Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but on opening the serial monitor nothing shows up, but on opening the app with which it works i.e WifiUfo I can see the footage of the camera .I did an nmap scan from my linux system for the open ports but there are no tcp ports open.But there are two udp ports open.Can somebody please point me in the right direction of reverse engineering it? P.S I am fairly new to reverse engineering

  • Are there any firmware update images available? Try extracting data from those; look into binwalk.
    – Billy
    May 2 '20 at 7:39

I did something similar with a WiFi microscope (webcam with a lens on it). I used Ettercap for a unified man-in-the-middle attack with ARP spoofing, so that my phone and the camera communicated through my computer, and Wireshark to log the data. From there it was fairly simple to see what packets the app is sending, and what the camera is sending in response. I was then able to send those magic packets from my computer to the camera and get the camera to start sending data to my computer (see this question for how). Decoding the data will be the next problem.

In my case, the camera is expecting a set of 11 "initiation packets" sent to a specific UDP port. When it receives them, it starts churning out UDP packets to a specific UDP port on the IP address it got the initiation packets from. I wouldn't be surprised if yours is similar.

Alternatively, decompile the app as mentioned here and investigate the code.


It seems you need to figure out how the app is communicating with the drone, either by reverse engineering it or intercepting the traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.