Close

First attempts at understanding how the video link works

A project log for Controlling a JJRC H37 Elfie quad from a PC

The JJRC Elfie Quadcopter comes with an Android/iOS app to control it from the phone. Can we control it from our own software?

adria.junyent-ferreadria.junyent-ferre 02/04/2017 at 22:370 Comments

I haven't done any further tests with the UDP controls, but I captured some more traffic in order to try to figure out how is the video transmitted between the quadcopter and the mobile phone. The communication seems to be established through port 8888 of the quadcopter; however, getting the video is not as simple as opening a stream with VLC. The traffic in Wireshark shows multiple connections being established. These always start with the mobile phone sending a message of 106 bytes to the quadcopter which seem to have a common header:

0000   49 54 64 00 00 00 52 00 00 00 7a 34 b1 04 99 c6  ITd...R...z4....
0010   b1 36 81 b7 be 83 83 4d de 4e 57 aa be 10 36 eb  .6.....M.NW...6.
0020   d8 94 9b a8 5e 59 54 92 1f e9 3e 37 fa 70 d6 52  ....^YT...>7.p.R
0030   e2 ae e0 91 10 9c 34 cf ea ff 57 aa be 10 36 eb  ......4...W...6.
0040   d8 94 9b a8 5e 59 54 92 1f e9 ad ce 18 b0 c3 10  ....^YT.........
0050   67 a8 36 f3 0e 06 d3 4b 60 bf 0a 78 6b bc b0 82  g.6....K`..xk...
0060   cf 8e a2 0b 26 f8 31 52 8f ab                    ....&.1R..

0000   49 54 64 00 00 00 52 00 00 00 05 a7 a9 0f b3 6e  ITd...R........n
0010   cd 3f a2 ca 7e c4 8c a3 60 04 ac ef 63 f7 71 57  .?..~...`...c.qW
0020   ab 2f 53 e3 f7 68 ec d9 e1 85 47 b8 c2 2e 21 d0  ./S..h....G...!.
0030   1b fb 6b 3d e3 25 a2 7b 8f b3 ac ef 63 f7 71 57  ..k=.%.{....c.qW
0040   ab 2f 53 e3 f7 68 ec d9 e1 85 b7 33 0f b7 c9 57  ./S..h.....3...W
0050   82 fc 3d 67 e7 c3 a6 67 28 da d8 b5 98 48 c7 67  ..=g...g(....H.g
0060   0c 94 b2 9b 54 d2 37 9e 2e 7a                    ....T.7..z

0000   49 54 64 00 00 00 52 00 00 00 72 98 c0 38 9b c3  ITd...R...r..8..
0010   72 a7 1a 17 4b d1 b5 14 b3 ad ac ef 63 f7 71 57  r...K.......c.qW
0020   ab 2f 53 e3 f7 68 ec d9 e1 85 47 b8 c2 2e 21 d0  ./S..h....G...!.
0030   1b fb 6b 3d e3 25 a2 7b 8f b3 ac ef 63 f7 71 57  ..k=.%.{....c.qW
0040   ab 2f 53 e3 f7 68 ec d9 e1 85 b7 33 0f b7 c9 57  ./S..h.....3...W
0050   82 fc 3d 67 e7 c3 a6 67 28 da d8 b5 98 48 c7 67  ..=g...g(....H.g
0060   0c 94 b2 9b 54 d2 37 9e 2e 7a                    ....T.7..z

0000   49 54 64 00 00 00 52 00 00 00 0c 76 da 94 66 a3  ITd...R....v..f.
0010   54 68 65 15 92 8c fd 4d 70 c7 ac ef 63 f7 71 57  The....Mp...c.qW
0020   ab 2f 53 e3 f7 68 ec d9 e1 85 47 b8 c2 2e 21 d0  ./S..h....G...!.
0030   1b fb 6b 3d e3 25 a2 7b 8f b3 ac ef 63 f7 71 57  ..k=.%.{....c.qW
0040   ab 2f 53 e3 f7 68 ec d9 e1 85 b7 33 0f b7 c9 57  ./S..h.....3...W
0050   82 fc 3d 67 e7 c3 a6 67 28 da d8 b5 98 48 c7 67  ..=g...g(....H.g
0060   0c 94 b2 9b 54 d2 37 9e 2e 7a                    ....T.7..z

0000   49 54 64 00 00 00 58 00 00 00 9b f8 90 49 c9 26  ITd...X......I.&
0010   88 4d 4f 92 2b 3b 33 ba 7e ce ac ef 63 f7 71 57  .MO.+;3.~...c.qW
0020   ab 2f 53 e3 f7 68 ec d9 e1 85 47 b8 c2 2e 21 d0  ./S..h....G...!.
0030   1b fb 6b 3d e3 25 a2 7b 8f b3 ac ef 63 f7 71 57  ..k=.%.{....c.qW
0040   ab 2f 53 e3 f7 68 ec d9 e1 85 eb 20 be 38 3a ab  ./S..h..... .8:.
0050   05 a8 c2 a7 1f 2c 90 6d 93 f7 2a 85 e7 35 6e ff  .....,.m..*..5n.
0060   e1 b8 f5 af 09 7f 91 47 f8 7e                    .......G.~
Searching online, I found a Reddit thread from 10 months ago where some people discussed how to control a (different) quadcopter from the PC. The model of the quadcopter was different but it also used port 8888 and it also used 106 bytes-long messages. One of the redditors in the thread eventually published a Chrome app that was able to control the quadcopter.

I've given the source code of the Chrome app a look and it doesn't have any comments but they seem to blindly send the messages they've seen the mobile app send to the quadcopter in order to establish the connection and get the video stream. The messages their application send seem to different from the ones the JJRC Elfie expects.

I may try to identify all messages the JJRC app sends and see if I can get the video to open in VLC somehow but this is certainly not going to happen today. I will keep you posted.

Discussions