- OS: Buildroot
- CPU: ARMv6-compatible processor rev 5 (v6l)
- BogoMIPS: 524.28
- Memory: 37MB
The root filesystem is rootfs, which is stored in memory and therefore wiped on reboot. The Micro SD card is mounted at /tmp/fuse_d/. Something is also mounted at /tmp/fuse_a and /tmp/fuse_z.
- SSID: YDXJ_[last 7 digits of SN]
- Default pass:
1234567890 - Securtiy: WPA2-Personal
- Camera IP:
192.168.42.1
Opened ports on 192.168.42.1
Discovered open port 80/tcp on 192.168.42.1
Discovered open port 554/tcp on 192.168.42.1
Discovered open port 53/tcp on 192.168.42.1
Discovered open port 8787/tcp on 192.168.42.1
Discovered open port 7878/tcp on 192.168.42.1##Shell access
To enable shell access you must create an empty file on the SD card named enable_info_display.script.
Then you can connect to the camera using telnet:
telnet 192.168.42.1 23You will be presented a login promt:
buildroot login:
Type root and hit enter. You are now connected to the camera's root Linux shell
Technically just a raw TCP socket connection, but it's easier to just call it telnet.
telnet 192.168.42.1 7878Error messages sent by the camera:
{"rval": -7}- Input is not a valid JSON object{"rval":-4,"msg_id":0}- Input object is empty{"rval":-9,"msg_id":0}- Input object is not a valid command
All requests require a token you have to request when connecting to the camera:
Request:
{"msg_id":257, "token":0}Response:
{ "rval": 0, "msg_id": 257, "param": 1 }param is your token. All requests in this article have the token set to 1. This will be different for you.
Request:
{"msg_id":3, "token":1} Response:
NOTE: The config is a list of objects of settings, not just an object of settings. You have to use a loop!
{
"rval": 0,
"msg_id": 3,
"param": [
{"camera_clock": "2015-04-07 02:32:29"},
{"video_standard": "NTSC"},
{"app_status": "idle"},
{"video_resolution": "1920x1080 60P 16:9"},
{"video_stamp": "off"},
{"video_quality": "S.Fine"},
{"timelapse_video": "off"},
{"capture_mode": "precise quality"},
{"photo_size": "16M (4608x3456 4:3)"},
{"photo_stamp": "off"},
{"photo_quality": "S.Fine"},
{"timelapse_photo": "60"},
{"preview_status": "on"},
{"buzzer_volume": "mute"},
{"buzzer_ring": "off"},
{"capture_default_mode": "precise quality"},
{"precise_cont_time": "60.0 sec"},
{"burst_capture_number": "7 p / s"},
{"restore_factory_settings": "on"},
{"led_mode": "all enable"},
{"dev_reboot": "on"},
{"meter_mode": "center"},
{"sd_card_status": "insert"},
{"video_output_dev_type": "tv"},
{"sw_version": "YDXJv22_1.0.7_build-20150330113749_b690_i446_s699"},
{"hw_version": "YDXJ_v22"},
{"dual_stream_status": "on"},
{"streaming_status": "off"},
{"precise_cont_capturing": "off"},
{"piv_enable": "off"},
{"auto_low_light": "on"},
{"loop_record": "off"},
{"warp_enable": "off"},
{"support_auto_low_light": "on"},
{"precise_selftime": "5s"},
{"precise_self_running": "off"},
{"auto_power_off": "5 minutes"},
{"serial_number": "xxxxx"},
{"system_mode": "capture"},
{"system_default_mode": "capture"},
{"start_wifi_while_booted": "off"},
{"quick_record_time": "0"},
{"precise_self_remain_time": "0"},
{"sdcard_need_format": "no-need"},
{"video_rotate": "off"}
]
}Request:
{"msg_id":769,"token":1}Response:
{ "msg_id": 7, "type": "start_photo_capture", "param":"precise quality;off"}{ "msg_id": 7, "type": "photo_taken", "param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0047.jpg"}paramis the full path of the image
NOTE: To get the download URL of the image, replace
/tmp/fuse_d/withhttp://192.168.42.1/.
All messages with msg_id: 7 are events and are sent automatically by the camera.
{ "msg_id": 7, "type": "<string: event name>"}Some events also provide additional data in the param attribute:
{ "msg_id": 7, "type": "<string: event name>", "param":"<int: event data>"}Below is a list of known events, their parameters and an example for each
Fired when the battery level changes
{ "msg_id": 7, "type": "battery", "param":"20"}typeisbatterywhen discharging andadapterwhen chargingparamis the battery charge percentage (int 1-100, obviously)
Fired when the USB charging cable is connected/disconnected
{ "msg_id": 7, "type": "adapter_status" ,"param":"1"}param:0- cable disconnectedparam:1- cable connected
Fired when the recording mode is changed (big button on the front)
{ "msg_id": 7, "type": "switch_to_rec_mode" }type:"switch_to_rec_mode"- switched to video modetype:"switch_to_cap_mode"- switched to photo mode
{ "msg_id": 7, "type": "start_photo_capture" ,"param":"precise quality;off"}{ "msg_id": 7, "type": "precise_capture_data_ready" }{ "msg_id": 7, "type": "photo_taken" ,"param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0513.jpg"}Fired when the SD card is inserted/removed
{ "msg_id": 7, "type": "sd_card_status" ,"param":"insert"}type:"insert"- SD card insertedtype:"remove"- SD card removed When SD card is removed, the following event also fires:
{ "msg_id": 7, "type": "CARD_REMOVED" }After you've successfully authenticated through telnet, you can connect to rtsp://192.168.42.1:554/live with VLC (or similar) to see the live view of the camera.
This doesn't always work. The only 100% way I know is to first connect with the official app.
Fired after start_photo_capture
Best guess: stop live view
{ "msg_id": 7, "type": "vf_stop" }Fired after photo_taken
Best guess: start live view
{ "msg_id": 7, "type": "vf_start" }vf == "viewfinder" ?
This message has been observed when taking out the battery with the cam on USB power, but I haven't been able to reproduce it so far.
{ "msg_id": 7, "type": "battery_status" ,"param":"0"}param- observed values0and-1
can you give an example with nc reading from stdin more than one line?
I'm trying without any success something like this: