Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Useful URLs #49

Open
jilleb opened this issue Aug 30, 2021 · 6 comments
Open

Useful URLs #49

jilleb opened this issue Aug 30, 2021 · 6 comments

Comments

@jilleb
Copy link

jilleb commented Aug 30, 2021

Not an issue, merely some research which should end up in the wiki when it's done, I guess.
I took a dive into the ppsapp binary, and found a lot of endpoints the doorbell is publishing on its internal webserver, as well as some additional variables for tuya_config.json which could be useful.

Warning, some of these URLs can mess up your camera.

Here you go:

URL Output Comment
/telnetd/switch Telnetd service started ok This doesn't start the telnet service, because telnetd is missing.
/devices/deviceinfo {"devname":"Smart Home Camera","model":"Bell 8S","serialno":"xxxxxxxxxx","softwareversion":"2.9.7","hardwareversion":"BE8S_H1_V10_433","firmwareversion":"ppstrong-c51-tuya2_lcs-2.9.7.20201020","authkey":"xxxxxxxxxx","deviceid":"xxxxxxxxxx","identity":"xxxxxxxxxx","pid":"aaa","WiFi MAC":"xxxxxxxxxx"}
/devices/storageformat No visible output. I think this formats the internal filesystem, or brings it back to factory settings. Don't use it.
/devices/formatpercent/ {"formatpercent":100} Shows the format progress.
/devices/firmware_upgrade Empty response
/devices/temp_humidity/value {"temperature_c":256,"temperature_error":256,"humidity":256,"humidity_error":256,"cpu_temperature_c":256,"cpu_temperature_error":256} Humidity sensor values. As far as I know this unit has no humidity sensor.
/flash/upgrade/ppstrong Upload example Some upload form .
/flash/upgrade/release_package Upgrade from ppstrong release package. Allows you to update firmware
/flash/upgrade/all Upload example Some upload form .
/search/ {"deviceName":"xxxxxxxxxx","serialno":"xxxxxxxxxx","sn":"xxxxxxxxxx","licenseUsed":1,"licenseId":"xxxxxxxxxx","p2p_uuid":"v2-xxxxxxxxxx","factory_code":0,"factory_code_str":"","model":"Bell 8S","ip":"xxxxxxxxxx","mask":"255.255.255.0","gw":"192.168.1.1","mac":"xxxxxxxxxx","interface":"wlan0","version":"2.9.7"}
/devices/upgradepercent/ {"percent":-1,"upgrade_percent":-1,"download_percent":-1}
/devices/reboot/ Reboots the device
/sys/reboot Reboots the device
/media/audio/output/volume {"volume":35}
/media/audio/input/volume {"volume":90}
/sys/info/ {"cpu":8,"mem":83,"uptime":"1m16s","abnormal_reboot":0}
/sys/active/ Empty reply from server
/sys/sleep Empty reply from server
/flash/encryption {"firmwareversion":"ppstrong-c51-tuya2_lcs-2.9.7.20201020","madeup_state":0,"abnormal_reboot":0,"WiFi_MAC":"xxxxxxxx","tp":""}
/flash/identity "identity": "MR200xxxxxxxxxxxxxx"
/dsp No visible output.
/dsp/debug/infodisplay This lists a bunch of additional dsp/debug URLs
/dsp/debug/xchdaynight/day/ /dsp/debug/xchdaynight/day/-->ok Switches the camera to day mode
/dsp/debug/xchdaynight/stop/ /dsp/debug/xchdaynight/stop/-->ok
/dsp/debug/xchdaynight/night/ /dsp/debug/xchdaynight/night/-->ok Switches the camera to nightvision mode
/dsp/debug/xchdaynight/auto/ /dsp/debug/xchdaynight/auto/-->ok Switches the camera into automatic day/night mode
/dsp/debug/xchdaynight/hdr/0/ /dsp/debug/xchdaynight/hdr/0/-->ok ?
/dsp/debug/xchdaynight/hdr/1/ /dsp/debug/xchdaynight/hdr/1/-->ok ?
/dsp/debug/invqe/off/ /dsp/debug/invqe/off/-->ok ?
/dsp/debug/outvqe/off/ /dsp/debug/outvqe/off/-->ok ?
/dsp/debug/invqe/on/aecon/ /dsp/debug/invqe/on/aecon/-->ok ?
/dsp/debug/invqe/on/aecoff/ /dsp/debug/invqe/on/aecoff/-->ok ?
/dsp/debug/outvqe/on/ /dsp/debug/outvqe/on/-->ok ?
/dsp/debug/outvol/openEffect/ /dsp/debug/outvol/openEffect/-->ok ?
/dsp/debug/outvol/closeEffect/ /dsp/debug/outvol/closeEffect/-->ok ?
/dsp/debug/audio/vol/ /dsp/debug/audio/vol/-->ok ?
/dsp/debug/isp/other/ /dsp/debug/isp/other/-->ok ?
/dsp/debug/daynight/para/ /dsp/debug/daynight/para/-->ok ?
/dsp/debug/isp/ae/ /dsp/debug/isp/ae/-->ok Automatic exposure?
/dsp/debug/isp/awb/ /dsp/debug/isp/awb/-->ok Automatic white balance?
/dsp/debug/isp/saturation/ /dsp/debug/isp/saturation/-->ok Saturation control. It's not known how to set it.
/dsp/debug/isp/3dnr/ /dsp/debug/isp/3dnr/-->ok 3D Noise reduction, It's not known how to set it.
/dsp/debug/isp/ldc/ /dsp/debug/isp/ldc/-->ok
/dsp/debug/sensorcheck/start/ /dsp/debug/sensorcheck/start/-->ok ?
/dsp/debug/sensorcheck/ready/ /dsp/debug/sensorcheck/ready/-->ok ?
/dsp/debug/sysdebug/ /dsp/debug/sysdebug/-->ok ?
/dsp/debug/isp/csc/ /dsp/debug/isp/csc/-->ok ?
/dsp/debug/isp/ccm/ /dsp/debug/isp/ccm/-->ok ?
/dsp/debug/isp/framrate/ /dsp/debug/isp/framrate/-->ok ?
/dsp/debug/isp/cross/ /dsp/debug/isp/cross/-->ok ?
/dsp/debug/isp/defog/ /dsp/debug/isp/defog/-->ok ?
/dsp/debug/isp/ldc/ldcopen/0x0/ /dsp/debug/isp/ldc/-->ok ?
/dsp/debug/isp/ldc/ldcopen/0x1/ldctype/0x0/CenterXOffset/0/CenterYOffset/0/Ratio/90/
/dsp/debug/isp/ldc/ldcopen/0x1/ldctype/0x0/CenterXOffset/0/CenterYOffset/70/Ratio/90/
/dsp/debug/isp/ldc/ldcopen/0x1/ldctype/0x0/CenterXOffset/0/CenterYOffset/40/Ratio/35/ Error in dmesg: MMB LEAK(pid=1067): 0x4353C000, 8192 bytes, 'AO(0,0) CirBuf' Makes the device crash, needs to be rebooted.
/proc/ppshal/dev_info -kernel_build_svn 20190403 -kernel_version 264485 -flash 8 -total 64 -hw_id 0 -sensor gc2063mipi -osmem 37 -mmz:27 -pcbname BE8S_H1_V10_433 -factoryname PPSTRONG -platform C5 -btnup 0 -btndown 0 -btnpresstime 0 -pcbversion BELL5S_H1_V10 -viewmirror default -inputvolumn none -ouputvolumn none -micphonemode none -distortion none -modename Bell^8S -lensinfo f2.4A -halinfo 3518ev300
/dsp/debug/cmd__/ No visible output.
/dsp/debug/setstreamfile/ No visible output.
/proc/net/pps_wifi_check/wifi_run_sta wifi_ok wifi status
/proc/net/wireless Table with wlan interfaces

More to be added.

@guino
Copy link
Owner

guino commented Aug 30, 2021

The telnet url says it works but never does because there’s no telnet binary in the firmware (had tried it way back). The others can probably go in the wiki.

EDIT: @jilleb I've created a page in the WIKI which links to this issue with the information posted.

@jilleb
Copy link
Author

jilleb commented Aug 30, 2021

👍🏼
I have some more to add, I'll put them in the first post.
Currently recovering my device, after formatting it by accident (one of the URLs does that 😉 )
Maybe I can cook up a simple portal that holds all URLs, with a description so users can access them easily.

@almirus
Copy link

almirus commented Sep 1, 2021

/proc/self/root/home/cfg/tuya_config.json

  "version": 1,
  "sleep_mode": 0,
  "alarm_fun_onoff": 0,
  "alarm_fun_sensitivity": 1,
  "alarm_fun_mode_switch": 0,
  "alarm_fun_time_start": 0,
  "alarm_fun_time_end": 0,
  "flip_onoff": 0,
  "light_onoff": 1,
  "night_mode": 1,
  "sound_detect_onoff": 0,
  "sound_detect_sensitivity": 1,
  "watermark_onoff": 1,
  "event_record_time": 60,
  "enable_event_record": 2,
  "record_enable": 1,
  "motion_trace": 1,
  "motion_area_switch": 0,
  "motion_area": "",
  "motion_tracking": 0,
  "cry_detection_switch": 0,
  "humanoid_filter": 0,
  "loudspeaker_vol_pct": 100,
  "onvif_enable": 0,
  "onvif_pwd": "admin"
}

@almirus
Copy link

almirus commented Sep 1, 2021

/proc/mounts

rootfs / rootfs rw 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /dev tmpfs rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,mode=600,ptmxmode=000 0 0
/dev/mtdblock6 /home/cfg jffs2 rw,relatime 0 0
/dev/mmcblk0p1 /mnt/mmc01 vfat rw,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,usefree,errors=continue 0 0

@youribonnaffe
Copy link

Some URLs from the CloudEdge application

127.0.0.1/devices/charm/pair
127.0.0.1/devices/charm/unpair
127.0.0.1/devices/firmware_upgrade
127.0.0.1/devices/led/all
127.0.0.1/devices/music/id/%s/start
127.0.0.1/devices/music/play/
127.0.0.1/devices/music/play/next
127.0.0.1/devices/music/play/pause
127.0.0.1/devices/music/play/prev
127.0.0.1/devices/music/play/state
127.0.0.1/devices/network
127.0.0.1/devices/reboot
127.0.0.1/devices/record/search_by_day
127.0.0.1/devices/sd_event
127.0.0.1/devices/settings
127.0.0.1/devices/storage
127.0.0.1/devices/temp_humidity/value
127.0.0.1/devices/upgradeprecent
127.0.0.1/devices/voicemail
127.0.0.1/media/audio/output/volume
127.0.0.1/media/audio/output/volume/

And the code from the app to see how they are called: https://github.com/youribonnaffe/iegeek-security-camera/blob/main/MeariDeviceController.java

I have not checked if they all work.

@youribonnaffe
Copy link

Even more URLs extracted from https://github.com/Mearitek/MeariSdk/tree/master/Android/library/x86_64 (libsppsdk):

http://%s/devices/ntp
http://%s/devices/timezone
http://%s/devices/network
http://%s/devices/reboot
http://%s/devices/setpasswd
http://%s/devices/voicetalk
http://%s/devices/record/stop
http://%s/devices/playback
http://%s/devices/setptzmove
http://%s/devices/setptzstop
http://%s/devices/upgrade
http://%s/devices/lte/online
http://%s/devices/wifi
http://%s/devices/deviceinfo
http://%s/devices/devicecaps
http://%s/devices/storage
http://%s/devices/netlink
http://%s/devices/lte/status
http://%s/devices/energy
http://%s/devices/lte/info
http://%s/devices/snapshot
http://%s/devices/daytonightlevel?videoid=%d
http://%s/devices/videosourceconfig?videoid=%d
http://%s/devices/audiosourceconfig?audioid=%d
http://%s/devices/factoryreset
http://%s/devices/record/search_by_day
http://%s/devices/record/search_by_month
http://%s/devices/record/start
http://%s/devices/record/schedule
http://%s/devices/playback/control
http://%s/devices/firmware_upgrade
http://%s/devices/storageformat
http://%s/devices/mirror?videoid=%d&mirror=%d
http://%s/devices/ftpcfg?videoid=%d
http://%s/devices/alarm/open?videoid=%d&alarmtype=%d
http://%s/devices/alarm/close?videoid=%d
http://%s/devices/lte/offline
http://%s/devices/videosourcecaps?videoid=%d
http://%s/devices/audiosourcecaps?audioid=%d
http://%s/devices/upgradeprecent
http://%s/devices/formatpercent
http://%s/devices/alarm/get?videoid=%d
http://%s/devices/mirror?videoid=%d

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants