Go to content Go to menu

Walkera X-Z-18 internals

Tuesday, December 30, 2014

The Walkera X-Z-18 camera is a very cheap and simple flight recording camera. It is intended for usage with Walkera’s Hoten-X or Ladybird quadcopters but it can also be used with other copters.
See this post for how to install and use it.

I’m always interested in how thing’s work so the following post describes some internals of the X-Z-18 camera.

Click on a picture for a larger view


The camera consists of:

  • an ARM SOC (ANYKA AK-1120Q) (info)
  • a 512K serial EEPROM containing the firmware (G25Q40) (info)
  • a 0308 camera module (info)
  • a microphone and a SD-Card slot

There are not many informations about the used components freely available but the overall design looks a lot like cheap chinese 808 car / keychain cameras. This site (http://www.chucklohr.com/808) contains a wealth of information about such cams.

Interestingly, there are unused USB and serial ports available on the board. By connecting the USB port to a PC the X-Z-18 acts like a USB stick providing access to the SD-Card content from the PC. It is also possible to use the X-Z-18 as a webcam by using the correct driver. Unfortunately I was unable to find the right one somewhere on the internet.

Mini USB pinout
1 - VCC
2 - Data-
3 - Data+
4 - ID (NC)
5 - GND

There is also a serial port available which seems to be a console to the ARM SOC. Connecting a terminal with 115200 baud, 8 databits, no parity and 1 stop bits a lot of information is output during power up / boot of the camera as well as during actions like taking photos and videos.

Serial Port pinout
1 - VCC 3.3V
2 - TX (115200 8N1)
3 - GND

It would be interesting to extract the firmware for the AK-1120 SOC from the SPI flash for further analysis. These SOC’s are quite powerfull and provide a lot of possibilities for modifications as described here http://www.computersolutions.cn/blog/2010/08/firmware-hackery-on-keychain-spycams-ak36xx-based/.

Below is a sample console output during power up of the camera:

RM2.0.0
sflash param
page size:00000100
erase size:00010000
progarm size00000100
flag:
clock:02625a00
pro_mask:0000001c
pgm init OK!
asic clk: 05b8d800, spi clk: 016e3600

######FirmWare information#########
##FirmWare Version:V0.0.7
##Chip of Current FirmWare used for: AK1120
##1.5V reference voltage used: internal
##power supply mode: internal LDO
######FirmWare information show end#########

VME_Main
ACR1:0x01010053 refVol:ox00000001 batDiv:0x
@@DAC_Init()
Detect Init avdd:33 off:0
*** This is userware ***
Version 1.0
Serial trace is active!!!!!
LoadMem_Init.
Mount_Lib_V2.0.3B

 Get FSLib - Version: EXFAT_V3.2.6_SVN1245
This card's capacity is 001dc000
SD Card Mounted!
initinit_system
Init OK!
exit from vme_main()

0
0
exitinit_system
VME_SystemInit
initinit_power_on
handleinit_power_on:1001
paintinit_power_on
exitinit_power_on
asic clk: 00375028, spi clk: 001ba814
usb cable state:0
asic clk: 03750280, spi clk: 01ba8140
Capacity High:0,Low:801341440
 into initcam_preview
asic clk: 06ea0500, spi clk: 01ba8140
Get Max count:19
get max:6asic clk: 03750280, spi clk: 01ba8140
asic clk: 06ea0500, spi clk: 01ba8140
Get Max count:19
get max:37asic clk: 03750280, spi clk: 01ba8140
640 480 640 480
JDrv_EncInit::jpeg head Malloc Size = 1024
JDrv_EncInit::jpeg head Malloc Success!
øððøcamera probe id = 0000009b, device id = 0000009b
match camera, id = 0000009b