Pearl from the flea market or reverse engineering of the DCS-5220A1 IP camera

The summer ended well, which means it is time to leave their homes, native summer cooperatives and flocks to go to the city. Everything would be fine, but somehow it is scary to leave farming for as many as six months unattended. I asked myself a similar question. As a result, I decided to equip the site with a simple set of a webcam and Internet access (most likely 3G). He started, as usual, from a small one - with a search for a suitable budget camera. My budget was about $ 20.


Something normal could not get into this amount, in principle, so there were options like “DIR-320 + openwrt + UVC camera from a laptop” sealed in a sealed plastic bag and suspended from wood. But one evening I was browsing through ads of the local flea market and came across the sale of the D-link DCS-5220A1 IP camera, and also the PTZ function for some funny $ 10. For those who do not know, give an excerpt from Wikipedia

Pan-tilt-zoom-camera (PTZ-camera) - a camera that supports remote control of the direction and zoom. PTZ is an abbreviation of pan, tilt and zoom (pan, tilt, zoom), which describes how to control the camera.

Yes, alert. But the toad overpowered, and self-confidence echoed her (“really, we won’t figure it out ?!”). The camera turned out to be old, but with an excellent light-sensitive sensor (just what is needed to observe the situation in the evening). Solved and the camera on my desk.



First [+]:

1. Elegant night sensitivity (without any infrared illumination) - 0.5 Lux @ f1.4
2. PTZ (although the zoom is only digital)
3. WiFi is implemented by miniPCI RT2560F card. Aliexpress can already find 802.11n (for example AR9160 , replace and drive the video stream in maximum quality (the camera supports mpeg4 and H.263)
4. Supports RTSP, HTTP, etc.
5. UPnP support
6. Gold was not spared a fee, the layer on all contacts is capital.
7. On board your web server. And the system is based on linux, because even some source codes are uploaded . However, initially it was not possible to get through to either SSH or telnet.

Then noticed [-]:

1. The maximum resolution is 640x480. The camera, apparently hellish (immediately thought that generally connected by lvds, the connector is very similar.
2. Difficulties with the primary connection. The camera connects to the computer _ only through a hub_ or a crossover cable. And no one knows what the IP address.

It should be immediately noted that on the Internet about my particular information model there was a scanty amount - a page on the d-link website and that's it. So I decided first of all to open the case, the benefit was kept on all three screws. By the way, the presence of a standard mount for a photo pole (1/4 ") on the bottom of the case seemed to me sweet. In general, after removing the cover, I saw the following picture:



Photos with the author's notes, it gives about the past to know the cell repair shop. All the time you make yourself solutions for the case of the arrival of a similar model :). Having a good look at the board, I collected everything back and decided to see how the camera would work with the native software (since I could download some huge packages from the d-link server).

Despite carefully studying the first Russian, then the English manual, I did not understand how to find the camera. I had to search the mezzanine for an old hub, connect a camera to it, install wireshark and listen to ethernet. Listening gave the ip-address "192.168.0.99". Having scored it in the manual settings of the d-link Network Camera Installation program, the camera picked up. To work with such a camera, another utility from d-link D-ViewCam is intended. It also had to enter the address manually, the camera showed up and I was even able to check the operation of the PTZ. The camera is really well controlled and goes right-left / up-down with a resolution of "one gear of the gear wheel" :). The truth is constantly clicking a little tiring.

Googling, I found the document " URL command for DCS-5220, DCS-2120"where it is written that you can control the camera with the command: http: ///cgi-bin/camctrl.cgi? [move =] [& speedpan =] [& speedtilt =], where value = up / down / left / right / home + - 5 - for a step in one gear of the drive gear.
In principle, it seems like everything should have been, but the worm of doubt did not give rest. Unix is ​​on board, well, what a web interface. After looking at analog cameras and reading forum.openwrt.org A vulnerability was discovered that allows a web request to enable telnet in the camera. All that was needed for this was to write it in the browser's line

http: // <camera address> /cgi/admin/telnetd.cgi?command=on

After finishing work with the camera, I strongly recommend turning off the telnet, this is done in a similar way, via a request

http: // <camera address> /cgi/admin/telnetd.cgi?command=off

In the net result, the telnet session gave far more answers than all the official sites (and even the official Telegram channel :)) combined. Below is information about the hardware features of this camera, collected via telnet and UART console:











To the note / reminder to all who dare to repeat such experiments - connect to the UART output via a level converter (I had it FTDI232).

Having carefully analyzed the console boot logs, it became approximately clear that the kernel is directly unpacked into RAM. Theoretically, the site can be found GPL firmware, if not for all, then at least for many d-link products. But it was for my model to download the latest firmware failed. Okay, I took the first one (* .pkg file) and fed it to binwalk.

It turned out the following:

$binwalk DCS-5220_A2_v1.05.pkg
DECIMAL HEXADECIMAL DESCRIPTION
__________________________________________
54_0x36_uImage header, OS Kernel Image, compression type: none, image name: "linux-2.4.26"
11770 _0x2DFA _gzip compressed data, maximum compression,
897238_0xDB0D6_gzip compressed data, maximum compression, file name: "initrd.img"
2935070_0x2CC91E_gzip compressed data

Before doing further research, I looked diagonally if there was any mention of disassembling and / or reassembling firmware for such cameras. I came across a resource of Firmware unpackers for IP cameras , which contains scripts for unpacking D-Link IP cameras firmwares and Trendnet cameras similar to them for iron stuffing. Unfortunately, my model was not available there. In any case, I tried to write to the author. To my surprise, the latter answered and confirmed the information given by the binwalk - there are simple archives inside the firmware. Running binwalk with the -e switch gave the following picture:



Simple TAR archives can be easily extracted with the tar -xvf command. The content there is as follows:



Since inside - nothing interesting was found, it was decided to climb inside the initrd.img . For analysis, simply mount the image with the command:

$ sudo mount -o loop initrd.img / home / imagefile /

Inside a standard set, ready for editing by a curious researcher :)

$ ls
bin drivers etc home lib linuxrc lost + found mnt proc root sbin tmp usr var

Along the way, I found that the firmware for camera 5220 revision A1 and revision A2 are identical and completely interchangeable. But the firmware from revision B to cameras with revision A hardware is absolutely not suitable.

In general, theoretically, adjusting the firmware to your needs is not difficult. As well as add the necessary driver (when replacing a miniPCI card for example). You can flash the camera through the standard interface of the D-ViewCam program or the Installation Wizard (which I mentioned at the very beginning).

But there is another option. Upload the finished firmware (renamed flash.pkg in advance) to the internal FTP of the camera (the FTP server must start from the telnet server, but for security reasons, the telnet is disabled by default and requires forced launch with a special request). Perhaps nothing will come of it - not enough time to check. All that is is the process log of the firmware from the standard application, taken using wireshark:


That's all, I decided to write because of the complete absence of any information on this type of camera and that the article should serve as a reminder that it would be necessary to fully understand the firmware. I would be glad if someone confirms or refutes my conjectures.

Sergey Besarab ( Siarhei V. Besarab )

Note: initially, being an ardent admirer of openwrt, I confess that it was useful inside the camera to find out if openwrt can be installed there. The answer is that the network functionality can be preserved, but the PTZ functionality will completely disappear. Therefore, it is better to modify the existing firmware. But I saved the topic on the openwrt.org forum, and uploading everything new there that I can learn about d-link DCS-5220.