Xiaomi Xiaofang Wireless Camera Custom Firmware Hack

xiaofang.png

A colleague of mine demonstrated a Wyze webcam a couple of weeks before. A nifty little FullHD wireless IP camera that has a decent (iOS/Android) app and cloud connectivity to store the data.
I liked everything about it, except the cloud-storage part. I don’t like it when I don’t know where my private data resides. So I started a to search to see if these devices could be altered to benefit my needs, and guess what, they can be altered.

There’s a github project where they fabricated a firmware hack and with custom software the camera can be used for much more. So now I had to get my hands on the most inexpensive version of the camera. Since there are different brands that ship basically the same hardware with a different firmware, there’s more than enough choice.

I got my test object from Aliexpress, mainly because it was dead-cheap and no shipping.

The problem with the AliExpress versions is that is all Chinese. The box, writing, voice etc, but since the instruction on the github pages are pretty straightforward it shouldn’t be a problem.

Apparently, mine was fabricated in September 2019 (2019-09), but I didn’t open my camera to see what the actual revision was.

Applying the firmware hack is purely done by ‘feeling’, since I have no idea what the Chinese voice was saying. But after the second time it looked like it stuck, and so I could prep the sd-card with the custom made software.

The most important is the wpa_supplicant.conf file, since that one gives you access to the device form a computer/mobile device.

Example /config/wpa_supplicant.conf file:

# For more configuration option please see:
# https://w1.fi/cgit/hostap/plain/wpa_supplicant/wpa_supplicant.conf

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
ap_scan=1

network={
        ssid="MY_SSID"
        psk="MY_SSID_PASSWORD"
        # Uncomment to connect to Hidden SSIDs
        scan_ssid=1 
        key_mgmt=WPA-PSK
        #pairwise=CCMP TKIP
        #group=CCMP TKIP WEP104 WEP40
        #priority=2
}

Another important file that needs the be changed is the swap.conf file. The SWAP parameter needs to be set to true. This enables the low-memory devices (like mine) to process images / video’s that can be used in e.g. Telegram notifications.

Example /config/swap.conf file:

# If you need to run many services in parallel you may want to enable swap on your camera to avoid running out of memory
# in particular on the xiaofang & clones with only 64 mb 

SWAP=true
SWAPPATH="/system/sdcard/swapfile"
SWAPSIZE=512

After that thew sd-card can be inserted in the camera and you can apply power to it.

When the LED on the back is blue (non-blinking) the device is operational. You may find the IP address to which to connect in your network router and/or Access point. To make it easier to identify the IP address you can use a QR-code scanner to scan the code on the back of the box. This returns the MAC address of the device (which links to an IP address in your Access Point/DSL Router/Switch/DHCP Server/whatever). You can also use a wireless scanner like Fing to scan for all the devices on your wireless network.

IMAGE 2019-11-19 145605.png

After finding the IP address you can connect to the device by using a browser.

The default username and password is root/ismart12, which can and should be altered for obvious security reasons. The password for the webgui can be altered through the webgui (System -> Administration), but that doesn’t change the password for SSH. That password needs to be changed by invoking the passwd command on the cli.

Experiences with the device so far:

  • After experiencing a corrupt sd-card everything seems to work fine.

  • A lot of functionality for a less than 20 euro IP camera.

  • IR / Nightvision is OK, but don’t place the camera behind double glazing, since the IR light reflects back to the camera (-> impaired vision)

  • Access and usage is a bit cumbersome in the browser on a mobile device.

  • The RTSP feed of the camera is unstable in the VLC player, BUT keeps working properly in the Synology Surveillance Station. Perhaps it has better recovery mechanisms on the RTSP stream?

  • Having both audio and video in the same stream works badly.

  • Easy Synology Surveillance Station integration

  • Telegram integration works fine (remember to set the swap file confiig!!), but resulting image/video might miss the actual motion. I blame this on the limited internal processing power of the device. The Synology Surveillance Service works just fine with motion on the RTSP stream.
    Also, the video/animated GIF in the Telegram message is not always working. Images work just fine.

Just remember that this is a very cheap wireless IP camera that can easily be pulled out of a (Chinese) cloud service, and gives you a lot of freedom with it.

Posted on November 19, 2019 and filed under Gadgets, Hardware, Security, Review, Tips'n Tricks.