YooSee SD-M5 doorbell: 1080p, PoE, RTSP, Onvif, only $66

brommetje said:
is there a way to change some options? what happens if you can change DBWaitSoundEnable = 0 maybe that terrible telephoning sound is gone if you push the bell/button?
running fw 13.1.1.36
Click to expand...
IMHO If you want that terrible telephone sound gone ditch the app and block the SD-M5 from accessing WAN. It wont make that noise if it doesnt have access to Yosee's servers. I have my network behind pfSense, I have all my sec cams on a VLAN that only has access to my Blue Iris server and I give the SD-M5 a static IP with pfSense. The app is trash AF anyway. I even block my Blue Iris server from accessing WAN, that way I dont get any surprise Windows updates. I only connect to stuff on my LAN remotely over OpenVPN built into pfSense anyway.
 
whoami ™ said:
IMHO If you want that terrible telephone sound gone ditch the app and block the SD-M5 from accessing WAN. It wont make that noise if it doesnt have access to Yosee's servers. I have my network behind pfSense, I have all my sec cams on a VLAN that only has access to my Blue Iris server and I give the SD-M5 a static IP with pfSense. The app is trash AF anyway. I even block my Blue Iris server from accessing WAN, that way I dont get any surprise Windows updates. I only connect to stuff on my LAN remotely over OpenVPN built into pfSense anyway.
Click to expand...
Thanks @whoami I will try this out somehow, what I can do is this I think I have a synology running for recording the rtsp stream of the sd-m5, I can configure a second dhcp scope with a fake gateway then the app should by blocked and see if that terrible is gone. Then the second problems if someone rings the bell my wife expect an email with a picture who is ringing. I think without the app there is no way to took to the doorbell or is there another way to do simulate the functions of the app, I agree the app is trash. How to make an action if someone “push the button”.
 
brommetje said:
if someone rings the bell my wife expect an email with a picture who is ringing. I think without the app there is no way to took to the doorbell
Click to expand...

Check previous posts in this topic several pages back for multiple suggestions, including using a general purpose 433Mhz receiver to detect pressing of the doorbell. You could then use that to trigger taking a picture through the onvif interface and sending that by email. Haven't had time to implement that myself yet but it should be doable.
 
Not every 433Mhz receiver will work with this doorbell. I have bought a cheap one like this, but that won't work with the doorbell. So the hunt is on to find one that does work. Does anyone know if the doorbell uses rolling codes for the doorbell push? I saw there is an HCS301 chip inside the SD-M5 for receiving 433Mhz signals (probably for the door unlock relay), which is a PIC that supports rolling codes. So I wonder now if the 433Mhz transmitter in the doorbell also uses rolling codes...
 
pcpg.janssen said:
Not every 433Mhz receiver will work with this doorbell. I have bought a cheap one like this, but that won't work with the doorbell. So the hunt is on to find one that does work. Does anyone know if the doorbell uses rolling codes for the doorbell push? I saw there is an HCS301 chip inside the SD-M5 for receiving 433Mhz signals (probably for the door unlock relay), which is a PIC that supports rolling codes. So I wonder now if the 433Mhz transmitter in the doorbell also uses rolling codes...
Click to expand...


Look through previous posts, a working one has already been found (might even be two different ones that have been confirmed to work but can't remember for sure). That post includes information on what DIP switch settings to use for that particular receiver.
 
SecuritySeeker said:
Look through previous posts, a working one has already been found (might even be two different ones that have been confirmed to work but can't remember for sure). That post includes information on what DIP switch settings to use for that particular receiver.
Click to expand...
Found it:

Ordered one of Amazon today, because they ship a lot faster than AliExpress and the WAF is becoming an issue at the moment :oops:

Would it be an idea to update the start-post with info like this? Then we could keep all the working solutions in one place which makes it easier for noobs like myself everybody to find.
 
pcpg.janssen said:
Not every 433Mhz receiver will work with this doorbell. I have bought a cheap one like this, but that won't work with the doorbell. So the hunt is on to find one that does work. Does anyone know if the doorbell uses rolling codes for the doorbell push? I saw there is an HCS301 chip inside the SD-M5 for receiving 433Mhz signals (probably for the door unlock relay), which is a PIC that supports rolling codes. So I wonder now if the 433Mhz transmitter in the doorbell also uses rolling codes...
Click to expand...
RFLink is working also.
 
Hi guys,

I just received my SD-M5, and configure it and I would like to improve a bit the experience.

Currently, when someone rings the bell, I receive the push notification on my phone. Is there any way to get this push notification turn my screen on and directly have the display of the camera on it? So when someone rings it would be like when someone calls me : phone turns on and I directly see the display of the call.

Thanks y'all.
 
bretonesf said:
Is there any way to get this push notification turn my screen on and directly have the display of the camera on it?
Click to expand...
If you have an Android phone, and you're happy to keep the phone unlocked all the time, then you can do it with an app called Tasker. Bit of a learning curve. I got it working for a Ring doorbell/app + wall mounted android tablet.

play.google.com

Tasker - Apps on Google Play

Automate everything from settings to photos, SMS to speech. ADC2 prize winner.
play.google.com play.google.com
 
I recently purchased 2 of these units, planned on having 1 at the frontyrad entrance and 1 at the backyard entry as we've been having issues with vandals the last number of months.

I was able to bench the cameras flawlessly on my WiFi before installing them at the doors. I was also able to setup recording on my NAS. I left it over night to ensure no issues, and there were none. Today, I took them and installed them in place of the oldschool original doorbells but the app would show them both as disconnected. I figured I had done something wrong and disconnected my frontyard camera, funny enough as soon as I did that the other unit (backyard) came online. So, I re-connected the frontyard camera and upon doing that, they both disconnected again. Then I did a swap to verify that potentially one of the cameras was faulty, but when I left the frontyard camera connected this time, and disconnected the backyard camera, the frontyard camera came online. It appears that I can't run two of these units at the same time.

I have verified that the cameras have different IP addresses from my DHCP pool, different MAC addresses and different ID's from the manufacturer. I attempted to connect one camera to a different SSID than the other as well, but that didn't matter, as soon as I had 2 cameras connected simultaneously, they would both disconnect.

If I take a disconnected camera and plug it into my switch, I don't have this issue at all. The cameras stay connected, it's as soon as they're both connected via WiFi installed on the door frames.

Anybody have this issue with multiple units? Any tips, tricks or ideas? Or crticism of my setup, all are welcome.
 
chay_Con1 said:
I recently purchased 2 of these units, planned on having 1 at the frontyrad entrance and 1 at the backyard entry as we've been having issues with vandals the last number of months.

I was able to bench the cameras flawlessly on my WiFi before installing them at the doors. I was also able to setup recording on my NAS. I left it over night to ensure no issues, and there were none. Today, I took them and installed them in place of the oldschool original doorbells but the app would show them both as disconnected. I figured I had done something wrong and disconnected my frontyard camera, funny enough as soon as I did that the other unit (backyard) came online. So, I re-connected the frontyard camera and upon doing that, they both disconnected again. Then I did a swap to verify that potentially one of the cameras was faulty, but when I left the frontyard camera connected this time, and disconnected the backyard camera, the frontyard camera came online. It appears that I can't run two of these units at the same time.

I have verified that the cameras have different IP addresses from my DHCP pool, different MAC addresses and different ID's from the manufacturer. I attempted to connect one camera to a different SSID than the other as well, but that didn't matter, as soon as I had 2 cameras connected simultaneously, they would both disconnect.

If I take a disconnected camera and plug it into my switch, I don't have this issue at all. The cameras stay connected, it's as soon as they're both connected via WiFi installed on the door frames.

Anybody have this issue with multiple units? Any tips, tricks or ideas? Or crticism of my setup, all are welcome.
Click to expand...

I believe that the issue is my doorbell transformer, it isn't sized appropriately. Only a 10V 5VA unit, likely not enough to power two cameras, but sufficient for one, hence why they drop as soon as a 2nd is connected. I am on my way to purchase a new transformer, hopefully this is an easy fix.
 
Interesting thread.
It looks that the doorbell I have is very similar in hardware/software to this described Yoosee SD-M5. I bought mine a couple of years ago. It is also a hi3518ev200 based, camera looks identical. It looks that the SD-M5 board is redesigned for a smaller footprint. I ended upgrading firmware on my device with the version 13.01.00.98 as it gave an adequate performance.

Recently tried it with Synology Surveillance Station and surprisingly the ONVIF stream was not stable, mostly not showing video or recordings, only randomly, while showing a successful connection and different frame rates and resolution in both onvif1 and onvif2 streams. In the same time VLC Player shows all nicely, and cannot connect only seldom. But that was only a test, as I am going to add a few real IP cameras for my home.

As for the doorbell software and hacking -- I hacked mine a long time ago. Though I was not able to hack or modify the npc executable, it was possible to find workarounds to all problems and now the doorbell is integrated into my smarthome system (domoticz). I do not use its 433 Mhz signal for ringing a chime, for two reasons. First the doorbell installed far away from my 433 MHz receiver, second it uses a rolling code and harder to hack. Instead, it sends a message to MQTT server using its POE connection and then it is possible to trigger any suitable sound device. In addition it sends a push notification to my Slack account with an attached jpeg image. That works better than Yosee mobile app's notification, but unfortunately does not allow to speak and open the doorlock. It would be possible to get rid of chineese cloud server connections if such functionality is not needed.

For those interested, I put here a link to another forum with a discussion that inspired me for a successful hacking of a SD-M5 compatible doorbell.
 
  • Like
Reactions: vandyman
I got this device a while ago and finally got time to play with it. My initial idea was (and still is), to see how I can use this as a surveillance camera as well as a video doorbell that works on my normal chime.

So today, I screwed it open, found the UART, connected the wires to it and got a root shell. For those interested, the yellow wire is TX, the red wire is RX and the blue wire is GND. Tomorrow I'll go and see if this thing works with Shinobi / Zoneminder / Motion.

Anybody ever tried to get this onvif stream working on Linux? If not, I'm afraid I'd have to code my own client, or a plugin to one of the aforementioned programs, which is not something I'm looking forward to :)
 

Attachments

  • c257d616-3701-488b-b15e-877e9f952a26.jpg
    c257d616-3701-488b-b15e-877e9f952a26.jpg
    224 KB · Views: 106
  • Like
Reactions: vandyman
Ok, so I tried both Shinobi and Motion and it didn't work because they use the underlying ffmpeg library. It's a known bug, and there is a workaround with netsed, but IMHO that is a rather expensive solution. So I created a patch for ffmpeg. If anyone is interested, please see below:

Diff: 
--- FFmpeg_orig/libavformat/rtsp.c    2020-08-13 15:44:07.631849461 +0200
+++ FFmpeg/libavformat/rtsp.c    2020-08-13 15:41:51.051617666 +0200
@@ -93,6 +93,7 @@
     RTSP_FLAG_OPTS("rtsp_flags", "set RTSP flags"),
     { "listen", "wait for incoming connections", 0, AV_OPT_TYPE_CONST, {.i64 = RTSP_FLAG_LISTEN}, 0, 0, DEC, "rtsp_flags" },
     { "prefer_tcp", "try RTP via TCP first, if available", 0, AV_OPT_TYPE_CONST, {.i64 = RTSP_FLAG_PREFER_TCP}, 0, 0, DEC|ENC, "rtsp_flags" },
+    { "force_tcp", "if RTP/AVP is received, force TCP instead of UDP", 0, AV_OPT_TYPE_CONST, {.i64 = RTSP_FLAG_FORCE_TCP}, 0, 0, DEC|ENC, "rtsp_flags" },
     RTSP_MEDIATYPE_OPTS("allowed_media_types", "set media types to accept from the server"),
     { "min_port", "set minimum local UDP port", OFFSET(rtp_port_min), AV_OPT_TYPE_INT, {.i64 = RTSP_RTP_PORT_MIN}, 0, 65535, DEC|ENC },
     { "max_port", "set maximum local UDP port", OFFSET(rtp_port_max), AV_OPT_TYPE_INT, {.i64 = RTSP_RTP_PORT_MAX}, 0, 65535, DEC|ENC },
@@ -896,6 +897,7 @@
     RTSPTransportField *th;
     char buf[256];
 
+    RTSPState *rt = s->priv_data;
     reply->nb_transports = 0;
 
     for (;;) {
@@ -932,7 +934,9 @@
             }
             th->transport = RTSP_TRANSPORT_RAW;
         }
-        if (!av_strcasecmp(lower_transport, "TCP"))
+        if (rt->rtsp_flags & RTSP_FLAG_FORCE_TCP)
+            th->lower_transport = RTSP_LOWER_TRANSPORT_TCP;
+        else if (!av_strcasecmp(lower_transport, "TCP"))
             th->lower_transport = RTSP_LOWER_TRANSPORT_TCP;
         else
             th->lower_transport = RTSP_LOWER_TRANSPORT_UDP;
@@ -1914,7 +1918,7 @@
                                   ~(lower_transport_mask - 1)];
 
         if ((lower_transport_mask & (1 << RTSP_LOWER_TRANSPORT_TCP))
-                && (rt->rtsp_flags & RTSP_FLAG_PREFER_TCP))
+                && ((rt->rtsp_flags & RTSP_FLAG_PREFER_TCP) || (rt->rtsp_flags & RTSP_FLAG_FORCE_TCP)))
             lower_transport = RTSP_LOWER_TRANSPORT_TCP;
 
         err = ff_rtsp_make_setup_request(s, host, port, lower_transport,
--- FFmpeg_orig/libavformat/rtsp.h    2020-08-13 15:44:07.631849461 +0200
+++ FFmpeg/libavformat/rtsp.h    2020-08-13 14:22:21.825409774 +0200
@@ -421,6 +421,8 @@
 #define RTSP_FLAG_RTCP_TO_SOURCE 0x8 /**< Send RTCP packets to the source
                                           address of received packets. */
 #define RTSP_FLAG_PREFER_TCP  0x10   /**< Try RTP via TCP first if possible. */
+#define RTSP_FLAG_FORCE_TCP   0x20   /**< If RTP/AVP is received, force TCP
+                                          instead of trying UDP. */
 
 typedef struct RTSPSource {
     char addr[128]; /**< Source-specific multicast include source IP address (from SDP content) */
 
sp00025 said:
Interesting thread.
It looks that the doorbell I have is very similar in hardware/software to this described Yoosee SD-M5. I bought mine a couple of years ago. It is also a hi3518ev200 based, camera looks identical. It looks that the SD-M5 board is redesigned for a smaller footprint. I ended upgrading firmware on my device with the version 13.01.00.98 as it gave an adequate performance.

Recently tried it with Synology Surveillance Station and surprisingly the ONVIF stream was not stable, mostly not showing video or recordings, only randomly, while showing a successful connection and different frame rates and resolution in both onvif1 and onvif2 streams. In the same time VLC Player shows all nicely, and cannot connect only seldom. But that was only a test, as I am going to add a few real IP cameras for my home.

As for the doorbell software and hacking -- I hacked mine a long time ago. Though I was not able to hack or modify the npc executable, it was possible to find workarounds to all problems and now the doorbell is integrated into my smarthome system (domoticz). I do not use its 433 Mhz signal for ringing a chime, for two reasons. First the doorbell installed far away from my 433 MHz receiver, second it uses a rolling code and harder to hack. Instead, it sends a message to MQTT server using its POE connection and then it is possible to trigger any suitable sound device. In addition it sends a push notification to my Slack account with an attached jpeg image. That works better than Yosee mobile app's notification, but unfortunately does not allow to speak and open the doorlock. It would be possible to get rid of chineese cloud server connections if such functionality is not needed.

For those interested, I put here a link to another forum with a discussion that inspired me for a successful hacking of a SD-M5 compatible doorbell.
Click to expand...

@sp00025 you speak about “it sends a message to MQTT server using its POE connection and then it is possible to trigger any suitable sound device.” how did you configure this sending messages to you MQTT server or how is this working?
 
I got a little bit annoyed with the frame rate issue. While playing with the device, often the message: "[vPrintMDResult, 18277]:nothing is moving, frame rate is down" would be shown on the console. I found it rather annoying to have the npc software determine if something is moving or not. So I just patched the npc binary, and now I always have a high frame rate :)
 
mrxyz said:
I got a little bit annoyed with the frame rate issue. While playing with the device, often the message: "[vPrintMDResult, 18277]:nothing is moving, frame rate is down" would be shown on the console. I found it rather annoying to have the npc software determine if something is moving or not. So I just patched the npc binary, and now I always have a high frame rate :)
Click to expand...

You were able to patch the firmware? Does the patch persist or do you need to re-patch after power cycling?

There are several here (including me) who are annoyed by the slow frame rate so more details on how you did this exactly so that it can be reproduced by others would be greatly appreciated.
 
SecuritySeeker said:
You were able to patch the firmware? Does the patch persist or do you need to re-patch after power cycling?

There are several here (including me) who are annoyed by the slow frame rate so more details on how you did this exactly so that it can be reproduced by others would be greatly appreciated.
Click to expand...
Ok, so here it goes.

First thing you need to do is buy a USB to UART bridge. I have a Silicon Labs CP210x, which together with the cables (as you can see a couple of posts ago) I bought for roughly 5 to 6$. Then you connect the cable as shown on the picture a couple of posts ago. Next you fire up putty, connect to your new com port with baud rate 115200 and then you will get a shell.

Now you insert your SD card into the doorbell and see if it automatically mounts. If not, you need to reformat it. On the device there is mkfs.vfat which can be used for that (mkfs.vfat /dev/mmcblk0p1 in my case did the trick). With a properly formatted SD card you can mount it on the device (mount /dev/mmcblk0p1 /mnt/disc1) and copy the npc binary on the mounted the disc. Get the SD card out and insert into another system where you have a hex editor and IDA pro (I think this will work with IDA free as well though).

Open the npc binary with IDA and wait a bit till it is fully loaded. Once loaded press shift+F12 and search for the "nothing is moving" string. Follow the xref and you will end up in a function that handles the motion detection. If for some reason you are using graph mode you will see something as shown below:
ida-graph.png

Notice that there are 2 branches. The one on the left says that something is moving, followed by a call to (in my case, but could be different on your version) sub_87740(0) and the one on the right says that nothing is moving, followed by a call to sub_87740(1). If you look inside sub_87740 you see that the function is internally known as VENC_autoDownFrameRate. We know we are at the right place now. If you feel like you can reverse more, or just take my word that calling sub_87740 with argument (1) lowers the frame rate and calling it with argument 0 sets the frame rate to the "right" value.

Now that we know all this we can patch the binary. In IDA press space, which will give asm code. Go to options --> general --> and set number of opcode byts to 5 or 8 or something. You will now see something like this:
ida-asm.png

Looking at 00090DB8, there is mov r0, #0 encoded as 00 00 A0 E3 in opcode, while at 00090E1C mov r0, #1 is encoded as 01 00 A0 E3. The first byte is thus the value moved to the register.

By default IDA parses a file and loads it with offsets like you will see when the binary is loaded into memory. If you want to get the offset in the file you need to look at the red circled spot. There you see that this piece of code is found at offset 00088E1C in the binary. Go there with your favorite hex editor, make sure that the code actually matches, and change the value of 01 to 00.

You have now patched your binary :clap:

Save the binary to your sd card, insert into the doorbell and go back to your terminal. Unfortunately, due to the implementation of busybox and the supported commands, it is not possible to simply overwrite the binary. You will get a message that there is no space left on the device. So remove the npc binary from /npc/ and create a shellscript named npc with the following contents:

Bash: 
#!/bin/sh
mount /dev/mmcblk0p1 /mnt/disc1
/mnt/disc1/patched/npc &

Note that I put my patched binary into patched/npc on the SD card. Make sure the shell script is executable, reboot your system and you're done.
 
Last edited:
  • Like
  • Love
  • Wow
Reactions: whoami ™, petervk, lGregl and 5 others
You must log in or register to reply here.
Top Bottom