axplincam

anonymous@undisclosed.example.com (Anonymous) — Tue, 15 Jun 2021 20:09:51 +0000

AxpLinCam

few days ago i bought AXP IP camera. it has wifi (802.11n is supported!), ethernet (10/100) audio in/out, 1 input and 1 output relay (for controlling stuff). of course pan/tilt is also available. video is recorded in a HD (1280×720) at 25fps.

it is though to be controlled via web interface (requires ActiveX – no comments on that…). video camera supports getting a video stream via RTSP. there are two issues with that:

documentation says nothing about the address to use.
there is no documentation on how to control the camera outside of the web interface.

let's see what can we do about that… :)

protocol

… is not documented. event RTSP link did not make it to the documentation. ;) fortunately, after a minute with wireshark, it appeared that the protocol is, in fact, dead simple.

RTSP

there are two streams, that can be obtained (assuming 1.2.3.4 is the IP of the camera):

rtsp://1.2.3.4/11 (high resolution)
rtsp://1.2.3.4/12 (lower resolution)

it can be player with mplayer like this:

mplayer -user "user" -passwd "xxxx" "rtsp://1.2.3.4/11"

and recorded like this:

mplayer -dumpvideo -dumpfile out.mpg -user "user" -passwd "xxxx" "rtsp://1.2.3.4/11"

stream is saved as H.264 mpeg.

pan/tilt control

camera movement is simply HTTP request. base link is: http://1.2.3.4/web/cgi-bin/hi3510/ptzctrl.cgi. parameters are passed directly as a post arguments. the nice think is it even has a help switch, so to see available options wget can be used:

$ wget -q -O - "http://1.2.3.4/web/cgi-bin/hi3510/ptzctrl.cgi?-?"
-?
  print help msg 

-act
  ptz action:up|down|left|right|vscan|hscan|stop|home

-chn
  channel number:0~3 default:0

-step
  step or not: 0|1 default:0

-speed
  speed number:0~255 default:0

content is pretty much self-explaining. for example to rotate camera, one step left, the command is:

$ wget -q -O - "http://1.2.3.4/web/cgi-bin/hi3510/ptzctrl.cgi?-act=left&-step=1"
[Success]call ptz function ok

yes! you've noticed correctly – no user name, nor password is required to operate on the camera! this is a fatal security breach, since anyone with the access to the network can move it to point, say to a ceiling, instead of actually monitored object! it's still a nice toy – but only a toy…

the funny thing is, that it is probably more generic script, since it is called PTZctrl, though camera does not support zoom. so it is possible that the same bug is present in more device types…

linux tools

in order to use the device from linux, one must have option to capture video stream and to move camera. stream can be captured with mplayer. to control camera in a user-friendly way a python library and an executable script has been created. it allows you to control device with arrow keys as well as do other requests, like infrared LED turning on/off. since version v1.1.0 also non-interactive, command line processing is available.