Hello all! New to IP Cameras with a few questions (Specifically Imou Ranger SE 4MP)

[palujust]

Hello!

I recently purchased a WiFi IP camera and I'm trying to determine if it's possible to initialize it (i.e., connect to the wireless network) without relying on a mobile app. Perhaps I'm overly paranoid, but I'd like to avoid a situation where I cannot change the network SSID or password because the app has disappeared from the Play Store or my phone's version of Android is not supported, etc., etc. (For what it's worth I do find the app works reasonably well, especially compared to the Blink Camera systems I've used before).

information I have/have been able to determine so far:

• Camera model: Imou Ranger SE 4MP (IPC-A43N)
• Resetting the camera forces it to boot into AP/Ad-hoc mode and I can connect my phone/laptop to the access point. The camera gives itself the IP address of 192.168.0.108 at this point. (Note, conveniently this is the IP address that my camera gets after it does join my actual network)
• nmap tells me that ports 80, 554, 8086, 37777 are open. I understand that 554 is for RTSP, 37777 is used for Dahua's protocol, and 80 is obviously for http. Not sure about 8086. (note: I actually ran this nmap after I completed the pairing process with my phone so not all of these ports may actually be available until after it connects to the wireless network)
• My Android phone happens to be rooted so I was able to run an app called PCAPdroid during the setup process. I can see my phone (192.168.0.109) sending a bunch of packets to 192.168.0.108 on port 37777. I can also see one packet has a large payload with the text "AES-128" followed by a large base64 encoded string. I assume this is an encrypted copy of the network credentials. (I hope it's not just sending a key over the air??)
• I cannot load
  http://192.168.0.108
  in the browser. It tries to load but ends with no response. curl tells me "Empty reply from server"
• I know this camera supports some subset of ONVIF and after looking for some URLs online, I found that a GET request to
  http://192.168.0.108/onvif/device_service
  does actually respond although the XML says "Unknown Error"
• I was able to get the RTSP stream to work in VLC
• I was able to connect the camera to iSpy
• I was able to connect the camera to Home Assistant (with mixed success, the streaming capabilities within the Home Assistant UI kinda suck)
• I was able to connect the camera to the Dahua SmartPSS tool and removed the Imou watermark
• I also downloaded the ConfigTool but I don't seem to see anything useful in it.

So I guess my longshot questions are:

1. Does anyone know of a hidden endpoint URL for the configuration web page? The HTTP server is clearly running, it's just limiting what it responds to.
2. Similar to above, is there an ONVIF method for setting the SSID and password? Could I invoke this endpoint while the camera is in AP mode?
3. Is there a firmware upgrade/downgrade that might enable a configuration web page?
4. Is there documentation available for the communications that are happening on port 37777? It seems like this is likely how the app is sending the network credentials to the camera. I have also noticed that the PTZ controls are much smoother in SmartPSS and the Imou Life app, so I'm wondering whether the Dahua protocol is just better than ONVIF here.

Thanks in advance for any info anyone can provide! FWIW I generally like this camera, but my concerns about whether I'll be able to initialize them without being tied to a mobile app are mainly just limiting whether I decide to buy more of them or look for other options.

 

[gardar]

I think the http is just for the onvif soap api, you need to do a http post and not get to get anything useful.
You can try with curl or postman for example. Or better yet GitHub - FalkTannhaeuser/python-onvif-zeep: ONVIF Client Implementation in Python 2+3 (using https://github.com/mvantellingen/python-zeep instead of suds as SOAP client)

You should be able to control the ptz over onvif, at least it's possible with the ranger rc and rex cameras.

I've not investigated what's listening when the cameras are in AP mode but I guess some api (perhaps onvif?) That's listening for a command to set the network.