YooSee SD-M5 doorbell: 1080p, PoE, RTSP, Onvif, only $66

It's been a while for me but I've kept reading progress here. Kudos to those who are keeping this thread alive!
When I get the time, I want to update the patched image I previously uploaded. There are still some reboots happening, I want to have the image complete with mosquitto_pub and the time synchronization method posted above.
I would also like to completely disable 'calling to China' but I am not sure how certain settings can be adjusted without the app functioning. For example as Brommetje already asked, is there any other way to set the RTSP stream password (if necessary at all)?
 
  • Like
Reactions: whoami ™
mrxyz said:
You might want to remove the values of USER_KEY and APP_TOKEN...
Click to expand...
ueveujttxfakeuserkeyieg7777
ak9gb9hdqfakeapptokena3oy7777

What are you using to debug? Is there a way to feed to the DevLog dir? Mine never seems to populate. I can run caton the npc/myfifo but that only seems to print out what npc is doing. I see it mentioned a few times that someone made a way to debug the linux side but I haven't figured it out yet other than running my scripts with the -x flag.
 
whoami ™ said:
ueveujttxfakeuserkeyieg7777
ak9gb9hdqfakeapptokena3oy7777

What are you using to debug? Is there a way to feed to the DevLog dir? Mine never seems to populate. I can run caton the npc/myfifo but that only seems to print out what npc is doing. I see it mentioned a few times that someone made a way to debug the linux side but I haven't figured it out yet other than running my scripts with the -x flag.
Click to expand...

Ah I see that they are fake now :) I didn't debug the NPC app myself using a debugger. I just looked at the output of the npc binary and reversed my way through it.
 
whoami ™ said:
I got PushOver working. I kept getting a SSL certificate error with curl while trying to use the cacert.pem so I could only get it to work with http://

Are the 5 or 6 of you others doing this programming communicating with each other somewhere else other than this thread? I swore I read this whole thread and never once read anything about how "alarm" got enabled to take a picture on button press. The only way I figured it out was by reverse engineering the "send_pic_telegram" script.
Click to expand...

Regarding the image uploading. Originally I used the inherent method of this product. With the app you can configure taking snapshots with an alarm on button push. The script "send_pic_telegram" is responsible for finding the latest snapshot. Sometimes it does not work and needs to adjust a timeout. Perhaps the same can be achieved without the app... I think the app does not read its config from the cloud, it leaves some undocumented settings in the nonvolatile area in the file called /rom/custom_setting.ini. Some parameters that could be related to the picture taking:
Code: 
AlarmPicCaps = 3
AlarmPathPushSuppport = 1
RemotlySetNetwork = 1
The latter can be something to control the cloud access, anyway the name does not sound nice. However, all that is only a guessing, if someone can take the time to test how the app settings correspond to the parameters values in this file, and how the other ones with permanent values affect the doorbell features.

Later I moved away from "send_pic_telegram" solution and stopped using the script in favour of the Home Assistant ecosystem. I integrated the RTSP stream from the doorbell into HA, and it takes care of all. Here kudos to @Florissilfhout as the original RTSP support was awful. Snapshots are taken with its automation as well as Telegram bot support. For the automation tasks I use NodeRed.

Florissilfhout said:
It's been a while for me but I've kept reading progress here. Kudos to those who are keeping this thread alive!
When I get the time, I want to update the patched image I previously uploaded. There are still some reboots happening, I want to have the image complete with mosquitto_pub and the time synchronization method posted above.
I would also like to completely disable 'calling to China' but I am not sure how certain settings can be adjusted without the app functioning. For example as Brommetje already asked, is there any other way to set the RTSP stream password (if necessary at all)?
Click to expand...
Thank you for continuing your effort on reverse engineering of the doorbell system. With time settings, my methods works for me, but it involves some hacking depending on your timezone. Basically, as I describe above, all needed things (for me) are now on the FW partition and do not need SD card. Maybe only that time setting script... but it can be moved there too, once the experiments are over. But for a convenience, I would keep a complete busybox, text editor, cron support on the SD anyway. So, regarding mosquitto_pub -- maybe pushing all to the new image is not that handy. If one day you need also to listen for the MQTT messages? BTW I have successfully tested a compiled together simple MQTT send/receive client based upon this project. That was easier than cross-compiling mosquitto.

The last comment is about RTSP passwords. On the same /rom partition mentioned above, together with RtspAuthentication = 1 setting in the config file you can find passwd1 and passwd2 files one of which can be related to the RTSP. However, once you kill the cloud connection does it matter at all?
 
Last edited:
sp00025 said:
Regarding the image uploading... With the app you can configure taking snapshots with an alarm on button push. Perhaps the same can be achieved without the app...
Click to expand...
My network is behind pfSense and I have the doorbell on a VLAN and blocked from WAN and use an allow white_list for PushOver. I'm using the FW @Florissilfhout made and posted earlier in this thread. For what-ever reason my M5 was already set to capture an image on button press. As I was trying to figure out how I could code something to make it snap an image on button press so I could create the PushOver script, I realized while reversing the Telegram script that the M5 was already taking and storing pics in /mnt/disc1/npc/push/alarm. Maybe @Florissilfhout enabled the setting in his FW. ¯\_(ツ)_/¯

I ended up getting https working buy using the -k flag with curl ie: /mnt/disc1/MONITORING/curl -sk \

Do you or anyone else know how many or for how long the M5 will keep those pics? Wondering if it needs some additional code to delete the previous days directory to keep things clean...
Bash: 
#!/bin/sh

#==================================================
## Script Name:    clean_pics.sh
## Decription:     Deletes directory containing
##                 the previous days images.
## Instructions:   Run as cron job 55 23 * * *
#==================================================

# Yesterdays date - name of dir containing the previous days images
DIR=`date -d "-13:00" '+%Y-%m-%d'`

# Alarm picture storage
PTH="/mnt/disc1/npc/push/alarm"
PTH2="/mnt/disc1/npc/record"
 
    if [ -d "${PTH}/${DIR}" ]; then
        rm -r "${PTH}/${DIR}" && rm -r "${PTH2}/${DIR}"
    else
        echo "${PTH} is empty"
    fi
    
exit 0
 
Last edited:
Florissilfhout said:
It's been a while for me but I've kept reading progress here. Kudos to those who are keeping this thread alive!
When I get the time, I want to update the patched image I previously uploaded. There are still some reboots happening, I want to have the image complete with mosquitto_pub and the time synchronization method posted above.
I would also like to completely disable 'calling to China' but I am not sure how certain settings can be adjusted without the app functioning. For example as Brommetje already asked, is there any other way to set the RTSP stream password (if necessary at all)?
Click to expand...
This weekend installed the patch image, update through the yoosee app that works fine after that changed the gateway to a fake one. At that moment the old password was still working fine, under /rom there are two password file but not human readable.
 
sp00025 said:
You can get all you need if you follow the discussion starting from this post by @Florissilfhout. For flashing, place the FW binary npcupg.bin into your SD-card root. There are two easy ways to flash it then, depending on the access to the doorbell box. You either press the reset button on the back of the box while powering it up, and keep pressing for about 15 sec. Or you use your favourite app which will indicate an available update, once the FW file is on your SD. After flashing telnet should be possible to use to access doorbell with its IP using root as username without password. From the login shell you can modify your scripts, run ftpd to upload all necessary files to your SD. If desperate put files onto SD using your desktop. That's basically all, but you need to have some basic linux skills to deal with an embedded linux system such as the one used in this little box.
Click to expand...
Thanks @sp00025 your howto works fine for me, still have troubles with date/time/TZ (Amsterdam), already an hot item and how to use mosquitto_pub.
 
Hi everyone, I was looking for a PoE-only doorbell and came across this thread. I've read it front to back like a detective novel and enjoyed the discoveries here a lot. Now that I'm at the end I decided to order the YooSee and guess I'll try the custom FW once the doorbell arrives.

Thanks for all your efforts and writing it down here
 
  • Like
Reactions: flynreelow and whoami ™
Jur said:
Hi everyone, I was looking for a PoE-only doorbell and came across this thread. I've read it front to back like a detective novel and enjoyed the discoveries here a lot. Now that I'm at the end I decided to order the YooSee and guess I'll try the custom FW once the doorbell arrives.

Thanks for all your efforts and writing it down here
Click to expand...

keep us posted.
 
  • Like
Reactions: Jur
sp00025 said:
Regarding the image uploading. Originally I used the inherent method of this product. With the app you can configure taking snapshots with an alarm on button push. The script "send_pic_telegram" is responsible for finding the latest snapshot. Sometimes it does not work and needs to adjust a timeout. Perhaps the same can be achieved without the app... I think the app does not read its config from the cloud, it leaves some undocumented settings in the nonvolatile area in the file called /rom/custom_setting.ini. Some parameters that could be related to the picture taking:
Code: 
AlarmPicCaps = 3
AlarmPathPushSuppport = 1
RemotlySetNetwork = 1
The latter can be something to control the cloud access, anyway the name does not sound nice. However, all that is only a guessing, if someone can take the time to test how the app settings correspond to the parameters values in this file, and how the other ones with permanent values affect the doorbell features.

Later I moved away from "send_pic_telegram" solution and stopped using the script in favour of the Home Assistant ecosystem. I integrated the RTSP stream from the doorbell into HA, and it takes care of all. Here kudos to @Florissilfhout as the original RTSP support was awful. Snapshots are taken with its automation as well as Telegram bot support. For the automation tasks I use NodeRed.


Thank you for continuing your effort on reverse engineering of the doorbell system. With time settings, my methods works for me, but it involves some hacking depending on your timezone. Basically, as I describe above, all needed things (for me) are now on the FW partition and do not need SD card. Maybe only that time setting script... but it can be moved there too, once the experiments are over. But for a convenience, I would keep a complete busybox, text editor, cron support on the SD anyway. So, regarding mosquitto_pub -- maybe pushing all to the new image is not that handy. If one day you need also to listen for the MQTT messages? BTW I have successfully tested a compiled together simple MQTT send/receive client based upon this project. That was easier than cross-compiling mosquitto.

The last comment is about RTSP passwords. On the same /rom partition mentioned above, together with RtspAuthentication = 1 setting in the config file you can find passwd1 and passwd2 files one of which can be related to the RTSP. However, once you kill the cloud connection does it matter at all?
Click to expand...


Are you getting button presses integrated into HomeAssistant? If so, how? I have stock firmware on my camera.

EDIT: Never mind. I see the MQTT script.
 
Last edited:
whoami ™ said:
My network is behind pfSense and I have the doorbell on a VLAN and blocked from WAN and use an allow white_list for PushOver. I'm using the FW @Florissilfhout made and posted earlier in this thread. For what-ever reason my M5 was already set to capture an image on button press. As I was trying to figure out how I could code something to make it snap an image on button press so I could create the PushOver script, I realized while reversing the Telegram script that the M5 was already taking and storing pics in /mnt/disc1/npc/push/alarm. Maybe @Florissilfhout enabled the setting in his FW. ¯\_(ツ)_/¯

I ended up getting https working buy using the -k flag with curl ie: /mnt/disc1/MONITORING/curl -sk \

Do you or anyone else know how many or for how long the M5 will keep those pics? Wondering if it needs some additional code to delete the previous days directory to keep things clean...
Bash: 
#!/bin/sh

#==================================================
## Script Name:    clean_pics.sh
## Decription:     Deletes directory containing
##                 the previous days images.
## Instructions:   Run as cron job 55 23 * * *
#==================================================

# Yesterdays date - name of dir containing the previous days images
DIR=`date -d "-13:00" '+%Y-%m-%d'`

# Alarm picture storage
PTH="/mnt/disc1/npc/push/alarm"

    if [ -d "${PTH}/${DIR})" ]; then
        rm -r "${PTH}/${DIR}"
    else
        echo "${PTH} is empty"
    fi

exit 0
Click to expand...
There is a little typo: the closing bracket ")" is too much in the check if the directory exists.
 
  • Like
Reactions: whoami ™
rABoUSaBsTRo said:
Random question, did anybody here ever used Frigate together with the camera?
Info: Frigate | Frigate

I'm trying but can't get the connection set up. The RTSP streams do work using VLC...
YAML: 
rtsp:/username:password@10.1.1.21:554/onvif1 # (1920x1080 5-15 fps)
rtsp:/username:password@10.1.1.21:554/onvif2 # (320x240 5-15 fps)
Click to expand...

I am using. but it not works without global ffmpeg args

1633765978213.png

mqtt:
host: 192.168.1.110
cameras:
entrance:
ffmpeg:
inputs:
- path: rtsp:/admin:pass@192.168.1.132:554/onvif2
roles:
- detect
- rtmp
- record

detect:
width: 1920 # <---- update for your camera's resolution
height: 1080 # <---- update for your camera's resolution
fps: 15
# motion:
# mask:
# - 192,1080,194,80,1920,84,1920,0,0,0,0,1080

# hwaccel_args:
# - -hwaccel
# - qsv
# - -qsv_device
# - /dev/dri/renderD128

detectors:
cpu1:
type: cpu
cpu2:
type: cpu

record:
enabled: true
retain_days: 0
events:
retain:
default: 10

ffmpeg:
# Optional: global ffmpeg args (default: shown below)
global_args: -hide_banner -loglevel warning
hwaccel_args: []
input_args: -avoid_negative_ts make_zero -fflags +genpts+discardcorrupt -stimeout 5000000 -use_wallclock_as_timestamps 1
# Optional: global output args -rtsp_transport udp
output_args:
# Optional: output args for detect streams (default: shown below)
detect: -f rawvideo -pix_fmt yuv420p
# Optional: output args for record streams (default: shown below)
record: -f segment -segment_time 60 -segment_format mp4 -reset_timestamps 1 -strftime 1 -c copy -an
# Optional: output args for clips streams (default: shown below)
##clips: -f segment -segment_time 10 -segment_format mp4 -reset_timestamps 1 -strftime 1 -c copy -an
# Optional: output args for rtmp streams (default: shown below)
rtmp: -c copy -f flv
 
  • Like
Reactions: zsqduke
Anyone try new firmware with optimized p2p connection?
14.00.00.87

Name: Yoosee camera firmware
Version: 14.00.00.87
Hardware solution: Novatek (Grain Media) 8135S/GM8136S, 16M RAM
Camera resolution: 1MP/720p; 1.3MP/960p; 2MP/1080p
File size: 2.92MB
Optimization:
1. Optimized P2P connection
2. Support users to remotely play recorded video
3. Fixed alarm related bugs.
 
  • Like
Reactions: eldod16
I think my Yoosee finally died.
There is no video, constant clicking inside the doorbell and the thing rings the bell with no one there. LOL.

I do not think I will get another one, because it looks like there are better options.
I will take any suggestions on my next move!
 
vandyman said:
I think my Yoosee finally died.
There is no video, constant clicking inside the doorbell and the thing rings the bell with no one there. LOL.

I do not think I will get another one, because it looks like there are better options.
I will take any suggestions on my next move!
Click to expand...
sorry to hear.

ive been happy with this one....

WTS - Brand New Sealed DB1C Doorbell

Factory Sealed. 89 shipped anywhere in the USA. Let me know. Thanks
ipcamtalk.com ipcamtalk.com
 
Last edited:
  • Like
Reactions: vandyman
Thanks to this thread I have this doorbell camera working well. I'm using the firmware posted by @Florissilfhout but am interested in trying to modify the most up to date version of the firmware. I've already started playing with the firmware from @Florissilfhout and the repacking tool (from GitHub - zzerrg/gmfwtools: GM8136 firmware tools) but I don't know how to obtain the current firmware. I guess I could stop the firewall blocking the device, fire up the yoosee app to let it update while sniffing packets on the network to see where it is downloaded from, but was hoping someone might already know.
 
I wouldn't waist your time trying to mess with an updated firmware, there is nothing new in there you'd need to use, I'm sure the only changes in there have to do with the servers the doorbell connects to. If you really want to make a difference and help us make some progress in this thread I would run the stock firmware, connect to shell over UART and start making changes in the Yosee app and see what it changes in the file system. The first place you could start looking is in /rom/custom_setting.ini
 
You must log in or register to reply here.
Top Bottom