Jump to content
Hak5 Forums

MavproxyUser

Active Members
  • Content count

    63
  • Joined

  • Last visited

  • Days Won

    1

1 Follower

About MavproxyUser

  • Rank
    Hak5 Fan +
  1. None the less... some of you may be interested in my talk "KickStarting a Drone JailBrak Scene"
  2. NONE of the original group hangs out here any more... we exclusively operate on Slack and GitHub now... https://join.slack.com/t/dji-rev/shared_invite/MjIzMTI1MDA5MDcyLTE1MDIyMDgyNTItNzZkNTZhZjY4NQ #DeejayeyeHackingClub information repos aka "The OG's" (Original Gangsters) http://dji.retroroms.info/ - "Wiki" https://github.com/fvantienen/dji_rev - This repository contains tools for reverse engineering DJI product firmware images. https://github.com/Bin4ry/deejayeye-modder - APK "tweaks" for settings & "mods" for additional / altered functionality https://github.com/hdnes/pyduml - Assistant-less firmware pushes and DUMLHacks referred to as DUMBHerring when used with "fireworks.tar" from RedHerring. DJI silently changes Assistant? great... we will just stop using it. https://github.com/MAVProxyUser/P0VsRedHerring - RedHerring, aka "July 4th Independence Day exploit", "FTPD directory transversal 0day", etc. (Requires Assistant). We all needed a public root exploit... why not burn some 0day? https://github.com/MAVProxyUser/dji_system.bin - Current Archive of dji_system.bin files that compose firmware updates referenced by MD5 sum. These can be used to upgrade and downgrade, and root your I2, P4, Mavic, Spark, Goggles, and Mavic RC to your hearts content. (Use with pyduml or DUMLDore) https://github.com/MAVProxyUser/firm_cache - Extracted contents of dji_system.bin, in the future will be used to mix and match pieces of firmware for custom upgrade files. This repo was previously private... it is now open. https://github.com/MAVProxyUser/DUMLrub - Ruby port of PyDUML, and firmware cherry picking tool. Allows rolling of custom firmware images. https://github.com/jezzab/DUMLdore - Even windows users need some love, so DUMLDore was created to help archive, and flash dji_system.bin files on windows platforms. https://github.com/MAVProxyUser/DJI_ftpd_aes_unscramble - DJI has modified the GPL Busybox ftpd on Mavic, Spark, & Inspire 2 to include AES scrambling of downloaded files... this tool will reverse the scrambling https://github.com/darksimpson/jdjitools - Java DJI Tools, a collection of various tools/snippets tied in one CLI shell-like application.
  3. Updated in original post... https://join.slack.com/t/dji-rev/shared_invite/MjIzMTI1MDA5MDcyLTE1MDIyMDgyNTItNzZkNTZhZjY4NQ
  4. several other exploits remain untouched.
  5. It blocks one variant of RedHerring... by fixing the busybox tar dir traversal issue, and making /system "ro" instead of "rw"
  6. I'll repost this here, as referenced in the dji_system.bin repo, this is a good place to start: http://dji.retroroms.info For those of you not in the loop, that want to help with the "retention" process regarding control of your DJI aircraft, please familiarize yourself with the following repos: This represents the front lines of the resistance as it were... "the movement" pretty well begins in all of these individual battle grounds. https://github.com/Bin4ry/deejayeye-modder - APK "tweaks" for settings & "mods" for additional / altered functionality https://github.com/hdnes/pyduml - Assistant-less firmware pushes and DUMLHacks referred to as DUMBHerring when used with "fireworks.tar" from RedHerring. DJI silently changes Assistant? great... we will just stop using it. https://github.com/MAVProxyUser/P0VsRedHerring - RedHerring, aka "July 4th Independence Day exploit", "FTPD directory transversal 0day", etc. (Requires Assistant). We all needed a *public* root exploit... why not burn some 0day? https://github.com/MAVProxyUser/dji_system.bin - Current Archive of dji_system.bin files that compose firmware updates referenced by MD5 sum. These can be used to upgrade and downgrade, and root your I2, P4, Mavic, Spark, Goggles, and Mavic RC to your hearts content. (Use with pyduml or DUMLDore) https://github.com/MAVProxyUser/firm_cache - Extracted contents of dji_system.bin, in the future will be used to mix and match pieces of firmware for custom upgrade files. This repo was previously private... it is now open. https://github.com/jezzab/DUMLdore - Even windows users need some love, so DUMLDore was created to help archive, and flash dji_system.bin files on windows platforms. So... that is all! Have fun folks, stop by Slack and see us if you get bored. #android_apk_patching, #archived_fw_flashing, #factory_mode_access, #firm_cache, #hardware, #mavic_rooting, #safety_shaming channels all have something for everyone. If not.. feel free to lurk in #general. We are currently looking to archive as much firmware as possible if anyone wants to help... https://www.rcgroups.com/forums/showpost.php?p=37941901&postcount=1704
  7. DUMLdore can be found here of course. You can use it to backup your DJI aircraft. https://github.com/jezzab/DUMLdore
  8. we have several firmwares backed up... we are looking for folks across various platforms to help us archive historic firmware using DUMLdore. It would be nice if any of you Inspire2, or P4, P4+ owners could help us archive some of the historic firmware. Stop by slack in #archived_fw_flashing and ask how to use DUMLdore to get is dji_system.bin files for your specific version. You can of course go into Assistant and check your current version against the list below to see if it is something we are missing. The current list is as follows: MD5 (V01.00.0300_Spark_dji_system.bin) = bf81af1c10318e8549bb78b0fef85013 MD5 (V01.00.0330_I2_dji_system.bin) = 0a5c437812b91355c9ae0d4d28d505d1 MD5 (V01.00.0400_Spark_dji_system.bin) = 65f15f4cbe7d761459c7a09ebc660801 MD5 (V01.01.0010_I2_dji_system.bin) = 7d04f199bd872c9372fdebddbef3c404 MD5 (V01.02.0602_P4_dji_system.bin) = 36e11566ae6e303ec5c407f9c0f6c382 MD5 (V01.03.0400_Mavic_dji_system.bin) = a5ac037462b4f902bfa6cb8d9fe395ae MD5 (V01.03.0400_RC_Mavic_dji_system.bin) = d5f40b9231786d6d5053539a78a105c5 MD5 (V01.03.0500_Mavic_dji_system.bin) = 2934111740e9cec3cd65029754b71fd8 MD5 (V01.03.0550_Mavic_dji_system.bin) = 34bdb52c8b8b7468f6312a5febf1838d MD5 (V01.03.0550_RC_Mavic_dji_system.bin) = 06cc62f5d658c7461c758f3903b56c2a MD5 (V01.03.0509_P4P_dji_system.bin) = 93a1663f6675a813ed494e260bb54e89 MD5 (V01.03.0600_Mavic_dji_system.bin) = f3a40d447c39bf8e946f2b5a087dccd6 MD5 (V01.03.0600_RC_Mavic_dji_system.bin) = 06b7657e1c8a42faf4b6f847eefcb438 MD5 (V01.03.0700_Goggles_dji_system-2.bin) = 76eefdb955bfa416e2f43f2ac9f86b84 MD5 (V01.03.0700_Goggles_dji_system.bin) = 47e7ea9eb5f5609bbd8141f7edb3516c MD5 (V01.03.0700_Mavic_dji_system.bin) = 891904fad23add85e8c50a7902f272df MD5 (V01.03.0700_RC_Mavic_dji_system.bin) = 8c11d7e04c03142a50cc0c9538d49fa6 MD5 (V01.03.0800_Goggles_dji_system.bin) = e2c93ded968c148f94c7a81776ce1dfd MD5 (V01.03.0800_Mavic_dji_system.bin) = 6602c26ed0729581246853d7c988a4ae MD5 (V01.03.0800_RC_Mavic_dji_system.bin) = e2508fbf87ce87c0dc7fb7721e555901 MD5 (V01.03.0900_Goggles_dji_system.bin) = 1f82d27681217b4c388a593e4ba6f875 MD5 (V01.03.0900_Mavic_dji_system.bin) = 984446beb028443670091e07d3bbd752 MD5 (V01.03.0900_RC_Mavic_dji_system.bin) = beb6c9dea2a0ad5f688ada4d439e969f MD5 (V01.04.0602_P4P_dji_system.bin) = 2a6b5baba26aa3203ecdc5450ba0473f MD5 (V02.00.0106_P4_dji_system.bin) = a49944bb254354ec064bee13c491fa1e For those of you that can already use git, and have no problem figuring out DUMLDore just submit us a pull request similar to this: https://github.com/MAVProxyUser/dji_system.bin/pull/6/files
  9. Current pyduml: https://github.com/hdnes/pyduml/commit/b7636619371462cf62f12b98e456e5a2f68e1b99 Current *combined* root/.400 Mavic downgrade. (this is no longer a private Git account... anyone can access it) https://github.com/MAVProxyUser/dji_system.bin/commit/c32b67c9853a195e4c8bfbf9a6e357c777675250 $ python pyduml.py /dev/tty.usbmodemXX 55 16 04 FC 2A 28 65 57 40 00 07 00 00 00 00 00 00 00 00 00 27 D3 55 0E 04 66 2A 28 68 57 40 00 0C 00 88 20 55 1A 04 B1 2A 28 6B 57 40 00 08 00 00 18 54 07 00 00 00 00 00 00 02 04 94 0B 55 1E 04 8A 2A 28 F6 57 40 00 0A 00 86 B3 22 02 66 12 E9 6F A0 93 73 BC 85 60 67 4A 6E 18 Firmware Upload Complete (wait 5 minutes, like for real!) # telnet 192.168.42.2 1234 Trying 192.168.42.2... Connected to 192.168.42.2. Escape character is '^]'. id; uid=0(root) gid=0(root) for ADB access... rm /data/.bin/grep; (via telnet) sh-3.2# adb devices List of devices attached RedHerringHasFangs device sh-3.2# adb shell [email protected]_dz_ap0002_v1:/ # To make your own:$ cp UniversalFireworksTar_dji_system.bin mavic_combined_400_root.bin $ gtar --concatenate --file mavic_combined_400_root.tar V01.03.0700_Mavic_dji_system.bin $ tar tvf mavic_combined_400_root.tar
  10. Current pyduml: https://github.com/hdnes/pyduml/commit/b7636619371462cf62f12b98e456e5a2f68e1b99 Current *combined* root/.400 Mavic downgrade. (you can't see this unless you give me your GitHub name via slack) https://github.com/MAVProxyUser/dji_system.bin/commit/c32b67c9853a195e4c8bfbf9a6e357c777675250 $ python pyduml.py /dev/tty.usbmodemXX 55 16 04 FC 2A 28 65 57 40 00 07 00 00 00 00 00 00 00 00 00 27 D3 55 0E 04 66 2A 28 68 57 40 00 0C 00 88 20 55 1A 04 B1 2A 28 6B 57 40 00 08 00 00 18 54 07 00 00 00 00 00 00 02 04 94 0B 55 1E 04 8A 2A 28 F6 57 40 00 0A 00 86 B3 22 02 66 12 E9 6F A0 93 73 BC 85 60 67 4A 6E 18 Firmware Upload Complete (wait 5 minutes, like for real!) # telnet 192.168.42.2 1234 Trying 192.168.42.2... Connected to 192.168.42.2. Escape character is '^]'. id; uid=0(root) gid=0(root) for ADB access... rm /data/.bin/grep; (via telnet) sh-3.2# adb devices List of devices attached RedHerringHasFangs device sh-3.2# adb shell [email protected]_dz_ap0002_v1:/ # To make your own:$ cp UniversalFireworksTar_dji_system.bin mavic_combined_400_root.bin $ gtar --concatenate --file mavic_combined_400_root.tar V01.03.0700_Mavic_dji_system.bin $ tar tvf mavic_combined_400_root.tar
  11. They are sent via FTP ... You can catch via ADB (with existing root access) adb pull /data/dji_system.bin or Via cp (with existing root access) (and copy to a spot you control and can get to later) while true ; do cp /data/dji_system.bin /data/xxx.bin; done
  12. Game over... Confirmed ability to downgrade firmware to any version you have the .bin for.
  13. Stop on by the slack mentioned in the first post... very few folks are on this thread these days... but slack is on and poppin.
  14. I know a lot of Windows users have wanted to play... as of This commit I believe you guys are good to go. Let me know of any bugs please. https://github.com/MAVProxyUser/P0VsRedHerring/commit/ac04a117cbea49dfcfecd216b2ed62d751cd03dd
  15. short answer... yes. There is a HUGE hint to this in my *original* post in one of the statements I made, and photos I added (inside IDA pro).
×