Xylla otoscope works partially

[mem0c]

Hello,

thank you for sharing this. I was able to adapt the code for my device (Xylla otoscope) with partial success.
For this device the ip and ports are different.

Capture from device:

DEVICE_HOST = '192.168.0.10'
DEVICE_CMD_PORT = 50000
DEVICE_STREAM_PORT = 8032

with open('raw0.bin', 'wb') as file:
    data = b'\x99\x99\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
    stream_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    stream_sock.sendto(data, (DEVICE_HOST, DEVICE_STREAM_PORT ))
    while True:
        data, _ = stream_sock.recvfrom(self.BUF_SIZE)
        file.write(data)

This seems to capture but stops after a while (the device either shutdowns or the camera led switches off).
I get a file which contains a sequence of [24 bytes header + bytes b'\xff\xd8' .. b'\xff\xd9 ( jpeg frame ?) + additional byte]

Post process:

with open('raw0.bin', 'rb') as f:
    data=f.read()

JPEG_START = b'\xff\xd8'
JPEG_END = b'\xff\xd9'

idx = 1
start = 0
while True:
    old_start = start
    start = data.find(JPEG_START, old_start)
    if start == -1:
        break
    
    end = data.find(JPEG_END, start + 2)
    if end == -1:
        break
    
    file_name = f'file{idx}.jpg'
    with open(file_name, 'wb') as f:
        jpg = data[start:end + 2]
        print(f'Wrote {file_name}. Frame has size {len(jpg)} from offset {start} to {end + 2}. Header={data[start-24:start]}')
        f.write(jpg)
    
    idx += 1
    start = end + 2

Example of jpeg written above:

As you can see there are garbage in the image.
The captured file is here raw0.zip

Any help would be appreciated.

[swgr424]

I have very similar experience. My device is a "smart" ear cleaner from a brand called AJUN. The corresponding android apk is com.air.airlook_2.6 which is made by molink and uses libmlcamera-2.5.so eventually. The ip, command port and stream port are exactly the same as yours -- 192.168.0.10 / 50000 / 8032. With your capture code, I'm able to get a few hundreds of chunks (most of them are 1460 bytes large, somes are smaller) before it stuck at one last recvfrom() call.

I can also see the ffd8~ffd9 pattern. With your post-processing code I managed to dump several jpgs, and they have identical defective strips like yours:

I wonder if they have updated libmlcamera-2.5.so. Attaching it just in case anyone is interested.
libmlcamera-2.5.zip

[mem0c]

@swgr424 yes airlook is also the app I'm using. Using pcapdroid app I was able to capture the full communication between the app and device. I can see multiple video cmd requests sent to the device in chunk (like 5-10) every 5-10 jpegs frame (sorry forgot the exact counts). So with this I modified my code to send the cmd requests in a thread every 0.2 sec and push the results to a queue, then in a different thread consume the frames in the queue and print them using opencv. And like that I was able to get a continuous video feed. See code below.

The defects in the pictures are still there though.
I wonder if there are embedded data in the frame or wrong padding/length somewhere in the jpeg frame.
I don't know enough of the jpeg format to resolve this. I hope someone can explain here.

Python code:

import socket
import cv2
import numpy as np
import queue
import threading
import time

class XyliaOtoscopeClient:
    CAMERA_HOST = '192.168.0.10'
    CAMERA_CMD_PORT = 50000
    CAMERA_STREAM_PORT = 8032
    BUF_SIZE = 65535
    JPEG_START = b'\xff\xd8'
    JPEG_END = b'\xff\xd9'
    
    def __init__(self, camera_host=CAMERA_HOST, camera_cmd_port=CAMERA_CMD_PORT, camera_stream_port=CAMERA_STREAM_PORT):
        self.camera_host = camera_host
        self.camera_cmd_port = camera_cmd_port
        self.camera_stream_port = camera_stream_port
        self.cmd_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        
    def _send_recv_msg(self, msg):
        print(f'Sending message : {msg}')
        self.cmd_sock.sendto(msg, (self.camera_host, self.camera_cmd_port))
        response, _ = self.cmd_sock.recvfrom(self.BUF_SIZE)
        print(f'Receive response: {response}\n')
    
    def connect(self):
        msg = b'SETCMD\xff\xff\x00\x00\x90\x00\x04\x00\x00\x00\x00\x00'
        response = self._send_recv_msg(msg)
    
    def close(self):
        self.cmd_sock.close()

    def write_stream_to_file(self, file_path):
        with open(file_path, 'wb') as file:
            data1 = b'\x99\x99\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
            data2 = b'\x99\x99\x17\x10\x48\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
            stream_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
            count = 0
            while True:
                if count % 10 == 0: stream_sock.sendto(data1, (self.camera_host, self.camera_stream_port))
                data, _ = stream_sock.recvfrom(self.BUF_SIZE)                
                file.write(data)

    def _request_frames(self, stream_sock, evt):
        data = b'\x99\x99\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
        stream_sock.sendto(data, (self.camera_host, self.camera_stream_port))
        while not evt.wait(timeout=0.2):
            stream_sock.sendto(data, (self.camera_host, self.camera_stream_port))
        
    def _produce_frames(self, stream_sock, frame_queue, evt):
        buffer = bytearray()
        frame_start = -1
        while not evt.is_set():
            data, _ = stream_sock.recvfrom(self.BUF_SIZE)
            buffer.extend(data)
            #print(f'{data}\n')
            print(f'received {len(data)} bytes')
            
            if frame_start == -1:
                frame_start = buffer.find(self.JPEG_START)
                print(f'frame_start={frame_start}')
                
            if frame_start == -1:
                print('skip due to frame_start==-1')
                buffer.clear()
                continue
            
            frame_end = buffer.find(self.JPEG_END, frame_start + 2)
            if frame_end == -1:
                #print('skip due to frame_end==-1')
                continue
            
            print(f'frame_end={frame_end}')
            frame = buffer[frame_start:frame_end + 2]
            frame_start = -1
            del buffer[:frame_end + 2] # delete (shift) data from buffer from beginning to frame_end
            if not frame_queue.full():
                frame_queue.put(frame)
    
    def _consume_frames(self, frame_queue, evt):
        while not evt.is_set():
            jpeg_bytes = frame_queue.get()
            np_arr = np.frombuffer(jpeg_bytes, dtype=np.uint8)
            frame = cv2.imdecode(np_arr, cv2.IMREAD_COLOR)
            if frame is not None:
                cv2.imshow("MJPEG Stream", frame)
            if cv2.waitKey(1) & 0xFF == ord('q'):
                evt.set()
                break
        cv2.destroyAllWindows()
        
    def show(self):
        frame_queue = queue.Queue(maxsize=25*30)
        evt = threading.Event()
        stream_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        
        request_thread = threading.Thread(target=self._request_frames, args=(stream_sock, evt, ), daemon=True)        
        producer_thread = threading.Thread(target=self._produce_frames, args=(stream_sock, frame_queue, evt, ), daemon=True)
        consumer_thread = threading.Thread(target=self._consume_frames, args=(frame_queue, evt, ), daemon=True)
        request_thread.start()
        producer_thread.start()
        consumer_thread.start()
        consumer_thread.join()
        producer_thread.join()
        request_thread.join()
        stream_sock.close()

if __name__ == '__main__':
    client = XyliaOtoscopeClient()
    client.connect()
    client.show()
    #client.write_stream_to_file('raw.bin')