Reversing video protocol for chinese drone so i can view the stream outside of the app

Question

I am trying to view the video stream of the vento protocol air drone on my computer. The final goal is to get the video stream into python or c++ for opencv; however, if i can just view it in a window that would work too. This is my first reverse engineering project ever.

The drone communicates with the phone over wifi, It creates a hotspot which the phone connects to. Then through the app you can view the video and also control the drone. The first thing i did was port scan it and found out it had udp port 67 (for dhcp I think) and 49153. I also captured the wireless traffic between my phone when I was streaming the video, but not controlling, in an attempt to identify what protocol it was using and implement it on the pc. In the capture it has a bunch of udp packets of length 1516 coming from the drone to the phone and a few smaller packets. I think the bigger packets are the video. There are also a bunch of 802.11 packets being exchanged between the drone and the phone, even after the initial connection. I tried decoder the larger udp packets for a few different video streaming protocols but they all just made junk. Here is a tar of the capture.

I also looked into decompiling the app. I couldn't manage to get anything id consider usable out of it. Every class was the exact same with a single call to another method and passed a bunch of numbers. But I couldn't decompile that class.

Also looking inside of the drone the wifi seems to be controlled with a marvell 88w8801-nmde.

While it would be great if someone just told me the protocol, i would appreciate just as much someone pointing me in the right direction as this is a good learning opportunity I think.

Answer 1

Dowload the apk and open it in jadx or any such decompiler tool. The app is not obfuscated. package com.lewei.lib looks promising with classes like VideoPlayer, FlyCtrl, H264Frame etc. On looking closely it can be seen that the app is trying to load multiple native libraries using System.loadLibrary. These .so files can be found in lib directory once the apk is unzipped. You'll need a good disassembler/decompiler(like IDA) to analyze these native libraries. Also you can try to find sources for liblewei over the internet.