Jan 4 2004

Deconstructing the Veo Observer Net Camera

I still want my daughter to appear on a network camera and I’m not giving up that easily (see Big Brother watching over little sister). The D-Link DCS-1000W has been replaced by a Veo Observer Wireless Network Camera. The camera quality is a lot better, but the software works on Windows only 🙁

The Veo Observer camera is controlled from within your browser using an Active-X control. No Unix solution. No Mac solution. Only one person at a time can access the camera. Those are some serious drawbacks and I believe that those limitations are “artificially manufactured” into the camera.

I need a solution that sits on a Unix system and grabs a frame at fixed time intervals. My software will then check whether it’s worth keeping the frame. The D-Link did that just fine and I’m determined to make that work with the Veo Observer as well.

Step 1 was to contact Veo’s manufacturers via a number of different channels. No matter where I sent my emails to, they were left unanswered. After trying to get some sort of contact for three times, I decided that this was not the correct route to solve my problem. Shame on Veo for not even responding with a simple “Sorry – we are too busy …”.

Step 2 was to download the camera SDK from the Veo Observer SDK page. This SDK (again) is only available for Windows. I used it to create a minimal C-program that would connect to the camera, setup 640×480 resolution, grab a frame, save it to a JPEG file and exit. As there was only one camera on the network, I decided to hard-code IP address, port, username and password in the program (you have got to change the defines at the top of the code). If you’re planning to use the SDK, be prepared that there are some serious differences between the documentation and the way that the SDK actually works (somebody at Veo may want to clean this up …)

Here is the code using the Veo Observer Windows C++ SDK. After compiling the software and linking it with the SDK-libraries/DLLs, you end up with a program that sends a snapshot at 640×480 to a filename specified on the program command line.

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

#include “xrlknc.h”

#define VEO_NETNAME  “192.168.1.1”
#define VEO_PORT     1600
#define VEO_USER     “username”
#define VEO_PASSWORD “password”

int main(int argc, char *argv[])
{
  PNET_CAM       veo;
  PCAM_FORMAT    fList;
  ULONG          fCount;
  CAM_STREAM_DEF fCurrent;
  CAMERR         err;
  CAM_SNAPSHOT_PARMS snapParams;
  CAM_STREAMING_PARMS streamParms;

  if(argc != 2) {
    printf(“Usage: %s <snapshot-filename>\n”,argv[0]);
    exit(1);
  }

  err = CamLogon(VEO_NETNAME, VEO_PORT, VEO_USER, VEO_PASSWORD, GetDesktopWindow(), WM_APP, &veo);
  if(err != CAMERR_OKAY) {
    printf(“Unable to logon to camera – error code %d\n”,err);
    exit(1);
  }

  fCurrent.Format=2;
  fCurrent.TimePerFrame=1000000;
  err = CamSetStreamDef(veo,&fCurrent);
  if(err != CAMERR_OKAY) {
    printf(“Unable to set stream def – error code %d\n”,err);
  }

  streamParms.VideoRect.top=0;
  streamParms.VideoRect.left=0;
  streamParms.VideoRect.right=640;
  streamParms.VideoRect.bottom=480;
  streamParms.Flags=0;
  streamParms.StreamId=fCurrent.StreamId;
  err=CamStart(veo, &streamParms);
  if(err != CAMERR_OKAY) {
    printf(“Unable to start streaming – error code %d\n”,err);
  }

  snapParams.pBufferDef=NULL;
  snapParams.FileName=argv[1];
  snapParams.Format=CAM_SNAPSHOT_FORMAT_JPEG;
  err = CamSnapshot(veo,&snapParams);
  if(err != CAMERR_OKAY) {
    printf(“Unable to take snapshot – error code %d\n”,err);
  }

  CamStop(veo);
  CamLogoff(veo);
  return 0;
}

Nice – now I have a similar situation as before, but I’m hating the fact that the frames are grabbed from the Windows system and are transported to the Unix server via Samba. I need a Unix-only solution.

Step 3 was to switch on tcpdump (http://www.tcpdump.org/) and analyze the network traffic between the Active-X Control and the Veo Observer Camera. After looking at tons of packet traces, I created a perl-module that allowed me to communicate with the camera: And this works on Windows, Unix and the Mac.

A typical mini-application to connect to the camera would look like this below. This connects to the camera (using the default username/password), sets light and brightness levels, selects 640×480 resolution and grabs 20 frames from the camera:

use strict;
use Veo;

my $veo=Veo->new(host => ‘192.168.1.1’, port => 1600);
$veo->login();
my($name,$loc)=$veo->info();
print “Name: $name\nLocation: $loc\n”;
print “Light: “,$veo->light(),”\n”;
$veo->light(Veo::VEO_LIGHT_NORMAL);
print “Light: “,$veo->light(),”\n”;
print “Brightness: “,$veo->brightness(),”\n”;
$veo->brightness(Veo::VEO_BRIGHT_NORMAL);
print “Brightness: “,$veo->brightness(),”\n”;
$veo->selectStream(Veo::VEO_STREAM_640X480,5);
$veo->stream(\&cb);
$veo->reset();

my($images)=0;
sub cb {
    my($data)=@_;
    print STDERR qq{stream callback with },length($data),qq{ bytes of data\n};
    open(OUT,”>”.sprintf(“veo%02d.out”,$images++));
    binmode(OUT);
    print OUT $data;
    close(OUT);
    return $images>=20?0:1;
}

Please keep in mind that this was all done without any information from Veo: All I did, was decoding the packet stream between the Active-X control and the camera.

The last hurdle in this puzzle is the image format that the camera dumps. What arrives in the callback is not in a standard format. Veo (with it’s Xirlink history) decided to encode the frames in a (proprietary) format called XJPG and I have not been able to find information about the make-up of XJPG files.
All I can tell is that those are YUV encoded frames that arrive from the camera; it’s not a differential format with key-frames, because the size of the data for each frame is very similar.

I decoded an entirely black frame with this:

0000000 0000 0000 1f03 73c6 ff00 ffff e3ff e001
0000010 8002 baf0 a228 288a 8aa2 a228 288a 8aa2
0000020 a228 288a 8aa2 a228 288a 8aa2 a228 288a
0000030 8aa2 a228 288a 8aa2 a228 288a 8aa2 a228
0000040 288a 8aa2 a228 288a 8aa2 a228 288a 8aa2
0000050 a228 288a 8aa2 a228 288a 8aa2 a228 288a

0001bf0 8aa2 a228 288a 8aa2 a228 288a 8aa2 a228
0001c00 288a 8aa2 a228 288a 8aa2 a228 288a 8aa2
0001c10 a228 288a 8aa2 a228 288a 8aa2 a228 288a
0001c20 8aa2 a228 288a 8aa2 a228 288a 8aa2 a228
0001c30 288a bfa2 d9ff

The “d9 ff” at the end looks a lot like a JPEG marker, but this is as much JPEG as I can see in the dump.

An entirely white frame (or close to white) looks a lot different:

0000000 0000 0000 091f ee47 ff00 ffff e3ff e001
0000010 8002 ddf4 98a1 4e1e 543b a3ea 3a1d 3474
0000020 ada7 9c02 6354 fd38 c129 5f01 6a4f 294a
0000030 42c1 3080 2a3f 4071 033a 71f9 1445 0ebc
0000040 184d b6e7 a04f 8aa2 0770 38d3 29fd f74a
0000050 ebef 1445 7360 4e81 c00b 0638 298a 0cc0

0003990 9ce9 ce51 513b 2145 40ce 1439 e799 e49c
00039a0 4551 f721 6734 1f03 8aca 0929 e93d 0032
00039b0 62e0 6294 9a92 3d39 fa08 3152 e23f 2829
00039c0 d234 324e 2946 b2a5 0639 4c8a 74d2 53fa
00039d0 fc49 69a9 4633 b47e ceab 8a73 5a5a d9ff

So, if the two dumps above look familiar to anybody (especially the 28a sequences in the black dump) or if you happen to know about the XJPG format, I’d be happy to hear from you using: tobias -at- kahunaburger.com

Otherwise, expect to hear back from me in while when I had the time to dig deeper into the Veo frames and find out how to decode the data.

Update 2/22/2004: Please take a look at the updated entry at Binary for Veo Observer Snapshot tool.

Update 8/12/2004: Finally I have a module that allows capturing the images from the Veo Observer Network Camera on any platform. See this entry.

58 Responses to “Deconstructing the Veo Observer Net Camera”

  • Bashy Says:

    Hi m8, yes i do, email me at simon_smitt@ntlworld.com

  • AndyG Says:

    Hello…it seems that the VEO website is not online anymore…

    I thought that I could find an update for the drivers etc etc, but now even the older one aren’t available anymore !!!

    Anyone knows the new website name ( if any) ??

    Ciao

    Andrea

  • Juan Says:

    Hi, i loss my cd with software Evo Wireless camera, and de website is offline. ¿?¿?

    I have same question like Andrea…

    Anyone knows the new website name ( if any) ??

    thanks and regards…

  • Malinim Says:

    Does anyone have the applets for the java motion portion of the Veo Observer XT. I cannot get the motion Jpeg to display and I believe its because the camera has not downloaded the Applets to my PC. I have the Java runtime, VM, and the Java media framework installed that came with the original CD, but I still get no motion pictures diplayed. The still picture displays works fine.

  • florin Says:

    heloo . ..have a veo observer wireless and i make a mistake …i write over her original software a newer version but the version from the ethernet version ….now i cannot make connection anymore with the camera to write back the corect software ….the wireless version …..

    what can i do ?
    pls help ….i don’t find any schematic ..nothing …

    thank you !
    my yahoo id : florins36
    email : florins36@yahoo.com

  • joslink Says:

    Hello, when I try myself to connect to my camera using the program me a error appears ” Unable to logon to camera – error code 18 “, that means this error?

  • Dan Says:

    Found your site, Great! The binary works, can I get a copy of xrlknc.h? And is there one for xrlkncd.dll?

    Thanks!

Leave a Reply