MDGrab- New version with Authentication

11. Februar 2007

Ive create a new version of the commandline videograbber tool MDGrab. (see downloads)
New Features:
-send keep alive packets
-authentication added
-webcam control added (up,left,right,down,nightshot)
-some fixes

It required the following jars which you can find here:

Example command to view live video on linux:

java -cp
commons-httpclient-3.0.1.jar:commons-logging.jar:commons-codec-1.3.jar:MDGrab.jar - admin adminpw | mplayer - -demuxer mpeg4es -msglevel all=1

A detailed description will follow.

Ovislink Airlive system access

11. Februar 2007

The Ovislink Airlive WL-5460CAM has a security hole which allows you to access the buildin Linux system, read and modify
configuration files.
How ?
-Open the web interface of the webcam
-Choose configuration
-Store/backup your configuration into a file
-Open this file with a text editor
-Search the section with the /sbin/ifconfig …. line, this section is the backup of your /etc/rc.d/rc.sysinit
-Everything you write into this section will be executed on startup (but be careful that it does not block/hang)
-For Example: Add a new line “ls -l /etc >> /etc/hosts” this will list all files in /etc and print the result in /etc/hosts
-Now restore your modified configuration file and reboot the webcam.
Why print to /etc/hosts ?

Because it is the next section in you backup configuration, after reboot you can read the result in your configuration backup.

Try it out ! If your Webcam doesn’t start anymore, you can reset it to the factory defaults.
With some effort it should also be possible to install a telnet or ssh binary to get remote access
Please keep me informed If you managed to get remote access.

Here is the process list of my webcam:

  PID  Uid     VmSize Stat Command
    1 root        316 S   init
    2 root            SW  [keventd]
    3 root            SWN [ksoftirqd_CPU0]
    4 root            SW  [kswapd]
    5 root            SW  [bdflush]
    6 root            SW  [kupdated]
    8 root            SW  [mtdblockd]
    9 root            SW  [ftld]
   10 root            SW  [khubd]
   13 root        312 S   init
   14 root        396 S   /bin/sh /etc/rc.d/rc.sysinit
   36 root            SW< [loop0]
  156 root        208 S   /usr/sbin/chkbutton
  158 root        220 S   /bin/op_server 0 0 0
  183 root        584 D   go-server
  184 root        416 S   ipv_server
  186 root        388 S   /bin/sh /etc/rc.d/
  188 root        416 S   ipv_server
  189 root        416 S   ipv_server
  196 root        288 R   /bin/ps x

Ovislink 5460 Webcam video grabber tool (MDGrab)

19. November 2006

I’ve finished the first version of a java based video grabber tool.
It grabs the live stream of the ovislink webcam and stores it into a file.
MDGrab Java Package (JRE 1.5.x required)

To start the video grabber command line tool, enter the following command:
java -jar MDGrab.jar [webcam IP-Address] [output filename]

Cellvision Header

18. November 2006

To get the plain mpeg4 video stream I had to remove Cellvisions additional header structure.
The header seems to be always 40 bytes long, and index 24-27 are the size of the following video data.
In java it look like this:

byte[] hdr = new byte[HEADERSIZE];
int r =;
//convert 4 bytes to an int
int ret = (hdr[27]& 0xFF)<< 24 | (hdr[26]& 0xFF) << 16 | (hdr[25]& 0xFF) << 8 | (hdr[24]& 0xFF);

I’ll provide a sample program later (check downloads).

WebCam Network Stream analysed

18. November 2006

After some hours of network tracing. I found out how the Webcam works:

It has multiple TCP Ports open:

Port 80 = Web Interface. All commands to control the webcam (pan&tilt…) are http requests.It also handles the authentication
Port 5000 = Stream initialization.
Port 5001 = Streaming Port, sends the video packets
Port 500 = documented as ipview port. But ipview pro does not connect to this port !
dynamic Port = UPnp Mediaserver port

The following sequence is used to start the video streaming:
1) connect to port 80 and authenticate (http authentication)
2) connect to port 5000, send a init sequence and disconnect
3) connect to port 5001, send a start sequence and receive the video stream (with a cellvision header in each packet)

Ovislink Airlive = Cellvision CAS670W

18. November 2006

Meanwhile I found out that the Ovislink Airlive 5460CAM is equal to the Cellvision CAS670W.

Cellvision seems to be the original developer of the Webcam, while tracing the network traffic I found a lot
of “Cellvision” strings in the package header.
Cellvision offers a Aragorn SDK which is a documentation of a webcam protocol (but not 100% equals).

Ovislink AIrlive 5460CAM

18. November 2006

I’ve bought a Ovislink Airlive 5460CAM Webcam.
It’s a really nice Webcam with integrated Wireless LAN and Pan&Tilt
A detailed specification could be found here Ovislink Airlive

After unpacking the webcam, I found out that the java applet was missing, instead an ActiveX plugin was
required to use the Webcam. WTF…
So, I’ve decided to implement my own java applet to capture the Webcam video.

Little Endian Debian on NSLU2

5. Juni 2006

I’ve installed the little Endian Debian port on my NSLU2.

  • +The official Debian Apt repository can be used
  • +More packages available
  • +Faster software updates
  • -Worser network performance
  • Howto change the playlist file to play from SD Card

    16. Januar 2006

    Some people ask me , how they can change the playlist file to work with the SDCard.So , I decided to write a short Howto:

    First you need a hex editor.
    For example HexEdit (Windows). Or KhexEdit (Linux)

    Then, you have to understand the playlist/spl format , here is a short description:

    01 00 00 00 00 00 Init Sequence
    00 00 00 00 Nr of Entries
    For each Entry:
    02 00 Init entry
    00 00 00 00 Entry number /position
    00 00 00 00 00 00 00 00 Filesize
    00 00 00 00
    00 00 00 00 Size of title
    ? ? ? ? ? ? ? ?
    00 00 00 00 Size of artist
    ? ? ? ? ? ? ? ? Artist
    00 00 00 00 Size of album
    ? ? ? ? ? ? ? ? Album
    00 00 00 00 Size of genre
    ? ? ? ? ? ? ? ? Genre
    00 00 00 00 Size of absolute file path
    ? ? ? ? ? ? ? ? Absolute file path
    00 Track nr
    00 Closing byte

    The important part is the “absolut file path”. This is the path where the aireo can find the mp3 file.
    Normally it would be something like \Disk\MyMusic\artist\album\title.mp3.
    Changing the “absolute file path” to \Storage Card\… causes the aireo to search on the SDCard.
    But you have to pay attention to the previous 4 bytes (”size of absolute file path”) ! These bytes define the
    length of the “absolute file path”.
    So you have the following options:
    1. Change \Disk\ to \Storage Card\ and change the mp3 file name so that the whole path has the same length as before.(don’t forget to rename the mp3 file.)
    2. Change \Disk\ to \Storage Card\ and add 8 to the “size of absolute file path”. (e.g. 3F 00 00 00 -> 47 00 00 00)

    That’s it ! The playlist contains now a song located on the SDCard !!

    Aireo Playlists on SD Card

    8. Dezember 2005

    Yes , it is possible to use Aireo Playlists on SD Card.

    The only difference is to use another path for the playlist entry:
    \Storage Card\My Music\…
    instead of
    \Disk\My Music\…

    I’m going to enhance Jasy to support playlists on SD Card.