Olympus OM-D Firmware & WLAN Hacks

This page collects details about the protocol and internals of Olympus WiFi enabled Cameras. Usually the only way to communicate with your camera is the Image Share (Oi.Share) Android / iOS App by Olympus.

There’s a Qt library which uses this information to provide a clean and open access to all functions of your camera: /stv0g/libqt-omd .

The Oi.Share App also allows to talk to Toshiba Flash Air SD-Cards. Toshiba has released a detailed description of the protocol they use for their SD cards Fortunately some parts of these protocols are similar.

Protocol

Camera open WLAN hotspot
- 2.4 GHz Channel: 1
- Cam IP address: 192.168.0.10
Open Ports
- TCP
  - 80: HTTP
    - Offers HTML frontend for browsing and downloading pictures
      - Full resolution: http://192.168.0.10/DCIM/100OLYMP/PC150004.JPG
      - Thumbnails: http://192.168.0.10/get_thumbnail.cgi?DIR=/DCIM100OLYMPPC150004JPG
    - Entrypoint for CGI programs
- UDP
  - 9: Discard?
  - 53: DNS
    - Resolving oishare.oishare to 192.168.0.10 (unreliable)
    - Search Domain oishare
  - 67: DHCPS
    - Assigns IP in 192.168.0.0/24 subnet
  - 68: DHCPC
- ICMP
  - ping

HTTP

The following protocol documentation if for the Olympus OM-D E-M10 with firmware version 1.2

`get_unusedcapacity.cgi`

Get free capacity on the camera SD drive in bytes.

At maximum this is equal to 4 GiB. Everything above is ignored? FIXME

HTTP Method: GET
Mode: FIXME
URL: http://192.168.0.10/get_unusedcapacity.cgi
Response:

<?xml version="1.0" ?>
<unused>4294967295</unused>

`get_commandlist.cgi`

Get list of available CGI commands and allowed parameters:

HTTP Method: GET
Mode: FIXME
URL: http://192.168.0.10/get_commandlist.cgi
Response: see here

`get_connectmode.cgi`

Get current WLAN connection mode: private or FIXME

HTTP Method: GET
Mode: all
URL: http://192.168.0.10/get_connectmode.cgi
Response:

<?xml version="1.0"?>
<connectmode>private</connectmode>

`switch_cammode.cgi`

Switch camera mode: play, rec and set liveview quality/resolution

HTTP Method: GET
Mode: all
URL:
Examples:
- http://192.168.0.10/switch_cammode.cgi
- http://192.168.0.10/switch_cammode.cgi?mode=rec&lvqty=0320x0240
Parameters:

Parameter	Allowed values	Description
`mode`	`rec`	Recording
	`play`	Playback
	`shutter`	Shutter

Response: HTTP code 200 on success. No body

Content-Type: www/unknown

`exec_pwoff.cgi`

Shutdown camera

URL: http://192.168.0.10/exec_pwoff.cgi
Response: HTTP code 200 on success. No body

Content-Type: www/unknown

`exec_takemotion.cgi`

Response: for http://192.168.0.10/exec_takemotion.cgi?com=assignafframe&point=0227x0172

<?xml version="1.0"?>
<response>
  <affocus>ok</affocus>
  <afframepoint>0209x0154</afframepoint>
  <afframesize>0036x0036</afframesize>
</response>

Response: for http://192.168.0.10/exec_takemotion.cgi?com=starttake&upperlimit=200

<?xml version="1.0"?>
<response>
  <take>ok</take>
  <affocus>ok</affocus>
  <afframepoint>0209x0154</afframepoint>
  <afframesize>0036x0036</afframesize>
</response>

`exec_takemisc.cgi`

Mode: FIXME
Response: for http://192.168.0.10/exec_takemisc.cgi?com=getrecview

HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 324553

Response: for http://192.168.0.10/exec_takemisc.cgi?com=startliveview&port=54578

<?xml version="1.0" encoding="UTF-8"?>
<funcidlist>
  <funcid name="framesize" />
  <funcid name="afframeinfo" />
  <funcid name="mntmediainfo" />
  <funcid name="rotation" />
  <funcid name="maxtakenum" />
  <funcid name="temperror" />
  <funcid name="battempty" />
  <funcid name="shutspeedvalue" />
  <funcid name="focalvalue" />
  <funcid name="expcomp" />
  <funcid name="wbvalue" />
  <funcid name="isospeedvalue" />
  <funcid name="contnotstop" />
  <funcid name="aspectratio" />
  <funcid name="liveaddinfo" />
  <funcid name="expphotowarning" />
  <funcid name="focusinfo" />
  <funcid name="zoominfo" />
</funcidlist>

`get_caminfo.cgi`

Get model of camera: E-M10

Mode: FIXME
URL: http://192.168.0.10/get_caminfo.cgi
Response:

<?xml version="1.0"?>
<caminfo>
  <model>E-M10</model>
</caminfo>

`get_camprop.cgi`

Mode: FIXME
URL: http://192.168.0.10/get_camprop.cgi?com=desc&propname=desclist
Response: see here

`set_camprop.cgi`

Set camera settings.

Mode: FIXME
Request: for http://oishare/set_camprop.cgi?com=set&propname=takemode

<?xml version="1.0"?>
<set>
  <value>A</value>
</set>

Request: for http://oishare/set_camprop.cgi?com=set&propname=drivemode

<?xml version="1.0"?>
<set>
  <value>continuous-H</value>
</set>

Response: HTTP code 200 on success. No body

`get_thumbnail.cgi`

Mode: FIXME
URL: http://192.168.0.10/get_thumbnail.cgi?DIR=/DCIM/100OLYMP/PC150004.JPG
Response:

Content-Type: image/jpeg

`get_imglist.cgi`

`get_rsvimglist.cgi`

Get list of images which are marked for transfer via the camera menu.

HTTP Method: GET
Mode: FIXME
URL: http://192.168.0.10/get_rsvimglist.cgi
Response:

Content-Type: text/plain

VER_100
/DCIM/100OLYMP,PC150001.JPG,7746678,0,17807,41094
/DCIM/100OLYMP,PC150006.JPG,7771088,0,17807,4474

<directory>,<filename>,<size>,<attribute>,<date>,<time>

These lines are separated by comas as follows:

#	Field	Example	Description
0	<directory>	/DCIM/100OLYMP	File directory name
1	<filename>	PC150006.JPG	File name
2	<size>	7771088	The size of the file in bytes (decimal form)
3	<attribute>	0	The attributes of the file (decimal form)
4	<date>	17807	The date of the file (decimal form)
5	<time>	4474	The time of the file (decimal form)

Attribute is specified in decimal 16-bit integer in the following formats (unverified):

Bit	Description
5	Archive
4	Directly
3	Volume
2	System file
1	Hidden file
0	Read only

Date is specified in decimal 16-bit integer in the following formats (unverified):

Bit	Field	Description
15-9	Year	Specify a value based on 0 as a 1980.
8-5	Month	Specify a value from 1 to 12.
4-0	Day	Specify a value from 1 to 31.

Time is specified in decimal 16-bit integer in the following formats (unverified):

Bit	Description
15-11	Hour
10-5	Minute
4-0	Second / 2

The line format seems to be identical to the one used by Toshiba Flash-Air SD cards.

See: https://flashair-developers.com/en/documents/api/commandcgi/#100

`clear_resvflg.cgi`

Clear flags of pictures marked for transfer.

HTTP Method: GET
Mode: FIXME
URL: http://192.168.0.10/clear_resvflg.cgi
Response: HTTP code 200 on success. No body

Content-Type: www/unknown

Liveview

The camera supports a live stream over Wifi of the current viewfinder.
The video is streamed via UDP packets
- Every frame is splitted in several chunks (~5-20) UDP packages
Every frame is encoded in JPEG
- See Wikipedia for a detailed description of the JPEG format
The stream has to started by issuing a HTTP GET request which includes the destination UDP port.
The stream can be stopped by issuing another HTTP request.
Depending on the camera, a few differend resolutions a available.

Packet / Frame format

Take a look here for the decoded and annotated frame format.

Byte	Description	Size	Values	Description
1 - 2	Packet type	2	`0x9060`	Start of frame
			`0x8060`	Middle part
			`0x80e0`	End of frame
3 - 4	Number of frame chunk	2
5 - 8	Unique id per frame	4
9 - 12	Unique id per stream	4

Source

From: http://dpzen.com/comment/2604719#comment-2604719

Hi Airelle,

I’m gone the same way on analysing the video stream. SOI and EOI markers were the hint that MJPEG is used. The camera transmittes around 20 images per second if a resolution of 640 x 480 pixels is used. Each image is splitted into several parts because it doesn’t fit in one packet. Each packet containes a 12 byte long header at the beginning with following structure: In order to display such an image you have to collect all data beginning with 0xffd8 from start packet followed by data from following packets until 0xffd9. From first packet you already have cut the header and the meta data section. But you also have to cut the first 12 byte of header from all following packets. That is your mistake during your previous work. There is a mechanism for correct assembling of data packets realized per header data within each packet. But during my tests it wasn’t necessary to order the packets an no one packet was missing. This is because the server (camera) and the client (the application) uses a direct network connection. I would recommend to implement a header evaluation for your application, but for a simple test you can pass it. Sorry for my poor english. I hope it is understandable anyway and will help you to develop your application.

Best Regards Andreas