Jump to content

Reversing Mavic Pro Firmware


Geodesix

Recommended Posts

  • Replies 105
  • Created
  • Last Reply

Top Posters In This Topic

Just now, MingTao said:

i have full dump from EMMC  , it is SAMSUNG EMCP  Samsung KMFJ20005A-B213

Were you able to mount the partitions from that image ?

Cant you modify the files (like enableing ADB) and flash back ?

Could you elaborate ? (Emmc Interface used, soldering points, ...)

 

Thank you !

Ender

Link to comment
Share on other sites

Yes, i think Assistant 2 is the way to go.

The Tool from Coptersafe is using the exactly same driver set (ADB etc), that are included in the Assistant 2 Installation.

As the Tool is only provided for Windows and im only having a old XP Machine "in stock", i couldnt investigate further.

 

 

 

Link to comment
Share on other sites

Oh god huo much i hate Twitter :-)

But thanks for the link. Those guys are also really onto the matter.

I saw them referring to POV, but unluckily he went under the surface sooan after the famous FW root Thread weas deleted on MavicPilots. I had limited contact to him.Did you really grok how the patches DJI_A to write stuff ? I saw the command hightlighted but i have the opinopn thats the patched SDK they were refering to ?

 

Greetings,

 

Ender

Link to comment
Share on other sites

8 minutes ago, Opcode said:

Yes, i think Assistant 2 is the way to go.

The Tool from Coptersafe is using the exactly same driver set (ADB etc), that are included in the Assistant 2 Installation.

As the Tool is only provided for Windows and im only having a old XP Machine "in stock", i couldnt investigate further.

 

 

 

Okay... how about a W7 VM ?

For comfort you could use this one, DJI Assistant already installed:

 

http://mavicpilots.com/threads/i-created-a-vm-so-we-can-all-forever-downgrade-to-400.16619/page-26#post-231468

 

First link, about 5gb

 

Ender

Link to comment
Share on other sites

10 hours ago, kariem112 said:

I have seen on twitter (https://twitter.com/TheDJIProblem) that someone changed the DJI Assistant 2 software so that he could write parameters directly to the drone.. ..

 

DClLJuBUIAAIaE5.jpg

It might be possible to enable adb there? 

 

https://github.com/droner69/MavicPro

more about dji assistant 2 debug/factory menu

anyone know how to enable it ?

 

by the way, mavproxyuser have provide python code to send/read parameters to drone, but it only allow to set thing with defined "range"

such as limit height, only allow to set 20 to 500

but you can set more than 500meter from dji assistant hidden menu

Link to comment
Share on other sites

Has someone already figured out the JTAG of the FC chip(which is next to the sd-card)? Because I'm really interested in that one, since I have encrypted firmware of both the loader and the fc, but wanna see if it is possible to decrypt them through JTAG.

Link to comment
Share on other sites

@freaky123

DJI has disabled JTAG just about everywhere they can.  I did a boundary scan, and although I could find some devices responding, I wasn't able to do any debugging.  There is absolutely no response from the Leadcore ARM chip, for example.  

Link to comment
Share on other sites

On 6/25/2017 at 10:40 AM, singlag said:

 

https://github.com/droner69/MavicPro

more about dji assistant 2 debug/factory menu

anyone know how to enable it ?

 

by the way, mavproxyuser have provide python code to send/read parameters to drone, but it only allow to set thing with defined "range"

such as limit height, only allow to set 20 to 500

but you can set more than 500meter from dji assistant hidden menu

Stop by and see us on this thread if you are bored... we are trying to keep the conversation heated up and on topic! Too many folks deviating and using speculation too drive their typing. We want to get back to *real* progress. 

 

 

Link to comment
Share on other sites

On 6/25/2017 at 1:38 PM, martinbogo said:

@freaky123

DJI has disabled JTAG just about everywhere they can.  I did a boundary scan, and although I could find some devices responding, I wasn't able to do any debugging.  There is absolutely no response from the Leadcore ARM chip, for example.  

Do you care to share the pinouts? There are at times glitching techniques and other errata that make certain parts of chip memory accessible, etc depending on the chip.

Link to comment
Share on other sites

On 6/24/2017 at 11:41 PM, kariem112 said:

I have seen on twitter (https://twitter.com/TheDJIProblem) that someone changed the DJI Assistant 2 software so that he could write parameters directly to the drone.. ..

It might be possible to enable adb there? 

 

As a heads up TheDJIProblem on Twitter == MavProxyUser on GitHub. He is I and I am him... slim with my tilted brim. 

Link to comment
Share on other sites

I have a FULL Unlock coptersafe programme. NFZ , altitude, sport.
if there is any way I can help let me know, send me an inbox Asap. I'm not very good with all this jibbery jabbery talk .. but if theres programmes or something I can run to store any info whilst I use it to jailbreak my mav.. and then send u files or what not let me know

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.

×
×
  • Create New...