Sitecom WLC-1000 Firmware Information

Unfortunately the company that created the iphone and android application has filed for bankruptcy, rendering the wlc-1000 cameras useless for checking your cameras on the road or recording to the cloud (recording on the sdcard should still work as far as I know).

A visitor asked me to share some of my findings for the sitecom firmware, because he wants to create an app to be able to use the cameras again, which sounds like a great idea!
It has been a while since I did the analysis, but I will try and share as much as I found, so anyone can try and setup a working application. With one side note, please share your projects, or setup a public repository, so other people can help / benefit from the code as well (and share it in the comments below).

All the working get Urls that are in the firmware: 
http://CAMERAIP/img/snapshot.jpg (get the latest saved snapshot)
http://CAMERAIP/CGI/ScanAP (get a list of wifi points nearby)
http://CAMERAIP/CGI/CameraStatus (get the current camerastatus in xml file, example:)

<CameraStatus>
    <RSSI>0</RSSI>
    <Adaptor>1</Adaptor>
    <Battery>100</Battery>
    <OpticalZoom>1.0</OpticalZoom>
    <OpticalZoomMax>1.0</OpticalZoomMax>
    <DigitalZoom>1.0</DigitalZoom>
    <DigitalZoomMax>1.0</DigitalZoomMax>
    <LED>0</LED>
    <Space>2658</Space>
    <Recording>0</Recording>
    <DirectMode>1</DirectMode>
    <SD>1</SD>
    <SDTotalSpace>3476</SDTotalSpace>
    <FormatStatus>0</FormatStatus>
    <StreamType>RTP_H264_WVGA</StreamType>
    <RemainingTime>0</RemainingTime>
    <RecordingTime>0</RecordingTime>
    <VideoResolution>0</VideoResolution>
    <PhotoResolution>0</PhotoResolution>
    <Audio>0</Audio>
    <Inverter>0</Inverter>
    <Loop>0</Loop>
    <EnMotionDetection>0</EnMotionDetection>
    <VoiceRecording>0</VoiceRecording>
    <PhotoTimeLapse>0</PhotoTimeLapse>
    <DZoomEnable>0</DZoomEnable>
    <Temperature>30</Temperature>
    <TemperatureMax>50</TemperatureMax>
    <TemperatureMin>0</TemperatureMin>
    <TemperatureType>C</TemperatureType>
    <Nightlight>OFF</Nightlight>
    <Notification>No_Event-2018/02/27 21:03:24</Notification>
    <LullabyPlay>OFF</LullabyPlay>
    <LullabySong>1</LullabySong>
    <LullabyTime>0</LullabyTime>
    <LullabyPlayingTime>0</LullabyPlayingTime>
    <LullabyMode>ONE</LullabyMode>
    <LullabyVolume>0</LullabyVolume>
    <MotionEvent>0</MotionEvent>
    <NewFirmwareEvent>0</NewFirmwareEvent>
    <NewFirmwareVersion></NewFirmwareVersion>
    <AudioEvent>0</AudioEvent>
    <TemperatureEvent>0</TemperatureEvent>
    <FwUpgradeStatus>Idle</FwUpgradeStatus>
    <FwDownloadProgress>0</FwDownloadProgress>
    <RTCDate>2018/02/27</RTCDate>
    <RTCTime>21:03:24</RTCTime>
    <GPS>0</GPS>
    <PortableCarDV>Portable</PortableCarDV>
    <StandType>NoStand</StandType>
    <FileChanged>0</FileChanged>
    <IQCalibration>1</IQCalibration>
    <CloudID>0</CloudID>
    <PanTest>0</PanTest>
    <TiltTest>0</TiltTest>
    <ZoomTest>0</ZoomTest>
</CameraStatus>

http://CAMERAIP/CGI/CameraSetting (this request seems to crash the response, so its not a complete response, but you can filter with variables, first the crashed response:

<CameraSetting>
    <Item>
        <Time>
            <Year>2018</Year>
            <Month>2</Month>
            <Day>27</Day>
            <Hour>21</Hour>
            <Minute>14</Minute>
        </Time>
    </Item>
    <Item>
        <Sound>ON</Sound>
    </Item>
    <Item>
        <TVSystem>50HZ</TVSystem>
    </Item>
    <Item>
        <FWVER>1356</FWVER>
    </Item>
    <Item>
        <RESOLUTION>HD30</RESOLUTION>
    </Item>
    <Item>
        <LIGHT>OFF</LIGHT>
    </Item>
    <Item>
        <SLOW_MOTION>OFF</SLOW_MOTION>
    </Item>
    <Item>
        <NIGHT_MODE>OFF</NIGHT_MODE>
    </Item>
    <Item>
        <TIME_LAPSE>OFF</TIME_LAPSE>
    </Item>
    <Item>
        <SELF_TIMER>OFF</SELF_TIMER>
    </Item>
    <Item>
        <AUTO_RECORDING>OFF</AUTO_RECORDING>
    </Item>
    <Item>
        <MOTION_DETECTOR>OFF</MOTION_DETECTOR>
    </Item>
    <Item>
        <VOICE_RECORDING>OFF</VOICE_RECORDING>
    </Item>
    <Item>
        <RECORD_INTERVAL>OFF</RECORD_INTERVAL>
    </Item>
    <Item>
        <DELAY_SHUTDOWN>OFF</DELAY_SHUTDOWN>
    </Item>
    <Item>
        <VIDEO_MODE>VIDEO</VIDEO_MODE>
    </Item>
    <Item>
        <PHOTO_MODE>PHOTO</PHOTO_MODE>
    </Item>
    <Item>
        <AUTO_POWER_OFF>OFF</AUTO_POWER_OFF>
    </Item>
    <Item>
        <TEMPERATURE_ALERT>
            <ENABLE>OFF</ENABLE>
            <TYPE>C</TYPE>
            <MAX>50</MAX>
            <MIN>0</MIN>
        </TEMPERATURE_ALERT>
    </Item>
    <Item>
        <LCD_TIMEOUT>OFF</LCD_TIMEOUT>
    </Item>
    <Item>
        <G_SENSOR>OFF</G_SENSOR>
        <Item>
            <SUPPORT_LANGUAGE>EN,DE,FR,IT,ES,PT,ZHS,ZHT,JP,KO,RU</SUPPORT_LANGUAGE>
        </Item>
        <Item>
            <LANGUAGE>ZHT</LANGUAGE>
        </Item>
        <Item>
            <MOTION_DETECTION>
                <ENABLE>ON</ENABLE>
                <SENSITIVITY>3</SENSITIVITY>
            </MOTION_DETECTION>
        </Item>
        <Item>
            <AUDIO_DETECTION>
                <ENABLE>OFF</ENABLE>
                <SENSITIVITY>3</SENSITIVITY>
            </AUDIO_DETECTION>
        </Item>
        <Item>
            <STREAM_RESOLUTION>WVGA</STREAM_RESOLUTION>
        </Item>
        <Item>
            <MAX_BANDWIDTH>1Mbps</MAX_BANDWIDTH>
        </Item>
        <Item>
            <EMAIL_ALERT></EMAIL_ALERT>
        </Item>
        <Item>
            <LULLABY_SONG>1</LULLABY_SONG>
        </Item>
        <Item>
            <LULLABY_MAX_VOLUME>5</LULLABY_MAX_VOLUME>
        </Item>
        <Item>
            <LULLABY_MODE></LULLABY_MODE>
        </Item>
        <Item>
            <SDPercentForCar>50</SDPercentForCar>
        </Item>
        <Item>
            <MAX_FRAMERATE>30</MAX_FRAMERATE>
        </Item>
        <Item>
            <IR_LED>AUTO</IR_LED>
        </Item>
        <Item>
            <FW_UPGRADE>OFF</FW_UPGRADE>
        </Item>
        <Item>
            <ROTATE_IMAGE>OFF</ROTATE_IMAGE>
        </Item>
        <Item>
            <TIME_ZONE>
                <GMT>+1</GMT>
                <NTP>ntp0.fau.de</NTP>
            </TIME_ZONE>
        </Item>
        <Item>
            <OSD>
                <Chan>
                    <Idx>0</Idx>
                    <Enable>OFF</Enable>
                    <X>0.000000</X>
                    <Y>0.000000</Y>
                    <CNT></CNT>
                    <Color>BLACK</Color>
                    <Size>1X</Size>
                </Chan>
                <Chan>
                    <Idx>1
                    </

it ends the response with: [libusock] read 2090 bytes

But if you add some variables you get a full response with these values:
http://CAMERAIP/CGI/CameraSetting?TIME&TIME_ZONE&MOTION_DETECTION&AUDIO_DETECTION

http://192.168.0.120/CGI/GoCloudStatus

<GoCloudStatus>0</GoCloudStatus>

And last but not least:
http://CAMERAIP/CGI/CloudmodeInfo
this one was interesting, because it spits out “garbage” it looks like they encrypted the data it’s displaying:

ΌΓμουδΣεττιξηΎΌΒαιδυΎΌΥΣΕ�ΞΑΝΕΎΌ―ΥΣΕ�ΞΑΝΕΎΌΑΓΓΕΣΣίΤΟΛΕΞΎΌ―ΑΓΓΕΣΣίΤΟΛΕΞΎΌ�ΕΖ.....

After some digging in the android app, I found some code that looked like a decryption function, I built a small java application, to call the url:

Java decode:

/*
 * To change this license header, choose License Headers in Project Properties.
 * To change this template file, choose Tools | Templates
 * and open the template in the editor.
 */
package javaapplication1;
import org.apache.http.impl.client.BasicCookieStore;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.util.EntityUtils;
import org.apache.http.HttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.client.ClientProtocolException;
import org.apache.http.client.CookieStore;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.commons.logging.LogFactory;
import java.io.IOException;

/**
 *
 * @author thomas
 */
public class JavaApplication1 {

    /**
     * @param args the command line arguments
     */
    public static void main(String[] args) {
        // TODO code application logic here
        
        String retSrc = "";
        DefaultHttpClient client = new DefaultHttpClient();
       HttpResponse response = null;
        try{
        response = client.execute(new HttpGet("http://192.168.0.120/CGI/CloudmodeInfo"));
        }
        catch(IOException e){
  e.printStackTrace();
}
                if (response.getStatusLine().getStatusCode() == 200) {
                    try{
                    retSrc = decodeContent(EntityUtils.toByteArray(response.getEntity()));
                    }catch(IOException e){
  e.printStackTrace();
}
                    System.out.println(retSrc);
                }
          
    }
     private static String decodeContent(byte[] contentByte) {
            byte[] decodedHex = new byte[(contentByte.length - 2)];
            for (int i = 0; i < decodedHex.length; i++) {
                contentByte[i] = (byte) (contentByte[i] ^ 128);
                decodedHex[i] = contentByte[i];
            }
            return new String(decodedHex);
        }
}

and decrypt the string and bingo, after decryption the string looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<CloudSetting>
   <Baidu>
      <USERNAME />
      <ACCESS_TOKEN />
      <REFRESH_TOKEN />
      <FOLDER />
      <CVR_ACTIVE>0</CVR_ACTIVE>
   </Baidu>
   <Dropbox>
      <USERNAME />
      <ACCESS_TOKEN />
      <FOLDER />
      <CVR_ACTIVE>0</CVR_ACTIVE>
   </Dropbox>
   <Chicony>
      <NEW>0</NEW>
      <EMAIL />
      <STATUS>0</STATUS>
      <USERNAME>nobady</USERNAME>
      <PASSWORD>nopass</PASSWORD>
      <ACTIVE>1</ACTIVE>
   </Chicony>
   <APList>
      <STATUS>0</STATUS>
      <AP>
         <SSID>MyWifiSSD</SSID>
         <PASSWORD>myPassword</PASSWORD>
         <CIPHER>WPA2</CIPHER>
         <CloudACTIVE>0</CloudACTIVE>
      </AP>
   </APList>
</CloudSetting>

The Post Urls:

http://CAMERAIP/CGI/CameraLogin (no body, it looks like it always outputs:)

<Login>Login OK</Login>
<CameraID>H2-Q6HKEBXX</CameraID>
<CameraName>Home Cam Mini</CameraName>
<MAC>64D1A3472CXX</MAC>
<HWVER>02</HWVER>
<FWVER>1356</FWVER>
<MODEL>WLC-1000</MODEL>
<PN>A02</PN>
<Mode>Portable</Mode>

To be continued..