Case study
DJI MIMO BLE artifacts: reconstructing the DJI Osmo control protocol
Documents the Bluetooth Low Energy message format that DJI's proprietary MIMO app uses to control DJI Osmo devices, as artifacts produced while building the independent djictl CLI. The author derives the framing — a magic byte, length, protocol version, header CRC8, subsystem and message-id fields, a payload and a message CRC16 — from the author's own Android BLE logs, and ships a Wireshark dissector plus an annotated catalog of message types. Many message types are labelled as guesses or unknown; the author reports reaching working livestreaming on a DJI Osmo Pocket 3 and pausing further analysis.
- Targets
- Protocol
- Category
- Independent reconstruction cases
- Relationship
- Independent reconstruction project
- Sources reviewed
Requirements & limits
- Reviewed at the main-branch head of 2025-06-08. The repository is a set of reverse-engineering notes, not a runnable application: the companion tool djictl lives in a separate repository, which this review did not assess. The README describes a DJI Osmo Pocket 3; coverage of other DJI Osmo models is not claimed.
- The method uses the user's own Android phone: the README captures a Bluetooth HCI snoop log through an adb bug report, then opens it in Wireshark. No DJI firmware, app binary or account is committed to or required by this repository, and no captured log is included beyond one Wireshark screenshot.
- mimo/ble/message_types.md lists annotated sample frames for about two dozen message types, and the Wireshark dissector in mimo/ble/wireshark-dissector/ maps message-type codes to names; many entries are marked with a question mark or as unknown, so the catalog is partial and author-interpreted rather than a complete specification.
- Building the dissector needs Wireshark development headers and pkg-config on a system with a C compiler; its Makefile installs a shared-object plugin into the Wireshark 4.2 plugin directory. The notes record protocol observations only; this review ran neither the dissector nor any device.
- The repository is licensed CC0-1.0 (public-domain dedication). DJI, MIMO and Osmo remain trademarks of their owners, and the reviewed sources establish no AI or REA use.
About this entry
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · xaionaro/reverse-engineering-dji · Revision 5c9278f
- mimo/ble/message_types.md GitHub · xaionaro/reverse-engineering-dji · Revision 5c9278f
- mimo/ble/wireshark-dissector/dji-ble-message.c GitHub · xaionaro/reverse-engineering-dji · Revision 5c9278f
- mimo/ble/wireshark-dissector/Makefile GitHub · xaionaro/reverse-engineering-dji · Revision 5c9278f
- LICENSE GitHub · xaionaro/reverse-engineering-dji · Revision 5c9278f
More in Protocols
- Cat Printer BLE: reconstructing the MXW01 thermal printer protocol · Case study
- a0rfid: an open driver for A0-protocol UHF RFID readers · Case study
- Xiaomi Kettle BLE protocol: reconstructing a smart kettle's control interface · Case study
- Ford Fiesta MK5 MS-CAN: decoding the dashboard and radio bus · Case study
- uniden-r8-ble: reconstructing the Uniden R8 radar detector's BLE telemetry · Case study
- opendash: reconstructing the Scanmatik SM3 J2534 adapter protocol · Case study