From 8a411d93daea6a886fcfdacffefc277b98cd536d Mon Sep 17 00:00:00 2001
From: Bjørn Mork <bjorn@mork.no>
Date: Sat, 11 May 2019 15:13:56 +0200
Subject: WiP: working auth, reading ip config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

getting IPCam service
dumping [<bluepy.btle.Characteristic object at 0x7fae2f8fccf8>, <bluepy.btle.Characteristic object at 0x7fae2f8fc940>, <bluepy.btle.Characteristic object at 0x7fae2f8fc898>, <bluepy.btle.Characteristic object at 0x7fae2f8fc748>, <bluepy.btle.Characteristic object at 0x7fae2f8fc5f8>, <bluepy.btle.Characteristic object at 0x7fae2f8fc8d0>, <bluepy.btle.Characteristic object at 0x7fae2f8fccc0>, <bluepy.btle.Characteristic object at 0x7fae2f8fcda0>, <bluepy.btle.Characteristic object at 0x7fae2f8fce48>, <bluepy.btle.Characteristic object at 0x7fae2f8fcef0>, <bluepy.btle.Characteristic object at 0x7fae2f8fcf98>, <bluepy.btle.Characteristic object at 0x7fae2f8a3080>, <bluepy.btle.Characteristic object at 0x7fae2f8a3128>, <bluepy.btle.Characteristic object at 0x7fae2f8a31d0>]
0000a000-0000-1000-8000-00805f9b34fb - Properties=READ NOTIFY  Handle=0x0013
0000a001-0000-1000-8000-00805f9b34fb - Properties=READ WRITE  Handle=0x0016
0000a100-0000-1000-8000-00805f9b34fb - Properties=READ  Handle=0x0018
0000a101-0000-1000-8000-00805f9b34fb - Properties=READ WRITE  Handle=0x001a
0000a102-0000-1000-8000-00805f9b34fb - Properties=WRITE  Handle=0x001c
0000a103-0000-1000-8000-00805f9b34fb - Properties=READ  Handle=0x001e
0000a104-0000-1000-8000-00805f9b34fb - Properties=READ  Handle=0x0020
0000a200-0000-1000-8000-00805f9b34fb - Properties=READ WRITE  Handle=0x0022
0000a201-0000-1000-8000-00805f9b34fb - Properties=WRITE  Handle=0x0024
0000a300-0000-1000-8000-00805f9b34fb - Properties=READ WRITE  Handle=0x0026
0000a301-0000-1000-8000-00805f9b34fb - Properties=READ  Handle=0x0028
0000a302-0000-1000-8000-00805f9b34fb - Properties=WRITE  Handle=0x002a
0000a303-0000-1000-8000-00805f9b34fb - Properties=WRITE  Handle=0x002c
0000a304-0000-1000-8000-00805f9b34fb - Properties=READ  Handle=0x002e
challenge is 4xfzqymahdkkjm9g
key is b'OD2I3x8HFbFctROU'
ip config is b'I=192.168.2.37;N=255.255.255.0;G=192.168.2.1;D=148.122.16.253'
Done.
b
Signed-off-by: Bjørn Mork <bjorn@mork.no>
---
 dcs8000lh-configure.py | 42 ++++++++++++++++++++++++++++--------------
 1 file changed, 28 insertions(+), 14 deletions(-)

diff --git a/dcs8000lh-configure.py b/dcs8000lh-configure.py
index 35fa476..fa057ec 100755
--- a/dcs8000lh-configure.py
+++ b/dcs8000lh-configure.py
@@ -1,26 +1,25 @@
 #!/usr/bin/python3
 
 import sys
+import hashlib
+import base64
 from bluepy.btle import Peripheral
 
 class BleCam(object):
-    def __init__(self, address):
-        try:
-            self.periph = Peripheral(address)
-        except BTLEDisconnectError:
-            print("failed to connect to <addr>".format(address))
-            return
+    def __init__(self, address, pincode):
+        self.pincode = pincode
+        self.periph = Peripheral(address)
         self.ipcamservice()
         self.dumpchars()
         self.experiment()
 
     def ipcamservice(self):
         try:
-            print("getting service")
+            print("getting IPCam service")
             self.service = self.periph.getServiceByUUID(0xD001)
         except BTLEEException:
-            print("no such service")
-            return
+            print("no IPCam service found for %s" % periph.address)
+
 
     def dumpchars(self):
         handles = self.service.getCharacteristics()
@@ -29,12 +28,27 @@ class BleCam(object):
             print("%s - Properties=%s Handle=%#06x " % (h.uuid, h.propertiesToString(), h.getHandle()))
 
     def experiment(self):
-        print("read %s" % self.service.getCharacteristics(0xa001)[0].read().decode())
-            
+        auth = self.service.getCharacteristics(0xa001)[0]
+        tmp = auth.read().decode().split(";", 10)
+        for t in tmp:
+            if t.startswith("C="):
+                self.challenge=t.split("=",2)[1]
+        print("challenge is %s" % self.challenge)
+        name = "DCS-8000LH-CC73"
+        hashit = name + self.pincode + self.challenge
+        self.key = base64.b64encode(hashlib.md5(hashit.encode()).digest())[:16]
+        print ("key is %s" % self.key)
+        try:
+            auth.write("M=0;K=".encode() + self.key, True)
+        except:
+            print("write failed")
+        print("ip config is %s" % self.service.getCharacteristics(0xa104)[0].read())
+
+        
 if __name__ == '__main__':
-    if len(sys.argv) < 2:
-        print("Usage: {} <addr>".format(sys.argv[0]))
+    if len(sys.argv) < 3:
+        print("Usage: {} <addr> <pincode>".format(sys.argv[0]))
         sys.exit(1)
 
-    BleCam(sys.argv[1])
+    BleCam(sys.argv[1], sys.argv[2])
 print("Done.")
-- 
cgit v1.2.3