Someone created a chrome app for their specific model a couple of years ago, and their notes are available here [1]:
> The commands are simple 8 byte packets sent continuously over UDP.
> The drone creates an unprotected wireless network and streams live video to an android or ios app named 'RC-Leading' (there are dozens of near-identical apps from the manufacturer)
> The drone's IP is always 172.16.10.1
> I've captured the communications between the drone and app and there seems to be several rounds of back and forth of ~100 bytes worth of non-intelligible data over the TCP 8888 port before the video streaming begins (I assume this is some kind of app level handshaking)
> It streams unencrypted video over TCP port 8888 (I can view video frame info using ffprobe on captured packets)
There was a similar hackaday project for this [2] and some of their notes are at [3]:
1) https://www.reddit.com/r/HowToHack/comments/4512il/how_to_ha...
2) https://hackaday.io/project/56102-reverse-engineering-a-dron...
3) https://steemit.com/drone/@highonapples/reverse-engineering-...
(edited for formatting)