Tom IT

Sitecom WLC-1000 Firmware Information

Unfortunately the company that created the iphone and android application has filed for bankruptcy, rendering the wlc-1000 cameras useless for checking your cameras on the road or recording to the cloud (recording on the sdcard should still work as far as I know).

A visitor asked me to share some of my findings for the sitecom firmware, because he wants to create an app to be able to use the cameras again, which sounds like a great idea!
It has been a while since I did the analysis, but I will try and share as much as I found, so anyone can try and setup a working application. With one side note, please share your projects, or setup a public repository, so other people can help / benefit from the code as well (and share it in the comments below).

All the working get Urls that are in the firmware: 
http://CAMERAIP/img/snapshot.jpg (get the latest saved snapshot)
http://CAMERAIP/CGI/ScanAP (get a list of wifi points nearby)
http://CAMERAIP/CGI/CameraStatus (get the current camerastatus in xml file, example:)

<CameraStatus>
    <RSSI>0</RSSI>
    <Adaptor>1</Adaptor>
    <Battery>100</Battery>
    <OpticalZoom>1.0</OpticalZoom>
    <OpticalZoomMax>1.0</OpticalZoomMax>
    <DigitalZoom>1.0</DigitalZoom>
    <DigitalZoomMax>1.0</DigitalZoomMax>
    <LED>0</LED>
    <Space>2658</Space>
    <Recording>0</Recording>
    <DirectMode>1</DirectMode>
    <SD>1</SD>
    <SDTotalSpace>3476</SDTotalSpace>
    <FormatStatus>0</FormatStatus>
    <StreamType>RTP_H264_WVGA</StreamType>
    <RemainingTime>0</RemainingTime>
    <RecordingTime>0</RecordingTime>
    <VideoResolution>0</VideoResolution>
    <PhotoResolution>0</PhotoResolution>
    <Audio>0</Audio>
    <Inverter>0</Inverter>
    <Loop>0</Loop>
    <EnMotionDetection>0</EnMotionDetection>
    <VoiceRecording>0</VoiceRecording>
    <PhotoTimeLapse>0</PhotoTimeLapse>
    <DZoomEnable>0</DZoomEnable>
    <Temperature>30</Temperature>
    <TemperatureMax>50</TemperatureMax>
    <TemperatureMin>0</TemperatureMin>
    <TemperatureType>C</TemperatureType>
    <Nightlight>OFF</Nightlight>
    <Notification>No_Event-2018/02/27 21:03:24</Notification>
    <LullabyPlay>OFF</LullabyPlay>
    <LullabySong>1</LullabySong>
    <LullabyTime>0</LullabyTime>
    <LullabyPlayingTime>0</LullabyPlayingTime>
    <LullabyMode>ONE</LullabyMode>
    <LullabyVolume>0</LullabyVolume>
    <MotionEvent>0</MotionEvent>
    <NewFirmwareEvent>0</NewFirmwareEvent>
    <NewFirmwareVersion></NewFirmwareVersion>
    <AudioEvent>0</AudioEvent>
    <TemperatureEvent>0</TemperatureEvent>
    <FwUpgradeStatus>Idle</FwUpgradeStatus>
    <FwDownloadProgress>0</FwDownloadProgress>
    <RTCDate>2018/02/27</RTCDate>
    <RTCTime>21:03:24</RTCTime>
    <GPS>0</GPS>
    <PortableCarDV>Portable</PortableCarDV>
    <StandType>NoStand</StandType>
    <FileChanged>0</FileChanged>
    <IQCalibration>1</IQCalibration>
    <CloudID>0</CloudID>
    <PanTest>0</PanTest>
    <TiltTest>0</TiltTest>
    <ZoomTest>0</ZoomTest>
</CameraStatus>

http://CAMERAIP/CGI/CameraSetting (this request seems to crash the response, so its not a complete response, but you can filter with variables, first the crashed response:

<CameraSetting>
    <Item>
        <Time>
            <Year>2018</Year>
            <Month>2</Month>
            <Day>27</Day>
            <Hour>21</Hour>
            <Minute>14</Minute>
        </Time>
    </Item>
    <Item>
        <Sound>ON</Sound>
    </Item>
    <Item>
        <TVSystem>50HZ</TVSystem>
    </Item>
    <Item>
        <FWVER>1356</FWVER>
    </Item>
    <Item>
        <RESOLUTION>HD30</RESOLUTION>
    </Item>
    <Item>
        <LIGHT>OFF</LIGHT>
    </Item>
    <Item>
        <SLOW_MOTION>OFF</SLOW_MOTION>
    </Item>
    <Item>
        <NIGHT_MODE>OFF</NIGHT_MODE>
    </Item>
    <Item>
        <TIME_LAPSE>OFF</TIME_LAPSE>
    </Item>
    <Item>
        <SELF_TIMER>OFF</SELF_TIMER>
    </Item>
    <Item>
        <AUTO_RECORDING>OFF</AUTO_RECORDING>
    </Item>
    <Item>
        <MOTION_DETECTOR>OFF</MOTION_DETECTOR>
    </Item>
    <Item>
        <VOICE_RECORDING>OFF</VOICE_RECORDING>
    </Item>
    <Item>
        <RECORD_INTERVAL>OFF</RECORD_INTERVAL>
    </Item>
    <Item>
        <DELAY_SHUTDOWN>OFF</DELAY_SHUTDOWN>
    </Item>
    <Item>
        <VIDEO_MODE>VIDEO</VIDEO_MODE>
    </Item>
    <Item>
        <PHOTO_MODE>PHOTO</PHOTO_MODE>
    </Item>
    <Item>
        <AUTO_POWER_OFF>OFF</AUTO_POWER_OFF>
    </Item>
    <Item>
        <TEMPERATURE_ALERT>
            <ENABLE>OFF</ENABLE>
            <TYPE>C</TYPE>
            <MAX>50</MAX>
            <MIN>0</MIN>
        </TEMPERATURE_ALERT>
    </Item>
    <Item>
        <LCD_TIMEOUT>OFF</LCD_TIMEOUT>
    </Item>
    <Item>
        <G_SENSOR>OFF</G_SENSOR>
        <Item>
            <SUPPORT_LANGUAGE>EN,DE,FR,IT,ES,PT,ZHS,ZHT,JP,KO,RU</SUPPORT_LANGUAGE>
        </Item>
        <Item>
            <LANGUAGE>ZHT</LANGUAGE>
        </Item>
        <Item>
            <MOTION_DETECTION>
                <ENABLE>ON</ENABLE>
                <SENSITIVITY>3</SENSITIVITY>
            </MOTION_DETECTION>
        </Item>
        <Item>
            <AUDIO_DETECTION>
                <ENABLE>OFF</ENABLE>
                <SENSITIVITY>3</SENSITIVITY>
            </AUDIO_DETECTION>
        </Item>
        <Item>
            <STREAM_RESOLUTION>WVGA</STREAM_RESOLUTION>
        </Item>
        <Item>
            <MAX_BANDWIDTH>1Mbps</MAX_BANDWIDTH>
        </Item>
        <Item>
            <EMAIL_ALERT></EMAIL_ALERT>
        </Item>
        <Item>
            <LULLABY_SONG>1</LULLABY_SONG>
        </Item>
        <Item>
            <LULLABY_MAX_VOLUME>5</LULLABY_MAX_VOLUME>
        </Item>
        <Item>
            <LULLABY_MODE></LULLABY_MODE>
        </Item>
        <Item>
            <SDPercentForCar>50</SDPercentForCar>
        </Item>
        <Item>
            <MAX_FRAMERATE>30</MAX_FRAMERATE>
        </Item>
        <Item>
            <IR_LED>AUTO</IR_LED>
        </Item>
        <Item>
            <FW_UPGRADE>OFF</FW_UPGRADE>
        </Item>
        <Item>
            <ROTATE_IMAGE>OFF</ROTATE_IMAGE>
        </Item>
        <Item>
            <TIME_ZONE>
                <GMT>+1</GMT>
                <NTP>ntp0.fau.de</NTP>
            </TIME_ZONE>
        </Item>
        <Item>
            <OSD>
                <Chan>
                    <Idx>0</Idx>
                    <Enable>OFF</Enable>
                    <X>0.000000</X>
                    <Y>0.000000</Y>
                    <CNT></CNT>
                    <Color>BLACK</Color>
                    <Size>1X</Size>
                </Chan>
                <Chan>
                    <Idx>1
                    </

it ends the response with: [libusock] read 2090 bytes

But if you add some variables you get a full response with these values:
http://CAMERAIP/CGI/CameraSetting?TIME&TIME_ZONE&MOTION_DETECTION&AUDIO_DETECTION

http://192.168.0.120/CGI/GoCloudStatus

<GoCloudStatus>0</GoCloudStatus>

And last but not least:
http://CAMERAIP/CGI/CloudmodeInfo
this one was interesting, because it spits out “garbage” it looks like they encrypted the data it’s displaying:

ΌΓμουδΣεττιξηΎΌΒαιδυΎΌΥΣΕ�ΞΑΝΕΎΌ―ΥΣΕ�ΞΑΝΕΎΌΑΓΓΕΣΣίΤΟΛΕΞΎΌ―ΑΓΓΕΣΣίΤΟΛΕΞΎΌ�ΕΖ.....

After some digging in the android app, I found some code that looked like a decryption function, I built a small java application, to call the url:

Java decode:

/*
 * To change this license header, choose License Headers in Project Properties.
 * To change this template file, choose Tools | Templates
 * and open the template in the editor.
 */
package javaapplication1;
import org.apache.http.impl.client.BasicCookieStore;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.util.EntityUtils;
import org.apache.http.HttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.client.ClientProtocolException;
import org.apache.http.client.CookieStore;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.commons.logging.LogFactory;
import java.io.IOException;

/**
 *
 * @author thomas
 */
public class JavaApplication1 {

    /**
     * @param args the command line arguments
     */
    public static void main(String[] args) {
        // TODO code application logic here
        
        String retSrc = "";
        DefaultHttpClient client = new DefaultHttpClient();
       HttpResponse response = null;
        try{
        response = client.execute(new HttpGet("http://192.168.0.120/CGI/CloudmodeInfo"));
        }
        catch(IOException e){
  e.printStackTrace();
}
                if (response.getStatusLine().getStatusCode() == 200) {
                    try{
                    retSrc = decodeContent(EntityUtils.toByteArray(response.getEntity()));
                    }catch(IOException e){
  e.printStackTrace();
}
                    System.out.println(retSrc);
                }
          
    }
     private static String decodeContent(byte[] contentByte) {
            byte[] decodedHex = new byte[(contentByte.length - 2)];
            for (int i = 0; i < decodedHex.length; i++) {
                contentByte[i] = (byte) (contentByte[i] ^ 128);
                decodedHex[i] = contentByte[i];
            }
            return new String(decodedHex);
        }
}

and decrypt the string and bingo, after decryption the string looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<CloudSetting>
   <Baidu>
      <USERNAME />
      <ACCESS_TOKEN />
      <REFRESH_TOKEN />
      <FOLDER />
      <CVR_ACTIVE>0</CVR_ACTIVE>
   </Baidu>
   <Dropbox>
      <USERNAME />
      <ACCESS_TOKEN />
      <FOLDER />
      <CVR_ACTIVE>0</CVR_ACTIVE>
   </Dropbox>
   <Chicony>
      <NEW>0</NEW>
      <EMAIL />
      <STATUS>0</STATUS>
      <USERNAME>nobady</USERNAME>
      <PASSWORD>nopass</PASSWORD>
      <ACTIVE>1</ACTIVE>
   </Chicony>
   <APList>
      <STATUS>0</STATUS>
      <AP>
         <SSID>MyWifiSSD</SSID>
         <PASSWORD>myPassword</PASSWORD>
         <CIPHER>WPA2</CIPHER>
         <CloudACTIVE>0</CloudACTIVE>
      </AP>
   </APList>
</CloudSetting>

The Post Urls:

http://CAMERAIP/CGI/CameraLogin (no body, it looks like it always outputs:)

<Login>Login OK</Login>
<CameraID>H2-Q6HKEBXX</CameraID>
<CameraName>Home Cam Mini</CameraName>
<MAC>64D1A3472CXX</MAC>
<HWVER>02</HWVER>
<FWVER>1356</FWVER>
<MODEL>WLC-1000</MODEL>
<PN>A02</PN>
<Mode>Portable</Mode>

To be continued..

Comments

  • Harrie Boormans

    September 22, 2019

    I have also been working with these cameras for a while. These work great in Homebridge. But would like the motion detect to be stored on Google Drive. Okay but I don’t know how to get to the settings through a browser or something else. Who can help me further. Hope someone has already found something for this camera.

    reply
  • Harry Laoulakos

    November 25, 2018

    Hi Thomas,
    Thank you for the blogposts about Sitecom camera.
    I have this old model and with your blogposts I have managed to get the stream. 🙂
    Would you care share the code of the app you are referring to?
    I might be able to find more info on how to record and upload to cloud.

    reply
    • Thomas Lang

      December 25, 2018

      I can share the mobile app decompiled code in a github, I’m currently looking to find a way to connect my sitecom cam to my new wifi setup.and am considering making a small app to get it connected to wifi and to see the stream

      reply
      • tjeerdhans

        July 13, 2019

        Hi, did you manage to connect your wlc-1000 to your new wifi setup? I’ve got one too and can’t seem to get it into the factory default mode where it should broadcast its own wifi network called ‘Home Cam Mini’.

        edit: Oops, turned out I didn’t give the camera enough power on the input. Now I can connect to it and query the API. Did you put the decompiled code somewhere on github? If so, please let me know so I can find out how to configure the cam’s wifi settings. Thanks!

        edit2: found the apk, decompiled it, found the api-calls to set wifi config (including decoding and encoding) and activate them. Got it working! Might make a blogpost tomorrow describing the steps.

        edit3: made a tool to update wifi settings. It’s Electron-based, sorry for that.. https://github.com/tjeerdhans/wlc-1000-wificonfig

        reply
  • vocea

    October 10, 2018

    Please continue that . I own one and can not use. Thankyou.

    reply
  • Marco Montoisis

    March 4, 2018

    Hello,

    Thanks for all of these new informations. After tests, it seems that the upload of video to a google drive doesn’t works anymore, i suppose that it was using sitecom cloud to transfers the video. I should verify if the video from motion detection are well stored on the sd card. If not, i can use opencv to perform the detection and i can store the video somewhere else.

    reply
    • Thomas Lang

      March 4, 2018

      Hi, it looks like the sd still saves the motion detection.

      I think you might be correct that sitecom would save it to google drive (I will scan the app code again soon, to doublecheck)

      But with the decrypted cloudinfo settings giving this:

      0

      I suspect we might be able to add dropbox settings, and make it save the files to dropbox.

      I will need to do more research for it, I think encoding the dropbox xml string and posting it to cloudmodesetup should do the trick..

      reply

Add Comment