glad to share I have hacked my ZOSI Camera ZG2323M ... I'm only missing the exact URL to retrieve the video flows!
after my NVR ZR08LL has died, I was expecting to reuse my 6 ZOSI cameras with NX Witness . not easy, but thanks to above details and more from other sources, I was able to enter in the camera.
remind this is link to the ZOSI
ZG2323M , it may differs with other models.
First step is to find IP address. Out of the box, never plugged into a NVR, the IPCAM comes with an address 192.168.138.x . My NVR has changed it to 192.168.147.x ... don't ask me why, I have no idea.
Once you have find the ip address of your cameras, with nmap, ipscan, or whatever ip scanner, you can connect to the camera via TELNET (port 23 is open)
# telnet 192.168.138.2
login: root
password: 123456asj or 123456asi
Welcome to HiLinux.
you are in!
The IPC is running Linux Busybox.
the folders are organized like this:
/ (root)
/app : specific for Zosi
/bin : standard busybox
/boot : (empty)
/config : specific for Zosi
/dev
/etc : some specific settings for Zosi network
/font
/home : some Zosi binaries here with extension .g711a
/komod : specific for Zosi
/lib
/mnt
/nfsroot : (empty)
/opt : some Zosi specific
/proc
/res : specific for Zosi
/root: only one script pm_callback
/run
/sbin : standard busybox
/share : (empty)
/sys
/tmp
/usr
/var
If you want to change the IP address, use ZOSI NVR if it works. Then remove the cameras from the NVR and switch it off. use your new NVR to add the Cameras from their IP addres.
Remember my NVR has died, I cannot tweak the cameras anymore with it. So I have decided to update the network configuration in each.
here are the files you need to update to match the new NVR network.
First, take a copy of the original, I'm use to do it by : cp xxxx.yy xxxx.yy.
org By doing this, I can always refer to the original if I have a doubt.
Second updates ALL files listed below before rebooting or you can lose network connection to your camera.
1. /app/start.sh : update the lines for Ethernet connection (
ifconfig eth0 192.168.0.2) and gateway (
route add default gw 192.168.0.1 eth0)
2. /app/switchwifi.sh : update the line for Wireless connection (
ifconfig wlan0 192.168.0.102)
3. /config/NetCfgParam.CFG : update the Rj45Info and WifiInfo parameters to reflect the as in /app files . You need to update
IPAddr, Gateway, Dns , you shouldn't change NetMask , it should be the same as your local network. 255.255.255.0
4. /etc/hostapd.conf : optional, this is for a wireless Access point on your camera . be sure it does not conflict with any of your local defintion into ssid= . You can change ssid= and wpa_passphrase to something which fits your need.
5. /etc/resolv.conf : this is for the DNS, replace the value of nameserver by the DNS IP in your local network, like
nameserver 192.168.0.1
6. /etc/wpa-psk.conf : this is critical to connect the camera to you wifi network. update
ssid= with your wifi ssid and update the password
psk= with your wifi pass key
check a last time all your network settings and reboot the camera by the command
# reboot
after a while, your camera is visible on your network, if you don't do a mistake. If you have done a mistake in network settings it could be almost impossible to find the IP address or regain access.
ok, the cams are on my (mesh) wifi network. Now it's time to add them to the new NVR.
a port scan gives a few ports open,
TCP/23 (telnet)
TCP/554 (RTSP)
I did a try to auto discovery via ONVIF protocol without success.
The next option is to give manually the RTSP url of each camera.
According internet sources
iSpy for Zosi cameras, Zosi rtsp urls end with one of ch0_0.264 , ucast/11, and more depending on your model. Unfortunately my exact model is not listed (ZG2323M).
At the stage I had to dig into the Zosi setup in the camera to find :
1. user
assword
2. exact url
I did find two users, "admin" and "user" into /app/bin/config.xml
- username: admin password: admin
- username: user password: 123456
I did find a tag <url>screenlive</url> and video codec H265 and MP4, audio codec G711A , transfer mode UP with vport 50001 and aport 50002 which I guess stands for vport: video and aport: audio
I did a try with all within NX Witness using rtsp:/admin:admin@192.168.0.2/screenlive :
--> NX witness accepts the camera and add it to the list,but fails to render the video.
--> in NX server log, it says that the RTSP DESCRIBE response is too short. Other said, the url is not good.
another file of interest /app/bin/onvif_config.xml seems promising... but onvif:/admin:admin@192.168.0.2/onvif/device_service does not respond. this is the typical scan on ONVIF protocol I mentionned above.
inside this onvif_config.xml, I have found interesting information:
- forgot <server..> tags, it says running on port 8080, but a quick scan ( netstat -an in the busybox ) shows there is no listener on this port
- you can find the same 2 users as found into config.xml
- followed by <profile> tags in which an interesting <stream_uri> tag contains values mentionned by iSpy
- ucast/11 for a video encoder H264 1920x1080 with audio encoder G711
- ucast/12 for a video encoder H264 640x360 with audio encoder G711
- and onvif tags
<scope>onvif:/www.onvif.org/location/country/china</scope>
<scope>onvif:/www.onvif.org/type/video_encoder</scope>
<scope>onvif:/www.onvif.org/name/IP-Camera</scope>
<scope>onvif:/www.onvif.org/hardware/HI3518C</scope>
full of hope, I have tried many rtsp urls without success so far, like
- rtsp:/192.168.0.2/screenlive
- rtsp:/192.168.0.2/ucast/11
- rtsp;/192.168.0.2/ucast/11/screenlive
and more ... none where able to be registered properly with NX Witness, Shinobi, or any other NVR
last piece of information, I have seen the url of another IP camera , onvif compliant. it introduces the uuid in the url like this
rtsp:/{ip}/{uuid}/channel0
I did a last try with the uuid of my camera found into /app/bin/uuid.txt
rtsp:/{ip}/{uuid}/screenlive
rtsp:/{ip}/{uuid}/ucast/11
etc
none of them are working.
I wonder if somebody has the right format of the url? * SOLVED * rtsp:/admin:admin@192.168.0.2/video1 and video2
It could allow me to reuse my Zosi cameras. Otherwise I will need to purchase 6 new cameras, and probably not ZOSI, but one officially referenced with NX Witness.
PS: about the TZ issue mentionned in this forum, the boot process launch /app/IPCAMERA.exe whihc overwrite /etc/TZ . captured in the log
[APP INFO] [ src/common/TimeProcess.c, Line: 320 ] Save time zone:echo GMT-8 > /etc/TZ
