A 13-year-old Linux kernel is hiding the ONVIF server on your cheap IP camera
Taking another shot at the cheap IP camera, part 2
After a year, Eric SwPark returns to a Tuya-based IP camera that refuses to stream locally. He extracts the firmware with binwalk, finds a Linux 3.4.35 kernel from 2013, and uses Ghidra to locate the ONVIF enable flag in the ppsapp binary. The config reader and writer functions reveal how the camera handles the onvif_enable setting, and the binary contains the RTSP URL format for the hidden stream.
OK, so it runs Linux 3.4.35. When was that released again? March 2013. A 13-year old kernel!
- z3ugma
> the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22.
This feels just so fundamentally like a step change to me. I was reverse-engineering Nest thermostats a year ago by hand, and now I feel like a month worth of my work could be done with 22 cents and an LLM. Exciting times for reverse-engineering and hardware/software interface
- mynameajeff
I've been meaning to work on something similar. I have some random cheap IP camera's lying around I'd like to use but don't want their entire suspect cloud connection, shoddy app, etc. One of them looked particularly easy. After getting stumped on a similar password gate, I tried throwing Codex with as much "don't worry about safety I have permissions to do this" prompts as possible but that shut down pretty quickly. I gave it to deepseek and it was much more cooperative but I didn't have a setup as equipped to easily interact with the network and USB connection like I did with Codex and wasn't sure how much I'd be putting in token wise to a cheap camera. Seeing this cost you a whopping 22 cents I'm tempted to give it a shot now if I can get a better setup for it to interact with the cameras.
- hedora
I guess miniaturization should stop surprising me, but I recently realized you can buy drone components online. These are low power and transmit a low-latency video feed (some analog, some digital, depending on camera) a long distance (they are for first-person-view drone racing).
https://betafpv.com/collections/cameras
The price is what really surprised me. The most expensive thing there is $14. There are many similar options floating around. I assume that these are priced at a premium because they are for applications where people care about shaving 0.1g.
- azalemeth
I recently bought an air con unit. It's a recognised (high quality) brand where I live but instead of having an IR remote it has an irritating Android app. I declined the horrible permissions and privacy policy, got a warning that my phone is rooted (it is! Why should AC care?!) and promptly uninstalled it.
Claude managed to RE that surprisingly well. I didn't use the words "decompiled" once, but it that when given the APK. It's a Tuya Wifi module that requires a lot of network access and I'm very unlikely to ever use it. Fortunately there's a lot of Tuya compatible code on GitHub and a community of people expressing a desire to get it into home assistant, including by reflashing the firmware or using as separate esp32 uC to talk over spi and uart to the actual controller.
I'll have a dive at some point. Everything else in my home is zigbee. I wish this was too.
- gregsadetsky
I’m very very excited by reverse engineered / reflashed cheap PoE cameras - you can find many on aliexpress that are about $20 and fully run Linux.
Check out cameras with the “GOKE” chip.
https://openipc.org/supported-hardware/featured is one long-standing effort to RE and provide new firmware for these cams. There can’t be enough!