hn/reolink-camera

Reolink RLC-410-5MP IP camera reverse engineered technical details

reolink-camera's Issues

Unable to make the buildroot

First off thank you for doing this, I have a ton of these cameras and their unwillingness to ditch the flash player is making me want to take the issue into my own hands, however, I have never done much with embedded Linux (though I am not a stranger to embedded programming) and could use some pointers if you have the time,

So far I have been unable to make the buildroot environment,

freadahead.c:91:3: error: #error "Please port gnulib freadahead.c to your platform! Look at the definition of fflush, fread, ungetc on your system, then report this to bug-gnulib."
   91 |  #error "Please port gnulib freadahead.c to your platform! Look at the definition of fflush, fread, ungetc on your system, then report this to bug-gnulib."
      |   ^~~~~
fseeko.c: In function 'rpl_fseeko':
fseeko.c:109:4: error: #error "Please port gnulib fseeko.c to your platform! Look at the code in fseeko.c, then report this to bug-gnulib."
  109 |   #error "Please port gnulib fseeko.c to your platform! Look at the code in fseeko.c, then report this to bug-gnulib."
      |    ^~~~~

I believe this has to do with my development system having a newer version of glibc, have you encountered this issue? If so, how did you work around it, if not, what OS and version are you using?

Also, if you happen to know of a quick tutorial on compiling/including a custom binary in a buildroot environment that would be amazing!

I am not sure I need that to get an html5 video player working on this camera but it would be nice to know how to do that.

Thank you!

firmware modification without soldering?

Thanks for writing this up! Very interesting.

Looks like the procedure in README.md is based on soldering something onto J9 to get to the uboot prompt, copying the firmware off the camera, and copying altered firmware back.

Has anyone tried altering a .pak file and uploading it through the camera's web UI? I don't know if Reolink uses signed firmware or something to prevent this. It'd be nice to have a way of getting ssh access without any hardware modification.

Files with more than 11 partitions/sections

There are firmware files where there are more than 11 partitions/sections. For example I am currently looking at IPC_528B174MP.1388_22100601.Reolink-Duo-WiFi.GC4653.4MP.WIFI1021.REOLINK.pak which has 13 partitions.

To find out how many partitions are needed you need to divide the offset found in the entry for the first section by (64 + 76)

rtsp stream smearing

I dumped my reolink camera into my project bin because of the smearing issue on the rtsp stream. Did you ever find anything out regarding the cause of the smearing?

argus 2

hey thanks for the guide. noticed argus 2 has 5 pin UART. seems to be based on a Grain Media SoC (no board model yet)

feel free to close as this not really an issue but more info if anyone decides to dig further into this model.

Custom Watermark

Hello,

I have figured out how to extract the .pak file using the 7zip program and have access to the directories. I found the watermark files under mnt/app/ and then the 3 watermark files are listed as watermark_e.bmp, watermark_m.bmp, and watermark_s.bmp. I have created 3 of my own bmp files based on the specifications of the already existing ones and have tried to repackage the pak file in 7zip by just changing the 7z file extension to .pak, but the camera seems to be rejecting the firmware as its unable to recognize the file type it says. Any ideas on how I can get this to work? I'd also be willing to pay someone to demo this for me so I could do it myself in the future. I will attach a copy of my custom pak file, but I would say there are settings not right with how it archives it again.
IPC_51516M5M.116_20103104.RLC-511W.OV05A10.5MP.WIFI1021.AF.REOLINK (2).zip

repacking the modified squashfs into a deployable firmware file

Hi,
I tried to understand the unpack script to create a "repack" script. But i am struggling with the crc calculations. Would it be generally feasible to write a scipt / tool which would re-pack a modified squashfas image to a deploymabel firmware file?
The goal is to modify the image file and upload it to the camrea without the need to have a serial connection.

regards
.andreas

Need some help with injection and repack of pak

Hello,

firstly I was able to build with buildroot on ubuntu only after following patch because

Compilation of m4 fails due to "Please port gnulib freadahead.c to your platform!"

error messages.
I spend some time till I found a soution, could be helpful for others:

in folder ~/rootfs/buildroot-2015.11.1/output/build/host-m4-1.4.17

$ sed -i 's/IO_ftrylockfile/IO_EOF_SEEN/' lib/*.c
$ echo "#define _IO_IN_BACKUP 0x100" >> lib/stdio-impl.h

Now I have some questions:
how do i repack and inject the build into the pak file to upload via gui?

output of "make" in buildroot:
rootdir=/home/user/rootfs/buildroot-2015.11.1/output/target
table='/home/user/rootfs/buildroot-2015.11.1/output/build/_device_table.txt'
/usr/bin/install -m 0644 support/misc/target-dir-warning.txt /home/user/rootfs/buildroot-2015.11.1/output/target/THIS_IS_NOT_YOUR_ROOT_FILESYSTEM

~$ sudo ./repack-reolink-rootfs.sh (how to use that shellscript?)
~$ cat /dev/mtdblock6 > /mnt/sda/mtdblock6.bin
bash: /mnt/sda/mtdblock6.bin: No such file or directory

Further tweaking

Soon as I get some time I want to play around with this. I have this camera with the same firmware, but the recording options are crippled. One can only use VBR vs CBR and cannot set the keyframe rate.

I'm led to believe the RLC-420-5MP uses the same hardware, but has these options exposed in the web interface. I've tried flashing the firmware directly but it fails. Suspecting there is some sort of check before flashing.

Just wanted to reach out in case you've already encountered this.

Thank you for your work!

Recompile newest IPC_51316M FW to discontinued C1-Pro

I have Reolink C1 Pro, which is now discontinued and have latest FW from June 2019. However, other cameras on the same HW (IPC_51316M), e.g. RLC-410 have recent December update that includes much needed Flash replacement as well as lots of other accumulated fixes from several firmware updates. Apparently Reolink doesn't want to compile any new firmware to the discontinued model.
Is it possible to download both firmwares - for my C1 Pro and the most recent for IPC-51316M, and recompile the latter one with the bootloader from my model? Or what else needs to be taken from my firmware? Could you help with some instructions please?