FC40 Camera - Reverse Engineering

So, the Phantom FC40 comes with a wireless camera, controllable from an iPhone or Android phone. It’s a small device — about two inches by two inches, similar to the size of a GoPro if you cut off the ‘lens’ part. I think the camera is a stripped down version of a another wifi camera; at least, the specs, shape, etc. seem to match.

It records 720p video to a built-in SD Card, and is controllable via an App on the iPhone or Android. However, there’s no way to control it from a laptop, which sort of annoys me. I’d also like to experiment with linking the camera and doing live-streaming straight from the camera to the web — I think that would rock.

After doing some research, I found that it looks like the software on this camera is very similar to the wifi support on the GoPro: It uses an “Ambarella streaming” web-app hosted by Apache Coyote on the device. The device provides an RTSP stream, and in theory allows you to browse the files on the device and get access to them.

However, it appears that DJI stripped most of this functionality out — in a pretty hacky way, from what I can tell, leaving half-complete stuff and stubs. It has instead implemented its own hacky interface that you can use to control the camera, though it still does RTSP streaming to the phone application.

In trying to work with the camera, I learned the following things:

- The camera sets up a wifi access point, using 192.168.1.1 as its IP, and serves DHCP addresses starting with 192.168.1.100 to clients. It serves an HTTP server on port 80. (This is different than the GoPro which defaults to a different IP setup and runs on port 8080.)
- Most interaction to the camera is through posting of XML to /CGI/ calls.
- Most HTTP calls/functions in the camera require a “Cookie” called “Session” with a value in it. If they don’t have it, they simply return an Error code.
- To get a session, you post to “/CGI/CameraLogin?Device=Mobile&Stream=RTP_H264_WQVGA” with a ‘password=’ (blank) form value. This returns a set of data in XML (’Login OKFC40_S7NO4621102U40_NO_CODEC A06‘) and also has a Set-Cookie header: ‘ Set-Cookie: Session=750997680′. However, the Set-Cookie header is preceded by a space, and therefore is not recognized by regular browsers; it seems the FC40 app knows to look for this, but this prevents trivial use of forms in browsers to replicate the functionality. (No idea if this is intentional or not.)
- There is a CGI for RemoteControl
- There is a CGI for status.

I’ve put together some documentation for these and put them into a fc40 camera github repo. I’ll probably end up expanding it a bit more.

The most interesting thing, of course, is the live streaming of video. After poking it a bit, I did find out that it does RTSP streaming, and I was able to discover that VLC does, in theory, play RTSP streams. However, although the setup mostly works, when it tries to PLAY a stream via VLC, the camera immediately closes the connection. Having inspected packets, I believe the only difference is that the User-Agent is VLC instead of being blank/not included, which is apparently a not-unheard of trick for security-by-obscurity for RTSP streams. I have not yet gotten to the point where I can test this theory, but I’m working towards it.

I wish that DJI was a bit more open about these things, but maybe the reason they’re not is because they took the hardware from some OEM who didn’t want people to get this instead of a more expensive model… or instead of upgrading to a GoPro, which does have a pretty open setup out of the box where all these things ‘just work’. In any case, I figured I’d share what I learned for others to play with.

13 Responses to “FC40 Camera - Reverse Engineering”

  1. Stephen Haskill Says:

    I read your post and on first reas through have the gist of your post. Perhaps you can steer me in the right direction. We, grandson and I, are trying to develop an agricultural use for a drone. I have a 15 acre vineyard that turkeys and bears love to visit. Yes , I know we could shoot them, but even if legal, it is really hard to see them first. Too much foliage and rolling hills. I bought a FC40 Phantom as a test vehicle to see if it would stay on a gps course and return home with video. Next step would be a big one. Either using image recognition or motion detection, could the drone stop, hover and then turn on the pizzoelectric alarm and then return to base. This is for real as I lost $10k to animals last season. Love to hear your thoughts on using the camera for this purpose.

  2. crschmidt Says:

    I probably wouldn’t use a drone for this.

    I would probably make an attempt to do this by using stationary motion detection and alarms. 15 acres suggests that you’re looking at something that’s about 800 feet on a side (though given it’s a vineyard, I’m sure it’s not square); it seems like if you were able to put something every 100 feet or so, you could install a network of 8 x 8 sirens, like this:

    http://www.ebay.com/itm/321214172393?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1439.l2649

    For the bears, it seems like you can actually just do perimiter detection and sirens; I don’t know if the turkeys are walking in or flying in, so that’s something you’d have to figure out.

    If you can hook these up to some kind of motion sensor, I feel like it would provide the best ability that you could get… I don’t have a good sense of how you’d do the sensing, but I’d try something like https://www.sparkfun.com/products/9196 and see if it fits your needs; build a set of mini vibration + alarms, scatter them on the edge of your property, and see if that helps…

    I think that overall, a drone is the wrong solution for this. If nothing else, I would say that you’d be better off installing a large pole with a stable camera on top for image processing, rather than a drone, which has extremely limited flight time and is way less stable. (Doing motion detection from a fixed camera is a pretty solved problem too, if you go that route.)

  3. Stephen Haskill Says:

    Thanks for the ideas. Thought about this approach but no electricity and a greater than one mile boundary fence. The property is like a dome, a bald but with no visibilty at ground level. Turkeys scare easily and are somewhat time dependent, early and late in the day. The bears are irregular. Never have seen one from a distance; usually turn a corner of vines and there he is. Part of the issue here is a projecy for my nerd gradson who i s into robotics in high school.
    Thanks

  4. Jonas Petrauskas Says:

    Hello!
    If you use linux you can do it with http://www.live555.com/openRTSP/
    I was having same issue, and my phone is not andoird or iphone, so here is solution to stream to laptop, if you have any question how-to feel free to ask.

  5. Jonas Petrauskas Says:

    Hello!
    I found easiest way to have dji camera application,
    Burn iso of android x86(it will work on any pc-laptop) to cd or usb =] enjoy
    http://www.android-x86.org

    P.S. you can run android os without installation. it will load app to ram.

  6. crschmidt Says:

    Jonas,

    I tried to email you, but the email you used appears to be bogus. I’m interested in any details you have on using openRTSP to get the video stream out. (My interest is less in control, and more in getting the live stream for other uses.)

    ====
    I’d be interested in any
    detials on how you got the streaming working. Connecting to the camera
    and using:

    ./live/testProgs/openRTSP -g ” rtsp://192.168.1.1/live

    Seems to work relatively well (sends PLAY requests, etc.), but I never
    see any data coming back; it creates two files:

    Created output file: “video-H264-1″
    Created output file: “audio-MPEG4-GENERIC-2″

    But then doesn’t actually fill them with any content. Is there a trick
    to it that I’m missing?
    ====

  7. Keith Says:

    DJI uses the miniturized cameras from Ambarella. They went from version A5S to A7 and now A9. The GoPro Hero 3 uses the A7 1080p60fps 1W with second streaming WiFi of lower resolution while the Hero White and Silver uses the earlier A5S 1080p30fps 650mW. The A9 puts out 1080p120fps 2W plus again the second lower res streaming WiFi. I have not opened up the FC40 to see what number is on the Ambarella chip; but, suspect its the A5S. I will soon have an FC40 and intend to open it up working toward a better WiFi signal output.

  8. Joe Says:

    Hi.

    I am wondering how the wifi Works on this camera…?
    Is it allways activated ?….or will it be activated once you turn on wifi on Your phone/tablet..?

    Some People say that this camera can be mounted as a “Upgrade” to the phantom1…. but that one is running on 2,4 Ghz, so i fear that there can be interference..?

  9. crschmidt Says:

    Joe,

    When the camera is on, the Wifi is activated, yes.

    I agree that mounting this on a P1 would be a risky move. That said, assuming you are not *using* the wifi, the effect should be diminished to the point that it is not a significant issue with controlling the P1; interference is generally caused by the broadcast traffic, but so long as you aren’t connecting to the camera, it will only be doing the very minimal traffic in respond to SSID scans and the like, rather than transmitting video.

    You might be better off buying an older GoPro, though: the image quality is probably going to be slightly better, and you won’t have the risk of having issues with the Wifi.

    Best of luck.

  10. Rob Says:

    Hi there, I’m trying to figure out, how to save the fc40’s photographs, actually into my iPhone 5 memory, I have taken some pics and whilst still in wifi mode, with the camera on, I have clicked save to mobile, when I go in my gallery, there are no new photos in there, I have print screened to achieve the photos in the gallery, but that’s not ideal. Is this to do with them being in jpg form. Is it something I’m missing.

  11. Jim Says:

    Great info! Looking forward to progress. I too would love to be able to stream the FC40 video to a Windows laptop. I tried to use Bluestacks Android for Windows app and the FC40 apk, but it will not connect. Interestingly I have found that Bluestacks Andriod Windows app will work with the DJI Vision cameras. So not sure why it will not connect with the FC40…
    Cheers,
    Jim

  12. Alan Shields Says:

    II have successfully got control of the FC40 camera using Curl, but I want to stream to my MacBook using VLC. I know you have had issues, but can you tell me what URL your are using i.e. rtsp:/192.168.1.1/????

    Many thanks.

  13. Jerry Says:

    I have the FC40 and am wanting to put the Phantom 2 Vision camera on there. Has anyone tried this or knows how to do this. Is it possible?

Leave a Reply