What do i need? I need to get a live view video stream from DJI Osmo and restream it into video server (any RTMP service, or my own low latency live video streaming service). For my service i want not only video, but also the Osmo's telemetry too.
Native DJI's software not allowed to do this, so i have to do it by myself. And i want to get stream not from mobile Android or IOS device, but from any linux-based device like Virt2real board or Raspberry Pi.
DJI Osmo has two hosts - 192.168.1.2 and 192.168.1.3 Just make a Wi-Fi connection to Osmo, and you can ping this hosts.
Оффтопик на русском
В процессе ковыряния гуглил дефолтный пароль,
“
FPV-передатчик Vision+ построен на чипсете от Texas Instruments. Кстати, на таком же чипсете построен и русский проект платы управления с видеокодеком «Виртурилка», который уже выпускается и успешно используется для дистанционного управления много чем, в т.ч. настоящим большим автомобилем.
So... DJI Osmo allows Telnet and FTP connection by default. Try "telnet 192.168.1.3 20" (login root, pass 123456 or 12345678) and, voila
[code]Dji-Pro login: root Password: #Process /etc/profile... root@Dji-Pro:~#[/code] FTP connection allows access to /opt directory. Just do FTP connect on 192.168.1.3:21 as anonymous (or any login/pass). Directory is read/write, so we can put there some stuff.
Telnet is good, but we all want a SSH connection. SSH is disabled by default (very strange). But we can turn it on. Just run "/opt/dji/bin/sshenable" in telnet session.
Here is script [code]#!/bin/sh ./eth0config mkdir -p /var/run mkdir -p /var/empty/sshd chmod 755 /var/empty /usr/local/sbin/sshd [/code] Now we can connect to SSH at 192.168.1.3:22. Login "root", password "123456" or "12345678". Connection very slow, so be patient.
Hardware details
For live video streaming DJI Osmo uses a TI DaVinci DM368 processor and native TI Linux kernel (2.6.32.17). We can see this
[code]root@Dji-Pro:~# uname -a Linux Dji-Pro 2.6.32.17-davinci1 #6 PREEMPT Mon Nov 2 15:28:34 CST 2015 armv5tejl GNU/Linux[/code] [code]root@Dji-Pro:~# cat /proc/cpuinfo Processor : ARM926EJ-S rev 5 (v5l) BogoMIPS : 215.44 Features : swp half thumb fastmult edsp java CPU implementer : 0x41 CPU architecture: 5TEJ CPU variant : 0x0 CPU part : 0x926 CPU revision : 5
UPD> yeah, Ambarella (Phantom has the same camera module) ()
“
Deeper digging by Disassembling the DJI Phantom 3 Camera reveals that the P3Pro camera uses the Ambarella A9 SOC which has some really impressive capabilites for a 2 year old 1st gen 4K/UHD image processor. The A9 provides a direct SDIO SDXC connection, so as long as DJI is using that connection there should be no bottleneck between the chip and the SDXC card.
”
Local ports
Now we want to see any used local ports in Osmo's linux. [code]root@Dji-Pro:~# netstat -a Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 (null):2001 (null):* LISTEN tcp 0 0 (null):20 (null):* LISTEN tcp 0 0 (null):21 (null):* LISTEN tcp 0 0 (null):22 (null):* LISTEN tcp 0 2 (null):20 (null):51924 ESTABLISHED netstat: /proc/net/tcp6: No such file or directory udp 0 0 (null):9000 (null):* netstat: /proc/net/udp6: No such file or directory netstat: /proc/net/raw6: No such file or directory Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path[/code]
TCP: Port 20 - my current Telnet connection Port 21 - FTP server Port 22 - SSH server Port 2001 - maybe telemetry
UDP: Port 9000 - live video via UDT protocol
UPD> Wow! I found topic with some DJI Phantom hacks. System a very similar to Osmo, with a few differences. Here it is - They says that 2001 port used for telemetry. Ура, товарищи, телеметрия найдена!
Encoding software
For my interest i tryed to copy encode_wifi into my Virt2real board (based on DM365).
Try to run [code][root@virt2real /]# ./encode_wifi ./encode_wifi: error while loading shared libraries: libudt.so: cannot open shared object file: No such file or directory [/code] Ooops, UDT library needed. But now we know that video streame uses . Not a problem. Take this library from Osmo. Try to start again
[code][root@virt2real /]# ./encode_wifi ./encode_wifi: error while loading shared libraries: libcommon.so: cannot open shared object file: No such file or directory[/code] Ok, libudt now good, take other libraries from Osmo.
Try to start again. And... Yeah, baby!!! DJI Osmo's streaming software runned on Virt2real board! But i have no dm365-gpio device module. Hmmm... But this is not needed for my tasks, so i don't care. [code][root@virt2real /]# ./encode_wifi encode_usb V00.02.02.00(Dec 18 2015 11:09:36). open /dev/dm365-gpio fail! Usage: encode [options]
Options: -v | --videofile Video file to record to -y | --display_standard Video standard to use for display (see below). Same video standard is used at input. -r | --resolution Video resolution ('width'x'height') [video standard default] -b | --videobitrate Bit rate to encode video at [variable] -g | --gop_interal GOP interval[30] -w | --watchdog_disable Disable watchDog [watchDog Disabled] -f | --write_disable Disable recording of encoded file [enabled] -I | --video_input Video input source [video standard default] -n | --nooutput don't output the stream [off] -m | --mode libusb async send mode [off] -a | --autodetect autodetect the video input port and standard [off] -s | --serialdata receive data from uart1 and append to h264 stream trail[off]-h | --help Print this message
Video standards available 1 D1 @ 30 fps (NTSC) 2 D1 @ 25 fps (PAL) 3 720P @ 30 fps [Default] 4 720P @ 50 fps - for DM368 5 720P @ 60 fps - for DM368 6 1080I @ 25 fps - for DM368 7 1080I @ 30 fps - for DM368 8 1080P @ 25 fps - for DM368 9 1080P @ 30 fps - for DM368 10 1080P @ 50 fps - for DM368 11 1080P @ 60 fps - for DM368 Video inputs available: 1 Composite 2 HDMI[/code]
Video stream
Now try to get video stream. It is not so easy how i think.
At first, look packets from mobile appication. Tcmpdump needed, but it absent in Osmo's Linux. But i have filesystem from Virt2real board. Get tcmpdump from there and copy into /opt/tmp. Then run it.
[code]root@Dji-Pro:/opt/tmp# ./tcpdump [J tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on usb0, link-type EN10MB (Ethernet), capture size 65535 bytes 00:09:20.004016 IP 192.168.1.20.49189 > 192.168.1.3.20: Flags [.], ack 2210972111, win 63568, length 0 00:09:20.026723 IP 192.168.1.3.20 > 192.168.1.20.49189: Flags [P.], seq 1:151, ack 0, win 5840, length 150 00:09:20.205874 IP 192.168.1.20.49189 > 192.168.1.3.20: Flags [.], ack 151, win 63418, length 0[/code] This is just telnet session from Putty. Nothing interesting.
