Reverseengineering the Hubsan Wifi Drones

MCenderdragon wrote 08/09/2020 at 10:34 1 point

I aquired a cheap Hubsan Drone (H216A, X4 Desire) and wanted to know if its possible to control it without their app. The Drone opens a WiFi where you can connect your phone to controll it via an App. Using Bluestack & Wireshark I got some information of how it works.
The Drone has always a IP of and open Ports TCP: 8855, 8866 and UDP 8867.As large amount of data is send from the Drone on port 8855 I guess that is the video feed, and 8866 is for status in both directions. I have no idea what the UDP is for but it is send from the App to the drone so it could be the controls.

My Question is: what is the best why to analyze this data? What possibilites are there to find out what the video format used is? Or is it a better approach to try and disassamble their app ?

Edit 1: exporting the full video stream made it readable by media info: Its a AVC Video Stream, 640*360 at 25FPS, AVC (Main@L3) (CABAC / 1 Ref Frames)

Edit 2: AFter decompiling the App and searching through the code I found the 8866 port is used to open soemthing the call a MAVLink, and thanksfully MAVLink is a fully documented Protokoll.