Support for Xiaomi Aqara Camera (lumi.camera.aq1)

[miguelangel-nubla]

$ mirobo discover
INFO:miio.discovery:Discovering devices with mDNS, press any key to quit...
WARNING:miio.discovery:Found unsupported device lumi-camera-aq1_miio75547134._miio._udp.local. at 192.168.1.33, please report to developers

edit: copied over from #347: https://fr.gearbest.com/ip-cameras/pp_978606.html?wid=1433363

[rytilahti]

Can you tell us more about this device? Is it the same as the one mentioned in #347?

[miguelangel-nubla]

Yes, It is the same. Is a camera with functionality as a zigbee gateway.

How can I help, what do you need to know about it?

[rytilahti]

We need to obtain the commands the app is sending to the device. This guide can be helpful for doing that: https://github.com/aholstenson/miio/blob/master/docs/protocol.md . Can you try mirobo discover --handshake true to see if you get a token directly from the device? If yes, can you execute mirobo --ip <ip> --token <token> info and paste the results here?

[miguelangel-nubla]

Does not report the token this way, but I have it with the other methods.

mirobo discover --handshake true
INFO:miio.device:Sending discovery to with timeout of 5s..
INFO:miio.device: IP 192.168.1.33 (ID: 0480****) - token: b'ffffffffffffffffffffffffffffffff'

Replaced credentials with #####.

user@LAPTOP:$ miiocli device --ip 192.168.1.33 --token ###################### info
Model: lumi.camera.aq1
Hardware version: Linux
Firmware version: 3.3.7_240
Network: {'localIp': '192.168.1.33', 'mask': '255.255.255.0', 'gw': '192.168.1.1'}
AP: {'ssid': 'wifi######', 'rssi': -67, 'bssid': '44:FF:##:##:##:##'}

-> 10.42.0.178 data= {"id":4704,"method":"start_zigbee_join","params":[0]}
<- 10.42.0.214 data= {"result":["ok"],"id":4704}
-> 10.42.0.178 data= {"id":4705,"method":"start_zigbee_join","params":[30]}
<- 10.42.0.214 data= {"result":["ok"],"id":4705}
-> 10.42.0.178 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":4706,"method":"start_zigbee_join","params":[0]}
<- 10.42.0.214 data= {"result":["ok"],"id":4706}
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":8532,"method":"start_zigbee_join","params":[30]}
<- 10.42.0.214 data= {"result":["ok"],"id":8532}
user@LAPTOP: $ miio protocol json-dump --token 6d6b426e674a70746d59497941616769 cameraDump3.json
user@LAPTOP: $ miio protocol json-dump --token 6d6b426e674a70746d59497941616769 cameraDump2.json
-> 10.42.0.178 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
user@LAPTOP: $ miio protocol json-dump --token 6d6b426e674a70746d59497941616769 cameraDump.json
-> 10.42.0.178 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":65001,"method":"get_ipcprop","params":["all"]}
<- 10.42.0.214 data= {"p2p_id":"#################","app_type":"celing","offset_x":"0","offset_y":"0","offset_radius":"0","md_status":1,"video_state":1,"fullstop":0,"led_status":1,"ir_status":1,"mdsensitivity":6000000,"channel_id":0,"flip_state":0,"avID":"####","avPass":"####","id":65001}
-> 10.42.0.178 data= {"id":3623,"method":"get_arming","params":[]}
<- 10.42.0.214 data= {"result":["off"],"id":3623}
-> 10.42.0.178 data= {"id":3624,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":3624}
-> 10.42.0.178 data= {"id":3625,"method":"set_arming","params":["on"]}
<- 10.42.0.214 data= {"result":["ok"],"id":3625}
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":3626,"method":"set_arming","params":["off"]}
<- 10.42.0.214 data= {"result":["ok"],"id":3626}
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":3627,"method":"get_arming","params":[]}
<- 10.42.0.214 data= {"result":["off"],"id":3627}
-> 10.42.0.178 data= {"id":3628,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":3628}
-> 10.42.0.178 data= {"id":65001,"method":"get_ipcprop","params":["video_state"]}
<- 10.42.0.214 data= {"result":["on"],"id":65001}
-> 10.42.0.178 data= {"id":6209,"method":"get_gateway_volume","params":[]}
<- 10.42.0.214 data= {"result":[40],"id":6209}
-> 10.42.0.178 data= {"id":6210,"method":"set_gateway_volume","params":[41]}
<- 10.42.0.214 data= {"result":["ok"],"id":6210}
-> 10.42.0.178 data= {"id":6211,"method":"set_gateway_volume","params":[65]}
<- 10.42.0.214 data= {"result":["ok"],"id":6211}
-> 10.42.0.178 data= {"id":6212,"method":"set_gateway_volume","params":[30]}
<- 10.42.0.214 data= {"result":["ok"],"id":6212}
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":3629,"method":"get_arming","params":[]}
<- 10.42.0.214 data= {"result":["off"],"id":3629}
-> 10.42.0.178 data= {"id":3630,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":3630}
-> 10.42.0.178 data= {"id":65002,"method":"get_ipcprop","params":["video_state"]}
<- 10.42.0.214 data= {"result":["on"],"id":65002}
user@LAPTOP: $ miio protocol json-dump --token 6a4d6b48706f4d6353796153426f7333 cameraDump4.json
-> 10.42.0.178 data= N/A
-> 10.42.0.178 data= N/A
-> 10.42.0.178 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":65001,"method":"get_ipcprop","params":["all"]}
<- 10.42.0.214 data= {"p2p_id":"#####################","app_type":"celing","offset_x":"0","offset_y":"0","offset_radius":"0","md_status":1,"video_state":1,"fullstop":0,"led_status":1,"ir_status":1,"mdsensitivity":6000000,"channel_id":0,"flip_state":0,"avID":"#########","avPass":"############","id":65001}
-> 10.42.0.178 data= {"id":2661,"method":"get_arming","params":[]}
<- 10.42.0.214 data= {"result":["off"],"id":2661}
-> 10.42.0.178 data= {"id":2662,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":2662}
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":2663,"method":"get_arming","params":[]}
<- 10.42.0.214 data= {"result":["off"],"id":2663}
-> 10.42.0.178 data= {"id":2664,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":2664}
-> 10.42.0.178 data= {"id":65001,"method":"get_ipcprop","params":["video_state"]}
<- 10.42.0.214 data= {"result":["on"],"id":65001}
-> 10.42.0.178 data= {"id":65002,"method":"set_video","params":["off"]}
<- 10.42.0.214 data= {"result":["ok"],"id":65002}
-> 10.42.0.178 data= {"id":65003,"method":"set_video","params":["on"]}
<- 10.42.0.214 data= {"result":["ok"],"id":65003}
-> 10.42.0.178 data= {"id":2665,"method":"get_arming","params":[]}
<- 10.42.0.214 data= {"result":["off"],"id":2665}
-> 10.42.0.178 data= {"id":2666,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":2666}
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":2667,"method":"get_arming","params":[]}
<- 10.42.0.214 data= {"result":["off"],"id":2667}
-> 10.42.0.178 data= {"id":2668,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":2668}
-> 10.42.0.178 data= {"id":65004,"method":"get_ipcprop","params":["video_state"]}
<- 10.42.0.214 data= {"result":["on"],"id":65004}
-> 10.42.0.178 data= {"id":2669,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":2669}
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":2670,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":2670}
-> 10.42.0.178 data= {"id":2671,"method":"get_alarming_volume","params":[]}
<- 10.42.0.214 data= {"result":[90],"id":2671}
-> 10.42.0.178 data= {"id":2672,"method":"get_device_prop","params":["lumi.0","alarm_time_len"]}
<- 10.42.0.214 data= {"result":[30],"id":2672}
-> 10.42.0.178 data= {"id":2673,"method":"get_music_info","params":[0]}
<- 10.42.0.214 data= {"result":{"default":"0","total":10,"list":[{"index":0,"mid":"0","time":1},{"index":1,"mid":"1","time":1},{"index":2,"mid":"2","time":1},{"index":3,"mid":"3","time":1},{"index":4,"mid":"4","time":1},{"index":5,"mid":"5","time":1},{"index":6,"mid":"6","time":1},{"index":7,"mid":"7","time":1},{"index":8,"mid":"8","time":1},{"index":9,"mid":"9","time":1}]},"id":2673}
-> 10.42.0.178 data= {"id":2674,"method":"get_alarming_volume","params":[]}
<- 10.42.0.214 data= {"result":[90],"id":2674}
-> 10.42.0.178 data= {"id":2675,"method":"get_music_info","params":[0]}
<- 10.42.0.214 data= {"result":{"default":"0","total":10,"list":[{"index":0,"mid":"0","time":1},{"index":1,"mid":"1","time":1},{"index":2,"mid":"2","time":1},{"index":3,"mid":"3","time":1},{"index":4,"mid":"4","time":1},{"index":5,"mid":"5","time":1},{"index":6,"mid":"6","time":1},{"index":7,"mid":"7","time":1},{"index":8,"mid":"8","time":1},{"index":9,"mid":"9","time":1}]},"id":2675}
-> 10.42.0.178 data= {"id":2676,"method":"set_default_music","params":[0,"1"]}
<- 10.42.0.214 data= {"result":["ok"],"id":2676}
-> 10.42.0.178 data= {"id":2677,"method":"play_music_new","params":["1",90]}
<- 10.42.0.214 data= {"result":["ok"],"id":2677}
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":2678,"method":"set_sound_playing","params":["off"]}
<- 10.42.0.214 data= {"result":["ok"],"id":2678}
-> 10.42.0.178 data= {"id":2679,"method":"get_alarming_volume","params":[]}
<- 10.42.0.214 data= {"result":[90],"id":2679}
-> 10.42.0.178 data= {"id":2680,"method":"get_device_prop","params":["lumi.0","alarm_time_len"]}
<- 10.42.0.214 data= {"result":[30],"id":2680}
-> 10.42.0.178 data= {"id":2681,"method":"get_music_info","params":[0]}
<- 10.42.0.214 data= {"result":{"default":"1","total":10,"list":[{"index":0,"mid":"0","time":1},{"index":1,"mid":"1","time":1},{"index":2,"mid":"2","time":1},{"index":3,"mid":"3","time":1},{"index":4,"mid":"4","time":1},{"index":5,"mid":"5","time":1},{"index":6,"mid":"6","time":1},{"index":7,"mid":"7","time":1},{"index":8,"mid":"8","time":1},{"index":9,"mid":"9","time":1}]},"id":2681}
-> 10.42.0.178 data= {"id":2682,"method":"set_alarming_volume","params":[27]}
<- 10.42.0.214 data= {"result":["ok"],"id":2682}
-> 10.42.0.178 data= {"id":2683,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":2683}
-> 10.42.0.178 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A
-> 10.42.0.178 data= {"id":2684,"method":"get_arming","params":[]}
<- 10.42.0.214 data= {"result":["off"],"id":2684}
-> 10.42.0.178 data= {"id":2685,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":2685}
-> 10.42.0.178 data= {"id":2685,"method":"get_arm_wait_time","params":[]}
<- 10.42.0.214 data= {"result":[0],"id":2685}
-> 10.42.0.178 data= {"id":65005,"method":"get_ipcprop","params":["video_state"]}
<- 10.42.0.214 data= {"result":["on"],"id":65005}
-> 10.42.0.178 data= N/A
<- 10.42.0.214 data= N/A

And on the plugin of MiHome app I can find:

.field public static final LUMI_CAMERA_GET_FULLSTOP:Ljava/lang/String; = “get_fullstop”
.field public static final LUMI_CAMERA_GET_PROP:Ljava/lang/String; = “get_ipcprop”
.field public static final LUMI_CAMERA_GET_SD_FORMAT:Ljava/lang/String; = “sdformat”
.field public static final LUMI_CAMERA_GET_SD_STATUS:Ljava/lang/String; = “get_sdstatus”
.field public static final LUMI_CAMERA_SET_FLIP:Ljava/lang/String; = “set_flip”
.field public static final LUMI_CAMERA_SET_FULLSTOP:Ljava/lang/String; = “set_fullstop”
.field public static final LUMI_CAMERA_SET_IR:Ljava/lang/String; = “set_ir”
.field public static final LUMI_CAMERA_SET_LED:Ljava/lang/String; = “set_led”
.field public static final LUMI_CAMERA_SET_MD:Ljava/lang/String; = “set_md”
.field public static final LUMI_CAMERA_SET_VIDEO:Ljava/lang/String; = “set_video”

[rytilahti]

Ok, great. The API seems to be similar to that of the gateway device.

• How is the video data delivered when the video is on?
• The camera has a speaker, right? (those music parts)
• get_ipcprop with of variables to fetch (or all) seems to be the one reporting the states from all pieces.
• As set_video takes either "on" or "off" for toggling the state, I suppose those other setters will take the same format.
• sdformat will likely format the sd card.
• start_zigbee_join initializes the pairing, you can probably see the linked devices by sending get_device_prop with ['lumi.0', 'device_list'] as parameters, reading the values from those devices depend on what type of sensor the target is. (I seem to be tested something like this earlier on the gateway: self.send("get_prop_sensor_ht", ["battery", "voltage", "temperature", "humidity", "lqi"], extra_params={'sid': 'lumi.XXXXXXXX'}))

You could also try to see what kind of output you get when sending get_sdstatus and get_fullstop with raw_command to the device. I can wrap a preliminary implementation for testing, so any extra information you can extract and report back are appreciated.

[rytilahti]

I added a very preliminary support, there are open issues:

• How can we access the images from the camera?
• How to handle arming? How are the music parts used?
• What is MD? Motion detection?
• What is fullstop?
• How does the SD card functionality work?

[miguelangel-nubla]

Every method pasted here is self-descriptive and works as expected. All the changes are verified from the app or manually checking them.

• How is the video data delivered when the video is on?
  P2P system, h264 video over UDP. TUTK (now branded Kalay) 20 char P2P UID system.
  Reference implementation here https://github.com/TutkKalay/Kalay_Kit_Sample_App
  I am currently trying to make the client work, it is not a direct library drop-in replacement with uid, user and password change, xiaomi implementation differs somehow from the one on the samples. I am able to connect and validate credentials but the video feed returns 0 bytes frames... If anyone have experience with these systems and knows how to get the video working please report.

• The camera has a speaker, right? (those music parts)
  Yes, same functionality as a gateway, radio, alarm and 2 way audio communication from the video feed.
  2 way audio also over TUTK protocol.

• start_zigbee_join initializes the pairing, you can probably see the linked devices by sending get_device_prop with ['lumi.0', 'device_list'] as parameters, reading the values from those devices depend on what type of sensor the target is. (I seem to be tested something like this earlier on the gateway: self.send("get_prop_sensor_ht", ["battery", "voltage", "temperature", "humidity", "lqi"], extra_params={'sid': 'lumi.XXXXXXXX'}))

That is partially correct, this camera starts behaving different here.

$ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_device_prop "['lumi.0', 'device_list']"
Running command raw_command
Error: {'code': -5005, 'message': 'params error'}

So I currently don't know how to get the device list for the gateway part.
I don't know if it is even implemented, or directly speaks to xiaomi servers without a way to poll them directly via this API like the previous gateways.

• sdformat will likely format the sd card.
  How does the SD card functionality work?

Sure do, 1 on success beginning format.

$ miiocli device --ip 192.168.1.33 --token ######################## raw_command sdformat
Running command raw_command
1

Without sd card inserted:

$ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_sdstatus
Running command raw_command
0

SD card needs format:

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_sdstatus
Running command raw_command
2

While formatting SD card:

$ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_sdstatus
Running command raw_command
3

SD card ok, the app reports "good"

$ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_sdstatus
Running command raw_command
1

• How to handle arming? How are the music parts used?

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_arming
Running command raw_command
['off']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_arming '["on"]'
Running command raw_command
['ok']

Also have "arming" state

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_arming
Running command raw_command
['oning']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_arming
Running command raw_command
['on']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_arming '["off"]'
Running command raw_command
['ok']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_arming
Running command raw_command
['off']

Arm delay seconds

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_arm_wait_time
Running command raw_command
[0]
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_arm_wait_time '["5"]'
Running command raw_command
['ok']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_arm_wait_time
Running command raw_command
[5]

Volume is 0 to 100, but accepts and reports bigger values whithout problem (bug)

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_alarming_volume 100
Running command raw_command
['ok']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_alarming_volume 10
Running command raw_command
['ok']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_alarming_volume 30
Running command raw_command
['ok']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_alarming_volume 200
Running command raw_command
['ok']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_alarming_volume
Running command raw_command
[200]
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_alarming_volume 20
Running command raw_command
['ok']

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_music_info '[0]'
Running command raw_command
{'default': '1', 'total': 10, 'list': [{'index': 0, 'mid': '0', 'time': 1}, {'index': 1, 'mid': '1', 'time': 1}, {'index': 2, 'mid': '2', 'time': 1}, {'index': 3, 'mid': '3', 'time': 1}, {'index': 4, 'mid': '4', 'time': 1}, {'index': 5, 'mid': '5', 'time': 1}, {'index': 6, 'mid': '6', 'time': 1}, {'index': 7, 'mid': '7', 'time': 1}, {'index': 8, 'mid': '8', 'time': 1}, {'index': 9, 'mid': '9', 'time': 1}]}

Play the sound directly. First param is the mid value from one item of the previous list (sound ID), second volume at which to play it.

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command play_music_new '["1", 30]'
Running command raw_command
['ok']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command play_music_new '["3", 30]'
Running command raw_command
['ok']

The first param 0 seems to be the type of sound setting, for now only found id 0 wich is the alarm sound setting.
Returns a 'defaut' value wich is the sound id for the sound setting, in this case the alarm is set to sound ID 1.

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_music_info '[0]'
Running command raw_command
{'default': '1', 'total': 10, 'list': [{'index': 0, 'mid': '0', 'time': 1}, {'index': 1, 'mid': '1', 'time': 1}, {'index': 2, 'mid': '2', 'time': 1}, {'index': 3, 'mid': '3', 'time': 1}, {'index': 4, 'mid': '4', 'time': 1}, {'index': 5, 'mid': '5', 'time': 1}, {'index': 6, 'mid': '6', 'time': 1}, {'index': 7, 'mid': '7', 'time': 1}, {'index': 8, 'mid': '8', 'time': 1}, {'index': 9, 'mid': '9', 'time': 1}]}

Change alarm

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_default_music '[0, "3"]'
Running command raw_command
['ok']

Reports back

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_music_info '[0]'
Running command raw_command
{'default': '3', 'total': 10, 'list': [{'index': 0, 'mid': '0', 'time': 1}, {'index': 1, 'mid': '1', 'time': 1}, {'index': 2, 'mid': '2', 'time': 1}, {'index': 3, 'mid': '3', 'time': 1}, {'index': 4, 'mid': '4', 'time': 1}, {'index': 5, 'mid': '5', 'time': 1}, {'index': 6, 'mid': '6', 'time': 1}, {'index': 7, 'mid': '7', 'time': 1}, {'index': 8, 'mid': '8', 'time': 1}, {'index': 9, 'mid': '9', 'time': 1}]}

• What is MD? Motion detection?
  Yes, motion detection

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_md
Running command raw_command
{'return': 0, 'md_status': 1, 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_md 0
Running command raw_command
{'return': 0, 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_md
Running command raw_command
{'return': 0, 'md_status': 0, 'id': 1}

Sensitivity set from the app allows high (6000000), medium(10000000), low(11000000), but can set any value. Don't know the unit.

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_mdsensitivity
Running command raw_command
['6000000']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_mdsensitivity
Running command raw_command
['10000000']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_mdsensitivity
Running command raw_command
['11000000']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_mdsensitivity 362346
Running command raw_command
['ok']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_mdsensitivity
Running command raw_command
['362346']

• What is fullstop?
  With values bigger than 0 motion detection alarm does not trigger. Video feed and rest of features seems to work. I guess it is stop alarming for the video?
  Behaviour is strange

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_fullstop '["off"]'
Running command raw_command
{'return': 0, 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_ipcprop '["all"]'
Running command raw_command
{'p2p_id': '####################', 'app_type': 'celing', 'offset_x': '0', 'offset_y': '0', 'offset_radius': '0', 'md_status': 0, 'video_state': 1, 'fullstop': 1103125395, 'led_status': 0, 'ir_status': 1, 'mdsensitivity': 63454, 'channel_id': 0, 'flip_state': 0, 'avID': '#########', 'avPass': '#########', 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_fullstop '["on"]'
Running command raw_command
{'return': 0, 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_ipcprop '["all"]'
Running command raw_command
{'p2p_id': '####################', 'app_type': 'celing', 'offset_x': '0', 'offset_y': '0', 'offset_radius': '0', 'md_status': 0, 'video_state': 1, 'fullstop': 1101048787, 'led_status': 0, 'ir_status': 1, 'mdsensitivity': 63454, 'channel_id': 0, 'flip_state': 0, 'avID': '#########', 'avPass': '#########', 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_fullstop '[0]'
Running command raw_command
{'return': 0, 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_ipcprop '["all"]'
Running command raw_command
{'p2p_id': '####################', 'app_type': 'celing', 'offset_x': '0', 'offset_y': '0', 'offset_radius': '0', 'md_status': 0, 'video_state': 1, 'fullstop': 0, 'led_status': 0, 'ir_status': 1, 'mdsensitivity': 63454, 'channel_id': 0, 'flip_state': 0, 'avID': '#########', 'avPass': '#########', 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_fullstop '[65]'
Running command raw_command
{'return': 0, 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_ipcprop '["all"]'
Running command raw_command
{'p2p_id': '####################', 'app_type': 'celing', 'offset_x': '0', 'offset_y': '0', 'offset_radius': '0', 'md_status': 0, 'video_state': 1, 'fullstop': 65, 'led_status': 0, 'ir_status': 1, 'mdsensitivity': 63454, 'channel_id': 0, 'flip_state': 0, 'avID': '#########', 'avPass': '#########', 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_fullstop '["on"]'
Running command raw_command
{'return': 0, 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_ipcprop '["all"]'
Running command raw_command
{'p2p_id': '####################', 'app_type': 'celing', 'offset_x': '0', 'offset_y': '0', 'offset_radius': '0', 'md_status': 0, 'video_state': 1, 'fullstop': 1100460382, 'led_status': 0, 'ir_status': 1, 'mdsensitivity': 63454, 'channel_id': 0, 'flip_state': 0, 'avID': '#########', 'avPass': '#########', 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_fullstop '["on"]'
Running command raw_command
{'return': 0, 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_ipcprop '["all"]'
Running command raw_command
{'p2p_id': '####################', 'app_type': 'celing', 'offset_x': '0', 'offset_y': '0', 'offset_radius': '0', 'md_status': 0, 'video_state': 1, 'fullstop': 1103029089, 'led_status': 0, 'ir_status': 1, 'mdsensitivity': 63454, 'channel_id': 0, 'flip_state': 0, 'avID': '#########', 'avPass': '#########', 'id': 1}

set_video toogles sleep mode
Turns off the video completelly. No video feed or motion alarm. Even infrared night light is disabled.

user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_ipcprop '["all"]'
Running command raw_command
{'p2p_id': '####################', 'app_type': 'celing', 'offset_x': '0', 'offset_y': '0', 'offset_radius': '0', 'md_status': 0, 'video_state': 1, 'fullstop': 1103029089, 'led_status': 0, 'ir_status': 1, 'mdsensitivity': 63454, 'channel_id': 0, 'flip_state': 0, 'avID': '#########', 'avPass': '#########', 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_video '["off"]'
Running command raw_command
['ok']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_ipcprop '["all"]'
Running command raw_command
{'p2p_id': '####################', 'app_type': 'celing', 'offset_x': '0', 'offset_y': '0', 'offset_radius': '0', 'md_status': 0, 'video_state': 0, 'fullstop': 1103029089, 'led_status': 0, 'ir_status': 1, 'mdsensitivity': 63454, 'channel_id': 0, 'flip_state': 0, 'avID': '#########', 'avPass': '#########', 'id': 1}
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command set_video '["on"]'
Running command raw_command
['ok']
user@LAPTOP: $ miiocli device --ip 192.168.1.33 --token ######################## raw_command get_ipcprop '["all"]'
Running command raw_command
{'p2p_id': '####################', 'app_type': 'celing', 'offset_x': '0', 'offset_y': '0', 'offset_radius': '0', 'md_status': 0, 'video_state': 1, 'fullstop': 1103029089, 'led_status': 0, 'ir_status': 1, 'mdsensitivity': 63454, 'channel_id': 0, 'flip_state': 0, 'avID': '#########', 'avPass': '#########', 'id': 1}

[rytilahti]

Thanks for a comprehensive feedback, I updated the PR based on that information. I think the main thing missing now is to figure out how the video&audio can be accessed. If you don't mind testing the PR, it would be helpful (please comment your findings in the PR, so it is easier to correct them).

[sendorm]

There is a solution to video playback here:
https://github.com/miguelangel-nubla/videoP2Proxy

[humpedli]

@sendorm Great! Thank you, I just tried out the linked solution and it worked. I made a docker container for the script if anyone would like to run it in docker: https://github.com/humpedli/docker-xiaomi-aqara-rtsp

[dgiese]

I need to communicate better, see slide 33-38 here:
http://dgiese.scripts.mit.edu/talks/DEFCON26/DEFCON26-Having_fun_with_IoT-Xiaomi.html
If you have installed the firmware update, I will have some news on Twitter soon. In addition to that I will push a commit to the dustcloud-documentation repo in the next days. It will also contain the exact rooting methods.

[sendorm]

@miguelangel-nubla's great work ceased to work after lumi.camera.aq1 3.3.7_248.0143 firmware update.

[penolove]

sorry to bother, curious about the speaker mentioned above

The camera has a speaker, right? (those music parts)
Yes, same functionality as a gateway, radio, alarm and 2 way audio communication from the video feed.
2 way audio also over TUTK protocol.

is it possible to make the camera play a prepared mp3 via a function call?