# DJI MIMO BLE artifacts: reconstructing the DJI Osmo control protocol

> Documents the Bluetooth Low Energy message format that DJI's proprietary MIMO app uses to control DJI Osmo devices, as artifacts produced while building the independent djictl CLI. The author derives the framing — a magic byte, length, protocol version, header CRC8, subsystem and message-id fields, a payload and a message CRC16 — from the author's own Android BLE logs, and ships a Wireshark dissector plus an annotated catalog of message types. Many message types are labelled as guesses or unknown; the author reports reaching working livestreaming on a DJI Osmo Pocket 3 and pausing further analysis.

- Type: Case study
- Targets: Protocol
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/xaionaro/reverse-engineering-dji>
- Primary source: <https://github.com/xaionaro/reverse-engineering-dji/blob/5c9278ff0b53bbe0d03ea6c830aab13ac775871e/README.md>
- Catalog page: <https://awesomerea.org/resources/dji-mimo-ble-reveng-case/>
- Record JSON: <https://awesomerea.org/resources/dji-mimo-ble-reveng-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/dji-mimo-ble-reveng-case/index.md)

## Requirements & limits

- Reviewed at the main-branch head of 2025-06-08. The repository is a set of reverse-engineering notes, not a runnable application: the companion tool djictl lives in a separate repository. The README describes a DJI Osmo Pocket 3.
- The method uses the user's own Android phone: the README captures a Bluetooth HCI snoop log through an adb bug report, then opens it in Wireshark. No DJI firmware, app binary or account is committed to or required by this repository, and no captured log is included beyond one Wireshark screenshot.
- mimo/ble/message_types.md lists annotated sample frames for about two dozen message types, and the Wireshark dissector in mimo/ble/wireshark-dissector/ maps message-type codes to names; many entries are marked with a question mark or as unknown, so the catalog is partial and author-interpreted rather than a complete specification.
- Building the dissector needs Wireshark development headers and pkg-config on a system with a C compiler; its Makefile installs a shared-object plugin into the Wireshark 4.2 plugin directory. The notes record protocol observations only.
- The repository is licensed CC0-1.0 (public-domain dedication). DJI, MIMO and Osmo remain trademarks of their owners.

## Primary sources

1. <https://github.com/xaionaro/reverse-engineering-dji/blob/5c9278ff0b53bbe0d03ea6c830aab13ac775871e/README.md>
2. <https://github.com/xaionaro/reverse-engineering-dji/blob/5c9278ff0b53bbe0d03ea6c830aab13ac775871e/mimo/ble/message_types.md>
3. <https://github.com/xaionaro/reverse-engineering-dji/blob/5c9278ff0b53bbe0d03ea6c830aab13ac775871e/mimo/ble/wireshark-dissector/dji-ble-message.c>
4. <https://github.com/xaionaro/reverse-engineering-dji/blob/5c9278ff0b53bbe0d03ea6c830aab13ac775871e/mimo/ble/wireshark-dissector/Makefile>
5. <https://github.com/xaionaro/reverse-engineering-dji/blob/5c9278ff0b53bbe0d03ea6c830aab13ac775871e/LICENSE>

## More in Protocols

- [Cat Printer BLE: reconstructing the MXW01 thermal printer protocol](https://awesomerea.org/resources/catprinterble-mxw01-printer-case/index.md) · Case study
- [a0rfid: an open driver for A0-protocol UHF RFID readers](https://awesomerea.org/resources/a0rfid-uhf-reader-protocol-case/index.md) · Case study
- [Xiaomi Kettle BLE protocol: reconstructing a smart kettle's control interface](https://awesomerea.org/resources/xiaomi-kettle-ble-protocol-case/index.md) · Case study
- [Ford Fiesta MK5 MS-CAN: decoding the dashboard and radio bus](https://awesomerea.org/resources/ford-fiesta-mk5-ms-can-case/index.md) · Case study
- [uniden-r8-ble: reconstructing the Uniden R8 radar detector's BLE telemetry](https://awesomerea.org/resources/uniden-r8-ble-telemetry-case/index.md) · Case study
- [opendash: reconstructing the Scanmatik SM3 J2534 adapter protocol](https://awesomerea.org/resources/opendash-scanmatik-sm3-protocol-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.
