gaiar
8/4/2018 - 12:48 PM

Xiaomi Yi

Xiaomi Yi

#Xiaomi Yi camera

##General info

  • OS: Buildroot
  • CPU: ARMv6-compatible processor rev 5 (v6l)
  • BogoMIPS: 524.28
  • Memory: 37MB

The root filesystem is rootfs, which is stored in memory and therefore wiped on reboot. The Micro SD card is mounted at /tmp/fuse_d/. Something is also mounted at /tmp/fuse_a and /tmp/fuse_z.

#WiFi AP

  • SSID: YDXJ_[last 7 digits of SN]
  • Default pass: 1234567890
  • Securtiy: WPA2-Personal
  • Camera IP: 192.168.42.1

##Nmap scan:

Opened ports on 192.168.42.1
Discovered open port 80/tcp on 192.168.42.1
Discovered open port 554/tcp on 192.168.42.1
Discovered open port 53/tcp on 192.168.42.1
Discovered open port 8787/tcp on 192.168.42.1
Discovered open port 7878/tcp on 192.168.42.1

##Shell access To enable shell access you must create an empty file on the SD card named enable_info_display.script. Then you can connect to the camera using telnet:

telnet 192.168.42.1 23

You will be presented a login promt:

buildroot login: 

Type root and hit enter. You are now connected to the camera's root Linux shell


##Telnet commands Technically just a raw TCP socket connection, but it's easier to just call it telnet.

telnet 192.168.42.1 7878

###Meta Error messages sent by the camera:

  • {"rval": -7} - Input is not a valid JSON object
  • {"rval":-4,"msg_id":0} - Input object is empty
  • {"rval":-9,"msg_id":0} - Input object is not a valid command

###Token All requests require a token you have to request when connecting to the camera:

Request:

{"msg_id":257, "token":0}

Response:

{ "rval": 0, "msg_id": 257, "param": 1 }

param is your token. All requests in this article have the token set to 1. This will be different for you.

###Config Request:

{"msg_id":3, "token":1} 

Response:

NOTE: The config is a list of objects of settings, not just an object of settings. You have to use a loop!

{
    "rval": 0,
    "msg_id": 3,
    "param": [
        {"camera_clock": "2015-04-07 02:32:29"},
        {"video_standard": "NTSC"},
        {"app_status": "idle"},
        {"video_resolution": "1920x1080 60P 16:9"},
        {"video_stamp": "off"},
        {"video_quality": "S.Fine"},
        {"timelapse_video": "off"},
        {"capture_mode": "precise quality"},
        {"photo_size": "16M (4608x3456 4:3)"},
        {"photo_stamp": "off"},
        {"photo_quality": "S.Fine"},
        {"timelapse_photo": "60"},
        {"preview_status": "on"},
        {"buzzer_volume": "mute"},
        {"buzzer_ring": "off"},
        {"capture_default_mode": "precise quality"},
        {"precise_cont_time": "60.0 sec"},
        {"burst_capture_number": "7 p / s"},
        {"restore_factory_settings": "on"},
        {"led_mode": "all enable"},
        {"dev_reboot": "on"},
        {"meter_mode": "center"},
        {"sd_card_status": "insert"},
        {"video_output_dev_type": "tv"},
        {"sw_version": "YDXJv22_1.0.7_build-20150330113749_b690_i446_s699"},
        {"hw_version": "YDXJ_v22"},
        {"dual_stream_status": "on"},
        {"streaming_status": "off"},
        {"precise_cont_capturing": "off"},
        {"piv_enable": "off"},
        {"auto_low_light": "on"},
        {"loop_record": "off"},
        {"warp_enable": "off"},
        {"support_auto_low_light": "on"},
        {"precise_selftime": "5s"},
        {"precise_self_running": "off"},
        {"auto_power_off": "5 minutes"},
        {"serial_number": "xxxxx"},
        {"system_mode": "capture"},
        {"system_default_mode": "capture"},
        {"start_wifi_while_booted": "off"},
        {"quick_record_time": "0"},
        {"precise_self_remain_time": "0"},
        {"sdcard_need_format": "no-need"},
        {"video_rotate": "off"}
    ]
}

###Photo capture Request:

{"msg_id":769,"token":1}

Response:

{ "msg_id": 7, "type": "start_photo_capture", "param":"precise quality;off"}
{ "msg_id": 7, "type": "photo_taken", "param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0047.jpg"}
  • param is the full path of the image

NOTE: To get the download URL of the image, replace /tmp/fuse_d/ with http://192.168.42.1/.

##Telnet events All messages with msg_id: 7 are events and are sent automatically by the camera.

{ "msg_id": 7, "type": "<string: event name>"}

Some events also provide additional data in the param attribute:

{ "msg_id": 7, "type": "<string: event name>", "param":"<int: event data>"}

Below is a list of known events, their parameters and an example for each

###Battery Fired when the battery level changes

{ "msg_id": 7, "type": "battery", "param":"20"}
  • type is battery when discharging and adapter when charging
  • param is the battery charge percentage (int 1-100, obviously)

###Charger status Fired when the USB charging cable is connected/disconnected

{ "msg_id": 7, "type": "adapter_status" ,"param":"1"}
  • param:0 - cable disconnected
  • param:1 - cable connected

###Camera mode switched Fired when the recording mode is changed (big button on the front)

{ "msg_id": 7, "type": "switch_to_rec_mode" }
  • type:"switch_to_rec_mode" - switched to video mode
  • type:"switch_to_cap_mode" - switched to photo mode

###Photo taken

{ "msg_id": 7, "type": "start_photo_capture" ,"param":"precise quality;off"}
{ "msg_id": 7, "type": "precise_capture_data_ready" }
{ "msg_id": 7, "type": "photo_taken" ,"param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0513.jpg"}

###SD Card status Fired when the SD card is inserted/removed

{ "msg_id": 7, "type": "sd_card_status" ,"param":"insert"}
  • type:"insert" - SD card inserted
  • type:"remove" - SD card removed When SD card is removed, the following event also fires:
{ "msg_id": 7, "type": "CARD_REMOVED" }

#Live view After you've successfully authenticated through tenet, you can connect to rtsp://192.168.42.1:554/live with VLC (or similar) to see the live view of the camera.

This doesn't always work. The only 100% way I know is to first connect with the official app.

##Unknown events ###Photo taken vf_start/stop Fired after start_photo_capture Best guess: stop live view

{ "msg_id": 7, "type": "vf_stop" }

Fired after photo_taken Best guess: start live view

{ "msg_id": 7, "type": "vf_start" }

vf == "viewfinder" ?

###Battery status This message has been observed when taking out the battery with the cam on USB power, but I haven't been able to reproduce it so far.

{ "msg_id": 7, "type": "battery_status" ,"param":"0"}
  • param - observed values0 and -1