I have a HI3516D camera with terrible hardcoded settings, is it posssible to change these?

Joined
Mar 20, 2019
Messages
26
Reaction score
8
Location
here
Hi All!

I have a HI3516D camera that I'm able to edit the configuration of using CMS. Now the problem here is that the configuration on the camera has locked the bitrate down to stupidly low levels depending on frame rate. For example, I want CBR 6000kb/s at 10FPS with H.265 encoding. The encoder is well capable of this, but unfortunately the manufacturer has locked the max bitrate at these settings to 3270kb/s.

I'm assuming these settings are configured on the device somewhere, so is anyone familiar enough with this chipset to possibly point me in the direction of where these settings can be changed?

The OnVif configuration gives a lot more flexibility, but unfortunately the onVif mode only supports H.264 and the difference in quality at this resolution and bitrate between H.264 and H.265 is very noticeable.

The camera is branded as a Techege 5mp.

Any advice appreciated!
 
Joined
Aug 3, 2015
Messages
3,791
Reaction score
12,182
Location
Charlotte
Are you configuring the camera through an NVR, or directly from a PC, or from your phone? If it's an Hi351x based system, it's very likely the XMeye interface is present and available from the camera through a web browser, IF the camera is connected directly to your network.
 
Joined
Mar 20, 2019
Messages
26
Reaction score
8
Location
here
Just a bit of an update, managed to load default firmware from Hisilicon for the 3516D chipset on to the camera in the hope that it might load default settings. This worked, but unfortunately killed the quality on the camera and didn't unlock the bitrate. I was able to get the camera back on the original firmware by running the firmware update tool for the camera.
 
Joined
Aug 3, 2015
Messages
3,791
Reaction score
12,182
Location
Charlotte
It is on the network, but I'm unsure what you mean by xmeye interface?
That's the very common, very low-level web GUI firmware/program running on the Hi351x chip. The actual program name in Linux is 'sonia'. It's been around for three or four years, and is seen most often on these cheap Chinese cameras running the Hi351x chips. If it looks like the below image, that's XMeye from XiongMai.
web-interface-login.png
 
Last edited:
Joined
Mar 20, 2019
Messages
26
Reaction score
8
Location
here
Oh yes, that's available. It's still locked to the same bitrate settings though.

I've actually packet sniffed that and grabbed the configuration packet that gets sent to the camera in hopes I could edit it, but it won't respond to my custom packets :/

>The actual program name in Linux is 'sonia'

Seen a folder called Sonia when I was rummaging through the cameras firmware, was wondering what it was!

EDIT: sorry, the folder is called sofia
 
Last edited:
Joined
Aug 3, 2015
Messages
3,791
Reaction score
12,182
Location
Charlotte
Last edited:
Joined
Mar 20, 2019
Messages
26
Reaction score
8
Location
here
Oh I seen that thread!

I've two of these cameras now, one is only 20 euro, but both have the same issue that the manufacturer has locked the upper bitrate to a stupidly low level.

I've two possible solutions so far

1. I've found the location of the current encoder configuration in the firmware. If I could get into the device remotely (maybe telnet), I could try and change the config, restart the device and see if that works. Unfortunately it appears that none of the open ports have telnet on them.
2. I've captured the configuration packet that gets sent from the software to the camera. This seems really easy to manipulate, but for some reason the camera ignores my packet, even when it's exactly the same as the one sent from the camera software. I think there's some sort of synchronization pattern sent at the start I can't figure out.

If I could figure out soloution 2, I could possibly write a small windows app to allow people to configure these cameras outside of CMS.

Have you looked at this stuff before? Has anyone looked at the source code for this, maybe so I could see exactly what is going on with the configuration so I can emulate it.
 
Top