Control Reolink RLC-423 with API

Hello,

Thanks but I have already contact the support and the answer is "Sorry that PTZ CGI is not available for personal users. please kindly refer to all available CGI commands"
So, I think that it could be possible with an hidden function or with cURL script...
Any idea?
 
next time buy from a vendor with a documented HTTP API Available to everyone.. thats a fucked up response; indicating they do have an API but you dont deserve to know it.

for $100 more you coulda got a camera 100x better; send that pice of junk Reolink back if you still have the option.. then buy one of these: Dahua 2MP 25x Starlight IR PTZ Network Camera (SD49225T-HN) then you can reference this: http://contenidosdigitales.net/plan...amientas/api/DAHUA_HTTP_API_FOR_DVR_V1.29.pdf

API Engineering is what I do for a living; and if a Vendor cant be bothered to publish it for all to know then fuck them.. seriously, thats the point of an API.. If its a secret then how can anything integrate with it.
 
  • Like
Reactions: izidor78
The other thing you could do is disassemble their firmware for the camera, and review the output of a UNIX/Linux 'strings' output against their webserver and/or javascript and/or html code. The Python program 'binwalk' is helpful.

The attached ZIP archive contains the api.cgi file from the SquashFS filesystem, from the directory /bin. The other text file is a strings listing from api.cgi. Good luck!
 

Attachments

Last edited:
@nayr Wow Dahua camera seem to excellent! Where can we buy it? Only aliexpress?

Close - Use "binwalk -e -M firmware.bin"

-M implies Matroska, or recursive extraction.

The top level is two compressed .xz files, plus the SquashFS file system. That's the source of the api.cgi file I posted above.
 
Thanks @VorlonFrog I have seen our extract but I cannot found ptz control command in these files.
Do you find another file named ptz_control.cgi in the firmware?
 
izidor78, I'm in the same boat here! I went with reolink and not so happy but it has so far went well for what I need it to do. I have the RLC-411 and photo is clear but movement is blurry at night.

Dahua is the way to go, if you contact their CS they are friendly and helpful.
 
Thanks @VorlonFrog I have seen our extract but I cannot found ptz control command in these files.
Do you find another file named ptz_control.cgi in the firmware?
I'll take a look when I get off work tonight. The extracted firmware files are on my Linux box at home.

Something else you might do is download and run the Wireshark program to capture the Ethernet packets sent back and forth from the Reolink viewer app on your PC to the camera. That traffic should reveal all of the CGI command syntax.
 
  • Like
Reactions: izidor78
@EMPIRETECANDY has more units on the way, conversate with him if you want one.. last time he announced stock he was sold out instantly.

Reverse Engineering there own API Gonna suck; have you tried to see if it'll take ONVIF yet? Its horribly more complicated than a basic RESTfull HTTP API, but its still a fuck load easier to implement than reverse engineering someone elses stuff w/no docs.
 
Nope, no other CGI files anywhere in the SquashFS directory tree. Only PTZ files were two graphic images.

Searched a bit more, and found the directory /mnt/app/www/js containing the JavaScript files attached to this message in a ZIP file. Note that they use JQuery.js to handle most of their JavaScript, but this should get you going...
 

Attachments

Last edited:
Ok Thanks. So I will try with Wireshark but first I need to learn this program.
Could you explain to me how I can use it to capture the Ethernet packets sent back from my camera?
I have add a filtre on ip address and after I don't what have to do.
 
Ok Thanks. So I will try with Wireshark but first I need to learn this program.
Could you explain to me how I can use it to capture the Ethernet packets sent back from my camera?
I have add a filtre on ip address and after I don't what have to do.
Check my previous post, again. I found the JavaScript files and posted them for you.
 
Perfect! I found the following code in the file PlayerPreview.js

this.callPresetPoint = function(point) {
PlayerPreview.waiter.show('Calling PTZ-Preset point...');
CGI.sendCommand('PtzCtrl', {
"channel": point.channel,
"op": "ToPos",
"speed": ViewPTZAction.speed,
"id": point.id
}, function() {
PlayerPreview.waiter.hide();
}, function(cmd, errno, msg) {
PlayerPreview.waiter.hide();
CGI.autoErrorHandler(cmd, errno, msg);
});
};

How to write the params in the url?
 
you don't need WireShark or any special software to track down the commands. Just open your camera in the Chrome Browser, and press Ctrl Shift i (or Cmd Shift i on a Mac); then click on the "Network" tab at the top. Then run your camera using the regular controls and you will see the corresponding network commands appear in the network list. You can then click on each one, and look at the other tabs, Header, Preview, Response

Just a quick look, I can see that the PTZ control, you POST to this address (substitute in your cameras IP address AAA, BBB, and then also your token)

along with the request payload; this is a payload to move to preset 1:
[{"cmd":"PtzCtrl","action":0,"param":{"channel":0,"op":"ToPos","speed":32,"id":1}}]

move to preset 2
[{"cmd":"PtzCtrl","action":0,"param":{"channel":0,"op":"ToPos","speed":32,"id":2}}]

move right
[{cmd: "PtzCtrl", action: 0, param: {channel: 0, op: "Right", speed: 32}}]

to get your token for the URL above, you need to post here:

with this payload (substituted in your username and password)
[{"cmd":"Login","action":0,"param":{"User":{"userName":"admin","password":"abcdefg"}}}]

the response that comes back has the token in the name field
[
{
"cmd" : "Login",
"code" : 0,
"value" : {
"Token" : {
"leaseTime" : 3600,
"name" : "75a35d0a5a30680"
}
}
}
]

all of these commands can be sent in javascript very easily like so:

var url="";
var json=[{"cmd":"PtzCtrl","action":0,"param":{"channel":0,"op":"ToPos","speed":32,"id":1}}];

/create request for shopify
var req=new XMLHttpRequest();

req.onreadystatechange=function(e) {
if(req.readyState==4) {
var showErrorTab=false;
if(req.status==200) {
console.log("response:"+req.responseText);
} else {
console.log("Error calling PtzCtrl");
}
}
}

req.open("POST",url);
req.setRequestHeader("Accept","application/json");
req.send(JSON.stringify(json));
 
I'm unable to zoom in out with reolink 411. It only zooms in / out one camera no matter which one I choose.
 
I think I spoke to soon - unfortunately the commands only work for a short while before the camera logs the connection out requiring a fresh login and new token to be issued - not sure if it will be feasible to do this using Blue Iris. Looks like I will just need to go back to triggering the relevant camera via a camera group and making do with the one preset being activated.