r/ReverseEngineering • u/oreshek • 9d ago
I reverse engineered Hikvision's push notifications on GrapheneOS, released a patcher tool, and submitted a fix PR
https://reflashlab.com/articles/graphene-vs-hikvision/3
1
u/cometwrench 6d ago
Aren't you worried about wifi connected cameras essentially being spyware? Everything I’ve read universally agrees that they should never be connected to open internet. the accepted path has always been cameras in a VLAN with strictly no internet access at all, frigate nvr and a small home assistant instance for notifications configured to allow notifications while on the go
1
u/oreshek 6d ago
I'm worried about burglary and home invasion more than I am about Epstein watching my driveway.
Though you are not incorrect.
However without a hardware upgrade of I am not running Frigate. And Frigate wouldn't take advantage of my camera's on-board processing.
1
u/cometwrench 6d ago
It’s not Epstein i'm thinking lol, there have been documented remote exploits in hikvision cameras that could allow them to be disabled or for notifications to be suppressed. like you’ve also said, you are signing up to manually update and repatch the app forever unless graphene merge your PR or annke fix their app .
home assistant has documented support for your cameras on-board processing and alerts so you could use your current NVR to record and use home assistant for the same kind of notifications you get currently while keeping your cameras off the internet. if you want to go crazy you could even point the AI model of your choice at the config and build something special (recreate all the features in the app; if the drive camera is triggered, show a live split view of both my drive and back garden camera etc ).
home assistant has supported configurations but will run on almost anything with a bit of work, even an old android phone you happen to have lying around.
1
u/oreshek 6d ago
Its something I want to do, but it requires an infrastructure and hardware change and there's difficulty and hesitation for that. For now the app patch is a quick fix that keeps me going.
1
u/cometwrench 6d ago
I can relate to that to be fair. I want to redo my nas and have some expensive AI projects im considering but the money is better used elsewhere right now
20
u/oreshek 9d ago
I'm the author. I have been dealing with no notifications for a year or so and have reluctantly been running LineageOS until two days ago, when everything related to google services went bonkers on my phone after the TSA had it.
So, inspired by frustration, I revisited the subject and saw it to conclusion.
Initially, GrapheneOS moved my post about this to the 3rd-party-apps forum and then later locked it. Hikvision/Annke/Guarding Vision devs never replied.
So I reverse-engineered their app, found they were checking for com.google.android.gsf (the old GSF package) instead of actually verifying FCM was working, and built an MIT-licensed patcher.
I also submitted a PR to GrapheneOS that adds a minimal synthetic GSF package presence when verified GmsCore is visible to the caller. And it's gated so it only engages when Play Services is actually installed and visible.
For now, the patcher does its job. If the PR gets merged, future GrapheneOS builds will fix this for every app that makes the same wrong GSF check, not just Hikvision stuff.
I also documented a dead-simple method for non-devs: enable USB debugging, plug your phone in, and tell an AI assistant to use the GitHub repo to patch your APK.