RTSP hack for Xiaomi Mi Square (XiaoFang)

Apr 6, 2017

I reviewed the Xiaomi Mi Square aka XiaoFang recently and I regretted that this excellent IP Camera would only work with its dedicated app.

Well... this has changed thanks to some talented hackers...






This article is outdated and does not apply to the current production of XiaoFang
 due to firmware changes from Xiaomi. It is kept only for reference.

This is a work in progress that started early this year and gives promising results already!

The #fang-hacks project reminds me of the joys of hacking the H502W some time ago, and effectively jail-breaks the XiaoFang camera by adding various services (rtsp, telned, ftp, ...). 

The ability to disable the Cloud service is a good news for those concerned that it would put their privacy at risk. 
The IR Control script might require attention as it could be related to a known Overheating issue.

Once the hack is installed on the camera (everything you need to know is there: https://github.com/samtap/fang-hacks , proceed at your own risks!), the scripts can be controller via a web interface. 
http://device-ip/cgi-bin/status



The installation:
- Proceed to the release page to download the latest SD-Card Image archive
- Unzip the SD-Card Image file 
- Use a tool such as Win32 Disk Imager to perform a raw copy of the fanghacks_vx.x.x.img to a micro-SD card.
- Power up the XiaoFang 
- Insert the micro-SD card. If you hear "ting-ting" shortly after, you can proceed to:

http://device-ip/cgi-bin/status

- Finally, click on "Apply" button to apply the hacks.

Again, proceed at your own risks!  
























I applied it to my camera after updating it to the latest firmware currently available (3.0.3.56) and now have a working addition to my Synology Surveillance Station using RTSP:

rtsp://device-ip/unicast

...and this includes the audio stream!







28 comments:

  1. There's a newer IR control script available:
    http://bobbyromeo.com/technology/xiaomi-smart-1080p-wifi-ip-camera-rtsp-streaming-hack#heat

    ReplyDelete
    Replies
    1. Thanks for the heads up Penguin Dude! :-)

      Delete
  2. I'd love to get one of these but I would need someone to help me to hack it.
    Is it possible to record and view the output on both IOS and Android, (Sorry but I don't understand rtsp though I know it's something to do with this!)

    ReplyDelete
  3. Hey, say... You seem to know your stuff. I'm sorry to ask so coldly, but there's no real "Contact Us" feature, so I can't really ask directly...

    I have a Sricam SP012 right now, and I just switched to a Windows Phone (Lumia 950) because I can't afford the HP Elite X3, because of Windows 10, my XBOne, and because I was fed-up with Google, and that phone just fit the bill (but I digress), however, one thing I can't do anymore is use the Sricam app.

    So my question to you is: Do you know a similar camera (with pan/tilt, motion sensor, e-mail alert, two-way audio, etc.) that has a web server?

    I don't care so much about the app feature, my main thing is using it as an alarm system, so as long as I can do that from outside the door, or on VPN, or even trough the internet connection, it's fine...

    If you know a Windows phone app that you know for sure can activate the motion sensor of the camera, that would work, too, or even on the PC - I can use remote desktop, no problem.

    But for security, I'd really like a camera that just has a web server. I'd like it to sit quietly alone in its corner... I'm not fond of Chinese slapped-together apps, even less desktop apps, so if you know a few good devices you could recommend me, I'd appreciate.

    Also, I don't often think that, but it doesn't usually strike me, either... good job with the reviews! I understand you're just starting out, but I like the aspects you cover, and the tone you use, the stance you take... I think you have potential, and maybe you could ask for bigger hardware to review, get yourself more hits...

    Thanks in advance if you get this, and you reply! : D

    ReplyDelete
    Replies
    1. Hi Patrick, thanks for your message.
      Wanscam has got some good models that stand out from the crowd. The best so far in my opinion is the HW0049. It has a complete Web interface with Flash Player (no crappy ActiveX plug-in), P&T, email alert and 2-way audio (almost as good as the Mi Square).
      Cheers!

      Delete
  4. Hi bubbah,
    Please, can you explain me how did you add (step by step) the xiaofang in the synology survillance station?
    I have a xiaomi yi ants and today i added, but i dunno how to do it with xiaofang. I have 2 xiaofang hacked with the rtsp activated.

    tha ks

    ReplyDelete
    Replies
    1. Hi Juanma, you really just need to add a [user define] camera with port 554 and with /unicast as the source path. Pretty much like the URL in the last VLC screenshot from the article above.

      Delete
    2. Hi Bubbah,
      And you don't need to create a configuration file in synology survillance like this link?

      https://ahkhai.com/tag/surveillance-station/

      In my case i know which is the path to see camera via rtsp using vlc, but with survillance of synology i'm really new, please, can you explain with detail like link before?

      thanks

      Delete
    3. Hi Bubbah,
      I tried to add camera as generic camera with these fields to complete:
      -Name: Cam2
      -IP: 192.168.X.X
      -Port: 554
      -Trademark: User
      -Model: Define
      -Video_format: H264
      -Origin route: /unicast
      -User: "blank"
      -Pass: "blank"

      And synology survillace applicaciotn says failed. What i'm doing wrong? My camera has link...

      thanks

      Delete
    4. Hi,

      At the end i obtained! was very easy! The problem was that i didn't activate the rtsp protocol :)
      sorry!

      bye

      Delete
    5. Hi Juanma, happy to hear you're sorted. Sorry I couldn't help much but was very busy lately. Cheers!

      Delete
    6. Has anyone tried viewing the RTSP stream on VLC remotely? RTSP works in my local network but not when it is outside my local network. I did do the port forward and I can see the port is open on canyouseeme.com. I forward internal port 554 to external port 554.

      When I am in my local network, I typed the following and it works on VLC.
      rtsp://192.168.1.100/unicast

      When I am outside my local network and say my WAN address is 250.168.220.2 for example. I typed the following and RTSP doesn't work on VLC.
      rtsp://250.168.220.2:554/unicast

      Delete
  5. I want to access to the camera remotely via 3g with my mobile phone, but I have no idea about how to do it. I can access by WiFi but it's not enough for me

    ReplyDelete
  6. thank you very much! it 's work on my synology

    ReplyDelete
  7. Tried the hack but the following message appeared:

    Script is already installed!
    Error: Nothing is mounted on /media/mmcblk0p2!

    Tried the manual mount but failed. Any remedy?

    thanks.

    ReplyDelete
    Replies
    1. Mounting /dev/mmcblk0p2 to /media/mmcblk0p2...
      Device is present (filesystem: ext2)
      mount: mounting /dev/mmcblk0p2 on /media/mmcblk0p2 failed: Device or resource busy
      Failed to mount!

      Delete
  8. @bubbah,
    after change the firmware (enable rstp), still we can use this cctv with app MiHome ?
    and how much success rate change that firmware ?
    Thx

    ReplyDelete
    Replies
    1. Hi Raka,
      I've been using this hack exclusively for months now and don't have/use MiHome anymore but, at the beginning, I remember that MiHome was working with the hack present.
      I have activated an option to disable the "cloud services" (because I don't trust these cameras calling their motherland every so often), but unless you do use that option, it should still work with MiHome.
      Cheers

      Delete
    2. @Bubbah
      thx for reply...
      more quetion -> event if we enable cloud services, does rstp still active ?

      Delete
    3. Both services can work together, just no sure if they can both stream simultaneously. I didn't test that.

      Delete
  9. after enabling the hack. how to connect the camera to wifi. should we connect through mi home app

    ReplyDelete
  10. I unplugged my xiaofang and followed the instructions but now just flashes blue. Cannot connect to wifi OUTSIDE of home. Only if on wifi router at home is working. IS this being blocked by xiaomi?? HELP.

    ReplyDelete
  11. I have a fresh camera that only works in China. I haven't powered it on at all. Would I need to connect to the WiFi network via their app, even if it bricks my camera, before installing the hacks via micro SD?

    Thanks

    ReplyDelete
  12. This no longer works due to updated cameras blocking the hack.

    ReplyDelete
  13. the snx_autorun.sh can not be loaded by the latest firmware :(

    ReplyDelete
  14. I need stream my xiaofang on VLC, is necessary a hack it?

    ReplyDelete
  15. I have an issue getting the camera running on synology (DS218play DSM 6.1.4-15217 Update 2). I'm using the same settings as Juanma, and have rtsp streaming on. If I click test, I get an ok sign. But when clicking next, I get the error message "failed to load camera capabilities values"
    Any advice??

    ReplyDelete