Hacking a Summer Infant Baby Monitor

Quick post, mostly so that if I get back to this project I'll remember where I left off. Opened up an old Summer Infant Baby Monitor. The screen part had long since broken been disposed of, but I still had the camera/microphone piece.

The unit in two parts, that hinge on each other. The part in this picture contains the camera, microphone, and various LEDs - presumably infrared. The other part (pictured below) contains the power socket, switch, antenna, and a circuit that presumably deals with transmitting via RF.


I was trying to see if I could get a picture off this thing. The four wires coming out of the camera unit are

  • red +9V
  • yellow video
  • white mic+
  • black GND
Connected red/black to +5V/ground on an Arduino, and the yellow/white to analog pins 0, 1. Ran the following simple sketch just to see what came out.

// Sketch to read the video and microphone of a Summer Infant camera unit

//

// red     +9V (only connecting +5V and it seems to work)

// yellow  video
// white   mic+
// black   ground

#define VID_PIN 1
#define MIC_PIN 0

char buf[100] = {0};

void setup() {
  Serial.begin(19200);
  pinMode(VID_PIN, INPUT);
  pinMode(MIC_PIN, INPUT);
}

void loop() {
  int vidValue = analogRead(VID_PIN);
  int micValue = analogRead(MIC_PIN);
  sprintf(buf, "video: 4d    mic: 4d", vidValue, micValue);
  Serial.println(buf);
}


Very crude, but the mic outputs 0 most of the time, except when you tap/scratch it. So definitely a signal there. A little harder to tell with the video. But it did seem to be outputting different streams of numbers when you wave in front of it.

I was more interested in the video, so for the next step I connected the yellow video pin to the TX on my Duemilanove. Then using a trick I read about in this TTL Serial Camera Tutorial I loaded an empty sketch onto the Arduino so that I could "hi-jack" the serial lines. 


// empty sketch
void setup()  
{
}
void loop()
{
}


I also used the CommTool mentioned in that article to see the output. Unfortunately I have no idea what this camera on the board is, and there's no input to it exposed. It just starts streaming data in some format when you apply power. The interesting thing when using it over serial was that when the lens was completely blocked with something very dark, it stopped streaming data. When you expose the lens, it starts streaming again.

Next step is probably to do that and try and capture the output into a file so that I can make an effort at identifying the format and perhaps display the content. For now this goes into a box of things to play with another time.



4 comments:

  1. Is this their 2.4Ghz model that is available in most large retail stores? I'm fairly sure that they claim that the signal is encrypted.

    This makes me wonder if the bottom board isn't only for RF, but it may also add some sort of cipher to the signal as well.

    Is the yellow wire which you are using connected to the pin on the bottom ("rf") board which is labeled "video in"?

    If it isn't, then maybe you could tap the signal from there?

    If nether, do you think that Summer left an option to input another camera, such as a standard composite video feed? That would actually be pretty neat because then you could drill a hole, add a standard BNC connector, and then use any industry standard security cameras.

    Alternately you could add an rca jack and broadcast other types of composite video.

    If that is already where you're getting the signal from ("video in" pin), then it might be necessary to tap into the signal between the camera and the fist IC chip (if that is at all possible).

    If your purpose is to grab the video in a serial format, then you will definitely want to try and tap it somewhere on the board before the actual radio frequency generation occurs.

    You could find the exciter by tracing your way back from the antenna. Somewhere there will be a transistor or something to amplify the signal. Then directly behind that is likely an IC, or circuit, which controls the frequency. Somewhere attached to this would be the raw output signal (possibly encrypted at this point).

    Unless there are some sort of chips under that heat spreader on the bottom board, now that I've looked a little closer, I'm thinking it could be more likely that encryption is done by whatever MCU or CPU is on the top board.

    Is there any indication as to what that could be?

    If you have a scope, then you could poke around on the chip and possibly find a TTL console of some sort, or maybe even the raw video signal (whatever that would look like, I dunno). Standard composite video will always be a value from 0 to 1 volts. I kind of doubt that the camera would output this directly, though. :-D However stranger things have happened.

    Can your Arduino be used as a scope? (or something else you have there like maybe an FPGA or other MCU?)

    Cheers!

    ReplyDelete
    Replies
    1. Josh - thanks for the detailed comment. This post described something I was playing with about 5 years ago, so I can't answer your questions. But thanks for your time.

      Delete
  2. Awesomely enough, I just picked a couple of these up. Time to get out the screwdrivers.

    ReplyDelete
  3. I have monitor but no camera is tjere a way i could tap in video. i could not find pinout for video chip

    ReplyDelete