安全与隐私thirtythreeforty.net
逆向工程摄像头协议：为了乐趣和收益
Reverse engineering a camera protocol for fun and profit
2020 — 2022，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
作者对 Reolink B800 IP 摄像头进行逆向工程：拆解固件、用 Wireshark/Ghidra 等工具分析其私有 Baichuan 协议，最终用 Rust 重写了一个开源客户端 neolink，让摄像头可以通过标准 RTSP 与 NVR 软件配合使用。文章详细记录了从硬件拆解到协议还原的完整过程。
为什么经久不衰：它是一篇教科书级的硬件/协议逆向工程实战记录，工具链和思路至今仍适用于破解各类闭源物联网设备。
HN 评论精选
被引用代码的原作者现身，分享了自己类似但未完成的逆向经历
没想到周四晚上会读到一篇引用了我 15 岁时写的代码的文章。当年我逆向父母家的网络 DVR 是为了接入 Home Assistant，但卡在 H264 流重组上，只得到损坏的静态帧，没能像作者走得那么远。做得好！
nvella查看英文原文
I must say, out of all the things to happen on a Thursday night I wouldn't have expected to read an article where someone referenced my own code that I wrote when I was 15. (5 years ago now... time flies) Here's the file I presumed he looked at; https://github.com/nvella/sdvr/blob/master/pk.c I was trying to reverse-engineer my parent's network CCTV DVR so I could hopefully integrate it with Home Assistant - as far as I'm aware the sluggish smartphone apps are still the only way to access those boxes. I wasn't ever able to get as far as George did with his IP cameras; I hit a snag on trying to correctly reassemble the H264 streams, so all I ever got out of it was mostly corrupt still frames. If you're reading this George, well done! :D
称赞用字节序变换后的十六进制常量做 Google 搜索这一妙招
作者把数据包中的同步字 0xf0debc0a 转成小端序 0x0abcdef0 再去 Google 搜索，居然找到了 2015 年的相关项目。这种搜索技巧简单优雅，我要把它加进自己的工具箱。
peter_d_sherman查看英文原文
>"The only thing that jumped out to me was the appearance of a sync word at the beginning of each packet, 0xf0debc0a. (In little endian, this is 0x0abcdef0.) On a lark, I Googled this, and actually found a project on GitHub from 2015..." That is some excellent Google-Fu! I had never thought about Googling the reversed-endian versions of hexadecimal constants -- until you wrote about doing this; I think it's a brilliant idea, so I'm adding it to my search engine technique toolbox. In summation, it's a great idea! It's both simple and elegant!
建议用 VLAN 隔离来应对廉价摄像头糟糕的安全性
如果担心这些廉价摄像头的安全性，可以把它们放进一个无互联网访问的独立 VLAN，与家庭局域网其他部分防火墙隔离。我默认这些设备一插上就被攻破了，只把它们当作哑的 RTSP 端点喂视频给 NVR。
giobox查看英文原文
If the crap security on these cheap cams is a concern, one thing that is pretty easy to do if you buy a "managed switch" or similar is put the crappy cheap IP cams on their own private VLAN with no internet access, firewalled from all the other VLANs on your home LAN, perhaps with a few exceptions for NVRs or devices who view the feed locally at home. I just assume these devices are broken and compromised from moment I plug them in, because inevitably they always are. Cameras can't be accessed from your LAN, cameras can't access your LAN and they can't phone home easily. They just sit and feed the NVR with video content, offline. I don't even connect them to the internet for firmware updates unless there is some show stopper bug preventing them working as plain ole cams - they are just dumb RTSP endpoints.
指出低端摄像头的 ONVIF/RTSP 标准兼容性普遍不可靠
低端（<100 美元）IP 摄像头的 ONVIF 支持出奇地残缺，即使声称兼容也应查官方认证列表。RTSP 也常缺胳膊少腿，比如从不响应 OPTIONS 请求。另外 VLC 在 Debian 系发行版上因许可问题不再支持 RTSP。
Frotag查看英文原文
ONVIF support is surprisingly spotty on low-end (<$100) IP cameras, especially wifi ones. Even if a camera claims to be ONVIF compatible, you should really check for a certification at [0]. Even for RTSP, there's often something stupid like the camera implementing 90% of the protocol except it never responds to OPTIONS requests. And fun fact, VLC no longer supports RTSP on Debian-based distros due to licensing issues [1]. [0] - https://www.onvif.org/conformant-products [1] - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981439
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选