Episode: 4686
Title: Debugging Security Cameras: Firmware Updates, Python Scripts and Windows Workarounds
Source: https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr4686/hpr4686.mp3
Transcribed: 2026-07-31 16:16:46 (official HPR transcript)

---

This is Hacker Public Radio Episode 4686, for 2026-07-20
Today's show is entitled, "Debugging Security Cameras: Firmware Updates, Python Scripts and Windows Workarounds"
The host is operat0r and the duration is 00:41:52
The flag is Explicit, and the license is CC-BY-SA
The summary is "Debug a Uniview camera using Python scripts, firmware updates and Windows hacks."
Hello everyone and welcome to another episode. I have a pre-book video with your host operator
feeling a little under the weather so my voice is kind of we're seeing moody
I mumble so I'm going to try to announce heat especially if I'm 6 so we'll get through this
Anyways, a couple of things
I'm going to talk about fixing my front camera
and um before that I'm telling you how I'm doing my soup
I drop soup the trick to it is get it boiling
and when you um you can make your own broth you can use a beat broth cubes it's
sludge cheaper than buying the whole
stupid chicken broth you can buy the chicken
boolean cubes or whatever chicken boolean cubes do that same thing
can't really help
Anyways, he makes those up however much to want
I got to do one and maybe a couple eggs
the trick is to heat it up to like a rolling boil and then I start
real quickly and I get a little swirl going on
and then I pour the egg down in there from the the egg drop
and I pour it down and let it let's swirl around and that's how you get that rippony
rippony messed up
you'll actually want to have more broth than you really need
um as a ratio so like this is a little junky because
there wasn't quite as much broth but if you want to be perfect you have like tons of
broth and very little egg but I don't want to be wasteful so
uh when I had to move that so what I do is I do usually
once I get that rolling boil I turn off the heat and I spin it around circles
and then I pour the egg in there and I'll let it sit for a second and it's done basically
and then uh since this is actually kind of salty I shouldn't have
put my soy sauce in there usually on but soy sauce but that's kind of where I'm at now
this is my hot soup for my sickness I picked up some kind of something
oh I went camping with my son and uh
went camping and uh for scouts and apparently that's uh I picked up some kind of
crack red so first things first we're going to check the camera itself I have no
browsers um so the camera is a I'll actually tell you
cctvf I did vocal domain names so instead of remembering IP addresses
I put in the UDM device I put um we call that static DHCP basically
so that static IP I think it's like a when they put in like the MAC address and it
results back and that's how you get like a static DHCP I think how it's set up
so anyways um this is some trinysium actually it's not trinysium it's a very good brand
UVN um UVN is there to find the docs on it
UVN UVN you eat and no um UVN no of course not so anyways um this is a
hardware version from where version model number maybe I'll search for the
lot of number it'll come up model yeah look a thing with a good fig
this is a one of those ones is for like a pbpbr a a vansy um DVR or whatever they want you to buy their
stack so as a as a camera by itself it's kind of jeancy it's not kind of doesn't work
so I had to write my own API there's not really an API for it so this is uh the company is
univ you sorry it's an univ you uh why is that ISP warm light deterrent network camera
they're pretty high in cameras the optics are amazing with the past three or four years um you can
get really good optics on these cameras um for relatively low cost um you can find their reseller
for an Arnold like but I don't know how much I paid for this one I think I paid cost for it because
friend does stuff so he I showed him a picture of my horrible black and white mess and he sent me
one of these and and kindly sent me one of these so um now I have a crappy one of the back
and then the fancy one of the front the problem is she's not getting the alerts so
the way I have it set up is this kind of giant fat SD card on it
and that runs uh plugs in power of ether at POE and I think it's a lot of like 30 volts or
some crazy power of ether at some crazy amount of voltage under power of ether that by the way
so I'm going into the server because I think that's where everything lives
unfortunately when you have we are old you'll remember where anything is anymore
and that's why another project I'm working on is my own personal AI so I have a crontab
very crypt that's not it's my SL um CCTV FPY and unbeknownst to me I have a log here so
I can look at this log um it's a Python script that I will put in these
show notes I will do show notes so let me make a new thing here put Python script for API
camp in show notes and a model number I use the clipboard history which is the security
flop because as soon as you copy and paste a password you're screwed so whatever the
all right so we're going to take a look at this Python script first
extra make sure it runs as a current user so we're going to do this whole
it's a crontab entry that says it runs every two minutes well that's aggressive
I also want to put thrallion here so no recordings found in the past 24 hours
which is not great because uh they're definitely been something in the past 24 hours my
while I come home my flat whatever so that's a little weird oh look at the log here so it's a
a Python command followed by the Python script and then the pipe we call it listen or
or greater than greater than greater than in flex and then the errors out to itself
on standard and standard out I never really could understand it so there's no time
it's a time state of sign any of this 11 25 10 20 few is when I first started this script
and it looks like it started it was working this file is massive I use VI and you can press
colon and then a button like a bunch of numbers I'll just mash down the work and I'll take you to
whatever line number so if you do colon one we'll take you to the first line like so like that
so I met the end and it says no recordings in the past 24 hours so one thing this here is
missing is a timestamp me bullet my brains out here
all right so we have some exceptions next retry exceeded with URL
jailtreme streams offset blah blah blah fail a sourcing new connection error whatever
um that's a weird one so I'm going to cut out this file because everybody loves cat
recordings there's a bunch of noise in this file so I think it's called no recordings
and choosing tests recordings found no recording sound in the past 24 hours so we're going to
get rid of that it's going to cat this file so I'm counting the log file and I'm gripping out
grip minus V if you use e-grep it's basically an alias to the grip so I don't
I've gotten out of the habit of using that because it doesn't exist everywhere
what's the kind of one thing to keep in mind so um I've gripped out that no recordings
to an alias something crashed um found one recordings in the past 24 hours
no new recordings across this found record but fail to record fail to get recordings for 01
almost like a off issue
and then there's really big error like a timeout type of thing
probably fire the power went out maybe next retries exceeded with URL blah blah blah
recordings begin time stamp and time stamp limit offset blah blah blah so I'm filtering out by date and time
it looks like so I'm going to go to the actual camera which sucks because again
these things are not made to be used I don't want to say it locally I have to download and
install this weird executable from China it's like a five-meg set up EXE it's like
super-shifty so whatever all these things are kind of scary say at least so I've installed this
little executable which randomly makes me reinstall it I don't know why because I'll install it
and then like two months later whenever next time I have to use it it has to be installed again
which just does make a sense so anyways um I believe there's no callbacks to try that in here
so I've installed this little setup EXE which I think like hooks a DLL so that it can do
whatever silliness needs to do I see a main stream in a substream substreams like the
traditionally a substream is a lower lower quality stream and it's loading like a poop poop poop poop
the local admin password is all the same pretty much my house is like the egg you know
the technology where we get it you're pretty much screwed anyway so if you got somebody on your
network you're kind of screwed anyway so I usually use leave credits default to most stuff
because it doesn't really matter um no it is random so pseudo random should dare I say
the math nerds we'll say that it's a pseudo random so anyways I can't get any playback at all
working it might even just need to be like unplugged and plugged back in because I can't even get a
stream going um I do have somewhere else a different URL which I don't know where it is probably
in my city in notes now um let me search I've been using it up sitting for a little bit
yeah this is a video too I'm still new to obsidian but it's it's the
the front end for my AI assistant that eats uh two three googles one yahu
male and a uh linkedin and google voice mail oh okay so you might be able to hear this
no I can't hear this I see crickets and a tire in her front yard whatever so it's it's working
as he's stuff um the real question is is why is it why is one the playback not working
which I'll close all this out closing on all my browser windows and restarting
maybe that'll help
I've always kind of had issues with the live view
with this camera again a lot of these are made to have like a DVR whatever and you know
they're like a hundred dollars or something who knows oh they have my life only put let me put
it outside gamers wow this is saltiest says hell anyways um yeah I can't even get
upstream or mainstream I can hit it via RTSP but for whatever reason there's no captures in here
I mean it's possible it could have been reset somehow um I don't know but this view eyes
does it say at least take a photo take a photo I have no idea what I'm looking at
let's see free space so there's kind of two ways to do this I had uh a there's like two different
kinds of answers like motion events which I used to have enabled motion detection is off right now
this is like your standard better regular motion detection and it has I don't have to think
it has boundaries like the other thing does I don't think it has boundaries I can't even remember
but that's the more traditional method the one you want is this intelligence thing that's called
intrusion and the intrusion let's see do like these rules and yeah see I still can't see anything
going on with this with this setup try not a coffin your ear let's see try and load it again
that's the thing with this camera it's just like not designed to be managed with a client
um so I don't know it's kind of frustrating I'm gonna do a tale of the
tail tail minus in 10,000 third in 2000 found 15 recordings no no it's like it found 15 recordings
and then through up maybe maybe it needs to be like you know reset because it's trying to pull
in 15 recordings that once and it can't do that right so we're gonna just assume something like that
happened all right now I'm starting to cauff getting um see
content I'm I don't know I the whole crime tab thing there's user
crime tabs and there's root crime tabs and you can have the root crime tabs basically the user
and I feel like I just want to put everything in root but that's not what you're supposed to do so I
have user crime tabs but it's very confusing um because I have different users with different
crime tabs and it's hard to see them all I'm sure it was like me and I can run to see them all but
it's quite I'm not just to throw it back up this first cp like cp my um
either auto hockey that will um it makes paste and copy and paste uh caps locks a and caps like s
but when it's not on I just end up typing caps like s and that caps like a capitalating
capital S um so it's kind of annoying I turned it off because I was going to be near game
so we have some kind of resets out yeah fx file sent sent events is the is flag is a it's like a
placeholder cat oh my god I'm hitting the cast on all the time now so I'm going to go to
go to my user folder start up this thing oh my god what is going on so going on my user folder
I'm going to start up a auto hockey because it drives me insane not to be able to copy and paste
it does much of other stuff things too it's like I'm pretty defined can't um
get don't get something get something send events
all right um and it's like a bunch of timestamps um maybe if I just heard it or echo
I don't know just one the last one two
sent events it's also weird that like sometimes when I copy and paste it's like got
extra characters in it and it's so weird if I use the clipboard history and then I paste
what's in the clipboard history the first time it has like carrot left bracket left bracket 200
uh squiggly and then the paste it version and then squiggly but then if I do it again
it works perfectly fine so don't understand what happens it's weird it's really weird the way uh
the way it works like it doesn't make any sense clipboard Canadians so anyways that sent events
I completely cleared out which I think five eight nine eight four three some kind of time stamp
or right you ID I have no idea that's from with the vibe code it should is it you have no idea
what anything is doing what it does stuff so I'm going to do my contact I'm going to run this
run the script it's who happens so no recordings found the past 24 hours um which might be true
because I can't tell if anything is running anyways so yeah it's proving not to be fine at all
and that's that's the uh the fun of it Jesus um I guess I can turn off my at blockers and my
privacy battery and you black origins that might be it
when every time I refresh at the log in it's like
1990 style session management all right I turn off all the uh at blockers maybe I'll get an
actually stream I'll get an actual stream for this no yeah give it I don't know man um
yeah this is just waste time so I'm about to see what happens okay so I'm about to both the computer
and the camera and I do not see any events for today at all I want to check yesterday
interface for this thing is potato all right so let's do this stuff it's uh 12 523 that was
so long time ago I'm not gonna do a 523 doing 623 6 2019 okay so it hasn't been doing events for
a while not even locally so this is their stupid camera app it's oh my god it's not even now
you know you you you you think um so now I'm uh it's it's now 623 the date I'm going back to
619 I see nothing I want to go back to 523 I see stuff let's go to 615 so the events aren't happening
at all there's no events being generated meaning something's wrong with the the ability
for it to capture events for some reason so we're gonna go with that um I doubt there's any kind
of troubleshooting or any errors or log is there anything with this thing um that is really weird
now can I force a record record you would do like to access storage and you can save images
oh no I'm not that kind of record I want to record on that for server and so this web app thing is
still piece garbage let's see if we don't have Firefox somewhere want to stay up at Firefox on
here anyways it's super exciting obviously let me put jump off for a second okay so a bit of a tangent
I got it working with I found a Firefox executable for a playwright which is for automation
of stuff so I'm I have Firefox running with the viewer and I can actually see the camera
but I noticed that my windows directory is still exists and it's really hard to delete that
windows old the folder what you can't do is a program called there's other ways to do it you can
do the run as okay let me back up there's users in windows there's system and trusted
installer and a lot of people think that admin is admin no it's not admin system is more or less
sort of admin and trusted installer is more like a root if if I had to put them in a bucket
a lot of people do not know how windows permissions work and how that magic is I don't even know
but I know I do know that you can use a trusted installer kind of bypass you think where you
replace the binary of the trusted installer executable or the the trusted installer
command line and replace it with whatever you want see you basically take the trusted installer
service and replace the command to run the trusted installer service with whatever you want it to
actually do as trusted installer and then and then you hopefully revert it back if not all your
adder move add all that stuff having to do the software it's going to get all one key and you will
be able to install stuff but I had a hack that would basically forcefully delete stuff or
forcefully run a specific process using the trusted installer hack by replacing the admin you
have admin rights to replace the trusted installer service binary to run whatever you want and
that's kind of how you hack around the problem with that there's no easy way to do an interactive
trusted installer instance now there's an executable that's been around forever called
exact EXETI.exe exact TI exact trusted installer.exe and this lets you bring up a
windows you you take them run dialogue but you can run whatever command you want as trusted installer
so I type C&D hit enter and I have set and I see compact layer app health installer the
row with the system path is home path is still user internet which is quite interesting
I'm looking at the environment variables for this thing so it's compact layer detectors
app health installer does compatibility window windows compatibility layer I wonder if there's
something there if that's like a way I can be just installer I don't know so there's some other
some other weird chocolate you last update not just okay so we're going to try to delete this
mood directory versus this windows it windows old and I guarantee you it will work with
falsely because trusted installer has writes that not even system has if you try to do see yeah
which system is being used by other process I don't know how this is like how how long I'm
supposed to delete the stuff except do it in dice yeah it's saying like users all users in video
messaging message bus log is being used by another program I hope I'm not actually delete my real
windows folder that would be hilarious I don't think that's the case let me double check
windows directory SQL Microsoft does sure system root SQL Microsoft Windows okay but it says it's
being used by another process which doesn't make any I think sense that's kind of terrifying
so the auto boot links to get rid of this uh that's really the only way to delete stuff
in windows to like won't let you delete um you can do chamada type of stuff and just to complicated
whereas windows or Linux will let you just melt what what what you want and then delete what you want
without having to do take ownership of entire folder and like take ownership of all the files and
all that bullshit um Linux you just go now in a fsmout whatever god um you know there are
some very rare edge cases that that could be a problem but anyways that was a bit of tangent
it's on my website it's uh under actually I'll make a show that's for it trusted installer
exact TI right as where's my notes I started some notes they and then I rebooted
so anyways card drives by the problem with that is it'll trigger every time inside whoa what is that
dude I just saw something purple and glowing what was that
that I was creepy anyways the I buy house lights on so there's a little bit of weird
colors going on so there's a rule that has a compounding box of my driveway and all in
way out to the street but not the street itself motion technically gets picked up by
cars driving down and that motion gets activated and once the motion is activated it looks for an
object such as a motor vehicle or pedestrian and I have sensitivity thresholds whatever
it works good it used to trigger a lot and that was why I switched it from
the regular motion to this intelligence smart thing but the problem with the intelligence smart thing
is that the email alerts we're not working the intrusion detection email it's we're not working
so I had to make my own that's kind of where we're at now I don't know what the problem is
I did go out there and move around and do stuff I read I formatted the storage
so it says total capacity 230 gigs geez man what how much 230 gig micro SD is right now
how much did I buy that for Jesus Christ why did I buy such a massive card
250 250 micro 250 on to say 250 I don't even know where I bought it from
like I see R. I'm looking at my Amazon history I probably bought it through them
with the storage yeah it'd be careful here's a 32 gig 250 and why that's it
okay how much did I buy this for I bought it for 49 dollars
what you can buy 200 if you can see it for 49 bucks I guess it's just like the memory the
ECC or the fancy ram is really expensive this is cheap 450 bucks I'll probably pay more than that
what did I pay let's see I pay 38 okay whatever anyways
yeah that's that I put the just a dollar thing in there I I'm going to try one more thing
and try to trigger it and then I'll come back okay well we got something in how did the date the
system to I got close this other window I looked at the date it says it's November 1st 2011 at 1500
hours is this system time on New York is the right time zone the NTPs NTP server is an IP address
of I don't know where the hell that is so let me ask a I top NTP servers for Linux
didn't even type it correctly it's like deviant what's a deviant one I pulled that NTP
network sure North America pool US pool dot NTP dot org who's an 80 on these test NTP check
failed that's interesting what about it about to
NTP check failed we're okay we're actually get the IP address and put that in maybe that's why
I had an IP address in there is because the IP address is it doesn't take a host name oh that's
fucking weird it doesn't take a host name so that's weird I said so with the computer sync with computer
system time that's not I don't want to do any of that I don't want to do any of that so let me go back
back to cc cc tv fn what's definitely one problem is it thinks it's it thinks it's 2011 for whatever reason
that I wipe it out or something I don't know so I click the download I search for the model number
and I click download firmware and I get this weird as this is the weirdest download I've ever seen
in my life it's at 7% it's dog slow when I click the download button and there's no actual it's
not using the browser it's download but it's using like some Java bullshit so I am just because I'm
crazy I use bolt media downloader that's like a sniffer sort of sorts um so we got this weird
140 mags file that it's downloading it whatever speed so not going to copy and paste this
copy this link it downloads like some json from Lenovo and then it it's files.com wow really
you can even host your own shit you got to use some third party whatever before minutes two minutes one
minute um yeah that's the fastest it's going to get so I can do stream to downloading too so
I'm going to take that link and take it to download manager send to download manager which
can do three threads at a time also download links see if I get three or four threads going
I'm going to be fair it is a like secure link it's got like my IP address in it and like all
kind of stuff um yeah any ID token the token is blank of course off key so it's definitely
some kind of you know temporary thing and the hilarious thing is that it says client IP equals
in my home IP which that's going to be in there it walks anyway so it doesn't make a ton of
sense to put that somewhere um I guess you can deny the download based on somebody else's
if you put their own remote IP in there I don't know I've never heard of files if I LZ.com to
fucking malware why these guys don't support their own downloads is terrifying they got Facebook and
YouTube and all that stuff but I guess that these things are all shady Chinese and whatnot like
what why why why do you have the outsource here your downloads that's kind of gross
so we're almost done 66% so it's not any faster with multi threaded the thing I use from
multi threaded is called turbo download manager and that's for chrome and along with both
media downloader and turbo download manager I can pretty much download almost anything
and then URLs that I can't download directly I'll send to FFNP or YouTube deal
um I have a oh my get up I have a YouTube downloader script that will use RSSC2 to multi threaded
download any video you send it um so you can set it a list of like you know 16 different videos from
the same site across 16 other websites you'd have like 16 times 16 and it would download all those
at the same time I think how I have it set up anyway so here's a file that is a bin which it's supposed
to be I think as a file because the way I downloaded it it's not so let's see what happens when I
click this yeah it's supposed to be blah blah blah does it so I'm gonna copy and paste this weird as
message I'm gonna rename it to a zip file thank god it opens so I have this zip file and
I'm gonna extract it you'll see that it's okay it has a cloud upgrade button which yeah that sounds
terrifying um click the image debug I'm gonna turn that off while I'm doing this I can go ahead and
export my config um file encryption I don't want to encrypt anything can that be empty
that's gonna weird
is it file or something how is it encrypted it's just like this is encrypted like it's a
dot config file I don't understand so I use seven zip which is the mother of all
decompression tools yeah I don't know how to read this I don't know how to read this it's a
weird file um I use bash for a lot of stuff bash I can I bash here they kind of slow bash everywhere
yeah sort of works um IPs IPc it just says data um the file can be just calls it data I have no
idea what this is but we're gonna back it up put it on the uh Google I guess it's just my
config drive like keep like documentation and small things like things I want to be able to search for
essentially in um in Google Drive because it has that kind of index feature
or I can search for stuff so I'm gonna call it the call it some
was it CC TV CC TV CC TV F is it F new I can't remember I'll try to drop it in here
I think it's there so now I have backup of the config the new version is detected no
okay we'll take a while please do not disconnect power that no idea what it's doing it just says it's
gonna take a while oh look the data right so it says 2026 that might be why it's not working because
there's nothing to collect from 2011 maybe the data's so far off you know who knows so we'll go
pop back into the thing and delete that date file maybe that'll help kind of jumpstart it
um or into the no dot to these files
lesson video yeah so that's blanked out and then also we're gonna
I go test to the log file so I need to log file and I look new to the timestamp trigger
think so that knows so that it knows where it's at and then we'll go from there see what happens
at the update all right well uh I guess it says the upgrade will take a while please do not
disconnect power wish me like um looks like the family's heading back here so I do not have
any more time and you know more of the same take it easy
You have been listening to the Hacker Public Radio podcast, at hackerpublicradio.org.
Today's show was contributed by a HPR listener like yourself.
If you ever thought of recording a podcast, then visit the HPR site to find out how easy it really is.
Hosting for HPR has been kindly provided by anhonesthost.com, the Internet Archive, rsync.net, and the HPR Community Content Delivery Network.
Unless otherwise stated, today's show is released under a Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.