Windows-only IP camera on linux

I got a nice panning VGA camera for £69.00, but it’s one of those cameras from hell that only supports internet explorer on windows and crashes windows a lot.

As far as I can tell generically it is an SQ IP Cam or a GP-280 IP Camera.

I want to use it on linux, so out comes ethereal to do some packet sniffing and here is what I get:

I can get a video stream (special header and concatenated JPEG’s) with this URL:

http://192.168.1.69/cgi-bin/Stream?Video?Acc=USERNAME?Pwd=PASSWORD?webcamPWD=RookCookies00000

Possibly the RootCookies bit is important, perhaps related to a login that occurred earlier.

I can move the camera wth:
http://192.168.1.69/motor_control_right?webcamPWD=RootCookie00000

http://192.168.1.69/motor_control_left?webcamPWD=RootCookie00000

http://192.168.1.69/motor_control_up?webcamPWD=RootCookie00000

http://192.168.1.69/motor_control_down?webcamPWD=RootCookie00000

For horizontal and vertical centre

http://192.168.1.69/motor_control_auto_h?webcamPWD=RootCookie00000

http://192.168.1.69/motor_control_auto_v?webcamPWD=RootCookie00000

Full centre

http://192.168.1.69/motor_control_center?webcamPWD=RootCookie00000

To stop

http://192.168.1.69/motor_control_stop?webcamPWD=RootCookie00000

The special header on the video stream is a 40 byte header. I’m expecting certain values so they were easy to find:

Stream Header

Offset	Format	Data
0×16-0×17	16 bit integer LSB	size of jpeg in bytes, or in other words, the number of bytes to read after this header before the start of the next header
0×1a-0×1b	16 bit integer LSB	jpeg width in pixels
0×1c-0×1d	16 bit integer LSB	jpeg height in pixels
0×28-	Start of JPEG header

So stripping off the first 40 byte with
dd if=stream of=1.jpeg bs=1 skip=40

leaves me a jpeg (with loads more jpegs on the end, ech prefixed by the same 28 byte header).

So I can control the camera and rip video from it, now to make it like zoneminder.

UPDATE:

I can watch a video stream with VLC using:

wget -O /dev/stdout http://192.168.1.69/cgi-bin/Stream?Video?Acc=USERNAME?Pwd=PASSWORD?webcamPWD=RookCookies00000 |dd  skip=40 bs=1 | vlc -

I modified axmjpeg so it can split images from my camera too.

Update: 20 Sept 2007
This patch has been reworked applied to the standard axmjpeg project. (a while ago!)

This script can be used to control the camera from zoneminder:

#! /bin/bash
preset=home
presets="nothing motor_control_auto_h motor_control_auto_v motor_control_stop motor_control_center"

while test -n "$1"
do
  case "$1" in
    --address=*) address="${1##--address=}";;
    --address)   address="$2"; shift;;
    --command=*) command="${1##--command=}";;
    --command)   command="$2"; shift;;
    --preset=*)  preset="${1##--command=}";;
    --preset)    preset="$2"; shift;;
  esac
  shift;
done

url_base="http://$address/"
url_tail="?webcamPWD=RootCookie00000"

case "$command" in
  # home goto
  preset_home) url_command="motor_control_center";;
  preset_goto) set $presets; shift "$preset"; url_command="$1";;
  # right left down up
  move_rel_*) url_command="motor_control_${command##move_rel_}" ;;
esac

url="$url_base$url_command$url_tail"
wget -O /dev/null "$url" 2>/dev/null

UPDATE snapshot

I found a URL that can be used for a single snapshot (based on this http://ultradigital.freshdesk.com/support/solutions/articles/77478-comment-acc-der-au-flux-vid-o-d-une-cam-ra-ip-9060-i-9060-o-ou-9060a-mp):

http://192.168.1.69/snapshot.jpg?account=admin&password=password

Also related source code here: http://read.pudn.com/downloads65/sourcecode/internet/webserver/235705/Net_apps/httpd/api/HttpFileSystem.c__.htm

UPDATE streaming

I can play the stream like this:

ffplay -f mjpeg -probesize 40 -i 'http://192.168.1.69/cgi-bin/Stream?Video?Acc=admin?Pwd=password?webcamPWD=RookCookies00000&f=file.mjpg'

tip from http://www.lavrsen.dk/foswiki/bin/view/Motion/MplayerMjpegStreamViewing

but it seems more reliable to use axmjpeg to remove the extra data and output just a concatenation of jpegs:

axmjpeg -N -o /dev/stdout  'http://192.168.1.69/cgi-bin/Stream?Video?Acc=admin?Pwd=password?webcamPWD=RookCookies00000' | ffplay -f mjpeg /dev/stdin