camera – Sergei's incoherrent ramblings

ILDVR – and their lack of professionalism

It all started with me purchasing ILDVR INC-MH40D06 IP Camera. I decided to poke at it and discovered some interesting and blatant security flaws.

About a year ago I contacted ILDVR (Arnold and Marika Wei) regarding the security issues, which got no response.
After about a year of the camera sitting on a shelf, I decided to poke at it again.
Which prompted me to send them this email:

For which I got a friendly response from Marika:

To which I replied, asking for firmware update (which I thought was reasonable to expect firmware updates for products with serious security flaws):

The only response I got is this peculiar email from sales@ildvr.com:

So, it seems that:
1) ILDVR.com/ILDVR does not care about security
2) ILDVR.com/ILDVR does not care about PR
3) ILDVR.com/ILDVR does not care about customers

Perhaps they should adopt the following motto:

“GO TO HELL! – ILDVR (where security does not matter)”.

To be honest, I would probably let go this whole thing if they simply not responded. It would have taken them less effort to not to respond either. Instead they chose to send me email with “GO TO HELL!”. I find this thing very hilarious.

It is even more hilarious if you look at google search results:

mini0806 design flaw

Alternative title: why my mini0806 was crashing and stopped working after a light drop.

One of the differences between mini0805 and mini0806 is this heat sink:

It is a bitch to remove, so I gently coerced it with a blade:

After some time of gentle pushing and heating it managed to peel off:

Revealing Samsung ram chip and Ambarella A7LA50 SoC:

Here is why it was not working after slight drop (and crashing before that):

Pulled out pads! Note that the blade I used to remove would cause other side of pads missing if I applied too much pressure.

My theory is following: the heat sink that bridges RAM and SoC is causing stress on these chips. Mostly because it is glued and not mechanically pressed against the chips. This is a very silly design flaw, if for example, only SoC would have the heat sink (like found on IP cameras) then there would not be any stresses. I don’t think RAM needs heat sinking on those things.

I am tempted to take dremel to my other mini and split the heat sink in two…

Dahua IPC-HDBW4300E

Dahua IPC-HDBW4300E with 2.8mm lens.

Bought on Aliexpress, initially came with Chinese firmware, but seller helped me resolve this (was advertised as English).

Reason why I went with dome vs bullet is because I needed wider angle camera.

Here it is:

To adjust it one needs to remove the dome with Allen Key provided:

(sorry about blurry photo).

Note: The 4 pin header (on the right) is for serial (RS232), while button next to it (not visible) is the reset button (press 5 seconds to reset).

From Firmware/System perspective it is no different to Dahua IPC-HFW4300S.

Day time image quality exactly the same, except of course the HFW4300S comes with 3.6mm lens minimum while HDBW4300E comes with 2.8mm.
Night time image quality is a bit worse (due to weaker IR, and wider lens).

Here is the angle comparison:

3.6mm (HFW4300S):

2.8mm (HDBW4300E):

inside of Mini0806

Update: if you ever thinking about buying this camera, don’t! Unless you wish to buy five them to get one good. It is plagued with issues, from assembly problems (jammed cable), crappy firmware, stability issues, poor choice of power supply IC (only 0.5V head room), random crashes to shitty plastic case that melts at 100’C.

Below is the breakdown of mini0806 dashcam.

The packaging contents:

Camera itself:

To open pop the rear cap with fingers:

There are screws behind it holding the whole camera together:

Notice torn cable inside of the ring? This is a common assembly/design fault:

The shell is easily separated:

The beefy heat sink is a good thing to have, I believe it is relatively easy to add a micro fan there (maybe with minimal case cutting).

The two boards held together quite tight. Here is the camera side:

Here is the back side:

Notice how battery is simply jammed between two halves? It is held by double sided tape…

Under the battery:

I have added insulation tape around battery area in case the battery swells in future:

Camera is easily assembled back, one thing to watch out for is the power/GPS cable that feeds through the ring. It can be easily jammed and torn by adjusting the angle, if it is not assembled carefully. I bolted the contact pad last which allowed me to check if the cable is jammed.

Navman (Mio) MiVue 388

I bought Navman MiVue 388 for holiday in Australia, as I was going to do a few thousands kilometres worth of driving.
This camera is sold everywhere else under Mio brand. It is not a Navman product.
When I was purchasing this dash camera I had few prerequisites (which it met, somewhat):
1) 1080p
2) suction cup mount (for easy removal from rental)
3) Modest size
4) Available next day
5) Reasonably priced (under $250)
6) GPS
So basically the only product in New Zealand that met those was this camera.

Whatever you do, do not buy this dash camera. There is nothing really positive I can write about it (apart that it supports 64GB VFAT formatted card, despite the specifications). It pales in comparison to a much cheaper G1W, or Mini0806 (also crap! DO NOT BUY THESE!) or even my dated Blackvue DR400G-HD II. If you are after a good value for money camera get G1W for ~$60USD. Same applies to MiVue 338/358.

Image quality is very grainy:

I didn’t test the camera with optional CPL filter as Navman didn’t sell it at the time (it could have been sources from eBay as Mio branded).

Beyond image quality there are other major issues:

* Suction cup mount is a standard GPS mount, is way too big and vibration prone. It is not very good and falls off after few hours. Not possible for discreet mounting in a smaller car without major view obstruction.
* After 1 month of operation the face plate (screen cover) fell off. It was stuck on by two short strips of double sided tape. After reattaching second time, I gave up and now the camera is used without it.
* Occasionally it decided to completely lose time settings and gets stuck on Setup Time screen. While in that state it does not record!!!
* Cannot turn off blue pixelated “MiVue388” logo on top of the screen (without hacking firmware).
* Battery life is hopeless (about 1 minute and 30 seconds). Good luck actually using park mode.

Two of the issues were because of the climate in New Zealand; this camera is not suitable for being attached permanently on the windscreen due to heat. It is probably far worse for it in Australia.

To address the shitty mount I have decided to build my own mount (secured by not suction cup but double sided tape).
The materials I used are the following:

* Piece of scrap aluminium plate (some random cut off)
* A random drawer knob that I found at hardware store (a 16mm ball with threaded hole and a screw).
* 3M moulding tape
* Black paint

Test fit:

Painted and assembled:

Finished product:

With my mount the dash cam no longer blocks the view, in fact it is almost not visible (apart from status LED) from drivers seat. It is also very discreet from outside as it is masked by mirror contour.

Rebooting IP cameras remotely

Hikvision

Complete Hikvision API documentation is available here.

To reboot remotely a Hikvision IP camera, all one needs to do is ‘PUT’ /System/reboot:

curl -X PUT --user {USERNAME}:{PASSWORD} http://{CAMERA_IP}/System/reboot

Dahua

Complete Dahua API documentation is available here.

To reboot remotely a Hikvision IP camera, all one needs to do is 'GET' /cgi-bin/magicBox.cgi?action=reboot:

curl --user {USERNAME}:{PASSWORD} http://{CAMERA_IP}/cgi-bin/magicBox.cgi?action=reboot

inside of Dahua IPC-HFW4300S

I have decided to switch back from 8mm lens to 3.6mm lens (Mega brand, sold as 3.6mm, f2.3, M12, for 1/3″ sensor).

Disassembly is fairly straight forward.

Note: there is no need to remove screw from the back of the camera. It looks like it is covering a breathing hole (the screw does not hold anything).

Unscrew the front half:

The IR LED PCB is held by couple of screws:

In case of lens change there is no need to disassemble further. But for curiosity I continued.
The SoC board is held by another couple of screws and two screw posts that IR LED PCB was screwed into. These posts can be unscrewed by flat screw driver.

Interestingly enough the camera is mostly empty space, the raised part of the body inside is used as heat sink (covered by yellow heat sink pad). There was a bag of silica gel inside.

The SoC board with lens:

Lens is simply threaded on the sensor body, secured by locking nut. Everything was finger tight. The locking nut is transferred to the new lens and then the whole thing is assembled back, except IR PCB and front cover. Focusing is done on live camera, preferably with a special pattern. The trick is slightly “over” focus, and then tighten the locking nut (while holding the lens).

Back of SoC board:

Here what states on the “CPU”:

Ambarella
A5s-CO-RH
A1407
N6WY4-AN3
1N1
A5s88

Here is the front of SoC with lens removed:

The dust speckle on the sensor was courtesy of Chinese aliexpress seller (probably when they replaced the lens to 8mm).
EDIT: the unpopulated 4 pin header (top right) is for the Serial (RS232) connector, the unpopulated 2 pin header (bottom left, next to battery) is for the reset button.

I used a bit of sticky tape to remove the dust speckle without leaving anything else on the IR filter.

The screws were one time use only (made out of Chinesium) so I replaced them with nice stainless steel screws.

Buying Hikvision cameras in New Zealand

This is how you buy genuine Hikvision cameras in New Zealand:
You don’t.

All I wanted to buy is a genuine Hikvision camera locally (with correct Language flag set in firmware, and basic support).
I went onto global Hikvision website and checked listed distributors for New Zealand. I also e-mailed Hikvision regarding the New Zealand distributor.

The Hikvision website lists Atlas Gentech as their distributor. This was confirmed via email as well.

From quick look on Atlas Gentech website it appears that they are deal with trade only (ie wholesale shop).
I have contacted Atlas Gentech, and they confirmed that you need to be a company to deal with them.
They provided me with couple of their customers I could enquire regarding buying Hikvision cameras.
Both of the contacts given were security companies (not a retail shop), as well as what appeared to be “one-man” operations. The security companies naturally have no interest in selling hardware to customers, they are more naturally inclined to sell services (ie. installation and monitoring). There is simply a conflict of interest there to start off.

I have contacted these companies. Only one responded.

Originally I have enquired about DS-2CD2032-I with 12 mm lens. I have been told that it is unavailable and was given two options:
DS-2CD2232-I5 for approximately $700NZ + GST (~$620USD). BTW I have bought DS-2CD2232-I5 from Aliexpress for $95USD. The most expensive DS-2CD2232-I5 on Amazon was around $240USD, while the US version (with correct language flag) is sold around $170USD.
and DS-2CD4232FWD-I a vari-zoom/vari-focal camera for approximately $1200 + GST (~$1073USD). The DS-2CD4232FWD-I can be bought for about $400 USD on Aliexpress.

The camera bought from Aliexpress physically does not differ from cameras that being sold here. The only difference is the language flag (which is fixable), and obviously support/CGA.

I also found that the Aliexpress sourced camera can be bought on trademe for $250NZ ($194USD).

I had expectations of paying maybe 2 times of the US Version, the expectations were completely shattered when Atlas Gentech confirmed that quoted $700NZD + GST was reasonable (and not bullshit RRP price). lets assume that US Version retails for $200USD (a bit higher than $170USD on Amazon). The $620USD is over 3 times of the retail price of US Version.
Remember when camera sold on Aliexpress for $95USD the Alixpress makes a cut, the seller on Alixpress makes a cut and the Hikvision still makes a profit. Looking at the cost of Ambarella SoC (wholesale around $20USD), the cost of making the camera is around $40-50USD. Selling camera for $620 USD is pure greed.

Hikvision is blatantly ripping off New Zealanders, because they can. Shame on you Hikvision for doing so, and shame on you for artificial differentiation of the markets by setting the language bit. Geo-locking in Internet world is stupid and futile.

Shame on you Hikvision for violating GPL as well, since when I bought the cameras there was no mention of the licence, and the camera definitely uses GPL licensed software. The GPL code requests were fallen to silent ears. This company is behaving like a greedy parasite, taking from community and not giving anything back.

Hikvision DS-2CD2232-I5

Bought it from Aliexpress as I have completely given up on sourcing genuine camera in New Zealand.
Ordered with 12mm lens option for the driveway monitoring.

Internally it is exactly the same as Hikvision DS-2CD2032-I IP camera. Same CPU/RAM/Sensor/Firmware.

Externally it is rather large and bulky. It is all metal construction, except the default mount – flimsy plastic. I have used an arm from an old CCTV camera, it bolted perfectly fine to one of the bottom threaded holes. It had another threaded hole at the back giving plenty of mount options. The hood adjustment did not make any sense, fully extended at around half of centimetre, it looks like the screw (which was also a bit too small) holding it was put in slightly wrong place.

One thing I didn’t like is the cable was external, on DS-2CD2032-I it is routed internally through mount allowing for more discreet installation. I simply used split piece of 20mm conduit around it to make it more difficult for cutting.

The IR LEDs are very powerful, in fact they are too powerful as number plates are not visible due to excess light bounced from reflective surface. As bonus it lit up the area for other camera.

With 12mm lens it has sufficient zoom to clearly see along our long drive way.

Picture sample (day):

Picture sample (night):

Hikvision DS-2CD2032-I IP camera part 2

continuation from Hikvision DS-2CD2032-I IP camera

As a quest to solve the dropped frames issue I have upgraded the firmware from Version V5.2.0 to V5.2.3.
This was done successfully, except the interface has switched to Chinese (and no option to choose otherwise).

Model DS-2CD2032-I Serial No. DS-2CD2032-I20141014CCCH482137191 Firmware Version V5.2.3 build 141024 Encoding Version V5.0 build 140714

Basically the camera I bought supposed to be international version but upon inspecting the serial number it looks like it is Chinese.

The Chinese versions have CCCH while international version have CCWR in their serial numbers. Cameras that sold as “International Version” on amazon are actually Chinese versions with multilingual interface. The correct camera to buy is “English Retail” version. Caveat Emptor!

I found a workaround without modifying the firmware: drop into developer console in the browser and type the following:

javascript:chooseLanguage("en");

There is also a hack by CBX here . This is a permanent solution, but I will probably not go that way since I don’t need use WebUI very often. Shame on you Hikvision for having regions! Since it is same hardware and software anyway…

So far with new firmware I cannot see any changes whatsoever (that concern me).
The loadavg is still very high (around 4). Not sure about original problem, will need to run the camera for a while (since it does not manifest itself immediately).

I have contacted CBX and he as kind enough to provide me with the patch for token amount of money in exchange.
The camera now has correct language ID:


# prtHardInfo
...
language                        = 1
...