IP Video Door Bell - Atz-dbv01p

Others (MiLight, Hue, Toon etc...)
riogrande75
Posts: 21
Joined: Thursday 27 October 2016 7:38
Target OS: Linux
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by riogrande75 » Wednesday 11 October 2017 14:00

xman71 wrote:
Wednesday 11 October 2017 12:22
Could you send me by MP the UDP packet to use ?
No, just read what I wrote y'day. The packet will look different for all deviceID/password combinations. My packet will not work with your device.
But finding the correct one is quite easy: You have to get the IPC_DEBUG_TOOL from http://www.gwell.cc/e/DownSys/GetDown?c ... 6&pathid=0
Let it find your device in your LAN, add correct password (just like in my translated screenshot from above).
Then start your sniffer (wireshark) and click unlock.
When you hear switching of the relay, then you know it works.
Find the UDP packet that was sent by your PC to the doorbell's port 51880 exactly when you clicked and send it again by e.g. "Packet Sender". Works a 100% for me.

xman71
Posts: 6
Joined: Monday 22 February 2016 11:31
Target OS: NAS (Synology & others)
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by xman71 » Wednesday 11 October 2017 15:42

Thanks Rio.
I thought you were talking about a way to do this without uart.
Sorry for the misunderstanding.

Envoyé de mon SM-G935F en utilisant Tapatalk


riogrande75
Posts: 21
Joined: Thursday 27 October 2016 7:38
Target OS: Linux
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by riogrande75 » Thursday 12 October 2017 7:09

Hi Xman!
Yes, in fact you can open the door from your LAN without UART. Just find the right UDP packet as described.
If you solve the doorbell push notification with an email that you filter somehow, you do not have to open the bell at all.

Due the fact, a simple fake UDP packet can open the your house's door, it's irresponsible risky to let the device access the internet or to switch on wifi!
I block internet access completely on my firewall and shutdown the wifi interface on the device

Code: Select all

ifconfig wlan0 down

riogrande75
Posts: 21
Joined: Thursday 27 October 2016 7:38
Target OS: Linux
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by riogrande75 » Tuesday 31 October 2017 9:01

Too less response from other users - I give up and will sell it again.

dolby44
Posts: 4
Joined: Wednesday 15 June 2016 15:36
Target OS: Linux
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by dolby44 » Saturday 04 November 2017 0:41

Hello,
Have anyone tested to listen to the 433 chime with RFXCOM or RFLINK ?

Thank you

BobS
Posts: 25
Joined: Friday 05 June 2015 11:49
Target OS: Raspberry Pi
Domoticz version: beta
Location: Rotterdam, NL
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by BobS » Monday 06 November 2017 15:59

Hi,
I can see the doorbell in RFLink not in RFXCOM.

dolby44
Posts: 4
Joined: Wednesday 15 June 2016 15:36
Target OS: Linux
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by dolby44 » Wednesday 08 November 2017 10:24

Oh great ! Thanks you !

Envoyé de mon Redmi 3S en utilisant Tapatalk


robsonEXD
Posts: 1
Joined: Thursday 11 January 2018 3:41
Target OS: OS X
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by robsonEXD » Thursday 11 January 2018 3:45

Riogrande75: I'm very interesed in this device, with the information which was gave by you here I was able to manage to access my device. You mentioned earlier that you made MQTT client for this architecture. Can you share these with us?

riogrande75
Posts: 21
Joined: Thursday 27 October 2016 7:38
Target OS: Linux
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by riogrande75 » Sunday 14 January 2018 12:03

I do not have the device anymore. But here are the 2 mqtt files (binary), that I crosscompiled for running on this hisilicom platform:
https://expirebox.com/download/3e47aad7 ... 2c812.html
Pls. dont ask anything about it - I might not be able to help you.

burton666
Posts: 106
Joined: Monday 17 August 2015 21:25
Target OS: Raspberry Pi
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by burton666 » Monday 12 February 2018 12:01

josesmith wrote:
Monday 29 August 2016 5:01
This video doorbell is based on Gwell Hi3518E + OV9712 hardware design, the RTSP and ONVIF information can be found on Yoosee camera faq page: http://www.yooseecamera.com/faq.html

rtsp://IPadr:554/onvif1
Main stream rtsp://IPadr:554/onvif1
Sub-stream rtsp://IPadr:554/onvif2

ONVIF port: 5000; Device discovery port: 3702

In addition to use the Yoosee App, there are many alternatives including 2CU, COT PRO. Additionally, you can use any ONVIF compliant software/app to access the camera.
Where do I buy the Yoosee camera?

User avatar
dyter
Posts: 7
Joined: Thursday 08 February 2018 16:48
Target OS: NAS (Synology & others)
Domoticz version: 8841
Location: Lyon
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by dyter » Friday 16 February 2018 18:26

I bought ATZ-DBV03P with good aluminium body here:
https://www.ebay.fr/itm/eBELL-ATZ-DBV03 ... 2769935705

There are 2 versions of ATZ-DBV03P. One here with small firmware:
http://www.atz-tech.com/news/38-en.html

And mine, Gwell version:
http://www.gwell.cc/e/action/ShowInfo.p ... =102&id=22
Flashtool:
http://www.gwell.cc/e/action/ShowInfo.p ... =101&id=20
Unpack bin tool:
https://github.com/zzerrg/gmfwtools

I test downgrade from 13.00.01.10 to 13.00.00.99 with success.

If you someone can extract . bin for hack ? :roll:

sergiucip
Posts: 1
Joined: Monday 05 March 2018 19:09
Target OS: Raspberry Pi
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by sergiucip » Tuesday 06 March 2018 17:27

About rf 433MHZ ring button:

Step 1. Buy a sonoff RF bridge
Step 2. Install ESPURNA FRIMWARE on it ( http://tinkerman.cat/hacking-sonoff-rf-bridge-433/ )
Step 3. Put Sonoff RF in Learning Mode, push the button on the IPCAM device.
Step .4 Save the learnig code in one of the swtich position

Now you have an MQTT mesage for pressing the button on the intercom and that message cant be interpreted in Openahb or HASS or Domoticz or other solution
If you have a Broadcom RF switch the learning button with change frequency mode, standard learnig doesnt work./

Tested and working on Sonoff RF, with broadcom i do just a a small experiment.

Now, i f u guys tell me how to make the modification in linux to run the scripts from riogrande75because if i do " vi /etc/init.d/rcS " command in the next reboot we will loose aditions code in the rcS file. I wish to undestand how can i run a script in case of reboot

what i discover so far:
1. Conect the device with USB UART ( conect only the RX/TX and GND pins)
2. Run putty , select serial . name you com number, select baud rate at 115200 and conect

if you connected in correct order RX,TX and GND you should see a console with running lines

3.Now write in console telnetd to enable telnet
4. Conect with putty in telnet mode port 23
5 Login as root
6 Press enter (do not entry any password )

and you sould see somthing like this

(none) login: root
Welcome to HiLinux.
#

and now you will cracked the box

My device is like user jumble , see page 3

i am not shure i understand the riogrande75 work, how hi can run a custom scritp on boot the device
And can somebody send to me riogrande75 mqtt scripts, thank you!

So, to enable telnet for remote acces you must do the following steps
1. Connect with UART to the device
2. Wait for booting to complete
3. write " telnetd " without quotes
4. open putty and set it to com conexion, choose your com number ( see in windows devices manager) set the baudrate to 115200, and conect to device with telnet trough LAN or WIFI
5. If you are succesufully you should see the awesome message " (none) login:" type root and enter and voila: "

Code: Select all

(none) login: root
Welcome to HiLinux.
#

6. run command

Code: Select all

 vi /npc/npc-scritp
7. paste this code

Code: Select all

#!/bin/sh
telnetd &
/npc/npc-exe
escape and type :wq to write the file

8 run this command to move the original npc executables

Code: Select all

mv npc npc-exe
9 run this command to move npc-script to npc

Code: Select all

mv npc-script npc
OBS: Now the npc is the bell app and run at every restart so we renamed with npc script to npc, adn move the original npc to npc-exe (thanks riogrande to this tip)
10 reboot the device and you should be able to telnet this toy without UART in you lan
11. If you want to disble WIFI interface put in npc script this line

Code: Select all

ifconfig wlan0 down
adn save it again with :wq command

At this step you should be able to have full root acces with telnet and noe it is time to do some scripting:

What we should do: well Install a mqtt script to send message from button and maybe open the relay for door access and right now i dont know how to do that.

Thats it for now. If riogrande75 see my message , please send the mqtt file becouse the llink where you put it is expired and i cant PM for it, maybe because i dont have allot of post here. So please help if you like and THANKS RIOGRANDE75 for the multiple tips

User avatar
dyter
Posts: 7
Joined: Thursday 08 February 2018 16:48
Target OS: NAS (Synology & others)
Domoticz version: 8841
Location: Lyon
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by dyter » Monday 19 March 2018 22:34

I built a RFLink with gateway 433Mhz for <10€. Bell is show as "SelectPlus3" and this work fine 8-)

Image

dementeb
Posts: 1
Joined: Monday 21 May 2018 11:19
Target OS: Linux
Domoticz version:
Contact:

Re: IP Video Door Bell - Atz-dbv01p

Post by dementeb » Monday 21 May 2018 11:47

Thanks sergiucip for good howto.
A small additional:

Code: Select all

chmod +x /npc/npc 
needed for new script file

I also start ftp server and try to send output to file:

Code: Select all

#!/bin/sh
telnetd &
tcpsvd -vE 0.0.0.0 21 ftpd -w /mnt &
mount /dev/mmcblk0p1 /mnt/disc1 -t vfat -o relatime
/npc/npc-exe &>/mnt/disc1/npc.log
also we can see output with tail proc:

Code: Select all

ps | grep npc
  791 root      1704 S    /bin/sh /npc/npc
  797 root      252m S    /npc/npc-exe
  849 root       992 S    udhcpc -i eth0 -t 15 -b -s /npc/dhcp.script -p /mnt/ramdisk/dhcpc_eth0_pid.txt
  859 root       984 S    udhcpc -i wlan0 -t 15 -b -s /npc/dhcp.script -p /mnt/ramdisk/dhcpc_ra0_pid.txt
 1115 root      1704 S    grep npc
tail -f /proc/797/fd/2
Also to riogrande75 - thanks for you hard work! If possible, please share binary again. MQTT from this bell its my dream )

Thanks. Sorry for my English.

Update:
Big thanks riogrande75! Sorry I don't have rights here for write PM.

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest