Mavic Pro flight controller ?

[musicwarez]

Anybody know which flight controller installed in Mavic Pro? I want build custom firmware and need know which source code use.

 

[Glasswalker]

You're not going to find any open-source firmware that compiles out of the box for the mavic.

I'm pretty sure it's an entirely proprietary FC, though based on ARM SOC, etc (multiple ARM processors if I remember correctly).

I believe someone else was reverse engineering the protocol somewhere on one of the forums.

The Mavic definitely runs Linux internally, as does the RC, they use a proprietary RF link (Occusync) to communicate with one another wirelessly. And it has many 100% custom drivers, and services that run on the Linux OS on-device which you'd need to be able to interface with the hardware.

As I said someone did reverse engineer some of it, and has for example dumped the firmware file, and been able to trigger boot mode on the drone to get it to give a hardware serial port (which was used to drop to a Linux commandline on the drone for example).

 

[musicwarez]

You're not going to find any open-source firmware that compiles out of the box for the mavic.

I'm pretty sure it's an entirely proprietary FC, though based on ARM SOC, etc (multiple ARM processors if I remember correctly).

I believe someone else was reverse engineering the protocol somewhere on one of the forums.

The Mavic definitely runs Linux internally, as does the RC, they use a proprietary RF link (Occusync) to communicate with one another wirelessly. And it has many 100% custom drivers, and services that run on the Linux OS on-device which you'd need to be able to interface with the hardware.

As I said someone did reverse engineer some of it, and has for example dumped the firmware file, and been able to trigger boot mode on the drone to get it to give a hardware serial port (which was used to drop to a Linux commandline on the drone for example).

Yes you right but not completely. I am already have source for DJI A3/N3 firmware. If Mavic has same architecture like DJI A3/N3 controllers this mean that it already hacked because it use ROS and Mavlink and this is open source projects If i will know exact controller I will find short way to jailbreak. Also I sure that I can connect to fly controller useing UART port on board with DJI service software.

I think I already know about reverse engineer post and I think that it is fantasies because all mavic firmware files encrypted. I have all this files and it useless. Encrypted binary files... On mavic board I found many different files and all they also encrypted

 

[Glasswalker]

Cool, that's very possible if it's using ROS/Mavlink. But I doubt if anyone has that info easily available yet

Why not give it a try yourself! If you can get to a point of connecting to a shell, you can likely poke around to discover more about what's there.

I'm personally going to be undertaking a similar project eventually, as I would really like to know if there is a way to access the DAT file logs from the drone itself, via the wireless link. (Obviously not through any official DJI API, but wondering if it's even possible lol...)

Would love to see how you do on this!

 

[musicwarez]

Cool, that's very possible if it's using ROS/Mavlink. But I doubt if anyone has that info easily available yet

Why not give it a try yourself! If you can get to a point of connecting to a shell, you can likely poke around to discover more about what's there.

I'm personally going to be undertaking a similar project eventually, as I would really like to know if there is a way to access the DAT file logs from the drone itself, via the wireless link. (Obviously not through any official DJI API, but wondering if it's even possible lol...)

Would love to see how you do on this!

Access is possible but absolutely meaningless because all files are encrypted by onboard core libs and you can not make any changes. First what we need to know on which level restrictions applied. After that we will decide how to solve it

 

[Mission North]

Adding ADS-B could be interesting. Unfortunately the aircraft that fly at low level around my home only show their altitude, not location. I am considering making a mobile ADS-B receiver that could warn me of low flyng aircraft based on the signal quality and altitude. Should be easy using a Raspberry Pi and SDR TV dongle.

 

[Glasswalker]

Access is possible but absolutely meaningless because all files are encrypted by onboard core libs and you can not make any changes. First what we need to know on which level restrictions applied. After that we will decide how to solve it

View attachment 9446

I'm not interested in changing anything about operation, I just want to grab the DAT file as-is so it could be processed in a file similar to datcon. Without needing to plug the mavic itself into a PC via USB (ie: I'd like to be able to do this after a flight easily, once I have WiFi, obviously not over the cell network as the data usage would be insane lol).

You say they are encrypted internally, but aren't they also encrypted once DJI Assist exports them? Or do you mean it's encrypted differently (ie: in a way that can not be decoded by known means?)

When you say it's accessible, what exactly do you mean? IE: if I were to write a custom mobile app on the phone that plugs into the RC, could I somehow tunnel through the RC to the drone in order to get to it's internal SSH (or some hidden API?)

Thanks!

 

[BudWalker]

The .DAT file on the Mavic (and several other DJI drones) isn't encrypted. It's encoded though. It's a distinction with a real difference. The encoding scheme is well understood and easily decoded. If it were encrypted in a serious way there would be no way to decrypt it.

The older versions of the DJI Assistant compress the .DAT; i.e. they don't encrypt the .DAT. If the .DAT is compressed then ExtractDJI can be used to decompress it. The newer versions of DJI Assistant don't compress the .DAT. In either case, the .DAT that exists on the Mavic is identical to the .DAT that is submitted to CsvView/DatCon.

 

[Glasswalker]

The .DAT file on the Mavic (and several other DJI drones) isn't encrypted. It's encoded though. It's a distinction with a real difference. The encoding scheme is well understood and easily decoded. If it were encrypted in a serious way there would be no way to decrypt it.

The older versions of the DJI Assistant compress the .DAT; i.e. they don't encrypt the .DAT. If the .DAT is compressed then ExtractDJI can be used to decompress it. The newer versions of DJI Assistant don't compress the .DAT. In either case, the .DAT that exists on the Mavic is identical to the .DAT that is submitted to CsvView/DatCon.

Hey BudWalker Thanks for the clarification. I haven't actually looked at the process for decoding the file yet. I had just heard others mention encryption (which I actually have quite a bit of experience with). My assumption was that if the controller on the aircraft is doing the encryption, then a private key of some kind is likely stored on the aircraft firmware, and I suspected someone had gotten their hands on that, in order to decrypt the files.

But yeah if it's not encrypted, and it's just some kind of binary encoding, that's pretty straightforward.

My main challenge, is I'd like a way to fetch the DAT files in a simpler way (not requiring the connection of the drone to a PC/Mac). So exploring what options there are. Upon finding out that both the RC and Aircraft run Linux, I had hoped there was some mechanism allowing me to connect over the Occusync link, but it appears it's not a "conventional" network interface. Doesn't mean it's impossible though, just need to better understand the system architecture of the RC/Aircraft/Mobile Device triad, and all appropriate communication paths.

 

[BudWalker]

....
My main challenge, is I'd like a way to fetch the DAT files in a simpler way (not requiring the connection of the drone to a PC/Mac). So exploring what options there are. Upon finding out that both the RC and Aircraft run Linux, I had hoped there was some mechanism allowing me to connect over the Occusync link, but it appears it's not a "conventional" network interface. Doesn't mean it's impossible though, just need to better understand the system architecture of the RC/Aircraft/Mobile Device triad, and all appropriate communication paths.

I saw that and would be interested to see if this is possible. You might want to check out
Hooking P3A to PC for more info.
I never did understand exactly what the procedure is, but he seems to be bypassing the necessity of the AC being in flight data mode to get at the internal .DAT. He still has to use a USB/PC connection, but maybe it's part way to the solution you're after.

 

[Glasswalker]

I saw that and would be interested to see if this is possible. You might want to check out
Hooking P3A to PC for more info.
I never did understand exactly what the procedure is, but he seems to be bypassing the necessity of the AC being in flight data mode to get at the internal .DAT. He still has to use a USB/PC connection, but maybe it's part way to the solution you're after.

Interesting! Thanks for the link!

 

[BudWalker]

@Glasswalker one other thing that might help. Back in November it was possible to access the .DAT files on the internal SD card directly without the use of the DJI Assistant. Then, and now, if the Mavic is connected via the USB you eventually get a disk show up on the PC that contains the external SD card; the one that contains the video files. Back in November the disk that would appear on the PC would sometimes be the internal SD card not the external SD card. Seemed like that would happen once every 15 or 20 attempts. I tried to determine if there was a specific sequence of events that caused this. But, I finally had to conclude it must be some random timing thing.

 

[Glasswalker]

Interesting, that's also good to know. That's fairly common for this type of embedded system (to have specific time windows where a detected connection results in using a different USB profile, and mounting up different storage, or enabling different options). This is likely made even more complex with the DJI drones due to the presence of multiple processors, etc.

I haven't had a lot of time to play with this project yet, but I'm still hoping there is a way that we can:
1 - From Mobile Device -> Tap into RC's Linux OS directly
2 - From Linux on RC -> Access wireless link
3 - Via Wireless link -> Access Linux OS on AC
4 - From AC Linux, directly access local storage to snag the DAT files

I suspect that steps 1, 2 and 4 are easy. It's 3 that is the big unknown...