Sitecom WLC-1000 Review & API endpoints
As mentioned in my post about using openhab & WLC-1000 I have a few sitecom WLC-1000 cameras, and would like to tell you the things I like, and don’t like, plus give you some usefull urls I found during my research on how to use them with openhab.
UPDATE 04-12-2017
After IOS11 the mobile app stopped working, they said it would be fixed but still no update, so if you only have an ios device, you can’t install the cam anymore for now.. I currently use memu to see the camera’s (pc android emulator), I will let you know when the app starts working again
I bought the cameras on ibood for a discount price of €41 each, (including shipping), normally they sell for around €70, which is really on the high side for this device.
I had a Philips b120n, they sell for around €50 on ebay, which I feel is a completer product.
What I like about the Sitecom WLC-1000
- Pretty good video quality
at 720p 30fps, you can check the quality of the picture in this video - Video Storage
Comes with 8gb microsd, for local recording, and connects to google drive, for saving motion /audio detection recordings on your google drive - Setup is quite easy
The things I don’t like:
- Nightvision & led
Sitecom has chosen to add a blue led on top which is always on, and the nigt vision leds are visible too at night, It is a bit too bright to use as a baby camera, I did tape off the blue led, but I still find it a bit brighter in a dark room, compared to the B120N, I will add a picture of the camera brightness tonight. - Recording & Push notifications
The cameras will only record when motion or sound is detected, if you have this feature on, and enable pushnotifications, you will receive a notification every minute when you are home, you can’t set a timeschedule for enabling motion detection. so you are forced to manually disable the notifications or motion detection in the app when at home (unless you are using a script like I mentioned in my previous post) - mobile app
The mobile app feels incomplete, logging in with google account needs to be done every time you open the app, would’ve been nice if this only needed to be done once, or once every week..
Conclusion
For the price I paid, I’m defenitely not complaining, it’s a pretty good little device, although I would like to get some 1080p cams in the future for outside, (I really like the price and quality of the Amcrest Dome Camera) for now I will keep these indoors, and have them recording when away.
Some nice Urls you can use:
Rtsp stream, you can enter in vlc player, to see the stream directly on your pc:
rtsp://CAMERAIP/live0 (low quality video stream)
rtsp://CAMERAIP/live1 (high quality video stream)
Change settings through posting to the XML API:
http://CAMERAIP/CGI/CameraSetup
For instance, to enable motion detection, post:
<Item><MOTION_DETECTION><ENABLE>ON</ENABLE><SENSITIVITY>3</SENSITIVITY></MOTION_DETECTION></Item>
Disable motion detection:
<Item><MOTION_DETECTION><ENABLE>OFF</ENABLE><SENSITIVITY>0</SENSITIVITY></MOTION_DETECTION></Item>
Disable IR_LEDS:
<IR_LED>OFF</IR_LED>
Enable Auto switch IR_LEDS:
<IR_LED>auto</IR_LED>
See accesspoints near your camera:
http://CAMERAIP/CGI/ScanAP
Get latest snapshot:
http://CAMERAIP/img/snapshot.jpg
Hello Thomas, thanks for the informations that you provides. Since the end of january it is not possible to use both android or iOS application to communicate with sitecom cameras. The sitecom company is on bankruptcy.
I’m developping an application to manage the camera. Do you have any idea of the payload to use for pairing the camera with a given endpoint?
Thanks for your help.
Hi there, Yes, I know, I have 3 useless cameras hanging as decoration at the moment :(… I meant to do a writeup but didn’t get round to doing it yet.
Your project sounds great!
I’ll try and list some more information I have left out of this article (I have some setup urls etc..) tomorrow.
Hello, thanks for your answer.
hi there, it’s taking a bit longer to go through all my notes on my old harddrive, and the firmware, I made a start with the article, and try and finish it this week. I’ll keep you posted.
https://www.thomaslang.nl/sitecom-wlc-1000-firmware-information/
I did find some assembly code for a setrootpwd command, would you be able to decypher that? I’m not sure if it’s the complete function, and it will take me some more time to start decoding it..
Hello Thomas,
Thanks for your help. Yes, i can try to reverse the assembly code. I will make some tests and then i will start making an app, for the moment i have only made a python script that get pictures from the rtsp stream and upload it on a rest api. I’ll keep you informed and of course I’ll share the code.
edit: can you post the code of the decryption function for the call of CloudmodeInfo ?
the decryption code is in the new post as well https://www.thomaslang.nl/sitecom-wlc-1000-firmware-information/
Thanks Thomas,
Here is the gitlab address of the Camera Manager project. https://gitlab.com/dev884/camnager
Regards,
Marco
this is the assembly part I found, not sure if it’s complete:
; function: CGI_SetRootPWD at 0xed80 — 0xf1f3
0xed80: 00 48 2d e9 stm db sp!, 0x4800
0xed84: 04 b0 8d e2 add fp, sp, #0x4, 0x0
0xed88: 86 df 4d e2 sub sp, sp, #0x86, 0xf
0xed8c: 00 30 a0 e3 mov r3, #0x0, 0x0
0xed90: 18 30 0b e5 str r3, [ fp, # – 0x18 ]
0xed94: 00 30 a0 e3 mov r3, #0x0, 0x0
0xed98: 14 30 0b e5 str r3, [ fp, # – 0x14 ]
0xed9c: 00 30 a0 e3 mov r3, #0x0, 0x0
0xeda0: 0c 30 0b e5 str r3, [ fp, # – 0xc ]
0xeda4: e0 03 9f e5 ldr r0, [ pc, # + 0x3e0 ]
0xeda8: 25 e7 ff eb bl 0x8a44
0xedac: 00 30 a0 e1 mov r3, r0, lsl #0x0
0xedb0: 03 00 a0 e1 mov r0, r3, lsl #0x0
0xedb4: 8e e7 ff eb bl 0x8bf4
0xedb8: 00 30 a0 e1 mov r3, r0, lsl #0x0
0xedbc: 08 30 0b e5 str r3, [ fp, # – 0x8 ]
0xedc0: c8 33 9f e5 ldr r3, [ pc, # + 0x3c8 ]
0xedc4: 00 20 93 e5 ldr r2, [ r3, # + 0x0 ]
0xedc8: c4 33 9f e5 ldr r3, [ pc, # + 0x3c4 ]
0xedcc: 02 00 a0 e1 mov r0, r2, lsl #0x0
0xedd0: 03 10 a0 e1 mov r1, r3, lsl #0x0
0xedd4: bc 23 9f e5 ldr r2, [ pc, # + 0x3bc ]
0xedd8: 49 e7 ff eb bl 0x8b04
0xeddc: b8 03 9f e5 ldr r0, [ pc, # + 0x3b8 ]
0xede0: 17 e7 ff eb bl 0x8a44
0xede4: 00 30 a0 e1 mov r3, r0, lsl #0x0
0xede8: 10 30 0b e5 str r3, [ fp, # – 0x10 ]
0xedec: 9c 33 9f e5 ldr r3, [ pc, # + 0x39c ]
0xedf0: 00 20 93 e5 ldr r2, [ r3, # + 0x0 ]
0xedf4: a4 33 9f e5 ldr r3, [ pc, # + 0x3a4 ]
0xedf8: 02 00 a0 e1 mov r0, r2, lsl #0x0
0xedfc: 03 10 a0 e1 mov r1, r3, lsl #0x0
0xee00: 10 20 1b e5 ldr r2, [ fp, # – 0x10 ]
0xee04: 3e e7 ff eb bl 0x8b04
0xee08: 08 20 1b e5 ldr r2, [ fp, # – 0x8 ]
0xee0c: 90 33 9f e5 ldr r3, [ pc, # + 0x390 ]
0xee10: 03 00 52 e1 cmp r2, r3, lsl #0x0
0xee14: 02 30 a0 31 movcc r3, r2, lsl #0x0
0xee18: 08 30 0b e5 str r3, [ fp, # – 0x8 ]
0xee1c: 86 3f 4b e2 sub r3, fp, #0x86, 0xf
0xee20: 03 00 a0 e1 mov r0, r3, lsl #0x0
0xee24: 00 10 a0 e3 mov r1, #0x0, 0x0
0xee28: 02 2c a0 e3 mov r2, #0x2, 0xc
0xee2c: 58 e7 ff eb bl 0x8b94
0xee30: 08 20 1b e5 ldr r2, [ fp, # – 0x8 ]
0xee34: 6c 33 9f e5 ldr r3, [ pc, # + 0x36c ]
0xee38: 00 30 93 e5 ldr r3, [ r3, # + 0x0 ]
0xee3c: 86 1f 4b e2 sub r1, fp, #0x86, 0xf
0xee40: 01 00 a0 e1 mov r0, r1, lsl #0x0
0xee44: 02 10 a0 e1 mov r1, r2, lsl #0x0
0xee48: 01 20 a0 e3 mov r2, #0x1, 0x0
0xee4c: 44 e7 ff eb bl 0x8b64
0xee50: 38 33 9f e5 ldr r3, [ pc, # + 0x338 ]
0xee54: 00 10 93 e5 ldr r1, [ r3, # + 0x0 ]
0xee58: 4c 23 9f e5 ldr r2, [ pc, # + 0x34c ]
0xee5c: 86 3f 4b e2 sub r3, fp, #0x86, 0xf
0xee60: 01 00 a0 e1 mov r0, r1, lsl #0x0
0xee64: 02 10 a0 e1 mov r1, r2, lsl #0x0
0xee68: 03 20 a0 e1 mov r2, r3, lsl #0x0
0xee6c: 08 30 1b e5 ldr r3, [ fp, # – 0x8 ]
0xee70: 23 e7 ff eb bl 0x8b04
0xee74: 10 00 1b e5 ldr r0, [ fp, # – 0x10 ]
0xee78: 30 13 9f e5 ldr r1, [ pc, # + 0x330 ]
0xee7c: 2c e7 ff eb bl 0x8b34
0xee80: 00 30 a0 e1 mov r3, r0, lsl #0x0
0xee84: 00 00 53 e3 cmp r3, #0x0, 0x0
0xee88: 05 00 00 1a bne 0xeea4
0xee8c: 10 00 1b e5 ldr r0, [ fp, # – 0x10 ]
0xee90: 1c 13 9f e5 ldr r1, [ pc, # + 0x31c ]
0xee94: 26 e7 ff eb bl 0x8b34
0xee98: 00 30 a0 e1 mov r3, r0, lsl #0x0
0xee9c: 00 00 53 e3 cmp r3, #0x0, 0x0
0xeea0: 01 00 00 0a beq 0xeeac
0xeea4: 01 30 a0 e3 mov r3, #0x1, 0x0
0xeea8: 18 30 0b e5 str r3, [ fp, # – 0x18 ]
0xeeac: 18 30 1b e5 ldr r3, [ fp, # – 0x18 ]
0xeeb0: 01 00 53 e3 cmp r3, #0x1, 0x0
0xeeb4: a7 00 00 1a bne 0xf158
0xeeb8: d0 32 9f e5 ldr r3, [ pc, # + 0x2d0 ]
0xeebc: 00 10 93 e5 ldr r1, [ r3, # + 0x0 ]
0xeec0: f0 22 9f e5 ldr r2, [ pc, # + 0x2f0 ]
0xeec4: 86 3f 4b e2 sub r3, fp, #0x86, 0xf
0xeec8: 01 00 a0 e1 mov r0, r1, lsl #0x0
0xeecc: 02 10 a0 e1 mov r1, r2, lsl #0x0
0xeed0: 03 20 a0 e1 mov r2, r3, lsl #0x0
0xeed4: 0a e7 ff eb bl 0x8b04
0xeed8: dc 02 9f e5 ldr r0, [ pc, # + 0x2dc ]
0xeedc: 38 e7 ff eb bl 0x8bc4
0xeee0: 00 30 a0 e1 mov r3, r0, lsl #0x0
0xeee4: 14 30 0b e5 str r3, [ fp, # – 0x14 ]
0xeee8: 14 30 1b e5 ldr r3, [ fp, # – 0x14 ]
0xeeec: 00 00 53 e3 cmp r3, #0x0, 0x0
0xeef0: 07 00 00 ca bgt 0xef14
0xeef4: c4 22 9f e5 ldr r2, [ pc, # + 0x2c4 ]
0xeef8: 90 32 9f e5 ldr r3, [ pc, # + 0x290 ]
0xeefc: 00 30 93 e5 ldr r3, [ r3, # + 0x0 ]
0xef00: 02 00 a0 e1 mov r0, r2, lsl #0x0
0xef04: 01 10 a0 e3 mov r1, #0x1, 0x0
0xef08: 1a 20 a0 e3 mov r2, #0x1a, 0x0
0xef0c: 32 e7 ff eb bl 0x8bdc
0xef10: 91 00 00 ea b 0xf15c
0xef14: 87 0f a0 e3 mov r0, #0x87, 0xf
0xef18: de e6 ff eb bl 0x8a98
0xef1c: 00 30 a0 e1 mov r3, r0, lsl #0x0
0xef20: 0c 30 0b e5 str r3, [ fp, # – 0xc ]
0xef24: 0c 00 1b e5 ldr r0, [ fp, # – 0xc ]
0xef28: 00 10 a0 e3 mov r1, #0x0, 0x0
0xef2c: 87 2f a0 e3 mov r2, #0x87, 0xf
0xef30: 17 e7 ff eb bl 0x8b94
0xef34: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xef38: 01 20 a0 e3 mov r2, #0x1, 0x0
0xef3c: 04 20 83 e5 str r2, [ r3, # + 0x4 ]
0xef40: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xef44: 1c 30 83 e2 add r3, r3, #0x1c, 0x0
0xef48: 03 00 a0 e1 mov r0, r3, lsl #0x0
0xef4c: 70 12 9f e5 ldr r1, [ pc, # + 0x270 ]
0xef50: 0c 20 a0 e3 mov r2, #0xc, 0x0
0xef54: c3 e6 ff eb bl 0x8a68
0xef58: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xef5c: 0c 20 a0 e3 mov r2, #0xc, 0x0
0xef60: 0c 20 83 e5 str r2, [ r3, # + 0xc ]
0xef64: 08 20 1b e5 ldr r2, [ fp, # – 0x8 ]
0xef68: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xef6c: 10 20 83 e5 str r2, [ r3, # + 0x10 ]
0xef70: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xef74: 1c 20 83 e2 add r2, r3, #0x1c, 0x0
0xef78: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xef7c: 0c 30 93 e5 ldr r3, [ r3, # + 0xc ]
0xef80: 03 10 82 e0 add r1, r2, r3, lsl #0x0
0xef84: 08 30 1b e5 ldr r3, [ fp, # – 0x8 ]
0xef88: 86 2f 4b e2 sub r2, fp, #0x86, 0xf
0xef8c: 01 00 a0 e1 mov r0, r1, lsl #0x0
0xef90: 02 10 a0 e1 mov r1, r2, lsl #0x0
0xef94: 03 20 a0 e1 mov r2, r3, lsl #0x0
0xef98: b2 e6 ff eb bl 0x8a68
0xef9c: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xefa0: 0c 20 93 e5 ldr r2, [ r3, # + 0xc ]
0xefa4: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xefa8: 10 30 93 e5 ldr r3, [ r3, # + 0x10 ]
0xefac: 03 30 82 e0 add r3, r2, r3, lsl #0x0
0xefb0: 1c 20 83 e2 add r2, r3, #0x1c, 0x0
0xefb4: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xefb8: 00 20 83 e5 str r2, [ r3, # + 0x0 ]
0xefbc: 0c 00 1b e5 ldr r0, [ fp, # – 0xc ]
0xefc0: 64 e7 ff eb bl 0x8d58
0xefc4: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xefc8: 00 30 93 e5 ldr r3, [ r3, # + 0x0 ]
0xefcc: 14 00 1b e5 ldr r0, [ fp, # – 0x14 ]
0xefd0: 0c 10 1b e5 ldr r1, [ fp, # – 0xc ]
0xefd4: 03 20 a0 e1 mov r2, r3, lsl #0x0
0xefd8: c3 e6 ff eb bl 0x8aec
0xefdc: 00 30 a0 e1 mov r3, r0, lsl #0x0
0xefe0: 18 30 0b e5 str r3, [ fp, # – 0x18 ]
0xefe4: 18 30 1b e5 ldr r3, [ fp, # – 0x18 ]
0xefe8: 00 00 53 e3 cmp r3, #0x0, 0x0
0xefec: 07 00 00 aa bge 0xf010
0xeff0: d0 21 9f e5 ldr r2, [ pc, # + 0x1d0 ]
0xeff4: 94 31 9f e5 ldr r3, [ pc, # + 0x194 ]
0xeff8: 00 30 93 e5 ldr r3, [ r3, # + 0x0 ]
0xeffc: 02 00 a0 e1 mov r0, r2, lsl #0x0
0xf000: 01 10 a0 e3 mov r1, #0x1, 0x0
0xf004: 18 20 a0 e3 mov r2, #0x18, 0x0
0xf008: f3 e6 ff eb bl 0x8bdc
0xf00c: 52 00 00 ea b 0xf15c
0xf010: 78 31 9f e5 ldr r3, [ pc, # + 0x178 ]
0xf014: 00 10 93 e5 ldr r1, [ r3, # + 0x0 ]
0xf018: ac 21 9f e5 ldr r2, [ pc, # + 0x1ac ]
0xf01c: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xf020: 1c 00 83 e2 add r0, r3, #0x1c, 0x0
0xf024: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xf028: 0c 30 93 e5 ldr r3, [ r3, # + 0xc ]
0xf02c: 03 30 80 e0 add r3, r0, r3, lsl #0x0
0xf030: 01 00 a0 e1 mov r0, r1, lsl #0x0
0xf034: 02 10 a0 e1 mov r1, r2, lsl #0x0
0xf038: 03 20 a0 e1 mov r2, r3, lsl #0x0
0xf03c: b0 e6 ff eb bl 0x8b04
0xf040: 0c 00 1b e5 ldr r0, [ fp, # – 0xc ]
0xf044: 00 10 a0 e3 mov r1, #0x0, 0x0
0xf048: 87 2f a0 e3 mov r2, #0x87, 0xf
0xf04c: d0 e6 ff eb bl 0x8b94
0xf050: 14 00 1b e5 ldr r0, [ fp, # – 0x14 ]
0xf054: 0c 10 1b e5 ldr r1, [ fp, # – 0xc ]
0xf058: 87 2f a0 e3 mov r2, #0x87, 0xf
0xf05c: a5 e6 ff eb bl 0x8af8
0xf060: 00 30 a0 e1 mov r3, r0, lsl #0x0
0xf064: 18 30 0b e5 str r3, [ fp, # – 0x18 ]
0xf068: 18 30 1b e5 ldr r3, [ fp, # – 0x18 ]
0xf06c: 00 00 53 e3 cmp r3, #0x0, 0x0
0xf070: 07 00 00 ca bgt 0xf094
0xf074: 54 21 9f e5 ldr r2, [ pc, # + 0x154 ]
0xf078: 10 31 9f e5 ldr r3, [ pc, # + 0x110 ]
0xf07c: 00 30 93 e5 ldr r3, [ r3, # + 0x0 ]
0xf080: 02 00 a0 e1 mov r0, r2, lsl #0x0
0xf084: 01 10 a0 e3 mov r1, #0x1, 0x0
0xf088: 19 20 a0 e3 mov r2, #0x19, 0x0
0xf08c: d2 e6 ff eb bl 0x8bdc
0xf090: 31 00 00 ea b 0xf15c
0xf094: f4 30 9f e5 ldr r3, [ pc, # + 0xf4 ]
0xf098: 00 10 93 e5 ldr r1, [ r3, # + 0x0 ]
0xf09c: 30 21 9f e5 ldr r2, [ pc, # + 0x130 ]
0xf0a0: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xf0a4: 08 30 93 e5 ldr r3, [ r3, # + 0x8 ]
0xf0a8: 01 00 a0 e1 mov r0, r1, lsl #0x0
0xf0ac: 02 10 a0 e1 mov r1, r2, lsl #0x0
0xf0b0: 18 20 1b e5 ldr r2, [ fp, # – 0x18 ]
0xf0b4: 92 e6 ff eb bl 0x8b04
0xf0b8: d0 30 9f e5 ldr r3, [ pc, # + 0xd0 ]
0xf0bc: 00 10 93 e5 ldr r1, [ r3, # + 0x0 ]
0xf0c0: 10 21 9f e5 ldr r2, [ pc, # + 0x110 ]
0xf0c4: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xf0c8: 1c 30 83 e2 add r3, r3, #0x1c, 0x0
0xf0cc: 01 00 a0 e1 mov r0, r1, lsl #0x0
0xf0d0: 02 10 a0 e1 mov r1, r2, lsl #0x0
0xf0d4: 03 20 a0 e1 mov r2, r3, lsl #0x0
0xf0d8: 89 e6 ff eb bl 0x8b04
0xf0dc: f8 00 9f e5 ldr r0, [ pc, # + 0xf8 ]
0xf0e0: 63 e6 ff eb bl 0x8a74
0xf0e4: f4 00 9f e5 ldr r0, [ pc, # + 0xf4 ]
0xf0e8: 61 e6 ff eb bl 0x8a74
0xf0ec: f0 00 9f e5 ldr r0, [ pc, # + 0xf0 ]
0xf0f0: 5f e6 ff eb bl 0x8a74
0xf0f4: ec 20 9f e5 ldr r2, [ pc, # + 0xec ]
0xf0f8: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xf0fc: 10 30 93 e5 ldr r3, [ r3, # + 0x10 ]
0xf100: 02 00 a0 e1 mov r0, r2, lsl #0x0
0xf104: 03 10 a0 e1 mov r1, r3, lsl #0x0
0xf108: 4a e6 ff eb bl 0x8a38
0xf10c: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xf110: 1c 10 83 e2 add r1, r3, #0x1c, 0x0
0xf114: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xf118: 10 20 93 e5 ldr r2, [ r3, # + 0x10 ]
0xf11c: c8 30 9f e5 ldr r3, [ pc, # + 0xc8 ]
0xf120: 00 30 93 e5 ldr r3, [ r3, # + 0x0 ]
0xf124: 01 00 a0 e1 mov r0, r1, lsl #0x0
0xf128: 01 10 a0 e3 mov r1, #0x1, 0x0
0xf12c: aa e6 ff eb bl 0x8bdc
0xf130: 58 30 9f e5 ldr r3, [ pc, # + 0x58 ]
0xf134: 00 10 93 e5 ldr r1, [ r3, # + 0x0 ]
0xf138: b0 20 9f e5 ldr r2, [ pc, # + 0xb0 ]
0xf13c: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xf140: 1c 30 83 e2 add r3, r3, #0x1c, 0x0
0xf144: 01 00 a0 e1 mov r0, r1, lsl #0x0
0xf148: 02 10 a0 e1 mov r1, r2, lsl #0x0
0xf14c: 03 20 a0 e1 mov r2, r3, lsl #0x0
0xf150: 6b e6 ff eb bl 0x8b04
0xf154: 00 00 00 ea b 0xf15c
0xf158: 25 00 00 eb bl 0xf1f4
0xf15c: 14 30 1b e5 ldr r3, [ fp, # – 0x14 ]
0xf160: 00 00 53 e3 cmp r3, #0x0, 0x0
0xf164: 01 00 00 0a beq 0xf170
0xf168: 14 00 1b e5 ldr r0, [ fp, # – 0x14 ]
0xf16c: 4c e6 ff eb bl 0x8aa4
0xf170: 0c 30 1b e5 ldr r3, [ fp, # – 0xc ]
0xf174: 00 00 53 e3 cmp r3, #0x0, 0x0
0xf178: 01 00 00 0a beq 0xf184
0xf17c: 0c 00 1b e5 ldr r0, [ fp, # – 0xc ]
0xf180: ad e6 ff eb bl 0x8c3c
0xf184: 04 d0 4b e2 sub sp, fp, #0x4, 0x0
0xf188: 00 88 bd e8 ldm ia sp!, 0x8800
0xf18c: 94 f5 00 00
0xf190: 5c 8a 01 00 andeq r8, r1, ip, asr sl
0xf194: a4 f5 00 00 andeq pc, r0, r4, lsr #0xb
0xf198: 30 07 01 00 andeq r0, r1, r0, lsr r7
0xf19c: b4 06 01 00
0xf1a0: c0 06 01 00 andeq r0, r1, r0, asr #0xd
0xf1a4: ff 01 00 00
0xf1a8: 3c 8a 01 00 andeq r8, r1, ip, lsr sl
0xf1ac: b4 f5 00 00
0xf1b0: e4 06 01 00 andeq r0, r1, r4, ror #0xd
0xf1b4: ec 06 01 00 andeq r0, r1, ip, ror #0xd
0xf1b8: 88 f9 00 00 andeq pc, r0, r8, lsl #0x13
0xf1bc: 18 f6 00 00 andeq pc, r0, r8, lsl r6
0xf1c0: 2c f6 00 00 andeq pc, r0, ip, lsr #0xc
0xf1c4: bc f3 00 00
0xf1c8: 78 f6 00 00 andeq pc, r0, r8, ror r6
0xf1cc: a4 f9 00 00 andeq pc, r0, r4, lsr #0x13
0xf1d0: 94 f6 00 00
0xf1d4: 3c f9 00 00 andeq pc, r0, ip, lsr r9
0xf1d8: bc f9 00 00
0xf1dc: 4c fd 00 00 andeq pc, r0, ip, asr #0x1a
0xf1e0: c4 f7 00 00 andeq pc, r0, r4, asr #0xf
0xf1e4: 0c f8 00 00 andeq pc, r0, ip, lsl #0x10
0xf1e8: 28 f8 00 00 andeq pc, r0, r8, lsr #0x10
0xf1ec: 38 8a 01 00 andeq r8, r1, r8, lsr sl
0xf1f0: d4 f9 00 00
; function: Send_InvalidRemoteAddr at 0xf1f4 — 0xf27b
0xf1f4: 10 48 2d e9 stm db sp!, 0x4810
0xf1f8: 08 b0 8d e2 add fp, sp, #0x8, 0x0
0xf1fc: 24 d0 4d e2 sub sp, sp, #0x24, 0x0
0xf200: 64 30 9f e5 ldr r3, [ pc, # + 0x64 ]
0xf204: 28 c0 4b e2 sub ip, fp, #0x28, 0x0
0xf208: 03 e0 a0 e1 mov lr, r3, lsl #0x0
0xf20c: 0f 00 be e8 ldm ia lr!, 0xf
0xf210: 0f 00 ac e8 stm ia ip!, 0xf
0xf214: 07 00 9e e8 ldm ia lr, 0x7
0xf218: 03 00 ac e8 stm ia ip!, 0x3
0xf21c: b0 20 cc e1 strh r2, [ ip, # + 0x0 ]
0xf220: 48 20 9f e5 ldr r2, [ pc, # + 0x48 ]
0xf224: 48 30 9f e5 ldr r3, [ pc, # + 0x48 ]
0xf228: 00 30 93 e5 ldr r3, [ r3, # + 0x0 ]
0xf22c: 02 00 a0 e1 mov r0, r2, lsl #0x0
0xf230: 01 10 a0 e3 mov r1, #0x1, 0x0
0xf234: 19 20 a0 e3 mov r2, #0x19, 0x0
0xf238: 67 e6 ff eb bl 0x8bdc
0xf23c: 34 40 9f e5 ldr r4, [ pc, # + 0x34 ]
0xf240: 28 30 4b e2 sub r3, fp, #0x28, 0x0
0xf244: 03 00 a0 e1 mov r0, r3, lsl #0x0
0xf248: 6c e6 ff eb bl 0x8c00
0xf24c: 00 20 a0 e1 mov r2, r0, lsl #0x0
0xf250: 28 30 4b e2 sub r3, fp, #0x28, 0x0
0xf254: 04 00 a0 e1 mov r0, r4, lsl #0x0
0xf258: 02 10 a0 e1 mov r1, r2, lsl #0x0
0xf25c: 03 20 a0 e1 mov r2, r3, lsl #0x0
0xf260: f4 e5 ff eb bl 0x8a38
0xf264: 08 d0 4b e2 sub sp, fp, #0x8, 0x0
0xf268: 10 88 bd e8 ldm ia sp!, 0x8810
0xf26c: 14 07 01 00 andeq r0, r1, r4, lsl r7
0xf270: f8 06 01 00
0xf274: 5c 8a 01 00 andeq r8, r1, ip, asr sl
0xf278: 48 06 01 00 andeq r0, r1, r8, asr #0xc
; section: .fini
; function: _fini at 0xf27c — 0xf28b
0xf27c: 0d c0 a0 e1 mov ip, sp, lsl #0x0
0xf280: f0 df 2d e9 stm db sp!, 0xdff0
0xf284: 04 b0 4c e2 sub fp, ip, #0x4, 0x0
0xf288: f0 af 1b e9 ldm db fp, 0xaff0
Hello Thomas,
My sitecom camera can rotate, do you have any idea of the payload i should use to do that ? How can i proceed to find the payload ? I have made a java application that streams the camera output, the app allows to enable / disable ir led. I will put it on my git soon.
Regards,
For the rotate you can only flip the image vertically:
POST to:
http://CAMIP/CGI/CameraSetup
then add raw body:
ON
btw you can set almost any value you get from the /CGI/CameraSetting result in the same way:
2018
3
3
13
8
ON
50HZ
1356
HD30
OFF
OFF
OFF
OFF
OFF
OFF
OFF
OFF
OFF
OFF
VIDEO
PHOTO
OFF
OFF
C
50
0
OFF
OFF
EN,DE,FR,IT,ES,PT,ZHS,ZHT,JP,KO,RU
ZHT
ON
3
OFF
3
WVGA
1Mbps
1
5
50
30
AUTO
OFF
OFF
+1
ntp0.fau.de
0
OFF
0.000000
0.000000
BLACK
1X
1
</Id
Hello Thomas, thanks for the informations that you provides. Since the end of january it is not possible to use both android or iOS application to communicate with sitecom cameras. The sitecom company is on bankruptcy.
I’m developping an application to manage the camera. Do you have any idea of the payload to use for pairing the camera with a given endpoint?
Thanks for your help.
Hi there, Yes, I know, I have 3 useless cameras hanging as decoration at the moment :(… I meant to do a writeup but didn’t get round to doing it yet.
Your project sounds great!
I’ll try and list some more information I have left out of this article (I have some setup urls etc..) tomorrow.
Hi Thomas,
I did also buy the cam via iBOOD, EUR 39 so not too bad.
I want to disable the infrared LEDs but I am not a developer; what is the easy way to perform that http POST command to get the LEDs off?
Is that something that I can do with CURL maybe? any tips on the syntax?
I have to say that with your article the camera gets even better value for money, thanks!
Duncan
If you have Google Chrome you can install postman, you can type in the url there and add the raw post data (the xml string), remember when you turn off the leds the night vision won’t work.
https://chrome.google.com/webstore/detail/postman/fhbjgbiflinjbdggehcddcbncdddomop
Thanks.
I managed to change the IR setting using https://itunes.apple.com/us/app/httpbot-http-rest-client/id1232603544 but it does behave a bit different than I had expected (or maybe hoped for); the “IR_LED=OFF” feature seems to not switch the IR LED off but does switch the camera IR sensor off.
The IR LEDs however stay on and as these also give a bit of visible red light this prevents the camera to be used behind a window as the glass will still reflect this light a bit.
I am curious if it is actually possible to disable the IR LEDs via software, or if this requires a hardware modification (or black tape of course, but that isn’t that sophisticated).
How did you figure out these API commands by the way? Are there more (yet unknown) commands?
Duncan
Hi Duncan, I just tried this, in my case the IR Leds really turn off, only the blue light stays on (that one needs a bit of tape, unfortunately there is no way to disable it)
Try it with postman in google chrome, see if you get a better result (turning them on and off will make a noise as well)
The post url:
http://CAMIP/CGI/CameraSetup
Set body to raw:
AUTO
The response should look like:
OK
screenshot: https://uploads.disquscdn.com/images/e9b685dc43ae08cec2a4a2fb5da92fd0c763d5811923f2d4a9cba236848f8909.png
I figured out the commands because when you enter a specific url to a file on your cam that doesn’t exist for some reason it spits out a piece of their firmware and that contains API endpoints if you look between the unreadable data 😛