User Tools

Site Tools


projects:omd:start

Olympus OM-D Firmware & WLAN Hacks

This page collects details about the protocol and internals of Olympus WiFi enabled Cameras. Usually the only way to communicate with your camera is the Image Share (Oi.Share) Android/iOS App by Olympus.

There's a Qt library which uses this information to provide a clean and open access to all functions of your camera: https://github.com/stv0g/libqt-omd

The Oi.Share App also allows to talk to Toshiba Flash Air SD-Cards. Toshiba has released a detailed description of the protocol they use for their SD cards. Fortunately some parts of these protocols are similar.

Protocol

  • Camera open WLAN hotspot
    • 2.4 GHz Channel: 1
    • Cam IP address: 192.168.0.10

HTTP

The following protocol documentation if for the Olympus OM-D E-M10 with firmware version 1.2

get_unusedcapacity.cgi

Get free capacity on the camera SD drive in bytes.

At maximum this is equal to 4 GiB. Everything above is ignored? FIXME

HTTP Method: GET

Mode: FIXME

URL: http://192.168.0.10/get_unusedcapacity.cgi

Response:

<?xml version="1.0" ?>
<unused>4294967295</unused>

get_commandlist.cgi

Get list of available CGI commands and allowed parameters:

HTTP Method: GET

Mode: FIXME

URL: http://192.168.0.10/get_commandlist.cgi

Response: see here

get_connectmode.cgi

Get current WLAN connection mode: private or FIXME

HTTP Method: GET

Mode: all

URL: http://192.168.0.10/get_connectmode.cgi

Response:

<?xml version="1.0"?>
<connectmode>private</connectmode>

switch_cammode.cgi

Switch camera mode: play, rec and set liveview quality/resolution

HTTP Methode: GET

Mode: all

URL:

Parameters:

Parameter Allowed values Description
mode rec Recording
play Playback
shutter Shutter

Response: HTTP code 200 on success. No body

Content-Type: www/unknown

exec_pwoff.cgi

Shutdown camera

URL: http://192.168.0.10/exec_pwoff.cgi

Response: HTTP code 200 on success. No body

Content-Type: www/unknown

exec_takemotion.cgi

Response: for http://192.168.0.10/exec_takemotion.cgi?com=assignafframe&point=0227x0172

<?xml version="1.0"?>
<response>
  <affocus>ok</affocus>
  <afframepoint>0209x0154</afframepoint>
  <afframesize>0036x0036</afframesize>
</response>

Response: for http://192.168.0.10/exec_takemotion.cgi?com=starttake&upperlimit=200

<?xml version="1.0"?>
<response>
  <take>ok</take>
  <affocus>ok</affocus>
  <afframepoint>0209x0154</afframepoint>
  <afframesize>0036x0036</afframesize>
</response>

exec_takemisc.cgi

Mode: FIXME

Response: for http://192.168.0.10/exec_takemisc.cgi?com=getrecview

HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 324553

Response: for http://192.168.0.10/exec_takemisc.cgi?com=startliveview&port=54578

<?xml version="1.0" encoding="UTF-8"?>
<funcidlist>
  <funcid name="framesize" />
  <funcid name="afframeinfo" />
  <funcid name="mntmediainfo" />
  <funcid name="rotation" />
  <funcid name="maxtakenum" />
  <funcid name="temperror" />
  <funcid name="battempty" />
  <funcid name="shutspeedvalue" />
  <funcid name="focalvalue" />
  <funcid name="expcomp" />
  <funcid name="wbvalue" />
  <funcid name="isospeedvalue" />
  <funcid name="contnotstop" />
  <funcid name="aspectratio" />
  <funcid name="liveaddinfo" />
  <funcid name="expphotowarning" />
  <funcid name="focusinfo" />
  <funcid name="zoominfo" />
</funcidlist>

get_caminfo.cgi

Get model of camera: E-M10

Mode: FIXME

URL: http://192.168.0.10/get_caminfo.cgi

Response:

<?xml version="1.0"?>
<caminfo>
  <model>E-M10</model>
</caminfo>

get_camprop.cgi

set_camprop.cgi

Set camera settings.

Mode: FIXME

Request: for http://oishare/set_camprop.cgi?com=set&propname=takemode

<?xml version="1.0"?>
<set>
  <value>A</value>
</set>

Request: for http://oishare/set_camprop.cgi?com=set&propname=drivemode

<?xml version="1.0"?>
<set>
  <value>continuous-H</value>
</set>

Response: HTTP code 200 on success. No body

get_thumbnail.cgi

Mode: FIXME

URL: http://192.168.0.10/get_thumbnail.cgi?DIR=/DCIM/100OLYMP/PC150004.JPG

Response:

Content-Type: image/jpeg

get_imglist.cgi

get_rsvimglist.cgi

Get list of images which are marked for transfer via the camera menu.

HTTP Method: GET

Mode: FIXME

URL: http://192.168.0.10/get_rsvimglist.cgi

Response:

Content-Type: text/plain

VER_100
/DCIM/100OLYMP,PC150001.JPG,7746678,0,17807,41094
/DCIM/100OLYMP,PC150006.JPG,7771088,0,17807,4474

<directory>,<filename>,<size>,<attribute>,<date>,<time>

These lines are separabe by comas as follows:

# Field Example Description
0 <directory> /DCIM/100OLYMP File directory name
1 <filename> PC150006.JPG File name
2 <size> 7771088 The size of the file in bytes (decimal form)
3 <attribute> 0 The attributes of the file (decimal form)
4 <date> 17807 The date of the file (decimal form)
5 <time> 4474 The time of the file (decimal form)

Attribute is specified in decimal 16-bit integer in the following formats (unverified):

Bit Description
5 Archive
4 Directly
3 Volume
2 System file
1 Hidden file
0 Read only

Date is specified in decimal 16-bit integer in the following formats (unverified):

Bit Field Description
15-9 Year Specify a value based on 0 as a 1980.
8-5 Month Specify a value from 1 to 12.
4-0 Day Specify a value from 1 to 31.

Time is specified in decimal 16-bit integer in the following formats (unverified):

Bit Description
15-11 Hour
10-5 Minute
4-0 Second / 2

The line format seems to be identical to the one used by Toshiba Flash-Air SD cards. See: https://flashair-developers.com/en/documents/api/commandcgi/#100

clear_resvflg.cgi

Clear flags of pictures marked for transfer.

HTTP Method: GET

Mode: FIXME

URL: http://192.168.0.10/clear_resvflg.cgi

Response: HTTP code 200 on success. No body

Content-Type: www/unknown

Liveview

  • The camera supports a live stream over wifi of the current viewfinder.
  • The video is streamed via UDP packets
    • Every frame is splitted in several chunks (~5-20) UDP packages
  • Every frame is encoded in JPEG
    • See Wikipedia for a detailed description of the JPEG format
  • The stream has to started by issuing a HTTP GET request which includes the destination UDP port.
  • The stream can be stopped by issuing another HTTP request.
  • Depending on the camera, a few differend resolutions a available.

Packet / Frame format

Take a look here for a decoded and annoted frame.

Byte Description Size Values Description
1 - 2 Packet type 2 0x9060 Start of frame
0x8060 Middle part
0x80e0 End of frame
3 - 4 Number of frame chunk 2
5 - 8 Unique id per frame 4
9 - 12 Unique id per stream 4

Source

From: http://dpzen.com/comment/2604719#comment-2604719

Hi Airelle,
I'm gone the same way on analysing the video stream.
SOI and EOI markers were the hint that MJPEG is used.
The camera transmittes around 20 images per second if a resolution of 640 x 480 pixels is used.
Each image is splitted into several parts because it doesn't fit in one packet.
Each packet containes a 12 byte long header at the beginning with following structure:
In order to display such an image you have to collect all data beginning with 0xffd8 from start packet followed by data from following packets until 0xffd9.
From first packet you already have cut the header and the meta data section.
But you also have to cut the first 12 byte of header from all following packets.
That is your mistake during your previous work.
There is a mechanism for correct assembling of data packets realized per header data within each packet.
But during my tests it wasn't necessary to order the packets an no one packet was missing.
This is because the server (camera) and the client (the application) uses a direct network connection.
I would recommend to implement a header evaluation for your application, but for a simple test you can pass it.
Sorry for my poor english. I hope it is understandable anyway and will help you to develop your application.
Best Regards
Andreas

Existing Software

Forum Threads

projects/omd/start.txt · Last modified: 21:33 29.10.2017 (external edit)