0

I was recently given a trail camera, "wildlife camera." It works great, but the mobile app to connect and see the pictures/videos is very janky and hard to use. I write software for a living, so building something that can read files from a server is the easy part. What I'm trying to figure out is how to connect to the camera wirelessly. (I mostly figured that out while writing this post)

Here's what I can discern so far.

  1. The app appears to connect to bluetooth first.
  2. It then prompts "Join network TC08-...."
  3. I tried joining the wireless network directly from MacOS while connected to the app, it prompted me with the "hand-off" feature where you can share a password across devices. When I went and checked what password was shared it was, wait for it, 12345678.
  4. The network is only allows one device at a time (is that a thing?), because if I get the computer connected, the ios app can't connect.
  5. The wifi network only boots up when I connect to bluetooth, I assume this is a power-saving feature. I don't see the camera on my list of available bluetooth apps in MacOS.
  6. Once connected I used nmap to find the open ip/ports. Here's the list: 80, 443, 3333, 8192, 8193.
  7. I can navigate through the browser to the ip, and get download links for all the photos and videos, it's basically a very simple webpage: /DCIM/MOVIE is where the videos are stored.

So this is very close to my goal, however, I don't want to download each video file. The app has access to thumbnails of the video files, but I'm not sure where they are stored. I wonder if I could connect the two devices if I could use wireshark to view what paths are requested from the app?

The two parts I'd like to nail down:

  1. connect on bluetooth from the computer, so I can trigger the wifi to start.
  2. find the thumbnails so I don't have to download each video file.

1 Answer 1

0

Most definitely not a complete answer as we lack a lot of info and this is going to be a lot of trial and error to attempt to get something, but a few pointers:

  • iOS apps use BLE (Bluetooth Low Energy) rather than classic Bluetooth.
  • There are many BLE scanner apps available both in iOS and macOS. You should be able to find the device being advertised. In some you can even connect to the device. With some luck this is enough to enable WiFi.
  • You can use Core Bluetooth to communicate with the device from an app on your Mac
  • This will most likely involve scanning for devices, then connecting to the device, then possibly exchanging some data to control the camera and activate WiFi. As stated above, if you are lucky enough, just connecting to the device at the BLE level will be enough. If not then it’s going to be a lot harder because you need to find out what should be exchanged.
  • Once connected you can enumerate the services and characteristics of the device. With some more luck, some of them will be standard and give a hint of what is possible.
  • This is one example of a simple CLI app using Core Bluetooth.
  • If connecting is not enough and there are no standard services, you could try to make your Mac simulate the camera: you’ll need to switch the role of your Mac (run as a “Peripheral” rather than a “Central”), advertise the same data, services and characteristics as the camera, and see what the app sends.
  • If it’s more then just “set characteristic X of service Y to value Z” to enable WiFi, and there is an actual exchange, then you would probably need to run as both Central (with the camera as a Peripheral) and Peripheral (with the phone as Central) and relay messages between them, but this will probably require the phone not to be able to see the camera…

Are you sure the “hand-off” was from the device? My guess is that it’s more likely to be from your phone (and the phone got it from the app, there are APIs to automatically connect to WiFi networks).

As for the thumbnails, either they are somewhere in the file tree as well or there is some webservice to get them (as well as a list of videos etc.). If nothing seems to be available directly in the file hierarchy, what you could try is to have your Mac between the device and your phone while it is connecting. The details will vary depending on a number of details (including whether it uses an IP or a domain name, whether it uses TLS and actually checks certificates or not…).

It’s going to be a bit convoluted but you could share the connection to the device with another network (you’ll probably need to share to Ethernet and then have an AP for the iPhone to connect to), and start by observing using Wireshark what the phone sends (note that you’ll have to somehow separate what is actually from the app from the rest).

One other thing you could look into is to activate developer mode on your phone, then use the Console app (not Terminal, Console) to view the logs on your phone. Sometimes apps log lots of useful information.

4
  • this is a great answer and gives me a lot of directions. The BLE is good information: considering the wifi password is 12345678, I'm hoping that means simply connecting will trigger the wifi and web server to start. Although the Central/Peripheral sounds interesting, it'll probably run this experiment over the weekend timeframe. I don't have ssh access to the camera, so I can't look at the file tree. "have your Mac between the device and your phone," mh, like a proxy, good idea, although putting the phone in dev mode sounds like the easiest. I'll update if I make progress. Thanks again!
    – icicleking
    Jun 25, 2023 at 13:07
  • By file tree I meant what you see through you web browser and how you found the /DCIM/MOVIE folder I suppose. Note that another possibility is that there aren’t any thumbnails stored separately but that they are extracted from the movie itself (which would indeed be quite slow). I wonder, is the camera only reachable via WiFi? No USB?
    – jcaron
    Jun 25, 2023 at 13:42
  • There are ways to display a thumbnail from a video using the video tag with no controls or autoplay: <video src="path/to/video.mp4/>. What I'll have to experiment with is if the entire video is fetched, or if the browser can get just the first frame. (you can set witch second to view as well with ?t=2 parameter.
    – icicleking
    Jun 27, 2023 at 0:48
  • In a quick experiment, it looks like there's some browser magic to display that first frame before the entire video is downloaded. When using big buck bunny with throttled network I get the first frame at around 7.7MB of an 8.7MB download. This might also explain one of the reasons the app is so buggy: either they're on-the-fly generating thumbnails, or their relying on the app downloading the whole video. (The third possibility is the thumbnails are generated separately, and hidden is some obscured path, we can still hope)
    – icicleking
    Jun 27, 2023 at 1:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.