franga2000/Xiaomi YI.md

## Xiaomi YI.md

      
    Raw
  

              Xiaomi YI.md
            
          
    Xiaomi Yi camera

General info


OS: Buildroot
CPU: ARMv6-compatible processor rev 5 (v6l)
BogoMIPS: 524.28
Memory: 37MB

The root filesystem is rootfs, which is stored in memory and therefore wiped on reboot. The Micro SD card is mounted at /tmp/fuse_d/. Something is also mounted at /tmp/fuse_a and /tmp/fuse_z.
WiFi AP


SSID: YDXJ_[last 7 digits of SN]
Default pass: 1234567890
Securtiy: WPA2-Personal
Camera IP: 192.168.42.1

Nmap scan:

Opened ports on 192.168.42.1
Discovered open port 80/tcp on 192.168.42.1
Discovered open port 554/tcp on 192.168.42.1
Discovered open port 53/tcp on 192.168.42.1
Discovered open port 8787/tcp on 192.168.42.1
Discovered open port 7878/tcp on 192.168.42.1
##Shell access
To enable shell access you must create an empty file on the SD card named enable_info_display.script.
Then you can connect to the camera using telnet:
telnet 192.168.42.1 23
You will be presented a login promt:
buildroot login: 

Type root and hit enter. You are now connected to the camera's root Linux shell

Telnet commands

Technically just a raw TCP socket connection, but it's easier to just call it telnet.
telnet 192.168.42.1 7878
Meta

Error messages sent by the camera:

{"rval": -7} - Input is not a valid JSON object
{"rval":-4,"msg_id":0} - Input object is empty
{"rval":-9,"msg_id":0} - Input object is not a valid command

Token

All requests require a token you have to request when connecting to the camera:
Request:
{"msg_id":257, "token":0}
Response:
{ "rval": 0, "msg_id": 257, "param": 1 }
param is your token. All requests in this article have the token set to 1. This will be different for you.
Config

Request:
{"msg_id":3, "token":1} 
Response:

NOTE: The config is a list of objects of settings, not just an object of settings. You have to use a loop!

{
	"rval": 0,
	"msg_id": 3,
	"param": [
		{"camera_clock": "2015-04-07 02:32:29"},
		{"video_standard": "NTSC"},
		{"app_status": "idle"},
		{"video_resolution": "1920x1080 60P 16:9"},
		{"video_stamp": "off"},
		{"video_quality": "S.Fine"},
		{"timelapse_video": "off"},
		{"capture_mode": "precise quality"},
		{"photo_size": "16M (4608x3456 4:3)"},
		{"photo_stamp": "off"},
		{"photo_quality": "S.Fine"},
		{"timelapse_photo": "60"},
		{"preview_status": "on"},
		{"buzzer_volume": "mute"},
		{"buzzer_ring": "off"},
		{"capture_default_mode": "precise quality"},
		{"precise_cont_time": "60.0 sec"},
		{"burst_capture_number": "7 p / s"},
		{"restore_factory_settings": "on"},
		{"led_mode": "all enable"},
		{"dev_reboot": "on"},
		{"meter_mode": "center"},
		{"sd_card_status": "insert"},
		{"video_output_dev_type": "tv"},
		{"sw_version": "YDXJv22_1.0.7_build-20150330113749_b690_i446_s699"},
		{"hw_version": "YDXJ_v22"},
		{"dual_stream_status": "on"},
		{"streaming_status": "off"},
		{"precise_cont_capturing": "off"},
		{"piv_enable": "off"},
		{"auto_low_light": "on"},
		{"loop_record": "off"},
		{"warp_enable": "off"},
		{"support_auto_low_light": "on"},
		{"precise_selftime": "5s"},
		{"precise_self_running": "off"},
		{"auto_power_off": "5 minutes"},
		{"serial_number": "xxxxx"},
		{"system_mode": "capture"},
		{"system_default_mode": "capture"},
		{"start_wifi_while_booted": "off"},
		{"quick_record_time": "0"},
		{"precise_self_remain_time": "0"},
		{"sdcard_need_format": "no-need"},
		{"video_rotate": "off"}
	]
}
Photo capture

Request:
{"msg_id":769,"token":1}
Response:
{ "msg_id": 7, "type": "start_photo_capture", "param":"precise quality;off"}
{ "msg_id": 7, "type": "photo_taken", "param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0047.jpg"}

param is the full path of the image


NOTE: To get the download URL of the image, replace /tmp/fuse_d/ with http://192.168.42.1/.

Telnet events

All messages with msg_id: 7 are events and are sent automatically by the camera.
{ "msg_id": 7, "type": "<string: event name>"}
Some events also provide additional data in the param attribute:
{ "msg_id": 7, "type": "<string: event name>", "param":"<int: event data>"}
Below is a list of known events, their parameters and an example for each
Battery

Fired when the battery level changes
{ "msg_id": 7, "type": "battery", "param":"20"}

type is battery when discharging and adapter when charging
param is the battery charge percentage (int 1-100, obviously)

Charger status

Fired when the USB charging cable is connected/disconnected
{ "msg_id": 7, "type": "adapter_status" ,"param":"1"}

param:0 - cable disconnected
param:1 - cable connected

Camera mode switched

Fired when the recording mode is changed (big button on the front)
{ "msg_id": 7, "type": "switch_to_rec_mode" }

type:"switch_to_rec_mode" - switched to video mode
type:"switch_to_cap_mode" - switched to photo mode

Photo taken

{ "msg_id": 7, "type": "start_photo_capture" ,"param":"precise quality;off"}
{ "msg_id": 7, "type": "precise_capture_data_ready" }
{ "msg_id": 7, "type": "photo_taken" ,"param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0513.jpg"}
SD Card status

Fired when the SD card is inserted/removed
{ "msg_id": 7, "type": "sd_card_status" ,"param":"insert"}

type:"insert" - SD card inserted
type:"remove" - SD card removed
When SD card is removed, the following event also fires:

{ "msg_id": 7, "type": "CARD_REMOVED" }
Live view

After you've successfully authenticated through telnet, you can connect to rtsp://192.168.42.1:554/live with VLC (or similar) to see the live view of the camera.

This doesn't always work. The only 100% way I know is to first connect with the official app.

Unknown events

Photo taken vf_start/stop

Fired after start_photo_capture
Best guess: stop live view
{ "msg_id": 7, "type": "vf_stop" }
Fired after photo_taken
Best guess: start live view
{ "msg_id": 7, "type": "vf_start" }
vf == "viewfinder" ?
Battery status

This message has been observed when taking out the battery with the cam on USB power, but I haven't been able to reproduce it so far.
{ "msg_id": 7, "type": "battery_status" ,"param":"0"}

param - observed values0 and -1