The problem

In 2015, EE (one of the UK mobile networks) sold a product called the 4GEE Action Cam. This was a small-ish HD camera with waterproof case designed for use in extreme sports. The Unique Selling Point was the built-in 4G modem, enabling the camera to stream live video to the internet without the need to be tethered to a phone or laptop.

The product appears to be a re-badged BenQ QC1 Action Cam - and no doubt was sold under various different names in different places around the world.
Originally it came with a wristwatch-style wireless viewfinder (which is now sadly lost in my case) and an Android app could also be used for this purpose.

The app in question is still available on the Google Play app store, but this has not been updated since August 2017 and is not compatible with newer Android versions.

So the problem is this - I'd like to use the wireless viewfinder feature, but I don't have the wristwatch and my phone is too new. What to do?

Getting it working

Of course like most other people I have a drawer full of old phones, and so it didn't take me long to find a device that is compatible with the official app. In my case I have a Nokia 2 which runs Android 7.1.1.

With the app installed on this older handset I could now start to examine how it worked:

  • The camera provides a WiFi access point to which the phone connects
  • The app somehow detects the camera on the network and begins streaming live video
  • It is possible to change settings and access all camera functions from the app
  • It's also possible to browse the saved files from the app
  • Most surprisingly, with a SIM card installed in the camera, it functions as a router, so a connected WiFi client can access the internet through the camera

One minor annoyance was that on start-up the app nagged me to update the camera firmware. However, accessing the firmware update option gave a message indicating that the firmware was already up to date. I suspect that what is actually happening is that the request from the camera results in a 404 or similar error, but the camera software catches this and reports it as 'no update available' or something like that.

The only feature that doesn't work anymore is the live streaming. This isn't really surprising - when the camera was new it used a service called Skeegle which shut down in 2016. It does make the built-in 4G modem rather useless though!

Note - I've since discovered that a later firmware version allows the camera to stream live to Facebook. I haven't been able to track down a source for this firmware though.

Reverse engineering

The first thing I tried was to connect my laptop to the camera access point and then scan the camera host with nmap to see what ports were open.

  • Port 53 is used for DNS, and this makes sense since the camera can operate as a router
  • Port 445 is used for SMB file sharing. I tried connecting to the host with an SMB client but I was unable to authenticate

Wireshark

Since nmap did not reveal any obvious RPC interface, the next thing I wanted to do was inspect the traffic coming from the phone to the camera. I knew I wanted to use Wireshark to examine the network traffic, but I wasn't sure the best way of capturing packets.

My first idea was to run the Android emulator on my laptop. Although this might have worked, the app would only run on an ARM emulator (not x86) and this flavour of emulator ran so slowly on my laptop that it was completely useless

My next thought was to install tcpdump on my Nokia handset. After reading up on this however, it seemed to require me to 'root' the handset, and to do this I would need to visit some very shady looking websites and download some shady looking apps. I try to avoid that sort of thing these days so I looked for an alternative.