Maygion IPCamera - ZM Crashing

bristoldave · Post by **bristoldave** » Mon Nov 23, 2009 10:05 am

I have started this thread to post my findings with the Maygion IP Camera and hope that with help from others I can get this camera working.

The camera appears to be a clone of a Foscam FI8908, though it has a different firmware and I'm told that if I flash it with the Foscam firmware it's likely to brick it.

It has pan/tilt and appears to support either MJPEG or some sort of stream (though the seller I bought it off on eBay said MJPEG, I'm not sure I can trust this info) as well as still JPEGs.

I can't find the URL for MJPEG but after some analysis of the camera's own webpage the still JPEGs can be pulled off using http://x.x.x.x/snap.jpg?usr=admin&pwd=admin.

The problem I am having (also reported by sfpeter here) is that when I use this in ZoneMinder, it crashes quite regularly with:

Code: Select all

11/23/09 09:02:35.137393 zmc_m1[17575].DB3-zm_remote_camera.cpp/739 [Got status '200' (OK), http version 1.1]
11/23/09 09:02:35.137406 zmc_m1[17575].DB3-zm_remote_camera.cpp/752 [Got content length '41793']
11/23/09 09:02:35.137419 zmc_m1[17575].DB3-zm_remote_camera.cpp/780 [Got content type 'image/jpeg']
11/23/09 09:02:35.151553 zmc_m1[17575].DB3-zm_remote_camera.cpp/225 [Expecting 31856 bytes]
11/23/09 09:02:35.151705 zmc_m1[17575].DB3-zm_remote_camera.cpp/250 [Read 31856 bytes]
11/23/09 09:02:35.151969 zmc_m1[17575].DB3-zm_remote_camera.cpp/225 [Expecting 2896 bytes]
11/23/09 09:02:35.151999 zmc_m1[17575].DB3-zm_remote_camera.cpp/250 [Read 2896 bytes]
11/23/09 09:02:35.153373 zmc_m1[17575].DB3-zm_remote_camera.cpp/225 [Expecting 1448 bytes]
11/23/09 09:02:35.153423 zmc_m1[17575].DB3-zm_remote_camera.cpp/250 [Read 1448 bytes]
11/23/09 09:02:35.153550 zmc_m1[17575].DB3-zm_remote_camera.cpp/225 [Expecting 1448 bytes]
11/23/09 09:02:35.153570 zmc_m1[17575].DB3-zm_remote_camera.cpp/250 [Read 1448 bytes]
11/23/09 09:02:35.155245 zmc_m1[17575].DB3-zm_remote_camera.cpp/225 [Expecting 1448 bytes]
11/23/09 09:02:35.155305 zmc_m1[17575].DB3-zm_remote_camera.cpp/250 [Read 1448 bytes]
11/23/09 09:02:35.155641 zmc_m1[17575].DB3-zm_remote_camera.cpp/225 [Expecting 1448 bytes]
11/23/09 09:02:35.155670 zmc_m1[17575].DB3-zm_remote_camera.cpp/250 [Read 1448 bytes]
11/23/09 09:02:35.156174 zmc_m1[17575].DB3-zm_remote_camera.cpp/225 [Expecting 660 bytes]
11/23/09 09:02:35.156214 zmc_m1[17575].DB3-zm_remote_camera.cpp/250 [Read 660 bytes]
11/23/09 09:02:35.156230 zmc_m1[17575].DB3-zm_remote_camera.cpp/990 [Got end of image by length, content-length = 41793]
11/23/09 09:02:35.156274 zmc_m1[17575].DB3-zm_remote_camera.cpp/1057 [Returning 41793 (41793) bytes of captured content]
11/23/09 09:02:35.625003 zmc_m1[17575].DB3-zm_remote_camera.cpp/159 [Connected to host, socket = 3]
11/23/09 09:02:35.625065 zmc_m1[17575].DB3-zm_remote_camera.cpp/180 [Request sent]
11/23/09 09:02:35.634349 zmc_m1[17575].DB3-zm_remote_camera.cpp/220 [Socket closed]
11/23/09 09:02:35.634431 zmc_m1[17575].DB6-zm_remote_camera.cpp/667 []
11/23/09 09:02:35.634447 zmc_m1[17575].DB3-zm_remote_camera.cpp/828 [Unable to extract entire header from stream, continuing]
11/23/09 09:02:35.634542 zmc_m1[17575].ERR-zm_signal.cpp/77 [Got signal (Segmentation fault), crashing]

ZM will then restart, grab a few more images, and then crash again.

sfpeter claimed in the other thread that he did not have this problem in 1.22 but does have it in 1.24.2 - I was experiencing the problem in 1.24.2 so downgraded to 1.23.3 but am still experiencing the problem here. Is there anything that has changed between 1.22 and 1.23 that could cause this?

I've also noticed two things:

1) When ZM connects to the camera to grab the image, the HTTP Connection is "Keep-Alive":

Code: Select all

11/23/09 09:02:34.480394 zmc_m1[17575].DB2-zm_remote_camera.cpp/124 [Request: GET /snap.jpg?usr=admin&pwd=admin HTTP/1.1^M
User-Agent: ZoneMinder/1.23.3^M
Host: 192.168.2.103^M
Connection: Keep-Alive^M

Should it be? Is there any way to change this?

2) When connecting to the camera's webpage (at http://x.x.x.x) it displays the stream using an OCX control (which is why I can't get the URL for the MJPEG stream, even if I try to sniff for the request using Wireshark) but it also has a Javascript page for non-IE browsers that pulls the snap.jpg file continuously in an attempt to display a "stream".

There are a couple of interesting points about this page: It's able to continuously pull images down without any errors, and more importantly, it adds an extra parameter to the JPEG image of "uniq" which is a value that changes each time and is generated by using a Javascript Math.Random(); function.

I can only assume from this that the camera has some sort of "protection" (?) to stop you pulling the same URL from it constantly. There must be a reason the camera's javascript-based webpage changes the URL it requests each time by use of the "uniq" parameter.

I can't see how this can be replicated in zoneminder, unless I write a bash script to wget the image and use a similar random number feature. This is going to be my next port of call.

However using the MJPEG stream would be better. I have mailed the contact at http://www.maygion.com about how to get it (since I've read on other forums they're planning on releasing an SDK soon) but I haven't had a reply yet.

bristoldave · Post by **bristoldave** » Mon Nov 23, 2009 11:49 am

Update:

I think this thread is related:

http://www.zoneminder.com/forums/viewtopic.php?t=13340

johnnytolengo · Post by **johnnytolengo** » Mon Nov 23, 2009 9:37 pm

I had some similar problem some time ago with an IP camera a the thing was that the configuration inside the camera eg.640x480 was not real so firstly try to open the real stream eg. cgi/image.mjpg on firefox and stop the it to get a photo then press F12 with buzilla and use the tool to check the size of the image in my case was 640x483 then I puted this size and the camera worked, stupid firmware

so be carefull with the pic. sizes.

Regards.

J.

bristoldave · Post by **bristoldave** » Mon Nov 23, 2009 10:11 pm

Thanks for the tip Johnny, I'll check it out.

Update: Image is definitely 640x480. Thanks for the advice though.

bristoldave · Post by **bristoldave** » Tue Nov 24, 2009 12:15 pm

Further research:

It definitely seems to be using HTTP rather than another protocol like RTSP.

However, the port seems to randomly change quite a lot which could be problematic, although I do wonder whether that's the client OCX doing that rather than the camera.

Below is one packet I've captured with wireshark - the <i>MayGionCmd V0100 HTTP/1.1</i> looks interesting but I still can't find out what URL it's calling from the camera to get the stream.

Code: Select all

0000  00 09 09 00 02 e8 00 16  17 21 00 8e 08 00 45 00   ........ .!....E.
0010  00 46 f3 02 40 00 80 06  81 91 c0 a8 02 66 c0 a8   .F..@... .....f..
0020  02 67 0a f4 00 50 e3 67  76 83 cf 09 be 27 50 18   .g...P.g v....'P.
0030  ff ff 1c 80 00 00 4d 61  79 47 69 6f 6e 43 6d 64   ......Ma yGionCmd
0040  56 30 31 30 30 20 48 54  54 50 2f 31 2e 31 0d 0a   V0100 HT TP/1.1..
0050  43 54 0d 0a                                        CT..

I might have to look at decompiling the OCX!

bristoldave · Post by **bristoldave** » Thu Nov 26, 2009 10:32 am

Further progress:

I've found that if you try and call a non-existent cgi script (for example test.cgi) from the camera you get an error:

Code: Select all

unknown cgi cmd:[test.cgi]

However, if I try and call videostream.cgi as some other cameras require, I get a blank page. If I wget it from the command line, even sending the standard "?usr=admin&pwd=admin" options with it, it returns 0 bytes. But it doesn't return the error message!

This to me suggests that the videostream.cgi script exists on the camera, although maybe it's not sending the stream as it should.

Either this page is implemented but not supported, or I need to send a vital command to it to start sending the data and I'm not.

Still no mail from the Maygion manufacturers.

mitch · Post by **mitch** » Thu Nov 26, 2009 8:32 pm

your packet capture should really contain everything you need. Just look at the first request that gets sent out when you go to view the feed if its following the http standard it will say Get /whatever.whatever?params HTTP 1/1 etc make sure you look at what you are sending the server, not what the server is sending you.

bristoldave · Post by **bristoldave** » Sun Nov 29, 2009 2:12 am

A further update: applying the fix here didn't solve the problem - I think the main issue is that the Maygion camera is occasionally sending zero-length JPEGs and zoneminder doesn't really know what to do with them, even after the fix is applied. I thin k this may be why the javascript page on the Maygion camera sends a "uniq" value with each jpeg request, maybe the camera has some sort of built-in DoS filtering? If so I'd rather like to be able to switch it off!

However, I mailed the address on the Maygion website about how to access MJPEG streams (which I'm convinced would make ZM a lot easier) and got this in reply:

hi,Dave:
I'm writing CGI these days and will finish at this weekend,
I'll publish it on www.maygion.com and send a copy to you.

--
XiongWanPing(ç†Šä¸‡å¹³)
Professional IPCamera(MJPG,MPEG4,H.264) Developer & Provider
HomePage:www.MayGion.com
MSN:xwpcom@msn.com
QQ:117620974
TEL:(086)13544178846
Address:ShenZhen,China

Looks promising!

Nepenthes · Post by **Nepenthes** » Thu Dec 10, 2009 9:55 am

Here is my experience with the Maygion IP camera - who knows it may help someone:

* I bought it off ebay thinking it was a Foscam. I knew there were Foscam clones out there, so chose an ebay vendor that displayed a Foscam User interface and box in the auction listing. Still got sent the Maygion so was angry about that!

* Out of the box it is very dangerous. There is a function called 'easy access' which is basically a home cooked DynDNS service that Maygion have implemented, your camera registers it's serial number with Maygion.com and there is a maygion.com/xxxx URL which redirects to your IP. Handy, yes, but IT IS SWITCHED ON BY DEFAULT!!! that means as soon as you get it home and plugged in, it phones home, creates a port-forward on your router via UPnP, and exposes the camera to the Internet with the default credentials of Admin/Admin. I could not believe this, I did some random urls and managed to view many people's camera!

* The MJPEG is only availabe via a dumn OCX plugin for IE. If someone could reverse engineer that, then thanks a lot. I don't have the time. Maybe there will be an update for that.

* Sound seems to lag behind the video by about 5 seconds, but seems quite seneitive and clear.

* The Motion detection is pants. you can define the motion detection area but as far I can tell alarms and emails etc are implemented by a PC connected to the camera running the monitoring software, not the cam itself. But then this is why we have zoneminder, right?

* There is a snap.jpg url provided by the camera. You can grab that with Zoneminder provided you give credentials in the URL. I had BIG troubles with all binaries of Zoneminder. Building from latest sources works though, and was easier than I thought.

* I can get 5 fps using the snap.jpg URL. Resolution is 320 * 240 - this is determined by whatever res you set last time you logged into the camera, there is no URL param as far as I know

* The night vision is awesome, the IR Leds are powerful - you can see them at night time though they glow red, so the camera is not hidded. Colors are a bit crap in the day time though I guess due to a lack of an IR filter

* The provided lens is not very wide angle, but I got a 2.4mm lens off ebay, it's a lot better. Standard 12mm thread fitting.

bristoldave · Post by **bristoldave** » Fri Dec 11, 2009 11:51 pm

Thanks for the very helpful post Nepenthes!

I have a few things to add:

* I've had a look at reverse-engineering the OCX but I'm not experienced enough in that field, especially with assembler.

* I don't think the "uniq" value I mentioned above for snap.jpg is required by the camera. I think it's in the javascript source of the js.asp page just to prevent browser caching of the image.

* Maygion have published a CGI SDK for their camera, which mentions a snapshot.cgi as used by foscams etc. This makes me wonder if there are more similarities between these camera's firmwares than we think. However, this SDK is only for firmware v1.8 which is yet to be posted on maygion's website, which is currently up and down like a whore's knickers. I think the reason for this is the "easy access" Nepenthes mentions.

Nepenthes - did your ZM not crash like I've described above when pulling snap.jpg off the camera? If not, I wonder why not?

Nepenthes · Post by **Nepenthes** » Sun Dec 13, 2009 8:13 pm

Dave - it did crash in a similar way (don't remember the exact reason so can't say 100%) with Ubuntu Koala and binaries from the Ubuntu repo (i.e all installed with apt). I even got fed up and set up a script to wget the image and set up a file monitor on zm. The results of that were poor of course.

At the moment it is ok though - setup is Ubuntu Koala with Apache and Mysql from the repo, and ZM (rev 3000) and ffmpeg from source. Followed this guide:

http://www.zoneminder.com/wiki/index.ph ... ozola-0.7)

This is running with the snap at 320 by 240, and only 5fps. Obviously I would be keen to gain access to the MJPEG stream to get 640by480 and a higher fps, so keep the thread updated with any reverse engineering results.[/url]

bristoldave · Post by **bristoldave** » Mon Dec 14, 2009 12:41 pm

Nepenthes wrote:Dave - it did crash in a similar way (don't remember the exact reason so can't say 100%) with Ubuntu Koala and binaries from the Ubuntu repo (i.e all installed with apt). I even got fed up and set up a script to wget the image and set up a file monitor on zm. The results of that were poor of course.

I tried the same trick, and had exactly the same (very poor!) results. I think it would try to read the file before wget had finished writing to it, so I'd get half an image all the time.

Nepenthes wrote:At the moment it is ok though - setup is Ubuntu Koala with Apache and Mysql from the repo, and ZM (rev 3000) and ffmpeg from source. Followed this guide:

http://www.zoneminder.com/wiki/index.ph ... ozola-0.7)

This is running with the snap at 320 by 240, and only 5fps. Obviously I would be keen to gain access to the MJPEG stream to get 640by480 and a higher fps, so keep the thread updated with any reverse engineering results.

Will do. I'm also running Ubuntu Server Karmic along with Apache/Mysql from the repo, but I have a feeling my rev of ZM is earlier. I might have to download a later rev of ZM to see if this solves the problem. I'd obviously like to run the cam at 640x480 at a higher fps as well, I will wait until Maygion's site comes back up (at the moment it doesn't even appear to have a DNS record which is slightly worrying) and see if the 1.8 firmware is available for test.

If it's not I'll mail the developer whose address I have as they seemed quite helpful, even if a little slow to reply. The SDK I have has a note that welcomes suggestions, so maybe we could request a cgi script like the Foscams have to access the MJPEG stream?

bristoldave · Post by **bristoldave** » Wed Dec 16, 2009 4:24 pm

Update: The Maygion website is back up, but no sign of the 1.8 firmware yet. Hoping it arrives soon!

bristoldave · Post by **bristoldave** » Thu Dec 17, 2009 9:05 am

Further update: The site is now back up with the 1.8 firmware in beta which I have installed.

snapshot.cgi now works but ZM still crashes

I will try updating to the latest trunk of zm.

There still doesn't appear to be a way of accessing the MJPEG stream, I will mail the developer.

Nepenthes · Post by **Nepenthes** » Sat Dec 19, 2009 3:41 pm

Looks like MJPEG support is coming next week by the announcement on the website.
I guess that in combo with the CGI PT commands makes this cam a 'proper' zoneminder option...

ZoneMinder Forums

Maygion IPCamera - ZM Crashing

Maygion IPCamera - ZM Crashing

picture size