It's alright if you're chinese like me :smiley:

Status update - I've found out how to get telnet access and change the root password without having to solder leads to the camera's motherboard, but it only seems to work on the original camera firmware (i.e. it won't work if you've updated to the latest firmware). To work out why, I'm going to need to solder leads onto my second camera (which has the newer firmware) - I may find time to do that tomorrow.

On the original firmware, when a microSD card is inserted the camera will look for a file called "snx_autorun.sh" in the root of the microSD card and run it if found.

So if you create a file called "snx_autorun.sh" in the root directory of your microSD card containing the following bash script, and insert it into the camera, the script will change the root password to "toor" (or whatever alternative you choose by editing the below) and start a telnet server:

#!/bin/sh
# Set root password
ROOT_PASS=toor
###
# Change root pasword
echo "Changing root password" > /dev/console
echo -e "${ROOT_PASS}\n${ROOT_PASS}\n" | passwd
# Launch telnetd
echo "Start telnet server..." > /dev/console
telnetd &

You'll then be able to connect to the camera over telnet using Putty with username "root" and password "toor" (unless you changed it in the above script). You can find the camera's IP in the Mi Home app.

Next step is to try to get some useful services running. It already has a simple web server running (albeit with no pages to serve), but I'm keen to get an rtsp stream out of the thing if possible.

Let me know if the above works for you and you can telnet into your camera.

After brute forcing overnight... *drumroll*... the standard root password for these cameras is "ismart12".

That means that we can remove the portion of snx_autorun.sh that changes the root password, leaving just the following:

#!/bin/sh
# Launch telnetd
echo "Start telnet server..." > /dev/console
telnetd &

Once you insert the microSD card with the above script in the root folder and hear the double beep, you should be able to telnet into the camera using user/pass: root/ismart12.

I'm continuing to explore getting an rtsp feed and ftp server running. The cameras come with a very simple web server that serves pages out of /tmp/www, which should help.

Nice of any good and easy to set up

shame the app is in chinese :disappointed:

Thanks op. Ordered

hi is this battery operated

Great little cameras. I bought 2 just before Christmas, as said above the app is in Chinese but I think they are working on an English version.

Cheers - ordered. Already got a hikvision nvr and camera setup but can't for the life of me get the audio to work so this'll be a backup.

Ordered 3 a few weeks back still waiting for them to arrive, they look great