reolink-init

KO | EN

gitlite — search

#machine-learning #anthropic #golang #database #shell #markdown #privacy #reactjs #windows #linux

(★ 9)

Initialize & configure Reolink cameras (password, Wi-Fi, ports) with no Reolink app or cloud — over the Baichuan (port 9000) protocol and the HTTP CGI API.

파일 탐색기

ZIP 다운로드

.env.sample
.gitignore
baichuan_init.py
LICENSE
README.md
reolink_env.py
reolink_wifi_setup.py
requirements.txt

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Initialise and configure Reolink cameras **without any Reolink-made software** —
no mobile app, no desktop client, no cloud account.

A factory-fresh Reolink camera (e.g. **RLC-510WA** on recent firmware) ships
*uninitialized*: the `admin` user has a blank password and every service port
(HTTP/HTTPS/RTSP/RTMP/ONVIF) is disabled, so only TCP **9000** — the proprietary
"Baichuan" protocol is open. The official apps use port 9000 to set the first
password and turn on the normal ports. These tools do the same thing over the camera's
native protocol and the standard HTTP CGI API.

## Why did I do this?

Recent "no default password" laws (e.g. California SB-327, UK PSTI Act) require
the camera to ship with no usable credentials until a human sets one. The vendor's
implementation is to keep everything but port 9000 closed until initialised —
which normally forces users through their app. That is fine; however, the use of 
proprietary apps may not be desired or impractical, for example, in a pure CLI Linux environment.

## Contents

| File | Transport | Purpose |
|------|-----------|---------|
| `baichuan_init.py` | Baichuan, port 9000 | Bootstrap a fresh camera: probe state, enable ports, set password |
| `reolink_wifi_setup.py` | HTTP CGI (`api.cgi`) | Wi-Fi, RTSP URLs, disable UID/P2P, set admin password |

`baichuan_init.py` reuses the [`reolink_aio`](https://github.com/starkillerOG/reolink_aio)
library for the protocol framing, AES/XOR crypto and the login handshake; it only
adds the camera-init commands on top.

## Install

Using a Python environment like "venv" is recommended.

```bash
pip install reolink-aio loguru rich requests
```

## Configuration (`.env`)

To avoid repeating/exposing the IP and password, copy `.env.sample` to `.env` and fill it in:

```bash
cp .env.sample .env
# then edit: REOLINK_IP, REOLINK_USER, REOLINK_PASSWORD
```

Both tools automatically load `.env`. Any value is used **only when the matching
argument is omitted** — an explicit CLI argument (or a real environment variable)
always wins. So with `.env` set, you can run:

```bash
python baichuan_init.py probe                  # IP + password from .env
python reolink_wifi_setup.py --scan            # IP + password from .env
python baichuan_init.py set-password 'NewPass' # IP from .env
```

`.env` is gitignored (it holds your password); `.env.sample` is committed.
Recognised keys: `REOLINK_IP`, `REOLINK_USER` (default `admin`), `REOLINK_PASSWORD`
(empty for a factory-fresh camera).

---

## `baichuan_init.py` — bootstrap over port 9000

```
python baichuan_init.py <IP> [-u USER] [-p PASSWORD] [--port 9000] [-v] <command>
```

Global options:

- `-u, --username` — default `admin`
- `-p, --password` — **current** password. Leave empty for a factory-fresh camera (default `''`).
- `--port` — Baichuan port (default `9000`)
- `-v, --verbose` — debug logging, including the `reolink_aio` Baichuan wire traffic

### `probe` — read-only state dump (changes nothing)

```bash
python baichuan_init.py 192.168.1.60 probe
```

Logs in and prints device info (cmd 80), users (cmd 58) and port state (cmd 37).
Use this first to confirm the camera is reachable and that blank-password login works.

### `enable` — turn on service ports (cmd 36)

```bash
# default: http https rtsp onvif
python baichuan_init.py 192.168.1.60 enable

# specific ports
python baichuan_init.py 192.168.1.60 enable --ports http rtsp onvif
```

Port choices: `http https rtmp rtsp onvif`. After HTTP is enabled, the camera's web server takes a few seconds to start listening on port 80.

### `set-password` — set the admin password

```bash
python baichuan_init.py 192.168.1.60 set-password 'MyNewPass123'
```

Enables HTTP (cmd 36) and then sets the password over the **verified** HTTP
`ModifyUser` CGI (`newPassword`/`oldPassword`), confirming the change with a fresh login. 
The pure-Baichuan **cmd 59** user-write is a **silent no-op** on tested firmware (the camera returns `rspCode 200` but the
password does not change), so it is not used here anymore; its payload remains in `build_set_password_xml()` for experimentation via the `raw` subcommand.

A `ModifyUser` with a plain `password` field is likewise accepted (rspCode 200) but silently ignored — the change **must** use `newPassword`+`oldPassword`.

### `init` — all-in-one

```bash
python baichuan_init.py 192.168.1.60 init 'MyNewPass123'
```

Enables HTTP, sets the password via HTTP (verified), then re-logs in via Baichuan with the new password, and enables the default service ports.

### `raw` — send an arbitrary command (for further experimentation)

```bash
python baichuan_init.py 192.168.1.60 raw --cmd-id 80
python baichuan_init.py 192.168.1.60 raw --cmd-id 59  --body-file mybody.xml -p 'currentpass'
```

Useful for replaying a body reconstructed from a packet capture.

---

## `reolink_wifi_setup.py` — configure over HTTP

Requires HTTP (port 80) to be open — enable it first with `baichuan_init.py enable`.

```
python reolink_wifi_setup.py <IP> [-u USER] [-p PASSWORD] <flags>
```

- `-p, --password` — current admin password. Omit to be prompted; pass `-p ''` for a
  fresh/uninitialized camera.

### Set the admin password (recommended path)

```bash
python reolink_wifi_setup.py 192.168.1.60 -p '' --set-admin-password
```

Prompt twice for the new password (to keep it out of your shell history). Or non-interactively:

```bash
python reolink_wifi_setup.py 192.168.1.60 -p ''  --set-admin-password --new-password 'MyNewPass123'
```

### Wi-Fi

```bash
# list networks the camera can see
python reolink_wifi_setup.py 192.168.1.60 -p 'pass' --scan

# test credentials before committing
python reolink_wifi_setup.py 192.168.1.60 -p 'pass' --test-wifi --ssid 'YourSSID'

# set Wi-Fi (prompts for the Wi-Fi password)
python reolink_wifi_setup.py 192.168.1.60 -p 'pass' --set-wifi --ssid 'YourSSID'
```

### Other

```bash
# print local RTSP URLs
python reolink_wifi_setup.py 192.168.1.60 -p 'pass' --print-rtsp

# best-effort disable Reolink UID/P2P cloud (still block WAN on the router!)
python reolink_wifi_setup.py 192.168.1.60 -p 'pass' --disable-uid
```

---

## Recommended end-to-end flow (fresh camera)

```bash
IP=192.168.1.60

# 1. Confirm uninitialized state (read-only)
python baichuan_init.py $IP probe

# 2. Enable HTTP over Baichuan
python baichuan_init.py $IP enable --ports http

# 3. Set the admin password over HTTP (you choose it; prompted)
python reolink_wifi_setup.py $IP -p '' --set-admin-password

# 4. Enable the rest of the service ports
python baichuan_init.py $IP -p '<newpass>' enable --ports rtsp onvif

# 5. (optional) Wi-Fi + RTSP URLs
python reolink_wifi_setup.py $IP -p '<newpass>' --scan
python reolink_wifi_setup.py $IP -p '<newpass>' --set-wifi --ssid 'YourSSID'
python reolink_wifi_setup.py $IP -p '<newpass>' --print-rtsp

# 6. On your router: BLOCK the camera from the internet (WAN).
```

Step 6 is the one that actually keeps the camera off the cloud. Disabling UID/P2P on the device is best-effort; the firewall rule is what's enforceable.

---

## Baichuan protocol notes for future development

Proprietary TCP/UDP protocol on port **9000**. The reference impl is `reolink_aio`, command names from the neolink Wireshark dissector.

- **Header**: magic `f0debc0a` + `cmd_id`(4 LE) + `mess_len`(4 LE) + `mess_id`(4) +
  enc/status(2) + `message_class`(2) [+ `payload_offset`(4) on 24-byte headers].
- **Crypto**: a simple XOR cipher (`XML_KEY`, keyed by message offset) for the
  legacy/login phase; **AES-CFB** (iv `0123456789abcdef`) for normal traffic, with the
  key derived as `md5(nonce + "-" + password)[:16]` (uppercased 31-char MD5 hex).
- **Login**: legacy header-only request fetches a `nonce`; the modern login then sends
  MD5-hashed `username+nonce` / `password+nonce`.
- **Command IDs used here**: `1` login, `2` logout, `36` enable ports (ServerPort write),
  `37` read ports, `58` read users, `59` write user/password *(unverified)*, `80` version info.

## Safety

- Run all of this on an **isolated VLAN** with the camera blocked from the internet.
- Sending an unknown/malformed Baichuan command is safe — the camera returns an error code; these tools never write firmware.
- If you get locked out (forgotten/unknown password), factory-reset with the pinhole button and start over from `probe`.

## Credits

- [`reolink_aio`](https://github.com/starkillerOG/reolink_aio) — Baichuan + HTTP API library
- [`neolink`](https://github.com/thirtythreeforty/neolink) — Baichuan Wireshark dissector

❤️

reolink-init

파일 탐색기

# CDN으로 사용하기

Was this content helpful?

Recent Feedback

Download README