Xiaomi Yi
#Xiaomi Yi camera
##General info
The root filesystem is rootfs
, which is stored in memory and therefore wiped on reboot. The Micro SD card is mounted at /tmp/fuse_d/
. Something is also mounted at /tmp/fuse_a
and /tmp/fuse_z
.
#WiFi AP
1234567890
192.168.42.1
##Nmap scan:
Opened ports on 192.168.42.1
Discovered open port 80/tcp on 192.168.42.1
Discovered open port 554/tcp on 192.168.42.1
Discovered open port 53/tcp on 192.168.42.1
Discovered open port 8787/tcp on 192.168.42.1
Discovered open port 7878/tcp on 192.168.42.1
##Shell access
To enable shell access you must create an empty file on the SD card named enable_info_display.script
.
Then you can connect to the camera using telnet:
telnet 192.168.42.1 23
You will be presented a login promt:
buildroot login:
Type root
and hit enter. You are now connected to the camera's root Linux shell
##Telnet commands Technically just a raw TCP socket connection, but it's easier to just call it telnet.
telnet 192.168.42.1 7878
###Meta Error messages sent by the camera:
{"rval": -7}
- Input is not a valid JSON object{"rval":-4,"msg_id":0}
- Input object is empty{"rval":-9,"msg_id":0}
- Input object is not a valid command###Token All requests require a token you have to request when connecting to the camera:
Request:
{"msg_id":257, "token":0}
Response:
{ "rval": 0, "msg_id": 257, "param": 1 }
param
is your token. All requests in this article have the token set to 1. This will be different for you.
###Config Request:
{"msg_id":3, "token":1}
Response:
NOTE: The config is a list of objects of settings, not just an object of settings. You have to use a loop!
{
"rval": 0,
"msg_id": 3,
"param": [
{"camera_clock": "2015-04-07 02:32:29"},
{"video_standard": "NTSC"},
{"app_status": "idle"},
{"video_resolution": "1920x1080 60P 16:9"},
{"video_stamp": "off"},
{"video_quality": "S.Fine"},
{"timelapse_video": "off"},
{"capture_mode": "precise quality"},
{"photo_size": "16M (4608x3456 4:3)"},
{"photo_stamp": "off"},
{"photo_quality": "S.Fine"},
{"timelapse_photo": "60"},
{"preview_status": "on"},
{"buzzer_volume": "mute"},
{"buzzer_ring": "off"},
{"capture_default_mode": "precise quality"},
{"precise_cont_time": "60.0 sec"},
{"burst_capture_number": "7 p / s"},
{"restore_factory_settings": "on"},
{"led_mode": "all enable"},
{"dev_reboot": "on"},
{"meter_mode": "center"},
{"sd_card_status": "insert"},
{"video_output_dev_type": "tv"},
{"sw_version": "YDXJv22_1.0.7_build-20150330113749_b690_i446_s699"},
{"hw_version": "YDXJ_v22"},
{"dual_stream_status": "on"},
{"streaming_status": "off"},
{"precise_cont_capturing": "off"},
{"piv_enable": "off"},
{"auto_low_light": "on"},
{"loop_record": "off"},
{"warp_enable": "off"},
{"support_auto_low_light": "on"},
{"precise_selftime": "5s"},
{"precise_self_running": "off"},
{"auto_power_off": "5 minutes"},
{"serial_number": "xxxxx"},
{"system_mode": "capture"},
{"system_default_mode": "capture"},
{"start_wifi_while_booted": "off"},
{"quick_record_time": "0"},
{"precise_self_remain_time": "0"},
{"sdcard_need_format": "no-need"},
{"video_rotate": "off"}
]
}
###Photo capture Request:
{"msg_id":769,"token":1}
Response:
{ "msg_id": 7, "type": "start_photo_capture", "param":"precise quality;off"}
{ "msg_id": 7, "type": "photo_taken", "param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0047.jpg"}
param
is the full path of the imageNOTE: To get the download URL of the image, replace
/tmp/fuse_d/
withhttp://192.168.42.1/
.
##Telnet events
All messages with msg_id: 7
are events and are sent automatically by the camera.
{ "msg_id": 7, "type": "<string: event name>"}
Some events also provide additional data in the param
attribute:
{ "msg_id": 7, "type": "<string: event name>", "param":"<int: event data>"}
Below is a list of known events, their parameters and an example for each
###Battery Fired when the battery level changes
{ "msg_id": 7, "type": "battery", "param":"20"}
type
is battery
when discharging and adapter
when chargingparam
is the battery charge percentage (int 1-100, obviously)###Charger status Fired when the USB charging cable is connected/disconnected
{ "msg_id": 7, "type": "adapter_status" ,"param":"1"}
param
:0
- cable disconnectedparam
:1
- cable connected###Camera mode switched Fired when the recording mode is changed (big button on the front)
{ "msg_id": 7, "type": "switch_to_rec_mode" }
type
:"switch_to_rec_mode"
- switched to video modetype
:"switch_to_cap_mode"
- switched to photo mode###Photo taken
{ "msg_id": 7, "type": "start_photo_capture" ,"param":"precise quality;off"}
{ "msg_id": 7, "type": "precise_capture_data_ready" }
{ "msg_id": 7, "type": "photo_taken" ,"param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0513.jpg"}
###SD Card status Fired when the SD card is inserted/removed
{ "msg_id": 7, "type": "sd_card_status" ,"param":"insert"}
type
:"insert"
- SD card insertedtype
:"remove"
- SD card removed
When SD card is removed, the following event also fires:{ "msg_id": 7, "type": "CARD_REMOVED" }
#Live view
After you've successfully authenticated through tenet, you can connect to rtsp://192.168.42.1:554/live
with VLC (or similar) to see the live view of the camera.
This doesn't always work. The only 100% way I know is to first connect with the official app.
##Unknown events
###Photo taken vf_start/stop
Fired after start_photo_capture
Best guess: stop live view
{ "msg_id": 7, "type": "vf_stop" }
Fired after photo_taken
Best guess: start live view
{ "msg_id": 7, "type": "vf_start" }
vf
== "viewfinder" ?
###Battery status This message has been observed when taking out the battery with the cam on USB power, but I haven't been able to reproduce it so far.
{ "msg_id": 7, "type": "battery_status" ,"param":"0"}
param
- observed values0
and -1