USB installer script

README.md

@@ -2,7 +2,10 @@
 The latest Sony cameras include an Android subsystem used to run apps from the proprietary Sony PlayMemories Camera App Store (PMCA). We reverse engineered the installation process. This allows you to install custom Android apps on your camera.
 
 ## How to use it? ###
-**Go to [sony-pmca.appspot.com](https://sony-pmca.appspot.com/) to try it out!** You can upload your own apps and install them to your camera using the official Sony browser plugin. Since other browser vendors are disabling NPAPI plugins, please try it using **Internet Explorer**.
+There are two ways to install apps on your camera:
+
+* Browser plugin: **Go to [sony-pmca.appspot.com](https://sony-pmca.appspot.com/) to try it out!** You can upload your own apps and install them to your camera using the official Sony browser plugin. Since other browser vendors are disabling NPAPI plugins, please try it using **Internet Explorer**.
+* Python script: This method is for experienced users: Download this repository and run `python pmca.py install -f yourAppPackage.apk`. This script emulates the browser plugin and manages all the USB communication with the camera. WPD or libusb are used as drivers. The driver defaults to WPD on Windows. If you want to use libusb on Windows, you'll have to install generic drivers for your camera using [Zadig](http://zadig.akeo.ie/).
 
 ## Is it safe? ##
 This is an experiment in a very early stage. All information has been found through reverse engineering. Even though everything worked fine for our developers, it could cause harm to your hardware. If you break your camera, you get to keep both pieces. **We won't take any responsibility.**
@@ -17,6 +20,8 @@ If you want to develop your custom app, feel free to do so. Debug and release ce
 ## What about this repository? ##
 We replicated the server side of the Sony app store and created a Google appengine [website](https://sony-pmca.appspot.com/) for you to use it. This repository contains the source code.
 
+There is also `pmca.py`, a python script to communicate with your camera without the browser plugin. Run `pmca.py install --help` for more information.
+
 ## How does it all work? ##
 Since you asked, here are the juicy technical details:
 

pmca.py

@@ -0,0 +1,103 @@
+#!/usr/bin/env python
+"""A command line application to install apps on Android-enabled Sony cameras"""
+
+import argparse
+import json
+import os
+
+from pmca import installer
+from pmca.api import *
+from pmca.usb import *
+from pmca.usb.driver import *
+from pmca.usb.sony import *
+
+def printStatus(status):
+ """Print progress"""
+ print '%s %d%%' % (status.message, status.percent)
+
+def switchToAppInstaller(dev):
+ """Switches a camera in MTP mode to app installation mode"""
+ print 'Switching to app install mode. Please run this command again when the camera has switched modes.'
+ dev.switchToAppInstaller()
+
+def installApp(dev, api, apkFile=None, outFile=None):
+ """Installs an app on the specified device. The apk is uploaded to the specified WebApi."""
+ print 'Creating task'
+ # Upload apk (if any), start task
+ task = api.startBlobTask(api.uploadBlob(apkFile.read())) if apkFile else api.startTask()
+ xpdData = api.getXpd(task)
+
+ print 'Starting communication'
+ # Point the camera to the web api
+ result = installer.install(dev, xpdData, printStatus)
+ if result.code != 0:
+  raise Exception('Communication error %d: %s' % (result.code, result.message))
+
+ print 'Downloading task'
+ # Get the result from the website
+ result = api.getTask(task)
+ if not result['completed']:
+  raise Exception('Task was not completed')
+ result = result['response']
+
+ print 'Task completed successfully'
+
+ if outFile:
+  print 'Writing to output file'
+  json.dump(result, outFile, indent=2)
+
+
+def installCommand(url, driverName=None, apkFile=None, outFile=None):
+ """Install command main"""
+ if not driverName:
+  # On Windows, we default to wpd, user libusb for other systems
+  driverName = 'wpd' if os.name == 'nt' else 'libusb'
+
+ # Import the specified driver
+ if driverName == 'libusb':
+  print 'Using libusb'
+  import pmca.usb.driver.libusb as driver
+ elif driverName == 'wpd':
+  print 'Using Windows Portable Device Api (WPD)'
+  import pmca.usb.driver.wpd as driver
+ else:
+  raise Exception('Unknown driver')
+
+ print 'Looking for Sony MTP devices'
+ # Scan for MTP devices
+ devices = [dev for dev in driver.listDevices() if dev.type == USB_CLASS_PTP and dev.idVendor == SONY_ID_VENDOR]
+
+ if not devices:
+  print 'No MTP devices found. Ensure your camera is connected in MTP mode.'
+
+ for device in devices:
+  print '\nQuerying %s' % device.product
+  # Get device info
+  drv = driver.MtpDriver(device)
+  info = MtpDevice(drv).getDeviceInfo()
+
+  if isSonyMtpCamera(info):
+   print '%s is a camera in MTP mode' % info.model
+   switchToAppInstaller(SonyMtpCamera(drv))
+  elif isSonyMtpAppInstaller(info):
+   print '%s is a camera in app install mode' % info.model
+   installApp(SonyMtpAppInstaller(drv), WebApi(url), apkFile, outFile)
+
+
+def main():
+ """Command line main"""
+ parser = argparse.ArgumentParser()
+ subparsers = parser.add_subparsers(dest='command', title='commands')
+ install = subparsers.add_parser('install', description='Installs an apk file on the camera connected via USB. The connection can be tested without specifying a file.')
+ install.add_argument('-u', dest='url', help='specify the web api base url', default='https://sony-pmca.appspot.com')
+ install.add_argument('-d', dest='driver', choices=['libusb', 'wpd'], help='specify the driver')
+ install.add_argument('-o', dest='outFile', type=argparse.FileType('w'), help='write the output to this file')
+ install.add_argument('-f', dest='apkFile', type=argparse.FileType('rb'), help='the apk file to install')
+
+ args = parser.parse_args()
+ if args.command == 'install':
+  installCommand(args.url, args.driver, args.apkFile, args.outFile)
+
+
+if __name__ == '__main__':
+ main()

pmca/api/__init__.py

@@ -0,0 +1,27 @@
+import requests
+
+class WebApi:
+ """A simple interface for the appengine website"""
+ def __init__(self, baseUrl):
+  self.base = baseUrl
+
+ def uploadBlob(self, data, name='app.apk'):
+  """Uploads a blob, returns its key"""
+  url = requests.get(self.base + '/ajax/upload').json()['url']
+  return requests.post(url, files={'file': (name, data)}).json()['key']
+
+ def startTask(self, urlSuffix=''):
+  """Starts a task sequence and returns its id"""
+  return str(requests.get(self.base + '/ajax/task/start' + urlSuffix).json()['id'])
+
+ def startBlobTask(self, key):
+  """Starts the installation task of a previously uploaded apk blob"""
+  return self.startTask('/blob/' + key)
+
+ def getXpd(self, task):
+  """Downloads the xpd file for a task"""
+  return requests.get(self.base + '/camera/xpd/' + task).text.encode('ascii','ignore')
+
+ def getTask(self, task):
+  """Returns the task result"""
+  return requests.get(self.base + '/ajax/task/get/' + task).json()

pmca/installer/__init__.py

@@ -0,0 +1,105 @@
+"""Manages the communication between camera, PC and appengine website during app installation"""
+
+from collections import namedtuple
+import json
+import select
+import socket
+
+from ..usb.sony import *
+from .. import xpd
+
+Response = namedtuple('Response', 'protocol, code, status, headers, data')
+Request = namedtuple('Request', 'protocol, method, url, headers, data')
+
+Status = namedtuple('Status', 'code, message, percent, totalSize')
+Result = namedtuple('Result', 'code, message')
+
+def _buildRequest(endpoint, contentType, data):
+ return 'POST %s REST/1.0\r\nContent-type: %s\r\n\r\n%s' % (endpoint, contentType, data)
+
+def _parseHttp(data):
+ headers, data = data.split('\r\n\r\n')[:2]
+ headers = headers.split('\r\n')
+ firstLine = headers[0]
+ headers = dict(h.split(': ') for h in headers[1:])
+ return firstLine, headers, data
+
+def _parseRequest(data):
+ firstLine, headers, data = _parseHttp(data)
+ method, url, protocol = firstLine.split(' ', 2)
+ return Request(protocol, method, url, headers, data)
+
+def _parseResponse(data):
+ firstLine, headers, data = _parseHttp(data)
+ protocol, code, status = firstLine.split(' ', 2)
+ return Response(protocol, int(code), status, headers, data)
+
+def _parseResult(data):
+ data = json.loads(data)
+ return Result(data['resultCode'], data['message'])
+
+def _parseStatus(data):
+ data = json.loads(data)
+ return Status(data['status'], data['status text'], data['percent'], data['total size'])
+
+def install(dev, xpdData, statusFunc = None):
+ """Sends an xpd file to the camera, lets it access the internet through SSL, waits for the response"""
+ # Initialize communication
+ dev.emptyBuffer()
+ dev.sendInit()
+
+ # Start the installatin by sending the xpd data in a REST request
+ response = dev.sendRequest(_buildRequest('/task/start', xpd.constants.mimeType, xpdData))
+ response = _parseResponse(response)
+ result = _parseResult(response.data)
+ if result.code != 0:
+  raise Exception('Response error %s' % str(result))
+
+ connectionId = 0
+ sock = None
+
+ # Main loop
+ while True:
+  if sock != None:
+   ready = select.select([sock], [], [], 0)
+   if ready[0]:
+    # There is data waiting on the socket, let's send it to the camera
+    resp = sock.recv(4096)
+    if resp != '':
+     dev.sendSslData(connectionId, resp)
+    else:
+     dev.sendSslEnd(connectionId)
+     sock.close()
+     sock = None
+
+  # Receive the next message from the camera
+  message = dev.receive()
+  if message == None:
+   # Nothing received, let's wait
+   continue
+
+  if isinstance(message, SslStartMessage):
+   # The camera wants us to open an SSL socket
+   connectionId = message.connectionId
+   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+   sock.connect((message.host, 443))
+  elif isinstance(message, SslSendDataMessage) and sock and message.connectionId == connectionId:
+   # The camera wants to send data over the socket
+   sock.send(message.data)
+  elif isinstance(message, RequestMessage):
+   # The camera sends a REST message
+   request = _parseRequest(message.data)
+   if request.url == '/task/progress':
+    # Progress
+    status = _parseStatus(request.data)
+    if statusFunc:
+     statusFunc(status)
+   elif request.url == '/task/complete':
+    # The camera completed the task, let's stop this loop
+    result = _parseResult(request.data)
+    dev.sendEnd()
+    return result
+   else:
+    raise Exception("Unknown message url %s" % request.url)
+  else:
+   raise Exception("Unknown message %s" % str(message))

pmca/usb/__init__.py

@@ -0,0 +1,68 @@
+from collections import namedtuple
+
+from ..util import *
+
+DeviceInfo = namedtuple('DeviceInfo', 'manufacturer, model, serialNumber, operationsSupported, vendorExtension')
+
+class MtpDevice:
+ """Manages communication with a PTP/MTP device. Inspired by libptp2"""
+ PTP_OC_GetDeviceInfo = 0x1001
+ PTP_OC_OpenSession = 0x1002
+ PTP_OC_CloseSession = 0x1003
+ PTP_RC_OK = 0x2001
+ PTP_RC_SessionNotOpen = 0x2003
+ PTP_RC_SessionAlreadyOpened = 0x201E
+
+ def __init__(self, driver):
+  self.driver = driver
+  self.openSession()
+
+ def _checkResponse(self, code, acceptedCodes=[]):
+  if code not in [self.PTP_RC_OK] + acceptedCodes:
+   raise Exception('Response code not OK: 0x%x' % code)
+
+ def _parseString(self, data, offset):
+  length = parse8(data[offset:offset+1])
+  offset += 1
+  end = offset + 2*length
+  return end, data[offset:end].decode('utf16')[:-1]
+
+ def _parseIntArray(self, data, offset):
+  length = parse32le(data[offset:offset+4])
+  offset += 4
+  end = offset + 2*length
+  return end, [parse16le(data[o:o+2]) for o in range(offset, end, 2)]
+
+ def _parseDeviceInfo(self, data):
+  offset = 8
+  offset, vendorExtension = self._parseString(data, offset)
+  offset += 2
+
+  offset, operationsSupported = self._parseIntArray(data, offset)
+  offset, eventsSupported = self._parseIntArray(data, offset)
+  offset, devicePropertiesSupported = self._parseIntArray(data, offset)
+  offset, captureFormats = self._parseIntArray(data, offset)
+  offset, imageFormats = self._parseIntArray(data, offset)
+
+  offset, manufacturer = self._parseString(data, offset)
+  offset, model = self._parseString(data, offset)
+  offset, version = self._parseString(data, offset)
+  offset, serial = self._parseString(data, offset)
+
+  return DeviceInfo(manufacturer, model, serial, set(operationsSupported), vendorExtension)
+
+ def openSession(self, id=1):
+  """Opens a new MTP session"""
+  response = self.driver.sendCommand(self.PTP_OC_OpenSession, [id])
+  self._checkResponse(response, [self.PTP_RC_SessionAlreadyOpened])
+
+ def closeSession(self):
+  """Closes the current session"""
+  response = self.driver.sendCommand(self.PTP_OC_CloseSession, [])
+  self._checkResponse(response, [self.PTP_RC_SessionNotOpen])
+
+ def getDeviceInfo(self):
+  """Gets and parses device information"""
+  response, data = self.driver.sendReadCommand(self.PTP_OC_GetDeviceInfo, [])
+  self._checkResponse(response)
+  return self._parseDeviceInfo(data)

pmca/usb/driver/__init__.py

@@ -0,0 +1,5 @@
+from collections import namedtuple
+
+USB_CLASS_PTP = 6
+
+UsbDevice = namedtuple('UsbDevice', 'handle, idVendor, idProduct, type, manufacturer, product')