YooSee SD-M5 doorbell: 1080p, PoE, RTSP, Onvif, only $66

Ryco

n3wb
Joined
Nov 9, 2019
Messages
9
Reaction score
0
Location
Bc canada
Thank you. It's 有 and it means 'have'.

The strangest thing happened yesterday: whenever I start the CMSClient software and try to obtain the IP config it always comes back with 'password error' but one time, and one time, it suddenly did return the IP config and I was also able to click the Password button and set a new password. After that the IPCTestTool showed the same Chinese character as in your screenshot.

Not that it made any difference. I was still unable to see any of the ONVIF details in ONVIF Device Manager (v 2.2.250) for instance. At some point I rebooted the camera in IPCTestTool and it wouldn't come back on so I did a hard reset on the device itself. After the 'hass password' column in IPCTestTool was empty again.

Anyway, it looks as if I can get the videostream from the device without setting a password. This works in BlueIris, IPCTestTool and contrary to what I said before also in CMSClient because I found out that if I double-click the manually added camera it does show the video stream from it.

I also tried setting the password today from IPCTestTool with the 制 作 烧 录 文 件 popup menu entry but that doesn't seem to work.

I did capture the network traffic when I was setting the password with CMSClient but it's not easily decodable. At the moment I cannot do any further experiments because CMSClient is refusing to start and I don't want to reboot the PC remotely (it's at the office).

When I get back there I will reboot and continue my experiments. One thing I want to do is setup a mirror port on my switch and capture all traffic between the camera and everything else to see if there is something it tries to connect to when pressing the doorbell, although it's quite possible it will only try to do that after setting a password or after it has already connected to the cloud server.
This is interesting. My CMSClient has never been able to connect to get the IP information. I used the Yoosee app before I tried the CMSClient, so it might have set a password then.

How are you doing a hard reset on the device?

Ryan
 

Ryco

n3wb
Joined
Nov 9, 2019
Messages
9
Reaction score
0
Location
Bc canada
Did a factory reset and no longer says anything in the Password column of IPCTestTool.
 

whoami ™

Pulling my weight
Joined
Aug 4, 2019
Messages
229
Reaction score
222
Location
South Florida
It's not looking like this cam has a open telnet port... I'm a little disappointed... :(
Code:
Nmap scan report for 192.168.0.107
Host is up, received arp-response (0.0023s latency).
Scanned at 2019-11-09 22:34:14 EST for 154s
Not shown: 998 closed ports
Reason: 998 resets
PORT     STATE SERVICE REASON         VERSION
554/tcp  open  rtsp?   syn-ack ttl 64
|_rtsp-methods: OPTIONS, DESCRIBE, SETUP, TEARDOWN, PLAY, PAUSE, GET_PARAMETER, SET_PARAMETER,USER_CMD_SET
5000/tcp open  upnp?   syn-ack ttl 64
MAC Address: 4C:B0:08:D3:19:55 (Shenzhen Gwelltimes Technology)
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.10
Code:
root@kalihost:~# nmap -p1-65535 192.168.0.107
Starting Nmap 7.70 ( https://nmap.org ) at 2019-11-09 22:51 EST
Nmap scan report for 192.168.0.107
Host is up (0.0042s latency).
Not shown: 65533 closed ports
PORT     STATE SERVICE
554/tcp  open  rtsp
5000/tcp open  upnp
MAC Address: 4C:B0:08:D3:19:55 (Shenzhen Gwelltimes Technology)

Nmap done: 1 IP address (1 host up) scanned in 8.95 seconds
 
Last edited:

Ryco

n3wb
Joined
Nov 9, 2019
Messages
9
Reaction score
0
Location
Bc canada
Worked on it a bit more tonight. If you do a factory reset on the camera (hold down reset button for 10 seconds when it is booted up), it does reset the password to blank. You can then go into the newest version on CMS v1.0.0.53_0 and configure the passwords and put a static ip on it. If you change the password, Yoosee will not let you connect. If you leave the passwords blank, once Yoosee connects, it does set a password on the camera, but the nice part is it left the static IP. So at least now I have a static IP on the camera. It also let me keep rtsp running with out a password.
 

SecuritySeeker

Pulling my weight
Joined
Oct 5, 2018
Messages
266
Reaction score
156
Location
Netherlands
Yes probably. Once you use the Yoosee app, in the RTSP setting it forces you to set a password. You can not leave it blank.
Without setting a password it will also accept

rtsp:/admin:123@192.168.178.38:554/onvif1

but it clearly knows this is the default password and not one set by the user.

I just ran CMSClient on another PC and this time it found one of my two YooSee doorbells (got one in black and one in white). I set the passwords and now I do have to enter the username : password in VLC. However, if I use ONVIF Device Manager it can still connect and show streaming video without entering the username/password! And also if I do enter the username/password. And I just tried again in VLC and now it also works without username : password. Pretty weird.

Can your or anyone else check if in OnVIF Device Manager you can view the Identification, Time settings, Maintentance, Network settings etc? This works fine on my Dahua cams but not with the YooSee, not even after setting a password.
 
Last edited:

SecuritySeeker

Pulling my weight
Joined
Oct 5, 2018
Messages
266
Reaction score
156
Location
Netherlands
制作烧录文件 refers to firmware updates, so it doesn't seem related to password settings.
Could it be that this option somehow allows you to produce a firmware update image file containing a pre-defined username and password? Then you could take that and update the firmware of the device. Just guessing wildly here.
 

whoami ™

Pulling my weight
Joined
Aug 4, 2019
Messages
229
Reaction score
222
Location
South Florida
here is the configuration info I pulled from the SD-M5 using the Yoosee_IPC_TEST_TOOL_DEBUG_UTILITY v.V01.00.00.59

So it sounds like some how there has to be a way into the Linux OS its running & there has to be a way to change these values..

Code:
SoundPromptOpt = 1
MicInVolume = 62
LoudSpeakerVolume = 115
OpenLockTime_ms = 2500
fang_chai_support = 1
Door_Bell_Send_Counter = 2
DrBlLedPrompt = 15
net_time_sync = 1
misc_config0 = 1207959859
misc_config1 = 2147549508
8188_Support_Voicelink_In_Ap = 1
Ap_Mode_Support = 1
Door_Bell_Support = 1
gpio_ctrl_support = 1
PreRecordSupport = 1
KeyAoVolLeve = 2
md_level = 5
Set_MD_Level_Support = 1
user_sel_clearOpt = 4
RemotlySetNetwork = 1
DBWaitSoundEnable = 1
AlarmPathPushSuppport = 1
Change_Wifi_Mode_Key_Disable = 1
ircut_with_adc_support = 1
adc_setting_val= 100060
DonotDetectOpenLockButton = 1
RtspAuthentication = 1
RtspUseNewMethodForPwd = 1
 
Last edited:

kriboogh

n3wb
Joined
Nov 10, 2019
Messages
2
Reaction score
3
Location
Belgium
Hi, new here. I registered because I bought one of these (after reading this thread). It's working, I also got it hooked up to a "RX-Multi RF module". You need to set the 5th jumper=universal rolling code 433Mhz and then you can use channel 1 on the module for the doorbel button, and channel 2 for the "doorlock" command. Anyway, I'm now trying to get the camera feed into my smart home soft (loxone). Only problem is, it needs a MJPEG stream and I would need the external url (not the local IP). Any of you know how I could hack that? (Audio would be cool to, but then I need a SIP url).
 

SecuritySeeker

Pulling my weight
Joined
Oct 5, 2018
Messages
266
Reaction score
156
Location
Netherlands
Hi, new here. I registered because I bought one of these (after reading this thread). It's working, I also got it hooked up to a "RX-Multi RF module". You need to set the 5th jumper=universal rolling code 433Mhz and then you can use channel 1 on the module for the doorbel button, and channel 2 for the "doorlock" command.
That's great. Would you mind sharing the exact model number and a link where you purchased the RX-Multi RF module? I found something through Google but I'm not sure it's the exact same thing (although it probably doesn't matter).

Anyway, I'm now trying to get the camera feed into my smart home soft (loxone). Only problem is, it needs a MJPEG stream and I would need the external url (not the local IP). Any of you know how I could hack that?
What do you mean by external url, that of the cloudserver/p2p infrastructure it connects to?

If you have a managed switch you could mirror the port it's connected to and use Wireshark on the mirroring port to see the connections it makes but I'm not sure what you are hoping to accomplish by this. I don't know if the YooSee support MJPEG but if not I think you would have to use PC software or something like that to take the incoming H264 stream and re-transmit it as MJPEG.

(Audio would be cool to, but then I need a SIP url).
The YooSee does not support SIP, it looks like the 2-way audio interface is proprietary and can only be used through the YooSee App on a smartphone. I thought I saw an option for 2-way sound in the CMS Client software but cannot find it now so maybe I'm remembering incorrectly.
 
Last edited:

myasus

n3wb
Joined
Nov 8, 2019
Messages
1
Reaction score
0
Location
USA
Bought this with chime today:
It is on sale today. You can clip $2 off every $15 and paypal $4 off. My total was $57 with all coupons (including tax).
 

kriboogh

n3wb
Joined
Nov 10, 2019
Messages
2
Reaction score
3
Location
Belgium
That's great. Would you mind sharing the exact model number and a link where you purchased the RX-Multi RF module? I found something through Google but I'm not sure it's the exact same thing (although it probably doesn't matter).
I bought it on aliexpress, don't have the reference anymore which seller it was, but if you search "RX Multi RF" you will find plenty. Attached is an picture of it. You basically hook it up to 9-30vdc, engage the 5th jumper, press a channel button for 3s and while the led is blinking, you press the doorbell button. Same goes for the lock control command.

What do you mean by external url, that of the cloudserver/p2p infrastructure it connects to?
Loxone asks for a local and external url. I will try to monitor traffic to see how it connects.
 

Attachments

SecuritySeeker

Pulling my weight
Joined
Oct 5, 2018
Messages
266
Reaction score
156
Location
Netherlands
I bought it on aliexpress, don't have the reference anymore which seller it was, but if you search "RX Multi RF" you will find plenty. Attached is an picture of it. You basically hook it up to 9-30vdc, engage the 5th jumper, press a channel button for 3s and while the led is blinking, you press the doorbell button. Same goes for the lock control command.
That looks just like the one I found, thanks.

Loxone asks for a local and external url. I will try to monitor traffic to see how it connects.
Check out this, similar problem with a solution:

 

whoami ™

Pulling my weight
Joined
Aug 4, 2019
Messages
229
Reaction score
222
Location
South Florida
I can't get the SD-M5 to stay at 15fps in Blue Iris. Ive tried too many things to list. It seems as soon as motion is detected, even though motion detection has been disabled using the app, it drops from >15fps to 5fps. Only way to get it back to 15fps is to restart cam. Anyone else run into this?
 

SecuritySeeker

Pulling my weight
Joined
Oct 5, 2018
Messages
266
Reaction score
156
Location
Netherlands
It seems as soon as motion is detected, even though motion detection has been disabled using the app, it drops from >15fps to 5fps.
I don't have a smartphone so mine is running with whatever the defaults are and just with the rtsp stream going to BI or CMS Client or VLC (or all three) but I haven't noticed fps dropping.
 

SecuritySeeker

Pulling my weight
Joined
Oct 5, 2018
Messages
266
Reaction score
156
Location
Netherlands
I tried the USB chime today, was able to pair it without problem. I had hoped (but did not expect) that the signal would go from the groundlevel to two floors up but no such luck. No real surprise as it has to travel through two thick reinforced concrete floors.

By the way the only ringing sound I find acceptable is the default one. The rest sucks, is cheesy and mostly badly out of tune.
 
Last edited:

SecuritySeeker

Pulling my weight
Joined
Oct 5, 2018
Messages
266
Reaction score
156
Location
Netherlands
Whats the default RSTP passwd? Without setting one up in the app?
It seems to accept absolutely anything: any username, any password, including blank for both. There's a 'Has password' column in IPCTestTool which clearly shows whether a password has been set (through the app) or not. As long as that column is empty instead of showing 有 ('Have') the above should apply.

Interestingly, the CMSClient software found both my doorbells today without any problem multiple times.
 

SecuritySeeker

Pulling my weight
Joined
Oct 5, 2018
Messages
266
Reaction score
156
Location
Netherlands
Here's a snapshot of a direct comparison between the YooSee MD-5 doorbell and a Dahua IPC-HDBW4231F-AS (mini wedge dome):

YooSee MD-5 vs Dahua IPC-HDBW4231F-AS.png

The license plate is roughly at 6.5m / 21ft 4 inches and is 11 cm / 4.3 inches heigh. Both are using the default settings.

I did not adjust/correct the focus of the YooSee, the two that I received seem to be reasonably focussed out of the box. The YooSee has a slightly wider viewing angle than the Dahua so the YooSee image is a bit smaller.

To my eyes it seems that the Dahua is applying a more agressive sharpening to the image, resulting in halos around the letters and numbers of the license plate. Also check out the holes in the moving boxes, they look distorted on the Dahua. The picture of the YooSee seems a bit more true to life as it is suffering less from this sort of 'enhancement':

YooSee MD-5 vs Dahua IPC-HDBW4231F-AS.png


I will try to do a direct comparison between the YooSee and a IPC-HDW5231R-ZE (in the twilight or dark if possible) but I'm not sure when I will have the opportunity to do that. I'm spending way too much time on all this as it is.

Edit: I just noticed that I didn't have Direct-to-disc enabled in BI, that would have been better of course.
 
Last edited:
Top