Instax Mini Link support placeholder

[vitorio]

Launched last month, the Instax Mini Link: https://instax.com/mini_link/en/

Same mini film at 800x600 resolution as the SP-2, but prints over Bluetooth instead of wifi, and uses a different Instax Mini Link app.

[jpwsutton]

Oooh, this is basically what I wished the instax was when it first launched!
I've not got any reason to buy one for myself sadly, but happy to help support someone else adding it to this library.

At a guess, I would imagine that Fujifilm will have likely used the same communications protocol under the covers, but have switched from WiFi to bluetooth. If this is the case, then it should make it pretty easy to adapt this library to work with it.

[caichunjian520]

Does instax mini link use the same communications protocol as sp-2? If the answer is true, I gonna buy a mini link instead of sp-2.

[netzwanze]

dmesg:

[27085.469143] usb 3-2.1: USB disconnect, device number 8
[28991.907737] usb 3-2.1: new full-speed USB device number 9 using xhci_hcd
[28992.044195] usb 3-2.1: New USB device found, idVendor=04cb, idProduct=5019, bcdDevice= 2.00
[28992.044200] usb 3-2.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[28992.044202] usb 3-2.1: Product: instax mini Link1
[28992.044205] usb 3-2.1: Manufacturer: FUJIFILM
[28992.044207] usb 3-2.1: SerialNumber: 00000000001A
[28992.100359] cdc_acm 3-2.1:1.0: ttyACM0: USB ACM device`

ok -> CDC ACM (serial port over USB)

Bluetooth find 2 devices:

INSTAX-10669469(ANDROID) typ printer but can not connect
INSTAX-10669469(IOS) typ unkown  it is possible to connect 

[INSTAX-10669469(IOS)]# info
Device FA:AB:BC:4D:1A:FA (random)
	Name: INSTAX-10669469(IOS)
	Alias: INSTAX-10669469(IOS)
	Paired: yes
	Trusted: yes
	Blocked: no
	Connected: yes
	LegacyPairing: no
	UUID: Generic Access Profile    (00001800-0000-1000-8000-00805f9b34fb)
	UUID: Generic Attribute Profile (00001801-0000-1000-8000-00805f9b34fb)
	UUID: Device Information        (0000180a-0000-1000-8000-00805f9b34fb)
	UUID: Vendor specific           (0000e0ff-3c17-d293-8e48-14fe2e4da212)
	UUID: Vendor specific           (70954782-2d83-473d-9e5f-81e1d02d5273)
	Modalias: bluetooth:v005Dp0000d0100
	ManufacturerData Key: 0x04d8
	ManufacturerData Value:
  01 00                                            ..              
	RSSI: -46
	TxPower: 0

[caichunjian520]

Last year, I successfully translate this project to iOS project with swift language.
So I purchased a mini link to test.
There are three characteristics can read or write
0xFFE1 (Write Notify)
0xFFE9 (Write)
0xFFEA (Notify)

When I tried to sendPrePrintCommand with cmdNumber from 1 to 8, it gets no response at all.
So I think they have changed communications protocol.

[jpwsutton]

I suspect that you're right @caichunjian520, the jump to bluetooth would have probably have instigated more changes deeper down the stack too. However, this actually should be pretty easy to reverse engineer compared to the original instax devices.
If anyone has an instax mini and an android device, they can enable the Bluetooth HCI snoop log, which I have a feeling will let you log all of your bluetooth traffic and then analyse it in WireShark on your computer (https://support.honeywellaidc.com/s/article/How-to-capture-Bluetooth-traffic-from-and-to-an-Android-Device)

If we could get a complete set of interactions between the android app and the mini this way, we should be able to figure out what's going on.

I'm unlikely to buy another instax printer, but if we can get the wireshark logs uploaded, I'd be happy to go through and see if I can match them to this API.

[netzwanze]

Hi will try it with my Moto G5 with LineageOS.I find the developer options. Now i have to find the log. Am Montag, den 28.12.2020, 01:39 -0800 schrieb James Sutton:

…

I suspect that you're right @caichunjian520, the jump to bluetooth would have probably have instigated more changes deeper down the stack too. However, this actually should be pretty easy to reverse engineer compared to the original instax devices. If anyone has an instax mini and an android device, they can enable the Bluetooth HCI snoop log, which I have a feeling will let you log all of your bluetooth traffic and then analyse it in WireShark on your computer ( https://support.honeywellaidc.com/s/article/How-to-capture-Bluetooth-traffic-from-and-to-an-Android-Device ) If we could get a complete set of interactions between the android app and the mini this way, we should be able to figure out what's going on. I'm unlikely to buy another instax printer, but if we can get the wireshark logs uploaded, I'd be happy to go through and see if I can match them to this API. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or unsubscribe.

[caichunjian520]

I just try to get the BLE HCI log file. There are two files when printing a photo with mini link printer.
One file with extension .log, another with extension .last

In order to get the smallest data file. I just switch on the HCI log option, select image, and print, then switch off the log option. So it would be quicker to analyse.

I print two photos, each has 2 files. So there are total 4 files to analyse.

Image a
https://www.dropbox.com/s/z282i2fbl9ldo7p/btsnoop_hci_image_a.log?dl=0
https://www.dropbox.com/s/22uen29t8s0fhv4/btsnoop_hci.log_image_a.last?dl=0

Image b
https://www.dropbox.com/s/2h05637o8nhnime/btsnoop_hci_image_b.log?dl=0
https://www.dropbox.com/s/13qwm7lz2rq85f5/btsnoop_hci.log_image_b.last?dl=0

[netzwanze]

So, it was not so easy for me. I found it on my G5 with LineageOS here ./data/misc/bluetooth/logs/btsnoop_hci.log I printed one file. + 2. file :-) https://www.dropbox.com/sh/dwe22pvy0gs4zy0/AAD536KOrH6jkHpJj78yMxw3a?dl=0 Please contact me via my email. netzwanze(at)gmx.net

[jpwsutton]

Ok, These logs look perfect!
For reference, I'm viewing them in wireshark with the btspp filter on as these look like the actual commands / responses between the device and the phone.

Some first observations:

1. Command Packets start with 0x41 0x62 and Response packets start with 0x61 0x42
2. The next two bytes appear to be the total length of the packet.
3. The final byte is a two's complement checksum - 1 for some reason

I'm starting to write some parsing code for the log files you've provided me with, will update here as I find more 👍🏻

[jpwsutton]

Ok getting a bit further now, here are what I think some of the commands / responses are:
(I'm stripping the headers out for the payloads to make things tidier below.

Command Payload	Response Payload	Notes
0007 0000	0010 0000 0001 0000 0000 0000 00
0008 0001 00	0012 0001 0000 0846 554a 4946 494c 4d	ASCII for FUJIFILM, byte 6 is string length, 8
0008 0001 01	000e 0001 0001 0453 502d 34	ASCII for SP-4, byte 6 is length, 8
0008 0001 02	0012 0001 0002 0831 3034 3538 3634 37	ASCII for 10458647 (Serial Number) byte 6 is length, 8
0008 0001 03	000e 0001 0003 0430 3030 30	ASCII for 0000 byte 6 length, 4
0008 0001 04	000e 0001 0004 0430 3130 32	ASCII for 0102 byte 6 length, 4
0008 0001 05	000e 0001 0005 0431 2e30 30	ASCII for 1.00
0008 0002 00	0013 0002 0000 0258 0320 0200 0002 5800
0007 2010	000a 2010 0000 00
0009 3002 0203	0009 3002 0003
0137......	0008 3001 00	This is a big command, not big enough for image data thought
0008 0002 02	0011 0002 0002 2600 000d 0000 0000
0008 0002 03	0011 0002 0003 0000 0004 0000 0001
0008 0002 01	000d 0002 0001 0232 0010
0007 3000	000f 3000 0000 10ff f0fb f000
038f......	000c 1001 0000 0000 02	Lots of these, and huge, definitely the image being sent.

There are a few more, but I'll pause there for now..

This Protocol, definitely seems to be a step-change from the previous one used on the SP-1,2 and 3. Not surprising given the new form factor and communication method (Bluetooth rather than WiFi). From what I've seen already, it would appear that they've had some time to reflect and improve on the old one (always a good thing, but just means a bit more work for us!)

The Plan!

[ ] Create a new mini-link branch
[ ] Build out a packet library for the mini link / sp-4
[ ] Build out the test harness and appropriate bluetooth serial code
[ ] Test with App & test harness
[ ] Flesh out Packet Library
[ ] Test with real device
[ ] Merge mini-link branch back to master

I can probably get away with doing most of the steps above, and am more than happy to. But will definitely need some help in testing with the real device eventually!

[netzwanze]

Great. I will test with my mini link.

[caichunjian520]

I have a question. I worked on several BLE projects on iOS as well as Android. All of them need to set notify for listening data change from peripheral device. Or send byte array to characteristic to send data.

Based on the log file. I can't figure out which characteristic I should write data. does it work with RFCOMM protocol?