Nikon WU-1a WiFi Dongle Hacking

Here’s a pretty tricky piece of consumer electronics reverse engineering. [Joe Fitz] came across the Nikon WU-1a. It’s a dongle that plugs into a Nikon D3200 camera, producing a WiFi connection which can be picked up and controlled from a smart phone. The app shows you the current image from the viewfinder, allows you to snap the picture, then pulls down the picture afterwards. The problem is that the same functionality for his D800 camera will cost him $1200, when this dongle can be had for $60. That’s a powerful incentive to find a way to use the WU-1a with his camera model. This is more than just rerouting some wires. It involves sniffing the USB traffic and drilling down in the datasheets for the chips used in the hardware. We’re not certain, but he may have even rolled new firmware for the dongle.

Details are a bit scarce right now. Your best bet is to watch the video embedded after the break. There is also a set of slides which [Joe] put together for a talk at this weekend’s BsidesPDX. It will give you a general overview of the process he went through. But he also started a forum thread and we hope to learn much more from that as the conversation gets going.

23 thoughts on “Nikon WU-1a WiFi Dongle Hacking

  1. Hey,
    Sorry for the scarce details. No firmware mod needed, just had to trick the wu-1a to boot normally with 3v on pin 6 while camera is attached, as well as supply the 5v VBUS to both camera and device….
    Will post code and schematic later this week….

    -joe

    1. with USB host port

      Damn slides didnt work for me the first time, figured out link was dead, turns out Google docs doesnt work with Opera? :/
      looking at them now in FF

      WOW it is a PTP-PTPIP bridge
      too bad it has nikon specific firmware and broadcome BCM4336 SDIO wifi part (no docs?, cant easily write own firmware, would need to reverse SPI protocol?)

  2. I know this might sound a bit stupid, but would this hack work for my Nikon D40 too?

    I’ve used attached USB to my MacBook to do HDR and adjust ISO settings on-the-hoof (great for photographing a Lightning storm), but it would be better if I could do it Wireless.

  3. I am not sure if underline setup will work

    Connecting a USB Based Wifi Dongle which is Powered by it’s own internal Battery through USB OTG cable in DSLR.

    Using LR as tethered software and connected to USB Dongle SSID.

    Will this setup will work or has anyone tested it.

  4. So, I have been trying my own hack with this device. I can use this dongle with my phone, but the Nikon app really sucks. It seems that Nikon doesn’t have any desktop software to tether wirelessly with the thing. This really sucks! I have been trying to sniff out its communication and write my own control and handshake on a desktop and not phone app. My problem thus far is that I can only connect one device, and it only will associate with a device that has the app. The android Emulator won’t install 3rd party apps so I am not sure how to move forward, Anyone else tried this?

  5. I’m definitely going to say that yes it is way better. but for now I’ll stick with his hack. I’ve used attached USB to my MacBook to do HDR and adjust ISO settings on-the-hoof (great for photographing a Lightning storm), but it would be better if I could do it Wireless.

  6. Any news? I’m very interested in tethering pictures to my computer without a cable. I got the WU-1a and a Nikon D7100 but the mobile restriction really suc….. and a WT-5 is too expensive for a non-professional user. Best regards.

  7. Hi,
    I just bought a new wu-1a and my phone is new BlackBerry 10. But the device is not getting connected. I installed WMU from android using snap. Guess the problem is IP conflict!! Can you guide me?! It’s a $40 loss if not solved!!

Leave a Reply to joefitzCancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.