Help with playback files download

[DenisMartin0]

Hi,

I know that it's not the main purpose of neolink, but is anyone able to decode the xml parameters to download "PlaybackFiles" request/response ?
Based on provided Wireshark plugin, it seems that the Windows client use type 13 and then type 8 to download a Playback file.
Unfortunately the plugin didn't decode the parameters, or I'm not doing it the right way... :

NB: I'm connected to a NVR, not a camera.

[QuantumEntangledAndy]

I believe the binary data is in the same format as the streams that we decode. It is discussed here in the project dissector/mediapacket.md. I think there are a few programs that can decide the data once saved to disk but I've never seen it decoded from the packets.

If your looking to write a program or extend neolink to decode them then you can find the bulk of the decoding here src/bc_protocol/media_packet.rs and here src/bc_protocol.rs.

[QuantumEntangledAndy]

For reference here is a working decoder:

use log::*;
use env_logger::Env;
use openssl::symm::*;
use md5::{Md5, Digest};

const NONCE: &'static str = "EFC616738D65B1D0";
const PWD: &'static str = "testPass";
const IV: &'static [u8] = b"0123456789abcdef";
const CIPHERTEXT: &'static str = "x2n/hpPivHqK8s3DIv+5kF2mj/+krYGpvTkSmspBfbdQRikDABCi+2sYSRnVJM7bxi6jquqRR2hNPhscATMtaB4KozAWAB4tqmAan/2/LnR7uiBhOdx1ScrMZPfi7vlzXZnWuPU3Za+gR8liJVVRc8JQ6PlROHBRjyQ6i+HN+FLFWCchai9edOxllyHxznlfWUVP1iKrSx6U26U7zycI/wXgyyxXGpsk/v90uWfYVmSCdHJNPKSrLZnbutYCOPmNnjc4X2gAZJRZLYhPW/Wv+GS3eeV2C/KbcWXFXWUUVYGjuh01QPUGuOZHm5Jljhu/bX9M5gYdKc1H34XxY6cILOsTOvi481Zayo5k4euI8fsWH0czDGytmtYDRN06Z9visb28dXzYAjJkPicSCJjNp/hp7Zg1uyN/McLuvx/kljUIvP24l4/4XT+kRR98H8ipdirP+GiE49g0Ko73xkajQvvb1nMsOhxLpw1MQOq3K5AsQaY1T0Fodf2Eves2o2LW6GlvSuM3vf7DK9JRWI3bindjDKhwK1Pn2tRK4uUZ0vybm6aMAE1fufhLy0054+E5XSKDnIBJp+of6s9zBcgCUClznRaNuPZ1muGMIi5j3bldU7iDQS45f8SxdDu0EcBXBZ17n8lPFSn0K4DSwHxauAUS";
const HEADER_SIZE: usize = 0;
const TAIL_SIZE: usize = 0;

fn main() {
    env_logger::Builder::from_env(Env::default().default_filter_or("info")).init();
    
    let decoded = base64::decode(&CIPHERTEXT).unwrap();
    let ciphertext = &decoded[HEADER_SIZE..(decoded.len()-TAIL_SIZE)];
    
    let key_phrase = format!("{}-{}", NONCE, PWD);
    let key_phrase_hash = md5_string(&key_phrase, Md5Trunc::ZeroLast).to_uppercase().into_bytes();
    
    let key = &key_phrase_hash[0..16];
    let iv = &IV[0..16];
    
    info!("KEY: {:x?}, len: {}", key, key.len());
    info!(" IV: {:x?}, len: {}", iv, iv.len());
    info!("ciphertext: {:x?}, len: {}", ciphertext, ciphertext.len());

    let t = Cipher::aes_128_cfb128();
    let result = decrypt(t, key, Some(iv), &ciphertext).unwrap();
    
    info!("Bytes: {:x?}, len: {}", result, result.len());
    info!("UTF8: {:?}", unsafe{std::str::from_utf8_unchecked(&result)});
}
#[derive(PartialEq, Eq)]
enum Md5Trunc {
    ZeroLast,
    Truncate,
}

fn md5_string(input: &str, trunc: Md5Trunc) -> String {
    let mut md5 = format!("{:X}\0", Md5::digest(input.as_bytes()));
    md5.replace_range(31.., if trunc == Md5Trunc::Truncate { "" } else { "\0" });
    md5
}

[QuantumEntangledAndy]

Ok I have a working PR here #83. Its an update of my Protocol update. So it includes the new BC models that we worked out earlier and it knows about message ids and status codes. Please let me know what you think

[QuantumEntangledAndy]

If we merge this PR I hope to get HD and SD streams from a single login using message ids

[thirtythreeforty]

Nice you beat me to it. I'll comment there.

[QuantumEntangledAndy]

I had 90% done already because I was working on an unencrypted protocol update (@twistedddx requested it ages ago for his camera) which needed a switch in the same places this needed a switch.