DirectShow & OEM Camera API

Most 3rd party camera applications relies on DirectShow to control the camera. However, on some devices, DirectShow doesn't expose the full camera capabilities. For example, on a Dopod 838Pro, DirectShow only allows recording up to 176x144 7.5fps while the built-in camera can do much better. Further investigation shows that the built-in camera app (and some 3rd party apps such as CoolCamera) do not use DirectShow but instead relies on a proprietary camera API to control the camera. This API exposes the full capabilities of the camera. This web page lists which devices expose usable camera modes via DirectShow and those which cause problems.

On a Dopod 838Pro device, the camera API is hidden in \Windows\HTCCamera1.dll. Calling several functions inside this dll could turn on the camera and the flashlight. However, getting the camera to work properly without proper API documentation seems to be an impossible task. Attempt was made to reverse engineering the HTCCamera1.dll and CoolCamera using Interactive Disassembler (IDA). However, it was not clear from the disassembly how the camera raw frame buffer was retrieved. The part of the code which retrieves the camera data has probably been obfuscated.

The following code shows how to init the camera, turn on the flashlight and then turn it off:

test = 1
result = Camera_Init(test)
test = 0
result = Camera_Begin(test)
result = Camera_FlashLight(CameraPropertyState.STATE_ON)
MessageBox.Show("Flashligh ON. Click OK to turn off.")
result = Camera_FlashLight(CameraPropertyState.STATE_OFF)
result = Camera_Deinit()

<DllImport("HTCCamera1.dll")> _
Private Shared Function Camera_Init(ByRef input As Int32) As Boolean
End Function

<DllImport("HTCCamera1.dll")> _
Private Shared Function Camera_Begin(ByRef input As Int32) As Boolean
End Function

<DllImport("HTCCamera1.dll")> _
Private Shared Function Camera_End(ByRef input As Int32) As Boolean
End Function

Enum CameraPropertyState As Integer
STATE_ON = 1
STATE_OFF = 2
End Enum

<DllImport("HTCCamera1.dll")> _
Private Shared Function Camera_FlashLight(ByVal state As CameraPropertyState) As Boolean
End Function

<DllImport("HTCCamera1.dll")> _
Private Shared Function Camera_Deinit() As Boolean
End Function

Another way to control the flashlight is to use DeviceIOControl. This does not rely on HTCCamera1.dll but is still device-specific

DWORD dwDIOC=0x90002024; //device io (device specific)
int Mode_int = 1;
DeviceIoControl(hCam, dwDIOC, LPVOID(&Mode_int), sizeof(Mode_int), 0, NULL, NULL, NULL);
MessageBox(GetActiveWindow(), L"OK to turn off", L"Flash Light", MB_OK);
Mode_int = 2;
DeviceIoControl(hCam, dwDIOC, LPVOID(&Mode_int), sizeof(Mode_int), 0, NULL, NULL, NULL);