Unrar – Delete archive(s) after extraction

Due to lack of disk space on a server I needed a mechanism for automatically deleting RAR archives after their contents had been extracted. I couldn’t find any particularly neat way to do this with a shell script so I knocked up the following quick & dirty patch for unrar.

The patch applies cleanly to version 5.1.6 of the unrar source as follows:

wget 'http://www.rarlab.com/rar/unrarsrc-5.1.6.tar.gz'
tar -xvzf unrarsrc-5.1.6.tar.gz
cd unrar
wget 'http://simon.aldrich.eu/download/unrar/unrar-deleteOnExtract.patch'
patch -p1 < unrar-deleteOnExtract.patch
make

The compiled unrar binary will have the following extra option:

de  Delete archive(s) after extracting

Which you can use with the -e or -x commands e.g.:

unrar x -de test.part01.rar

Hopefully this might be useful to someone other than just me. Although, obviously, if extraction fails for any reason you will have deleted all the earlier volumes in the archive set. My suggestion would be to use the -t command to test your archive(s) first. I take no responsibility for any screw-ups you may cause yourself if you use this patch – caveat emptor!

Hacking the Motorola Blink 1 Baby Monitor (Part 2)

Ok, so it’s been quite some time since I posted my first efforts at “hacking” the Motorola Blink 1 Baby Monitor. Suffice to say we’ve been quite busy for a while & I’ve only just gotten around to actually plugging it in again now that our son is with us & at an age where we’re starting to think about being able to put him down in his crib & go into another room.

Anyway, I powered it on for the first time since August today and it asked to perform a firmware upgrade. I though ‘Aha! I’ll capture what it’s up to and see if I can work out where it downloads new firmware from’ but I inadvertently messed-up my tcpdump session & didn’t actually capture anything while it was upgrading. Furthermore, as I should have known from reading the comments here it seems that Motorola have disabled the landing page for the onboard web-server in the new firmware version (08-050) and it now just gives you a 404.

Well obviously this couldn’t be allowed to stand. Suffice to say if you capture all network traffic from the Blink when it powers on you’ll see it makes some web requests to a Monitor Everywhere ‘OTA’ server. It seems this is how it determines if there’s a firmware upgrade to be downloaded & with a bit of jiggery-pokery you too can download bmfwromfs_08_050.tar.gz which contains the latest firmware.

Unpacking the gzip’d tarball you’ll see there is a binary file ‘conprog.bin’ which I’m pretty sure is the kernel image  (2.6.17.14 since you ask) and a file ‘rootfs.bin’ which is a romfs image file containing the root file system for the camera.

You can mount this under Linux using the command:

mount -t romfs -o loop <path to rootfs.bin> <mount-point>

I’ve only just got this going tonight so I’ve yet to have a real poke around in there but for everyone who’s looking for the web interface point your brower at:

http://<camera-ip>/blinkhome.html

– or –

http://<camera-ip>/index2.html

to get it back. Incidentally the pages aren’t quite the same, so worth looking at both!

 

Hacking the Motorola Blink 1 Baby Monitor (Part 1)

As I mentioned before I’ve recently acquired a Motorola Blink 1 Wi-Fi baby monitor. My plan was to reverse engineer some of its functions in order to integrate it with our existing home automation. My findings to date indicate that it should be fairly easy to interface with the monitor without using the Monitor Everywhere App.

The first step was just to point a web browser at the camera’s IP address which paid off by giving me the following (with no authentication incidentally – be careful if you might be putting one of these on a publicly accessible IP):

Motorola Blink 1 Web InterfaceYou get a web interface with Javascript based video streaming & control Pan & Tilt as well as a reading of the current temperature & controls for contrast, brightness & image resolution. Two resolutions are available: QVGA (320×240) & VGA (640×480). On this page the video stream is provided by using some Javascript to repeatedly load a JPEG image from the URL:

http://<camera-ip>/?action=snapshot

and replacing the existing page image with it. Control of pan & tilt is also done with AJAX HTTP requests, I’ve not done any experimenting with those yet so I’ll leave them for another time. It is also possible to read the temperature sensor value in °C by requesting the following URL:

http://<camera-ip>/?action=command&command=value_temperature

 

The link for “Video + Audio” takes you to an identical looking page but instead of using Javascript to provide the video it using a Java applet to playback an MJPEG stream with audio. The Java applet appears to be based on the Cambozola streaming image viewer by Andy Wilcock. The URL for the MJPEG stream is:

http://<camera-ip>/?action=appletvastream

It seems possible to playback the video stream perfectly happily using VLC (just point it at the URL) but so far I can’t get it to play any audio with VLC. Unjar’ing the cambozola.jar from the Blink makes me suspect there could be an ADPCM audio stream (there is an ADPCMDecoder.class in the JAR) but it’s not obvious from capturing the stream’s URL with wget – if anyone knows anything about audio encoding in MJPEG streams I’d be most interested to hear about it.

One final point of interest from the web interface is that the page title identifies the Blink 1 as the MBP2000W which I’m guessing is the Motorola internal model number for the device.

Having explored the web interface a bit I thought I’d look into what sort of network traffic the Blink was generating. Having whipped out arpspoof & tcpdump I can confirm that the Blink is chatty little thing. On start-up it registers itself with the Monitor Everywhere website (it seems to use its own MAC address as the key), it seems to generate lots of ICMP traffic (mostly echo requests) & there’s definitely some STUN stuff going on (presumably to allow access to the camera from outside of your local network). I’ve got some network captures that I’ll be spending some time analysing in the near future.

One thing I did notice is that it’s fairly easy to receive alerts from the camera when it detects a noise. It just sends out a UDP subnet broadcast on port 51110. The contents of the UDP packet are:

VOX:<Camera MAC Address>

You can test this for yourself just by using netcat to listen on UDP port 51110 like so:

netcat -l -u 51110

That’s all I’ve got so far but I’ll post some more info when I’ve got some. In the meantime, happy hacking!

Motorola Blink1 Wi-Fi Baby Monitor

Discovering that we were expecting our first child at the end of the year naturally meant it was time to shop for exciting new gadgets that will make parenting a walk in the park (ha!). Top of that list came the acquisition of a baby monitor.

We’d seen a wireless video baby-monitor (with pan & tilt) that some friends of ours had bought. It looked ideal as it came with a neat little portable display unit & had all the required features (night vision, sound alert, talkback, temperature monitor etc). Unfortunately on further investigation I discovered that it transmitted video over the unregulated 2.4GHz band which meant that when the baby monitor was on it stomped all over their Wi-Fi signal. This seemed like a bit of a show-stopper to me.

Fortunately there are a few video baby monitors on the market which transmit their video over Wi-Fi meaning they should play nicely with the Wi-Fi. After a bit of research I decided to go with the Motorola Blink 1, it has all the features we wanted (temperature & sound alert, talkback) and also has an Apple & Android app (called Monitor Everywhere) which allows you to view the camera on your phone or tablet at home and also when away from home (should you so wish). You can also log into the Monitor Everywhere website to view your camera from any web browser. We bought ours from Amazon for £75 and got a £25 discount for joining Amazon Family which meant we got the Blink for £50 – bargain!

The slight downside to the Blink is that it doesn’t come with a dedicated video display. Obviously the intention is that you’ll use your phone or tablet to monitor it so you don’t need one. We decided to set up Katy’s Nexus 7 (which rarely gets used at home) as a display using the official charging dock which allows it to charge while sitting in the correct orientation for viewing video.

So far the experience is pretty positive. The set-up was straightforward & all done via the app (in this case the Android one) including adding the monitor to our Wi-Fi network. Once on the Wi-Fi it automatically downloaded & installed a new firmware update. After that it just appeared as a camera available to be viewed in the app. My two complaints about the current version of the app are:

  1. It doesn’t keep the screen of the device on when you’re viewing the camera
  2. If there’s no background noise the audio stream from the camera makes a periodic “purring” noise

Because it’s a Wi-Fi camera, it should be possible to reverse-engineer some (or all) of its functions and maybe make it do some cool stuff. Things I’m thinking of so far are:

  • Pause playback on the media centre / squeezebox when the monitor detects a noise
  • Provide some visual cue (LED strip or something) when noise is detected
  • Log & graph the temperature in the nursery
  • Automatically launch the app & turn on the screen of the Nexus when noise is detected

I’m sure there’s a bunch of other stuff it could also do. Anyone got any suggestions?Anyway, I’ll be documenting my discoveries here and hopefully they’ll be useful to other Geek Dads / Dads-to-be.

Network remote for Onkyo A/V Receivers

I recently purchased an Onkyo TX-NR515 A/V receiver & amplifier. One of my main reasons for choosing this amp was that it supports network remote control via its ethernet port. This enables me to shut the amp away out of sight in an A/V cabinet and control it using the Onkyo Remote Android app.

Being a geek though it wasn’t sufficient for me to be able to control it via app. I wanted to make the amp “magically” turn itself on & select the correct input source when I turned on my HTPC or Squeezebox Touch (more on this soon).

Thanks to Tom Gutwin‘s excellent work of finding Onkyo’s protocol specification & documenting his efforts to produce a Java eISCP client it was pretty easy to produce a little Linux command-line utility which sends remote commands to an Onkyo amp.

The utility is written in C and should compile cleanly with GCC on Linux (it may work on other platforms, I haven’t tried it). Usage is as follows:

./onkyo-iscp <amp hostname or ip> <ISCP command> <command parameter>

For example:

./onkyo-iscp onkyo.home.lan PWR 01

will send a “power on” message to the amp. There’s currently no error checking on the command or parameters, it assumes you know what you’re sending to the amp (read the protocol spec for a list of commands & parameters). It also doesn’t read any data from the amp, I might get around to implementing this eventually (if it turns out that I need it).

Source tarball is here: onkyo-iscp.tar.gz

Changing Pageant’s default behaviour

As a Unix developer, I spend most of my working day with lots of terminals open to various Linux & Solaris development or test servers

For many years I’ve used the excellent PuTTY by Simon Tatham for all my SSH’ing needs. In addition to PuTTY, I also use Pageant to make launching new terminal sessions as easy as right clicking an icon in the system-tray and choosing the machine.

The one complaint that I have with Pageant is its default double-click behaviour. My typical use case for Pageant is:

  • I start Pageant when logging into Windows and automatically load my SSH key (by supplying the filename of the private-key file as a command-line argument to Pageant).
  • I mostly launch previously saved PuTTY sessions from Pageant’s “Saved Sessions” menu.
  • Occasionally (once or twice a day) I’ll need to launch a PuTTY session to a machine which isn’t in my “Saved Sessions” (usually because saving them all would make the “Saved Sessions” menu overly long).

Pageant’s default behaviour when double-clicking the tray icon is to launch the “View Keys” dialog. What I’d really like it to do is to launch PuTTY (i.e.: what the “New Session” menu item does).

Thankfully Pageant (indeed all of the PuTTY suite) is open-source so it was relatively straightforward to download the source, make my simple change and recompile Pageant.

In case anyone else shares my use case I’m making this modified Pageant available:

Pageant

You can also download a patch file containing these changes which can be applied to Pageant v0.62 here.

App Idea : SMS Spam Reporter

I’m probably not alone in getting quite a few “spam” SMS messages on my phone. Lately they’ve all been about PPI mis-selling but in the past they’ve been about dodgy loans, accident claims etc etc

Unfortunately all these messages come from mobiles that have been bought to bulk-send SMS spam and aren’t registered or legislated for in any way. The only recourse that you might possibly have against these are to report the text to your mobile phone operator in the hope that they will block that number so that others aren’t inconvenienced.

You obviously need to include the sender’s number when forwarding the spam text to 7226 or (87226 if you’re on Vodafone). On my phone, the ‘forward’ function doesn’t do this automatically. So here’s my great app idea:

  • You set up a “blacklist” of words that usually appear in spam texts (e.g.: “PPI”, “claim” etc)
  • When your phone receives a text with one of the blacklisted words it automatically pops up a dialog which shows you the text and asks you if you’d like to report it as spam.
  • The app edits the text to include the original sender’s number and automatically forwards it to your operator’s SMS spam reporting number.
  • The app then deletes the text from your text inbox.

It doesn’t sound too hard does it? It might even result in these spam merchants getting their comeuppance. So why can’t I find an app that will do this? All the anti-spam apps I can find want to filter messages out of my inbox and become my messaging app. I don’t want that, I just want to report these sons of guns.

If I get a bit of free time this will be my first Android app (unless someone else makes it first).

Listing recovery and source files using par2cmdline

I use the parchive command-line utility par2 quite a lot. In order to improve its scriptability I found that I needed to have the ability to list the recovery (*.par2) and source files (the files verified or repaired using the recovery data) associated with a master PAR2 file.

Admittedly I could have scraped the output from par2 -r <somefile.par2> but as it does some progress-percentage type output to the console I thought it might be cleaner to patch the par2 command to add a -list option.

Here’s how to download, patch & compile the par2cmdline v0.4 package to get these changes for yourself. These instructions are specifically for Ubuntu 10.04 (Lucid Lynx) but will probably work on any recent(ish) Ubuntu (or indeed Debian) install.

Optional step; if you’ve already installed par2cmdline via apt-get you’ll probably want to remove it with:

sudo apt-get remove par2
  1. Download the source of par2cmdline v0.4 from here (hint: you want par2cmdline-0.4.tar.gz).
  2. Untar the archive, this will create a par2cmdline-0.4 directory with the source in.
  3. If you’ve got gcc version 4 on your machine (you probably have) you’ll need to apply this patch to the source directory.
  4. Download and apply my patch to the source directory.
  5. Configure, compile and install.

Or, if you’re too busy and|or lazy to follow that, just paste the following into your console:

wget -O "par2cmdline-0.4.tar.gz" "http://downloads.sourceforge.net/project/parchive/par2cmdline/0.4/par2cmdline-0.4.tar.gz?r=&ts=1351786076&use_mirror=switch"
tar -xvzf par2cmdline-0.4.tar.gz
wget "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-arch/par2cmdline/files/par2cmdline-0.4-gcc4.patch"
patch -p0 < par2cmdline-0.4-gcc4.patch
wget "http://simon.aldrich.eu/download/par2cmdline/par2cmdline-0.4-list.patch"
patch -p0 < par2cmdline-0.4-list.patch
cd par2cmdline-0.4/
./configure
make
sudo make install

If all goes well you’ll end up with a par2 command with the following new options:

Usage:

  par2 c(reate) [options]  [files] : Create PAR2 files
  par2 v(erify) [options]  [files] : Verify files using PAR2 file
  par2 r(epair) [options]  [files] : Repair files using PAR2 files
  par2 l(ist)   [options]  [files] : List files using PAR2 files

You may also leave out the "c", "v", and "r" commands by using "parcreate",
"par2verify", or "par2repair" instead.

Options:

  -b  : Set the Block-Count
  -s  : Set the Block-Size (Don't use both -b and -s)
  -r  : Level of Redundancy (%%)
  -c  : Recovery block count (Don't use both -r and -c)
  -f  : First Recovery-Block-Number
  -u     : Uniform recovery file sizes
  -l     : Limit size of recovery files (Don't use both -u and -l)
  -n  : Number of recovery files (Don't use both -n and -l)
  -m  : Memory (in MB) to use
  -v [-v]: Be more verbose
  -q [-q]: Be more quiet (-q -q gives silence)
  -e     : List only recovery files
  -o     : List only source files
  --     : Treat all remaining CommandLine as filenames

The -l command will by default list both the recovery & source files. Use the -e and -o options to restrict listing to one or the other of these file types.

By my own admission this patch is pretty rough and ready (it doesn’t handle PAR v1 files for example) but I hope it’s of use to someone.