Unix

Hacking a Xiaomi Security Camera: Full Control and iOS/HomeKit Integration

TheChinesecompanyXiaomiisknownnotonlyforitssmartphonesbutalsoforitsinexpensivegadgets,withthelineupgrowingeveryyear.Theresonecatch:theyoftenworkonlywiththecompanysownappsandhubs.Inthisarticle,Illshowhowtomodifythe The Chinese company Xiaomi is known not only for its smartphones but also for its inexpensive gadgets, with the lineup growing every year. There’s one catch: they often work only with the company’s own apps and hubs. In this article, I’ll show how to modify the 25 Xiaomi Small Square Smart Camera to first gain access to all the interesting features, and then integrate it into the Apple ecosystem.

The Small Square Smart Camera is a compact Wi‑Fi camera that records high‑quality 1920×1080 video with a solid field of view. It also features IR illumination for night vision, a convenient magnetic mount, support for memory cards up to 64 GB, a USB port for external storage, and a speaker and microphone for two‑way audio. All in all, for under 2,000 rubles, it’s a very solid package.

Xiaomi Small Square Smart Camera
Xiaomi Small Square Smart Camera

A major drawback of this camera is that it’s designed to work only through the Mi Home app. That means you can’t feed its video stream into a proper surveillance system or integrate it with Apple’s HomeKit. However, thanks to the efforts of the enthusiast community, all of these limitations have been overcome!

Taking the Camera Apart and Reading Logs over UART

Inside the camera is an ARM9-based chip running standard Linux. Our goal is to install firmware that gives us control over the system and enables RTSP video streaming. But first, I recommend connecting via the UART debug port so you can watch the logs for errors.

So, remove the memory card, undo the two screws, and slide the bottom cover toward you.

If everything went well, you should see something like this
If everything went well, you should see something like this

Next:

  • Gently pry the case apart
  • Disconnect the Wi‑Fi antenna
  • Remove the three internal screws
  • Disconnect the camera ribbon cable

UART access gained!

UART access
UART access

Note that the UART TTL level is 3.3 V (the chip runs at 3.3 V), while the camera itself is powered from 5 V over USB. The best practice is to connect only GND, TX, and RX, and supply power via USB.

Now solder on three wires and connect a USB–UART adapter.

USB — UART
USB — UART

Use minicom or PuTTY to get root access.

  • Baud rate: 115200
  • Username: root
  • Password: ismart12

If you plug in a USB flash drive while the camera is running, it should detect it, mount it, and run the firmware modification script. All system activity is logged to the console.

Modding the camera firmware for RTSP streaming

The newest firmware version that can be modified with fang-hacks is 3.0.3.56, so the first step is to downgrade.

  • Download the firmware: XiaoFang_FWv3.0.3.56 (https://drive.google.com/open?id=1guHseq43q1qVGLnDpJU-PqXYmjW-ioy4).
  • Format the microSD card as FAT32.
  • Extract the firmware archive to the root of the microSD card.
  • Power off the camera.
  • Insert the microSD card into the camera.
  • Press and hold the Setup button on the camera.
  • While holding the Setup button, power the camera back on.
  • After about two minutes, you’ll hear a voice prompt in Chinese.

The firmware downgrade is complete; you can proceed with applying the hack.

From the fang-hacks repository, download fanghacks_v0.2.0. This is a prebuilt image with two partitions: a bootable FAT32 and a system ext2. Use the dd utility or another imaging tool to write the image to the SD card.

dd
dd
  • Power on the camera without a memory card.
  • Wait until the blue LED stops blinking and stays solid.
  • Insert the card; the camera should play its usual chime. If it doesn’t, check the logs for SD card detection/mount errors.
  • The snx_autorun.sh script will start automatically; wait about 30 seconds.

The firmware has been modified; you can now activate the hack. Go to http://device-ip/cgi-bin/status and click Apply.

What this hack enables:

  • RTSP video streaming
  • Unbinding from the Chinese cloud service
  • Configuring Wi‑Fi as a client or an access point
  • FTP, telnetd, SSH/SCP/SFTP
  • Setting the correct time

RTSP support means you can view the video in any camera-compatible application. You can test this with VLC: in the File menu, choose Open Network and go to rtsp://device_address/unicast.

VLC
VLC

Setting Up Homebridge and the Camera Plugin on a Raspberry Pi

If you’re putting together a video surveillance system, you probably already know what to do with an RTSP stream. But if you want to integrate a camera into your smart home and you carry an iPhone, read on: I’ll show you how to turn almost any off-the-shelf camera into a device that works with Apple HomeKit. As with smart bulbs, the easiest way to do this is to use a tool called Homebridge.

Homebridge is a Node.js plugin, so start by installing a stable Node.js release. All the software will run on a Raspberry Pi 3 Model B with Raspbian Stretch. A Raspberry Pi is ideal for this project because the camera video needs to be transcoded to H.264 in real time, and the board can do this with hardware acceleration.

$ wget -O - https://raw.githubusercontent.com/sdesalas/node-pi-zero/master/install-node-v.lts.sh | sudo bash
Raspberry Pi 3
Raspberry Pi 3

To install extensions from the npm package manager, you need to install the build tools:

$ sudo apt-get install -y build-essential

Next, install homebridge itself:**

$ sudo npm install -g --unsafe-perm homebridge

To use hardware video encoding on a Raspberry Pi, you need to build FFmpeg with the appropriate flags. All right—let’s get to it!

Install the build tools:

$ sudo apt-get install pkg-config autoconf automake libtool libx264-dev git

Download and install fdk-aac.

$ git clone https://github.com/mstorsjo/fdk-aac.git
$ cd fdk-aac
$ ./autogen.sh
$ ./configure --prefix=/usr/local --enable-shared --enable-static
$ make -j4
$ sudo make install
$ sudo ldconfig
$ cd ..

Download and install FFmpeg.

$ git clone https://github.com/FFmpeg/FFmpeg.git
$ cd FFmpeg
$ ./configure --prefix=/usr/local --arch=armel --target-os=linux --enable-omx-rpi --enable-nonfree --enable-gpl --enable-libfdk-aac --enable-mmal --enable-libx264 --enable-decoder=h264 --enable-network --enable-protocol=tcp --enable-demuxer=rtsp
$ make -j4
$ sudo make install

Install the homebridge-camera-ffmpeg plugin.

$ sudo npm install -g homebridge-camera-ffmpeg

Create the configuration file /home/pi/.homebridge/config.json1 with the following content:

{
"bridge": {
"name": "Homebridge",
"username": "CC:22:3D:E3:CE:34",
"port": 51826,
"pin": "031-45-154"
},
"description": "My Home",
"accessories": [],
"platforms": [{
"platform": "Camera-ffmpeg",
"cameras": [
{
"name": "Camera Name",
"videoConfig": {
"source": "-rtsp_transport tcp -re -i rtsp://192.168.1.3/unicast",
"stillImageSource": "-i rtsp://192.168.1.3/unicast",
"maxStreams": 2,
"maxWidth": 1280,
"maxHeight": 720,
"maxFPS": 10,
"vcodec": "h264_omx",
"debug": true
}
}
]
}
]
}

Launch Homebridge with debug logging enabled: DEBUG=* /opt/nodejs/bin/homebridge.

HKStarted
HKStarted

When Homebridge starts, the log shows that a single platform Camera-ffmpeg is being loaded, and it displays a QR code and a numeric code for adding the camera to the Home app on iOS. In debug mode, you can watch the camera pairing process to make sure everything is proceeding as expected. While the camera is running, the log outputs messages about the decoding process and indicates when hardware decoding is being used.

www

You can find more detailed configuration guidance on the project page: project page. For example, to improve performance you can lower the video resolution or reduce the frame rate (FPS). This helps if the camera is far from the router and the Wi‑Fi signal is weak.

Add the Camera to Apple Home via HomeKit

Starting with iOS 10, the Home app appeared on iPhone and iPad, letting you control smart home devices via HomeKit. To add a camera to Home, tap the + icon, choose “Don’t Have a Code or Can’t Scan?”, and then you’ll see a list where only the camera can be added.

Adding the camera
Adding the camera

Without any extra hardware, you can view the camera’s video as long as your phone or tablet is on the same network. However, if you have a HomeKit hub (a HomePod, Apple TV, or iPad can serve as one), the video will be relayed through Apple’s servers, letting you see what’s happening at home from anywhere.

it? Share: