Xiaomi Yi JSON Protocol Reverse Enginnering

xiaomiprotocol.md

Xiaomi Yi JSON Protocol Reverse Engineering

First, connect to your camera via WiFi. Then you can send data to 192.168.42.1:7878

HELP IS APPRICIATED

Get token

Request:

{"msg_id":257,"token":0}

Response:

{ "msg_id": 7, "type": "vf_stop" }
{ "rval": 0, "msg_id": 257, "param": 1 }

"param" - Your token, you need to pass it in later requests.
Messages with id 7 are status updates:
"vf_stop" - ????

Take a photo

Request:

{"msg_id":769,"token":1}

Response:

{"rval":-27,"msg_id":769}

"rval" - When this equals -27, that means error occured (Probably sdcard is missing/busy)

{"rval":0,"msg_id":769}
{ "msg_id": 7, "type": "start_photo_capture" ,"param":"precise quality;off"}
{ "msg_id": 7, "type": "precise_capture_data_ready" }
{ "msg_id": 7, "type": "photo_taken" ,"param":"/tmp/fuse_d/DCIM/127MEDIA/YDXJ0373.jpg"}
{ "msg_id": 7, "type": "vf_start" }

"rval" - When this equals 0, that means everything is ok. Messages with id 7 are status updates:
"start_photo_capture" - Camera is taking photo
"precise_capture_data_ready" - Photo taken, camera is processing it.
"photo_taken" - Photo has been saved to sdcard, you have path to it in "param"
"vf_start" - ?????

Get battery status

Request:

{"msg_id":13,"token":1}

Response:

{"rval":0,"msg_id":13,"type":"adapter","param":"100"}

"param" - Battery level in percent
"type" - adapter or battery

Get all settings

Request:

{"msg_id":3,"token":1}

Response:

{ "rval": 0, "msg_id": 3, "param": [ { "camera_clock": "2015-04-07 02:32:29" }, { "video_standard": "NTSC" }, { "app_status": "idle" }, { "video_resolution": "1920x1080 60P 16:9" }, { "video_stamp": "off" }, { "video_quality": "S.Fine" }, { "timelapse_video": "off" }, { "capture_mode": "precise quality" }, { "photo_size": "16M (4608x3456 4:3)" }, { "photo_stamp": "off" }, { "photo_quality": "S.Fine" }, { "timelapse_photo": "60" }, { "preview_status": "on" }, { "buzzer_volume": "mute" }, { "buzzer_ring": "off" }, { "capture_default_mode": "precise quality" }, { "precise_cont_time": "60.0 sec" }, { "burst_capture_number": "7 p / s" }, { "restore_factory_settings": "on" }, { "led_mode": "all enable" }, { "dev_reboot": "on" }, { "meter_mode": "center" }, { "sd_card_status": "insert" }, { "video_output_dev_type": "tv" }, { "sw_version": "YDXJv22_1.0.7_build-20150330113749_b690_i446_s699" }, { "hw_version": "YDXJ_v22" }, { "dual_stream_status": "on" }, { "streaming_status": "off" }, { "precise_cont_capturing": "off" }, { "piv_enable": "off" }, { "auto_low_light": "on" }, { "loop_record": "off" }, { "warp_enable": "off" }, { "support_auto_low_light": "on" }, { "precise_selftime": "5s" }, { "precise_self_running": "off" }, { "auto_power_off": "5 minutes" }, { "serial_number": "xxxxx" }, { "system_mode": "capture" }, { "system_default_mode": "capture" }, { "start_wifi_while_booted": "off" }, { "quick_record_time": "0" }, { "precise_self_remain_time": "0" }, { "sdcard_need_format": "no-need" }, { "video_rotate": "off" } ] }

Get setting choices

Request:

{"msg_id":9,"param":"video_resolution","token":1}

"param" - The key you want choices for
Response:

{ "rval": 0, "msg_id": 9, "param": "video_resolution", "permission": "settable", "options": [ "1920x1080 60P 16:9", "1920x1080 30P 16:9", "1920x1080 48P 16:9", "1920x1080 24P 16:9", "2304x1296 30P 16:9", "1280x960 60P 4:3", "1280x960 48P 4:3", "1280x720 60P 16:9", "1280x720 48P 16:9", "1280x720 120P 16:9", "848x480 240P 16:9" ] }

"options" - Available options for requested key, in this example "video_resolution"

Get single setting

Request:

{"msg_id":1,"type":"video_resolution","token":1}

"type" - The key you want
Response:

{"rval":0,"msg_id":1,"type":"video_resolution","param":"1920x1080 60P 16:9"}

Get sdcard space

Request:

{"msg_id":5,"type":"free","token":1}

"type" - free or total
Response:

{ "rval": 0, "msg_id": 5, "param": 15146464 }

"param" - Free (Or total) space on sdcard in bytes

Set single setting

Request:

{"msg_id":2,"type":"video_resolution","param":"1920x1080 60P 16:9","token":1}

"type" - Key you want to set
"param" - Value from available choices
Response:

{ "rval": 0, "msg_id": 2 ,"type":"video_resolution","param":"1920x1080 60P 16:9"}

"rval" - Return value, should be 0 if everything is ok

I've found also useful to enable logs and check the firmware.avtive.logfile.

To do so, send a message to activate the log:
{"msg_id":2,"type":"save_log","param":"on","token":1}

Then telnet to the camera:
telnet x.x.x.x
tail -f /tmp/fuse_a/firmware.avtive.log

In which models have you tested those commands?

Any clues on how to capture/sniff these?

The server seems to go away after about 20 minutes or so with no action. You can prevent this by periodically sending a simple request (eg. battery level) every few minutes.

"msg_id":769 - take photo - start time lapse
"msg_id":770 - stop the timelapse

For which model did you test? Not all are work for the Yi Discovery (J22)

---

Discovery tcpdump

{"msg_id":257,"param":0,"token":0,"heartbeat":1}
{"rval":0,"msg_id":257,"param":38,"model":"J22","rtsp":"rtsp://192.168.42.1:554/live"}

{"msg_id":3,"token":38}
{"rval":0,"msg_id":3,"param":[{"camera_clock":"2018-07-18 22:46:16"},{"video_standard":"NTSC"},{"app_status":"vf"},{"video_resolution":"3840x2160 20P 16:9"},{"video_stamp":"off"},{"video_quality":"S.Fine"},{"timelapse_video":"0.5"},{"capture_mode":"precise quality"},{"photo_size":"16M"},{"photo_stamp":"off"},{"precise_cont_time":"3s"},{"buzzer_ring":"off"},{"burst_capture_number":"3 p / s"},{"restore_factory_settings":"on"},{"restore_wifi":"on"},{"restore_bt":"on"},{"wifi_ssid":"YDXJ_34120f"},{"wifi_password":"1234567890"},{"sta_ssid":"YDXJ_sta"},{"sta_password":"1234567890"},{"sta_connect_password":"1234567890"},{"sta_ip":"192.168.43.1"},{"wifi_mode":"ap"},{"led_mode":"on"},{"meter_mode":"center"},{"sd_card_status":"insert"},{"sw_version":"J22_1.3.32_201804201604"},{"hw_version":"YDXJ2_V11YB"},{"dual_stream_status":"on"},{"streaming_status":"off"},{"precise_cont_capturing":"off"},{"piv_enable":"off"},{"support_auto_low_light":"off"},{"precise_selftime":"3s"},{"precise_self_running":"off"},{"auto_power_off":"off"},{"serial_number":"J22Vxxxxxxxxxxx"},{"system_mode":"capture"},{"system_default_mode":"last used mode"},{"precise_self_remain_time":"0"},{"sdcard_need_format":"no-need"},{"rec_mode":"record"},{"record_photo_time":"0"},{"dev_functions":"8967"},{"timelapse_video_duration":"6s"},{"timelapse_video_resolution":"3840x2160 20P 16:9"},{"video_photo_resolution":"3840x2160 20P 16:9"},{"slow_motion_resolution":"1080P/2X"},{"loop_rec_duration":"5 minutes"},{"iq_eis_enable":"off"},{"iq_photo_iso":"auto"},{"iq_video_iso":"auto"},{"iq_photo_shutter":"auto"},{"iq_photo_ev":"0"},{"iq_video_ev":"0"},{"iq_photo_wb":"auto"},{"iq_video_wb":"auto"},{"protune":"off"},{"screen_auto_lock":"off"},{"dewarp_support_status":"off"},{"eis_support_status":"off"},{"video_volume_set":"on"},{"product_name":"YI Discovery Action Camera"},{"stamp_enable":"on"},{"ev_enable":"on"},{"wifi_country":"US"},{"wifi_country_editable":"off"},{"rec_audio_support":"on"},{"photo_sharpness":"high"},{"video_sharpness":"high"},{"support_sharpness":"on"},{"timelapse_photo_shutter":"auto"},{"support_iso":"on"},{"support_wb":"on"},{"rc_button_mode":"mode_shutter"},{"video_loop_resolution":"3840x2160 20P 16:9"}]}

{"type":"TCP","msg_id":261,"param":"192.168.42.205","token":38}
{"rval":0,"msg_id":261}

{"msg_id":9,"param":"system_default_mode","token":38}
{"rval":0,"msg_id":9,"permission":"settable","param":"system_default_mode","options":["last used mode","record","record_loop","record_timelapse","precise quality","precise self quality","burst quality"]}

{"msg_id":9,"param":"precise_selftime","token":38}
{"msg_id":9,"param":"burst_capture_number","token":38}

{"rval":0,"msg_id":9,"permission":"settable","param":"burst_capture_number","options":["3 p / s","5 p / s","10 p / s","10 p / 2s","10 p / 3s","20 p / 2s","30 p / 3s","30 p / 6s"]}
{"rval":0,"msg_id":9,"permission":"settable","param":"precise_cont_time","options":["3s","10s","15s","20s","30s"]}

{"msg_id":9,"param":"slow_motion_rate","token":38}
{"rval":0,"msg_id":9,"permission":"settable","param":"slow_motion_rate","options":["2","4","8"]}

{"msg_id":9,"param":"timelapse_video","token":38}
{"rval":0,"msg_id":9,"permission":"settable","param":"timelapse_video","options":["0.5","1","2","5","10","30","60"]}

{"msg_id":9,"param":"timelapse_video_duration","token":38}
{"rval":0,"msg_id":9,"permission":"settable","param":"timelapse_video_duration","options":["off","6s","8s","10s","20s","30s","60s","120s"]}

{"msg_id":9,"param":"record_photo_time","token":38}
{"rval":0,"msg_id":9,"permission":"settable","param":"record_photo_time","options":["5","10","30","60"]}

{"msg_id":9,"param":"loop_rec_duration","token":38}
{"rval":0,"msg_id":9,"permission":"settable","param":"loop_rec_duration","options":["5 minutes","20 minutes","60 minutes","120 minutes","max"]}

{"type":"app_status","msg_id":1,"token":38}
{"rval":0,"msg_id":1,"type":"app_status","param":"vf"}

{"msg_id":13,"token":38}
{"rval":0,"msg_id":13,"type":"adapter","param":100}

{"msg_id":259,"param":"none_force","token":38}
{"rval":0,"msg_id":259}

If anyone needed, I've released a MIT-licensed python library to control these cameras a long time ago:
https://github.com/Informatic/ambarpc/blob/master/ambarpc.py

@Nokius how did you create the tcpdump? Because of direct AP I don't find it that easy to log it. Thank you!