How to inspect trail camera network

Question

I was recently given a trail camera, "wildlife camera." It works great, but the mobile app to connect and see the pictures/videos is very janky and hard to use. I write software for a living, so building something that can read files from a server is the easy part. What I'm trying to figure out is how to connect to the camera wirelessly. (I mostly figured that out while writing this post)

Here's what I can discern so far.

1. The app appears to connect to bluetooth first.
2. It then prompts "Join network TC08-...."
3. I tried joining the wireless network directly from MacOS while connected to the app, it prompted me with the "hand-off" feature where you can share a password across devices. When I went and checked what password was shared it was, wait for it, 12345678.
4. The network is only allows one device at a time (is that a thing?), because if I get the computer connected, the ios app can't connect.
5. The wifi network only boots up when I connect to bluetooth, I assume this is a power-saving feature. I don't see the camera on my list of available bluetooth apps in MacOS.
6. Once connected I used nmap to find the open ip/ports. Here's the list: 80, 443, 3333, 8192, 8193.
7. I can navigate through the browser to the ip, and get download links for all the photos and videos, it's basically a very simple webpage: /DCIM/MOVIE is where the videos are stored.

So this is very close to my goal, however, I don't want to download each video file. The app has access to thumbnails of the video files, but I'm not sure where they are stored. I wonder if I could connect the two devices if I could use wireshark to view what paths are requested from the app?

The two parts I'd like to nail down:

1. connect on bluetooth from the computer, so I can trigger the wifi to start.
2. find the thumbnails so I don't have to download each video file.

Answer 1

Most definitely not a complete answer as we lack a lot of info and this is going to be a lot of trial and error to attempt to get something, but a few pointers:

• iOS apps use BLE (Bluetooth Low Energy) rather than classic Bluetooth.
• There are many BLE scanner apps available both in iOS and macOS. You should be able to find the device being advertised. In some you can even connect to the device. With some luck this is enough to enable WiFi.
• You can use Core Bluetooth to communicate with the device from an app on your Mac
• This will most likely involve scanning for devices, then connecting to the device, then possibly exchanging some data to control the camera and activate WiFi. As stated above, if you are lucky enough, just connecting to the device at the BLE level will be enough. If not then it’s going to be a lot harder because you need to find out what should be exchanged.
• Once connected you can enumerate the services and characteristics of the device. With some more luck, some of them will be standard and give a hint of what is possible.
• This is one example of a simple CLI app using Core Bluetooth.
• If connecting is not enough and there are no standard services, you could try to make your Mac simulate the camera: you’ll need to switch the role of your Mac (run as a “Peripheral” rather than a “Central”), advertise the same data, services and characteristics as the camera, and see what the app sends.
• If it’s more then just “set characteristic X of service Y to value Z” to enable WiFi, and there is an actual exchange, then you would probably need to run as both Central (with the camera as a Peripheral) and Peripheral (with the phone as Central) and relay messages between them, but this will probably require the phone not to be able to see the camera…

Are you sure the “hand-off” was from the device? My guess is that it’s more likely to be from your phone (and the phone got it from the app, there are APIs to automatically connect to WiFi networks).

As for the thumbnails, either they are somewhere in the file tree as well or there is some webservice to get them (as well as a list of videos etc.). If nothing seems to be available directly in the file hierarchy, what you could try is to have your Mac between the device and your phone while it is connecting. The details will vary depending on a number of details (including whether it uses an IP or a domain name, whether it uses TLS and actually checks certificates or not…).

It’s going to be a bit convoluted but you could share the connection to the device with another network (you’ll probably need to share to Ethernet and then have an AP for the iPhone to connect to), and start by observing using Wireshark what the phone sends (note that you’ll have to somehow separate what is actually from the app from the rest).

One other thing you could look into is to activate developer mode on your phone, then use the Console app (not Terminal, Console) to view the logs on your phone. Sometimes apps log lots of useful information.