Equipment/Webcams/EasyN FS-618A-M136

From London Hackspace Wiki
Jump to: navigation, search

EasyN IPCam

Model FS-618A-M136, ordered from Ebay (with a free NETWOKR CABLE)Ebay.

Seriously shonky, it spews out a repeating half-second beep on harmonics of 16.072MHz, including 144.648MHz. This starts about 10 seconds after boot, and is probably due to a TCO-745V or similar.

Network

IP: 172.31.24.122

To stream, request /image.jpg repeatedly.

For commands, request /cmmd=%s, where %s is:

52 username=?
50 ? (disconnects)

3207???????? set DDNS IP
3206???????? set IP ?
3205???????? set DNS 2 (C0A80001)
3204???????? set DNS 1 (C0A80001)
3203???????? set subnet mask (FFFFFF00)
3202???????? set gateway (C0A80001)
3201???????? set IP (C0A80064)
320000 DHCP off
3200?? DHCP on

31?? ? (0-0xf) (v. slow if set high)

30?? causes it to sleep for a proportionate time

290405 tilt scan
290404 pan scan
290403 pan & tilt scan?
290402 also tilt scan?
290401 also pan scan?
290400 stop

2903?? also centre?
290301 centre

290004 tilt down
290003 tilt up
290002 pan left
290001 pan right

28 state info

26 ? (disconnects)
25 ? (returns a value)

2401 cold reboot?

2201 flip on
22?? flip off

2101 mirror on
21?? mirror off

(not a flag in state)
2005 gamma? high
2003 gamma? med
2001 gamma? low

Also increases quality by 0x10 until it's above 0x3a:
1F01 60Hz
1F?? 50Hz

1E01 outdoor on
1E?? outdoor off

1D01 night on
1D?? night off

1C02 reboot (reset cam software?)
1C01 warm reboot

1802 res high (640x480)
1801 res med (320x240)
1800 res low (160x120)

1701 ?
1700 ?

13?? qual
13E0 qual lowest (14kB for 640x480)
1389 qual v. low
1359 qual std
1339 qual v. high
1329 qual highest (60kB for 640x480)

12 qual higher by 0x10
11 qual std (0x59)
10 qual lower by 0x10


Known URLs

  • /
  • /viwx\..* (viwx.html)
  • /pant\..* (pant.html)
  • /image.* (image.jpg)
  • /cgi-bin.*
  • /cmmd

HTTP version is ignored for all except /.

/image and /cmmd return the following headers:

HTTP/1.1 200 OK
Content-Type: image/jpeg
Server: vid=smarteye      username=002agfq&userpwd=12764977          alarm=11111111 status=00000000 pksize=0900 uiv3.4
Cache-control: no-cache

State info

All values are big-endian:

0000 uint32_t "uiv2"
0004 uint8_t Major version (0x34 for version 34)
0005 uint8_t Minor version
0006 uint16_t Reserved/extra version?
0008 uint8_t[6] MAC address
000e uint16_t HTTP port (0x50)
0010 uint32_t IP address (0xc0a80064)
0010 uint32_t Default gateway address (0xc0a80001)
0018 uint32_t Subnet mask (0xffffff00)
001c uint32_t DNS 1 (0xc0a80001)
0020 uint32_t DNS 2
0024 uint32_t IP ?
0028 uint32_t IP of DDNS server
...
002f uint8_t  ?
0x01-0x0f ? (310?)
0030 uint16_t Reserved?
0032 uint8_t Flags
0x40 mirror
0x80 flip
0033 uint8_t Compression level (0x00 for highest quality)
0034 uint8_t  ?
0035 uint8_t Flags:
0x08 night
0x10 60Hz
0x20 outdoor
0x40 res 320x240
0x80 res 640x480
0036 uint8_t Flags:
0x01 ?
0x02 ?
0x80 DHCP
0037 uint8_t  ?
0038 uint8_t[6]  ?


UDP control

The state info is also returned from UDP broadcast of "uicam query\0" on port 10139.

The camera responds 520 bytes (512, assuming the first 8 bytes are separate), starting with "uiv2". The state info is followed by the DDNS update details: host, "\0\0", data to send (i.e. an HTTP request without the HTTP version).

You can change any settings in one go by returning uisp (set params?) in place of uiv2. The webcam replies with oksp "OK", followed uibo "Booting". Only the uiv2 response populates the version field.


At boot:

0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50  uiv24....`nQfC.P
0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01  ...z............
0000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 71 6e 01  .............qn.
0000030: 00 00 c8 59 36 89 83 00 00 00 00 00 00 00        ...Y6.........

Later:

0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50  uiv24....`nQfC.P
0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01  ...z............
0000020: 00 00 00 00 00 00 00 00 3a 3d 26 b1 00 71 6e 01  ........:=&..qn.
0000030: 00 00 c8 4a 36 89 83 00 00 00 00 00 00 00        ...J6.........
0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50  uiv24....`nQfC.P
0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01  ...z............
0000020: 00 00 00 00 00 00 00 00 3a 3d 26 b1 00 73 56 01  ........:=&..sV.
0000030: 00 00 c8 29 36 89 83 00 00 00 00 00 00 00        ...)6.........

After a reboot:

0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50  uiv24....`nQfC.P
0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01  ...z............
0000020: 00 00 00 00 00 00 00 00 3a 3d 26 b1 00 73 d0 01  ........:=&..s..
0000030: 00 00 c8 39 36 89 83 00 00 00 00 00 00 00        ...96.........