cam-reverse/README.md

Re-implementation of the "ilnk" protocol used on some cheap chinese cameras (sometimes branded as 'A9').

• Bought here.
• App is YsxLite

Per pictures the main chip is TXW817 (chinese, eng, google translate)

The interesting implementation is in libvdp.so, part of the apk bundle.

Protocol reversing was done with a combination of static analysis of the shared object with Ghidra and dynamic analysis with Frida.

The headers reversed with Ghidra are at types/all.h. They are almost not used by this minimal implementation though.

The hooks used with frida are at frida-hooks.js, but it's mostly a playground - some useful functions got deleted once I understood the protocol.

To execute the server, run make run; JPEG files will be created in a folder named captures.

Protocol

The protocol is weirdly complex, though very little communication is necessary to use the device

---
title: Establish session
---

sequenceDiagram
	autonumber
    App->>+Cam: LanSearch
    Cam->>-App: PunchPkt (SerialNo)
    App->>+Cam: P2PRdy
    Cam->>-App: P2PRdy
    App->>+Cam: ConnectUser
    Cam->>-App: ConnectUserAck (Video Token)
   
   loop Every 400-500ms
        Cam-->>+App: P2PAlive
        App-->>-Cam: P2PAliveAck
    end

---
title: Stream audio/video
---

sequenceDiagram
    App->>Cam: StreamStart (with Token)
   
   loop
        Cam-->>+App: Audio/Video Payload
        App-->>-Cam: DrwAck
    end

Take APK from emulator/sacrificial device

adb shell pm list packages | grep ysx
adb shell pm path com.ysxlite.cam
adb shell pm path com.ysxlite.cam | while read -r line ; do adb pull $(echo $line | cut -d: -f2-) ;  done

Push to sacrificial device

adb install-multiple *apk

Frida install Android

docs