Sony Camera BLE Control Interface
Posted by Mark Kirschenbaum on
Sony Cameras are now supporting a Bluetooth Low Energy (BLE) based control protocol. This interface allows a client to control as well as acquire status from a BLE enabled remote.
[Sony RMT-P1BT - Remote works similarly as the JJC RMT-P1BT]
This article assumes the reader knows basic BLE terminology so perhaps have a read on the Introduction of BLE from Adafruit if you're unfamiliar. This is not a step-by-step guide, but a broad reference guide on this protocol. As always, I'm available for hire if your product needs this connectivity.
Discovery
Discovery is rather straight forward for Sony BLE enabled cameras. How the App discovers the camera is via searching through the advertised manufacturer data for Sony's Bluetooth manufacturer ID of 0x012D (Little Endian).
Sony Manufacturer Advertisement Header
| 2d 01 | Sony Corporation Company Identifier (0x012D) |
| 03 00 | This Sony is a Camera |
| 64 | Protocol Version |
| 00 | Not Used |
| 45 31 | ASCII Model Code e-mount cameras 'E1', a-mount 'A1', etc. |
To summarize, we search for the advertising packet whose manufacturing data consists of:
0x2D 0x01 0x03 0x00 0x64 0x00
We don't necessarily search for a particular model code, but can for your particular application. Our camera is an e-mount and therefore transmits ASCII 'E1'
ModelCode = 'E1'
Tags
Finally, we seek for the camera's status via <tag><00><data>. Multiple tags can be added to each advertisement.
Tag 22h
| Meaning | Mask |
| PairingSupported | 0x80 |
| PairingEnabled | 0x40 |
| LocationFunctionSupported | 0x20 |
| LocationFunctionEnabled | 0x10 |
| UnknownFunctionSupported | 0x08 |
| UnknownFunctionEnabled | 0x04 |
| RemoteFunctionEnabled | 0x02 |
| Unknown | 0x01 |
Examples:
| Value | Meaning |
| 0xEF | Pairing, Location not enabled |
| 0xAF | No Pairing, Location not enabled |
Tag 21h
This tag seems to be mainly set by the Send to Smartphone Func.->Cnct. during Power OFF Option
| Definitition | Value |
| WirelessPowerOnEnabled | 0x80 |
| CameraOn | 0x40 |
| WifiHandoverSupported | 0x20 |
| WifiHandoverEnabled | 0x10 |
Device Name
The device name is user configurable and is sent as an advertising packet.
UUID
A unique UUID is also sent on the a7c but not the a7m4. This may be unique to every camera. For example the ILCE-7C has
8E3F7E15-AF80-1567-D946-A9190C2Cf98A
Services
Supporting cameras have several modes of operations that determine which Services are operational. We'll focus on the DIRC service but for completeness here are the various modes.
Camera Control Service
The service enables various camera control over BLE. It's believed this service has more functionality than the DIRC, but its usage is somewhat limited at this time by clients. Once clients begin using this interface, you can be sure we'll snoop the interface. Camera Control Service is disabled if the "Bluetooth Rmt Cnt" is activated.
The Camera Control Service is currently being used by the Sony App for BLE to Wifi Handoff. Many of it's characteristics appear to be for FTP server support, but this is not confirmed. CC40 does contain all the FTP user provided server names so we expect the proceeding characteristics to apply to the 9 FTP servers.
| Characteristic | UUID |
| Service UUID | 8000CC00-CC00-FFFF-FFFF-FFFFFFFFFFFF |
| CameraControlNotify | CC01 |
| CameraControlCharacteristic | CC02 |
| WifiStatusNotifyCharacteristics | CC05 |
| WifiSsidCharacteristics | CC06 |
| WifiPasswordCharacteristics | CC07 |
| FTP Status? Notify* | CC21 |
| FTP/Wifi Servers? Writes* | CC22-CC2C |
| FTP Server Names* | CC40 |
*ILCE-7C only
Camera Location Services
It appears this characteristic is for your mobile device to actively push location and time data to your camera. This gets enabled when "Location Info. Link Set." is enabled.
| Characteristic | UUID |
| CameraLocation Service | 8000DD00-DD00-FFFF-FFFF-FFFFFFFFFFFF |
| CameraLocationNotifyCharacteristic | DD01 |
| CameraLocationInfoCharacteristic | DD11 |
| CameraLocationFeatureCharacteristic | DD21 |
Camera Pairing Service
This characteristic appears to allow untethered pairing and shutdown of the camera.
| Characteristic | UUID |
| Pairing Service | 8000EE00-EE00-FFFF-FFFF-FFFFFFFFFFFF |
| CameraPairingCharacteristic | EE01 |
Commands (Untested)
| Command | Values |
| writePairingCommand | 06 08 01 00 00 00 |
| writePairingCommandWithDisconnect | 06 08 02 00 00 00 |
| writePowerOffCommand | 03 08 13 |
Camera Remote Control Service
This service provides a means to control the camera with a small subset of features.
| Characteristic | UUID |
| Service UUID | 8000FF00-FF00-FFFF-FFFF-FFFFFFFFFFFF |
| RemoteCommand | FF01 |
| RemoteNotify | FF02 |
Commands
| Command |
| S1 (Focus) |
| S2 (Shutter) |
| Record |
| AF-ON Customizable Button |
| C Customizable Button |
| Focus Far |
| Focus Near |
| Zoom Tele |
| Zoom Wide |
Responses
IRC will send a 0x0185 GATT Status back if there is a protocol error.
Various notifications will be sent if processes such as a photo is taken, or recording starts.
