Запись в блоге юзера Gol

Hacking DJI Osmo

DJI Osmo

Все части эпопеи


part 1
part 2
part 3
part 4

Пишу всё на инглише, надо тренироваться...

Для нетерпеливых - видео внизу :-)

Intro


What do i need? I need to get a live view video stream from DJI Osmo and restream it into video server (any RTMP service, or my own low latency live video streaming service). For my service i want not only video, but also the Osmo's telemetry too.

Native DJI's software not allowed to do this, so i have to do it by myself. And i want to get stream not from mobile Android or IOS device, but from any linux-based device like Virt2real board or Raspberry Pi.

DJI Osmo has two hosts - 192.168.1.2 and 192.168.1.3 Just make a Wi-Fi connection to Osmo, and you can ping this hosts.


Оффтопик на русском


В процессе ковыряния гуглил дефолтный пароль, наткнулся на ветку форума

FPV-передатчик Vision+ построен на чипсете от Texas Instruments. Кстати, на таком же чипсете построен и русский проект платы управления с видеокодеком «Виртурилка», который уже выпускается и успешно используется для дистанционного управления много чем, в т.ч. настоящим большим автомобилем.


Уж три года прошло, а помнят тачку Бонда :-)

Продолжение...


At first, try to play with 192.168.1.3

First connections


So... DJI Osmo allows Telnet and FTP connection by default.
Try "telnet 192.168.1.3:20" (login root, pass 123456) and, voila

Dji-Pro login: root
Password:
#Process /etc/profile...
root@Dji-Pro:~#

FTP connection allows access to /opt directory. Just do FTP connect on 192.168.1.3:21 as anonymous (or any login/pass). Directory is read/write, so we can put there some stuff.

Telnet is good, but we all want a SSH connection. SSH is disabled by default (very strange). But we can turn it on. Just run "/opt/dji/bin/sshenable" in telnet session.

Here is /opt/dji/bin/sshenable script
#!/bin/sh
./eth0config
mkdir -p /var/run
mkdir -p /var/empty/sshd
chmod 755 /var/empty
/usr/local/sbin/sshd

Now we can connect to SSH at 192.168.1.3:22. Login "root", password "123456". Connection very slow, so be patient.


Hardware details


For live video streaming DJI Osmo uses a TI DaVinci DM368 processor and native TI Linux kernel (2.6.32.17). We can see this


root@Dji-Pro:~# dmesg
[ 0.000000] Kernel Product Vesion : DJI-WIFI-WM610-Kernel-1.0-rc4(Nov 2 2015-15:24:51)
[ 0.000000] Linux version 2.6.32.17-davinci1 (root@xueb-VirtualBox) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #1 PREEMPT Mon Nov 2 15:28:34 CST 2015
[ 0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
[ 0.000000] CPU: VIVT data cache, VIVT instruction cache
[ 0.000000] Machine: DaVinci DM36x EVM
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] On node 0 totalpages: 12288
[ 0.000000] free_area_init_node: node 0, pgdat c03e453c, node_mem_map c042b000
[ 0.000000] DMA zone: 96 pages used for memmap
[ 0.000000] DMA zone: 0 pages reserved
[ 0.000000] DMA zone: 12192 pages, LIFO batch:1
[ 0.000000] DaVinci dm36x_rev1.2 variant 0x8
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping off. Total pages: 12192
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rw dm365_imp.oper_mode=0 video=davincifb:vid0=0,0:vid1=0,0:osd0=0,0:osd1=0,0 mem=48MB davinci_enc_mngr.ch0_output=COMPOSITE davinci_enc_mngr.ch0_mode=pal ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs ip=off lpj=1077248
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Memory: 48MB = 48MB total
[ 0.000000] Memory: 44432KB available (3652K code, 453K data, 120K init, 0K highmem)
[ 0.000000] SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] NR_IRQS:245
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] Calibrating delay loop (skipped) preset value.. 215.44 BogoMIPS (lpj=1077248)
[ 0.000000] Mount-cache hash table entries: 512
[ 0.000000] CPU: Testing write buffer coherency: ok
[ 0.000000] DaVinci: 8 gpio irqs
[ 0.000000] NET: Registered protocol family 16
[ 0.130000] bio: create slab <bio-0> at 0
[ 0.140000] DM365 IPIPE initialized in Continuous mode
[ 0.140000] SCSI subsystem initialized
[ 0.150000] usbcore: registered new interface driver usbfs
[ 0.150000] usbcore: registered new interface driver hub
[ 0.150000] usbcore: registered new device driver usb
[ 0.150000] davinci_i2c_probe
[ 0.150000] vpss vpss: dm365_vpss vpss probed
[ 0.150000] vpss vpss: dm365_vpss vpss probe success
[ 0.150000] dm365_afew_hw_init
[ 0.160000] ch0 default output "COMPOSITE", mode "PAL"
[ 0.160000] <vpbe_encoder_setoutput>
[ 0.160000] Setting output to Composite
[ 0.160000] Start of vpbe_encoder_setmode..
[ 0.160000] </vpbe_encoder_setmode>
[ 0.160000] </vpbe_encoder_setoutput>
[ 0.160000] VPBE Encoder initialized
[ 0.160000] <vpbe_encoder_enumoutput>
[ 0.160000] </vpbe_encoder_enumoutput>
[ 0.160000] <vpbe_encoder_setoutput>
[ 0.160000] Setting output to Composite
[ 0.160000] Start of vpbe_encoder_setmode..
[ 0.160000] </vpbe_encoder_setmode>
[ 0.160000] </vpbe_encoder_setoutput>
[ 0.160000] Start of vpbe_encoder_setmode..
[ 0.160000] </vpbe_encoder_setmode>
[ 0.160000] <vpbe_encoder_getoutput>
[ 0.160000] </vpbe_encoder_getoutput>
[ 0.160000] <vpbe_encoder_getmode>
[ 0.160000] <vpbe_encoder_getmode/>
[ 0.160000] VPBE Encoder Initialized
[ 0.160000] LogicPD encoder initialized
[ 0.160000] Switching to clocksource timer0_1
[ 0.170000] musb_hdrc: version 6.0, pio, host, debug=0
[ 0.190000] musb_hdrc: ConfigData=0x06 (UTMI-8, dyn FIFOs, SoftConn)
[ 0.190000] musb_hdrc: MHDRC RTL version 1.500
[ 0.190000] musb_hdrc: setup fifo_mode 2
[ 0.190000] musb_hdrc: 9/9 max ep, 4032/4096 memory
[ 0.190000] musb_hdrc: USB Host mode controller at fec64000 using PIO, IRQ 12
[ 0.190000] musb_hdrc musb_hdrc: MUSB HDRC host driver
[ 0.190000] musb_hdrc musb_hdrc: new USB bus registered, assigned bus number 1
[ 0.190000] usb usb1: configuration #1 chosen from 1 choice
[ 0.190000] hub 1-0:1.0: USB hub found
[ 0.190000] hub 1-0:1.0: 1 port detected
[ 0.190000] NET: Registered protocol family 2
[ 0.190000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.190000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.190000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.190000] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.190000] TCP reno registered
[ 0.190000] NET: Registered protocol family 1
[ 0.190000] RPC: Registered udp transport module.
[ 0.190000] RPC: Registered tcp transport module.
[ 0.190000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.200000] JFFS2 version 2.2. (NAND) В© 2001-2006 Red Hat, Inc.
[ 0.200000] msgmni has been set to 86
[ 0.210000] alg: No test for stdrng (krng)
[ 0.210000] io scheduler noop registered (default)
[ 0.210000] <vpbe_encoder_getmode>
[ 0.210000] <vpbe_encoder_getmode/>
[ 0.240000] VBUS on (a_wait_vrise), devctl 19
[ 0.290000] DM365 IPIPEIF probed
[ 0.290000] imp serializer initialized
[ 0.290000] davinci_previewer initialized
[ 0.300000] davinci_resizer initialized
[ 0.300000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 0.300000] serial8250.0: ttyS0 at MMIO 0x1c20000 (irq = 40) is a 16550A
[ 0.660000] console [ttyS0] enabled
[ 0.670000] serial8250.0: ttyS1 at MMIO 0x1d06000 (irq = 41) is a 16550A
[ 0.680000] brd: module loaded
[ 0.690000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron NAND 128MiB 3,3V 8-bit)
[ 0.700000] Bad block table found at page 65472, version 0x01
[ 0.700000] Bad block table found at page 65408, version 0x01
[ 0.700000] Creating 4 MTD partitions on "davinci_nand.0":
[ 0.700000] 0x000000000000-0x0000004a0000 : "bootloader"
[ 0.710000] 0x0000004a0000-0x000000e00000 : "kernel"
[ 0.720000] 0x000000e00000-0x000007f00000 : "filesystem"
[ 0.730000] 0x000000000000-0x000008000000 : "all"
[ 0.740000] davinci_nand davinci_nand.0: controller rev. 2.3
[ 0.750000] UBI: attaching mtd2 to ubi0
[ 0.750000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 0.760000] UBI: logical eraseblock size: 126976 bytes
[ 0.770000] UBI: smallest flash I/O unit: 2048
[ 0.770000] UBI: sub-page size: 512
[ 0.780000] UBI: VID header offset: 2048 (aligned 2048)
[ 0.780000] UBI: data offset: 4096
[ 0.950000] usb 1-1: new high speed USB device using musb_hdrc and address 2
[ 1.100000] usb 1-1: configuration #1 chosen from 1 choice
[ 1.100000] hub 1-1:1.0: USB hub found
[ 1.120000] hub 1-1:1.0: 2 ports detected
[ 1.350000] UBI: attached mtd2 to ubi0
[ 1.350000] UBI: MTD device name: "filesystem"
[ 1.360000] UBI: MTD device size: 113 MiB
[ 1.360000] UBI: number of good PEBs: 904
[ 1.370000] UBI: number of bad PEBs: 0
[ 1.370000] UBI: max. allowed volumes: 128
[ 1.380000] UBI: wear-leveling threshold: 4096
[ 1.380000] UBI: number of internal volumes: 1
[ 1.390000] UBI: number of user volumes: 1
[ 1.390000] UBI: available PEBs: 0
[ 1.390000] UBI: total number of reserved PEBs: 904
[ 1.400000] UBI: number of PEBs reserved for bad PEB handling: 9
[ 1.410000] UBI: max/mean erase counter: 4/2
[ 1.410000] UBI: image sequence number: 522864454
[ 1.410000] UBI: background thread "ubi_bgt0d" started, PID 326
[ 1.420000] usbcore: registered new interface driver asix
[ 1.430000] usbcore: registered new interface driver cdc_ether
[ 1.440000] usbcore: registered new interface driver net1080
[ 1.440000] usbcore: registered new interface driver cdc_subset
[ 1.450000] usbcore: registered new interface driver zaurus
[ 1.460000] console [netcon0] enabled
[ 1.460000] netconsole: network logging started
[ 1.470000] Initializing USB Mass Storage driver...
[ 1.470000] usbcore: registered new interface driver usb-storage
[ 1.480000] USB Mass Storage support registered.
[ 1.480000] i2c /dev entries driver
[ 1.490000] Linux video capture interface: v2.00
[ 1.500000] vpfe-capture: vpss clock vpss_master enabled
[ 1.500000] vpfe-capture vpfe-capture: v4l2 device registered
[ 1.510000] vpfe-capture vpfe-capture: video device registered
[ 1.520000] EVM: switch to adv761x video input
[ 1.520000] adv761x_probe=>Chip found @ 0x4c (adv7611)
[ 1.560000] vpfe-capture vpfe-capture: v4l2 sub device adv761x registered
[ 1.570000] vpfe_register_ccdc_device: DM365 ISIF
[ 1.580000] DM365 ISIF is registered with vpfe.
[ 1.580000] <davinci_display_init>
[ 1.580000] Trying to register davinci display video device.
[ 1.590000] layer=c1192000,layer->video_dev=c1192164
[ 1.600000] Trying to register davinci display video device.
[ 1.600000] layer=c1192400,layer->video_dev=c1192564
[ 1.610000] davinci_init:DaVinci V4L2 Display Driver V1.0 loaded
[ 1.610000] </davinci_init>
[ 1.610000] watchdog watchdog: heartbeat 1 sec
[ 1.620000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 1.630000] arp_tables: (C) 2002 David S. Miller
[ 1.630000] TCP cubic registered
[ 1.630000] NET: Registered protocol family 17
[ 1.640000] Bridge firewalling registered
[ 1.670000] Clocks: disable unused mmcsd0
[ 1.670000] Clocks: disable unused mmcsd1
[ 1.670000] Clocks: disable unused spi0
[ 1.670000] Clocks: disable unused spi1
[ 1.670000] Clocks: disable unused spi2
[ 1.670000] Clocks: disable unused spi3
[ 1.670000] Clocks: disable unused spi4
[ 1.670000] Clocks: disable unused pwm0
[ 1.670000] Clocks: disable unused pwm1
[ 1.670000] Clocks: disable unused pwm2
[ 1.670000] Clocks: disable unused pwm3
[ 1.670000] Clocks: disable unused timer1
[ 1.670000] Clocks: disable unused timer3
[ 1.670000] Clocks: disable unused emac
[ 1.670000] Clocks: disable unused voice_codec
[ 1.670000] Clocks: disable unused asp0
[ 1.670000] Clocks: disable unused rto
[ 1.670000] Clocks: disable unused mjcp
[ 1.750000] nnnn===0
[ 1.750000] davinci_emac_probe: using random MAC addr: 52:59:6a:c2:48:2d
[ 1.760000] emac-mii: probed
[ 1.800000] UBIFS: recovery needed
[ 1.850000] UBIFS: recovery completed
[ 1.850000] UBIFS: mounted UBI device 0, volume 0, name "rootfs"
[ 1.860000] UBIFS: file system size: 110342144 bytes (107756 KiB, 105 MiB, 869 LEBs)
[ 1.870000] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 1.870000] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 1.880000] UBIFS: default compressor: lzo
[ 1.880000] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 1.890000] VFS: Mounted root (ubifs filesystem) on device 0:13.
[ 1.900000] Freeing init memory: 120K
[ 2.020000] usb 1-1.1: new high speed USB device using musb_hdrc and address 3
[ 2.130000] usb 1-1.1: configuration #1 chosen from 2 choices
[ 2.150000] usb0: register 'cdc_ether' at usb-musb_hdrc-1.1, CDC Ethernet Device, 32:74:03:97:bb:c1
[ 2.310000] HDMI video input detected (1280x720p@60HZ)
[ 4.110000] CMEMK module: built on Jan 14 2014 at 19:23:51
[ 4.130000] Reference Linux version 2.6.32
[ 4.130000] File /home/u/dm368/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/cmem/src/module/cmemk.c
[ 4.150000] allocated heap buffer 0xc7000000 of size 0x2456000
[ 4.180000] heap fallback enabled - will try heap if pool buffer is not available
[ 4.200000] CMEM Range Overlaps Kernel Physical - allowing overlap
[ 4.200000] CMEM phys_start (0x1000) overlaps kernel (0x80000000 -> 0x83000000)
[ 4.210000] cmemk initialized
[ 4.250000] IRQK module: built on Jan 14 2014 at 19:23:57
[ 4.270000] Reference Linux version 2.6.32
[ 4.270000] usb 1-1.2: new full speed USB device using musb_hdrc and address 4
[ 4.280000] File /home/u/dm368/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/irq/src/module/irqk.c
[ 4.300000] irqk initialized
[ 4.360000] EDMAK module: built on Jan 14 2014 at 19:24:08
[ 4.380000] Reference Linux version 2.6.32
[ 4.380000] File /home/u/dm368/dvsdk_dm368_4_02_00_06/linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/edma/src/module/edmak.c
[ 4.400000] usb 1-1.2: configuration #1 chosen from 1 choice
[ 5.060000] usb 1-1.2: USB disconnect, address 4
[ 5.600000] EVM: switch to adv761x video input
[ 5.620000] davinci_resizer davinci_resizer.2: RSZ_G_CONFIG:0:1:124
[ 5.630000] davinci_previewer davinci_previewer.2: ipipe_set_preview_config
[ 5.630000] vpfe-capture vpfe-capture: IPIPE Chained
[ 5.640000] vpfe-capture vpfe-capture: Resizer present
[ 5.650000] EVM: switch to adv761x video input
[ 5.650000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[ 5.660000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400
[ 5.670000] vpfe-capture vpfe-capture: width = 1280, height = 720, bpp = 1
[ 5.680000] vpfe-capture vpfe-capture: adjusted width = 1280, height = 720, bpp = 1, bytesperline = 1280, sizeimage = 1382400
[ 5.780000] ipipe_set_resizer, resizer - A enabled


root@Dji-Pro:~# uname -a
Linux Dji-Pro 2.6.32.17-davinci1 #6 PREEMPT Mon Nov 2 15:28:34 CST 2015 armv5tejl
GNU/Linux

root@Dji-Pro:~# cat /proc/cpuinfo 
Processor : ARM926EJ-S rev 5 (v5l)
BogoMIPS : 215.44
Features : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant : 0x0
CPU part : 0x926
CPU revision : 5

Hardware : DaVinci DM36x EVM
Revision : 0000
Serial : 0000000000000000


Network interfaces


root@Dji-Pro:~# ifconfig -a
eth0 Link encap:Ethernet HWaddr 00:00:00:00:00:00
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:52 Base address:0x7000

lo Link encap:Local Loopback
LOOPBACK MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

usb0 Link encap:Ethernet HWaddr 60:60:1F:10:00:0A
inet addr:192.168.1.3 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9115 errors:12 dropped:0 overruns:0 frame:0
TX packets:33100 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:598626 (584.5 KiB) TX bytes:41358809 (39.4 MiB)


Top output


root@Dji-Pro:~# top
Mem: 9224K used, 35348K free, 0K shrd, 0K buff, 3316K cached
CPU: 0.0% usr 57.1% sys 0.0% nic 35.7% idle 0.0% io 0.0% irq 7.1% sirq
Load average: 0.50 0.73 0.42 2/43 3614
PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND
464 1 root S < 179m411.6 0 35.6 /opt/dji/bin/encode_wifi -a -s -p 6000 -b 3000000
3614 1087 root R 3140 7.0 0 14.2 top
1087 468 root S 3144 7.0 0 0.0 -sh
468 1 root S 3144 7.0 0 0.0 telnetd -p 20
476 473 root S 3144 7.0 0 0.0 -sh
1 0 root S 3140 7.0 0 0.0 init
469 1 root S 3140 7.0 0 0.0 tcpsvd 0 21 ftpd -w /opt
473 1 root S 3140 7.0 0 0.0 {autologin} /bin/sh /sbin/autologin
462 1 root S 1748 3.9 0 0.0 /opt/dji/bin/monitor
463 1 root S 1496 3.3 0 0.0 /opt/dji/bin/usbupdate
154 2 root SW 0 0.0 0 0.0 [khubd]
5 2 root SW 0 0.0 0 0.0 [khelper]
3 2 root SW 0 0.0 0 0.0 [ksoftirqd/0]
4 2 root SW 0 0.0 0 0.0 [events/0]
2 0 root SW 0 0.0 0 0.0 [kthreadd]
326 2 root SW 0 0.0 0 0.0 [ubi_bgt0d]
355 2 root SW 0 0.0 0 0.0 [adv761x]
8 2 root SW 0 0.0 0 0.0 [async/mgr]
136 2 root SW 0 0.0 0 0.0 [sync_supers]
138 2 root SW 0 0.0 0 0.0 [bdi-default]
140 2 root SW 0 0.0 0 0.0 [kblockd/0]
157 2 root SW 0 0.0 0 0.0 [kseriod]
186 2 root SW 0 0.0 0 0.0 [rpciod/0]
195 2 root SW 0 0.0 0 0.0 [kswapd0]
196 2 root SW 0 0.0 0 0.0 [aio/0]
197 2 root SW 0 0.0 0 0.0 [nfsiod]
198 2 root SW 0 0.0 0 0.0 [crypto/0]
304 2 root SW 0 0.0 0 0.0 [mtdblockd]
372 2 root SW 0 0.0 0 0.0 [ubifs_bgt0_0]
1180 2 root SW 0 0.0 0 0.0 [flush-ubifs_0_0]

As we can see - it has adv761x process. It is a kernel driver for a ADV761x (ADV7611 - HDMI receiver). That's why a think Osmo has at least two parts - camera module with own processor (maybe Ambarella), and streaming module with DM368. Streaming module grabs video from camera module via HDMI input. Encode it and sending via usb0 to Wi-Fi module, who sends it to client's mobile device.

UPD> btw, this ADV7611 chip used in our HDMI-input module for Virt2real board :-)

UPD> yeah, Ambarella (Phantom has the same camera module) (found here)

Deeper digging by Disassembling the DJI Phantom 3 Camera reveals that the P3Pro camera uses the Ambarella A9 SOC which has some really impressive capabilites for a 2 year old 1st gen 4K/UHD image processor. The A9 provides a direct SDIO SDXC connection, so as long as DJI is using that connection there should be no bottleneck between the chip and the SDXC card.



Local ports


Now we want to see any used local ports in Osmo's linux.
root@Dji-Pro:~# netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 (null):2001 (null):* LISTEN
tcp 0 0 (null):20 (null):* LISTEN
tcp 0 0 (null):21 (null):* LISTEN
tcp 0 0 (null):22 (null):* LISTEN
tcp 0 2 (null):20 (null):51924 ESTABLISHED
netstat: /proc/net/tcp6: No such file or directory
udp 0 0 (null):9000 (null):*
netstat: /proc/net/udp6: No such file or directory
netstat: /proc/net/raw6: No such file or directory
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path


TCP:
Port 20 - my current Telnet connection
Port 21 - FTP server
Port 22 - SSH server
Port 2001 - maybe telemetry

UDP:
Port 9000 - live video via UDT protocol

UPD> Wow! I found topic with some DJI Phantom hacks. System a very similar to Osmo, with a few differences. Here it is - http://www.phantompilots.com They says that 2001 port used for telemetry. Ура, товарищи, телеметрия найдена!


Encoding software


For my interest i tryed to copy encode_wifi into my Virt2real board (based on DM365).

Try to run
[root@virt2real /]# ./encode_wifi
./encode_wifi: error while loading shared libraries: libudt.so: cannot open shared object file: No such file or directory

Ooops, UDT library needed. But now we know that video streame uses UDT.
Not a problem. Take this library from Osmo. Try to start again

[root@virt2real /]# ./encode_wifi
./encode_wifi: error while loading shared libraries: libcommon.so: cannot open shared object file: No such file or directory

Ok, libudt now good, take other libraries from Osmo.

Try to start again. And... Yeah, baby!!! DJI Osmo's streaming software runned on Virt2real board! But i have no dm365-gpio device module. Hmmm... But this is not needed for my tasks, so i don't care.
[root@virt2real /]# ./encode_wifi
encode_usb V00.02.02.00(Dec 18 2015 11:09:36).
open /dev/dm365-gpio fail!
Usage: encode [options]

Options:
-v | --videofile Video file to record to
-y | --display_standard Video standard to use for display (see below).
Same video standard is used at input.
-r | --resolution Video resolution ('width'x'height')
[video standard default]
-b | --videobitrate Bit rate to encode video at [variable]
-g | --gop_interal GOP interval[30]
-w | --watchdog_disable Disable watchDog [watchDog Disabled]
-f | --write_disable Disable recording of encoded file [enabled]
-I | --video_input Video input source [video standard default]
-n | --nooutput don't output the stream [off]
-m | --mode libusb async send mode [off]
-a | --autodetect autodetect the video input port and standard [off]
-s | --serialdata receive data from uart1 and append to h264 stream trail[off]-h | --help Print this message

Video standards available
1 D1 @ 30 fps (NTSC)
2 D1 @ 25 fps (PAL)
3 720P @ 30 fps [Default]
4 720P @ 50 fps - for DM368
5 720P @ 60 fps - for DM368
6 1080I @ 25 fps - for DM368
7 1080I @ 30 fps - for DM368
8 1080P @ 25 fps - for DM368
9 1080P @ 30 fps - for DM368
10 1080P @ 50 fps - for DM368
11 1080P @ 60 fps - for DM368
Video inputs available:
1 Composite
2 HDMI



Video stream


Now try to get video stream. It is not so easy how i think.

At first, look packets from mobile appication. Tcmpdump needed, but it absent in Osmo's Linux. But i have filesystem from Virt2real board. Get tcmpdump from there and copy into /opt/tmp. Then run it.

root@Dji-Pro:/opt/tmp# ./tcpdump 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on usb0, link-type EN10MB (Ethernet), capture size 65535 bytes
00:09:20.004016 IP 192.168.1.20.49189 > 192.168.1.3.20: Flags [.], ack 2210972111, win 63568, length 0
00:09:20.026723 IP 192.168.1.3.20 > 192.168.1.20.49189: Flags [P.], seq 1:151, ack 0, win 5840, length 150
00:09:20.205874 IP 192.168.1.20.49189 > 192.168.1.3.20: Flags [.], ack 151, win 63418, length 0

This is just telnet session from Putty. Nothing interesting.

Now connect Android smartphone without DJI Go application. Nothing new, no packets from/to port 9000. Go to Play Market and install DJI Go application, then start it. Look tcpdump again. Andoid smartphone has ip 192.168.1.21

00:09:29.797368 ARP, Request who-has 192.168.1.3 tell 192.168.1.21, length 28
00:09:29.797596 ARP, Reply 192.168.1.3 is-at 60:60:1f:10:00:0a (oui Unknown), length 28
00:09:29.800764 IP 192.168.1.21.59108 > 192.168.1.3.9000: UDP, length 64
00:09:29.801938 IP 192.168.1.21.45451 > 192.168.1.3.9001: UDP, length 64
00:09:29.802212 IP 192.168.1.3 > 192.168.1.21: ICMP 192.168.1.3 udp port 9001 unreachable, length 100
00:09:29.802786 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 64
00:09:29.805631 IP 192.168.1.21.59108 > 192.168.1.3.9000: UDP, length 64
00:09:29.809562 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 64
00:09:29.931408 IP 192.168.1.21.59108 > 192.168.1.3.9000: UDP, length 20
00:09:29.941207 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.941654 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.942136 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.942561 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.942998 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.943274 IP 192.168.1.21.59108 > 192.168.1.3.9000: UDP, length 40
00:09:29.943682 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.944111 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 805
00:09:29.944715 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 20
00:09:29.945728 IP 192.168.1.21.59108 > 192.168.1.3.9000: UDP, length 32
00:09:29.974711 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.975223 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.975675 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.976110 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.976533 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.976960 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 1472
00:09:29.977426 IP 192.168.1.3.9000 > 192.168.1.21.59108: UDP, length 830

Here it is! Video streaming via UDT with MTU 1500 (1500 - UDP header = 1472). But not known how to view it from my own code. Unknown yet...

Now try to start encode_wifi in Osmo's linux manualy

root@Dji-Pro:/opt/dji/lib# /opt/dji/bin/encode_wifi -a -s -p 6000 -b 3000000

encode_usb V00.02.02.00(Dec 18 2015 11:09:36).
Auto to detect video input type:
Default video input selected:Hdmi_yuv
Setting video standard to: 0x4000000000000
Capture input set to Hdmi_yuv:9
Capture videoStdOld=00000009
videoFrameRate=30000, width=1280, height=720
GOP interval:0, outBufSize:1382400, enAdpBW:0, airRate=0, slice=6, VUI=4,timeScale=60000
osdThrFxn: process ID is 664 ***********
tcp server ready on port:2001
server is ready at port: 9000
init udt server ok
watchdog timeout:4
Watchdog_Init
ctrlThrFxn: process ID is 659 ***********
cmd proc:
Illegal connection request!! Authen mac is 90:00:db:89:61:0a

hdmi status is 1 disableStream 0
ARM Load: 6% Video fps: !!!! 27 fps Video bit rate: lowframe 1 2049 kbps PHY Bandwidth: 0 kbps Time: 00:00:02 Resolution: 1280x720

serv 29b6f905(0) accept one new clnt 29b6f903
hdmi status is 1 disableStream 0
ARM Load: 76% Video fps: 30 fps Video bit rate: lowframe 1 2330 kbps PHY Bandwidth: 0 kbps Time: 00:00:03 Resolution: 1280x720

hdmi status is 1 disableStream 0
ARM Load: 52% Video fps: 30 fps Video bit rate: lowframe 1 2277 kbps PHY Bandwidth: 0 kbps Time: 00:00:04 Resolution: 1280x720

hdmi status is 1 disableStream 0
ARM Load: 54% Video fps: 30 fps Video bit rate: lowframe 1 2313 kbps PHY Bandwidth: 0 kbps Time: 00:00:05 Resolution: 1280x720

...

^Creceive sigint!process quit,let kernel feed watchdog!!!
ERROR: assertion violation: Thread_posix.c, line 258
ERROR: assertion violation: alg_malloc.c, line 116
Segmentation fault



UPD> So.. I did it!!! I see a realtime live view video from the DJI Osmo on Windows notebook at the same time with DJI Go application on Android smartphone!!!

Proof:



Now i can restream it to any video server!!! Ура, товарисчи!!!

UPD> New video. Live video translation from DJI Osmo via inet.



Links


Some files from DJI Osmo's DM368 Linux: dji_osmo/
File system from DJI Osmo's Ambarela Linux (firmware 1.6.2)

Disassembling the DJI Phantom 3 video camera
http://www.osmo-guide.co.uk
http://pixaero.ru/blog/skill/95.html
https://github.com/noahwilliamsson/dji-phantom-vision
http://www.phantompilots.com/threads/install-openwrt-webui-on-repeater-p2v.17704/

Hacking done!
Gol      Вторник, 23 Февраля, 2016 23:50       12


Добавить комментарий
 

Гость Суббота, 12 Марта, 2016 00:28 цитировать ссылка на коммент

Привет, G0l. Это мой пост на pixaero. И всё-таки, как смотреть видео с DJI на винде? Я разобрался только до того, что DJI используют протокол UDT, внутри UDP-пакетов. Но до получения живой картинки так и не дошло, подскажи куда копать дальше. С уважением, sea_owl.

 

 

Gol Суббота, 12 Марта, 2016 10:08 цитировать ссылка на коммент

2 Гость:
Привет! В двух словах рассказать не получится, так что погодь немного, готовлю огромный топик в продолжение этого, как раз на тему приёма и показа видео.

 

 

Гость Четверг, 31 Марта, 2016 04:14 цитировать ссылка на коммент

https://geektimes.ru/post/272834/

 

 

Gol Четверг, 31 Марта, 2016 04:33 цитировать ссылка на коммент

2 Гость:
ага, видел

 

 

Гость Понедельник, 4 Апреля, 2016 20:09 цитировать ссылка на коммент

Hi, this is amazing research - thank you for putting it up for the public. Your contribution to knowledge about the OSMO is very valuable.

 

 

Гость Понедельник, 4 Апреля, 2016 20:25 цитировать ссылка на коммент

What do you use to decode the video stream on the PC?

 

 

Gol Понедельник, 4 Апреля, 2016 20:39 цитировать ссылка на коммент

2 Гость:
Hi, i used GStreamer on PC and Raspberry PI.

 

 

Гость Воскресенье, 10 Апреля, 2016 19:36 цитировать ссылка на коммент

The password isn't works

 

 

Гость Воскресенье, 10 Апреля, 2016 19:37 цитировать ссылка на коммент

On the latest fw.

 

 

Gol Воскресенье, 10 Апреля, 2016 22:18 цитировать ссылка на коммент

On the latest firmware pass 12345678 for ssh, but dm368 not available now. See another parts links in head of topic. Only in russian, so use google translate

 

 

Гость Понедельник, 11 Апреля, 2016 00:27 цитировать ссылка на коммент

Okay, thanks :)

 

 

Гость Среда, 27 Апреля, 2016 18:01 цитировать ссылка на коммент


Привет друг, я tendando смотреть видео на ПК с Windows, встроенное программное обеспечение 1.6.2.10 может получить доступ только протокол SSH. У меня есть доступ к папкам и файлам. Можете ли вы дать мне какие-либо советы любой программы, которая может работать на ПК с Windows, который захватывает сеть Wi-Fi? Любой игрок, который запускает поток сети RTMP будет работать? Вы могли бы показать мне параметры конфигурации? Было бы достаточно, чтобы ввести 192.168.1.3:9000~~dobj в потоке? Спасибо, мой друг.

 

Сколько букв в слове Гол?

Вы вошли как Гость      

Сейчас на сайте: 1 и 19 гостей









Страница сгенерирована за 0.0034599304199219 мкс

cached