Elektroda.com
Elektroda.com
X

Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown

nihildiximus 2328 19
This content has been translated flag-pl » flag-en View the original version here.
  • Producer: Ezvis
    Model: C6C (CS-CV246, A0-3B1WFR)

    Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown

    Description: Cheap Wifi camera by Ezviz operating via Hikvision protocol on port 8000 with RTSP on port 554. Based on STM8S003F3 (8S003F3P6) microcontroller (16-MHz STM8S 8-bit MCU, 8Kb flash, 128b EEPROM, 10-bit ADC, UART, SPI, I²C). The other circuits are visible in the pictures - I tried to make them legible. At the moment there is no alternative software. The device itself can be dismantled and assembled completely non-invasively (housing screws are located under the rubber band from the bottom - the rest are not hidden, the "head" of the camera is closed with latches).

    Teardown photos:
    Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown Camera Ezviz C6C (CS-CV246, A0-3B1WFR) teardown

    Cool? Ranking DIY
    About Author
    nihildiximus
    Level 8  
    Offline 
    nihildiximus wrote 30 posts with rating 18, helped 1 times. Live in city Wrocław. Been with us since 2018 year.
  • #2
    gulson
    System Administrator
    Thanks for showing the inside. The camera is very cheap, only PLN 160. Does it send any data to an external cloud? Can you just connect to Hikvision cameras?
  • #3
    khoam
    Level 42  
    Manufacturer's website (in Polish): https://www.ezviz.com/pl/product/c6c-ez360/1254

    Quote:
    Does it send any data to an external cloud?

    EZVIZ cloud proprietary protocol

    Added after 6 [minutes]:

    EZViZ is a brand of Hikvision, and Hikvision:
    "US government bans Huawei, ZTE and Hikvision tech over 'unacceptable' spying fears."
  • #4
    robig
    Level 21  
    Hi

    In addition, in recent camera firmware updates, EZVIZ began to mess with the RTSP stream, turning off the stream by default, thus "encouraging" users to use the cloud or memory cards to record events. In the thematic app, you can easily turn on RTSP using the original app, although the option is hidden, but for example, in the DP2C door viewfinder, there is no such option, also through EZVIZ Studio ... So if someone uses cameras of this brand and RTSP stream, then let go of the firmware updates.
  • #5
    nihildiximus
    Level 8  
    The advantage of cameras is that they are cheap. The downside is that after about a year, the two cameras do not keep the settings and after the power is cut off, they need to be reconfigured. I did not make a major diagnosis, but the 3.3V battery visible in the pictures had the correct voltage during the demolition. FW updates automatically, so I had to re-enable RTSP. The problem is that this option can only be enabled in the local network to which the camera is connected (it is in the local camera settings). When offline, there are no options in the app. Another minus is that I have not seen that the Ezviza intercom has neither rtsp nor the possibility of downloading the stream otherwise than through the application - there is even no possibility of connecting it to the NVR. An alternative soft for these devices would be very useful, or some kind of patent for controlling them through port 8000 and downloading the stream through this port, which would enable the creation of an independent application operating without the cloud.

    Added after 1 [minutes]:

    So far I haven't had time to sit down to it, but I think you can start testing from this: https://www.docdroid.net/wlD2i8v/hikvision-isapi-26-ipmd-service-pdf#page=22
  • #6
    kotbury
    Gantry automation specialist
    Maybe a little off the topic of changing the firmware, but since the camera works on the HikVision protocol, it will work with almost any NVR (including basic PTZ functions), and this can usually be forced to work not via the cloud, but via TCP with a dedicated smart app or computer and we have independence from the PRC and their servers.
    However, there is another dependence on something - for the NVR we must have a fixed external IP or use DynDNS services. Well, but you also need to have the net and be dependent on its provider.
    This operation is a bit lame, but the less so, the more branded the NVR is.
    Anyway, you can do the same with the webcam itself if it has a web server. Does the camera have this option?
  • #8
    elektryku5
    Level 39  
    kotbury wrote:
    Anyway, you can do the same with the webcam itself if it has a web server. Does the camera have this option?


    I do not know about this model, but I once had the misfortune of configuring another camera-like product from the land of rice, no www, no possibility to connect the application via LAN, preview only via the cloud ...

    chemik_16 wrote:
    I have a whole carton of IP cameras, I'm counting on projects in the style


    It would be nice if this developed, because even apart from security issues, you can often get a headache on the factory camera and recorder software when it works as it pleases.
  • #9
    rusudanion
    Level 2  
    Hello i have two ezviz camera ,they are not unbind from account. works only in lan mode . Can i use in other mode ?
  • #10
    Daroken
    Level 8  
    I recently bought a similar XIAOMI Mi Home Security Camera 360 PTZ 2K Pro. How to take strim from it because I want to use it in Home Assistant.
  • #11
    chemik_16
    Level 25  
    You can't, you need to look for alternative software. Or ride through the clouds.
  • #12
    robig
    Level 21  
    Can a friend recommend such an app?

    kotbury wrote:
    since the camera works on the HikVision protocol, it will work with almost any NVR (including basic PTZ functions), and this can usually be forced to work not via the cloud, but via TCP with a dedicated app for a smart or computer, and we are independent of the PRC and their servers .
  • #13
    kotbury
    Gantry automation specialist
    Adult registrars have a dedicated app, but personalized for a specific company; for example, in the case of BCS, Dahuy, these are different types of DMSS, HikVision devices have the BitVision app, personally I have all the equipment (both cameras and recorder) based on Xionmaitech chipsets, i.e. XAI - it comes with this (and cameras, and NVR) ISS Mobile 1.5 app .7 (which is not in GooglePlay). So that's a lot of searching and matching with no guarantee it will work. And the basis - the equipment must be able to connect and configure via www. And whether the title camera has such a possibility at all - to be checked.
    Monitoring experts may write more (I'm rather an amateur myself).
  • #14
    Daroken
    Level 8  
    chemik_16 wrote:
    You can't, you need to look for alternative software. Or ride through the clouds.
    Can you tell me more about alternative software?
  • #15
    Duch__
    Level 31  
    It's a pity that in these cameras Ezviz does not go to set presets.
  • #16
    nobanmeplease
    Level 16  
    Maybe someone will make a list of cheap outdoor IP cameras and PTZ, which can be technically configured inside the local network without external clouds and unreliable applications?
    This would greatly help in the selection of equipment for budget installations that emphasize discretion and simplicity when servicing in closed networks.
  • #17
    Daroken
    Level 8  
    How is access to a stream blocked?
    If strim goes through the cloud how does it work?
  • #18
    nobanmeplease
    Level 16  
    Daroken wrote:
    How is access to a stream blocked?
    If strim goes through the cloud, how does it work?

    When it comes to the smart IP cameras themselves, there is no blockage here. Normally, the camera's API architecture is client-based and connects to the domain name through which access to stream, settings, etc. is made.
    As for closed networks, they are simply listening to the DHCP server that reserves ipv4 for MAC addresses and there is no configured gateway to the network above.
  • #19
    Daroken
    Level 8  
    How can you take over strim to the cloud to view the image directly in the local network?
  • #20
    nobanmeplease
    Level 16  
    This is a river topic dedicated to those who sit at CTFs. When I get such a camera, I will use wireshark to examine the packets and maybe I can somehow cheat certificates or find some very lame implementation of the protocol.