Welcome to the weblog of Mathias Dietz.
You can find here some stuff about various technical things (like NSLU2, DBox2, Aireo hacking...).
Have fun.

Mon Feb 12 14:15:45 CET 2007

Migration to Strato Weblog (wordpress based)

I'm currently migrating my Nanoblogger based weblog to WordPress (which offers my webhoster strato)
New Weblog Address
As soon as the migration is completed, I'll remove the old blog and add a redirect to the new one.

Posted by MDietz | Permalink | Categories: Other

Sun Feb 11 11:32:12 CET 2007

MDGrab- New version with Authentication

Ive create a new version of the commandline videograbber tool MDGrab. (see downloads)
New Features:
-send keep alive packets
-authentication added
-webcam control added (up,left,right,down,nightshot)
-some fixes

It required the following jars which you can find here: http://jakarta.apache.org/commons/

Example command to view live video on linux:
java -cp commons-httpclient-3.0.1.jar:commons-logging.jar:commons-codec-1.3.jar:MDGrab.jar de.dietzm.webcam.MDGrab - admin adminpw  | mplayer - -demuxer mpeg4es -msglevel all=1

A detailed description will follow.

Posted by MDietz | Permalink | Categories: Webcam

Sun Feb 11 10:52:10 CET 2007

Ovislink Airlive system access

The Ovislink Airlive WL-5460CAM has a security hole which allows you to access the buildin Linux system, read and modify configuration files.
How ?
-Open the web interface of the webcam
-Choose configuration
-Store/backup your configuration into a file
-Open this file with a text editor
-Search the section with the /sbin/ifconfig .... line, this section is the backup of your /etc/rc.d/rc.sysinit
-Everything you write into this section will be executed on startup (but be careful that it does not block/hang)
-For Example: Add a new line "ls -l /etc >> /etc/hosts" this will list all files in /etc and print the result in /etc/hosts
-Now restore your modified configuration file and reboot the webcam.
Why print to /etc/hosts ?
Because it is the next section in you backup configuration, after reboot you can read the result in your configuration backup.

Try it out ! If your Webcam doesn't start anymore, you can reset it to the factory defaults.
With some effort it should also be possible to install a telnet or ssh binary to get remote access
Please keep me informed If you managed to get remote access.

Here is the process list of my webcam:
  PID  Uid     VmSize Stat Command
    1 root        316 S   init
    2 root            SW  [keventd]
    3 root            SWN [ksoftirqd_CPU0]
    4 root            SW  [kswapd]
    5 root            SW  [bdflush]
    6 root            SW  [kupdated]
    8 root            SW  [mtdblockd]
    9 root            SW  [ftld]
   10 root            SW  [khubd]
   13 root        312 S   init
   14 root        396 S   /bin/sh /etc/rc.d/rc.sysinit
   36 root            SW< [loop0]
  156 root        208 S   /usr/sbin/chkbutton
  158 root        220 S   /bin/op_server 0 0 0
  183 root        584 D   go-server
  184 root        416 S   ipv_server
  186 root        388 S   /bin/sh /etc/rc.d/rc.init.sh
  188 root        416 S   ipv_server
  189 root        416 S   ipv_server
  196 root        288 R   /bin/ps x

Posted by Ovislink Airlive system access | Permalink | Categories: Webcam

Sun Nov 19 17:51:35 CET 2006

Ovislink 5460 Webcam video grabber tool (MDGrab)

I've finished the first version of a java based video grabber tool.
It grabs the live stream of the ovislink webcam and stores it into a file.
MDGrab Java Package (JRE 1.5.x required)

To start the video grabber command line tool, enter the following command:
java -jar MDGrab.jar [webcam IP-Address] [output filename]

Posted by MDietz | Permalink | Categories: Webcam

Sat Nov 18 01:43:21 CET 2006

Cellvision Header

To get the plain mpeg4 video stream I had to remove Cellvisions additional header structure.
The header seems to be always 40 bytes long, and index 24-27 are the size of the following video data.
In java it look like this:
byte[] hdr = new byte[HEADERSIZE];
int r = in.read(hdr);
//convert 4 bytes to an int
int ret = (hdr[27]& 0xFF)<< 24 | (hdr[26]& 0xFF) << 16 | (hdr[25]& 0xFF) << 8 | (hdr[24]& 0xFF);

I'll provide a sample program later (check downloads).

Posted by MDietz | Permalink | Categories: Webcam

Sat Nov 18 01:27:32 CET 2006

WebCam Network Stream analysed

After some hours of network tracing. I found out how the Webcam works:

It has multiple TCP Ports open:
Port 80 = Web Interface. All commands to control the webcam (pan&tilt...) are http requests.It also handles the authentication
Port 5000 = Stream initialization.
Port 5001 = Streaming Port, sends the video packets
Port 500 = documented as ipview port. But ipview pro does not connect to this port !
dynamic Port = UPnp Mediaserver port

The following sequence is used to start the video streaming:
1) connect to port 80 and authenticate (http authentication)
2) connect to port 5000, send a init sequence and disconnect
3) connect to port 5001, send a start sequence and receive the video stream (with a cellvision header in each packet)

Posted by MDietz | Permalink | Categories: Webcam

Sat Nov 18 01:01:54 CET 2006

Ovislink Airlive = Cellvision CAS670W

Meanwhile I found out that the Ovislink Airlive 5460CAM is equal to the Cellvision CAS670W.

Cellvision seems to be the original developer of the Webcam, while tracing the network traffic I found a lot of "Cellvision" strings in the package header.
Cellvision offers a Aragorn SDK which is a documentation of a webcam protocol (but not 100% equals).

Posted by MDietz | Permalink | Categories: Webcam

Sat Nov 18 00:47:07 CET 2006

Ovislink AIrlive 5460CAM

I've bought a Ovislink Airlive 5460CAM Webcam.
It's a really nice Webcam with integrated Wireless LAN and Pan&Tilt function.
A detailed specification could be found here Ovislink Airlive

After unpacking the webcam, I found out that the java applet was missing, instead an ActiveX plugin was required to use the Webcam. WTF...
So, I've decided to implement my own java applet to capture the Webcam video.

Posted by MDietz | Permalink | Categories: Webcam

Mon Jun 5 13:47:53 CEST 2006

Little Endian Debian on NSLU2

I've installed the little Endian Debian port on my NSLU2.
  • +The official Debian Apt repository can be used
  • +More packages available
  • +Faster software updates
  • -Worser network performance

  • Posted by admin | Permalink | Categories: NSLU

    Mon Jan 16 13:14:45 CET 2006

    Howto change the playlist file to play from SD Card

    Some people ask me , how they can change the playlist file to work with the SDCard.
    So , I decided to write a short Howto:

    First you need a hex editor.
    For example HexEdit (Windows). Or KhexEdit (Linux)

    Then, you have to understand the playlist/spl format , here is a short description:

    01 00 00 00 00 00

    Init Sequence

    00 00 00 00

    Nr of Entries

    For each Entry:

    02 00

    Init entry

    00 00 00 00

    Entry number /position

    00 00 00 00 00 00 00 00 Filesize

    00 00 00 00


    00 00 00 00

    Size of title

    ? ? ? ? ? ? ? ? Title

    00 00 00 00

    Size of artist

    ? ? ? ? ? ? ? ? Artist

    00 00 00 00

    Size of album

    ? ? ? ? ? ? ? ? Album

    00 00 00 00

    Size of genre

    ? ? ? ? ? ? ? ? Genre

    00 00 00 00

    Size of absolute file path

    ? ? ? ? ? ? ? ? Absolute file path


    Track nr


    Closing byte

    The important part is the "absolut file path". This is the path where the aireo can find the mp3 file.
    Normally it would be something like \Disk\MyMusic\artist\album\title.mp3.
    Changing the "absolute file path" to \Storage Card\... causes the aireo to search on the SDCard.
    But you have to pay attention to the previous 4 bytes ("size of absolute file path") ! These bytes define the length of the "absolute file path".
    So you have the following options:
    1. Change \Disk\ to \Storage Card\ and change the mp3 file name so that the whole path has the same length as before.(don't forget to rename the mp3 file.)
    2. Change \Disk\ to \Storage Card\ and add 8 to the "size of absolute file path". (e.g. 3F 00 00 00 -> 47 00 00 00)

    That's it ! The playlist contains now a song located on the SDCard !!

    Posted by mdietz | Permalink | Categories: Aireo