Hacking the Foscam FI9821W V2

The Foscam FI9821W V2 is a low end HD colour  IP camera.

The feature list is impressive.

• The unit has Ethernet and Wifi connectivity.
• It can stream video in various resolutions and formats (H.264 and MJPEG) as well as audio from the built-in microphone.
• It comes with multiple built-in infrared LEDs to get a B&W picture even in the dark.
• The lens can pan and tilt.  You can set preset points, and define cruises from point to point. 
• The built-in software supports motion detection with a grid of active and inactive areas.
• With the talk-back function you can speak through the cameras loud-speaker.
• And more

OS support

The description at Amazon promised a browser plugin for Explorer, Firefox, and Chrome, to control the camera as well as support for Windows, Mac and Linux.
As I had to find out, this didn't mean a browser plugin for Firefox that runs under Linux.  The plugin is Windows only.  It is part of the cameras firmware and can be downloaded via the cameras web interface.  It is recommended to delete the plugin after a firmware update and install the new one.

While the unit has a web interface which can be accessed from any current browser on any platform, this interface only allows you to set the basic configuration (user accounts, Ethernet and Wifi parameters, firmware upgrade, etc.).  The interface for the "advanced" features is implemented in the plugin, i.e. it is Windows only.  These advanced feature include video display, audio playback, pan and tilt, motion detection, etc.

The camera provides a rtsp video stream, which can be viewed using vlc - even under Linux.

Fortunately, Foscam provides a SDK with the description of the CGI interface, meaning that with a handful of specially crafted URLs most of the above "advanced" functions are available.  In fact, the browser plugin uses the CGI interface as well.

pyFosControl

I've started to write a Python interface to access those functions (GitHub).

One function the CGI interface can not provide is talk-back, which involves sending an audio stream to the camera.  As it turns out, the browser plug-in also uses a low-level protocol.  Even though Foscam provides a description of this protocol for its older cam, the newer ones (HD, H.264) are not (yet?) documented.

The low-level protocol

I reverse-engineered a part of this protocol. The results can be found in the "lowlevel" folder in the above mentioned pyFosControl project.  You'll also find the python program I'm using to "tickle" my camera.  If you find out more, please let me know.

Firmware and bugs

The firmware of this camera is still in development, and there have been a couple of firmware updates.  Further updates are badly needed as there are still bugs in even basic functions:

•  You can define "privacy areas" - black masks in the video stream.  However, these only work in the video stream not for snapshot pictures.
• Pictures and alarm videos stored on the internal SD RAM are accessible via FTP.  In the last firmware you didn't need any credentials to access them.  Currently you need admin rights. However, the credentials for the FTP server these are stored in RAM after you create an account and are gone when the unit is powered down.  You have to recreate the still existing account in order to get credential into memory. (The login to the web interface is not affected).
• The web interface can be securely accessed using https:// thus encrypting user name and password.  However, even under these circumstances the user name and password are transmitted in the clear in various situations, making it unsuitable for accessing the camera from the Internet without the protection of a VPN.

User forum

The Foscam user forum is quite active.  Many other problems of the various Foscam cameras are discussed there, but keep in mind that forums usually attracts those who have problems.  A few friendly souls trying to help you where they can.  It's worth a visit.

[Update 2014-03-02]

Faulty IR LEDs

After a few months illumination by the IR LEDs has become erratic. The problem seems to be intermittent contact of the power supply connectors to the pcb carrying the LEDs. According to the forums, this is a common problem – which can't be solved. And as most Foscam models look similar, it is very likely that all these units are affected. :(