Mathias Dietz Weblog

Ive create a new version of the commandline videograbber tool MDGrab. (see downloads)
New Features:
-send keep alive packets
-authentication added
-webcam control added (up,left,right,down,nightshot)
-some fixes

It required the following jars which you can find here: http://jakarta.apache.org/commons/
-commons-logging
-commons-httpclient
-commons-codecs

Example command to view live video on linux:

java -cp
commons-httpclient-3.0.1.jar:commons-logging.jar:commons-codec-1.3.jar:MDGrab.jar
de.dietzm.webcam.MDGrab 192.168.0.55 - admin adminpw | mplayer - -demuxer mpeg4es -msglevel all=1

A detailed description will follow.

The Ovislink Airlive WL-5460CAM has a security hole which allows you to access the buildin Linux system, read and modify
configuration files.
How ?
-Open the web interface of the webcam
-Choose configuration
-Store/backup your configuration into a file
-Open this file with a text editor
-Search the section with the /sbin/ifconfig …. line, this section is the backup of your /etc/rc.d/rc.sysinit
-Everything you write into this section will be executed on startup (but be careful that it does not block/hang)
-For Example: Add a new line “ls -l /etc >> /etc/hosts” this will list all files in /etc and print the result in /etc/hosts
-Now restore your modified configuration file and reboot the webcam.
Why print to /etc/hosts ?

Because it is the next section in you backup configuration, after reboot you can read the result in your configuration backup.

Try it out ! If your Webcam doesn’t start anymore, you can reset it to the factory defaults.
With some effort it should also be possible to install a telnet or ssh binary to get remote access
Please keep me informed If you managed to get remote access.

Here is the process list of my webcam:

  PID  Uid     VmSize Stat Command
    1 root        316 S   init
    2 root            SW  [keventd]
    3 root            SWN [ksoftirqd_CPU0]
    4 root            SW  [kswapd]
    5 root            SW  [bdflush]
    6 root            SW  [kupdated]
    8 root            SW  [mtdblockd]
    9 root            SW  [ftld]
   10 root            SW  [khubd]
   13 root        312 S   init
   14 root        396 S   /bin/sh /etc/rc.d/rc.sysinit
   36 root            SW< [loop0]
  156 root        208 S   /usr/sbin/chkbutton
  158 root        220 S   /bin/op_server 0 0 0
  183 root        584 D   go-server
  184 root        416 S   ipv_server
  186 root        388 S   /bin/sh /etc/rc.d/rc.init.sh
  188 root        416 S   ipv_server
  189 root        416 S   ipv_server
  196 root        288 R   /bin/ps x

I’ve finished the first version of a java based video grabber tool.
It grabs the live stream of the ovislink webcam and stores it into a file.
MDGrab Java Package (JRE 1.5.x required)

To start the video grabber command line tool, enter the following command:
java -jar MDGrab.jar [webcam IP-Address] [output filename]

To get the plain mpeg4 video stream I had to remove Cellvisions additional header structure.
The header seems to be always 40 bytes long, and index 24-27 are the size of the following video data.
In java it look like this:

byte[] hdr = new byte[HEADERSIZE];
int r = in.read(hdr);
//convert 4 bytes to an int
int ret = (hdr[27]& 0xFF)<< 24 | (hdr[26]& 0xFF) << 16 | (hdr[25]& 0xFF) << 8 | (hdr[24]& 0xFF);


I’ll provide a sample program later (check downloads).

After some hours of network tracing. I found out how the Webcam works:

It has multiple TCP Ports open:

Port 80 = Web Interface. All commands to control the webcam (pan&tilt…) are http requests.It also handles the authentication
Port 5000 = Stream initialization.
Port 5001 = Streaming Port, sends the video packets
Port 500 = documented as ipview port. But ipview pro does not connect to this port !
dynamic Port = UPnp Mediaserver port

The following sequence is used to start the video streaming:
1) connect to port 80 and authenticate (http authentication)
2) connect to port 5000, send a init sequence and disconnect
3) connect to port 5001, send a start sequence and receive the video stream (with a cellvision header in each packet)

Meanwhile I found out that the Ovislink Airlive 5460CAM is equal to the Cellvision CAS670W.

Cellvision seems to be the original developer of the Webcam, while tracing the network traffic I found a lot
of “Cellvision” strings in the package header.
Cellvision offers a Aragorn SDK which is a documentation of a webcam protocol (but not 100% equals).

I’ve bought a Ovislink Airlive 5460CAM Webcam.
It’s a really nice Webcam with integrated Wireless LAN and Pan&Tilt
function.
A detailed specification could be found here Ovislink Airlive

After unpacking the webcam, I found out that the java applet was missing, instead an ActiveX plugin was
required to use the Webcam. WTF…
So, I’ve decided to implement my own java applet to capture the Webcam video.