Accessing all my phone's cameras
The stock app is the only one that can really switch to the wide angle and the macro cameras but is misses a few features, like manual focus, macro video and viewing the fourth camera. There are a few apps out there for manual focus but none could access the macro or wide angle cameras.
Initial invesigation
The phone I want to use it on is a Samsung SM-A125DS running android 11.
Open camera does use the CameraAPI2 which supports multi camera. But of course the API onlyu reports 3 cameras: the rear (0), front zoomed in (1), front (2). Yeah there is two camera IDs for the front (which is a single camera) and only one for the back camera (composed of four physical cameras).
Looking at logs
Breaking out ADB to snoop around the logs.
./adb logcat | grep Camera\ ID
Changing the camera in the built in camera app reveiled a few interesting IDs:
- 23: portrait mode
- 50: wide angle
- 54: macro
Trying these IDs with the CameraAPI2 got nowhere.
Reverse engineer the built in app
./adb pull /system/priv-app/SamsungCamera/SamsungCamera.apk- Unzip
- There was a few
*.dexfiles which was converted to jar files with the help of dex2jar - JD-GUI made it really trivial to browse through the decoded jar files.
The access from the default app looks like how Open Camera access it through cameraAPI2.
Digging into libraries
There was a log message that peaked my interest:
CameraService: this package can use hidden camera ids.
I pulled all the libraries with:
adb pull /system/lib/ ./
And a quick look with grep -r pointed to libcameraservice.so as the library producing the log message above.
A quick look with Ghidra found the reason I cannot access the magical extra cameras. There is a function called android::CameraService::isHiddenCameraAvailable that checks a string against a list of strings. Without digging too deep, I would guess that the API performs differently if the app has one of the following names.
com.sec.android.app.cameracom.sec.android.app.camera.shootingmode.socialcom.sec.android.sdhmscom.sec.factory.cameracom.sec.factory.cameralyzercom.samsung.android.ardrawingcom.samsung.android.aremojicom.samsung.android.arzonecom.samsung.android.bio.face.servicecom.samsung.android.biometrics.servicecom.samsung.android.camerasdkcom.samsung.android.livestickerscom.samsung.android.rulercom.samsung.android.scan3dcom.samsung.android.sceneplaycom.samsung.android.server.iris
All the cameras
Sooooo a quick name change later...
The getCameraIdList still seems to only report the restricted list. But I can open cameras by the id string found in logs now. Some quick patch in OpenCamera to accept a static list, and we can now open all the camera IDs seen in the logs.
I did consider patching the .so file and injecting it back, but the phone is not rooted and I wanted this to persist across updates. Not a distributable solution but I'll leave this here in case anyone else really want to use all the cameras in their phone (without rooting).
Camera 52
Seeing the id 50 and 54 had me asking what about camera 52? So I added it to the static list and what do you know, a black and white camera showed up and there we have access to all of the four physsical cameras!
The camera has a very very large depth of field so everything is essentially in focus. It has the same field of view as the main camera. I would guess it is used alongside the main camera to provide HDR with some AI mixing the images?