Insta360 X3 BLE remote control with ESP32

Description

The insta360 X3 can be controlled by BLE with a fancy remote.
By reverse engineering an android app, I got some basic commands to work with and sourced some more.

The first byte is command length (including the lenght byte itself), followed by 16 byte command stuff and some optional protobuf encoded payload. The BLE payload is split in 20 byte blocks when sending.

###
If you chave a GPS remote for X3 and the skills for BLE debugging leave a comment
###

Big thanks to rhoenschrat for submitting a BLE trace.

Details

BLE command set

serviceUUID: 0000be80-0000-1000-8000-00805f9b34fb
writeCharacteristic: 0000be81-0000-1000-8000-00805f9b34fb
readCharacteristic:  0000be82-0000-1000-8000-00805f9b34fb
Lenght - 16 byte command stuff - optional protobuf
SN is a 2 byte message counter starting at 0x0200 (512). Seems to be not relevant
Video starts with the stettings currently set in each mode. Maybe some protobuf can change this.

// Mode 0x04 Commands:
  // 01 App mode
  // 02 switch mode/close app mode
  // 03 take photo
  // 04 start video normal
  // 05 stop video    
  // 0E C8 response
  // 0F some data
  // 18 whipe SD
  // 1A Periodic message activation
  // 1F F5 response
  // 20 reboot
  // 21 some data
  // 22 some data
  // 23,24,25,28 C8
  // 29 video bullet
  // 30 stop video
  // 33 video HDR
  // 34 stop video
  // 39 reset (factory reset)
  // 3D timeshift video
  // 3E stop video

  // 42 gyro calib data?
  // 45 loop record
  // 46 stop video
  //
  // 19, 41, 43,44 freeze --> needs reboot
  // 52 unknown C8 respose
  // 53 9301 response

// Example take photo
// Send 10 000000 04 0000 03 00 020C 0000 800000

Example video stop. Last block is protobuf including filename etc.
//Send 10 000000 04 0000 0500 0201 0000800000
//Got: 16 000000 04 0000 1020 02FF 8A43F40000 080010001A00
//Got: 07 000000 05 0000 
//Got: 14 000000 04 0000 0620 02FF 8A43F40B40 08001000
//Got: 49 000000 04 0000 C800 0201 0000800000 0A370A2E2F4443494D2F43616D65726130312F5649445F32303233303130335F3134303630385F31305F3036312E696E7376108080800A180810000000040000172002FF8A43F400C0
//Got: 07 000000 05 0000
--> "/DCIM/Camera01/VID_20230103_140608_10_061.insv" and some other stuff

If you get a response, try to decode the protobuf content. may include error codes as string.
 23 000000 04 0000 9001 020E 010080BF00 1211756E6B6E6F776E206D736720636F64652E = "unknown msg code."
 22 000000 04 0000 F401 0211 01008000C0 12106D73672065786563757465206572722E = "msg execute err."

Some old stuff:

These comands seems to be kind of outdated. (sourced from android wear app for One X2)

      // GPS Data (send as 20 byte blocks)
      // 47 000000 04 0000 3500 + SN + 0000 800000 0a35 + unix4Hex + 00000000000041 + 53/4E + lat8HEX + 57/45 + lon8hex + speed8Hex + heading8Hex + altitude8Hex
      // 1: 53 byte message

      // TakePhoto
      // 07 000000 05 0000
      // 10 000000 04 0000 0f00 + SN + 0000 800000
      // 3f 000000 04 0000 0300 + SN + 0000 800000      122d 5a18000000000000000000000000000000000000000000000000 6a023001 9a0100 aa0100 ba0100 d20100 e20200

      // 2:
          // 11: 0x00
          // 13: 6: 1
          // 19: 0x00
          // 21: 0x00
          // 23: 0x00
          // 26: 0x00
          // 44: 0x00


      // TakePhotoHDR
      // 07 000000 05 0000
      // 10 000000 04 0000 0f00 + SN + 0000 800000
      // 46 000000 04 0000 0300 + SN + 0100 800000 0801 122d 5a18000000000000000000000000000000000000000000000000 6a023001 9a0100 aa0100 ba0100 d20100 e20200 1a0327004e

      // 1: 1
      // 2:
          // 11: 0x00
          // 13: 6: 1
          // 19: 0x00
          // 21: 0x00
          // 23: 0x00
          // 26: 0x00
          // 44: 0x00
      // 3: 0x27 0x00 0x4e

      // Stop video
      // 07 000000 05 0000
      // 12 000000 04 0000 0500 + SN + 0000 800000 1001

      // 2: 1

      // StartVideo4K30
      // 07 000000 05 0000
      // 17 000000 04 0000 0900 + SN + 0000 800000 0a011f 1200 1807
      // 10 000000 04 0000 0f00 + SN + 0000 800000 
      // 12 000000 04 0000 0400 + SN + 0000 800000 0801       // 1: 1

      // 1: 0x1F
      // 2: -empty-
      // 3: 7

      // StartVideo5K30
      // 07 000000 05 0000
      // 1a 000000 04 0000 0900 + SN + 0000 800000 0a011f 1203f8010a 1807
      // 10 000000 04 0000 0f00 + SN + 0000 800000 
      // 12 000000 04 0000 0400 + SN + 0000 800000 0801

      // 1: 0x1F
      // 2: 31: 10
      // 3: 7

      // StartVideoGPS
      // 07 000000 05 0000
      // 1a 000000 04 0000 0900 + SN + 0000 800000 0a011f 1203f8010a 1807
      // 10 000000 04 0000 0f00 + SN + 0000 800000 
      // 12 000000 04 0000 0400 + SN + 0000 800000 0801

      // StartVideo4K50
      // 07 000000 05 0000
      // 1a 000000 04 0000 0900 + SN + 0000 800000 0a011f 1203f8010c 1807
      // 10 000000 04 0000 0f00 + SN + 0000 800000 
      // 12 000000 04 0000 0400 + SN + 0000 800000 0801

      // 1: 0x1F
      // 2: 31:...

Files

control.ino

ESP32 BLE example for insta360 X3 camera control

ino - 6.74 kB - 01/04/2023 at 07:56

Download

Discussions

veio wrote 02/03/2024 at 11:46

Does anybody have a full example of the GPS data? (I refer to this `

47 000000 04 0000 3500 + SN + 0000 800000 0a35 + unix4Hex + 00000000000041 + 53/4E + lat8HEX + 57/45 + lon8hex + speed8Hex + heading8Hex + altitude8Hex` from above.)

What is "unix4hex" here? is lon8hex a double or a long value?

What does "53/4E" mean? sometimes I have to send 53, sometimes 4E? Same question for "57/45".

Are you sure? yes | no

veio wrote 02/03/2024 at 14:54

I got most of it working:

unix = int(time.time())
speed = 0.0+offset*0.3
gps_lat = 49.0
gps_lon = 13.0
heading=0.0+offset*0.01
gps_altitude = 0+offset*3
print_variables(locals())
proto_buf = bytearray([0x0a, 0x35])
proto_buf.extend(unix.to_bytes(4, 'little'))
proto_buf.extend([0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0x00])
proto_buf.extend(struct.pack('d',gps_lat))
proto_buf.append(0x00)
proto_buf.extend(struct.pack('d',gps_lon))
proto_buf.extend(struct.pack('d',speed))
proto_buf.extend(struct.pack('d',heading))
proto_buf.extend(struct.pack('d',gps_altitude))

expect latitude and longitude. Those values result in `lat="1.875091954681102e+39" lon="-1.7020770365301929e-120"` when I export them from Insta360 studio. The values are changing, but miniscule and the following values (speed etc.) are also correct, so atleast the place in the buffer is not completely wrong.
Are they using a different encoding for the latitude and longitude than for speed and altitude?!

Are you sure? yes | no

Patrick Chwalek wrote 09/23/2023 at 00:50

I reverse-engineered the Insta360 Action Remote so that might be helpful: https://medium.com/@patrickchwalek/ble-control-of-insta360-cameras-7bf6894648a4

Are you sure? yes | no

Niccolo wrote 07/03/2023 at 15:27

Hello. I'm trying to reverse engineer the WiFi protocol to control my Insta360 ONE RS camera. I wish to thank you for highlighting that the communication uses Protocol Buffers, because it is the same on the WiFi channel. I wrote some proof-of-concept Python code to talk over the WiFi, using some of the protobuf definition language extracted from the Android app. My code is here: https://github.com/RigacciOrg/insta360-wifi-api

Are you sure? yes | no

Frederic L wrote 04/29/2023 at 06:56

Hello, thank your for your research and taking the time to write about it. I have successfully connected to my X3 camera and used your commands to control it (saving me from buying the expensive remote...). Have you been able to decode more commands ? I am more specifically looking for Timelapse video start and stop. I'll keep searching on my side and will let you know if I find more. I have a BLE packet sniffer but cannot read any exchange between my iPhone and the X3 for some reason.

Are you sure? yes | no

Baurito wrote 02/14/2023 at 04:50

Hello, This is a very cool project. I can't connect to the camera. Will there be any instructions? My camera insta360 one x2

Are you sure? yes | no

Insta360 X3 BLE remote control with ESP32

Description

Details

Files

control.ino

Components

Discussions

Similar Projects

LEM6502

HariFun#134 Oscilloscope Abuse

$0.87 WiFi for Raspberry Pi and Arduino Projects

Reversing Topfield TF5100 PVR Display Module

Insta360 X3 BLE remote control with ESP32

Become a Hackaday.io member

Just one more thing

Description

Details

Files

control.ino

Components

Enjoy this project?

Discussions

Become a Hackaday.io Member

Similar Projects

LEM6502

HariFun#134 Oscilloscope Abuse

$0.87 WiFi for Raspberry Pi and Arduino Projects

Reversing Topfield TF5100 PVR Display Module

Does this project spark your interest?

Report project as inappropriate

Send message

Remove Member