10
\$\begingroup\$

Some, if not all, Fuji X-series cameras seem to contain a Wifi (802.11) network function with ability to send/upload/download files and possibly do some tethered shooting or remote control.

Mostly Fuji mentions this is for using their specific "apps".

There seems to be all the needed mechanisms for sending photos to a NAS or website or doing unlimited timelapses etc (whatever a dev dreams up) if only it could be automated instead of being stuck with interactive proprietary tools.

These could be killer documentation cameras (consistent manual exposure), for example.

Is there any better information or documentation on how this system works, what protocols might be involved, and whether there is a way to develop applications for this yourself?

\$\endgroup\$
1
  • \$\begingroup\$ Going to extract the cam app and see what i can find. That app only supports file transfer, not live feed. I am thinking i can just load the Fuji app in nox and sniff the traffic on my laptop vs trying to do it all on the phone. I will post back when i make some headroom. xAlimorAx \$\endgroup\$
    – xAlimorAx
    Jan 31, 2019 at 16:12

4 Answers 4

6
\$\begingroup\$

I was searching for something similar and found this GitHub repository, which was someone's attempt to reverse engineer the wi-fi protocol with the Fujifilm X-T10.

\$\endgroup\$
1
  • 1
    \$\begingroup\$ That's a good looking effort and I'll take that as a complete answer, though I never got a Fuji after all. \$\endgroup\$
    – XTL
    May 19, 2016 at 15:54
5
\$\begingroup\$

I have been scouring the 'net for info on connecting to my brand new fuji x-t10 from Linux, but have come up completely empty-handed.

I tried sniffing the connection (I installed a packet sniffer on my phone), and what I've come up with so far is that a tcp connection is made from the phone to 192.168.0.1 (which is the camera) on port 55740. It appears to be a message based protocol, with the first 4 bytes being the length of the packet.

This is roughly how far I've got, it doesn't look like an easy protocol to reverse-engineer, and I've never reverse-engineered anything before. I'll keep plodding away at this, but any help in analysing the protocol would be appreciated!

My goal would be to create a Raspberry Pi appliance that automatically connects to the camera when wifi is started on it and downloads all new images and puts them on my NAS, or to Google Photos or whatever. But that is faaar away...

\$\endgroup\$
3
  • \$\begingroup\$ Sounds very interesting. \$\endgroup\$
    – XTL
    Jun 28, 2015 at 17:24
  • \$\begingroup\$ Are you still able to monitor the connection? Or at least do you still have the dumps from that session a year ago? \$\endgroup\$
    – spectras
    Jun 10, 2016 at 11:21
  • \$\begingroup\$ I'm sorry to say that I didn't actually do much more about this :-(. And I can't even find my old dumps... \$\endgroup\$
    – DonOregano
    Jun 12, 2016 at 19:25
3
\$\begingroup\$

If you couldn't find any information about their protocol (you've probably also tried Google search for communication protocol keywords directly on their site by typing keyword site:fujifilm.com) it isn't probably readily available.

You can contact Fujifilm, explain them your intentions and they might help you.

There might also be another option - you can perform reverse engineering.

Warning: First of all, read carefuly their "Terms and Conditions" if you don't do anything illegal by eavesdropping on communication between the camera and their app.

If there's nothing wrong with that (I suspect some unofficial protocols have been obtained in a similar way), here are a few hints to do so.

  1. Download and install Kali Linux which contains all necessary software tools.
  2. Put your WiFi adapter into monitor mode and dump the communication between the server (camera) and a client (a Fujifilm Android app, for example).
  3. In case you set the key on your camera and in your app, you can use it to decrypt the communication after loading the dump file into Wireshark.
    On the other hand, if the password is hardcoded in your camera and your app (you don't know it), you might not be able to crack it. There are some tools to do so but they usually rely on a dictionary attack (uncertain results) and brute forcing here is almost impossible due to encryption complexity. You can also search the Internet.
  4. Provided you sucessfuly decoded the application - camera communication, you can record all interesting tasks and implement your own application accordingly.
\$\endgroup\$
1
  • \$\begingroup\$ Just so you're aware, it is not illegal to violate a TOS. \$\endgroup\$
    – DMCoding
    Jan 10, 2017 at 14:43
2
\$\begingroup\$

The developer of ShutterSnitch seems to have figured it out, it might be possible to get them to help you out.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.