Menu
Cart

GoPro HERO5 Interfaces

Posted by Mark Kirschenbaum on

We love learning how to "talk" to the GoPro Camera from the various interfaces. This is a continuously updated blog post that contains the various methods which external devices talk to the GoPro Camera. We purposely never became members of the Developer Program so that we can share this interface since we feel it should be open for all to use. Feel free to send us resources and notes to update this post. 

GoPro HERO5 Hacking

Methods of Communication

  • Bluetooth Low Energy (BLE) - Complete control, feedback and metadata sink
  • USB MTP - Camera to Host connectivity. Expanded with Karma for GCCB (HEROBUS Protocol) via MTP/USB. 
  • USB CDC Serial - Allows for GCCB communications over serial for Karma
  • WiFi - Documented pretty well via external resources. See Konrad's Github
  • USB type-C - Power Delivery Protocol - Determines HEROBUS device type.
  • USB type-C - Supplement Pins - Muxed dependent on the device found by the PD driver.

GCCB - HeroBus v2.3 Protocol

We've expanded out the HeroBus/GCCB protocol but are not ready to post it yet. This protocol is the same as the GoPro HERO4's and is used for MultiCam syncing as well as complete control and feedback. It's basically a 1 to 1 interface to their APPC commands. A simple channel proxy establishes connection and then the session remains open until closed. The GCCB on the GoPro HERO5 can run over USB MTP, USB CDC, or i2c depending on what device is detected by the PD / Atmel MCU (Code named Garter device). 

It appears Rigado is the solutions provider for BLE and HEROBus Devtools. The form factor looks surprisingly similar to the 3.5 Pro Mic adapter and appears to be built to attach to an Arduino. 

GoPro HeroBus protocol

GCCB Types

group Name members
0 remote_proxy 4
1 remote_app_mode 0xB
2 remote_video 0x2D
3 remote_photo 0x22
4 remote_multi_shot 0x23
5 remote_broadcast 0x1C
6 remote_wireless 0x13
7 remote_setup 0x37
8 remote_system 0x1E
9 remote_storage 0x14
A remote_stream 0xF
B remote_fwupdate 7
C remote_medit 7
D remote_liveview 5
E remote_audio 0xA
F remote_voice_control 0xA

USB

A USB host can connect to the GoPro HERO4/5 and not only control, but push metadata to the camera. In addition, this interface can become a composite device and add a CDC USB channel which allows easier access to the GCCB bus. AFAIK, the composite device and access to MTP-GCCB only occurs when a Karma is detected by the PD. Karma (Kirkwood) talks to Sentinel via the following Vendor commands. It uses LIBMTP running on linux. Again they have not released their source GPL2! 

Vendor Specific Commands

USB_MTP_EXT_OPCODE_VENDOR_SET 0X9000
USB_MTP_EXT_OPCODE_VENDOR_GET 0X9001
USB_MTP_EXT_OPCODE_SDCARD_UNLOCK 0X9002
USB_MTP_EXT_OPCODE_SDCARD_LOCK 0X9003
USB_MTP_PROCESS_GET_ANALYTICS 0X9004
USB_MTP_PROCESS_GET_ANALYTICS 0X9005
USB_MTP_EXT_OPCODE_RST_USR_PREF 0X9006
USB_MTP_PROCESS_GPCONTROL_REQ 0X9007
USB_MTP_PROCESS_GPCONTROL_RSP 0X9008
USB_MTP_CAMERA_REBOOT 0X9009
USB_MTP_EXT_OPCODE_CLEAR_ANALYTIC 0X900A
USB_MTP_PROCESS_HOST_INFO_MSG 0X900B
USB_MTP_PROCESS_GCCB_MSG 0X900C
USB_MTP_PROCESS_GPTUNNEL_MSG 0X900D
USB_MTP_PROCESS_METADATA_MSG 0X900E
USB_MTP_EXT_OPCODE_MOUNT_MSC_CDROM 0X900F
USB_MTP_EXT_OPCODE_UNMOUNT_MSC_CDROM 0X9010
USB_MTP_PROCESS_DEVICE_READY_MSG 0X9011
USB_MTP_EXT_OPCODE_MONOCLE 0X9012


GPControl

GPControl allows access to WiFi Settings and control via USB. Items such as pairing and turning on wifi/ble can be setup this way. Also, network scanning can be done via this mechanism. It appears the Karma turns on wifi via GPControl to send fw updates to the camera via buckhorn->coyote. 

Metadata

Hardwired sensors can push data to the camera for it to be muxed into the MP4 stream. Karma uses this to push metadata to the camera and thus muxed into the  MP4.  

Other USB Notes

A simple lock/unlock call in vendor mtp commands will allow the host to erase and modify files. We haven't tested to see if this is accessible, but opens up a good amount of tweaking doors.

Monocle allows for the usb interface to get the YUV buffer and setup the image processing settings. 

DEVICE_READY

In Kirkwood (Karma), this tells the host if its initialized or not. In other modes, it initializes the tunnel param0=0 or states is is recording param0=3

Bluetooth

GoPro has two 16-bit service UUID's registered. They are: 

FEA5 - 0000fea5-0000-1000-8000-00805f9b34fb
FEA6 - 0000fea6-0000-1000-8000-00805f9b34fb

Here are the defined UUID members. Sorry about the formatting..

B5F90000-AA8D-11E3-9046-0002A5D5C51B
B5F90001-AA8D-11E3-9046-0002A5D5C51B GPAPC_Service_UUID
B5F90002-AA8D-11E3-9046-0002A5D5C51B GPAPC_SSID_Declaration
B5F90003-AA8D-11E3-9046-0002A5D5C51B GPAPC_PASSWORD_Declaration
B5F90004-AA8D-11E3-9046-0002A5D5C51B GPAPC_SWITCH_Declaration
B5F90005-AA8D-11E3-9046-0002A5D5C51B GPAPC_STATE_Declaration
B5F90005-AA8D-11E3-9046-0002A5D5C51B GPAPC_STATE_Value
B5F90006-AA8D-11E3-9046-0002A5D5C51B GPAPC_KEY_Declaration

b5f90072-aa8d-11e3-9046-0002a5d5c51b Command
b5f90073-aa8d-11e3-9046-0002a5d5c51b CommandResponse
b5f90074-aa8d-11e3-9046-0002a5d5c51b SetSetting
b5f90075-aa8d-11e3-9046-0002a5d5c51b SetSettingResponse
b5f90076-aa8d-11e3-9046-0002a5d5c51b QueryRequest
b5f90077-aa8d-11e3-9046-0002a5d5c51b QueryResponse
b5f90078-aa8d-11e3-9046-0002a5d5c51b SensorData
b5f90079-aa8d-11e3-9046-0002a5d5c51b SensorDataResponse

Try sending the non setting bytes to
CommandResponse {b5f90073-aa8d-11e3-9046-0002a5d5c51b}

SHUTTER_ON(new byte[]{(byte) 1, (byte) 1, (byte) 1}),
SHUTTER_OFF(new byte[]{(byte) 1, (byte) 1, (byte) 0}),

MODE_GROUP_VIDEO(new byte[]{(byte) 2, (byte) 1, (byte) 0}),
MODE_GROUP_PHOTO(new byte[]{(byte) 2, (byte) 1, (byte) 1}),
MODE_GROUP_MULTISHOT(new byte[]{(byte) 2, (byte) 1, (byte) 1}),

MODE_VIDEO_VIDEO(new byte[]{(byte) 3, (byte) 1, (byte) 0, (byte) 1, (byte) 0}),
MODE_VIDEO_TIMELAPSE(new byte[]{(byte) 3, (byte) 1, (byte) 0, (byte) 1, (byte) 1}),
MODE_VIDEO_PHOTO(new byte[]{(byte) 3, (byte) 1, (byte) 0, (byte) 1, (byte) 2}),
MODE_VIDEO_LOOPING(new byte[]{(byte) 3, (byte) 1, (byte) 0, (byte) 1, (byte) 3}),
MODE_PHOTO_SINGLE(new byte[]{(byte) 3, (byte) 1, (byte) 1, (byte) 1, (byte) 0}),
MODE_PHOTO_CONTINUOUS(new byte[]{(byte) 3, (byte) 1, (byte) 1, (byte) 1, (byte) 1}),
MODE_PHOTO_NIGHT(new byte[]{(byte) 3, (byte) 1, (byte) 1, (byte) 1, (byte) 2}),
MODE_MULTISHOT_BURST(new byte[]{(byte) 3, (byte) 1, (byte) 2, (byte) 1, (byte) 0}),
MODE_MULTISHOT_TIMELAPSE(new byte[]{(byte) 3, (byte) 1, (byte) 2, (byte) 1, (byte) 1}),
MODE_MULTISHOT_NIGHTLAPSE(new byte[]{(byte) 3, (byte) 1, (byte) 2, (byte) 1, (byte) 2}),


POWER_OFF_CAMERA(new byte[]{(byte) 4}),
SLEEP(new byte[]{(byte) 5}),


VIDEO_PROTUNE_RESET(new byte[]{(byte) 10, (byte) 1, (byte) 1}),
MULTISHOT_VIDEO_PROTUNE_RESET(new byte[]{(byte) 11, (byte) 1, (byte) 1}),
PHOTO_PROTUNE_RESET(new byte[]{(byte) 12, (byte) 1, (byte) 1}),


SET_DATE_TIME(new byte[]{(byte) 5, (byte) 13, (byte) 1}),

LOCATE_ON(new byte[]{(byte) 22, (byte) 1, (byte) 1}),
LOCATE_OFF(new byte[]{(byte) 22, (byte) 1, (byte) 0}),

WIFI_ON(new byte[]{(byte) 23, (byte) 1, (byte) 1}),
WIFI_OFF(new byte[]{(byte) 23, (byte) 1, (byte) 0}),
TAG(new byte[]{(byte) 24}),
GET_JSON(new byte[]{(byte) 59}),
GET_JSON_VERSION(new byte[]{(byte) 58}),
GET_CAMERA_INFO(new byte[]{(byte) 60});

Command characteristic
GPCAMERA_MOBILE_OFFLOAD_STOP
GPCAMERA_MOBILE_OFFLOAD_START
GPCAMERA_MOBILE_OFFLOAD_POWER_ON_START
GPCAMERA_APP_POWER_ON_START
GPCAMERA_ANALYTICS_SET_CLIENT_INFO

Query characteristic
GetMediaOffloadStateCmd
GPCAMERA_CROSS_CLIENT_GET_CLIENT_ID
GPCAMERA_CROSS_CLIENT_GET_ASSOCIATION_STATE

Settings characteristic
GPCAMERA_CROSS_CLIENT_SET_AUTH_CODE
GPCAMERA_CROSS_CLIENT_SET_ASSOCIATION_STATE
GPCAMERA_MEDIA_OFFLOAD_ENABLE
Set_SETTING


Ending Comments

If you are interested in the inner workings of the GoPro HERO 5 check out our HERO5 Tear Down where we took the camera apart.

We don't not understand why GoPro Inc. keeps tight wraps on their communication protocol where Sony, whom is known for proprietary interfaces, open's theirs up. You want companies and people to buy into your platform? Make it easy, and FREE, for them to do so! 

I feel the end is near for GoPro Inc. and the writing is on the wall. They had a cult following, and now stuff like encryption and selling their developer program is one more nail that closes their coffin. 

LEGAL: This product and/or service is not affiliated with, endorsed by, or in any way associated with GoPro Inc. or its products and services. GoPro, HERO, and their respective logos are trademarks or registered trademarks of GoPro, Inc. HEROBUS and BACPAC are trademarks of GoPro Inc.


Share this post



← Older Post Newer Post →

Hypoxic Products