ONVIF

ONVIF is a standard for IP-based physical security products such as cameras and NVRs. This note documents how some Xiongmai (XM) cameras derive a default ONVIF password like tlJwpbo6 from an MD5 digest.

Deriving the default password

import hashlib

def xmmd5(password: str) -> str:
    _XMMD5MAGIC = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz' # length 62
    md5 = hashlib.md5(password.encode('utf-8')).digest()
    return ''.join(_XMMD5MAGIC[(a + b) % 62]
                   for a, b in zip(md5[0::2], md5[1::2]))[:8]

result = xmmd5('')
print(result)

The MD5 of the empty string '' is d41d8cd98f00b204e9800998ecf8427e. Working the first output character by hand:

b'\xd4\x1d\x8c\xd9\x8f\x00\xb2\x04\xe9\x80\x09\x98\xec\xf8\x42\x7e'

# _XMMD5MAGIC[(0xd4 + 0x1d) % 62]
index = (0xd4 + 0x1d) % 62
index = (212 + 29) % 62
index = 241 % 62
index = 57

# _XMMD5MAGIC[57] is 't'