Re-implementation of the "ilnk" protocol used on some cheap chinese cameras (sometimes branded as 'A9').
Per pictures the main chip is TXW817 (chinese, eng, google translate)
The interesting implementation is in libvdp.so, part of the apk bundle.
Protocol reversing was done with a combination of static analysis of the shared object with Ghidra and dynamic analysis with Frida.
The headers reversed with Ghidra are at types/all.h. They are almost not used by this minimal implementation though.
The hooks used with frida are at frida-hooks.js, but it's mostly a playground - some useful functions got deleted once I understood the protocol.
To execute the server, run make run; JPEG files will be created in a folder named captures.
Take APK from emulator/sacrificial device
adb shell pm list packages | grep ysx
adb shell pm path com.ysxlite.cam
adb shell pm path com.ysxlite.cam | while read -r line ; do adb pull $(echo $line | cut -d: -f2-) ; done
Push to sacrificial device
adb install-multiple *apk