Working QSee/Swann/Zmodo DVR support! - Updated 2013-04-21

[DocSavage]

I took another look at your tcpdump, and unfortunately it looks like the video packets are encapsulated in something else. Not sure what yet, but that would be why it's "smearing", and indeed, I can't open that video at all. That's going to make decoding a lot more difficult.
Does your DVR have a mobile port? I could try to get that working, which might be easier.

Unfortunately it doesn't - just the 6039 port. I am going to try and look at what IP Cam does and see if it helps. I am on your google+ page now as well...

-Andy

[mcyberey]

I have a Zmodo H8114UV.

Here are a few notes for the 8114:

Using the windows "DVR Client" software, the streams are 352x240, not 704x480, regardless whether or not you select lan or internet. The internet setting appears at a harsher encoding and lower framerate however.

If I first view a stream with the windows or iPhone clients and then open a rtsp stream in vlc, I can sometimes pull the live feed from the first camera.

*edit* Can't attach wireshark output or post links since I am a new user. I can email it to you if you wish. see files below, replace "(dot)" with "."

Thanks for sharing.

Edit:

I captured my packets from my iPhone using the "naway" app connecting to the mobile port. They are posted here, there appears to be no handshaking.

people(dot)virginia(dot)edu/~mc8qr/from_iphone_app(dot)txt

I also captured the packets from the windows app connecting to the media port. There are two files, "1" is logging in to the DVR, "2" is the stream when I "start" a capture using the LAN encoding. After "2" is sent, it appears to be a regular h264 steam.

people(dot)virginia(dot)edu/~mc8qr/DVR_client_1.txt
people(dot)virginia(dot)edu/~mc8qr/DVR_client_2.txt

I'm guessing for the mobile port, there is no handshaking? For the media port, there is some handshaking when you start a stream. Given that I can start a stream with the DVR client software and then connect using VLC rtsp, we should be able to get this to work if we can figure out the handshaking.

[Phoenix84]

I have a Zmodo H8114UV.

Here are a few notes for the 8114:

Using the windows "DVR Client" software, the streams are 352x240, not 704x480, regardless whether or not you select lan or internet. The internet setting appears at a harsher encoding and lower framerate however.

If I first view a stream with the windows or iPhone clients and then open a rtsp stream in vlc, I can sometimes pull the live feed from the first camera.

*edit* Can't attach wireshark output or post links since I am a new user. I can email it to you if you wish. see files below, replace "(dot)" with "."

Thanks for sharing.

Edit:

I captured my packets from my iPhone using the "naway" app connecting to the mobile port. They are posted here, there appears to be no handshaking.

people(dot)virginia(dot)edu/~mc8qr/from_iphone_app(dot)txt

I also captured the packets from the windows app connecting to the media port. There are two files, "1" is logging in to the DVR, "2" is the stream when I "start" a capture using the LAN encoding. After "2" is sent, it appears to be a regular h264 steam.

people(dot)virginia(dot)edu/~mc8qr/DVR_client_1.txt
people(dot)virginia(dot)edu/~mc8qr/DVR_client_2.txt

I'm guessing for the mobile port, there is no handshaking? For the media port, there is some handshaking when you start a stream. Given that I can start a stream with the DVR client software and then connect using VLC rtsp, we should be able to get this to work if we can figure out the handshaking.

By 'handshaking' I mean the client sends something to the dvr, and the dvr responds. This can happen once, or multiple times, until the video feed starts. If that didn't happen, I'd expect the video feed to start immediately upon connect, which wouldn't make sense, since you have to tell it what channel you want.

Would you mind sending me the raw pcap files? You can use a VM if you like. Those are easier to work with, as I can get some context with it. You can email it to the address I provided in the OP.
If you want to edit the files, you can use editcap, but I'm not well versed on that myself.

Alternatively, if you have no objections, I could connect to your DVR to 1) get the capture myself, and 2) test my app directly against it. It would by far be the quickest option, which worked well for another user (got mobile support working for him in a few short hours), but completely understandable if you don't want to. If you want to do that, you can either pm or email me the details.

I'm curious how you got vlc to work, I never have. Could you post detailed steps on how you did that?

EDIT:
You know what, the 8114 was what I just finished (the user mentioned above). I'll see if I can send it to you. His was also fixed at 352x240, IIRC.

[mcyberey]

I have a Zmodo H8114UV.

Here are a few notes for the 8114:

Using the windows "DVR Client" software, the streams are 352x240, not 704x480, regardless whether or not you select lan or internet. The internet setting appears at a harsher encoding and lower framerate however.

If I first view a stream with the windows or iPhone clients and then open a rtsp stream in vlc, I can sometimes pull the live feed from the first camera.

*edit* Can't attach wireshark output or post links since I am a new user. I can email it to you if you wish. see files below, replace "(dot)" with "."

Thanks for sharing.

Edit:

I captured my packets from my iPhone using the "naway" app connecting to the mobile port. They are posted here, there appears to be no handshaking.

people(dot)virginia(dot)edu/~mc8qr/from_iphone_app(dot)txt

I also captured the packets from the windows app connecting to the media port. There are two files, "1" is logging in to the DVR, "2" is the stream when I "start" a capture using the LAN encoding. After "2" is sent, it appears to be a regular h264 steam.

people(dot)virginia(dot)edu/~mc8qr/DVR_client_1.txt
people(dot)virginia(dot)edu/~mc8qr/DVR_client_2.txt

I'm guessing for the mobile port, there is no handshaking? For the media port, there is some handshaking when you start a stream. Given that I can start a stream with the DVR client software and then connect using VLC rtsp, we should be able to get this to work if we can figure out the handshaking.

By 'handshaking' I mean the client sends something to the dvr, and the dvr responds. This can happen once, or multiple times, until the video feed starts. If that didn't happen, I'd expect the video feed to start immediately upon connect, which wouldn't make sense, since you have to tell it what channel you want.

Would you mind sending me the raw pcap files? You can use a VM if you like. Those are easier to work with, as I can get some context with it. You can email it to the address I provided in the OP.
If you want to edit the files, you can use editcap, but I'm not well versed on that myself.

Alternatively, if you have no objections, I could connect to your DVR to 1) get the capture myself, and 2) test my app directly against it. It would by far be the quickest option, which worked well for another user (got mobile support working for him in a few short hours), but completely understandable if you don't want to. If you want to do that, you can either pm or email me the details.

I'm curious how you got vlc to work, I never have. Could you post detailed steps on how you did that?

EDIT:
You know what, the 8114 was what I just finished (the user mentioned above). I'll see if I can send it to you. His was also fixed at 352x240, IIRC.

Thank you for your reply. I can give you access to the DVR is you want to play around with it, I'm just out of town at the moment would want to first change the password which I can't do remotely.

If you can send me the source code for the 8114, I would be very grateful.

To open a stream in VLC:
Start viewing a stream using either the windows client or the IOS client, after a second or two open ip_of_camera on port 554 in vlc. Sometimes it will play, sometimes it won't and it has a high probability of freezing the DVR's live stream. You can however still remotely reboot the DVR using the windows client if this occurs.

I tried using rtsp with authentication with vlc as well as mplayer to no avail. It couldn't be that easy.

WRT to handshaking. Using the iPhone "naway" app. The iPhone just appears to send a packet with the username and password and the DVR sends a stream back. I'll upload the raw pcap file in case you are interested.

Thanks again.

There is some info/downloads for these DVR's here, cctvimports(dot)com / tech / index(dot)php?dir=

It appears these DVR's may have a RS232 header and can be connected to using a terminal emulator. I'll look at my DVR more when I get back.

[Phoenix84]

Thank you for your reply. I can give you access to the DVR is you want to play around with it, I'm just out of town at the moment would want to first change the password which I can't do remotely.

If you can send me the source code for the 8114, I would be very grateful.

To open a stream in VLC:
Start viewing a stream using either the windows client or the IOS client, after a second or two open ip_of_camera on port 554 in vlc. Sometimes it will play, sometimes it won't and it has a high probability of freezing the DVR's live stream. You can however still remotely reboot the DVR using the windows client if this occurs.

I tried using rtsp with authentication with vlc as well as mplayer to no avail. It couldn't be that easy.

WRT to handshaking. Using the iPhone "naway" app. The iPhone just appears to send a packet with the username and password and the DVR sends a stream back. I'll upload the raw pcap file in case you are interested.

Thanks again.

There is some info/downloads for these DVR's here, cctvimports(dot)com / tech / index(dot)php?dir=

It appears these DVR's may have a RS232 header and can be connected to using a terminal emulator. I'll look at my DVR more when I get back.

I'm in no rush if you aren't.

That DVR does look pretty advanced (based on the interface I saw when I connected to it before).
I just tried restesting the 8114 support, and it doesn't seem to work this time. I'm going to try to verify everything this weekend if I have time.

[CasaDelGato]

You should know that there are a bunch of people that recently got the ZModo 8114's on sale at Woot, and are desperately trying to find some software to make them useable...
(Doesn't help that the units don't actually do what their specs said they would do.)

[Phoenix84]

You should know that there are a bunch of people that recently got the ZModo 8114's on sale at Woot, and are desperately trying to find some software to make them useable...
(Doesn't help that the units don't actually do what their specs said they would do.)

That's great! It looks like the 8114 is fairly simple to get at least the mobile port working. The regular port would require more work, as it looks like it supports multiple resolutions/compression rates. That may already be difficult to set up, and since I don't have one, even more so.
Do you happen to have one? (I'm guessing, since you mention the specs.)
Can you tell me what the max username/password lengths are?
I can't tell for sure, but from what I gathered it's 4/6, respectively. Can anyone confirm? That seems shorter than anything else I've seen. What I've seen so far has 8/6.

[jmuchrisf]

I looked back at my woot order, and apparently have a PKD-DK40207.

I'm planning on using your V2 to hack through getting this guy working.

Let me know if you put the code in google code or a git repository or something.

Good stuff!

[zodono]

Wow, This is almost exactly what i was looking for.. Except it doesnt work with my dvr. Many Qsee dvrs are rebranded TVT dvrs, made by TVT out of china, i have a generic TVT dvr.. it is an h264 dvr, and i have found it compatible with the software from certain qsee dvrs. I tried to look at your code, and decompile the android app supercam... But i have no code skills. My problem is i use linux and there is no software compatible for linux so im forced to run IE in a VM.... I captured the handshake with wireshark.. I have posted the android app supercam, and the captured handshake at zodonoalt . net/tvt/
If this could be supported it should add support for not only more qsee brand dvrs, but also every tvt manufactured dvr. It would also be awesome for me, as i could just connect vlc or ffmpeg to the pipe that is created and view my cams. I replaced the login in the handshake with uuuuuu and the password with pppppppp.. Ill help if i can, as well as give access to my dvr. Congrats on the awesomeness so far

[CasaDelGato]

Do you happen to have one? (I'm guessing, since you mention the specs.)

I don't have one anymore. I gave up on it and am sending it back. CIF resolution is just too crappy for use.

[dichotom]

I have a Zmodo DVR-H9116UVDH, I can get video out of the mobile port, but not the media port (port 9000 on mine currently). Has anyone had any success with this? I can submit any info that is needed.

[dichotom]

A little bit O/T but I have been running Brutus AE2 in a brute force telnet attack against my DVR but it keeps getting a false positive (even sometimes crashes the telnet daemon on the machine requiring reboot) and brutus craps out on me. I have been running the attack with 1 connection and 3 attempts per connect. Anyone else trying to get the root/telnet password out of this thing? I am going to try hydra next to see how it behaves.

[zodono]

well on the tvt manufactured qsee branded dvrs the telnet login is either root with no pass, or root and pass of 123456

rather than trying to brute force the telnet an easier and less time consuming approach would be to use a 3.3v ttl cable, like a n ftdi cable or a bus pirate to find a serial console on the board or tap it directly on the processor. if its well labled would take you less than 10 minutes to connect it up, and read the telnet password right out of the telnet daemons .conf file, at a minimum you could replace the passwd and shadow file, or download them for cracking.

[DocSavage]

Any more progress getting a better stream out of these babies? I am still thrashing around with the QSEE 504 trying to get a good stream. I can capture it and play it with some players albeit with some strange artifacts at the bottom half of the frame - but FFMPEG will not recognize it as valid.

I wish we could get Robert Chou (the guy who did the Android IP Cam Viewer) to give us some pointers as his little program works perfectly with all the qsee models. I have dropped him an email to see if he has some pointers...

-Andy

[mcyberey]

Using the H8114UV If you open "rtsp://IP/camera_number" ie "rtsp://192.168.1.2/2" for camera 2 on DVR with ip 192.168.1.2, you can view the live stream. It appears they have an rtsp server running with no authentication. I initially thought you had to have someone logged into the system for it to work, but you do not.