Ragazzi, un paio di cose:
1 - Non cercate hack particolari, ad oggi le cam non funzionano (più sotto la splendida disamina di samtap ch spiega il motivo)
2 - Sapete se TUTTE le cam Xiaomi hanno questo problema o solo le Xiaofang?
3 - Gearbest mi ha rimborsato per intero e mi ha detto di tenermele
Qui sotto la spiegazione di samtap:
--------------------------------------------------------------------------------------
- It appears the old version is accepted regardless of cam firmware and mi home version. These can be recognized by not having a QR code on the base. The wifi chip is sourced from some Shenzen supplier and the MAC address does not match the MAC address in device.conf (28:XX...) used for identification with cloud services.
- The new version has a wifi chip from Xiaomi with MAC address that matches the one set in device.conf (34:XX...). Now the interesting bit: device.conf does not exist on a virgin camera. It is created by iCamera when it starts, way before a wifi connection is up or Mi Home is involved. (iCamera is the executable running on the cam doing all the work).
Ergo: If you can make a new cam appear like an old cam, by providing a device.conf with a 28:XX MAC, it will be accepted by Mi Home.
- The MAC address on wlan0 is set by iCamera when it starts so spoofing it before it starts is useless (i.e. run 'strings iCamera |grep ifconfig'). I believe from that point forward, the MAC address is stored in memory of iCamera, spoofing after it starts has no effect (wifi works fine with a different mac, device.conf still contains 34: MAC).
- Each time you press the setup button (required for pairing with Mi Home), device.conf is rewritten in case you messed with it. It writes the 34 MAC regardless of the MAC used by wlan0 at that time. A device.token is written when Mi Home starts the pairing process, it is different each time. When making device.conf inaccessible, iCamera enters an infinite loop and doesn't proceed with pairing. Messing with it too much during pairing simply causes the pairing process in Mi Home to timeout and you have to start from scratch.
Ergo: iCamera has a way to retrieve the MAC address which is not simply reading ifconfig HWaddr. It is also unlikely stored in some kind of file as that would require them to flash each cam with a different file as they are produced, possible but unlikely (and I could find no evidence of such file). It is not provided by Mi Home or cloud services either since it's used to configure wlan0 before any pairing is initiated.
- Interestingly, the MAC is stored in the 'serial' field of the USB device descriptors provided by the wifi chip. And iCamera happens to link with libusb....! I can't think of any other reason they would need libusb besides doing accessing the wifi device. I've added some debug probes in libusb in the most likely places: functions that return the serial descriptor. Those didn't get hit. But there're still many other calls that are more low-level and could equally be used to retrieve the serial.
Conclusion: If somebody would build a custom libusb that rewrites the serial in case it starts with 34 before returning it to caller, it might trick iCamera into thinking it is running on a old cam.