Differences

This shows you the differences between two versions of the page.

--- doc:appunti:hardware:insta360_one_rs_wifi_reverse_engineering [2023/07/11 11:36] – [Packets anatomy] niccolo
+++ doc:appunti:hardware:insta360_one_rs_wifi_reverse_engineering [2023/09/08 10:46] (current) – [Insta360: WiFi protocol reverse engineering] niccolo
@@ Line 1: / Line 1: @@
 ====== Insta360: WiFi protocol reverse engineering ======
-I purchased an **Insta360 ONE RS** action camera in June 2023, I'm rather satisfied by its performances, but I'm really disappointed by the accompanying Android app. The app (version 1.40.1) is a monster download of **676 Mb**, once installed it requires more than 1 Gb of storage. It is rather invasive about permissions request because it wants access to the camera (the phone's camera!), contacts, microphone and phone. Once started it is totally **social oriented**, presenting me **blatantly useless info** about what other people does with their cameras.
+Get the open source software from the **[[https://github.com/RigacciOrg/insta360-wifi-api/|RigacciOrg/insta360-wifi-api]]** GitHub repository.
+I purchased an **[[insta360_one_rs|Insta360 ONE RS]]** action camera in June 2023, I'm rather satisfied by its performances, but I'm really disappointed by the accompanying Android app. The app (version 1.40.1) is a monster download of **676 Mb**, once installed it requires more than 1 Gb of storage. It is rather invasive about permissions request because it wants access to the camera (the phone's camera!), contacts, microphone and phone. Once started it is totally **social oriented**, presenting me **blatantly useless info** about what other people does with their cameras.
 **What I need is a simple remote control** for my action camera, not another invasive and useless social network. Beside that, the app doesn't work on my phone; maybe because the hardware specs are not at the cutting edge of techonolgy (but neverthless my phone has 4 Gb of RAM and a 4 cores MediaTek Helio A22 SoC), whenever I tap the icon to start the live view the app crashes. So the basic function of remote controlo does not work.
@@ Line 46: / Line 48: @@
 ===== Packets anatomy =====
-=== Sent Packets ===
+==== Sent Packets ====
-^ Offset  ^ Content  ^ Bytes  ^
+=== Sync Packet ===
-|   0 | Packet Len        | 4  |
-|   4 | Message Code      | 2  |
-|   6 | 0x02              | 1  |
-|   7 | Sequence Number   | 3  |
-|  10 | 0x80 0x00 0x00    | 3  |
-|  13 | Protobuf Message  | Variable   |
+^ Offset  ^ Content  ^ Bytes  ^ Note  ^
+|   0 | Packet Length     | 4   | Overall length of the packet, including this 4 bytes.  |
+|   4 | 0x06 0x00 0x00    | 3   | Message Type: Sync Packet.  |
+|   7 | syNceNdinS        | 10  | Magic String.  |
+=== Keep Alive Packet ===
+^ Offset  ^ Content  ^ Bytes  ^ Note  ^
+|   0 | Packet Length     | 4   | Overall length of the packet, including this 4 bytes.  |
+|   4 | 0x05 0x00 0x00    | 3   | Message Type: Keep Alive.  |
+=== Phone Commands ===
+^ Offset  ^ Content  ^ Bytes  ^ Note  ^
+|   0 | Packet Length     | 4  | Overall length of the packet, including this 4 bytes.  |
+|   4 | 0x04 0x00 0x00    | 3  | Message Type: Phone Command.  |
+|   7 | Message Code      | 2  | Examples: PHONE_COMMAND_GET_OPTIONS, PHONE_COMMAND_SET_OPTIONS, PHONE_COMMAND_TAKE_PICTURE, PHONE_COMMAND_START_CAPTURE, etc.  |
+|   9 | 0x02              | 1  |
+|  10 | Sequence Number   | 3  | Each command sent to the camera have its increasing sequence number, the relative response contains the same sequence number.  |
+|  13 | 0x80 0x00 0x00    | 3  |
+|  16 | Protobuf Message  | Variable  | The message serialized using Protocol Buffers.  |
+==== Received Packets ====
+=== Notifications or Response to Phone Commands ===
+^ Offset  ^ Content  ^ Bytes  ^ Note  ^
+|   0 | Packet Length     | 4  | Overall length of the packet, including this 4 bytes.  |
+|   4 | 0x04 0x00 0x00    | 3  | Response Type: Phone Command.  |
+|   7 | Response Code     | 2  | Examples: 200: OK, 500: ERROR, CAMERA_NOTIFICATION_CURRENT_CAPTURE_STATUS, etc.  |
+|   9 | 0x02              | 1  |
+|  10 | Sequence Number   | 3  | Matches to the requesting message.  |
+|  13 | 0x80              | 1  |
+|  14 | Unknown           | 2  |  |
+|  16 | Protobuf Message  | Variable  | The response message serialized using Protocol Buffers.  |
-=== Received Packets ===
 ===== Inspecting the raw Protobuf messages =====
@@ Line 71: / Line 102: @@
 </code>
-Then **extract some protobuf binary messages from the tcpdump output**; in the following example we try to decode a binary message received from the camera by the Android app. It seems that each message is prefixed by a 12 bytes header (more on that later), so in the Python code strip that header away and keep only the message body before calling the ''protobuf_to_json()'' function:
+Then **extract some protobuf binary messages from the tcpdump output**; in the following example we try to decode a binary message received from the camera by the Android app. Each message is prefixed by a 12 bytes header (see packets anatomy, above), so in the Python code strip that header away and keep only the message body before calling the ''protobuf_to_json()'' function:
 <code python>
@@ Line 241: / Line 272: @@
 echo "Python files were compiled into the pb2 directory."
 </code>
+===== The Insta360 Python remote program =====
+On the **[[https://github.com/RigacciOrg/insta360-wifi-api/|insta360-wifi-api GitHub repository]]** you can find a Python library which implements basic communication with the Insta360 camera over WiFi connection. There is also an example Python program with the basic functionality of **remote control**. You can easily run it from a PC with GNU/Linux, but you can also install the required Python language and libraries in MS-Windows and even on Android. I run that program on my smartphone, it just required to install the **[[https://f-droid.org/en/packages/com.termux/|Termux]]** app.
+===== Unsolved Problems =====
+It seems **impossibile to change some settings via the WiFi API**; e.g. I was not able to change:
+  * Sharpness
+  * Prompt Sound
+  * Indicator Light (LEDs)
+When some settings are changed via the WiFi API, **the preview on the camera screen does not reflect that change**; nor in the live stream, nor into the on-screen-display labels. E.g. white balance, capture resolution, fielf of view. Fortunately if you start the video capture, the settings are effective.
+===== White Balance Settings =====
+It is possible to change the white balance setting by changing the value of **white_balance** choosing from some enumerated presets or directly by changing the temperature value of **white_balance_value**. There seems to be some inconsistency between the labels assigned to the presets in the .proto files and the actual temperature values. I think that the best choice is to assign the white_balance_value, ignoring the enumerated presets.
+^ white_balance_value  ^ white_balance  ^ Protobuf Enum Label  ^
+|   AUTO |   0 | WB_AUTO  |
+|   2000 |   6 |  |
+|   2200 |   7 |  |
+|   2400 |   8 |  |
+|   2600 |   9 |  |
+|   2800 |   1 | WB_2700K  |
+|   3000 |  10 |  |
+|   3200 |  11 |  |
+|   3400 |  12 |  |
+|   3600 |  13 |  |
+|   3800 |  14 |  |
+|   4000 |   2 | WB_4000K  |
+|   4500 |  15 |  |
+|   5000 |   5 | WB_7500K  |
+|   5500 |  16 |  |
+|   6000 |  17 |  |
+|   6500 |   3 | WB_5000K  |
+|   7000 |  18 |  |
+|   7500 |   4 | WB_6500K  |
+|   8000 |  19 |  |
+|   8500 |  20 |  |
+|   9000 |  21 |  |
+|   9500 |  22 |  |
+|  10000 |  23 |  |
 ===== Web References =====