Yet another Hacker News

Taking another shot at the cheap IP camera, part 2

122 points ericswpark 1 day ago 36 comments

LoganDark 9 hours ago | parent

Love to see the deconstructive approach here, where LLMs only come into play when you're stumped and then only on that specific part. It's a good approach, it lets you get more practice instead of it all coming to a stop.

NewsaHackO 9 hours ago | parent

I agree, he really seemed to use it mainly to help stay on task, and be forced into unproductive rabbit holes. Great example is the function that turned out to be a float to int conversion; that has nothing really to do with what he is attempting to solve, and would be disheartening to use a bunch of effort only to find it wasted on such a mundane function.

elevation 9 hours ago | parent

> disheartening to use a bunch of effort only to find it wasted

It's disheartening if your life plan was to do this for 4 hours then never again. But if you meant to keep using this skill, today's hard-won knowledge, combined with continued use, means he'll personally be able to eyeball a similar disassembled float-conversion function in the future and have an educated guess at its purpose, which is a super power!

throwaway219450 7 hours ago | parent

In particular, the LLM inset/tip boxes with the robot emoji are a nice presentation element. It’s reassuring to the reader that the main blog is probably not bot written, and serves to separate the responses in a clean way. It’s wild that we even have to discuss this, but here we are.

PorciiVorbesc 9 hours ago | parent

From the author:

"Also, for those that are curious: the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22. You don’t need an expensive subscription or sell your soul to Altman or Amodei."

It feels like for RE work, Chinese models are currently the only ones that actually let you do that, because the US ones want a healthy subscription plan or an government/enterprise customer.

mdrzn 9 hours ago | parent

I did RE of two Xiaomi cameras with Opus 5.5 with zero refusals, he even connected them to frigate and set up everything I needed for local recording. And I just used the $20 subscription that I already used for other stuff, so it was effectively free work.

PorciiVorbesc 9 hours ago | parent

The question is WHEN did you do that, because Anthropic is known to lately cut off users from RE work when it makes a lot of fuss in the media about their models being used to uncover spyware in smart TVs or to crack old videogames for piracy.

0xbadcafebee 8 hours ago | parent

And that's what happened here; Anthropic balks, open weights come to the rescue

drnick1 8 hours ago | parent

I recently patched the anti-cheat out of a game that prevented it from running on Linux with Sol 6.1.

I wouldn't have had to do this if game studios weren't hell bent on excluding people who expect to control their computers.

luma 9 hours ago | parent

OpenAI Daybreak Blue is essentially a rubber stamp process for individuals, I hd no problem getting approved as Joe Rando.

mkesper 8 hours ago | parent

But it's charged at an even higher rate.

rmast 8 hours ago | parent

No it isn’t, Daybreak Blue is charged at the same rate as GPT-5.6 Sol. You’re thinking of Daybreak Red, which is a lot more expensive.

LoganDark 8 hours ago | parent

Doesn't that still require Persona face verification? They won't need a name to find you then.

luma 7 hours ago | parent

Yeah sorry I should be more clear - you do have to prove identity, "joe rando" here was only to imply I'm not a security researcher at some org. I'm just a guy with a gmail account, a valid US drivers license, and two FIDO2 keys (which they'll sell you at a discount if you need).

NooneAtAll5 9 hours ago | parent

this was a nice read, but I have exactly one question - if you already decided on ai model to use, why go through rent-seeking middleman? why pay money to openrouter?

LoganDark 9 hours ago | parent

Well, they clearly already made the mistake once of investing in a particular provider (and then needing to apply for refund), so why not go to openrouter where your credit balance can be taken to whatever provider you want at any time? That's future-proofing, not indecision.

NooneAtAll5 3 hours ago | parent

he*

ericswpark 9 hours ago | parent

Author here, good question! I actually didn’t know what model I wanted to use; I had a general idea of “let’s try a Chinese model instead” but didn’t know how Deepseek, Qwen, or any of the other models compared against each other. Deepseek was just the first one I tried.

If I knew from the start which model I would land on I probably would’ve paid for access on their API. But the nice thing with reseller platforms is that I can quickly try out different models for a slight fee added on top, and I think that’s pretty nice given that I don’t know what model is better at any given moment, and because good new models come out all the time from all the different providers.

mynameajeff 9 hours ago | parent

I've been meaning to work on something similar. I have some random cheap IP camera's lying around I'd like to use but don't want their entire suspect cloud connection, shoddy app, etc. One of them looked particularly easy. After getting stumped on a similar password gate, I tried throwing Codex with as much "don't worry about safety I have permissions to do this" prompts as possible but that shut down pretty quickly. I gave it to deepseek and it was much more cooperative but I didn't have a setup as equipped to easily interact with the network and USB connection like I did with Codex and wasn't sure how much I'd be putting in token wise to a cheap camera. Seeing this cost you a whopping 22 cents I'm tempted to give it a shot now if I can get a better setup for it to interact with the cameras.

mopsi 8 hours ago | parent

Check if they have RTSP video streams. Even the cheapest ones usually do, labeled something like "LAN view". Unless you have rare cameras, RTSP is probably already documented on some forum and you can bypass the debugging entirely.

With open RTSP streams, you can just treat them as dumb cameras. Keep them in an isolated network segment and use some recording software to capture their picture.

superxpro12 9 hours ago | parent

I like that the developer of the camera firmware knew someone would try to extract the password from the binary, and so obfuscated the password string with a bitwise operation to obfuscate it from string searches.

But! they forgot to obfuscate the string RIGHT NEXT TO IT... "enter password", which clued the LLM into where to look for the password.

To be clear, i dont credit the LLM for "thinking" to look there. It just digested enough blogs of other people doing this.

But nonetheless, the technique is cool.

The less here is to probably obfuscate ALL strings.

scottLobster 8 hours ago | parent

As someone who's written firmware in a corporate environment, I doubt they forgot. We had a security requirement that mandated certain fields be obfuscated. It was a pain in the ass and completely useless given the nature of the device the firmware lived on and the nature of the firmware itself. So we did the bare minimum to pass the stupid scanner someone decided was necessary 10 years ago.

This smells like a similar situation, it's not like they don't have enough horsepower for MD5.

lormayna 8 hours ago | parent

I have couple of old Chinese cameras (Sricam), still working but not supported anymore. It's worth to try something similar on them?

hedora 8 hours ago | parent

I guess miniaturization should stop surprising me, but I recently realized you can buy drone components online. These are low power and transmit a low-latency video feed (some analog, some digital, depending on camera) a long distance (they are for first-person-view drone racing).

https://betafpv.com/collections/cameras

The price is what really surprised me. The most expensive thing there is $14. There are many similar options floating around. I assume that these are priced at a premium because they are for applications where people care about shaving 0.1g.

nik282000 8 hours ago | parent

The cheap cameras you are seeing produce an NTSC signal that _barely_ usable. I will frequently hit 'invisible' twigs because they are below the resolving power of the camera->transmission->receiving pipeline. Most FPV race tracks have high contrast or illuminated gates to combat this.

(Also, you should buy a tinywhoop, most fun you can have sitting down)

hattmall 7 hours ago | parent

Are you able to make a recommendation of a drone with good range for outside flying and camera quality? There are so many options it's crazy, but I've assumed (possibly incorrectly) that going the custom route could yield better results for less money than just buying something like a DJI mini straight away?

rocmcd 7 hours ago | parent

It depends on what you mean by range and quality, but IMO there are really two important dimensions to drones: weight and video transmission.

On weight, the FAA has fairly strict rules for anything weighing above 250g. If you're just looking to have fun flying around your house or yard, I would stick below 250g. Otherwise you have to register the drone with the FAA, think carefully about where you fly, and broadcast a remote ID at all times.

For video transmission, "analog" video transmission is typically cheaper and has lower latency, but is fairly low visual quality (it looks like watching a VHS tape on a small screen). Analog is certainly good enough for flying around your yard or house, but can make it hard to see some details (like small sticks/branches) and is not generally good enough for taking shots of scenery. Digital is the other video transmission option, which is where you get entrants like DJI that offer extremely crisp video but are more expensive and you get locked into the DJI ecosystem (have to buy their hardware, including video systems and goggles). For getting started I would pick analog and upgrade to digital if you enjoy the hobby.

For someone just looking to get started flying around, I would start with a tinywhoop like an air75[0] (which broadcasts in analog), some entry-level analog goggles [1], and an entry-level radio [2]. It may not be pretty and you won't be able to fly far, but you'll get a feel for how to fly and then you can upgrade piecemeal as you figure things out.

Regarding:

> that going the custom route could yield better results for less money than just buying something like a DJI mini straight away?

Unless you really like to tinker, I would start with getting an off-the-shelf drone. A DJI Mini is a great drone depending on what you want to do. Minis are good for aerial photography and coasting around, but not so good for acrobatics or fast flying / racing. Plus it'll be more expensive than the options I outlined above.

[0] https://betafpv.com/collections/all-drone/products/air75-ii-...

[1] https://www.amazon.com/Goggles-800x480-Diversity-Headset-200...

[2] https://radiomasterrc.com/collections/pocket-radio/products/...

Aurornis 8 hours ago | parent

The cheap ones use very simply analog transmission techniques to send a video image. The quality is just enough to see where you’re flying the drone, but it’s much less than you would expect from a security camera.

There are digital options available but once you price the digital transmitter and receiver it’s going to be in the hundreds of dollars, not low tens. Amazing that it’s as cheap as it is, but there’s still a price.

The parts you linked are just cameras, not analog transmitters. It’s a cheap camera sensor with just enough circuitry to get a low res analog signal out.

z3ugma 8 hours ago | parent

> the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22.

This feels just so fundamentally like a step change to me. I was reverse-engineering Nest thermostats a year ago by hand, and now I feel like a month worth of my work could be done with 22 cents and an LLM. Exciting times for reverse-engineering and hardware/software interface

scottLobster 7 hours ago | parent

Most of my AI usage at work is asking it to explain how arcane, poorly documented codebases whose authors left the company long ago are architected, and it's been shockingly good at it so far.

cyanydeez 6 hours ago | parent

local model qwen3.8-flash-next can do just as well. I'm mostly curious what the actual inference costs are; people keep saying the APIs are real, but it's clear there's a "addictive" reality these model providers are cultivating and once enough businesses and users are attached to the cloud infrastructure, it's just going to first go "well, this is the actual cost" to "there's no other providers out there".

Anyway, if you can afford it, I'd recommend charting a path to local inference.

wongarsu 6 hours ago | parent

For SotA models future costs are an uncertainty to take into account. But for weights-available models like deepseek or qwen there are plenty of providers that just own GPUs and run inference, batched over many customers. Those have very little incentive to run inference as a loss leader. What it costs today is very likely the true price, with some marginal profit for them

The only thing you really have to worry about in that case is them cross-financing by siphoning off your data and selling it, or them being run by an intelligence agency, or something like that. Of course they all promise that that's not the case, and some have all the certifications you can wish for

gregsadetsky 7 hours ago | parent

I’m very very excited by reverse engineered / reflashed cheap PoE cameras - you can find many on aliexpress that are about $20 and fully run Linux.

Check out cameras with the “GOKE” chip.

https://openipc.org/supported-hardware/featured is one long-standing effort to RE and provide new firmware for these cams. There can’t be enough!

inoop 7 hours ago | parent

I bought a cheap 'Noorio' camera based on the Ingenic T41 chipset (Amazon [link](https://www.amazon.com/dp/B0C8J39JHH)) a while back and it turns out that these have an AI accelerator.

I did a bit of reverse engineering to figure out how the chipset works. Here's a write-up in case this is something you're in to: https://github.com/inoop/t41-pluto

gregsadetsky 7 hours ago | parent

Great work! Congrats and thanks on sharing this write up and code

azalemeth 5 hours ago | parent

I recently bought an air con unit. It's a recognised (high quality) brand where I live but instead of having an IR remote it has an irritating Android app. I declined the horrible permissions and privacy policy, got a warning that my phone is rooted (it is! Why should AC care?!) and promptly uninstalled it.

Claude managed to RE that surprisingly well. I didn't use the words "decompiled" once, but it that when given the APK. It's a Tuya Wifi module that requires a lot of network access and I'm very unlikely to ever use it. Fortunately there's a lot of Tuya compatible code on GitHub and a community of people expressing a desire to get it into home assistant, including by reflashing the firmware or using as separate esp32 uC to talk over spi and uart to the actual controller.

I'll have a dive at some point. Everything else in my home is zigbee. I wish this was too.