Hello..!
I have two DSC-P6000LH cameras, running firmware 1.03.03.
Any idea on the procedure to enable rtsp ?
Will it be the same with the 8000 model?

Hi there!

Awesome write-up!

Having an issue on the last step - upgrading the FW

It seems to always fail

curl --http1.0 -u admin:PIN--form [email protected] http://xxx.xxx.xxx/config/firmwareupgrade.cgi
upgrade=fail 

Is there a serial equivalent of --unsignedfw that needs to be run?
I tried doing it through bluetooth and I got "done" - however it still failed. I also noticed running lighttpd through bluetooth also returns "done", but the service doesn't actually appear to be running, no might be the same issue for running --unsignedfw through BT. If there is a way to do the same thing but through serial it'd be happy to give it a go

Thanks!

Hello - this could be awesome if I got it working. I have DCS-8000LH cloud camera which I want to stream local rtsp.

I'm running Ubuntu VM-ware client on a Win10 host. I have verified Wifi and BLE controllers are passed to client..
I don't have a barebones system around. Here is the output from the script:

$ ./dcs8000lh-configure.py b0:c5:54:4c:2d:80 560174
Connecting to b0:c5:54:4c:2d:80...
Traceback (most recent call last):
File "/home/frank/Downloads/defogger-master/./dcs8000lh-configure.py", line 152, in
cam = BleCam(args.address, args.pincode)
File "/home/frank/Downloads/defogger-master/./dcs8000lh-configure.py", line 28, in init
self.periph = Peripheral(address)
File "/usr/local/lib/python3.10/dist-packages/bluepy/btle.py", line 391, in init
self._connect(deviceAddr, addrType, iface)
File "/usr/local/lib/python3.10/dist-packages/bluepy/btle.py", line 439, in _connect
raise BTLEDisconnectError("Failed to connect to peripheral %s, addr type: %s" % (addr, addrType), rsp)
bluepy.btle.BTLEDisconnectError: Failed to connect to peripheral b0:c5:54:4c:2d:80, addr type: public

I think an ampersand is missing here. I added it to get things to work.

upgrade=ok```

Thanks for this! Worked quite well on my cameras, even though they had the old 1.0 firmware.

Hi,

Thank you very much for this repo!

Am I the only one who have audio stuttering issues when viewing https://<ip>/video/mpegts.cgi?

The audio is fine using https://<ip>/video/flv.cgi.

Same thing using http.

Thank you!

Hello,
First of all great work!

I am using firmware v2.02.02, and followed the instructions successfully. No errors were logged during the process.

however, after building and uploading the customer firmware fw.tar, the camera restarts but lighttpd and telnetd do not start automatically.

Any hints?
Thanks!

Hi, Thanks for such awesome work.

I can confirm that the entire process works flawlessly for firmware v2.01.03.

Off topic:
How does one turn off the 'motion detect' mode? The cam keeps disconnecting when it fails to detect motion after a few seconds.

The code I am using in python is:

import cv2

cap = cv2.VideoCapture("rtsp://admin:[email protected]/live/profile.0")

Check if the webcam is opened correctly

if not cap.isOpened():
raise IOError("Cannot open webcam")

while True:
ret, frame = cap.read()
cv2.imshow('Input', frame)
cap.release()

c = cv2.waitKey(1)
if c == 27:
	break

cap.release()
cv2.destroyAllWindows()

I've just messed up my mtd8 (rootfs) partition by doing silly things :D
Just got through the recovery process and want to share my steps with you:

Grab a TTL UART Converter and connect it like it is stated in the README with GND, TX, RX.
Power up the Camera and type alpha168 if the prompt "Press ESC to abort autoboot in 3 second" is shown.
As the uboot prompt you have do the following stuff:

Check the Partition start, end and size values from the README of the corrupted partition.

Execute
loady
Then upload the file via loady from your serial program (for windows you can use extraputty ->send files)
The mtd will be written to 0x82000000 in RAM
Write down the "filesize"-value.

After that you initialise and erase the partion.
(the first argument is the "start"-value of your partition, the second the "size"-value

sf probe
sf erase 0x4e0000 0xb00000

The last step is to write the file from ram to flash and reboot the camera.
First argument should not be edited (RAM Position), second is the start-value of the partition, third is the "filesize" which we got 2 steps above.
sf write 0x82000000 0x4e0000 0x007e2000

Hi all. Both my DCS8100LH upgraded their firmware last night from 2.01 to 2.07. I had always switched auto upgrade off, but after a reboot, they must have switched on again. Anyway, the long and the short is that Port 80 is now closed.

I can still run dcs8000lh-configure.py ok for 'survey' and connecting to wifi network, but can no longer stream MJPEG locally. The real bummer is that I can't downgrade firmware as it refuses connection when I run 'firmwareupgrade.cgi' with old .bin fw file.

Just checking, but is my only option to downgrade to use serial port with USB-TTL adaptor? Or are there any known tricks? (Ports 8080 (http-alt), 8081 (sunproxyadmin), 8088 (radan-http) and 24923 (unknown) are still open according to a scanner, but none allow connection.)

Just a note to say I've tried on a DCS-8330LH and it works. Awesome!

Hi, this is not about the impressive project “defogger”, but maybe goes to the fundamentals of hacking this device. Is it stable enough?
I have 4 of them running FW 1.0 and I quite often need to reboot them as they tend to get stuck on the same old image.
Anyone else noticed this?
It is now to a point where I am considering to make some sort of auto reboot procedure by comparing shots.
luup.inet.wget "user:pswd@camera-ipaddr/config/system_reboot.cgi?reboot=go"

Does it work for this modell to ?
Any experience ?
Greetings

Hi,

Do you know how can I properly make the date and time persist across reboots?

Thank you!

Hi, i order and receive my usb adapter like suggest on the guide. I plug the right pine at right place. Windows detect my usb adapter and put on COM3. When im trying to get it i have a black screen without prompt. What im doing wrong ?

I tried to use NIPCA
http://192.168.0.3/config/camera_info.cgi?name=CAM
the timestamp still showed "DCS8000lLH"
Is there a way to disable timestamp or change the camera name using NIPCA or tdb set?
Much appreciated

Background

So, after about 20 hours of messing about with the Bluetooth hack on Mac and Linux, I have found a way to get it working. My background is not coding, but more of a tech-savvy kind of guy. The idea is to spread more knowledge on issues and kind of small items in the wiki / guide, that a newbe like myself struggled a bit to find out.

Spoiler - you need a USB2Serial. And it is actually not that easy to get going - if you have not done it before.
First off, it is not possible to use a USB2Serial(U2S from now on) on Mac OS 13 and above. Don't ask why, but it is not possible. There is also an issue with bluepy(the python script that uses the BT-method). So my recommendation after a lot of testing:

Download Kali Linux or another live distro and boot your Mac from USB. But, remember to enable BT on that live distro, otherwise the upload won't work.

##Learnings

Step 1.
First things first, get yourself a USB2Serial, wire it like shown in the guide.

Note: Also add the USB power of the camera to let it get power from the power supply. When connecting the Tx, Rx, Gnd - make sure to have Rx and Tx switched. So data is Tx(transferred) from the U2S device, to Rx(receiver) on the camera. And visa-versa, Rx on U2S to Tx on the Camera
Step 2.
Get the U2S working on the Linux distro.
Learnings:

1. Run the following command to get a list of connected USB devices and make sure that the U2S shows up.
   lsusb
2. Make sure you identify where the device is accessible. This can be done by checking the '/dev' folder and checking the content starting with 'tty' related to USB.
   cd /dev && ls
   In my case, the name was 'ttyUSB0'

Step 3
Set up a working connection to be ready to do the U-Boot magic, and there are a couple of tricks here that helped me.

1. There are a lot of tools to use, like Putty, minicom etc, but a simple solution working for me was screen. In the guide it says that the band was 57600 and it used 8N1. As a noob, I needed some time to understand that. However, I got this working.
   That means that the setup I used was:
   screen /dev/ttyUSB0 57600 cs8

Step 4
How to get in. You have 3 seconds before the boot starts, so make sure the camera is disconnected and start your screen.

1. Get your copy/paste in order and make sure you have this copied for entering in the boot field.
   alpha168
   When you see:
   Press ESC to abort autoboot in 3 seconds

So that sum's up part 1. As of now I have some issues with the firmware and the admin password not matching my pin. This happened after flashing with DCS-8000LH_Ax_v2.02.02_3014.bin- but still working on it. I also got it to upload a custom fw.tar, so once complete I am planning to show what and how I did it. Because there are parts of the guide that does need to come in another order, than the one in the guide. So if people are interested in that, let me know.

Hi!
Would anyone know how to capture a motion triggered event?
As set in the app/web interface.
Cheers,
Bob

I found out that the camera appears to be on a port stream under:
http: // /live.m3u8 but unfortunately you need a login name and password, can you find out in the source code of the camera whether this is a default or something?

Hit a roadblock I can't solve for. F/W version is 1.10.1, the latest from DLink.

I had to play some games to get the camera to connect with the script:

• Add line self.periph.setMTU(256) under the init function
• Set self.name explicitly to "DCS-8300LH-####"
• Copied the entire "run_command" function from the repo over at tqz/defogger-8600 (@tqz)

I got into Telnet using root/twipc. There's no rc.d directory in /etc and I'm not finding any binaries for lighttp in general.

I can't figure out from here how to apply the custom firmware. I already have the backups made. Any thoughts?

I'm currently attempting this on a P6000LH which by all means should work from what I researched.
The camera is currently on firmware version 1.06.01

I've been following along with mostly no issues, though once I got the serial connected it outputs gibberish. I've used multiple different Baud values and messed with the parity to no change.

Does anyone have any suggestions?

(Image of my setup, using a Serial Cisco cable)
https://imgur.com/a/twDbGlH

Hi All

I have tried to use the defogger script on my DCS6500LH but it didn't work.
I then added serial terminal to the camera in hope that I could login as root to the system but I couldn't find any useful passwords in the GPL Source Code: DCS-6500LH A1 FW v1.x files.. Maybe I looked for the work things??! but no variable with password= was useful.

So therefore Im asking you the experts if I can do something from the U-boot terminal?
Below are the variables that I could find.

BR
EnerDK

U-Boot 2016.11 (Oct 16 2020 - 16:19:55 +0800)

=> printenv
baudrate=57600
bootaddr=0xBC000000 + 0x50000
bootargs=console=ttyS1,115200 root=/dev/mtdblock3 rts-quadspi.channels=dual mtdparts=18030000.spic:16384k@0(global),320k@0k(boot),2304k@320k(kernel),3584k@2624k(rootfs),7744k@6208k(userdata),2048k@13952k(userdata2),384k@16000k(userdat a3)
bootcmd=bootm 0xbc050000
bootdelay=2
ethact=r8168#0
loadaddr=0x80010000
netretry=yes
stderr=serial
stdin=serial
stdout=serial

Environment size: 432/65532 bytes
=> bdinfo
boot_params = 0x83782188
memstart = 0x80000000
memsize = 0x04000000
flashstart = 0xBFC00000
flashsize = 0x00000000
flashoffset = 0x00000000
ethaddr = (not set)
IP addr =
baudrate = 57600 bps
relocaddr = 0x83F91000
reloc off = 0x01791000

I'm attempting this on the 8600LH. I managed to install bluepy and Python 3.7. However, when running I get this error:

python dcs8000lh-configure.py 00:11:22:33:44:55 123456 --survey
[real MAC and pin redacted]

Connecting to 00:11:22:33:44:55...
Verifying IPCam service
Traceback (most recent call last):
File "dcs8000lh-configure.py", line 152, in
cam = BleCam(args.address, args.pincode)
File "dcs8000lh-configure.py", line 30, in init
self.name = self.periph.getCharacteristics(uuid=0x2a00)[0].read().decode() # wellknown name characteristic
File "/usr/local/lib/python3.7/dist-packages/bluepy/btle.py", line 508, in getCharacteristics
rsp = self._getResp('find')
File "/usr/local/lib/python3.7/dist-packages/bluepy/btle.py", line 407, in _getResp
resp = self._waitResp(wantType + ['ntfy', 'ind'], timeout)
File "/usr/local/lib/python3.7/dist-packages/bluepy/btle.py", line 368, in _waitResp
raise BTLEGattError("Bluetooth command failed", resp)
bluepy.btle.BTLEGattError: Bluetooth command failed (code: 10, error: No attribute found within the given range)

Is this because I'm running off a raspberry pi? Is there something else I'm missing? I've checked that the bluetooth agent is on and active and the pi is able to see the reset camera as a bluetooth device.

Impressive work!
I just got my rain-electrocuted device back up after several measures and a factory reset to FW 1.0.
The optics are a bit foggy, but hopefully that will go away.

My reflection is that it was not all that bad to use the app based dlink Bluetooth process to set up the device. I can still avoid the upgrade, etc...

Is the whole bluetooth set-up that you suggest avoidable if you disregard from this goal: "configuration of network and admin password via Bluetooth LE, without registering with D-Link or using the mydlink app at all".
Perhaps it is necessary for the initial communication?

Just wanted to share my experiences with this camera and your awesome application.

It sadly doesn't work. The app cannot get the hostname/name of the camera from the characteristics.
Hardcoding the string with the one on the back of the camera (name & last 2 pairs of mac) results in an unlock error that i could not get past.

There is one silver lining, the rtsp doesn't seem to be locked to localhost as with the 8000.

rtsp://ip-address/stream1
rtsp://ip-address/stream2

(stream1 = 1080p / stream2 = 720p)

Get me a password prompt! After some trial and error admin/admin worked, but after a factory reset admin/pincode was the new combination :)

I'm still intrigued as to what the password combo is for the 8088 port ?

Host is up (0.013s latency).
Not shown: 995 closed ports
PORT STATE SERVICE
554/tcp open rtsp
7000/tcp open afs3-fileserver
8080/tcp open http-proxy
8081/tcp open blackice-icecap
8088/tcp open radan-http

Ive been trying to tcp dump the traffic on my router to no avail. I did manage to find a sort of clue in the firmware tar online.

rts3901_sdk_v1.3_vanilla\users\network\lighttpd\rs_conf\htdigest_admin.txt
rts3901_sdk_v1.3_vanilla\users\network\lighttpd\rs_conf\htdigest_user.txt

Which contains:

admin:realsil:a9f95d7eea6c0c4c47b89d11c734a5db

If I'm not mistaken a9f95d7eea6c0c4c47b89d11c734a5db is the hash for "123456"

But that doesn't seem to work either. Now I'm happy with the fact that this camera supports rtsp (sort of) but I also have a 8000LH, and cannot get a stream from that and I'm on v2.03 but i ordered a serial cable and looking to try that route !

Thanks again for one hell of a great job !

Hi - does this work for the DCS-8100LH as well? Mine has FW v2.01 pre-installed which doesn't allow local streaming. Thanks!

Does anybody knows how can I find my pin code. I lost my box, stickers ( both paper and labed bellow the camera) . Please, help!

Hi, how create a backup firmware using serial connection?

Thanks!

I have a DCS-8000lhv2 but at some time I have removed the sticker on the bottom of the camera when I wanted to spray paint it black.
After that I never found the sticker again and didn't realize that the pin was so important. I thought I could use it as an generic camera throu rsvp or http ip streaming.
But that seems not to be the case.
So now I don't have access to the information on the information on the sticker anymore.
And I'm wondering, is there ANYTHING I can do to flash it with a new ID and PIN?
Or maybe connect the hardware via SERIAL or something else, maybe just the raw camera module, and get a picture/video feed out of that somehow?

If you could help, it would be much appreciated!!

Hello

I have 4 questions regarding D-LINK DCS-8600LH (https://github.com/tqz/defogger-8600)

the commands below work

dcs8600.py 00:11:22:33:44:55 012345 --command "reboot"
telnet login: root:twipc
mount /etc/ /tmp/SDCard/new-etc/
cp -r /etc/lighttpd /tmp/SDCard/lighttpd

1/ as root filesystem is read-only I can't edit file
/etc/lighttpd/lighttpd.conf and add server.port = 80

2/ what is the command to start or stop lighttpd

3/ i don't understand what to do
disable or change the authentication parts of the default conf.
killall mips-linux-lighttpd ; mips-linux-lighttpd -f /tmp/SDCard/lighttpd.conf -m /usr/lib/lighttpd

4/ how to update firmware

Thank you
cordially

My camera has a text overlay with the Date_Time stamp and the Model name in the feed that i access via rtsp.

Is there any way to disable this overlay?

I tried looking up the NICA API list but couldn't find a solution.

Hi, I'm getting stucked once time I'm in root console.
Every change that I'm doing is not permanent at the reboot.
It's seems the authentication is not working. I tried also to change the root password but it's not working.
Someone can help me?
Thanks.

I'm using a Raspberry Pi4 connected via serial0

I got couple DCS-8000LH/RE on sale (looks like refurbish model DCS-8000LHA1)
When I try the original method, I am not able to get HTTP access. I check the firmware and looks like its using 2.03.02 firmware
When I am trying to access to serial cable method, I did not see anything show up on console.
I tried over all the serial port parameters, none of them seem to get prompt console access.

Does anyone have any idea how do I access it via serial cable for this model to downgrade the firmware?

Hi, I set my 2 cameras up using your great instructions a year or so ago, but now I need to move them over to a new wifi network.

Is there a quick way of just changing the wifi details (just the SSID as the password hasn't changed) without having to reset everything?

Thanks,
Steve

I've been following the guide and I've finally reached the final firmware upgrade part. I compiled the firmware using the Makefile and altered the update.sh to fit my model as well as alter the private key file to fit my private key and model name. The firmware complies okay but when I try to upgrade, be it using curl or via serial it fails. Curl outputs upgrade=fail and fw_upgrade forceUpdate /tmp/tw.tar outputs either 1 or 0 with no sign of success.
Any suggestions?

I'm on firmware 2.03.02.

Followed the process until trying to upload firmware and it's giving this error:

curl: (7) Failed to connect to 10.0.1.172 port 80: Connection refused

Did an nmap which finds that port 80 isn't open:

Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-27 20:38 AEDT
Nmap scan report for 10.0.1.172
Host is up (0.025s latency).
Not shown: 997 closed ports
PORT     STATE    SERVICE
554/tcp  filtered rtsp
8080/tcp open     http-proxy
8081/tcp open     blackice-icecap

Based on release notes, it looks like they fixed the bluetooth command injection.

I can still enable HTTPD it working via serial.