海康相机IP搜索协议研究

╰半夏微凉° 2022-01-13 19:21 400阅读 0赞

[2019独角兽企业重金招聘Python工程师标准>>> ][2019_Python_] ![hot3.png][]

项目中使用了海康相机用于拍照功能，要访问海康相机就需要知道相机的IP，一般我们通过配置文件将IP地址传入程序中，在调用其官方SDK进行拍照。每次都需要手工配置IP地址，每次现场安装实施都要配置，非常容易配置错误。所以如果软件能够自动搜索相机，并自动配置，免去手工配置的麻烦和易出错，可以增强软件的可靠性，降低部署复杂度。

分析之后想到，海康官方有提供一个相机IP修改的工具，功能强大，只要在局域网中，即使不在一个IP段也能搜索到相机。如果我们的程序也能够实现该功能，能否实现前面的设想？

根据这个想法，我觉得可以分析下其IP搜索通信协议。

通过使用wireshark抓包工具，发现其IP搜索使用了两种通信方式，一种是UDP广播，另一种是更加底层的通信方式，直接通过网卡发送广播包。实测时发现，两种通信方式功能基本相同，都能够所搜IP，修改配置。直接使用网卡发包的方式比UDP广播的方式貌似兼容相机多些。

UDP广播：

UDP广播通信方式，搜索工具会向IP：239.255.255.250，端口号：37020进行广播，通信内容为xml格式字符串，例如以下内容。各个字段含义已经比较清晰了。

/* 以下是海康相机UDP协议
     * 用于搜索相机和修改IP
     * 广播地址：239.255.255.250
     * 端口号：37020
     */
    
    
     搜索相机广播请求
    <?xml version="1.0" encoding="utf-8"?>
    
    <Probe>
      <Uuid>AB2CC373-2332-4F7B-AA18-838E08E748AE</Uuid>
      <Types>inquiry</Types>
    </Probe>
    
    
     搜索相机返回结果
    <?xml version="1.0" encoding="utf-8"?>
    
    <ProbeMatch>
      <Uuid>AB2CC373-2332-4F7B-AA18-838E08E748AE</Uuid>  
      <Types>inquiry</Types>  
      <DeviceType>140063</DeviceType>  
      <DeviceDescription>DS-2CD5A26FWD-IZ</DeviceDescription>  
      <DeviceSN>DS-2CD5A26FWD-IZ20160518AACH604074182</DeviceSN>  
      <CommandPort>8000</CommandPort>  
      <HttpPort>80</HttpPort>  
      <MAC>bc-ad-28-53-85-e8</MAC>  
      <IPv4Address>172.16.16.191</IPv4Address>  
      <IPv4SubnetMask>255.255.255.0</IPv4SubnetMask>  
      <IPv4Gateway>172.16.16.1</IPv4Gateway>  
      <IPv6Address>::</IPv6Address>  
      <IPv6Gateway>::</IPv6Gateway>  
      <IPv6MaskLen>0</IPv6MaskLen>  
      <DHCP>false</DHCP>  
      <AnalogChannelNum>0</AnalogChannelNum>  
      <DigitalChannelNum>1</DigitalChannelNum>  
      <SoftwareVersion>V5.3.8build 151223</SoftwareVersion>  
      <DSPVersion>V7.3 build 151218</DSPVersion>  
      <BootTime>2016-08-01 17:04:52</BootTime>  
      <ResetAbility>false</ResetAbility>  
      <DiskNumber>0</DiskNumber>  
      <Activated>true</Activated>  
      <PasswordResetAbility>true</PasswordResetAbility>  
      <PasswordResetModeSecond>true</PasswordResetModeSecond> 
    </ProbeMatch>
    
    
    
    
    
     修改相机参数请求
    <?xml version="1.0" encoding="utf-8"?>
    
    <Probe>
      <Uuid>21A9F613-5E4F-41DF-B821-E36523087D1D</Uuid>
      <Types>update</Types>
      <MAC>28-57-be-af-7a-14</MAC>
      <Password>/RsWjdUa5zJ3OQWH6zy00w==</Password>
      <IPv4Address>172.16.16.190</IPv4Address>
      <CommandPort>8000</CommandPort>
      <HttpPort>80</HttpPort>
      <IPv4SubnetMask>255.255.255.0</IPv4SubnetMask>
      <IPv4Gateway>172.16.16.190</IPv4Gateway>
      <IPv6Address>::</IPv6Address>
      <IPv6Gateway>::</IPv6Gateway>
      <IPv6MaskLen>0</IPv6MaskLen>
      <DHCP>false</DHCP>
    </Probe>
    
    
     修改相机参数成功
    <?xml version="1.0" encoding="utf-8"?>
    
    <ProbeMatch>
      <Uuid>AB2CC373-2332-4F7B-AA18-838E08E748AE</Uuid>  
      <Types>update</Types>  
      <Result>success</Result>  
      <DeviceType>140063</DeviceType>  
      <DeviceDescription>DS-2CD5A26FWD-IZ</DeviceDescription>  
      <DeviceSN>DS-2CD5A26FWD-IZ20160518AACH604074182</DeviceSN>  
      <CommandPort>8000</CommandPort>  
      <HttpPort>80</HttpPort>  
      <MAC>bc-ad-28-53-85-e8</MAC>  
      <IPv4Address>172.16.16.195</IPv4Address>  
      <IPv4SubnetMask>255.255.255.0</IPv4SubnetMask>  
      <IPv4Gateway>172.16.16.1</IPv4Gateway>  
      <IPv6Address>::</IPv6Address>  
      <IPv6Gateway>::</IPv6Gateway>  
      <IPv6MaskLen>0</IPv6MaskLen>  
      <DHCP>false</DHCP>  
      <AnalogChannelNum>0</AnalogChannelNum>  
      <DigitalChannelNum>1</DigitalChannelNum>  
      <SoftwareVersion>V5.3.8build 151223</SoftwareVersion>  
      <DSPVersion>V7.3 build 151218</DSPVersion>  
      <BootTime>2016-08-01 17:04:52</BootTime>  
      <ResetAbility>false</ResetAbility>  
      <DiskNumber>0</DiskNumber>  
      <Activated>true</Activated>  
      <PasswordResetAbility>true</PasswordResetAbility>  
      <PasswordResetModeSecond>true</PasswordResetModeSecond> 
    </ProbeMatch>
    
    
    
     修改相机参数失败
    <?xml version="1.0" encoding="utf-8"?>
    
    <ProbeMatch>
      <Uuid>AB2CC373-2332-4F7B-AA18-838E08E748AE</Uuid>  
      <Types>update</Types>  
      <Result>failed</Result> 
    </ProbeMatch>

其中密码部分进行了加密，加密方式为md5+base64，加密参考代码如下

/**
    	 * md5加密
    	 * @param password
    	 * @return
    	 */
    	public static byte[] md5(String password) {
    		try{
    			// MD5
    			MessageDigest md = MessageDigest.getInstance("MD5");
    			md.update(password.getBytes());
    			byte[] digestedValue = md.digest();
    			
    			return digestedValue;
    		}catch(Exception e){
    			e.printStackTrace();
    			return null;
    		}
    	}
    	
    	/**
    	 * md5(base64)加密
    	 * @param password
    	 * @return
    	 */
    	public static String md5Base64(String password){
    		try{
    			// MD5
    			byte[] digestedValue = md5(password);
    			
    			// base64
    			BASE64Encoder encoder = new BASE64Encoder();
    			return encoder.encode(digestedValue);
    			
    		}catch(Exception e){
    			e.printStackTrace();
    			return null;
    		}
    	}

网卡广播方式：

网卡广播的方式，其协议内容使用二进制格式，并不像UDP方式那么容易理解。对于其协议格式只破解了一部分，其中貌似有校验和的字段，其校验和的计算方式无法得知，导致并不能实际用该协议对相机参数进行修改。要能够使用网卡进行广播通信，还需要安装WinPcap（官方工具也装了这个），java的话还需要*jPCAP才能进行底层通信。以*下是部分协议解析结果：

// mac通信设备搜索
    //21 02 01 42 00 00 1D 2C 06 04 03 00 21 82 50 7B 9D 73 44 73 AC 10 10 F4 FF FF FF FF FF FF 00 00 00 00 00 00 00 00 FE 80 00 00 00 00 00 00 9D 57 F5 8D 3B B0 78 EC 00 00 00 00 00 00 00 00 00 00 00 00 
    
    
    // 貌似以下是mac地址通信接收的数据
    //21 01 01 F6 00 00 1D 07 06 04 
    //04 (04=inquiry,07=update)
    //00 (结果：01=失败，02=成功)
    //5B 44 
    //C0 56 E3 7C B0 C4 (物理地址地址)
    //AC 10 10 C1 (IP地址：172.16.16.193)
    //FF FF FF FF FF FF 00 00 00 00 
    //FF FF FE 00 (子网掩码:255.255.254.0)
    //44 53 2D 32 43 44 32 34 31 32 46 2D 49 32 30 31 35 30 33 32 35 43 43 43 48 35 30 38 35 33 37 39 37 38 (设备序列号:DS-2CD2412F-I20150325CCCH508537978)
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 11 00 00 
    //1F 40 (端口:8000)
    //00 00 00 01 00 00 00 00 
    //56 35 2E 31 2E 36 62 75 69 6C 64 20 31 34 30 36 31 32 (软件版本：V5.1.6build 140612)
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    //56 35 2E 30 2C 20 62 75 69 6C 64 20 31 34 30 34 31 31 (DSP版本:V5.0, build 140411)
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    //32 30 31 36 2D 30 38 2D 30 32 20 31 38 3A 31 37 3A 33 31 (启动时间：2016-08-02 18:17:31)
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 9C 9D 99 
    //AC 10 10 01 (网关:172.16.16.1)
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 
    //00 (DHCP：00=关，01=开) 
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    //50 (http端口:80)
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    //44 53 2D 32 43 44 32 34 31 32 46 2D 49 (设备类型：DS-2CD2412F-I)
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    
    
    // mac通信修改信息
    //21 02 01 42 00 00 26 19 06 04 06 00 33 16 50 7b 9d 73 44 73 
    //ac 10 10 f4 (PC机IP(20)) 
    //c0 56 e3 7c b0 c4 (mac地址(24))
    //ac 10 11 87 (IP地址(30)：172.16.17.135)
    //ff ff fe 00 (子网掩码(34)：255.255.254.0)
    //82 7c cb 0e ea 8a 70 6c 4c 34 a1 68 91 f8 4e 7b (md5加密(38))
    //00 00 1f 40 00 00 00 00 00 00 00 00 02 9c 02 41 (1f 40两个值可能是校验和)
    //ac 10 10 01 (网关(70)：172.16.16.1)
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (IPV6地址(74))
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (IPV6网关(90))
    //00 (IPV6子网前缀长度(104))
    //00 
    //00 (DHCP(106))
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    //50 (http端口(137):80)
    //00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

转载于:https://my.oschina.net/u/2450094/blog/791385

[2019_Python_]: https://my.oschina.net/u/2663968/blog/3061697
[hot3.png]: /images/20220113/0ad4d09fb2c442929be33140c5485bcc.png