Welcome to the weblog of Mathias Dietz.
You can find here some stuff about various technical things (like NSLU2, DBox2, Aireo hacking...).
Have fun.
You can find here some stuff about various technical things (like NSLU2, DBox2, Aireo hacking...).
Have fun.
Mon Feb 12 14:15:45 CET 2007
Migration to Strato Weblog (wordpress based)
I'm currently migrating my Nanoblogger based weblog to WordPress (which offers my webhoster strato)
New Weblog Address
As soon as the migration is completed, I'll remove the old blog and add a redirect to the new one.
New Weblog Address
As soon as the migration is completed, I'll remove the old blog and add a redirect to the new one.
Sun Feb 11 11:32:12 CET 2007
MDGrab- New version with Authentication
Ive create a new version of the commandline videograbber tool MDGrab. (see downloads)
New Features:
-send keep alive packets
-authentication added
-webcam control added (up,left,right,down,nightshot)
-some fixes
It required the following jars which you can find here: http://jakarta.apache.org/commons/
-commons-logging
-commons-httpclient
-commons-codecs
Example command to view live video on linux:
A detailed description will follow.
New Features:
-send keep alive packets
-authentication added
-webcam control added (up,left,right,down,nightshot)
-some fixes
It required the following jars which you can find here: http://jakarta.apache.org/commons/
-commons-logging
-commons-httpclient
-commons-codecs
Example command to view live video on linux:
java -cp commons-httpclient-3.0.1.jar:commons-logging.jar:commons-codec-1.3.jar:MDGrab.jar de.dietzm.webcam.MDGrab 192.168.0.55 - admin adminpw | mplayer - -demuxer mpeg4es -msglevel all=1
A detailed description will follow.
Sun Feb 11 10:52:10 CET 2007
Ovislink Airlive system access
The Ovislink Airlive WL-5460CAM has a security hole which allows you to access the buildin Linux system, read and modify
configuration files.
How ?
-Open the web interface of the webcam
-Choose configuration
-Store/backup your configuration into a file
-Open this file with a text editor
-Search the section with the /sbin/ifconfig .... line, this section is the backup of your /etc/rc.d/rc.sysinit
-Everything you write into this section will be executed on startup (but be careful that it does not block/hang)
-For Example: Add a new line "ls -l /etc >> /etc/hosts" this will list all files in /etc and print the result in /etc/hosts
-Now restore your modified configuration file and reboot the webcam.
Why print to /etc/hosts ?
Because it is the next section in you backup configuration, after reboot you can read the result in your configuration backup.
Try it out ! If your Webcam doesn't start anymore, you can reset it to the factory defaults.
With some effort it should also be possible to install a telnet or ssh binary to get remote access
Please keep me informed If you managed to get remote access.
Here is the process list of my webcam:
How ?
-Open the web interface of the webcam
-Choose configuration
-Store/backup your configuration into a file
-Open this file with a text editor
-Search the section with the /sbin/ifconfig .... line, this section is the backup of your /etc/rc.d/rc.sysinit
-Everything you write into this section will be executed on startup (but be careful that it does not block/hang)
-For Example: Add a new line "ls -l /etc >> /etc/hosts" this will list all files in /etc and print the result in /etc/hosts
-Now restore your modified configuration file and reboot the webcam.
Why print to /etc/hosts ?
Because it is the next section in you backup configuration, after reboot you can read the result in your configuration backup.
Try it out ! If your Webcam doesn't start anymore, you can reset it to the factory defaults.
With some effort it should also be possible to install a telnet or ssh binary to get remote access
Please keep me informed If you managed to get remote access.
Here is the process list of my webcam:
PID Uid VmSize Stat Command
1 root 316 S init
2 root SW [keventd]
3 root SWN [ksoftirqd_CPU0]
4 root SW [kswapd]
5 root SW [bdflush]
6 root SW [kupdated]
8 root SW [mtdblockd]
9 root SW [ftld]
10 root SW [khubd]
13 root 312 S init
14 root 396 S /bin/sh /etc/rc.d/rc.sysinit
36 root SW< [loop0]
156 root 208 S /usr/sbin/chkbutton
158 root 220 S /bin/op_server 0 0 0
183 root 584 D go-server
184 root 416 S ipv_server
186 root 388 S /bin/sh /etc/rc.d/rc.init.sh
188 root 416 S ipv_server
189 root 416 S ipv_server
196 root 288 R /bin/ps x
Sun Nov 19 17:51:35 CET 2006
Ovislink 5460 Webcam video grabber tool (MDGrab)
I've finished the first version of a java based video grabber tool.
It grabs the live stream of the ovislink webcam and stores it into a file.
MDGrab Java Package (JRE 1.5.x required)
To start the video grabber command line tool, enter the following command:
java -jar MDGrab.jar [webcam IP-Address] [output filename]
It grabs the live stream of the ovislink webcam and stores it into a file.
MDGrab Java Package (JRE 1.5.x required)
To start the video grabber command line tool, enter the following command:
java -jar MDGrab.jar [webcam IP-Address] [output filename]
Sat Nov 18 01:43:21 CET 2006
Cellvision Header
To get the plain mpeg4 video stream I had to remove Cellvisions additional header structure.
The header seems to be always 40 bytes long, and index 24-27 are the size of the following video data.
In java it look like this:
byte[] hdr = new byte[HEADERSIZE];
int r = in.read(hdr);
//convert 4 bytes to an int
int ret = (hdr[27]& 0xFF)<< 24 | (hdr[26]& 0xFF) << 16 | (hdr[25]& 0xFF) << 8 | (hdr[24]& 0xFF);
I'll provide a sample program later (check downloads).
The header seems to be always 40 bytes long, and index 24-27 are the size of the following video data.
In java it look like this:
byte[] hdr = new byte[HEADERSIZE];
int r = in.read(hdr);
//convert 4 bytes to an int
int ret = (hdr[27]& 0xFF)<< 24 | (hdr[26]& 0xFF) << 16 | (hdr[25]& 0xFF) << 8 | (hdr[24]& 0xFF);
I'll provide a sample program later (check downloads).
Sat Nov 18 01:27:32 CET 2006
WebCam Network Stream analysed
After some hours of network tracing. I found out how the Webcam works:

It has multiple TCP Ports open:
Port 80 = Web Interface. All commands to control the webcam (pan&tilt...) are http requests.It also handles the authentication
Port 5000 = Stream initialization.
Port 5001 = Streaming Port, sends the video packets
Port 500 = documented as ipview port. But ipview pro does not connect to this port !
dynamic Port = UPnp Mediaserver port
The following sequence is used to start the video streaming:
1) connect to port 80 and authenticate (http authentication)
2) connect to port 5000, send a init sequence and disconnect
3) connect to port 5001, send a start sequence and receive the video stream (with a cellvision header in each packet)

It has multiple TCP Ports open:
Port 80 = Web Interface. All commands to control the webcam (pan&tilt...) are http requests.It also handles the authentication
Port 5000 = Stream initialization.
Port 5001 = Streaming Port, sends the video packets
Port 500 = documented as ipview port. But ipview pro does not connect to this port !
dynamic Port = UPnp Mediaserver port
The following sequence is used to start the video streaming:
1) connect to port 80 and authenticate (http authentication)
2) connect to port 5000, send a init sequence and disconnect
3) connect to port 5001, send a start sequence and receive the video stream (with a cellvision header in each packet)
Sat Nov 18 01:01:54 CET 2006
Ovislink Airlive = Cellvision CAS670W
Meanwhile I found out that the Ovislink Airlive 5460CAM is equal to the Cellvision CAS670W.

Cellvision seems to be the original developer of the Webcam, while tracing the network traffic I found a lot of "Cellvision" strings in the package header.
Cellvision offers a Aragorn SDK which is a documentation of a webcam protocol (but not 100% equals).

Cellvision seems to be the original developer of the Webcam, while tracing the network traffic I found a lot of "Cellvision" strings in the package header.
Cellvision offers a Aragorn SDK which is a documentation of a webcam protocol (but not 100% equals).
Sat Nov 18 00:47:07 CET 2006
Ovislink AIrlive 5460CAM
I've bought a Ovislink Airlive 5460CAM Webcam.
It's a really nice Webcam with integrated Wireless LAN and Pan&Tilt function.
A detailed specification could be found here Ovislink Airlive
After unpacking the webcam, I found out that the java applet was missing, instead an ActiveX plugin was required to use the Webcam. WTF...
So, I've decided to implement my own java applet to capture the Webcam video.
It's a really nice Webcam with integrated Wireless LAN and Pan&Tilt function.
A detailed specification could be found here Ovislink Airlive
After unpacking the webcam, I found out that the java applet was missing, instead an ActiveX plugin was required to use the Webcam. WTF...
So, I've decided to implement my own java applet to capture the Webcam video.
Mon Jun 5 13:47:53 CEST 2006
Little Endian Debian on NSLU2
I've installed the little Endian Debian port on my NSLU2.
Summary:
+The official Debian Apt repository can be used
+More packages available
+Faster software updates
-Worser network performance
Summary:
Mon Jan 16 13:14:45 CET 2006
Howto change the playlist file to play from SD Card
Some people ask me , how they can change the playlist file to work with the SDCard.
So , I decided to write a short Howto:
First you need a hex editor.
For example HexEdit (Windows). Or KhexEdit (Linux)
Then, you have to understand the playlist/spl format , here is a short description:
The important part is the "absolut file path". This is the path where the aireo can find the mp3 file.
Normally it would be something like \Disk\MyMusic\artist\album\title.mp3.
Changing the "absolute file path" to \Storage Card\... causes the aireo to search on the SDCard.
But you have to pay attention to the previous 4 bytes ("size of absolute file path") ! These bytes define the length of the "absolute file path".
So you have the following options:
1. Change \Disk\ to \Storage Card\ and change the mp3 file name so that the whole path has the same length as before.(don't forget to rename the mp3 file.)
2. Change \Disk\ to \Storage Card\ and add 8 to the "size of absolute file path". (e.g. 3F 00 00 00 -> 47 00 00 00)
That's it ! The playlist contains now a song located on the SDCard !!
So , I decided to write a short Howto:
First you need a hex editor.
For example HexEdit (Windows). Or KhexEdit (Linux)
Then, you have to understand the playlist/spl format , here is a short description:
| Header | |||||||||||||||||||||||||||||||||||||||
| 01 | 00 | 00 | 00 | 00 | 00 | Init Sequence | |||||||||||||||||||||||||||||||||
| 00 | 00 | 00 | 00 | Nr of Entries | |||||||||||||||||||||||||||||||||||
| For each Entry: | |||||||||||||||||||||||||||||||||||||||
| 02 | 00 | Init entry | |||||||||||||||||||||||||||||||||||||
| 00 | 00 | 00 | 00 | Entry number /position | |||||||||||||||||||||||||||||||||||
| 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | Filesize | |||||||||||||||||||||||||||||||
| 00 | 00 | 00 | 00 | Playtime | |||||||||||||||||||||||||||||||||||
| 00 | 00 | 00 | 00 | Size of title | |||||||||||||||||||||||||||||||||||
| ? | ? | ? | ? | ? | ? | ? | ? | Title | |||||||||||||||||||||||||||||||
| 00 | 00 | 00 | 00 | Size of artist | |||||||||||||||||||||||||||||||||||
| ? | ? | ? | ? | ? | ? | ? | ? | Artist | |||||||||||||||||||||||||||||||
| 00 | 00 | 00 | 00 | Size of album | |||||||||||||||||||||||||||||||||||
| ? | ? | ? | ? | ? | ? | ? | ? | Album | |||||||||||||||||||||||||||||||
| 00 | 00 | 00 | 00 | Size of genre | |||||||||||||||||||||||||||||||||||
| ? | ? | ? | ? | ? | ? | ? | ? | Genre | |||||||||||||||||||||||||||||||
| 00 | 00 | 00 | 00 | Size of absolute file path | |||||||||||||||||||||||||||||||||||
| ? | ? | ? | ? | ? | ? | ? | ? | Absolute file path | |||||||||||||||||||||||||||||||
| 00 | Track nr | ||||||||||||||||||||||||||||||||||||||
| 00 | Closing byte |
The important part is the "absolut file path". This is the path where the aireo can find the mp3 file.
Normally it would be something like \Disk\MyMusic\artist\album\title.mp3.
Changing the "absolute file path" to \Storage Card\... causes the aireo to search on the SDCard.
But you have to pay attention to the previous 4 bytes ("size of absolute file path") ! These bytes define the length of the "absolute file path".
So you have the following options:
1. Change \Disk\ to \Storage Card\ and change the mp3 file name so that the whole path has the same length as before.(don't forget to rename the mp3 file.)
2. Change \Disk\ to \Storage Card\ and add 8 to the "size of absolute file path". (e.g. 3F 00 00 00 -> 47 00 00 00)
That's it ! The playlist contains now a song located on the SDCard !!