Just curious if you're still interested in this topic (or moved on from the DxO-ONE already)?
I joined the party late and only got my DxO-ONE ~1 month ago (some excess stock is sold on Aliexpress for ~120USD), and I really like the size and picture quality, but I'm not an iPhone user.
So I began looking into the device software when I found it's based on an Ambarella SoC, and started studying the Software and script a bit.
And just now that I started compiling all the info I found I came across your git.
(Great insight on the dropbear Authentication bit, I didn't notice that until now)
I'm still in search of a USB-UART command to get the Amba Shell directly via USB (similar to your goal I noticed), but meanwhile I found a command to switch the Lightning-Port to the microUSB port, which provides the USB-interfaces for JSON-RPC directly to microUSB.
By combining this with another command to disable the iPhone Accessory Protocol, the USB-device can receive JSON-commands (like the App generates).
This could open an interesting method to control the camera via USB and maybe even find values not supported by the official app.
(And since this mode was implemented for testing/debug, I'm still not sure whether it could be combined with another ambash command with a direct UART shell...)
Anyway, here are the commands:
Route Lightning to USB:
t dxo micro_usb_connected_toggle on
t dxo iap2_toggle off
Reset Lightning:
t dxo micro_usb_connected_toggle off
t dxo iap2_toggle auto
(The settings are stored on the device, so to route the USB back to Lightning it needs to be reset to its original value again)
Afterwards the device registers several USB-devices when connected:
Let me know if you're still interested to revive your work, would be great to exchange findings a bit.
Otherwise, sorry for bothering and thanks for sharing your findings all those years ago!
Hello!
Just curious if you're still interested in this topic (or moved on from the DxO-ONE already)?
I joined the party late and only got my DxO-ONE ~1 month ago (some excess stock is sold on Aliexpress for ~120USD), and I really like the size and picture quality, but I'm not an iPhone user. So I began looking into the device software when I found it's based on an Ambarella SoC, and started studying the Software and script a bit.
And just now that I started compiling all the info I found I came across your git. (Great insight on the dropbear Authentication bit, I didn't notice that until now)
I'm still in search of a USB-UART command to get the Amba Shell directly via USB (similar to your goal I noticed), but meanwhile I found a command to switch the Lightning-Port to the microUSB port, which provides the USB-interfaces for JSON-RPC directly to microUSB. By combining this with another command to disable the iPhone Accessory Protocol, the USB-device can receive JSON-commands (like the App generates).
This could open an interesting method to control the camera via USB and maybe even find values not supported by the official app. (And since this mode was implemented for testing/debug, I'm still not sure whether it could be combined with another ambash command with a direct UART shell...)
Anyway, here are the commands:
Route Lightning to USB:
Reset Lightning:
(The settings are stored on the device, so to route the USB back to Lightning it needs to be reset to its original value again)
Afterwards the device registers several USB-devices when connected:
Reported USB-Devices
``` ID: 0 Path: /dev/bus/usb/001/005 VID: 0x2B8F PID: 0x0001 Class: 0 (USB_CLASS_PER_INTERFACE) Subclass: 0 Protocol: 0 3 Interfaces: ID: 0 Class: 255 (USB_CLASS_VENDOR_SPEC) Subclass: 240 Protocol: 0 2 Endpoints: ID: 0 Descriptor: [0x07 0x05 0x01 0x02 0x00 0x02 0x00] Address: 0x01 Endpoint Number: 1 Direction: 0 (host to device) Attributes: 0b00000010 Type: 0b10 (Bulk) Max. Packet Size: 512 Bytes Interval: 0 ID: 1 Descriptor: [0x07 0x05 0x82 0x02 0x00 0x02 0x00] Address: 0x82 Endpoint Number: 2 Direction: 1 (device to host) Attributes: 0b00000010 Type: 0b10 (Bulk) Max. Packet Size: 512 Bytes Interval: 0 ID: 1 Class: 255 (USB_CLASS_VENDOR_SPEC) Subclass: 240 Protocol: 1 0 Endpoints: ID: 2 Class: 255 (USB_CLASS_VENDOR_SPEC) Subclass: 240 Protocol: 1 2 Endpoints: ID: 0 Descriptor: [0x07 0x05 0x05 0x02 0x00 0x02 0x00] Address: 0x05 Endpoint Number: 5 Direction: 0 (host to device) Attributes: 0b00000010 Type: 0b10 (Bulk) Max. Packet Size: 512 Bytes Interval: 0 ID: 1 Descriptor: [0x07 0x05 0x84 0x02 0x00 0x02 0x00] Address: 0x84 Endpoint Number: 4 Direction: 1 (device to host) Attributes: 0b00000010 Type: 0b10 (Bulk) Max. Packet Size: 512 Bytes Interval: 0 ```Let me know if you're still interested to revive your work, would be great to exchange findings a bit. Otherwise, sorry for bothering and thanks for sharing your findings all those years ago!