Reverse engineering a drone's IP cam. stream

I’ve bought a cheap drone which has a 2 camera in it. And the drones camera connects with a app called WIFI UAV. The drone creates it’s own wifi ap and when ever any one tries to connect to it by sending a pacific header the drone sends video stream over UDP port 8800 and i’ve wrote a simple python script to get the data from the drone.

So, the drone sends exactly 1080 Bytes long data packets. And I’ve also decompiled the apk of WIFI UAV. I’ve found that the drone sends H.264 stream.

but after analyzing the packets that i got from my script and wireshark i can’t decode the data as a file. So, here is just one single packet of 1080 Bytes from the packet that drone sends.

http://s000.tinyupload.com/index.php?file_id=04212327903416803839

PS: I’ve a very little knowledge about the video different video codec .

Hi,

I am also working on reverse engineering the stream. I believe a code snippet from the picture is from the lxHwEncoder.java class: WiFi UAV_v2021.01.05.apk/lxHwEncoder.java - Decompiler.com, but could I also ask you to share your python script?

Thanks a lot!

1 Like

Hello!
Have you found anything else ? I stopped working on the project and I don’t have the script rn.

Have you found how to decode ? I’m approaching the same problem

no. have you found anything interesting ?

Other than controlling the drone via keyboard, not much. I’ve been stuck on decoding the video for weeks haha.

Seems like the App is using Ffmpeg, AVPlayer, EglView, Opencv, CNN, and etc. Idk if it’s helping.

I’ve read many articles about “hacking” bunch of drone. And their way of accesing the video stream so simple. Idk why it’s hard in this case haha. I thought that the drone is encapsulating the stream using something like RTP but after testing, the packet send using RTP doesn’t match what the drone have sent. Now i’m stuck. Still researching sending video over udp tho, will reply when i’ve found the solution.

wow! great. i would like to learn more about how you are controlling the drone via keyboard. its been almost 2 years i’ve stoped working on this.

So basically the WIFI UAV App sends 124 Bytes of Data. The 13th, 14th, 89th, 90th, 109th, and 110th byte are about time counter. Where 13 and 14 starts with 00, 89 and 90 starts with 01, and 109 and 110 starts with 02.

For controlling, the 21st byte is left and right from 00 to FF where in the middle is 80 ( 126 decimal )
22nd byte is forward and backward where backward from 00 and forward to FF
23th byte is throttle from 00 to FF
24th byte is for yaw from 00 to FF
25th byte is for command, where 01 takeoff, 02 emergency stop/killswitch, 03 landing, 04 Calibrate Gyro
26th byte is also command but for toggle between Headless mode and non-headless mode

There must be many commands but i didnt found yet

Hi,
Is there any update regarding the video stream from the uav-wifi apk, I am also trying to find a way to decode the video stream and process it further

Unfortunately i didn’t found anything. I’m resorting to make my own ip-cam using ESP32Cam, maybe if you want to know about control stuff you can visit my documentation here. Or let me know if you found anything interesting.