droner69

I made backups if the crawlers didn't get them.

I have successfully gotten coptersafe's tool to work with differing hardware fingerprints using VM's to test, but I don't have another mavic to see if this method works with differing serial numbers. If someone could send me their coptersafe "full pack" binary and or name/keys, I can test the method to see if it works using my mavic's serial, and then hopefully create a patch/crack. Below is the sequence of events that the coptersafe "Mountain Pack - speed+atti" tool goes through to patch to the mavic. I used wireshark and usbpcap to get this info. His tool writes to the external EEPROM on FC. 0 $Vp`EHNH*DC4l*p`cSc5=p`PC-PC<MSFT 5.07 } $Vp`ZEH@O**CD4l*p`cSc56*local V[RC]handle_wristband_channel 0|0|0|0|0|0|0 W[RC]1 1 1 (0|0)|0 0e X[API]api_ctrl_health_flag 0 Z[SEND DATA][Info] [Pub] In last second 0 bytes data were sent1 Z[SEND DATA][Info] [Pub] In last second 0 bytes data were sent1 d[PITOT]dev diff press 0.0000004 [DEV]call:comm_recorder_data, block_id:5000, data_len:26` 6 216420 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1; B[FMU/LED]call set_forearm_led_status' v[OSD]display_mode 1P w[RC]wristbnad cnt 02 x[RC]handle_wristband_channel 0|0|0|0|0|0|0S y[RC]1 1 1 (0|0)|0 0 z[API]api_ctrl_health_flag 0 |[SEND DATA][Info] [Pub] In last second 0 bytes data were sent [DEV]call:comm_recorder_data, block_id:5000, data_len:26>9 =[FLYLIMIT]>>sending limit areas:[0] [OSD]display_mode 1E [RC]wristbnad cnt 0 [RC]handle_wristband_channel 0|0|0|0|0|0|0/ [RC]1 1 1 (0|0)|0 0B [API]api_ctrl_health_flag 0 t [SEND DATA][Info] [Pub] In last second 0 bytes data were sent - [PITOT]dev diff press 0.000000 <[DEV]call:comm_recorder_data, block_id:5000, data_len:26D8Ua$ z 216520 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1U3 [FMU/LED]call set_forearm_led_statussU" [OSD]display_mode 1U" [RC]wristbnad cnt 0 ` ,U,6*74WM220 AC Ver.AR, p 227477 [L-SYS]NAVI wm220 20170112|132359I 'NAVI wm220 20170112|1323594 p 227478 [L-SEND DATA]assistant connect changed:last(0) != current(1) XXXXXXXXXXXXXX" #(first 14 of mavic serial number) p[DEV]call:comm_recorder_data, block_id:5000, data_len:267 p[FLYLIMIT]>>sending limit areas:[0]s q[OSD]display_mode 1 q[RC]wristbnad cnt 0R q[RC]handle_wristband_channel 0|0|0|0|0|0|0 q[RC]1 1 1 (0|0)|0 0 q[API]api_ctrl_health_flag 0 3o q[SEND DATA][Info] [Pub] In last second 0 bytes data were sent &q[PITOT]dev diff press 0.000000q q 227520 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1Q r[FMU/LED]call set_forearm_led_statusl r[DEV]call:comm_recorder_data, block_id:5000, data_len:26 8s[OSD]display_mode 1* 9s[RC]wristbnad cnt 0 :s[RC]handle_wristband_channel 0|0|0|0|0|0|0 ;s[RC]1 1 1 (0|0)|0 0- <s[API]api_ctrl_health_flag 0 .M >s[SEND DATA][Info] [Pub] In last second 0 bytes data were sent>R u[DEV]call:comm_recorder_data, block_id:5000, data_len:262x Wu[OSD]display_mode 1# Xu[RC]wristbnad cnt 0 Yu[RC]handle_wristband_channel 0|0|0|0|0|0|0 Zu[RC]1 1 1 (0|0)|0 0] [u[API]api_ctrl_health_flag 0 { ]u[SEND DATA][Info] [Pub] In last second 0 bytes data were sent gu[PITOT]dev diff press 0.000000/V 8v 227620 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1 Dv[FMU/LED]call set_forearm_led_statusu .w[DEV]call:comm_recorder_data, block_id:5000, data_len:26 yw[OSD]display_mode 1x1 zw[RC]wristbnad cnt 0 {w[RC]handle_wristband_channel 0|0|0|0|0|0|0 |w[RC]1 1 1 (0|0)|0 0 }w[API]api_ctrl_health_flag 0 Y w[SEND DATA][Info] [Pub] In last second 0 bytes data were sent_ My[DEV]call:comm_recorder_data, block_id:5000, data_len:26 y[OSD]display_mode 1D y[RC]wristbnad cnt 0M y[RC]handle_wristband_channel 0|0|0|0|0|0|08 y[RC]1 1 1 (0|0)|0 0R y[API]api_ctrl_health_flag 0 s y[SEND DATA][Info] [Pub] In last second 0 bytes data were sent y[PITOT]dev diff press 0.000000/G yz 227720 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1 z[FMU/LED]call set_forearm_led_statush z 227728 [L-SEND DATA]assistant connect changed:last(1) != current(0) z 227728 [L-CFG]lock_assistant z 227728 [L-SEND DATA]lock assistant!W d{[FLYLIMIT]>>sending limit areas:[0] u{[DEV]call:comm_recorder_data, block_id:5000, data_len:26` {[OSD]display_mode 1 {[RC]wristbnad cnt 0Um {[RC]handle_wristband_channel 0|0|0|0|0|0|0@ {[RC]1 1 1 (0|0)|0 0 {[API]api_ctrl_health_flag 0 < {[SEND DATA][Info] [Pub] In last second 0 bytes data were sent/% `g $T33p``B2c<wpad 0;r ll$@^p`E2`*6<wpad `Z $\p`ENc**: FHFAEBEECACACACACACACACACACACAAA }[DEV]call:comm_recorder_data, block_id:5000, data_len:26D# }[OSD]display_mode 1(@ }[RC]wristbnad cnt 0 }[RC]handle_wristband_channel 0|0|0|0|0|0|0 }[RC]1 1 1 (0|0)|0 0_t }[API]api_ctrl_health_flag 0 Y\ }[SEND DATA][Info] [Pub] In last second 0 bytes data were sent }[PITOT]dev diff press 0.0000004 ~ 227820 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1 ~[FMU/LED]call set_forearm_led_status `| $\p`ENc**: FHFAEBEECACACACACACACACACACACAAA [DEV]call:comm_recorder_data, block_id:5000, data_len:26k [OSD]display_mode 1 [RC]wristbnad cnt 0e [RC]handle_wristband_channel 0|0|0|0|0|0|0 [RC]1 1 1 (0|0)|0 0, [API]api_ctrl_health_flag 0 [SEND DATA][Info] [Pub] In last second 0 bytes data were sentn ` $\p`ENc**: FHFAEBEECACACACACACACACACACACAAA [DEV]call:comm_recorder_data, block_id:5000, data_len:26 [OSD]display_mode 1$2 ![RC]wristbnad cnt 0 "[RC]handle_wristband_channel 0|0|0|0|0|0|0 #[RC]1 1 1 (0|0)|0 025 $[API]api_ctrl_health_flag 0 &[SEND DATA][Info] [Pub] In last second 0 bytes data were sent 0[PITOT]dev diff press 0.000000*S 227920 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1e [FMU/LED]call set_forearm_led_statusSd [DEV]call:comm_recorder_data, block_id:5000, data_len:26 B[OSD]display_mode 1 C[RC]wristbnad cnt 0 D[RC]handle_wristband_channel 0|0|0|0|0|0|0| E[RC]1 1 1 (0|0)|0 0q7 F[API]api_ctrl_health_flag 0 H[SEND DATA][Info] [Pub] In last second 0 bytes data were sent; 227979 [L-CFG]unlock_assistantTH 227979 [L-CFG][_var_set] save(var->addr) 227979 [L-CFG]set g_config.flying_limit.limit_height_abs_without_gps 227979 [L-CFG]2500.000000 227979 [L-CFG][_var_set] save(var->addr) 227979 [L-CFG]set g_config.flying_limit.limit_height_absd 227979 [L-CFG]2500.000000 227979 [L-CFG][_var_set] save(var->addr)m 227979 [L-CFG]set g_config.flying_limit.limit_height_rel2 227979 [L-CFG]2500.000000M 227979 [L-CFG][_var_set] save(var->addr) 227979 [L-CFG]set g_config.flying_limit.height_limit_enabled_P 227979 [L-CFG]2h 227979 [L-CFG][_var_set] save(var->addr) 227979 [L-CFG]set g_config.mode_sport_cfg.tilt_atti_range 227979 [L-CFG]60.000000| 227979 [L-CFG][_var_set] save(var->addr) 227979 [L-CFG]set g_config.mode_sport_cfg.vert_vel_up 227979 [L-CFG]10.000000 227979 [L-CFG][_var_set] save(var->addr) 227979 [L-CFG]set g_config.mode_sport_cfg.vert_vel_downsU( 227979 [L-CFG]-10.000000U8*8 rXU8 227979 [L-CFG][_var_set] save(var->addr)?UE 227979 [L-CFG]set g_config.mode_sport_cfg.vert_acc_upg 227979 [L-CFG]10.000000dU8*8 ARUS 227980 [L-SEND DATA]assistant connect changed:last(0) != current(1)( 227980 [L-CFG][_var_set] save(var->addr)PJ 227980 [L-CFG]set g_config.mode_sport_cfg.vert_acc_downE 227980 [L-CFG]-10.000000 227980 [L-CFG][_var_set] save(var->addr)!AU; 227980 [L-CFG]set g_config.fw_cfg.max_speedU' 227980 [L-CFG]20.0000002nU8*CA 227985 [L-EMBEDDED]Eeprom write offset:2f8 9 ` eUe 227988 [L-GPS]<GPS INFO>[monitor][0][0]:lce:1,sfe:0,dit:80,fe:2,dynseed 912 cnt 912025 *[FLYLIMIT]>>sending limit areas:[0] 0 227993 [L-EMBEDDED]Eeprom write offset:458 b I[DEV]call:comm_recorder_data, block_id:5000, data_len:26] ` 227997 [L-EMBEDDED]Eeprom write offset:930 v [OSD]display_mode 1 [RC]wristbnad cnt 0M5 [RC]handle_wristband_channel 0|0|0|0|0|0|0X [RC]1 1 1 (0|0)|0 0 [API]api_ctrl_health_flag 0 s [SEND DATA][Info] [Pub] In last second 0 bytes data were sent [PITOT]dev diff press 0.0000001( i 228020 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1= u[FMU/LED]call set_forearm_led_status l[DEV]call:comm_recorder_data, block_id:5000, data_len:26h [OSD]display_mode 1hW [RC]wristbnad cnt 0 [RC]handle_wristband_channel 0|0|0|0|0|0|0 [RC]1 1 1 (0|0)|0 0 } [API]api_ctrl_health_flag 0 %h [SEND DATA][Info] [Pub] In last second 0 bytes data were sent [DEV]call:comm_recorder_data, block_id:5000, data_len:26N [OSD]display_mode 1 [RC]wristbnad cnt 0 [RC]handle_wristband_channel 0|0|0|0|0|0|0U [RC]1 1 1 (0|0)|0 00 [API]api_ctrl_health_flag 0 % [SEND DATA][Info] [Pub] In last second 0 bytes data were sent [PITOT]dev diff press 0.000000B 228120 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1 [FMU/LED]call set_forearm_led_status [DEV]call:comm_recorder_data, block_id:5000, data_len:26d* [OSD]display_mode 1L [RC]wristbnad cnt 0Z [RC]handle_wristband_channel 0|0|0|0|0|0|09b [RC]1 1 1 (0|0)|0 0 [API]api_ctrl_health_flag 0 | [SEND DATA][Info] [Pub] In last second 0 bytes data were sent [DEV]call:comm_recorder_data, block_id:5000, data_len:26Q [OSD]display_mode 1 [RC]wristbnad cnt 0j [RC]handle_wristband_channel 0|0|0|0|0|0|0g [RC]1 1 1 (0|0)|0 0 [API]api_ctrl_health_flag 0 [SEND DATA][Info] [Pub] In last second 0 bytes data were sentl [PITOT]dev diff press 0.000000` 228220 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1 [FMU/LED]call set_forearm_led_status_ N 228230 [L-SEND DATA]assistant connect changed:last(1) != current(0)1 O 228230 [L-CFG]lock_assistant P 228230 [L-SEND DATA]lock assistant! [FLYLIMIT]>>sending limit areas:[0]M; [DEV]call:comm_recorder_data, block_id:5000, data_len:26 2[OSD]display_mode 1d^ 3[RC]wristbnad cnt 0 4[RC]handle_wristband_channel 0|0|0|0|0|0|0 5[RC]1 1 1 (0|0)|0 0t 6[API]api_ctrl_health_flag 0 8[SEND DATA][Info] [Pub] In last second 0 bytes data were sentx [DEV]call:comm_recorder_data, block_id:5000, data_len:26, Q[OSD]display_mode 1 R[RC]wristbnad cnt 0 S[RC]handle_wristband_channel 0|0|0|0|0|0|07 T[RC]1 1 1 (0|0)|0 0< U[API]api_ctrl_health_flag 0 W[SEND DATA][Info] [Pub] In last second 0 bytes data were sente a[PITOT]dev diff press 0.0000004 2 228320 [L-FMU/MOTOR]set act status, num:1, r_id:37764728, res:0, id:201, status:1M >[FMU/LED]call set_forearm_led_statusy =[DEV]call:comm_recorder_data, block_id:5000, data_len:26H s[OSD]display_mode 1E t[RC]wristbnad cnt 0S u[RC]handle_wristband_channel 0|0|0|0|0|0|0 v[RC]1 1 1 (0|0)|0 0 w[API]api_ctrl_health_flag 0 & y[SEND DATA][Info] [Pub] In last second 0 bytes data were sentu \[DEV]call:comm_recorder_data, block_id:5000, data_len:263 [OSD]display_mode 1 [RC]wristbnad cnt 0 [RC]handle_wristband_channel 0|0|0|0|0|0|0L [RC]1 1 1 (0|0)|0 0 [API]api_ctrl_health_flag 0 k [SEND DATA][Info] [Pub] In last second 0 bytes data were sentK [PITOT]dev diff press 0.000000

Here is a list of commands and parameters taken off of the mavic pro.