Cheerson CX-10W CX-10WD WIFI Profotol?

Cheerson's mini drones CX-10W, CX-10WD, and some other models can be controlled by WIFI as well as conventional 2.4GHz RC. Some of these models also use WIFI to receive steaming video from onboard cameras.

The conventional TX protocols are available as deviation modules. However, seems little is known about the protocol used to control via WIFI. What protocol is used to control via WIFI and receive video via WIFI? Has anyone cracked this yet? Sniffing WIFI communication may be necessary to do so; have never used a WIFI packet sniffer.

Would like to develop custom control software on iOS and/or Andoird for these Cheerson WIFI capable mini drones.

The closest info I've found on this is the following reddit thread related to hacking the IP video and control protocol of the FQ777-954 which I believe uses the same or similar IP video board as the Cheerson CX-10W's.

www.reddit.com/r/HowToHack/comments/4512...camera_in_toy_drone/

(Unfortunately the code posted to tinyupload has disappeared.)

Pretty interesting read. Looks like there's javascript code linked at github in the last post. Looks like 8-bit channel values.

I haven't done any looking at wifi quads myself.

From what I gathered from mostly pictures in shops, those WIFI cams are basically autonomous and the instructions they receive via WIFI are sent to the board with a third wire (1+2 are power and GND).
I am waiting for a FQ777-951C module (cheapest one I could find) - I expect it to work with the iPhone just with power attached - while spitting out remote-commands on that one wire.

Utilizing the WIFI itself for your own app might be quite complex though. I would suspect some pretty obscure china-MCU plus unknown IP locked into this. After all it is live streaming video in under 5g weight and under $5 cost…
Of cause someone with WIFI sniffing skills might get something out of it - encryptions shouldn't bet that hard - or even existent - from what we know about other china-products.

Hi guys,
I've manager to reverse engineer the basic protocol (Handshake, Heartbeat, Controls, Video).
Right now I'm able to control the CX10-WD through an XBox Controller and playing the preview and save a copy of the streaming locally.
I've done it in Java. I'll publish it on github once I have completed the first version.

Cool news!
I wonder if an ESP8266 would be fast enough to receive the stream and output to a cheap TFT…
That would be < €15,- for parts.

The controls from the camera-module are sent to the flight-controller via the yellow cable, right?
Have you checked what gets sent with a logic analyzer? Would be interesting to know if it uses some known protocol or something special.
looking at this spare part: www.aliexpress.com/item/New-Arrival-Chee...era/32715411514.html

...as promised...

github.com/Otacon/wifi_china_drone_controller

First of all, great work on the code. I just have a quick question, in the your nalDecoder, how are you decoding before feeding it to ffplay? Is it some standard protocol or did you deduce it from the video stream?

Thanks @sha
Basically the NalDecoder is a flow-rewriting-thing.
The codec used by the drone is a variant of real-time x264. So I've studied how the data flow is structured on x264.
I've started then logging the stream flow (man in the middle attack) and comparing the NALs in the stream with the ones produced by the android app (yes, the app stores the processed stream into a file on the device's memory).
Once I've started comparing the NALs streamed and the ones in the file I noticed some differences on them and I've tried to figure out how to "translate" the stream to match the exact format of the one stored into the file.
I made here it quick and simple, but to find this solution it took me 3 weeks.

Other approaches I tried to follow are: unpack the android .apk, try to find a library that works with that stream, try to decode that stream with every tool in the world (it actually works just on ffmpeg-based players), try to decode all the other streams (there are 4 or 5 connections going on when you turn on the drone) etc etc etc
If you need more explanations let me know

Cyanotic87,
Awesome work, Is there a way that you know of to get into the wifi chip of this model and play with it. My intentions are to make 4 or 5 of these receive commands from one iphone controller. I have tried to crack into the interface of the NIC with no luck.
Thanks for any feedback in advance

Anyone interested in doing the same for the new cheerson cx-of drone?

www.cheersonhobby.com/en-US/Home/ProductDetail/149

I have tried this program on Ubuntu Linux and find the video playback freezes up completely after about 50 seconds +-. And it always does that. The recording did not work for Linux at all, I had to change the code and recompile to get recording to work on Linux. What can I do to get it to play the video contstantly, I am not sure why it is always freezing up like that. I must kill ffplay completely and restart drone_protocol.jar to get the video playback to play at all and then it freezes again.