Tuesday, April 5, 2016

Let's hack the Xiaomi Yi (Ants) camera

Reason:
Cloud based cameras are expensive and Xiaomi cameras are a worthy substitute

Eqipment:
- Xiaomi Yi camera with night vison (US version) - from amazon
- Xiaomi Yi camera (CN version) - from gearbest
- Note: there are non IR versions of this camera, be sure to check first

Goal: 
Get RSTP working with US firmware and let the camera app still work.

Background:
The Xiaomi Yi camera (not the action version) is a great little IP based camera. When it first came out you could use it to stream RSTP sessions to any capable device. In subsequent firmware releases this was disabled and you now had to use their apps to view your camera. The apps are still required to change the settings such as activity light and IR settings. There are apps for the US and CN version, and the CN version wants you to create a my MI account. When you sign in, be sure to choose "Chinese Mainland" so you can select the camera. As of firmware v1.8.5 you can still do this, but if you go to v1.8.6 then the camera complains that "this camera is for China only" and not allow you to do anything else. Most people should just get the US version and pay a few dollars more to avoid this hassle. Lessons learned...

The Hack:
Lots of googling and trying different firmware versions led me to understand that there are two parts to solve. 1) getting the right firmware on there to let it talk to the right app, and 2) getting a script and the RSTP binary deployed to enable the stream once more. The firmware is easy, it's available on the Xiaomi website. In case someone from the future reads this I will try to assemble some links to download the packages.  As of this writing the v1.8.5N version is the latest that works with their app. Which reminds me to not allow the app to update the camera if you have RSTP enabled.

Go through the configuration process as usual to get your camera connected to the WiFi and app. Once you can see the camera is available, you are ready. I can't vouch for the future of how this might change so I make no claims that any of this will still work - or brick your camera so beware.

You will need a microsd card to put the firmware on. Name the firmware "home". Next you will create a "test" folder in which you will put the script and the RSTP binaries. The script will enable telnet and ftp, as well as put the appropriate binary on the device. Credit goes to http://en.miui.com/thread-137413-1-1.html for the script. I only updated it to allow for the N firmware.

Insert the card and start up the camera. This will take a long time, but hopefully you will be able to see the camera come back to your app, this time with RSTP available. the RSTP channel will be on: <IP>:554/ch0_0.h264

Verdict: WORKS. 
- RSTP works with my IP camera security software as well as my app.
- Caveats:
  - US and CN versions require different apps

Resources:
- http://xiaoyi.querex.be/ - for firmware
- http://en.miui.com/thread-137413-1-1.html - for enabling RSTP on later firmware