Reverse-Engineering a Tuya-Based IP Camera to Enable Local RTSP Streaming

A researcher successfully identified the internal mechanisms of a budget IP camera to bypass its proprietary cloud platform, aiming to enable local video streaming via the ONVIF standard. The project highlights how firmware analysis can reveal hardcoded RTSP URL formats and configuration keys that manufacturers often keep hidden from the end user.

Firmware Extraction and Kernel Identification

The investigation began by extracting the camera's firmware image using the binwalk tool. The extraction revealed that the device operates on a Linux 3.4.35 kernel, a version originally released in March 2013.

Within the extracted filesystem, the researcher identified the initialization scripts and the primary application binary, 'ppsapp', which is responsible for running the camera's core functions.

“We now know the ONVIF streaming URL format, though we still need to know what port it runs on.”

— Taking another shot at the cheap IP camera, part 2

Identifying the ONVIF and RTSP Logic

By running the 'strings' command on the 'ppsapp' binary, the researcher confirmed the presence of ONVIF server logic and identified the specific RTSP URL format: 'rtsp://%s:%d/Streaming/Channels/101'.

This discovery confirmed that while the ONVIF server is built into the firmware, the streaming ports are disabled by default in the software configuration.

This image demonstrates the successful outcome of the researcher's efforts to unlock a local video stream.

Decompiling Configuration Logic in Ghidra

Using the Ghidra reverse-engineering tool, the researcher traced how the binary handles the 'onvif_enable' configuration key. The analysis showed the software reading 'tuya_config.json' to populate internal data structures for motion settings, passwords, and alarm functions.

This visual supports the technical analysis of how the device handles ONVIF configuration keys.

The decompiler revealed that the 'onvif_pwd' (password) is processed and stored in specific memory locations, providing a roadmap for how the device validates local access attempts.

Trade-offs and Limitations of Automated Analysis

The researcher highlighted that while Large Language Models (LLMs) can drastically reduce the time and cost of reverse-engineering, they can be hindered by simple obfuscation. For example, a developer might use bitwise operations to hide a password string from a simple text search.

While the researcher successfully identified the RTSP URL format and the configuration logic, the specific port number for the stream remains an unresolved detail in this specific analysis.