Author Topic: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?  (Read 10316 times)

kgrr

  • Full Member
  • ***
  • Posts: 148
  • Karma: +0/-0
  • My obsession: Totally automating my townhouse
    • My Facebook Page:
I have had some limited success with the Iris (Sercomm) RC8221 camera (available at Lowe's) so far.
Here is the spec sheet:
http://www.sercomm.com/SWI/downloads/product/data_sheet/RC8221_EN.pdf

Basic Capture
I have plugged it into vera's LAN and I do get a capture picture with it.
It does provide a capture on a web page.  192.168.x.y is in Vera's LAN subnet.
http://192.168.x.y/img/snapshot.cgi

Full Motion
It's in full color and does produce motion video

Night Vision
It does have LEDs that light up the area in front of it to take IR shots.  This is automatic according to the spec sheet.

Wireless
I have not figured out how to pair it over Wi-Fi with my Vera 2.
I have not found its admin web pages yet.

The camera has a motion detector
I have not figured out how this works with the rest of the camera.

Does anyone have anything to add?
---------------------
Vera2 (1.5.255, UI5); ACT ZRW113W; Aeon HEM, SmartSwitch, GE/Jasco 45600, 45601, 45602, 45603, 45604, 45605, 45606, 45609, 45614; Hawking HRDS1; Intermatic CA9000; Schlage BE369GR, WCE100; SQ Blaster Plus; Squeezebox; Trane TZEMT400AB32MAA

duomenox

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #1 on: September 30, 2012, 12:16:18 pm »
I am very interested in these cameras too... I was hoping to find a lower cost camera that I could pickup locally for use in my personal DVR using the free software from ACTI (free for up to 16 cameras).

This is what I have been able to find out:

H.264 streaming @ 640x480, 5 fps (large delay), no audio, address:
http://<ip_of_camera>/img/video.sav

H.264 streaming @ 640x480, 5 fps (large delay), with audio, address:
http://<ip_of_camera>/img/media.sav

Audio only streaming, address:
http://<ip_of_camera>/img/audio.sav

H.264 streaming @ 1280x720, 30 fps (small delay), no audio, address:
http://<ip_of_camera>/img/video.sav?channel=2

H.264 streaming @ 1280x720, 30 fps (small delay) , with audio, address:
http://<ip_of_camera>/img/media.sav?channel=2

There does not seem to be any web interface... I think it was stripped out of the product...
There are some admin CGIs that are available under the http://<ip_of_camera>/adm/ folder but I have not been able to figure out the credentials yet.
Sercom documentation states the default username is "administrator" with a blank password... but it looks like Lowes changed the password.

I hope that helps a bit... if someone has the oppertunity to figure out the admin password, that would be great... I'm not great at password cracking myself.

I'm hoping the forum will allow me to attach the PDF I found for the exact same camera, just rebranded. All the user and admin API commands are listed in the couple last sections of the document. This shows a web interface... but I'm guessing it can be stripped out (or at least turned off) by the company that is OEMing the product.

Well, it won't let me attach it... it's toobig, even compressed. Hopefully you can still get it from the following URL:
www(dot)eyespy247(dot)com-site/media-support/docs-support_35.pdf


Please post back if you uncover anything... I'm curious to know if I can use this for my project too.

BOFH

  • Sr. Member
  • ****
  • Posts: 415
  • Karma: +3/-0
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #2 on: September 30, 2012, 04:09:52 pm »
Your download URL for the spec sheet is somewhat messed up. The correct one is:

http://www.eyespy247.com/site_media/support_docs/support_35.pdf

I wonder if these camera's can be re-flashed with the factory firmware to restore full functionality. Such as can be done for the Schalge/ADT ones. The firmware is on the website and there is the http://<ip>/adm/upgrade.cgi (Upgrade Firmware) admin command. It also appears to have a read and update config option. Only to wait until someone figures out the admin password and is willing to risk bricking a $129 camera. :-)
« Last Edit: September 30, 2012, 04:25:41 pm by BOFH »
Vera3 UI5
Trane TZEMT400AB32 | Schlage BE369 FE599 | GE 45601 45602 45603 45604 45606 45609 | Intermatic HA01C HA03C HA05C HA07C CA600 CA3000 | Aeon DSC06106 | Foscam FI8910W FI8905W FI9821W | D-Link 930L | Wanscam JW0011

duomenox

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #3 on: September 30, 2012, 05:19:46 pm »
Sorry about that... the board would not allow me to post links to extenal sites so I had to try to mod it a bit... I'm guessing I have not passed a post threshold.

I'm thinking the flash would work just fine... it's just a rebranded RC8221 from Sercomm... I ended up taking the camera back for now I was getting too tempted to open it up and see if there was a jtag port in it :-)

I'll see if I can find anything out about these cameras... there is probebly some backdoor password we could use...

kgrr

  • Full Member
  • ***
  • Posts: 148
  • Karma: +0/-0
  • My obsession: Totally automating my townhouse
    • My Facebook Page:
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #4 on: October 01, 2012, 10:50:44 pm »
Search the FCC ID  Grantee Code: P27 Product Code: -RC8221 
on FCC's website:  http://transition.fcc.gov/oet/ea/fccid/
Yields this:
https://apps.fcc.gov/eas/GetApplicationAttachment.html?id=1418905
---------------------
Vera2 (1.5.255, UI5); ACT ZRW113W; Aeon HEM, SmartSwitch, GE/Jasco 45600, 45601, 45602, 45603, 45604, 45605, 45606, 45609, 45614; Hawking HRDS1; Intermatic CA9000; Schlage BE369GR, WCE100; SQ Blaster Plus; Squeezebox; Trane TZEMT400AB32MAA

sorphin

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #5 on: November 08, 2012, 12:28:17 pm »
I've been digging on the hub and the camera..

while monitoring with tcpdump, i found the UPNP traffic the camera sends out, including a link to:
it's IP: 192.168.1.114 Port:6789 Path: /device.xml (the board thought i was posting a link when I wasn't, so i had to modify it)

which contains:
Code: [Select]
<root xmlns="urn:schemas-upnp-org:device-1-0">
<specVersion>
<major>1</major>
<minor>0</minor>
</specVersion>
<URLBase>http : //192.168.1.114:6789</URLBase>
<device>
<deviceType>
urn:schemas-upnp-org:device:Wireless Network Camera:1
</deviceType>
<friendlyName>RC8221-RC82219278E2</friendlyName>
<manufacturer>Sercomm</manufacturer>
<manufacturerURL>http : //www.sercomm.com</manufacturerURL>
<modelDescription>Wireless Network Camera</modelDescription>
<modelName>Wireless Network Camera</modelName>
<modelNumber>RC8221</modelNumber>
<UDN>uuid:4d756c74-694d-6564-6961-000e8f9278e2</UDN>
<serviceList>
<service>
<serviceType>urn:upnp:service:BasicService:1</serviceType>
<serviceId>urn:upnp:serviceId:BasicServiceId</serviceId>
<controlURL>/upnp/control/BasicServiceId</controlURL>
<eventSubURL>/upnp/control/BasicServiceId</eventSubURL>
<SCPDURL>/scpd_basic.xml</SCPDURL>
</service>
</serviceList>
<presentationURL>http : //192.168.1.114</presentationURL>
<style type="text/css" style="display: none !important;">
object[classid$=":D27CDB6E-AE6D-11cf-96B8-444553540000"],object[classid$=":d27cdb6e-ae6d-11cf-96b8-444553540000"],object[codebase*="swflash.cab"],object[data*=".swf"],embed[type="application/x-shockwave-flash"],embed[src*=".swf"],object[type="application/x-shockwave-flash"],object[src*=".swf"],object[codetype="application/x-shockwave-flash"],iframe[type="application/x-shockwave-flash"],object[classid$=":166B1BCA-3F9C-11CF-8075-444553540000"],object[codebase*="sw.cab"],object[data*=".dcr"],embed[type="application/x-director"],embed[src*=".dcr"],object[type="application/x-director"],object[src*=".dcr"],object[classid$=":15B782AF-55D8-11D1-B477-006097098764"],object[codebase*="awswaxf.cab"],object[data*=".aam"],embed[type="application/x-authorware-map"],embed[src*=".aam"],object[type="application/x-authorware-map"],object[src*=".aam"],object[classid*="32C73088-76AE-40F7-AC40-81F62CB2C1DA"],object[type="application/ag-plugin"],object[type="application/x-silverlight"],object[type="application/x-silverlight-2"],object[source*=".xaml"],object[sourceelement*="xaml"],embed[type="application/ag-plugin"],embed[source*=".xaml"]{display: none !important;}
</style>
</device>
</root>
« Last Edit: November 08, 2012, 12:43:59 pm by oTi@ »

kgrr

  • Full Member
  • ***
  • Posts: 148
  • Karma: +0/-0
  • My obsession: Totally automating my townhouse
    • My Facebook Page:
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #6 on: November 14, 2012, 08:21:06 am »
Do you have an Iris controller, or were you just hooking up the camera to your LAN and sniffing the traffic?  I would be curious to see what the traffic to the camera looks like during setup.
---------------------
Vera2 (1.5.255, UI5); ACT ZRW113W; Aeon HEM, SmartSwitch, GE/Jasco 45600, 45601, 45602, 45603, 45604, 45605, 45606, 45609, 45614; Hawking HRDS1; Intermatic CA9000; Schlage BE369GR, WCE100; SQ Blaster Plus; Squeezebox; Trane TZEMT400AB32MAA

sorphin

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #7 on: November 14, 2012, 11:44:44 am »
Do you have an Iris controller, or were you just hooking up the camera to your LAN and sniffing the traffic?  I would be curious to see what the traffic to the camera looks like during setup.

Both. I've tried doing MITM stuff, and actually watching it on the Iris controller. I've made a lot of progress on the 'internals' of the Iris hub. It's on another forum though, and i'm not sure if i'm allowed to link to the thread posts i've made.  The traffic visible on the hub itself in the logs, is minimal.. you just vanilla messages... If I actually run a 'strings' on the Iris 'hubapp' program, i see all the urls it'll ever use to talk to the camera.. I even have access to the certs and private key now for the camera, sitting on the hub... but i've yet to be able to get anywhere with any of it.. I've emailed the manufacturer of the camera, twice. (Sercomm), no response. All traffic is SSL encrypted. (hence my attempts at doing a MITM attack on it)

All the Iris log shows is crap like this:
2012-11-14 14:20:18 :[GENERIC] CAM: 00-00-00-0E-8F-92-78-E2: Hub camera certificate
2012-11-14 14:20:18 :[GENERIC] PUBLIC KEY MEM 0
e2012-11-14 14:20:18 :[GENERIC] CAM: format_get_wireless
v2012-11-14 14:20:18 :[GENERIC] CAM: 00-00-00-0E-8F-92-78-E2: LQI 99

Update:

It would appear, they use passphraseless private keys on the hub for the camera, etc..  That makes my job a lot easier all the sudden.
« Last Edit: November 14, 2012, 09:26:03 pm by sorphin »

sorphin

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #8 on: November 17, 2012, 03:01:51 pm »
I found that the little 4 pin connector on the board of the camera is infact a TTL serial port, so i hooked up my USB->TTL adapter, and got a console on the camera.. I tried to paste the output here, but there's a 20k character limit...

kgrr

  • Full Member
  • ***
  • Posts: 148
  • Karma: +0/-0
  • My obsession: Totally automating my townhouse
    • My Facebook Page:
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #9 on: December 10, 2012, 01:14:43 am »
Sorphin, it looks like you've made a bit of progress, having found the console serial port.  What do you see? 
---------------------
Vera2 (1.5.255, UI5); ACT ZRW113W; Aeon HEM, SmartSwitch, GE/Jasco 45600, 45601, 45602, 45603, 45604, 45605, 45606, 45609, 45614; Hawking HRDS1; Intermatic CA9000; Schlage BE369GR, WCE100; SQ Blaster Plus; Squeezebox; Trane TZEMT400AB32MAA

sorphin

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #10 on: December 12, 2012, 06:44:58 pm »
Sorphin, it looks like you've made a bit of progress, having found the console serial port.  What do you see?

usual console messages... kernel, apps starting, wifi / ethernet decision making... Unfortunately... the console doesn't respond to input.. (not sure if the hardware has been tampered with, or if it's in their drivers.. the same cable works just fine for the iris hub)....  Also... The manufacturer is of no help, due to their contracts with Lowes... My contact DID however inform me, that in the coming months... "another major retailer" will be OEM'ing these same cameras, hopefully a bit more open than Lowes is. If you want the full log, i can provide that (since I can't post it here, it's too long)

kgrr

  • Full Member
  • ***
  • Posts: 148
  • Karma: +0/-0
  • My obsession: Totally automating my townhouse
    • My Facebook Page:
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #11 on: December 15, 2012, 09:48:43 am »
I did run into this document, where the RC8221 is being used with a security server of some sort. 
http://buy.dmp.com/dmp/products/documents/LT-1249.pdf
They offer three ways the RC8221 can be setup, but none of them allow the WPA2 keys to be set.  All Wi-Fi methods they present involve a WPS setup method.


---------------------
Vera2 (1.5.255, UI5); ACT ZRW113W; Aeon HEM, SmartSwitch, GE/Jasco 45600, 45601, 45602, 45603, 45604, 45605, 45606, 45609, 45614; Hawking HRDS1; Intermatic CA9000; Schlage BE369GR, WCE100; SQ Blaster Plus; Squeezebox; Trane TZEMT400AB32MAA

sorphin

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #12 on: December 15, 2012, 08:24:16 pm »
I did run into this document, where the RC8221 is being used with a security server of some sort. 
http://buy.dmp.com/dmp/products/documents/LT-1249.pdf
They offer three ways the RC8221 can be setup, but none of them allow the WPA2 keys to be set.  All Wi-Fi methods they present involve a WPS setup method.

Unfortunately, most things don't support WPS now (insecurity), and these cameras, when IRIS'd, limit themselves to 720p @ 5fps max, and stuff like that.

blakemanster

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #13 on: December 19, 2012, 03:24:16 pm »
Sorphin, I'm interested in where that thread is for the Iris Hub you have on another Forum.  I have created an SDK for accessing all of their HTTPS cloud based api calls, in C#/.net 4.5.  I'm about to open source it, it's complete with the exception of Magic, Senior Care, and Energy (haven't had the money to buy the devices).

Cheers!

sorphin

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
Re: Has anyone used the Lowes Iris (Sercomm) RC8221 camera with a Vera?
« Reply #14 on: December 19, 2012, 07:35:18 pm »
Sorphin, I'm interested in where that thread is for the Iris Hub you have on another Forum.  I have created an SDK for accessing all of their HTTPS cloud based api calls, in C#/.net 4.5.  I'm about to open source it, it's complete with the exception of Magic, Senior Care, and Energy (haven't had the money to buy the devices).

Cheers!

It's not directly for the Iris hub, but there are talks about it on there...
http://forum.alertme.org.uk/viewtopic.php?f=4&t=97&p=328