Skip to content

Instantly share code, notes, and snippets.

@x1unix

x1unix/Xiaomi YI.md

Forked from franga2000/Xiaomi YI.md
Created February 8, 2020 18:33
Download ZIP

Revisions

  1. @franga2000 franga2000 revised this gist Aug 2, 2019. 1 changed file with 20 additions and 21 deletions.
    41 changes: 20 additions & 21 deletions Xiaomi YI.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,22 +1,21 @@
    #Xiaomi Yi camera
    # Xiaomi Yi camera

    ##General info
    ## General info
    - **OS:** [Buildroot](http://buildroot.uclibc.org/)
    - **CPU:** ARMv6-compatible processor rev 5 (v6l)
    - **BogoMIPS:** 524.28
    - **Memory:** 37MB

    The root filesystem is `rootfs`, which is stored in memory and therefore wiped on reboot. The Micro SD card is mounted at `/tmp/fuse_d/`. Something is also mounted at `/tmp/fuse_a` and `/tmp/fuse_z`.

    #WiFi AP
    # WiFi AP
    - **SSID:** YDXJ_[last 7 digits of SN]
    - **Default pass:** `1234567890`
    - **Securtiy:** WPA2-Personal
    - **Camera IP:** `192.168.42.1`



    ##Nmap scan:
    ## Nmap scan:
    ```json
    Opened ports on 192.168.42.1
    Discovered open port 80/tcp on 192.168.42.1
    @@ -38,19 +37,19 @@ buildroot login:
    ```
    Type `root` and hit enter. You are now connected to the camera's root Linux shell
    ___
    ##Telnet commands
    ## Telnet commands
    Technically just a raw TCP socket connection, but it's easier to just call it telnet.
    ```sh
    telnet 192.168.42.1 7878
    ```
    ###Meta
    ### Meta
    Error messages sent by the camera:

    - `{"rval": -7}` - Input is not a valid JSON object
    - `{"rval":-4,"msg_id":0}` - Input object is empty
    - `{"rval":-9,"msg_id":0}` - Input object is not a valid command

    ###Token
    ### Token
    All requests require a token you have to request when connecting to the camera:

    **Request:**
    @@ -63,7 +62,7 @@ All requests require a token you have to request when connecting to the camera:
    ```
    `param` is your token. All requests in this article have the token set to 1. This will be different for you.

    ###Config
    ### Config
    **Request:**
    ```json
    {"msg_id":3, "token":1}
    @@ -125,7 +124,7 @@ All requests require a token you have to request when connecting to the camera:
    ]
    }
    ```
    ###Photo capture
    ### Photo capture
    **Request:**
    ```json
    {"msg_id":769,"token":1}
    @@ -143,7 +142,7 @@ All requests require a token you have to request when connecting to the camera:


    ##Telnet events
    ## Telnet events
    All messages with `msg_id: 7` are events and are sent automatically by the camera.
    ```json
    { "msg_id": 7, "type": "<string: event name>"}
    @@ -154,31 +153,31 @@ Some events also provide additional data in the `param` attribute:
    ```
    Below is a list of known events, their parameters and an example for each

    ###Battery
    ### Battery
    Fired when the battery level changes
    ```json
    { "msg_id": 7, "type": "battery", "param":"20"}
    ```
    - `type` is `battery` when discharging and `adapter` when charging
    - `param` is the battery charge percentage (int 1-100, obviously)

    ###Charger status
    ### Charger status
    Fired when the USB charging cable is connected/disconnected
    ```json
    { "msg_id": 7, "type": "adapter_status" ,"param":"1"}
    ```
    - `param`:`0` - cable **disconnected**
    - `param`:`1` - cable **connected**

    ###Camera mode switched
    ### Camera mode switched
    Fired when the recording mode is changed (big button on the front)
    ```json
    { "msg_id": 7, "type": "switch_to_rec_mode" }
    ```
    - `type`:`"switch_to_rec_mode"` - switched to **video mode**
    - `type`:`"switch_to_cap_mode"` - switched to **photo mode**

    ###Photo taken
    ### Photo taken
    ```json
    { "msg_id": 7, "type": "start_photo_capture" ,"param":"precise quality;off"}
    ```
    @@ -189,7 +188,7 @@ Fired when the recording mode is changed (big button on the front)
    { "msg_id": 7, "type": "photo_taken" ,"param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0513.jpg"}
    ```

    ###SD Card status
    ### SD Card status
    Fired when the SD card is inserted/removed
    ```json
    { "msg_id": 7, "type": "sd_card_status" ,"param":"insert"}
    @@ -201,14 +200,14 @@ When SD card is removed, the following event also fires:
    { "msg_id": 7, "type": "CARD_REMOVED" }
    ```

    #Live view
    *After you've successfully authenticated through tenet*, you can connect to `rtsp://192.168.42.1:554/live` with VLC (or similar) to see the live view of the camera.
    # Live view
    *After you've successfully authenticated through telnet*, you can connect to `rtsp://192.168.42.1:554/live` with VLC (or similar) to see the live view of the camera.

    > This doesn't always work. The only 100% way I know is to first connect with the official app.

    ##Unknown events
    ###Photo taken `vf_start/stop`
    ## Unknown events
    ### Photo taken `vf_start/stop`
    Fired after `start_photo_capture`
    Best guess: stop live view
    ```json
    @@ -222,7 +221,7 @@ Best guess: start live view
    ```
    `vf` == "viewfinder" **?**

    ###Battery status
    ### Battery status
    This message has been observed when taking out the battery with the cam on USB power, but I haven't been able to reproduce it so far.
    ```json
    { "msg_id": 7, "type": "battery_status" ,"param":"0"}
  2. @franga2000 franga2000 revised this gist Jul 6, 2016. 1 changed file with 9 additions and 17 deletions.
    26 changes: 9 additions & 17 deletions Xiaomi YI.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,26 +1,18 @@
    #Xiaomi Yi camera

    ##General info
    **OS:** [Buildroot](http://buildroot.uclibc.org/)
    - **OS:** [Buildroot](http://buildroot.uclibc.org/)
    - **CPU:** ARMv6-compatible processor rev 5 (v6l)
    - **BogoMIPS:** 524.28
    - **Memory:** 37MB

    **CPU:** ARMv6-compatible processor rev 5 (v6l)

    **CPU Clock:**

    **BogoMIPS:** 524.28

    **Memory:** 37MB

    The Micro SD card is mountd at `/tmp/fuse_d/`
    The root filesystem is `rootfs`, which is stored in memory and therefore wiped on reboot. The Micro SD card is mounted at `/tmp/fuse_d/`. Something is also mounted at `/tmp/fuse_a` and `/tmp/fuse_z`.

    #WiFi AP
    **SSID:** YDXJ_[last 7 digits of SN]

    **Default pass:** `1234567890`

    **Securtiy:** WPA2-Personal

    **Camera IP:** `192.168.42.1`
    - **SSID:** YDXJ_[last 7 digits of SN]
    - **Default pass:** `1234567890`
    - **Securtiy:** WPA2-Personal
    - **Camera IP:** `192.168.42.1`



  3. @franga2000 franga2000 revised this gist Jul 6, 2016. 1 changed file with 6 additions and 2 deletions.
    8 changes: 6 additions & 2 deletions Xiaomi YI.md
    View file
    Original file line number Diff line number Diff line change
    @@ -52,7 +52,8 @@ Technically just a raw TCP socket connection, but it's easier to just call it te
    telnet 192.168.42.1 7878
    ```
    ###Meta
    Error messages sent by the cam
    Error messages sent by the camera:

    - `{"rval": -7}` - Input is not a valid JSON object
    - `{"rval":-4,"msg_id":0}` - Input object is empty
    - `{"rval":-9,"msg_id":0}` - Input object is not a valid command
    @@ -209,7 +210,10 @@ When SD card is removed, the following event also fires:
    ```

    #Live view
    After you've successfully authenticated through tenet, you can connect to `rtsp://192.168.42.1:554/live` with VLC (or similar) to see the live view of the camera.
    *After you've successfully authenticated through tenet*, you can connect to `rtsp://192.168.42.1:554/live` with VLC (or similar) to see the live view of the camera.

    > This doesn't always work. The only 100% way I know is to first connect with the official app.

    ##Unknown events
    ###Photo taken `vf_start/stop`
  4. @franga2000 franga2000 revised this gist Jul 6, 2016. No changes.
  5. @franga2000 franga2000 revised this gist Jul 6, 2016. 1 changed file with 15 additions and 6 deletions.
    21 changes: 15 additions & 6 deletions Xiaomi YI.md
    View file
    Original file line number Diff line number Diff line change
    @@ -2,18 +2,28 @@

    ##General info
    **OS:** [Buildroot](http://buildroot.uclibc.org/)

    **CPU:** ARMv6-compatible processor rev 5 (v6l)

    **CPU Clock:**

    **BogoMIPS:** 524.28

    **Memory:** 37MB

    The Micro SD card is mountd at `/tmp/fuse_d/`

    #WiFi AP
    **SSID:** YDXJ_[last 7 digits of SN]

    **Default pass:** `1234567890`

    **Securtiy:** WPA2-Personal

    **Camera IP:** `192.168.42.1`



    ##Nmap scan:
    ```json
    Opened ports on 192.168.42.1
    @@ -27,7 +37,7 @@ Discovered open port 7878/tcp on 192.168.42.1
    ##Shell access
    To enable shell access you must create an empty file on the SD card named `enable_info_display.script`.
    Then you can connect to the camera using telnet:
    ```sh
    ```shell
    telnet 192.168.42.1 23
    ```
    You will be presented a login promt:
    @@ -49,6 +59,7 @@ Error messages sent by the cam

    ###Token
    All requests require a token you have to request when connecting to the camera:

    **Request:**
    ```json
    {"msg_id":257, "token":0}
    @@ -128,12 +139,13 @@ All requests require a token you have to request when connecting to the camera:
    ```
    **Response:**
    ```json
    { "msg_id": 7, "type": "start_photo_capture" ,"param":"precise quality;off"}
    { "msg_id": 7, "type": "start_photo_capture", "param":"precise quality;off"}
    ```
    ```json
    { "msg_id": 7, "type": "photo_taken" "param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0047.jpg"}
    { "msg_id": 7, "type": "photo_taken", "param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0047.jpg"}
    ```
    - `param` is the full path of the image

    > **NOTE:** To get the download URL of the image, replace `/tmp/fuse_d/` with `http://192.168.42.1/`.

    @@ -157,9 +169,6 @@ Fired when the battery level changes
    - `type` is `battery` when discharging and `adapter` when charging
    - `param` is the battery charge percentage (int 1-100, obviously)

    ####Special cases
    - `type:adapter, param:0` has been observed when

    ###Charger status
    Fired when the USB charging cable is connected/disconnected
    ```json
  6. @franga2000 franga2000 revised this gist Jul 6, 2016. No changes.
  7. @franga2000 franga2000 created this gist Jul 6, 2016.
    225 changes: 225 additions & 0 deletions Xiaomi YI.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,225 @@
    #Xiaomi Yi camera

    ##General info
    **OS:** [Buildroot](http://buildroot.uclibc.org/)
    **CPU:** ARMv6-compatible processor rev 5 (v6l)
    **CPU Clock:**
    **BogoMIPS:** 524.28
    **Memory:** 37MB

    #WiFi AP
    **SSID:** YDXJ_[last 7 digits of SN]
    **Default pass:** `1234567890`
    **Securtiy:** WPA2-Personal
    **Camera IP:** `192.168.42.1`


    ##Nmap scan:
    ```json
    Opened ports on 192.168.42.1
    Discovered open port 80/tcp on 192.168.42.1
    Discovered open port 554/tcp on 192.168.42.1
    Discovered open port 53/tcp on 192.168.42.1
    Discovered open port 8787/tcp on 192.168.42.1
    Discovered open port 7878/tcp on 192.168.42.1
    ```

    ##Shell access
    To enable shell access you must create an empty file on the SD card named `enable_info_display.script`.
    Then you can connect to the camera using telnet:
    ```sh
    telnet 192.168.42.1 23
    ```
    You will be presented a login promt:
    ```
    buildroot login:
    ```
    Type `root` and hit enter. You are now connected to the camera's root Linux shell
    ___
    ##Telnet commands
    Technically just a raw TCP socket connection, but it's easier to just call it telnet.
    ```sh
    telnet 192.168.42.1 7878
    ```
    ###Meta
    Error messages sent by the cam
    - `{"rval": -7}` - Input is not a valid JSON object
    - `{"rval":-4,"msg_id":0}` - Input object is empty
    - `{"rval":-9,"msg_id":0}` - Input object is not a valid command

    ###Token
    All requests require a token you have to request when connecting to the camera:
    **Request:**
    ```json
    {"msg_id":257, "token":0}
    ```
    **Response:**
    ```json
    { "rval": 0, "msg_id": 257, "param": 1 }
    ```
    `param` is your token. All requests in this article have the token set to 1. This will be different for you.

    ###Config
    **Request:**
    ```json
    {"msg_id":3, "token":1}
    ```
    **Response:**

    > **NOTE:** The config is a list of objects of settings, not just an object of settings. You have to use a loop!
    ```json
    {
    "rval": 0,
    "msg_id": 3,
    "param": [
    {"camera_clock": "2015-04-07 02:32:29"},
    {"video_standard": "NTSC"},
    {"app_status": "idle"},
    {"video_resolution": "1920x1080 60P 16:9"},
    {"video_stamp": "off"},
    {"video_quality": "S.Fine"},
    {"timelapse_video": "off"},
    {"capture_mode": "precise quality"},
    {"photo_size": "16M (4608x3456 4:3)"},
    {"photo_stamp": "off"},
    {"photo_quality": "S.Fine"},
    {"timelapse_photo": "60"},
    {"preview_status": "on"},
    {"buzzer_volume": "mute"},
    {"buzzer_ring": "off"},
    {"capture_default_mode": "precise quality"},
    {"precise_cont_time": "60.0 sec"},
    {"burst_capture_number": "7 p / s"},
    {"restore_factory_settings": "on"},
    {"led_mode": "all enable"},
    {"dev_reboot": "on"},
    {"meter_mode": "center"},
    {"sd_card_status": "insert"},
    {"video_output_dev_type": "tv"},
    {"sw_version": "YDXJv22_1.0.7_build-20150330113749_b690_i446_s699"},
    {"hw_version": "YDXJ_v22"},
    {"dual_stream_status": "on"},
    {"streaming_status": "off"},
    {"precise_cont_capturing": "off"},
    {"piv_enable": "off"},
    {"auto_low_light": "on"},
    {"loop_record": "off"},
    {"warp_enable": "off"},
    {"support_auto_low_light": "on"},
    {"precise_selftime": "5s"},
    {"precise_self_running": "off"},
    {"auto_power_off": "5 minutes"},
    {"serial_number": "xxxxx"},
    {"system_mode": "capture"},
    {"system_default_mode": "capture"},
    {"start_wifi_while_booted": "off"},
    {"quick_record_time": "0"},
    {"precise_self_remain_time": "0"},
    {"sdcard_need_format": "no-need"},
    {"video_rotate": "off"}
    ]
    }
    ```
    ###Photo capture
    **Request:**
    ```json
    {"msg_id":769,"token":1}
    ```
    **Response:**
    ```json
    { "msg_id": 7, "type": "start_photo_capture" ,"param":"precise quality;off"}
    ```
    ```json
    { "msg_id": 7, "type": "photo_taken" "param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0047.jpg"}
    ```
    - `param` is the full path of the image
    > **NOTE:** To get the download URL of the image, replace `/tmp/fuse_d/` with `http://192.168.42.1/`.


    ##Telnet events
    All messages with `msg_id: 7` are events and are sent automatically by the camera.
    ```json
    { "msg_id": 7, "type": "<string: event name>"}
    ```
    Some events also provide additional data in the `param` attribute:
    ```json
    { "msg_id": 7, "type": "<string: event name>", "param":"<int: event data>"}
    ```
    Below is a list of known events, their parameters and an example for each

    ###Battery
    Fired when the battery level changes
    ```json
    { "msg_id": 7, "type": "battery", "param":"20"}
    ```
    - `type` is `battery` when discharging and `adapter` when charging
    - `param` is the battery charge percentage (int 1-100, obviously)

    ####Special cases
    - `type:adapter, param:0` has been observed when

    ###Charger status
    Fired when the USB charging cable is connected/disconnected
    ```json
    { "msg_id": 7, "type": "adapter_status" ,"param":"1"}
    ```
    - `param`:`0` - cable **disconnected**
    - `param`:`1` - cable **connected**

    ###Camera mode switched
    Fired when the recording mode is changed (big button on the front)
    ```json
    { "msg_id": 7, "type": "switch_to_rec_mode" }
    ```
    - `type`:`"switch_to_rec_mode"` - switched to **video mode**
    - `type`:`"switch_to_cap_mode"` - switched to **photo mode**

    ###Photo taken
    ```json
    { "msg_id": 7, "type": "start_photo_capture" ,"param":"precise quality;off"}
    ```
    ```json
    { "msg_id": 7, "type": "precise_capture_data_ready" }
    ```
    ```json
    { "msg_id": 7, "type": "photo_taken" ,"param":"/tmp/fuse_d/DCIM/100MEDIA/YDXJ0513.jpg"}
    ```

    ###SD Card status
    Fired when the SD card is inserted/removed
    ```json
    { "msg_id": 7, "type": "sd_card_status" ,"param":"insert"}
    ```
    - `type`:`"insert"` - SD card **inserted**
    - `type`:`"remove"` - SD card **removed**
    When SD card is removed, the following event also fires:
    ```json
    { "msg_id": 7, "type": "CARD_REMOVED" }
    ```

    #Live view
    After you've successfully authenticated through tenet, you can connect to `rtsp://192.168.42.1:554/live` with VLC (or similar) to see the live view of the camera.

    ##Unknown events
    ###Photo taken `vf_start/stop`
    Fired after `start_photo_capture`
    Best guess: stop live view
    ```json
    { "msg_id": 7, "type": "vf_stop" }
    ```

    Fired after `photo_taken`
    Best guess: start live view
    ```json
    { "msg_id": 7, "type": "vf_start" }
    ```
    `vf` == "viewfinder" **?**

    ###Battery status
    This message has been observed when taking out the battery with the cam on USB power, but I haven't been able to reproduce it so far.
    ```json
    { "msg_id": 7, "type": "battery_status" ,"param":"0"}
    ```
    - `param` - observed values`0` and `-1`