Equipment/Webcams/EasyN FS-618A-M136

EasyN IPCam

Model FS-618A-M136, ordered from Ebay (with a free NETWOKR CABLE)Ebay.

Seriously shonky, it spews out a repeating half-second beep on harmonics of 16.072MHz, including 144.648MHz. This starts about 10 seconds after boot, and is probably due to a TCO-745V or similar.

Network

IP: 172.31.24.122

To stream, request /image.jpg repeatedly.

For commands, request /cmmd=%s, where %s is:

52 username=?
50 ? (disconnects)

3207???????? set DDNS IP
3206???????? set IP ?
3205???????? set DNS 2 (C0A80001)
3204???????? set DNS 1 (C0A80001)
3203???????? set subnet mask (FFFFFF00)
3202???????? set gateway (C0A80001)
3201???????? set IP (C0A80064)
320000 DHCP off
3200?? DHCP on

31?? ? (0-0xf) (v. slow if set high)

30?? causes it to sleep for a proportionate time

290405 tilt scan
290404 pan scan
290403 pan & tilt scan?
290402 also tilt scan?
290401 also pan scan?
290400 stop

2903?? also centre?
290301 centre

290004 tilt down
290003 tilt up
290002 pan left
290001 pan right

28 state info

26 ? (disconnects)
25 ? (returns a value)

2401 cold reboot?

2201 flip on
22?? flip off

2101 mirror on
21?? mirror off

(not a flag in state)
2005 gamma? high
2003 gamma? med
2001 gamma? low

Also increases quality by 0x10 until it's above 0x3a:
1F01 60Hz
1F?? 50Hz

1E01 outdoor on
1E?? outdoor off

1D01 night on
1D?? night off

1C02 reboot (reset cam software?)
1C01 warm reboot

1802 res high (640x480)
1801 res med (320x240)
1800 res low (160x120)

1701 ?
1700 ?

13?? qual
13E0 qual lowest (14kB for 640x480)
1389 qual v. low
1359 qual std
1339 qual v. high
1329 qual highest (60kB for 640x480)

12 qual higher by 0x10
11 qual std (0x59)
10 qual lower by 0x10

Known URLs

• /
• /viwx\..* (viwx.html)
• /pant\..* (pant.html)
• /image.* (image.jpg)
• /cgi-bin.*
• /cmmd

HTTP version is ignored for all except /.

/image and /cmmd return the following headers:

HTTP/1.1 200 OK
Content-Type: image/jpeg
Server: vid=smarteye      username=002agfq&userpwd=12764977          alarm=11111111 status=00000000 pksize=0900 uiv3.4
Cache-control: no-cache

State info

All values are big-endian:

0000	uint32_t	"uiv2"
0004	uint8_t	Major version (0x34 for version 34)
0005	uint8_t	Minor version
0006	uint16_t	Reserved/extra version?
0008	uint8_t[6]	MAC address
000e	uint16_t	HTTP port (0x50)
0010	uint32_t	IP address (0xc0a80064)
0010	uint32_t	Default gateway address (0xc0a80001)
0018	uint32_t	Subnet mask (0xffffff00)
001c	uint32_t	DNS 1 (0xc0a80001)
0020	uint32_t	DNS 2
0024	uint32_t	IP ?
0028	uint32_t	IP of DDNS server
...
002f	uint8_t	? 0x01-0x0f ? (310?)
0030	uint16_t	Reserved?
0032	uint8_t	Flags 0x40 mirror 0x80 flip
0033	uint8_t	Compression level (0x00 for highest quality)
0034	uint8_t	?
0035	uint8_t	Flags: 0x08 night 0x10 60Hz 0x20 outdoor 0x40 res 320x240 0x80 res 640x480
0036	uint8_t	Flags: 0x01 ? 0x02 ? 0x80 DHCP
0037	uint8_t	?
0038	uint8_t[6]	?

UDP control

The state info is also returned from UDP broadcast of "uicam query\0" on port 10139.

The camera responds 520 bytes (512, assuming the first 8 bytes are separate), starting with "uiv2". The state info is followed by the DDNS update details: host, "\0\0", data to send (i.e. an HTTP request without the HTTP version).

You can change any settings in one go by returning uisp (set params?) in place of uiv2. The webcam replies with oksp "OK", followed uibo "Booting". Only the uiv2 response populates the version field.

At boot:

0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50  uiv24....`nQfC.P
0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01  ...z............
0000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 71 6e 01  .............qn.
0000030: 00 00 c8 59 36 89 83 00 00 00 00 00 00 00        ...Y6.........

Later:

0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50  uiv24....`nQfC.P
0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01  ...z............
0000020: 00 00 00 00 00 00 00 00 3a 3d 26 b1 00 71 6e 01  ........:=&..qn.
0000030: 00 00 c8 4a 36 89 83 00 00 00 00 00 00 00        ...J6.........

0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50  uiv24....`nQfC.P
0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01  ...z............
0000020: 00 00 00 00 00 00 00 00 3a 3d 26 b1 00 73 56 01  ........:=&..sV.
0000030: 00 00 c8 29 36 89 83 00 00 00 00 00 00 00        ...)6.........

After a reboot:

0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50  uiv24....`nQfC.P
0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01  ...z............
0000020: 00 00 00 00 00 00 00 00 3a 3d 26 b1 00 73 d0 01  ........:=&..s..
0000030: 00 00 c8 39 36 89 83 00 00 00 00 00 00 00        ...96.........