 9a +0030 05 27 7a 70 3d a9 0d 83 74 a8 19 4e ee b5 2b 36 +0040 2a 36 a1 0a 4f 99 0d 20 53 0f 06 82 4e 69 bc e6 +0050 9a 33 6e e4 80 e7 a5 3d 4e 2a 35 e2 9c 3a d0 c6 +0060 a4 90 fd b9 6a 93 70 5e 05 43 c8 34 e5 e5 a9 bf +0070 74 71 77 2c 29 e2 9c 1f 11 c9 c9 24 a9 a8 49 c7 +0080 15 2c 44 6f 14 9e a6 91 69 49 5c ff d9 00 00 00 + + +where `ff d9` marks end of stream + + +DrwAck = +0000 f1 d1 00 12 d2 01 00 07 00 00 00 01 00 02 00 03 ................ +0010 00 04 00 05 00 06 00 00 00 00 00 00 00 00 00 00 ................ + +=> +0xf1d1 DrwAck +0x0012 "copy len + 4" => byte# after 0x00 0x07 = 0x7*2 +0xd2 = type?ack? unclear +0x1 = stream probably +0x7 = item count +0x0 - 0x6 = ack'd packets +0x0 ... = padding til 0x20? + +Another DrwAck = +0000 f1 d1 00 18 d2 01 00 0a 00 03 00 04 00 05 00 06 ................ +0010 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 00 00 00 ................ + +0x18 = ???? "copy len +4" = 0x14 = 0xa*2 +0xa = item count +0x0 ... = padding til 0x20? + +ACK packets go out every 10ms +each packets acknowledges.. 18ms? => have seen up to 9 acked packets, 12 max + + + +how to trigger video transfer? +0xf1 d0? + + +### other shit uhld/vhoenvr/bnl = add/remove 1 "encryption" +### => https://bitsandbinaries.wordpress.com/net-programming/windows-forms/encryption-software-the-art-of-encrypting/ +### => 'time.windows.com' + +certain commands (5th byte after 0xa11 >= 5?) are encrypted (4 byte rotation): +``` + if (*(ushort *)((long)also_pkt + 4) < 5) { + m_pkt_len = *(ushort *)((long)also_pkt + 2); + } + else { + XqBytesDec((ushort *)((long)also_pkt + 0xc),*(ushort *)((long)also_pkt + 4) - 4,4); + m_pkt_len = *(ushort *)((long)also_pkt + 2); + } + +``` + + + +0x3000....0x3041 NON CONTIGUOUS = parseFileInfo +0x3018 = parseCameraCtrl + + +0xf1d0 + +commands (CmdSndPush) + hdr: CmdHdrBuild: + id: 0xa11 + cmdtype (0x1020) + len+4 (+4 from ExtCmdHdrBuild) + dest (0x00ff) + +cmdtypes: + - 0x1020: SendUsrChk + + SessionGet:session id is BATC-609531-EXLVS,gParam.sessionNmb=8 + -> + Send_Pkt_P2PRdy buf + 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF + 00000000 42 41 54 43 00 00 00 00 00 09 4c fb 45 58 4c 56 BATC......L.EXLV + 00000010 53 00 00 00 + where the 8 bytes 00 00 00 00 00 09 4c fb = 609531 + + no trailing S? + + + + UDP PKT RECV, cmd=PunchPkt, 0xf141, ret=0x18 + 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF + 00000000 f1 41 00 14 42 41 54 43 00 00 00 00 00 09 4c fb .A..BATC......L. + 00000010 45 58 4c 56 53 00 00 00 EXLVS... + + +cmtypes: +0x0a11 = "CMD_START_CODE" +IOCmdRecvProcess, pkt = 0x0a11 + +encrypted = (*(ushort *)((long)also_pkt + 4) < 5) + = payload_len > 5 ?? + BECAUSE IT ROTATES BY 4 + => decrypt starting at 0xc + +if (cmd >> 8) & 1 == 0 => cmd else ack + +cmd (/ack) RcvProc: + - cmd >> 12: + - 1: Sys + - 0x1008: no idea + - 0x1108: no idea ack? + - 0x1020: ListenUserCheck - send admin creds + - 0x1120: ConnectUserCheckAck + - 0x1040: parseDateTime (send NTP) => CmdExecute + - 0x1141: RcvNTP ? + - 2: Sd + - 3: Av + - 0x3010: start video + - 0x3011: stop video + - 4: File + - 5: Pass + - 0x50ff + - 6: Net + - 7: Msg + + +dataRcv: CSession_DataPkt_Proc +f1 d0 04 04 d1 01 + ^ data? when 0 cmd + + +to trigger, AvCmd + +AvCmd 0x7cb0eed0b0 BATC609531EXLVS 0 3018 0x7fef46821c +AvCmd 0x3018 ret: 20 +AvCmd 0x7cb0eed0b0 BATC609531EXLVS 0 3018 0x7fef46821c +AvCmd 0x3018 ret: 20 +AvCmd 0x7cb0eed0b0 BATC609531EXLVS 0 3010 0x7fef46821c +AvCmd 0x3010 ret: 272 +AvCmd 0x7cb0f232f0 BATC609531EXLVS 0 3019 0x0 +AvCmd 0x7cb0fca6b0 BATC609531EXLVS 0 3010 0x7b23a03dbc +AvCmd 0x7cb0f01530 BATC609531EXLVS 0 3005 0x0 +AvCmd 0x3019 ret: 12 +AvCmd 0x3005 ret: 12 +AvCmd 0x3010 ret: 272 +AvCmd 0x7cb0f05cb0 BATC609531EXLVS 0 3026 0x7b479836ec +AvCmd 0x3026 ret: 0 + + +still works after disabling: +0x3018 +0x3019 +0x3005 +0x3026 +0x3001 +0x3003 + + +disabling 3010 = no video +disabling 3011 = video does not stop when hitting back + +-- just sending the 3010 pkt is not enough, maybe setup? + +BinCmd +0x1020 adminadmin +0x50ff some bcast? + +SysCmd necessary: + +0x1008 ? +0x1040 - ntp + +CmdSndPush 0x7d30f4b9a0 ff 1020 0x7bdf1a7a18 160 +CmdSndPush 0x1020 ret: 172 +CmdSndPush 0x7d30f4b9a0 0 1040 0x7b44169790 80 +CmdSndPush 0x1040 ret: 92 +CmdSndPush 0x7d30f4b9a0 0 50ff 0x7cd0f36920 552 +CmdSndPush 0x50ff ret: 564 +CmdSndPush 0x7d30f4b9a0 0 1008 0x0 0 +CmdSndPush 0x1008 ret: 12 + +disabling 0x1020, never move past off P2PRdy (DrwAck missing) + + +SystemCmd 0x7cb0f3f5f0 BATC609531EXLVS 0 1040 0x7b4448971c +SystemCmd 0x7cb0f4c850 BATC609531EXLVS 0 1008 0x0 +AvcLIB = src/object_jni.cpp, line 653, SystemCmd:[p2pID=BATC609531EXLVS]SystemCmd=0x1008 +AvcLIB = src/object_jni.cpp, line 653, SystemCmd:[p2pID=BATC609531EXLVS]SystemCmd=0x1040 +SystemCmd 0x1008 ret: 12 +SystemCmd 0x1040 ret: 92