Working QSee/Swann/Zmodo DVR support! - Updated 2013-04-21

If you've made a patch to quick fix a bug or to add a new feature not yet in the main tree then post it here so others can try it out.
Post Reply
Phoenix84
Posts: 21
Joined: Sat Jun 25, 2011 7:20 pm

Working QSee/Swann/Zmodo DVR support! - Updated 2013-04-21

Post by Phoenix84 »

So, I recently purchased one of the cheap Zmodo DVR's from Woot. To my disappointment (but not surprise), this system is not supported in Zoneminder.
Well, I figured out a way to get it working.

There's a great Android app called IP Cam Viewer. In case you haven't heard of it, it can stream many different cameras, including ZoneMinder.
Anyway, I decompiled that app and reverse engineered the protocol (to the best of my ability) used to get the camera stream. Using that information, I wrote a small app that allows Zoneminder to see the feeds.
It works by authenticating to the DVR's mobile port, and forwarding the receiving h264 stream to a FIFO pipe, which Zoneminder reads from. I spoke with the author of that app, Robert Chou, and he gave his ok, so I'm posting it here.

I was originally writing this as a test app to see if I could get it to even work, then add support directly into zoneminder. However I was so impressed with the results, I'm just using it as is. This is also why it's a C app, as opposed to a perl script.

How to use:
Download the C file (unzip file first, forum limitation) and compile with: gcc zmodopipe.c -o zmodopipe
It accepts many command-line options, which are documented by running: ./zmodopipe -h
As an example, to watch the first two cameras run this:
./zmodopipe -s 192.168.1.100 -p 18600 -c 1 -c 2 -u mobileuser -a mobilepass &
For more info on the options, check the help.

In Zoneminder do this:
1) Add a new monitor
2) Source type: ffmpeg
3) Source path: /tmp/zmodoX (or whatever the pipe name you used is, and where X is channel number - 1).
4) Capture size: 320x240 (704x480 for Media port)

Save, then wait for 10-30 seconds for ZM to start pulling the stream... and poof!

Now, this is a work in progress. So there are some issues.
1) Sometimes some streams cut out, even in Media mode. The stream occasionally has a bad frame ([h264 @ 0xaf5d60] no frame!), and when ZM decodes it, zmc keels over because there's no frame data:
11/12/11 08:03:16.245611 zmc_m4[-1].FAT-zm_ffmpeg_camera.cpp/173 [Unable to decode frame at frame 3270]
2) On the mobile port, occasionally the image will go grey, it'll fix itself in a few seconds after the next keyframe (don't know why). You'll have to take that into account for motion detection.
3) To change the directory the pipe is created in, change the source. I needed something quick that would work with all users, so I used /tmp. Pipes take no space, so there's no issue of filling up the disk. If there's enough demand, I'll add an option to specify the path.
4) Main process doesn't fork to the backgound (but children do). To close the app, press Ctrl-C or send a SIGTERM (if running in background with '&'). It will properly shut down and delete all children and their pipes.

Now, I only have the Zmodo DVR-H9104 unit. They are essentially the same as the equivalent Q-See/Swann units, so they should work, but I can't test anything else.
Let me know what you guys think.
PS. If you want to thank me, go buy his app if you use the free version. He's been a good sport (by allowing me to decompile his code). :D
I also hope by posting this code, someone else (who knows the internals of zoneminder better) will be able to add support in for these cameras natively.

For reference, here's the cameras it MIGHT work with:
Defender SN300 DVR
KGuard KG-SHA108 V2
Night Owl Poseidon
Night Owl Zeus
Q-See QS408 (ones based on this should work best)
Zmodo H9106
CnM Classic 4 Cam DVR (Thanks Ian)
Zmodo DVR-8104UV compatible (also DVR-8114HV) - Please test!
Visionari 4/8 channel DVR (thanks jasonblack)
Swann hardware version DM-70D, device type DVR04B and compatible (thanks, Phil)
  • Note, if this doesn't work it's been reported that you can access the stream using rtsp://ip/ch# (ie: rtsp://192.168.0.1:554/1
If anyone has this units, please test and let me know!

If you want to keep up with my progress (which is sometimes SLOW), check out my G+ page: https://plus.google.com/107530140244685710056
EDIT: I've updated this post for the newer version, which now supports the media port (some models only)!

EDIT 15 Nov 2011: There's a bug in the newest version, I reversed the user name and password fields. If you're getting login problems, try reversing them on the command line (-u for password, -a for username). I've already fixed it for when I release the next version.

EDIT 26 Jan 2012: I've uploaded a new version that supports the CnM Classic 4 Camera DVR system. There's also untested support for the DVR-8104UV models (also 8114HV). Please test those if you have one of those models.
I've also added a timer and signal support. Since the stream sometimes goes out, you can set a timer inerrupt to reset the connection on an interval (-t option). You can also send a SIGUSR1/2 manually to the errant process.

EDIT: 21 Apr 2013: New version, this includes the Visionari patch by forum user jasonblack. Also included is support for certain Swann models with hardware version DM-70D, device type DVR04B (I don't have the marketing model number). Command-line options -m7 and -m8, respectively.
I also improved reliability by making sure the children automatically restart streaming if they die for some reason. The grey images might still appear, but the process should always restart as long as the parent is running.
EDIT 27 Apr 2013: Actually uploaded the file this time. It looks like the forum only supports a max of 3 files. Sorry about that. :oops:
EDIT 5 May 2013: Fix help not displaying. Search and replace oops. :oops:
Attachments
zmodopipe_v41.zip
0.41 - 2013-05-03
Fixed -h option not displaying help.
0.4 - 2013-04-21
Add support for some Swann models
Added Visionari patch by jasonblack
Fix incorrect use of select timeout struct.
(7.82 KiB) Downloaded 7551 times
zmodopipe_v3.zip
Added more models: DVR-8104UV/8114HV and CnM Classic.
(6.68 KiB) Downloaded 3814 times
zmodopipe_v2.zip
Got media port support working (for some models at least).
Changed fork behavior to fix a bug, now parent only spawns children, it doesn't stream.
(4.8 KiB) Downloaded 3771 times
Last edited by Phoenix84 on Sat May 04, 2013 4:32 am, edited 18 times in total.
cpfl
Posts: 2
Joined: Fri Sep 30, 2011 1:02 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by cpfl »

Phoenix84,

I just bought one of those ZModo DVRs recently myself and was not too happy to discover that there was no support for them within Zoneminder or any other open source security suite for that matter. Admittedly, I hadn't done any research before buying it.

Being one of those people who refuses to get a smartphone, but who really likes the idea of having access to my video streams over my not-so-smart-feature-phone, I was extremely happy to see that you had written a utility to bridge the gap.

I would be very happy if you would continue its development.

Thank you!!!

CPFL.
Phoenix84
Posts: 21
Joined: Sat Jun 25, 2011 7:20 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by Phoenix84 »

I've posted an update which now includes Media port support (for some models at least). See the OP for download link.
cpfl
Posts: 2
Joined: Fri Sep 30, 2011 1:02 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by cpfl »

Thanks! I've downloaded it and will give it a try as soon as I can.
hamster
Posts: 3
Joined: Tue Nov 15, 2011 5:04 am

Re: Working QSee/Swann/Zmodo DVR support!

Post by hamster »

Howdy,

I posted on your google+ page the other day, and have just had a chance to try out your new code.

It still works great with the mobile port, and the network code seems much more robust. However, both of the media port versions (with and without the header) fail to work with my Swann DVR16-2600.

I just discovered that the DVR16-2600 has an open telnet port, but I don't have the login info. I managed to extract the root filesystem from a firmware image and am attempting to reverse the password to hop into the box and see what I can do in there.

Is there any kind of logs or tcpdumps I can do that would help to figure out how to access this thing? I'm a pretty good programmer but I'm not sure where to start to help with this.

Thanks for writing this, it's gonna be a big help for me.
Phoenix84
Posts: 21
Joined: Sat Jun 25, 2011 7:20 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by Phoenix84 »

hamster wrote:Howdy,

Is there any kind of logs or tcpdumps I can do that would help to figure out how to access this thing? I'm a pretty good programmer but I'm not sure where to start to help with this.

Thanks for writing this, it's gonna be a big help for me.
Cool. If you want to help out, that would be awesome.

If people are interested, I can write up a document describing how to get what you need from wireshark.
Here's the basic steps for those who want to send me the info, or have some experience to know what to look for (to quote my email sent to someone else):
  1. Start capturing on wireshark
  2. Open IE to the dvr's activex webpage.
  3. Login, and select "LAN" or "high bandwidth" if provided (create a new user specifically for this, as your password is clear text)
  4. Once the camera(s) show up for a few seconds, you can stop capturing
  5. Look on the log, and find a packet that has the DVR as the source, and your machine as the destination (this will be the h264 video) it should look similar to this:

    Code: Select all

    10456	37.664680	172.20.0.123	172.20.1.109	TCP	1514	cslistener > 65142 [ACK] Seq=2908101 Ack=508 Win=6912 Len=1460
  6. The sequence number might be large (like mine), depending on how long you left the capture on after the video started. HINT: Most likely, you're on port 9000, or 7000 (IP Cam viewer will tell you the default). Look for that at the start of the "Info" line (mine is 'cslistener > 65142', which means from DVR port 9000 to local machine port 65142, although that port is irrelevant, except for determining camera channel).
  7. Right click that packet, and select "Follow TCP Stream"
  8. You should get a new popup window, with red text on top, and blue text below (and possibly alternating)
  9. This is the 'handshake' as it were, and how to connect to the camera. After a few packets are sent back and forth, the h264 stream starts.
  10. Select 'Hex Dump' ('Raw' doesn't tell me the lengths of each packet)
  11. Additionally, to support multiple cameras, I need at least one other login packet from another camera channel. To do this, look in the same TCP dump for a similar packet, but with a different destination port number (ie. 65143). I will probably be one higher than the previous, but that's not a guarantee.
Just save both of those to a file and send it to me! (if you want remove the username/password, use a hex editor and replace them with spaces!)

FYI, in most cases, this is the stupid proprietary thing that gets in the way of a grabbing the stream normally, such as by RT(S)P. Because after these initial packets, all the return data is raw h264.

If you'd like to write your own camera support, just send me a patch. Since I can't test any unit other than mine, testing others is difficult.
Last edited by Phoenix84 on Tue Jan 31, 2012 6:32 am, edited 5 times in total.
hamster
Posts: 3
Joined: Tue Nov 15, 2011 5:04 am

Re: Working QSee/Swann/Zmodo DVR support!

Post by hamster »

Thanks for the quick reply!

I'll grab some packets here soon and see what happens :)
Phoenix84
Posts: 21
Joined: Sat Jun 25, 2011 7:20 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by Phoenix84 »

I was just thinking (and upping my post count, so I can link to images)...
Perhaps I could write a wrapper for RT(S)P or HTTP that zoneminder can pick up with one of it's other drivers (since ffmpeg seems flaky). Thoughts?
No guarantees though, as this would require some work (plus I don't know the RTP protocol, yet).
TheCase
Posts: 3
Joined: Tue Nov 15, 2011 11:32 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by TheCase »

I'm trying to get this working for the DVR-8114HV (Zmodo).

I keep getting Connection Refused. I've tried both ports of 7777 and 8888 (which are listed in the network configuration as Server port and Mobile port, respectively).
hamster
Posts: 3
Joined: Tue Nov 15, 2011 5:04 am

Re: Working QSee/Swann/Zmodo DVR support!

Post by hamster »

Try doing an nmap on the DVR, ie, from your linux box run 'nmap -P0 -v <ip address of DVR>', and it will return a list of open ports. Maybe that will help you narrow down which one to use.
Phoenix84
Posts: 21
Joined: Sat Jun 25, 2011 7:20 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by Phoenix84 »

TheCase wrote:I'm trying to get this working for the DVR-8114HV (Zmodo).

I keep getting Connection Refused. I've tried both ports of 7777 and 8888 (which are listed in the network configuration as Server port and Mobile port, respectively).
I didn't realize how many different configurations there are!

At the moment, this app only has a chance of working if your media port is 9000, or your mobile port is 18600, and even then it might be a toss-up. I guess my topic summary was too broad.

I'd be happy to help you out (unless you want to try tackling it yourself), just send me the tcp dump (ideally in pcap format) as described above to zmodo [at] danielosborne [dot] net. Also let me know which model it is. I'll do my best to add it.

I'm currently writing a test server which I should hopefully be able to use, with this tcp dump data, to verify I'm sending and receiving the data correctly (should speed testing up).

If anyone wants to volunteer access to their dvr system, I could test my app directly against it (faster and easier). However I completely understand if you don't want to. Again, PM or email me if you're interested.

EDIT: I missed the part about "connection refused". Are you accessing this from the same network (ie. not over the internet?). How about firewall settings? If you're connecting to the correct port, you shouldn't get "connection refused." I would expect a failure later on, but not during the connect.
TheCase
Posts: 3
Joined: Tue Nov 15, 2011 11:32 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by TheCase »

Phoenix84 wrote:
TheCase wrote:I'm trying to get this working for the DVR-8114HV (Zmodo).

I keep getting Connection Refused. I've tried both ports of 7777 and 8888 (which are listed in the network configuration as Server port and Mobile port, respectively).
I didn't realize how many different configurations there are!

At the moment, this app only has a chance of working if your media port is 9000, or your mobile port is 18600, and even then it might be a toss-up. I guess my topic summary was too broad.

I'd be happy to help you out (unless you want to try tackling it yourself), just send me the tcp dump (ideally in pcap format) as described above to zmodo [at] danielosborne [dot] net. Also let me know which model it is. I'll do my best to add it.

I'm currently writing a test server which I should hopefully be able to use, with this tcp dump data, to verify I'm sending and receiving the data correctly (should speed testing up).

If anyone wants to volunteer access to their dvr system, I could test my app directly against it (faster and easier). However I completely understand if you don't want to. Again, PM or email me if you're interested.

EDIT: I missed the part about "connection refused". Are you accessing this from the same network (ie. not over the internet?). How about firewall settings? If you're connecting to the correct port, you shouldn't get "connection refused." I would expect a failure later on, but not during the connect.
WireShark capture sent via email. This is all on the local network. I've also sent connection details if you'd like to try and access my DVR.
DocSavage
Posts: 4
Joined: Tue Apr 22, 2008 10:42 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by DocSavage »

Here is some more info on trying to get this to work with the QT504. What I have ended up doing with the program is hard-coding the send buffers with the data from the dump. This has successfully created the connection and packets are flowing. However - whenever I try to hook up ffmpeg to the pipe (ffmpeg -i /tmp/zmodo0 -vcodec copy -y camera.mp4) it sits there for a while and then gives an Invalid data found when processing input error...

I then just used cat to create a file from the pipe. What I got could be played by mplayer - sort of! It has a bunch of errors and the output is strangely smeared...

So it is close but no cigar.

Also whenever I try to load a sample file the forum says the extension is not allowed. I will send them directly if anybody is interested.
I figured out it can only be a zip file... attached now (sample is short due to forum limits - but it shows the errors)
-Andy
Attachments
camera.zip
Sample capture from pipe
(99.43 KiB) Downloaded 3641 times
zmodopipe.zip
C file with hardcoded buffers
(5.61 KiB) Downloaded 3585 times
Andrew Galewsky
Phoenix84
Posts: 21
Joined: Sat Jun 25, 2011 7:20 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by Phoenix84 »

To keep the forum free of busy messages, I'm posting updates to my G+ page: https://plus.google.com/107530140244685710056.
I will still post release updates here, and answer help requests.
This page is mostly for those who want to keep up to date on my progress.
Phoenix84
Posts: 21
Joined: Sat Jun 25, 2011 7:20 pm

Re: Working QSee/Swann/Zmodo DVR support!

Post by Phoenix84 »

DocSavage wrote:Here is some more info on trying to get this to work with the QT504. What I have ended up doing with the program is hard-coding the send buffers with the data from the dump. This has successfully created the connection and packets are flowing. However - whenever I try to hook up ffmpeg to the pipe (ffmpeg -i /tmp/zmodo0 -vcodec copy -y camera.mp4) it sits there for a while and then gives an Invalid data found when processing input error...

I then just used cat to create a file from the pipe. What I got could be played by mplayer - sort of! It has a bunch of errors and the output is strangely smeared...
I took another look at your tcpdump, and unfortunately it looks like the video packets are encapsulated in something else. Not sure what yet, but that would be why it's "smearing", and indeed, I can't open that video at all. That's going to make decoding a lot more difficult.
Does your DVR have a mobile port? I could try to get that working, which might be easier.
Post Reply