MingTao Posted June 24, 2017 Posted June 24, 2017 i sold to test point . but after 5-7 second after start . uart disable... and connection is closed. Quote
enderffx Posted June 24, 2017 Posted June 24, 2017 Ouch ;-( probably worked in that old < .200 Firmware... The other way to het access would surely be EMMC soldering, i have an EMMC Interface, any idea where those points are ? Ender Quote
MingTao Posted June 24, 2017 Posted June 24, 2017 i have full dump from EMMC , it is SAMSUNG EMCP Samsung KMFJ20005A-B213 Quote
enderffx Posted June 24, 2017 Posted June 24, 2017 Just now, MingTao said: i have full dump from EMMC , it is SAMSUNG EMCP Samsung KMFJ20005A-B213 Were you able to mount the partitions from that image ? Cant you modify the files (like enableing ADB) and flash back ? Could you elaborate ? (Emmc Interface used, soldering points, ...) Thank you ! Ender Quote
MingTao Posted June 24, 2017 Posted June 24, 2017 yes i can mount, but also i use R-Studio for recovery files from dump, also i try to modify files and flash back again - but get error Quote
enderffx Posted June 24, 2017 Posted June 24, 2017 Oh crap, as i am a newbie i can not guess why that happens. DO you have hope of getting it to work ? (And please if you can, share which EMMC Interface you use and where good soldering points are). Greetings, Nils Quote
MingTao Posted June 24, 2017 Posted June 24, 2017 i dont use testpoints for EMMC - just hemoved from board , then reboll and use flasher(programmer) for reading this memory Quote
enderffx Posted June 24, 2017 Posted June 24, 2017 Wow, great work and beyond my capabilties, Well done ! Ionly have a crappy reflow workstation ;-) Ender Quote
kariem112 Posted June 25, 2017 Posted June 25, 2017 I have seen on twitter (https://twitter.com/TheDJIProblem) that someone changed the DJI Assistant 2 software so that he could write parameters directly to the drone.. .. It might be possible to enable adb there? Quote
Opcode Posted June 25, 2017 Posted June 25, 2017 Yes, i think Assistant 2 is the way to go. The Tool from Coptersafe is using the exactly same driver set (ADB etc), that are included in the Assistant 2 Installation. As the Tool is only provided for Windows and im only having a old XP Machine "in stock", i couldnt investigate further. Quote
enderffx Posted June 25, 2017 Posted June 25, 2017 Oh god huo much i hate Twitter :-) But thanks for the link. Those guys are also really onto the matter. I saw them referring to POV, but unluckily he went under the surface sooan after the famous FW root Thread weas deleted on MavicPilots. I had limited contact to him.Did you really grok how the patches DJI_A to write stuff ? I saw the command hightlighted but i have the opinopn thats the patched SDK they were refering to ? Greetings, Ender Quote
enderffx Posted June 25, 2017 Posted June 25, 2017 8 minutes ago, Opcode said: Yes, i think Assistant 2 is the way to go. The Tool from Coptersafe is using the exactly same driver set (ADB etc), that are included in the Assistant 2 Installation. As the Tool is only provided for Windows and im only having a old XP Machine "in stock", i couldnt investigate further. Okay... how about a W7 VM ? For comfort you could use this one, DJI Assistant already installed: http://mavicpilots.com/threads/i-created-a-vm-so-we-can-all-forever-downgrade-to-400.16619/page-26#post-231468 First link, about 5gb Ender Quote
singlag Posted June 25, 2017 Posted June 25, 2017 10 hours ago, kariem112 said: I have seen on twitter (https://twitter.com/TheDJIProblem) that someone changed the DJI Assistant 2 software so that he could write parameters directly to the drone.. .. It might be possible to enable adb there? https://github.com/droner69/MavicPro more about dji assistant 2 debug/factory menu anyone know how to enable it ? by the way, mavproxyuser have provide python code to send/read parameters to drone, but it only allow to set thing with defined "range" such as limit height, only allow to set 20 to 500 but you can set more than 500meter from dji assistant hidden menu Quote
Freaky123 Posted June 25, 2017 Posted June 25, 2017 Has someone already figured out the JTAG of the FC chip(which is next to the sd-card)? Because I'm really interested in that one, since I have encrypted firmware of both the loader and the fc, but wanna see if it is possible to decrypt them through JTAG. Quote
martinbogo Posted June 25, 2017 Posted June 25, 2017 @freaky123 DJI has disabled JTAG just about everywhere they can. I did a boundary scan, and although I could find some devices responding, I wasn't able to do any debugging. There is absolutely no response from the Leadcore ARM chip, for example. Quote
Freaky123 Posted June 25, 2017 Posted June 25, 2017 @martinbogo On the LC I know from the bootloader that they indeed disabled JTAG. But I think that for the FC chip I know a way of enabling it, thus wanted to know if someone knows the pinout. Which devices did respond? Quote
martinbogo Posted June 25, 2017 Posted June 25, 2017 @freaky123 eMMC, Intel ma2100A vision processing, ed87458kb RF chip ( SDR!!! ) and Leadcore LC1160 power manager Couldn't get the Ambarella camera chip or the Ambarella memory to say hello, or the Leadcore CPU and it's associated memory Quote
Freaky123 Posted June 25, 2017 Posted June 25, 2017 Ok that is not that much, but I think for example that the FC has a separate jtag bus, since it is on another pcb. So hope to find that pinout somehow, maybe be desoldering the chip and then following the traces etc. Quote
martinbogo Posted June 25, 2017 Posted June 25, 2017 @freaky123 At this point, that's the way I'm going. There is someone that has already done a LOT of work already with both the Mavic and P4 series: If you aren't familiar with their work : https://twitter.com/TheDJIProblem It's a great step up, and there's plenty of code dumps, variable dumps, JSON examples, etc. -Martin Quote
MavproxyUser Posted June 27, 2017 Posted June 27, 2017 On 6/24/2017 at 1:44 PM, MingTao said: i sold to test point . but after 5-7 second after start . uart disable... and connection is closed. Can you show us the test points that you have soldered on to? Quote
MavproxyUser Posted June 27, 2017 Posted June 27, 2017 On 6/25/2017 at 10:40 AM, singlag said: https://github.com/droner69/MavicPro more about dji assistant 2 debug/factory menu anyone know how to enable it ? by the way, mavproxyuser have provide python code to send/read parameters to drone, but it only allow to set thing with defined "range" such as limit height, only allow to set 20 to 500 but you can set more than 500meter from dji assistant hidden menu Stop by and see us on this thread if you are bored... we are trying to keep the conversation heated up and on topic! Too many folks deviating and using speculation too drive their typing. We want to get back to *real* progress. Quote
MavproxyUser Posted June 27, 2017 Posted June 27, 2017 On 6/25/2017 at 1:38 PM, martinbogo said: @freaky123 DJI has disabled JTAG just about everywhere they can. I did a boundary scan, and although I could find some devices responding, I wasn't able to do any debugging. There is absolutely no response from the Leadcore ARM chip, for example. Do you care to share the pinouts? There are at times glitching techniques and other errata that make certain parts of chip memory accessible, etc depending on the chip. Quote
MavproxyUser Posted June 27, 2017 Posted June 27, 2017 On 6/24/2017 at 11:41 PM, kariem112 said: I have seen on twitter (https://twitter.com/TheDJIProblem) that someone changed the DJI Assistant 2 software so that he could write parameters directly to the drone.. .. It might be possible to enable adb there? As a heads up TheDJIProblem on Twitter == MavProxyUser on GitHub. He is I and I am him... slim with my tilted brim. Quote
kariem112 Posted June 27, 2017 Posted June 27, 2017 1 hour ago, MavproxyUser said: As a heads up TheDJIProblem on Twitter == MavProxyUser on GitHub. He is I and I am him... slim with my tilted brim. Quote
thatdumbdronie Posted June 27, 2017 Posted June 27, 2017 I have a FULL Unlock coptersafe programme. NFZ , altitude, sport. if there is any way I can help let me know, send me an inbox Asap. I'm not very good with all this jibbery jabbery talk .. but if theres programmes or something I can run to store any info whilst I use it to jailbreak my mav.. and then send u files or what not let me know Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.