H920 ST24 Mod FlightMode APK Control Strobe Lights, ect...

JoeCowboy · Jul 17, 2024

Where to start. I have have looked through the latest firmware for the ST24 to see what can be done with it. I have rooted the Android 4.1.1 so I can mod the FlightMode APK that controls all things on the H920.
Since the FlightMode APK is a system app I used Luck Patcher to uninstall it so I could install my modded version of the APK. One reason too I had to remove the because of signing the APK the signature does not match.
I have added a GoPro with the LK58 in the logic trying to get it to work with the GB603 gimbal. It shows up in the camera list just fine to select it but I just cannot get FlightMode to display the video, will not connect. I tested the rtsp stream
by logging into the LK58 wifi and seeing if the LK58 is streaming the video from the GoPro. So far no video stream from rtsp://192.168.73.254:8557/PSIA/Streaming/channels/2?videoCodecType=H.264

You can use APK Easy Tool to Decompile and Compile the APK but I used to just Sign the APK.
I used the command line apktool from Apktool | Apktool

There are a couple of places in the FlightMode APK that you have to mod:
camera_command.xml to add the Camera and mod the source code logic in the module Mainactivity.smali found in FlightMode\smali\com\yuneec\flightmode

One thing I am curious about is if it is sending the ID or name of the camera back collected from the HDMI EDID info. I really don't see that from the camera select code unless it's collected in the LK58 firmware.
Does anybody know the username and password for the telnet login of the LK58? Or does anyone have a firmware update for the LK58 that I could dump it and look through the firmware? Doing a port scan,
ports 23, 513 and 514 are open.

Interesting programmable device to emulate EDID info:

WolfPack Advanced HDMI EDID Emulator / Corrector

The HDTVEDID HDMI EDID Corrector resolves HDMI video stability & connection related issues

www.hdtvsupply.com

If you want to see it in JAVA script form you can use JADX - Dex to Java decompiler. If someone can tell me how to compile it after you dump the code from JADX or import it into Android Studio would be awesome.

One of the other reasons I am working on this is to add the ablility to turn on and off Strobe Lights to be compliant with the FAA 3 mile for night flight. I want to use the strobes from here:

STROBON v2 Cree Edition - Navigation Strobe Lights

This product is compatible with the latest FAA and CAA anti-collision lights rules for drones. It can be seen from at least 3 miles at night. STROBON Lights are the most powerful navigation lights on the model market for years. These Cree Edition lights are brighter and coming in polycarbonate...

store.flytron.com

I want design a mount (need help) so I can run the wiring of the strobes inside the tubes with the motor control wires and then one on top of the H920 or make a double mount for white strobes for the center arms one mounted up and one mounted down.
But the question is where can you tap into the Yuneec FCO to control the strobes. Then I can work on adding the contole code into the
FlightMode APK to be able to turn on and off the strobes from the main interface screen. Also, need an interface to capture the packets and read the on and off signal sent. Maybe an arduino board?

Interesting Github project for the SR24 receiver:

GitHub - h-elsner/SR24_decode: Read and decode data from Yuneec ZigBee receiver SR24. Test tool for Raspberry Pi.

Read and decode data from Yuneec ZigBee receiver SR24. Test tool for Raspberry Pi. - h-elsner/SR24_decode

github.com

Ideas are welcome and needed. Thank you!

JoeCowboy · Jul 18, 2024

I was wondering if someone could point me to where I could download the Sony A7 and Panasonic, Android APKs for the Yuneec ProAction Dual Grip Ground Handle with GB603 Gimbal. I want to go through the source code to see how it talks to the LK58 Video Downlink.

h-elsner · Jul 18, 2024

The CGO4 app (Panasonic) is here for example: https://apkcombo.com/de/cgo4/com.yuneec.android.cgo4
apkpure has it also.

JoeCowboy · Jul 19, 2024

h-elsner said:
The CGO4 app (Panasonic) is here for example: https://apkcombo.com/de/cgo4/com.yuneec.android.cgo4
apkpure has it also.

It looks like Yuneec in both this app and the FlighMode app logs into the WiFi of the Panasonic Lumix GH4 to control it.
Connects to http://192.168.54.1/ to run commands and looks like it might be using the LK58 as a WiFi bridge? Not sure until I can telnet into the LK58. I don't own a
Panasonic Lumix GH4. The default WiFi SSID (network name) for the Panasonic Lumix GH4 camera is typically something like "LUMIX-GH4_xxxxxx".
I don't see this any text with "LUMIX-GH4" in any of the source code and so that leads to believe the LK58 is logging into the camera's WiFi.
If someone can please let me know if this is the case. Also when you select the Panasonic GH3/GH4 camera on the ST24 does it ask for the WiFi password of the camera?

h-elsner · Jul 19, 2024

For CGO3 and CGO3+ the camera offers a WiFi hotspot with its own DCHP server where devices like mobil phones, laptops or even the ST16 can connect via the normal WiFi connection procedure where SSID starts with camera name followed by a unique number (I think part from the MAC address). Panasonic cam seems to be the same.

The control of the camera (not gimbal) is done by CGI commands.
More about this: CGO3control/docs at main · h-elsner/CGO3control
I believe you can use CGO3control also to send commands and receive answers from GH4 too. Not tested yet. It is worth to try.

h-elsner · Jul 19, 2024

JoeCowboy said:
Also when you select the Panasonic GH3/GH4 camera on the ST24 does it ask for the WiFi password of the camera?

Yes.
~~But I forgot to say that GH4 has it's own WiFI and do not need a LK58.~~

Edit:
Sorry, I mixed up CGO4 with GH4. CGO4 is also a Panasonic GH4 but has it's own Wifi module. I have only a CGO4 to test with.

JoeCowboy · Jul 19, 2024

h-elsner said:
For CGO3 and CGO3+ the camera offers a WiFi hotspot with its own DCHP server where devices like mobil phones, laptops or even the ST16 can connect via the normal WiFi connection procedure where SSID starts with camera name followed by a unique number (I think part from the MAC address). Panasonic cam seems to be the same.

The control of the camera (not gimbal) is done by CGI commands.
More about this: CGO3control/docs at main · h-elsner/CGO3control
I believe you can use CGO3control also to send commands and receive answers from GH4 too. Not tested yet. It is worth to try.

I can connect to the LK58 WiFi with my laptop but like I stated above only ports that are open upon connection are 23 (telent), 513 and 514 (rlogin, but cannot connect with rlogin).

When you telnet into the bet LK58 using the IP address 192.168.73.254 or 192.168.7.249 the IP address from the following greeting:

_____ _____ _ _
| _ |___ ___ ___ ___ | _ |___ ___ |_|___ ___| |_
| | _| .'| . | . | | __| _| . | | | -_| _| _|
|__|__|_| |__,|_ |___| |__| |_| |___|_| |___|___|_|
|___| |___|

Arago Project http://arago-project.org 192.168.7.249

Arago 2009.11 192.168.7.249

192.168.7.249 login:

The Arago is an embedded Linux from Texas Instruments:

CGit @ Texas Instruments - Open Source Git Repositories - git.TI.com/cgit

Texas Instruments Git Open Source Repositories

git.ti.com

I think the LK58 is sitting there looking for SSIDs of the Panasonic Lumix GH3/GH4 and the Sony A7ii. Then once connected HTTP and RTSP services start. If this is the case,
need a way to telnet into the LK58 and tell it to ignore logging into WiFi of the cameras and continue on to enabling HTTP and RTSP so can get live video feed from any camera placed on the GB603 gimbal.
You will not have camera control but that can always be added later. Should take these methods and create generic calls for other camera model commands and those camera commands to be stored in FlightMode database.

Here is a code Dex to Java snippet from FlightMode APK as you can see it sends cgi commands to the Panasonic Lumix GH4:

Java:

    @Override // com.yuneec.IPCameraManager.C0149i, com.yuneec.IPCameraManager.AbstractC0154n
    /* renamed from: a */
    public void mo418a() {
        this.f399a = "http://192.168.54.1/";
        this.f400b = "DCIM/100MEDIA/";
        this.f401c = "YUNC[\\w]*\\.THM";
        this.f402d = "YUNC[\\w]*\\.mp4";
        this.f403e = null;
        this.f404f = null;
        this.f405g = 10000;
        this.f406h = 10000;
    }

    @Override // com.yuneec.IPCameraManager.C0149i, com.yuneec.IPCameraManager.AbstractC0154n
    /* renamed from: a */
    public void mo419a(Messenger messenger) {
        Log.i("LumixGH4", "syncTime");
        m528a(this.f399a + "cam.cgi?mode=setsetting&type=clock&value=" + (new SimpleDateFormat("yyyyMMddHHmmss").format(Calendar.getInstance().getTime()) + "+0000"), messenger, 1, 301);
    }

    @Override // com.yuneec.IPCameraManager.C0149i, com.yuneec.IPCameraManager.AbstractC0154n
    /* renamed from: a */
    public void mo421a(Messenger messenger, C0147g c0147g) {
        Message obtain = Message.obtain();
        obtain.what = 1;
        obtain.arg1 = 12;
        obtain.obj = "HTTPCODE OK";
        try {
            messenger.send(obtain);
        } catch (RemoteException e) {
            e.printStackTrace();
        }
    }

    @Override // com.yuneec.IPCameraManager.C0149i, com.yuneec.IPCameraManager.AbstractC0154n
    /* renamed from: a */
    public void mo422a(Messenger messenger, String str) {
        Log.i("LumixGH4", "startRecord");
        m528a(this.f399a + "cam.cgi?mode=camcmd&value=video_recstart", messenger, 2, 301);
    }

    /* renamed from: a */
    public void m438a(Messenger messenger, String str, String str2, String str3) {
        String str4 = str3 == null ? this.f399a + "cam.cgi?mode=setsetting&type=" + str + "&value=" + str2 : this.f399a + "cam.cgi?mode=setsetting&type=" + str + "&value=" + str2 + "&value2=" + str3;
        Log.i("LumixGH4", "setCurrentMenu : " + str4);
        m528a(str4, messenger, 75, 301);
    }

    /* renamed from: a */
    public void m439a(Messenger messenger, String str, boolean z) {
        Log.i("LumixGH4", "fixFocus--value=" + str + ", enable=" + z);
        m528a(this.f399a + "cam.cgi?mode=camctrl&type=touch&value=" + str + "&value2=" + (z ? "on" : "off"), messenger, 64, 301);
    }

    /* renamed from: a */
    public void m440a(Messenger messenger, boolean z) {
        Log.i("LumixGH4", "setAEenable: " + z);
        m528a(this.f399a + "cam.cgi?mode=camctrl&type=af_ae_lock&value=" + (z ? "on" : "off"), messenger, 47, 301);
    }

    /* renamed from: a */
    public void m441a(String str, Messenger messenger) {
        Log.i("LumixGH4", "zoom--operate:" + str);
        m528a(this.f399a + "cam.cgi?mode=camcmd&value=" + str, messenger, 8, 301);
    }

    @Override // com.yuneec.IPCameraManager.C0149i, com.yuneec.IPCameraManager.AbstractC0154n
    /* renamed from: a */
    public void mo423a(String str, Messenger messenger, String str2) {
        Log.i("LumixGH4", "snapShot");
        m528a(this.f399a + "cam.cgi?mode=camcmd&value=capture", messenger, 4, 301);
    }

    @Override // com.yuneec.IPCameraManager.C0149i, com.yuneec.IPCameraManager.AbstractC0154n
    /* renamed from: b */
    public void mo424b(Messenger messenger) {
        m528a(this.f399a + "cam.cgi?mode=camcmd&value=recmode", messenger, 24, 301);
    }

    @Override // com.yuneec.IPCameraManager.C0149i, com.yuneec.IPCameraManager.AbstractC0154n
    /* renamed from: b */
    public void mo426b(Messenger messenger, String str) {
        Log.i("LumixGH4", "stopRecord");
        m528a(this.f399a + "cam.cgi?mode=camcmd&value=video_recstop", messenger, 3, 301);
    }

    /* renamed from: c */
    public void m442c(Messenger messenger, String str) {
        Log.i("LumixGH4", "manualFocus--operate:" + str);
        m528a(this.f399a + "cam.cgi?mode=camctrl&type=focus&value=" + str, messenger, 65, 301);
    }

    /* renamed from: d */
    public void m443d(Messenger messenger, int i) {
        Log.i("LumixGH4", "startUdpDatagram");
        m528a(this.f399a + "cam.cgi?mode=startstream&value=" + String.valueOf(i), messenger, 76, 301);
    }

    /* renamed from: d */
    public void m444d(Messenger messenger, String str) {
        Log.i("LumixGH4", "setExposure:" + str);
        m528a(this.f399a + "cam.cgi?mode=setsetting&type=exposure&value=" + str, messenger, 55, 301);
    }

    @Override // com.yuneec.IPCameraManager.C0149i, com.yuneec.IPCameraManager.AbstractC0154n
    /* renamed from: e */
    public void mo430e(Messenger messenger) {
        Log.i("LumixGH4", "getWorkStatus");
        m528a(this.f399a + "cam.cgi?mode=getstate", messenger, 37, 301);
    }

    /* renamed from: e */
    public void m445e(Messenger messenger, String str) {
        Log.i("LumixGH4", "setWhiteBalance: " + str);
        m528a(this.f399a + "cam.cgi?mode=setsetting&type=whitebalance&value=" + str, messenger, 53, 301);
    }

    @Override // com.yuneec.IPCameraManager.C0149i
    /* renamed from: f */
    public void mo431f(Messenger messenger) {
        Log.i("LumixGH4", "resetDefault");
        m528a(this.f399a + "cam.cgi?mode=setsetting&type=systemmenu&value=reset", messenger, 43, 301);
    }

    /* renamed from: f */
    public void m446f(Messenger messenger, String str) {
        Log.i("LumixGH4", "setISO:" + str);
        m528a(this.f399a + "cam.cgi?mode=setsetting&type=iso&value=" + str, messenger, 66, 301);
    }

    /* renamed from: g */
    public void m447g(Messenger messenger, String str) {
        Log.i("LumixGH4", "setShutterTime:" + str);
        m528a(this.f399a + "cam.cgi?mode=setsetting&type=shtrspeed&value=" + str + "/256", messenger, 68, 301);
    }

    /* renamed from: h */
    public void m448h(Messenger messenger, String str) {
        Log.i("LumixGH4", "setAperture:" + str);
        m528a(this.f399a + "cam.cgi?mode=setsetting&type=focal&value=" + str + "/256", messenger, 70, 301);
    }

    /* renamed from: i */
    public void m449i(Messenger messenger) {
        Log.i("LumixGH4", "stopZoom");
        m528a(this.f399a + "cam.cgi?mode=camcmd&value=zoomstop", messenger, 8, 301);
    }

    /* renamed from: i */
    public void m450i(Messenger messenger, String str) {
        Log.i("LumixGH4", "setProgrameShift:" + str);
        m528a(this.f399a + "cam.cgi?mode=camctrl&type=program_shift&value=" + str, messenger, 78, 301);
    }

    /* renamed from: j */
    public void m451j(Messenger messenger) {
        Log.i("LumixGH4", "getWhiteBalance");
        m528a(this.f399a + "cam.cgi?mode=getsetting&type=whitebalance", messenger, 54, 301);
    }

    /* renamed from: j */
    public void m452j(Messenger messenger, String str) {
        Log.i("LumixGH4", "getSingleCurrentMenu");
        m528a(this.f399a + "cam.cgi?mode=getsetting&type=" + str, messenger, 82, 301);
    }

    /* renamed from: k */
    public void m453k(Messenger messenger) {
        Log.i("LumixGH4", "getLensInfo");
        m528a(this.f399a + "cam.cgi?mode=getinfo&type=lens", messenger, 79, 301);
    }

    /* renamed from: l */
    public void m454l(Messenger messenger) {
        Log.i("LumixGH4", "getCurrentMenu");
        m528a(this.f399a + "cam.cgi?mode=getinfo&type=curmenu", messenger, 74, 301);
    }

    /* renamed from: m */
    public void m455m(Messenger messenger) {
        Log.i("LumixGH4", "stopUdpDatagram");
        m528a(this.f399a + "cam.cgi?mode=stopstream", messenger, 77, 301);
    }

    /* renamed from: n */
    public void m456n(Messenger messenger) {
        Log.i("LumixGH4", "turnOnLens");
        m528a("http://192.168.73.254/cgi-bin/cgi?CMD=START_CAMERA", messenger, 80, 301);
    }

    /* renamed from: o */
    public void m457o(Messenger messenger) {
        Log.i("LumixGH4", "turnOffLens");
        m528a("http://192.168.73.254/cgi-bin/cgi?CMD=STOP_CAMERA", messenger, 81, 301);
    }

JoeCowboy · Jul 19, 2024

h-elsner said:
Yes.
~~But I forgot to say that GH4 has it's own WiFI and do not need a LK58.~~

Edit:
Sorry, I mixed up CGO4 with GH4. CGO4 is also a Panasonic GH4 but has it's own Wifi module. I have only a CGO4 to test with.

The CGO4 has it's own dedicated camera class and methods in the FlightMode APK.

JoeCowboy · Jul 19, 2024

Talking about the GoPro they do have their own Github account now OpenGoPro. But, I like the original guy that got them started Github info better shows the WiFi commands for the different GoPro models:

GitHub - KonradIT/goprowifihack: Unofficial GoPro WiFi API Documentation - HTTP GET requests for commands, status, livestreaming and media query.

Unofficial GoPro WiFi API Documentation - HTTP GET requests for commands, status, livestreaming and media query. - KonradIT/goprowifihack

github.com

And GoPro's Github:

GitHub - gopro/OpenGoPro: An open source interface specification to communicate with a GoPro camera with accompanying demos and tutorials.

An open source interface specification to communicate with a GoPro camera with accompanying demos and tutorials. - gopro/OpenGoPro

github.com

JoeCowboy · Jul 22, 2024

Okay, couple things. One, I have been using NMAP trying to brute force the telnet login. Slow process, I might have better luck just trying to see if there is a serial port connection on the main board. I was looking at the FCC filings for the
LK58 and on the main PCB there are 6 solder points. Either JTAG or hopefully comm connection RX and TX but will not know until I tear the LK58 down. Maybe UBOOT is enabled to where you can download the firmware.
Really do not want to dump the flash by de soldering the chip.... I wish someone had a copy of the LK58 firmware already.

Secondly, I tested the HDMI output on my GoPro Hero 3+ Black and there is video output. I had to buy an adapter to check.

Going back to my first post looking at the Yuneec FCO module the four AUX ports are plugged into the Yuneec Tornado H920 Plus SWITCH BOARD but what do they do?

Can the Y-BUS2 be used for anything on the SR24 original for the H920? Since it's a UART port does it mirror the data of Y-BUS1? So if you send data from the controller maybe connect it to a arduino board to capture the packets sent to turn on and off the strobe lights?

JoeCowboy · Jul 26, 2024

Okay, I dumped the AMTEL304 24C04N chip from the LK58 transmitter I have taken a few pics of the board. I haven't dumped the contents of the SAMSUNG 422 / K9F1G8U0D / SCB0. If you look that the pic of the SAMSUNG flash I am not sure if that is a JTAG connection pads. Also, looks
like a hidden card slot on the LK58. It also has a hidden micro USB port on the Wifi board. When you plug USB cable into it and then into the PC it gives you a 802.11n NIC with this device ID: USB\VID_0BDA&PID_8193&REV_0000 I have tried to install drivers for it but as of yet been able to get them to load correctly.

JoeCowboy · Jul 29, 2024

h-elsner said:
Yes.
~~But I forgot to say that GH4 has it's own WiFI and do not need a LK58.~~

Edit:
Sorry, I mixed up CGO4 with GH4. CGO4 is also a Panasonic GH4 but has it's own Wifi module. I have only a CGO4 to test with.

I went ahead and bought the CG04+. I know it's not supposed to be used with the H920 non Plus model. But, I do have a ST16 remote. I have been looking through the FlightMode APK to see differences there are a few but looks like should be able to get it to work with the ST24 with some APK mods.
What's funny looking through the code of the ST16 FlightMode APK the missing cameras that are not in the list the code is still in the APK. I might make a modded APK and add all the missing cameras and maybe the models see if they work. Comparing the models data for the H920, analog.csv, curves.csv, manifest.csv, switches.csv, all the other model's data might have to be tweaked to use the ST16 controls? Hard to test without all the hardware.....

JoeCowboy · Aug 3, 2024

JoeCowboy said:
I went ahead and bought the CG04+. I know it's not supposed to be used with the H920 non Plus model. But, I do have a ST16 remote. I have been looking through the FlightMode APK to see differences there are a few but looks like should be able to get it to work with the ST24 with some APK mods.
What's funny looking through the code of the ST16 FlightMode APK the missing cameras that are not in the list the code is still in the APK. I might make a modded APK and add all the missing cameras and maybe the models see if they work. Comparing the models data for the H920, analog.csv, curves.csv, manifest.csv, switches.csv, all the other model's data might have to be tweaked to use the ST16 controls? Hard to test without all the hardware.....

I received my CGO4+ in the mail and installed it onto the Yuneec H920. I can connect to the camera just fine, get video stream and use the camera controls on the ST24 and ST16 but neither will control the gimbal.
Just like in the following forum thread:

A few questions about the CGO4...

Avrai bisogno dell'ST24. Grazie Gentilissimo Translated by Moderator: Thanks very kind

yuneecpilots.com

I logged into the WiFi on the gimbal with my laptop but it would not give me an IPV4 address. So I used a static IP address in the range of the gateway IP 192.168.73.254.

I also did a port scan after setting up a static IP address, scanned the IP 192.168.73.254 and found the following open ports (23, 80, 513, 514, 8300, 8301, 8302, 8303, 8304, 8553, 8554, 8555, 8556, 8557)

When logging into telnet port 23 I received the following:
_____ _____ _ _
| _ |___ ___ ___ ___ | _ |___ ___ |_|___ ___| |_
| | _| .'| . | . | | __| _| . | | | -_| _| _|
|__|__|_| |__,|_ |___| |__| |_| |___|_| |___|___|_|
|___| |___|

Arago Project http://arago-project.org DM368E_IPNC

Arago 2009.11 DM368E_IPNC

DM368E_IPNC login: root
Password:
Login incorrect

I found the following information on a Texas Instruments website about the IPNC DM368:

LINUXDVSDK-DM36X Software development kit (SDK) | TI.com

View the TI LINUXDVSDK-DM36X Software development kit (SDK) downloads, description, features and supporting documentation and start designing.

www.ti.com

is DM368 able to reach H264 encoding 12FPS at 5MP? - Processors forum - Processors - TI E2E support forums

Hi, We are approaching a project which require H264 encoder can perform 12fps at 5MP resolution. According to TI wiki and our evaluation, we found the best performance

e2e.ti.com

dm368 1080p performance issue - Processors forum - Processors - TI E2E support forums

We are having issues getting full 30 fps on 1080p stream for DM368. The hardware configuration is: ARM : 486MHz DDR :360MHz HDVICP: 360MHz The software

e2e.ti.com

Also this website talking about the DM36x:

DM36x Product Family - Zeeis

Zeeis offers the world’s most complete product line of TI DaVinci™ DM365/DM368 processors, DM36x products are the part of the low-cost DaVinci™ development solution for small to enterprise level organizations.

zeeis.com