FC40 Camera – Reverse Engineering
Posted in Photography, Software on April 27th, 2014 at 21:42:16So, the Phantom FC40 comes with a wireless camera, controllable from an iPhone or Android phone. As adumbrated at hotrate.com, it’s a small device — about two inches by two inches, similar to the size of a GoPro if you cut off the ‘lens’ part. I think the camera is a stripped down version of a another wifi camera; at least, the specs, shape, etc. seem to match.
It records 720p video to a built-in SD Card, and is controllable via an App on the iPhone or Android. However, there’s no way to control it from a laptop, which sort of annoys me. I’d also like to experiment with linking the camera and doing live-streaming straight from the camera to the web — I think that would rock.
After doing some research, I found that it looks like the software on this camera is very similar to the wifi support on the GoPro: It uses an “Ambarella streaming” web-app hosted by Apache Coyote on the device. The device provides an RTSP stream, and in theory allows you to browse the files on the device and get access to them.
However, it appears that DJI stripped most of this functionality out — in a pretty hacky way, from what I can tell, leaving half-complete stuff and stubs. It has instead implemented its own hacky interface that you can use to control the camera, though it still does RTSP streaming to the phone application.
In trying to work with the camera, I learned the following things:
– The camera sets up a wifi access point, using 192.168.1.1 as its IP, and serves DHCP addresses starting with 192.168.1.100 to clients. It serves an HTTP server on port 80. (This is different than the GoPro which defaults to a different IP setup and runs on port 8080.)
– Most interaction to the camera is through posting of XML to /CGI/ calls.
– Most HTTP calls/functions in the camera require a “Cookie” called “Session” with a value in it. If they don’t have it, they simply return an Error code.
– To get a session, you post to “/CGI/CameraLogin?Device=Mobile&Stream=RTP_H264_WQVGA” with a ‘password=’ (blank) form value. This returns a set of data in XML (‘
– There is a CGI for RemoteControl
– There is a CGI for status.
I’ve put together some documentation for these and put them into a fc40 camera github repo. I’ll probably end up expanding it a bit more.
The most interesting thing, of course, is the live streaming of video. After poking it a bit, I did find out that it does RTSP streaming, and I was able to discover that VLC does, in theory, play RTSP streams. However, although the setup mostly works, when it tries to PLAY a stream via VLC, the camera immediately closes the connection. Having inspected packets, I believe the only difference is that the User-Agent is VLC instead of being blank/not included, which is apparently a not-unheard of trick for security-by-obscurity for RTSP streams. I have not yet gotten to the point where I can test this theory, but I’m working towards it.
I wish that DJI was a bit more open about these things, but maybe the reason they’re not is because they took the hardware from some OEM who didn’t want people to get this instead of a more expensive model… or instead of upgrading to a GoPro, which does have a pretty open setup out of the box where all these things ‘just work’. In any case, I figured I’d share what I learned for others to play with.