Close
0%
0%

Exploring China Made NVRs DVRs & Cameras

Goal:
Modding china made security systems.
DVRs NVRs IP Cams

Similar projects worth following
SCOPE OF PROJECT.
This project is intended for person of any skill level. From beginner level all the way to Expert level. I'm gonna try my very best to go by step by step of each process. So every know and keeps up with whats going on. With as many pictures as I can. This is my very first project I've posted on hackaday.io. So just bare with me if i move stuff around.

AIM OF PROJECT
Setup, Configure, Update, ModdIng, Hacking, Cracking of Hardware and Software.


SUBJECT OF PROJECT
China made security systems and devices. NVRs, DVRs, IP Cameras.

Victim #1
ZMODO Professional 720p NVR Security System with 8 IP Cameras with Night Vision.

NVR Controller Model: ZP-NJ18-S
IP Camera Model: ZP-IDQ13

ZMODO Professional 720p NVR Security System

SKU: ZM-SS76D9D8-SC

UPC # ZNY010781150708B1045

UPC # 889490005180

Key Features

SET UP IN MINUTES

Connect your tablet or smartphone to your ip cameras or NVR with a quick scan of the QR code.

SIMPLIFIED POWER OVER THE ETHERNET

A single network cable each IP camera directly to NVR. Suppliying both power and video signal. (Does not support 3rd party PoE cameras)

INTELLIGENT RECORDING

Intelligent recording save up to 80% of your hard drive storage.

CONNECT VIA SMARTPHONE & PC

Stay connected wherever you go with the free Zsight app and Meshare web client.

VGA & HDMI OUTPUT

Easily display video through the HDMI port of your TV or moniter to take advantage of the security system's clarity. Standard VGA res is also available.

FREE ADVANCE ZSIGHT MOBILE APP

Zsight allows you to capture photos, record video clips, view playback, receive push notifications, share your device, and much more.

OKAY PEOPLE KNOW LET ME TELL YOU WHAT I REALLY HAD AFTER FEDEX DROPPED IT OFF AT MY HOUSE!!! AND I OPENED THE BOX. AND THE EXACT REASON I WANT TO TAKE THIS THING APART.

Lets start with main head unit. The call it a "NVR Network Video Recorder". Sticker on the bottom says it's a

ZMODO

Model: ZP-NJ18-S

SKU: ZM-SS7009D8-S

ID: XXXXXXXXXXXXXXX

User: admin

(Doesn't mention a password at all)

Lot No: YW015070015

Nice white finish. A little plain looking. (I just noticed my dog Dama photo bombed me!!)

Okay we got DC-19V input, 8 ports, 1 ethernet port, VGA, HD port?, (Maybe they ment HDMI port) 2 USB ports, (backup and mouse) reset button hole, and a GND screw. OH LORD I SEE WHAT WE DON'T HAVE!! Do you? Okay I'll give you another try.....

Look hard catch it this time? There is No SCREWS. Why may you ask? This is why....

The China man won't even put a dang harddrive in it. Come on couldn't even get a 1 gig? lol Intelligent recording saves up to 80% of your hard drive storage. Unintelligent recording saved me a 100% of storage because it has no storage. And no where on the box does it say "Harddrive not included". Think they would had thought to mention that.

Looks like I need a SATA Harddrive.... Surprised it wasn't a IDE setup now I see this. I guess I got to have one shipped to me. While I wait for it to get here lets push on to the rest of the stuff.

Bottom View If it was mounted. Ceiling mount interior wired IP camera. Very light weight. Notice the sticker and the funny plug. I'll get to that in a second.

I guess you would call this a side view if it was mounted.

Top view if it was mounted. This thing uses a micro USB to plug into. And the sticker reads as follows.

ZMODO

Model: ZP-IDQ13

SKU: ZM-SS76D001-S

User: admin

Password: 111111

Made in china

This is the sticker off the ceiling mount Camera.

Here we got the cable that runs from the camera to the NVR unit. Female micro-USB to RJ45 ethernet. I didn't expect that combo. But anyways it got me to thinking. I got me a 100 ideas where this could be useful. maybe on the next project.

This is as far as I can go ATM here. So here's a recap. I got me a NVR with no harddrive so I got me a SATA drive coming in the mail. Also I got me a NVR with a sticker on the bottom that lists the USER: admin but NO PASSWORD. I guess I'm gonna explore the camera side of this get up. Until I can move on.

  • 1 × NVR Controller Model: ZP-NJ18-S This is an 8 channel NVR sold by ZMODO
  • 8 × Wired IP Camera Model: ZP-IDQ13 SKU ZM-SS76D001-S Wired IP Camera sold by ZMODO
  • 1 × Netgear Wireless Router Model: WNDR3400v3 Netgear wireless router Model: WNDR3400v3 running TomatoUSB by shibby firmware. Check it out at tomatousb.org & linksysinfo.org
  • 1 × USB to TTL Serial Cable - Debug / Console Cable By adafruit $10 or less @ https://www.adafruit.com/product/954
  • 1 × SATA HardDrive I had to order a harddrice because the NVR did not come with one. Will update info. When it makes it to my house.

  • HAVE A QUESTION OR NEED HELP?

    Dr.Query04/17/2017 at 06:59 0 comments

    If you have a question or just don't know please feel free to ask as many questions as you need I will help you the best I can. Remember there are no dumb questions. Just dumb answers. I do ask you to do the following thing before you ask.

    TRY TO GOOGLE IT FIRST. I'm going to call you out or just plain out ignore you. If you ask " Hey what does sPOE mean? ". And I google it and the very first thing that pops up is. " Definition of sPoE. sPoE, an abbreviation for simplified Power Over Ethernet, PoE technology lets network cables carry electrical power in addition to data, making surveillance easier and more affordable. ... ※A power connection, to deliver the electrical power to the camera." Everybody is here to learn and help. NOT do it for you.

    Next thing try to be as detailed as you can. That means What is it your working on? Device? Model? Verison? Build? What are you using to work on it with? What exactly is it that you do you not know? What or how did you try it? What exactly happened when you tried to do whatever? What exactly was you expecting or wanting to happen?

    Last thing Screenshot everything. If you can't or don't know how. everybody has a cell phone these days take a picture it that way. Ever heard "A picture is worth a 1000 words"? Then try it...

    The short of it is it's better to be over explained than unexplained.

    I'm gonna try to figure at a good place to handle question. Asoon as i can figure out what works best. I don't know maybe I will make a FAQs Page or something. For right now tho post them in the DISCUSSIONS section at the bottom.

  • ** KEYWORD & SYMBOL DEFINITIONS **

    Dr.Query04/17/2017 at 03:51 0 comments

    ** KEYWORD & SYMBOL DEFINITIONS **


    SYMBOLS


    [ ! ] CAUTION or RISK. Be careful what with what you are doing. There is a risk of damage. Or detrimental effect toward wanted outcome.

    [ * ] USEFUL TIP This is just a little extra information on the subject. That someone thought you might could use.

    [ ** ] URL or WEB ADDRESS Anything with this symbol beside it. Will be listed on the RESOURCE PAGE under the "Project Log Entry" section.


    KEYWORDS


    • IP Camera An Internet protocol camera, or IP camera, is a type of digital video camera commonly employed for surveillance, and which, unlike analog closed circuit television (CCTV) cameras, can send and receive data via a computer network and the Internet.
    • Security System A control panel, which is the primary controller of a home'ssecurity system. Door and window sensors. Motion sensors, both interior and exterior. Wired or wireless security cameras. A high-decibel siren or alarm.
    • WIFI Connection Wi-Fi is the name of a popular wireless networking technology that uses radio waves to provide wireless high-speed Internet and network connections. A common misconception is that the termWi-Fi is short for "wireless fidelity," however this is not the case.Wi-Fi is simply a trademarked phrase that means IEEE 802.11x.
    • Wired Connection A wired network is a common type of wired configuration. Most wired networks useEthernet cables to transfer data between connected PCs. In a small wired network, a single router may be used to connect all the computers. Larger networks often involve multiple routers or switches that connect to each other.
    • NVR A network video recorder (NVR) is a software program that records video in a digital format to a disk drive, USB flash drive, SD memory card or other mass storage device. An NVR contains no dedicated video capture hardware.
    • DVR Short for (Digital Video Recorder) A device that records video from up to a dozen or more surveillance cameras onto a hard disk. ... Digital recorders are more flexible than earlier analog VHS tape systems, and the video can be easily transmitted over a computer network.

View all 2 project logs

  • 1
    Step 1

    WE GONNA DO IT BACKWARDS?


    Okay If you have be watching my project. In the details section. I unboxed the ZMODO NVR Security System. And come to find out the NVR unit doesn't come with any kind of storage nor a password. So I got it coming in the mail. Until then I'm gonna move to the camera side of the system. Go check it out to see how i came to this point.

    So here's what i got...

    ZMODO Wired IP Camera

    Model: ZP-IDQ13

    SKU: ZP-SS76D001-S

    That uses a funny cable...

    Female Micro-USB to RJ45 Ethernet Cable. Appx. 100 ft. long. So i decided if the NVR is off the table. I'll just see what i can do with the camera. Well I connected the camera and cable together. Plug it in to my router and guess what ? NOTHING. A big fat zero. Then I decided to plug it in to my laptop's port and guess what? NOTHING. Another big fat zero! Man this thing is as dead as my ex-wife on love making night!!!

    After doing some digging I found out this is a sPoE IP CAM. What's that?

    sPoE, an abbreviation for simplified Power Over Ethernet, PoE technology lets network cables carry electrical power in addition to data, making surveillance easier and more affordable.

    As you can see it's based off a 8 pin RJ-45 connector. Power and ground runs off pin 1 & 6. 1 being your negative or GND. 6 being your power or postive. Pin 2 & 3 carries the data or your video. Since I'm talking sPoE. I also want to mention something I found before somebody asks or try to experiment.

    [!]And I quote.

    " There are 2 reasons that a PoE switch or injector will not work, the first reason being that the sPoE cameras only accept 19V of power, and typical PoE is 48V, the increased voltage will very quickly damage the cameras. The second reason is the pinout configuration on the camera, PoE uses all 8 pins, 4 for power and 4 for data, the sPoE cameras only use 4 pins, 2 for power and 2 for data. " Okay moving on...

    If you look at the picture I posted above the camera it's self is pointed all the way over to one side. See how all the IRs are on one side? (If your wondering what a "IR" is hold tight get there in a little while.) This means you can mount the ring that the camera hangs from and install the camera but you have no way to point it. This means you gonna have to take the case apart to aim the camera inside.

    If you will look to where I'm pointing theres a notch. You gonna have get your self a big flat head screwdriver. And pry it apart. It should just unsnap. Be careful not to be to rough. Or you may crack the case.

    This is what it looks like with the case open. Now all you do is lock it into the mount and aim the camera. Snap the case back on. If you want to just finish installing and configuring you will have to skip the next few steps.

  • 2
    Step 2

    TIME FOR A REBUILD !!!


    Okay for the people that decided to stick around and see what's under the hood. I want you to know this is my first time modding / hacking one of these NVR camera systems. I have tinkered with most any kind of gizmo under the sun. So, Im gonna try to do my best but dont take my word as the gospel. Double check EVERYTHING I say. DO THIS AT YOUR OWN RISK. If you can help. Please do. I will besure to give credit where its due.

    This is my first Hackaday.io project and my aim is. For this project to be the goto project for china made junk. With that being said. If you will be kind enough to share methods and code. I will take the time to explain it. Were everybody should be able to understand or atleast be able to complete what we are trying to accomplish. No matter there skill level.

    Where should I start? I guess the "Why?" is a good place. Everybody should know the reason for what they are doing something. I could name a 1000 reason why. Just don't have time for all that right now. Companies over seas do not give a damn what they are selling us these days. Some are even using the stuff we buy from them against us. There is NO other way to say it.

    Anything from scamming us out of more money. To spying on us. Just go out on a limb with me for a second. Don't you think it's odd that china sales this system and a crap ton more exactly like it. Just with a different name stamped on it. Instead of it saying ZMODO on it. It may have Ying-Yang. Still the same NVR cameras and cables. With NO harddrives included. I think I proved that in the details section. Don't believe me. Look at the pictures yourself. Yet has ready made cloud server preinstalled and ready to rock in roll..... With little to no way to disable or uninstall. I guess just dumb luck. Huh?

    Most everybody here has delt with these devices before. It is no secret that hardly ever do you just pull them out the box. Slap it together and even 25% of the stuff work with out having to play with it for 2 days. Some of the features never goes to working. I can tell you the 2 things that has always worked. That cloud server and that call back home script.

    lol Omg I just want to see one device that them two things were broke out broke when it got unwrapped. I mean they have managed to brake all 150 other key features. Never either of them two. We all know were our live video goes after it comes out that DVR or NVR. Before it makes it to our TV or hand held. That's right CHINA. Where you think all those cloud and call back servers are located at?

    If these companies are not gonna play right. And Nobody here gonna make them play right. We gotta lock em down our selfs. That's all there is to it. Fact of the matter security system are a safety device. Just the same as a bullet proof vest.

    If they gonna hack us. We need to make sure they don't cut any corners. Sit your butt down in front of a command line. Pull your sniffers, crackers, injectors, scripts, and handmade tools out. Put them long hours in just like everybody body else. NO FREE PASSES YING.

  • 3
    Step 3

    WHAT'S THE PROBLEM?

    Ok thanks for reading my disclaimer slash rant. Okay we all know the point of doing this. So lets get in to it. I left off at I just opened the case on the camera. First thing first. Lets figure out how it works and why its broke. That way we will know how to fix it.

    The good people in China has built these things to where. When these camera are powered up. It encrypts the video stream before it ever leaves the camera. Not only that. It tries to hide the actual camera's connection. Best i got it figured. Thats to hide the encrypted stream so you can't decode the stream it's self nor all the other info they have stole.

    What other information could a camera get you ask? It's like this. Anytime you put a device on the inside of a private network. It inherits certain privileges. This is just how a network works. If every device was totally locked down and hidden. None of the network devices could see each other. Trade data among each other etc....

    So when a device is added there a certain level trust that it is given. So it can coexist with all the things connected to the network. Back to the information theft. It knows what your internal ip address is for sure. It can be made to take a look around. To see how many and what kinds of devices is on the network. Not only that it can even tell what the devices are doing. Aww I'm just crazy. If so prove it. If all the data is encrypted and hidden. They is no way to prove what it is or isn't sending and receiving. None the less if you look above this what a network kind looks like. This Is pretty much the easiest way i can explain it.

    Okay now we have this piece of junk from china sitting on our network. That has encrypted and hidden it's self. I mean total lock down. Since it don't have all the hardware needed to get whatever it's holding out of the private home network on to the public internet. It has to ask for help. This is where the NVR DVR comes in. First of all the camera need to stay hidden. So we cant get a hold of the stream. So the NVR and the camera makes a encrypted / hidden connection. Very little of this can be seen by other devices on the SAME network.

    Ok now think about this. Pretty much the NVR and how ever many camera on the network. Has made there own network where it's just China device talking to other China devices. Inside YOUR network. So pretty much all these little China machines can say and do what they want. It's all up to whoever programmed them wanted them to do at the time. Without you being able to control them in anyway. As long as they don't try to pass though the networks router where you have the control.

    The router in most cases acts like the boss of the network. It hands out the ip addresses. Says who comes and who goes. If it catches a device doing what it shouldn't. It can block the internet connection. If the device is really being bad it can blacklist the device. Kick it out the network and refuse to let it back in. Just like mama use to do.

    Not the case with "Ying" the camera from China. And "Yang" the NVR/DVR from China. They have got there own network going inside your network. Because Yang the NVR has a little secret he is half router too. Yang gets is IP address / internet from your router. Then makes a door for Ying the IP camera from china. By sharing his address and connection! Nice huh?

    Okay the camera has got video stream and whatever else it's decided it wants. Nobody knows it's all encrypted and hidden. Now it need to get the data off your network. On to the public internet. But there's one thing stopping it. Your network router / boss. The camera can't do it. Heck the router doesn't even know it's on the local network.

    Here comes the trick read closely... The camera passes the data to the NVR / DVR from china. The NVR tells you. "Hey I got the feed from the camera. But before I can show it to you. I need a password to unencrypt it." Now I'm gonna stop right here for a second take a look below.

    It is 11,671km or 7252.0232 mi from the capital of China to the capital of the US.

    It took a 7200 miles trip one way with your data to ask for a password. The software on the NVR and the firmware has totally locked out the end user. The only way to stop this from happening is to unlock the software / firmware. Or replace it with different software / firmware combo


View all 4 instructions

Enjoy this project?

Share

Discussions

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates