- OS: Buildroot
- CPU: ARMv6-compatible processor rev 5 (v6l)
- BogoMIPS: 524.28
- Memory: 37MB
The root filesystem is rootfs, which is stored in memory and therefore wiped on reboot. The Micro SD card is mounted at /tmp/fuse_d/. Something is also mounted at /tmp/fuse_a and /tmp/fuse_z.
- SSID: YDXJ_[last 7 digits of SN]
- Default pass:
1234567890 - Securtiy: WPA2-Personal
- Camera IP:
192.168.42.1
Opened ports on 192.168.42.1
Discovered open port 80/tcp on 192.168.42.1
Discovered open port 554/tcp on 192.168.42.1
Discovered open port 53/tcp on 192.168.42.1
Discovered open port 8787/tcp on 192.168.42.1
Discovered open port 7878/tcp on 192.168.42.1##Shell access
To enable shell access you must create an empty file on the SD card named enable_info_display.script.
Then you can connect to the camera using telnet:
telnet 192.168.42.1 23You will be presented a login promt:
buildroot login:
Type root and hit enter. You are now connected to the camera's root Linux shell
Technically just a raw TCP socket connection, but it's easier to just call it telnet.
telnet 192.168.42.1 7878Error messages sent by the camera:
{"rval": -7}- Input is not a valid JSON object{"rval":-4,"msg_id":0}- Input object is empty{"rval":-9,"msg_id":0}- Input object is not a valid command
All requests require a token you have to request when connecting to the camera:
Request:
{"msg_id":257, "token":0}Response:
{ "rval": 0, "msg_id": 257, "param": 1 }param is your token. All requests in this article have the token set to 1. This will be different for you.
Request:
{"msg_id":3, "token":1} Response:
NOTE: The config is a list of objects of settings, not just an object of settings. You have to use a loop!
{
"rval": 0,
"msg_id": 3,
"param": [
{"camera_clock": "2015-04-07 02:32:29"},
{"video_standard": "NTSC"},
{"app_status": "idle"},
{"video_resolution": "1920x1080 60P 16:9"},
{"video_stamp": "off"},
{"video_quality": "S.Fine"},
{"timelapse_video": "off"},
{"capture_mode": "precise quality"},
{"photo_size": "16M (4608x3456 4:3)"},
{"photo_stamp": "off"},
{"photo_quality": "S.Fine"},
{"timelapse_photo": "60"},
{"preview_status": "on"},
{"buzzer_volume": "mute"},
{"buzzer_ring": "off"},
{"capture_default_mode": "precise quality"},
{"precise_cont_time": "60.0 sec"},
{"burst_capture_number": "7 p / s"},
{"restore_factory_settings": "on"},
{"led_mode": "all enable"},
{"dev_reboot": "on"},
{"meter_mode": "center"},
{"sd_card_status": "insert"},
{"video_output_dev_type": "tv"},
{"sw_version": "YDXJv22_1.0.7_build-20150330113749_b690_i446_s699"},
{"hw_version": "YDXJ_v22"},
{"dual_stream_status": "on"},
{"streaming_status": "off"},
{"precise_cont_capturing": "off"},
{"piv_enable": "off"},
{"auto_low_light": "on"},
{"loop_record": "off"},
{"warp_enable": "off"},
{"support_auto_low_light": "on"},
{"precise_selftime": "5s"},
{"precise_self_running": "off"},
{"auto_power_off": "5 minutes"},
{"serial_number": "xxxxx"},
{"system_mode": "capture"},
{"system_default_mode": "capture"},
{"start_wifi_while_booted": "off"},
{"quick_record_time": "0"},
{"precise_self_remain_time": "0"},
{"sdcard_need_format": "no-need"},
{"video_rotate": "off"}
]
}Request:
{"msg_id":769,"token":1}Response:
{ "msg_id": 7, "type": "start_photo_capture", "param":"precise quality;off"}{ "msg_id": 7, "type": "photo_taken", "param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0047.jpg"}paramis the full path of the image
NOTE: To get the download URL of the image, replace
/tmp/fuse_d/withhttp://192.168.42.1/.
All messages with msg_id: 7 are events and are sent automatically by the camera.
{ "msg_id": 7, "type": "<string: event name>"}Some events also provide additional data in the param attribute:
{ "msg_id": 7, "type": "<string: event name>", "param":"<int: event data>"}Below is a list of known events, their parameters and an example for each
Fired when the battery level changes
{ "msg_id": 7, "type": "battery", "param":"20"}typeisbatterywhen discharging andadapterwhen chargingparamis the battery charge percentage (int 1-100, obviously)
Fired when the USB charging cable is connected/disconnected
{ "msg_id": 7, "type": "adapter_status" ,"param":"1"}param:0- cable disconnectedparam:1- cable connected
Fired when the recording mode is changed (big button on the front)
{ "msg_id": 7, "type": "switch_to_rec_mode" }type:"switch_to_rec_mode"- switched to video modetype:"switch_to_cap_mode"- switched to photo mode
{ "msg_id": 7, "type": "start_photo_capture" ,"param":"precise quality;off"}{ "msg_id": 7, "type": "precise_capture_data_ready" }{ "msg_id": 7, "type": "photo_taken" ,"param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0513.jpg"}Fired when the SD card is inserted/removed
{ "msg_id": 7, "type": "sd_card_status" ,"param":"insert"}type:"insert"- SD card insertedtype:"remove"- SD card removed When SD card is removed, the following event also fires:
{ "msg_id": 7, "type": "CARD_REMOVED" }After you've successfully authenticated through telnet, you can connect to rtsp://192.168.42.1:554/live with VLC (or similar) to see the live view of the camera.
This doesn't always work. The only 100% way I know is to first connect with the official app.
Fired after start_photo_capture
Best guess: stop live view
{ "msg_id": 7, "type": "vf_stop" }Fired after photo_taken
Best guess: start live view
{ "msg_id": 7, "type": "vf_start" }vf == "viewfinder" ?
This message has been observed when taking out the battery with the cam on USB power, but I haven't been able to reproduce it so far.
{ "msg_id": 7, "type": "battery_status" ,"param":"0"}param- observed values0and-1
I don't know if it is, but getting the latency much lower than WiFi probably isn't easy. If the hardware allows it, you could try to forward the socket over USB using Linux gadgets, but the latency probably comes earlier in the pipeline. An HDMI capture card will be your best bet there - you can get some surprisingly good ones for 12$ on various Chinese sites.