XMPP Reverse Engineering

[Gary Tessman]

Now that I have the UPNP stuff working pretty good, I am off to the
XMPP stuff.

I ran wire shark and found the same results as you Matthew, but it's
unclear to me how to make much sense of the "order of operations"
etc. Wondering if you have any guidance here? I'm able to get a
connection to the cam via XMPP, just not sure what is next. Is there
a way to get a list of commands or roster so that I am to retrieve to
figure out what I am able to run?

I also noticed you had your code commented out where it says
ser...@127.0.0.1/NvrCore but I see many instances of that in the logs
- so I am also curious why you might choose something different? Do
you have any recommended XMPP trace programs or is it pretty much
wireshark/tcpdump?

Here's some of the data I've pulled off (below) which I am sure you've
seen. Wondering if you can point me in the right direction in regard
to XMPP?

Thanks,
Gary Tessman

<pre code="xml">

<iq to='ad...@192.168.1.180/Commander/
b287fde4-4672-4b39-9283-4f1a879019ce' from='ser...@127.0.0.1/NvrCore'
id='uid:d6b0f550:00000115' type='set' xmlns='jabber:client'>
<query xmlns='http://jabber.org/protocol/bytestreams' sid='FTS_LMR
S231032.832167-0500 D8549 A66 F33 E.mp4_2011-12-04T23:10:54_97115'
mode='tcp'>
<streamhost jid='ser...@127.0.0.1/NvrCore' host='192.168.1.180'
port='5800'/>
<streamhost jid='ser...@127.0.0.1/NvrCore' host='127.0.0.1'
port='5800'/>
</query>
</iq>

968 153.716256 192.168.1.180 192.168.1.191 Jabber/XML 1006
Response:
<iq to='ad...@192.168.1.180/Commander/
b287fde4-4672-4b39-9283-4f1a879019ce' id='uid:d6b60818:000000a1'
type='result' from='ser...@127.0.0.1/NvrCore' xmlns='jabber:client'>
<Transfer xmlns='urn:logitech-com:logitech-
alert:device:media:recording:file'><MediaRecording id='00-12-AB-18-40-
C9\2011-12-04T23:10:32.832167-05:00'
start='2011-12-04T23:10:32.832167-05:00' duration='PT8.549S'
amountOfMotion='PT0.0666666S' size='1360261' hasThumbnail='1'
type='H264InMP4'/>
<Device id='00-12-AB-18-40-C9'/>
<FileTransfer xmlns='urn:logitech-com:logitech-alert:file-transfer'
id='FTS_LMR S231032.832167-0500 D8549 A66 F33
E.mp4_2011-12-04T23:10:54_97115'>
<File name='LMR S231032.832167-0500 D8549 A66 F33 E.mp4'
size='1360261' date='2011-12-05T04:10:32Z'
hash='05ec4ab7970f3fa890ccd4a6652c48d4'>
<Description>
LMR S231032.832167-0500 D8549 A66 F33 E.mp4
</Description>
</File>
<TransferMethod type='http://jabber.org/protocol/bytestreams'/>
</FileTransfer>
</Transfer>
</iq>

</pre>

[Matthew Szatmary]

XMPP works like any other protocol. Connect, Authenticate, send/receive commands. Just everything is in XML. The protocol was originally designed for IM clients, hence to and from is not implied to be client and server thus ID are required. The cameras jabberId is 127.0.0.1/NvrCore. Your ID should be admin@[ip]/[guid]

Are you using an XMPP library, or do you intend on doing it yourself vis straight sockets? If the latter, you will need to read the following RFCs.

RFC 3290

XEP-0066

XEP-0060

XEP-0050

Are you planning to release your project open source?

[Gary Tessman]

Once I get something streaming through a transcoder, I was planning too release it open source if people are interested in it.  Right now with rtsp as my only option and vlc player, its not stable and crashes a lot on the browser side with vlc.  Yes, I am using SMACK library for jabber.  I am able to connect and login just fine.  I'm just not sure what to do after that.  I presume there are some commands I can run to get a list of available commands etc.  PubSub to some channel maybe?  I was able to see presence working too.  I'll read some more about it.

Thank you,
~Gary

[Matthew Szatmary]

Start with a basic get. Its an AdHoc command ( xmlns="urn:logitech-com:logitech-alert:nor:basic:get", you will also need to include a data form ). Use tcpdump to make sure the stanza you are sending matches the one alert commander sends. That will give you basic information about the camera. Next I would use PubSub to get live events (xmlns="urn:logitech-com:logitech-alert:remote-event:device:media:recording:ended"). That will return a thumbnail JPG that is bas64 encoded. You can then use the file name returned to request a file transfer. That part will get a little tricker, because that is a custom stanza.

[Gary Tessman]

Thanks Matthew, I'll read about it more too.   This is very helpful to know, but at least gives me a good starting point with XMPP side of things.  I was also planning on integrating MySQL database, wondering if you have any thoughts pro/con on that?  Upnp device removed doesn't seem to happen as timely as Commander recognizes it, so probably they are using XMPP for recognition of that disconnect.  However, discovery works great about the same speed as Commander.

Thanks,
~Gary

[Gary Tessman]

Okay, I'm pretty much stuck on the xmpp stuff using smack.  Its not exactly very intuitive or very well documented.  I spent an entire day on it trying to get adhoc commands working but made no progress.  Seems this part of smack isn't well documented.  If you want source let me know - maybe you will have some better luck with smack than I am.  I'm about to give up...

I also am using desktop notifications for chrome.  The idea here was that you could have your browser minimized and still get your motion events or upnp connect/disconnect events. 

~Gary

[Gary Tessman]

First I want to mention Matthew, your link to github on this site:   http://forums.logitech.com/t5/Alert-Security-Systems/Open-Source-Alert-Commander-Replacement/td-p/699514/page/3     is broke, it takes you to here: https://github.com/szatmary/iAlert/downloads%29.  You may want to repost that.

As for XMPP, I think I am finally making progress...   here's what I've found:

<iq id="tMz5F-7" to="ad...@192.168.1.188/Smack" from="ser...@127.0.0.1/NvrCore" type="result">
  <query xmlns="http://jabber.org/protocol/disco#items" node="http://jabber.org/protocol/commands">
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceMediaRecordingDelete" node="urn:logitech-com:logitech-alert:device:media:recording:delete"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrBasicSetRequest" node="urn:logitech-com:logitech-alert:nvr:basic:set"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceBasicSetRequest" node="urn:logitech-com:logitech-alert:nvr:device:set"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrDevicesGetRequest" node="urn:logitech-com:logitech-alert:nvr:devices:get"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceAudioSetRequest" node="urn:logitech-com:logitech-alert:nvr:device:audio:set"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceVideoGetRequest" node="urn:logitech-com:logitech-alert:nvr:device:video:get"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceVideoSetRequest" node="urn:logitech-com:logitech-alert:nvr:device:video:set"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceWasatchGetRequest" node="urn:logitech-com:logitech-alert:nvr:device:wasatch:get"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceAlertGetRequest" node="urn:logitech-com:logitech-alert:nvr:device:alert:get"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceAudioGetRequest" node="urn:logitech-com:logitech-alert:nvr:device:audio:get"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrOnlineSetRequest" node="urn:logitech-com:logitech-alert:nvr:online:set"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrReset" node="urn:logitech-com:logitech-alert:nvr:reset"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceAlertSetRequest" node="urn:logitech-com:logitech-alert:nvr:device:alert:set"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrBasicGetRequest" node="urn:logitech-com:logitech-alert:nvr:basic:get"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrTimeGetRequest" node="urn:logitech-com:logitech-alert:nvr:time:get"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrTimeSetRequest" node="urn:logitech-com:logitech-alert:nvr:time:set"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceMediaRecordingProtect" node="urn:logitech-com:logitech-alert:device:media:recording:protect"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceBasicGetRequest" node="urn:logitech-com:logitech-alert:nvr:device:get"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrSecurityChangeKey" node="urn:logitech-com:logitech-alert:nvr:security:key:change"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrSecurityChangePassword" node="urn:logitech-com:logitech-alert:nvr:security:password:change"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlDeviceWasatchSetRequest" node="urn:logitech-com:logitech-alert:nvr:device:wasatch:set"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrBandwidthTestStart" node="urn:logitech-com:logitech-alert:nvr:diagnostics:bandwidth-test:start"/>
    <item jid="ser...@127.0.0.1/NvrCore" name="LogiNvrControlNvrOnlineGetRequest" node="urn:logitech-com:logitech-alert:nvr:online:get"/>
  </query>
</iq>
----------------------------------------------------------------------------------------------------
<iq id="tMz5F-8" to="ad...@192.168.1.188/Smack" from="ser...@127.0.0.1/NvrCore" type="result">
  <command xmlns="http://jabber.org/protocol/commands" node="urn:logitech-com:logitech-alert:nvr:basic:get" sessionid="uid:f7c237a8:000000ad" status="completed">
    <actions/>
    <x xmlns="jabber:x:data" type="result">
      <title>Get NVR Basic Response</title>
      <field var="FORM_TYPE" type="hidden">
        <value>urn:logitech-com:logitech-alert:nvr:basic:get</value>
      </field>
      <field var="InstanceId">
        <value>00-12-AB-1D-55-D1</value>
      </field>
      <field var="InstanceName">
        <value>Kitchen</value>
      </field>
      <field var="InstanceType">
        <value>1</value>
      </field>
      <field var="SoftwareVersion">
        <value>3.1.154</value>
      </field>
      <field var="SoftwareVersionReleaseDate">
        <value>2011-10-27T05:12:16Z</value>
      </field>
      <field var="SoftwareInstallDate">
        <value>2011-10-27T05:12:16Z</value>
      </field>
      <field var="OperatingSystemFullName">
        <value>Linux 169.254.244.39 2.6.18_pro500-davinci_IPNC_1.0 #1 PREEMPT Thu Mar 3 10:36:27 MST 2011 armv5tejl GNU/Linux</value>
      </field>
      <field var="OperatingSystemVersion">
        <value>2.6.18_pro500-davinci_IPNC_1.0</value>
      </field>
      <field var="SystemUpTime">
        <value>125686</value>
      </field>
    </x>
  </command>
</iq>
--------------------------------------------------------------------------------------

So what do you think?  Am I heading in the right direction finally?  Stupid me left out the "r" in the recipient user name... that was what caused most of my headaches.

[Gary Tessman]

Matthew,

I got all this working now.  I'm able to subscribe to do basic adhoc commands, pubsub commands and custom stanza's.  I've got file transfers working and the MP4 is being downloaded to the app server now,  pan tilt zoom is working and so are motion events, capture live image and email notifications :-)   Thank you for your guidance.  

Now, the only difficult thing left is trans-muxing.  Wondering if you have any input on that?  Seem all the players I try with crtmpserver dont work well because the logitech cams send two control play/starts on the rtsp stream.  This also seems to cause VLC player to crash sporadically.   I'm able to get the stream to transcode through crtmpserver, just cant view it because of this double control play/start.  I've tried it with jwplayer, flowplayer, and osmplayer.  They all won't play this rtmp stream through crtmpserver.   RTSP seems to be the only option which works only 50% of the time in VLC player (I think from this double start thing too). 

Wondering if you have any input on this?

Thanks,
Gary Tessman

[Matthew Szatmary]

If you don't mind the extra dependency, You can install a copy of wowza (there are free personal licenses available). Wowza will transmux into almost any streaming format on the fly. ffserver (part of the ffmpeg package) is also an option.

[Gary Tessman]

Thanks Matthew,

I've checked out Wowza (same thing logitech uses) and their developer licenses and personal edition both have an expiration.  Am I missing something there?   I'll check out ffserver and see if it can help too.

Thanks,
Gary

[Matthew Szatmary]

If I remember correctly, the developer licenses do not expire (they are just feature limited)

[Gary Tessman]

I think that *used* to be the case maybe with wowza2.  But now this is too restrictive for any single user wowza3.  One live stream in wont cut it and for only 180 days only.

Thanks,
~Gary Tessman

	FREE DEVELOPER LICENSE
		IDEAL FOR	Long-term development tasks
		LICENSING	One license key - one server instance
		SERVER LIMITS	On-Demand: up to 10 connections Live: 1 stream in, up to 9 out
		TRANSCODER ADDON LIMITS	1 stream in, up to 9 out Audio/video watermark
		nDVR ADDON LIMITS	1 stream in, up to 9 out
		DRM ADDON LIMITS	On-Demand: up to 10 connections Live: 1 stream in, up to 9 out
		LICENSE TIME LIMIT	180 days