Equipment/Webcams/EasyN FS-618A-M136
EasyN IPCam
Model FS-618A-M136, ordered from Ebay (with a free NETWOKR CABLE)Ebay.
Seriously shonky, it spews out a repeating half-second beep on harmonics of 16.072MHz, including 144.648MHz. This starts about 10 seconds after boot, and is probably due to a TCO-745V or similar.
Network
IP: 172.31.24.122
To stream, request /image.jpg repeatedly.
For commands, request /cmmd=%s, where %s is:
52 username=? 50 ? (disconnects) 3207???????? set DDNS IP 3206???????? set IP ? 3205???????? set DNS 2 (C0A80001) 3204???????? set DNS 1 (C0A80001) 3203???????? set subnet mask (FFFFFF00) 3202???????? set gateway (C0A80001) 3201???????? set IP (C0A80064) 320000 DHCP off 3200?? DHCP on 31?? ? (0-0xf) (v. slow if set high) 30?? causes it to sleep for a proportionate time 290405 tilt scan 290404 pan scan 290403 pan & tilt scan? 290402 also tilt scan? 290401 also pan scan? 290400 stop 2903?? also centre? 290301 centre 290004 tilt down 290003 tilt up 290002 pan left 290001 pan right 28 state info 26 ? (disconnects) 25 ? (returns a value) 2401 cold reboot? 2201 flip on 22?? flip off 2101 mirror on 21?? mirror off (not a flag in state) 2005 gamma? high 2003 gamma? med 2001 gamma? low Also increases quality by 0x10 until it's above 0x3a: 1F01 60Hz 1F?? 50Hz 1E01 outdoor on 1E?? outdoor off 1D01 night on 1D?? night off 1C02 reboot (reset cam software?) 1C01 warm reboot 1802 res high (640x480) 1801 res med (320x240) 1800 res low (160x120) 1701 ? 1700 ? 13?? qual 13E0 qual lowest (14kB for 640x480) 1389 qual v. low 1359 qual std 1339 qual v. high 1329 qual highest (60kB for 640x480) 12 qual higher by 0x10 11 qual std (0x59) 10 qual lower by 0x10
Known URLs
- /
- /viwx\..* (viwx.html)
- /pant\..* (pant.html)
- /image.* (image.jpg)
- /cgi-bin.*
- /cmmd
HTTP version is ignored for all except /.
/image and /cmmd return the following headers:
HTTP/1.1 200 OK Content-Type: image/jpeg Server: vid=smarteye username=002agfq&userpwd=12764977 alarm=11111111 status=00000000 pksize=0900 uiv3.4 Cache-control: no-cache
State info
All values are big-endian:
0000 | uint32_t | "uiv2" |
0004 | uint8_t | Major version (0x34 for version 34) |
0005 | uint8_t | Minor version |
0006 | uint16_t | Reserved/extra version? |
0008 | uint8_t[6] | MAC address |
000e | uint16_t | HTTP port (0x50) |
0010 | uint32_t | IP address (0xc0a80064) |
0010 | uint32_t | Default gateway address (0xc0a80001) |
0018 | uint32_t | Subnet mask (0xffffff00) |
001c | uint32_t | DNS 1 (0xc0a80001) |
0020 | uint32_t | DNS 2 |
0024 | uint32_t | IP ? |
0028 | uint32_t | IP of DDNS server |
... | ||
002f | uint8_t | ?
0x01-0x0f ? (310?) |
0030 | uint16_t | Reserved? |
0032 | uint8_t | Flags
0x40 mirror 0x80 flip |
0033 | uint8_t | Compression level (0x00 for highest quality) |
0034 | uint8_t | ? |
0035 | uint8_t | Flags:
0x08 night 0x10 60Hz 0x20 outdoor 0x40 res 320x240 0x80 res 640x480 |
0036 | uint8_t | Flags:
0x01 ? 0x02 ? 0x80 DHCP |
0037 | uint8_t | ? |
0038 | uint8_t[6] | ? |
UDP control
The state info is also returned from UDP broadcast of "uicam query\0" on port 10139.
The camera responds 520 bytes (512, assuming the first 8 bytes are separate), starting with "uiv2". The state info is followed by the DDNS update details: host, "\0\0", data to send (i.e. an HTTP request without the HTTP version).
You can change any settings in one go by returning uisp (set params?) in place of uiv2. The webcam replies with oksp "OK", followed uibo "Booting". Only the uiv2 response populates the version field.
At boot:
0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50 uiv24....`nQfC.P 0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01 ...z............ 0000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 71 6e 01 .............qn. 0000030: 00 00 c8 59 36 89 83 00 00 00 00 00 00 00 ...Y6.........
Later:
0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50 uiv24....`nQfC.P 0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01 ...z............ 0000020: 00 00 00 00 00 00 00 00 3a 3d 26 b1 00 71 6e 01 ........:=&..qn. 0000030: 00 00 c8 4a 36 89 83 00 00 00 00 00 00 00 ...J6.........
0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50 uiv24....`nQfC.P 0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01 ...z............ 0000020: 00 00 00 00 00 00 00 00 3a 3d 26 b1 00 73 56 01 ........:=&..sV. 0000030: 00 00 c8 29 36 89 83 00 00 00 00 00 00 00 ...)6.........
After a reboot:
0000000: 75 69 76 32 34 00 00 00 00 60 6e 51 66 43 00 50 uiv24....`nQfC.P 0000010: ac 1f 18 7a ac 1f 18 01 ff ff fe 00 ac 1f 18 01 ...z............ 0000020: 00 00 00 00 00 00 00 00 3a 3d 26 b1 00 73 d0 01 ........:=&..s.. 0000030: 00 00 c8 39 36 89 83 00 00 00 00 00 00 00 ...96.........