[Change phantom 4 pro plus CE to FCC]

2 hours ago, barry99705 said:

I'm not even sure what you're asking.

 

 

2 hours ago, barry99705 said:

I'm not even sure what you're asking.

yap…

the app fake gps, works only with dji drone with wifi . (dji  spark and mavic air ) the p4 pro+ dont works whith wifi...

[Change phantom 4 pro plus CE to FCC]

11 minutes ago, barry99705 said:

I'm not even sure what you're asking.

 

 

11 minutes ago, barry99705 said:

I'm not even sure what you're asking.

my drone phantom, 4 pro+ works with the CE mode.
I want it to work in FCC mode.
I have read on the internet that this change is possible.
I do not know how to do it.
And I need someone to teach-me how to make change. (CE for FCC).
I'm sorry, my english is not very good

[Change phantom 4 pro plus CE to FCC]

please...

[Remove CE limits from DJI products and other fun stuff in DJI Go4]

On 7/4/2017 at 12:57 PM, Bin4ry said:

Hey, 

Update:

You can find the Modding tool on github: https://github.com/Bin4ry/deejayeye-modder

Feel free to contribute. 

 

i saw that here are already 2 topics regarding DJI products and their limitations, so i guessed it is ok to show you some of my recent work here. I don't want to introduce myself here too much, if you want to know something about me find me on XDA. 

Ok, so i recently bought a DJI spark, and i tried to come up with a way to remove the CE transmission limit without rooting the drone (because technically this is not my drone but my wifes ? ) and i started with reversing the dji go app. What i found was this part of code which is called when the app is started (this is decompiled from classes4.dex, because of that the code looks strange):

public void a(String paramString1, String paramString2, dji.pilot.countrycode.model.a parama1, dji.pilot.countrycode.model.a parama2, a parama)
  {
    boolean bool = dji.pilot2.usercenter.activate.c.d(DJIApplication.getAppContext());
    StringBuilder localStringBuilder = new StringBuilder(40);
    if ((!parama1.a()) && (bool))
    {
      a(paramString1, paramString2, parama1, parama);
      localStringBuilder.append("飞机GPS获得，采取策略1:UavGps策略");  //Aircraft GPS gets, take strategy 1: UavGps strategy
    }
    for (;;)
    {
      a.a(this.c, "【国家码获取（get）】触发后策略选择： " + localStringBuilder); //[Country code get (get)] After the trigger strategy selection:
      return;
      if ((!parama2.a()) && (bool))
      {
        b(paramString1, paramString2, parama2, parama);
        localStringBuilder.append("飞机GPS没有获得，手机GPS获得，采取策略2:MobileGps策略"); //Aircraft GPS does not get, mobile GPS gets, take strategy 2: MobileGps strategy
      }
      else if (a(parama, false, -1))
      {
        localStringBuilder.append("飞机GPS没有获得，手机GPS没有获得，mCC获得，采取策略3:Mcc策略"); //Aircraft GPS did not get, cell phone GPS did not get, mCC get, take strategy 3: Mcc strategy
      }
      else if (bool)
      {
        a(paramString1, paramString2, parama);
        localStringBuilder.append("飞机GPS没有获得，手机GPS没有获得，mCC没有获得，采取策略4:IP策略"); //Aircraft GPS did not get, cell phone GPS did not get, mCC did not get, take strategy 4: IP strategy
      }
      else
      {
        parama.a(-1, "get cc failure for network is disconnect");
      }
    }
  }

I added comments to translate the chinese stuff. So what this code does is simple, it has a few checks and goes through a strategy to determine which limitations it should apply. 

1.) check if aircraft has gps -> if yes, use the coords to determine which country (done on phone!)

2.) if 1 failed -> check if mobile has gps ......

3.) if 2 failed -> check if mobile has SIM, if yes look for MCC and determine sim country

4.) if 3 failed -> check if mobile has internet, if yes go to: https://mydjiflight.dji.com/api/v2/geocoder_service/geoip and parse the json result

 

Ok, so there are a few ways to get the app think we are located in the US to get FCC limits instead of CE. First i modified the above functions smali code to represent something lilke this java code: 

    public void a(String string, String string2, dji.pilot.countrycode.model.a a2, dji.pilot.countrycode.model.a a3, a a4) {
        c.d((Context)DJIApplication.getAppContext());
        StringBuilder stringBuilder = new StringBuilder(40);
        a2.a();
        this.a(a4, false, -1);
        stringBuilder.append("Call to fake function which will always answer with US MCC");
        dji.pilot.countrycode.a.a.a((Context)this.c, (String)("Going to use fake function to always return US MCC: " + stringBuilder));
    }

also i modified the function which it calls.

Before:

 private boolean a(a parama, boolean paramBoolean, int paramInt)
  {
    String str = ((TelephonyManager)this.c.getSystemService("phone")).getNetworkCountryIso();
    if (!TextUtils.isEmpty(str))
    {
      this.b[b.c.ordinal()] = str.toUpperCase();
      parama.a(a(), "getFromMcc");
      return true;
    }
    if (paramBoolean) {
      parama.a(paramInt, "getFromMcc():CountryCode is empty !");
    }
    return false;
  }

After:

    private boolean a(a a2, boolean bl, int n) {
        if (!TextUtils.isEmpty((CharSequence)"us")) {
            this.b[b.c.ordinal()] = "us".toUpperCase();
            a2.a(this.a(), "getFromMcc");
            return true;
        }
        if (!bl) return false;
        a2.a(n, "getFromMcc():CountryCode is empty !");
        return false;
    }

 

So the new program flow is:

1.) call MCC function -> MCC function answers "us" ?

 

I've done the changes directly in the smali code and put it together again to a dex file, then i packed the dex file into the apk, removed the manifest.mf with its signatures and signed the whole file again with testkeys. 

You can find the modified apk (based on version 4.1.3) here if you don't want to put together your own version (you will have to remove the original apk first because this one is signed with a testkey and not with dji's key): 

!Downloadlink removed!

I have not had time to test the range yet, but i am pretty sure it should work if there is no other check involved. As far as i was able to understand this check should be the same for all dji products which use the DJIGo4 App, so if you have multiple products this should work for all of them at the same time ?

I hope i was able to contribute here and would love to hear some of your thoughts. 

 

Best Regards

Bin4ry

I 

 

On 7/4/2017 at 12:57 PM, Bin4ry said:

Hey, 

Update:

You can find the Modding tool on github: https://github.com/Bin4ry/deejayeye-modder

Feel free to contribute. 

 

i saw that here are already 2 topics regarding DJI products and their limitations, so i guessed it is ok to show you some of my recent work here. I don't want to introduce myself here too much, if you want to know something about me find me on XDA. 

Ok, so i recently bought a DJI spark, and i tried to come up with a way to remove the CE transmission limit without rooting the drone (because technically this is not my drone but my wifes ? ) and i started with reversing the dji go app. What i found was this part of code which is called when the app is started (this is decompiled from classes4.dex, because of that the code looks strange):

public void a(String paramString1, String paramString2, dji.pilot.countrycode.model.a parama1, dji.pilot.countrycode.model.a parama2, a parama)
  {
    boolean bool = dji.pilot2.usercenter.activate.c.d(DJIApplication.getAppContext());
    StringBuilder localStringBuilder = new StringBuilder(40);
    if ((!parama1.a()) && (bool))
    {
      a(paramString1, paramString2, parama1, parama);
      localStringBuilder.append("飞机GPS获得，采取策略1:UavGps策略");  //Aircraft GPS gets, take strategy 1: UavGps strategy
    }
    for (;;)
    {
      a.a(this.c, "【国家码获取（get）】触发后策略选择： " + localStringBuilder); //[Country code get (get)] After the trigger strategy selection:
      return;
      if ((!parama2.a()) && (bool))
      {
        b(paramString1, paramString2, parama2, parama);
        localStringBuilder.append("飞机GPS没有获得，手机GPS获得，采取策略2:MobileGps策略"); //Aircraft GPS does not get, mobile GPS gets, take strategy 2: MobileGps strategy
      }
      else if (a(parama, false, -1))
      {
        localStringBuilder.append("飞机GPS没有获得，手机GPS没有获得，mCC获得，采取策略3:Mcc策略"); //Aircraft GPS did not get, cell phone GPS did not get, mCC get, take strategy 3: Mcc strategy
      }
      else if (bool)
      {
        a(paramString1, paramString2, parama);
        localStringBuilder.append("飞机GPS没有获得，手机GPS没有获得，mCC没有获得，采取策略4:IP策略"); //Aircraft GPS did not get, cell phone GPS did not get, mCC did not get, take strategy 4: IP strategy
      }
      else
      {
        parama.a(-1, "get cc failure for network is disconnect");
      }
    }
  }

I added comments to translate the chinese stuff. So what this code does is simple, it has a few checks and goes through a strategy to determine which limitations it should apply. 

1.) check if aircraft has gps -> if yes, use the coords to determine which country (done on phone!)

2.) if 1 failed -> check if mobile has gps ......

3.) if 2 failed -> check if mobile has SIM, if yes look for MCC and determine sim country

4.) if 3 failed -> check if mobile has internet, if yes go to: https://mydjiflight.dji.com/api/v2/geocoder_service/geoip and parse the json result

 

Ok, so there are a few ways to get the app think we are located in the US to get FCC limits instead of CE. First i modified the above functions smali code to represent something lilke this java code: 

    public void a(String string, String string2, dji.pilot.countrycode.model.a a2, dji.pilot.countrycode.model.a a3, a a4) {
        c.d((Context)DJIApplication.getAppContext());
        StringBuilder stringBuilder = new StringBuilder(40);
        a2.a();
        this.a(a4, false, -1);
        stringBuilder.append("Call to fake function which will always answer with US MCC");
        dji.pilot.countrycode.a.a.a((Context)this.c, (String)("Going to use fake function to always return US MCC: " + stringBuilder));
    }

also i modified the function which it calls.

Before:

 private boolean a(a parama, boolean paramBoolean, int paramInt)
  {
    String str = ((TelephonyManager)this.c.getSystemService("phone")).getNetworkCountryIso();
    if (!TextUtils.isEmpty(str))
    {
      this.b[b.c.ordinal()] = str.toUpperCase();
      parama.a(a(), "getFromMcc");
      return true;
    }
    if (paramBoolean) {
      parama.a(paramInt, "getFromMcc():CountryCode is empty !");
    }
    return false;
  }

After:

    private boolean a(a a2, boolean bl, int n) {
        if (!TextUtils.isEmpty((CharSequence)"us")) {
            this.b[b.c.ordinal()] = "us".toUpperCase();
            a2.a(this.a(), "getFromMcc");
            return true;
        }
        if (!bl) return false;
        a2.a(n, "getFromMcc():CountryCode is empty !");
        return false;
    }

 

So the new program flow is:

1.) call MCC function -> MCC function answers "us" ?

 

I've done the changes directly in the smali code and put it together again to a dex file, then i packed the dex file into the apk, removed the manifest.mf with its signatures and signed the whole file again with testkeys. 

You can find the modified apk (based on version 4.1.3) here if you don't want to put together your own version (you will have to remove the original apk first because this one is signed with a testkey and not with dji's key): 

!Downloadlink removed!

I have not had time to test the range yet, but i am pretty sure it should work if there is no other check involved. As far as i was able to understand this check should be the same for all dji products which use the DJIGo4 App, so if you have multiple products this should work for all of them at the same time ?

I hope i was able to contribute here and would love to hear some of your thoughts. 

 

Best Regards

Bin4ry

I have a phantom 4 pro plus , and i need to change frontal CE to FCC..

can you explain wo make this ??

i apreciate your help

[Change phantom 4 pro plus CE to FCC]

Hello.

any help me ??

i need change my Drone phantom 4 pro plus from CE to FCC .

i stay in Portugal ??