tv-ip422w pan/tilt webcam remote control

lazardo · 06-07-2011, 11:35 PM

Security update for Trendnet and similar webcams:
http://seclists.org/bugtraq/2011/Jun/63

Not linux hardware in the traditional sense, but here's a control script for a pan/tilt webcam that covers basic up/down/left/right/preset/speed functions. Probably applies to other Trendnet and Airlink pan/tilt models.

The IP422W is a 330x110 degree pan/tilt wireless GPIO webcam with built in server. Comes with the usual java interface and windows software for basic programmed functions. Thanks to the net and 'Setarcos' postings in 2007, I was able to put the following together.

Unfortunately the camera had a short life since it's infrared lens was ill suited to reflections, glass, accurate color, low light focus, image quality, etc.

Cheers,

Code:

#!/bin/bash
# webcam - em.lazardo@gmail.com - 2011
# 
# primarily an adaptation of commands discovered by 'Setarcos'
# for the Airlink101 SkyIPCam 747W, circa 2007


HOST=webcam2		# LAN = hostname, WAN = router_IP:port
CMD="curl --silent --user admin:password"

##############################################################

_help () {
		echo "
linux cli for TV-IP422w

udlr [degrees]	move camera up/down/left/right [1..20]
p value		move to preset 1..8
s [seconds]	scan all presets, with delay [1..999]

L		list presets
P value name	set current position as preset 1..8, with name
S value		set speed, slow or fast (medium is available but noisy)

sesame		enter busybox via telnet

"
		exit
}

_stat () {
	# input: error status
	# s/b useful, never implemented
	[ $1 -ne 0 ] && echo "err:$1" >> /dev/stderr
}

_move () {
	# input: direction
	$CMD http://${HOST}/admin/ptctl.cgi\?move=$1 > /dev/null
	_stat $?
}

_set_step () {
	# input: type, value
	[ "$arg" == "" ] && return

	[ $arg -gt 20 ] && arg=20
	case $1 in
		l|r)	$CMD \
			http://${HOST}/admin/pantilt.cgi\?p_step=$arg > /dev/null; _stat $?
			;;
		u|d)	$CMD \
			http://${HOST}/admin/pantilt.cgi\?t_step=$arg > /dev/null; _stat $?
			;;
	esac
}

_list () {
	$CMD \
	http://${HOST}/cgi/admin/param.cgi\?action=list\&group=PanTilt |\
	egrep 'Step|Position'
}


cmd="$1"; arg="$2"; name="$3"


# no they can't be combined
case "$cmd" in
	h|-h|--help|"")	_help ;;
	l|r|u|d)	_set_step $cmd $arg ;;
esac

case "$cmd" in
	u)	_move up ;;
	d)	_move down ;;
	l)	_move left ;;
	r)	_move right ;;

	p)	((arg--)); [[ $arg -lt 0  || $arg -gt 7 ]] && _help
		_move p${arg}
		;;

	s)	case "$arg" in
			pscan|stop|reset) ;;	# 360 pan, INT, calibrate (undocumented in help)

			"")	arg=patrol ;;

			*)	[[ $arg -lt 3  || $arg -gt 900 ]] && _help
				$CMD \
				http://${HOST}/admin/pantilt.cgi\?staytime=$arg > /dev/null
				arg=patrol
				;;
		esac
		$CMD \
		http://${HOST}/admin/ptctl.cgi\?move=$arg > /dev/null
		;;

	P)	[[ $arg -lt 1  || $arg -gt 8 ]] && _help

		_list | egrep Position${arg}
		read -p "Replace current preset? [y/n] " answer
		[ "$answer" != "y" ] && exit
		((arg--))

		$CMD \
	       	http://${HOST}/admin/ptctl.cgi\?position=$arg\&positionname=$name > /dev/null
		_stat $?
		;;

	L)	_list ;;

	S)	case "$arg" in
			s*)	arg=0 ;;
			m*)	arg=1 ;;
			f*)	arg=2 ;;
			*)	_help ;;
		esac

		for type in p p_scan; do	# pan, pan-scan (tilt s/b always slow)
			echo -n "$type "
			$CMD \
			http://${HOST}/admin/pantilt.cgi\?${type}_speed=$arg > /dev/null
		done
		echo ""
		;;

	sesame)	$CMD \	
		http://${HOST}/cgi/maker/tools.cgi?telnet=1
		telnet ${HOST} 15566
		$CMD \	
		http://${HOST}/cgi/maker/tools.cgi?telnet=0

	*)	_help ;;
esac

######################################################
#
# these are unimplemented
#
#PTZ control by degrees (used for mapped movement):
#Directions (up,down,left,right)
#Mapped movement on a 640x480 image
#Up/Down max = 8 degrees
#Left/Right max = 30 degrees
#Example: Move right by 18 degrees
#<http://webcam2/cgi/admin/ptctrl.cgi\?action=movedegree&Cmd=right&Degree=18>
#
#Example: Move down by 2 degrees
#<http://webcam2/cgi/admin/ptctrl.cgi\?action=movedegree&Cmd=down&Degree=2>
#
#Trigger GPIO output (1=enable, 0=disable, default -1 (no change))
#http://webcam2/admin/trigger.cgi\?alarm=<value>
#
#Night mode (1=enable, 0=disable, default -1 (no change))
#http://webcam2/admin/trigger.cgi\?night=<value>
#
#Audio input/output in PCM format (Note: Input is HTTP GET, output is HTTP POST)
#http://webcam2/cgi/audio/audio.cgi\?type=PCM