Hacking an Aldi Cocoon360 360 degree VR camera

This cheap little number is quite decent, and the apps are OK as well. But what if you want more? To live stream from the camera, you turn on Wifi, and connect your phone to the camera's AP. I connected my laptop instead and ran nmap to see what's open - lo an behold, ports 21 (ftp) and 554 (rtsp) are open. Easy. VLC to the rtsp port (rtsp://192.168.1.1) yields a stream straight up. This is almost too easy. 

But how can we change the view that the camera is showing? For this I installed Packet Capture on my phone, and captured a few packets while change the view in the app. At first glance, it seems that it uses FTP for changing the view. The username and password are both wificam (I wonder if this can be changed). After setting passive mode, we get a RETR \FULL_VIEW.BIN; unfortunately this doesn't seem to yield much; it's possibly an update mechanism from the app.

Moving on, we see port 15740 in use. Annoyingly, it's a binary protocol. Playing around and looking at the traffic dump, it seems that a straight replay of the previous commands from the app doesn't quite work - it doesn't give the same response. I suspect there is a handshake going on, but I don't have the time to decipher it at the moment.

Thankfully, it appears that whatever view mode was last set via the Android app persists when watching the RTSP stream, so that might be all I need in order to re-broadcast a live stream.

Annoyingly, the wifi connection on this camera seems to be flaky on the connection phase; specifically both my Android and OSX computer often fail to pick up a DHCP lease.