Fake NLD (FCC Mode + Boost)

AntDX316 · Oct 12, 2019

GadgetGuy said:
Only looking for NFZ and altitude removal on the M2. Already have FCC.
NLD offers NFZ removal on .100 FW but still no mountain climbing unlock.

What's a mountain climbing unlock? How do you FCC Boost the M2? I just did the P4PV2.0 and the frequency graph never looked better.

Go to 8:36 and look at the height limit and airport section. You can connect the M2 and the Spark to 1.1.2 and it would detect. I did this first on the Inspire 1 Pro (X3) with a firmware mod. I changed the vertical performance variables where I set 8 and -8. It pulls and descends awesome. When you change the height limit and airport section, tell me if it works.

Here is the 1.1.2 file and the instructions.

DJI 1.1.2 - Google Drive

drive.google.com

AntDX316 · Oct 13, 2019

GadgetGuy said:
Only looking for NFZ and altitude removal on the M2. Already have FCC.
NLD offers NFZ removal on .100 FW but still no mountain climbing unlock.

NLD isn't free and it doesn't work.

raven swe · Oct 13, 2019

Where you get that from, works fine for me and many others, if it didn't work for you maybe you weren't doing it right.

AntDX316 · Oct 13, 2019

raven swe said:
Where you get that from, works fine for me and many others, if it didn't work for you maybe you weren't doing it right.

They've updated the firmware lately. The boost is gone if you don't know.

raven swe · Oct 13, 2019

yep I do know and mine still works with the update, I only use fcc, didn't see much difference using boost, so not to stress sc I keep it at fcc.

AntDX316 · Oct 13, 2019

raven swe said:
yep I do know and mine still works with the update, I only use fcc, didn't see much difference using boost, so not to stress sc I keep it at fcc.

so you removed boost, put FCC, firmware updated and it's FCC instead of CE? you can potentially keep the boost mod if you had it installed prior to upgrading?

zappy54 · Oct 13, 2019

I to kept the FCC Mod which made a lot difference. the boost didn't make much difference

raven swe · Oct 13, 2019

yeah I know, but fcc works for what i want to use the drone for, better than ce, using boost in my view pushes the rf finals to ther limit so if I don't need it why use it

zappy54 · Oct 13, 2019

raven swe said:
yeah I know, but fcc works for want I use the drone for, better than ce, using boost in my view pushes the rf finals to ther limit so if I don't need it why use it

yes same here Thumbswayup

Shivers · Oct 13, 2019

Questions!!
So, I don’t see the M2Z support in this tool, yet some say they are using this?
Can you flash back to stock? In case you have a issue and needs to be sent back to DJI, is it possible to flash back!? And will they know?
Has anyone done this yet?
Thanks!

What is stealth mode? Or mountain climb mode? Lolol.

Shivers · Oct 13, 2019

Yup, I agree... my apologies. Got excited... search.

brett8883 · Oct 13, 2019

I don’t work for NLD and I haven’t used their paid service but I do know those guys and know how all the mods originated. If you have issues with it you should contact their support.

AntDX316 said:
What's a mountain climbing unlock? How do you FCC Boost the M2? I just did the P4PV2.0 and the frequency graph never looked better.

Go to 8:36 and look at the height limit and airport section. You can connect the M2 and the Spark to 1.1.2 and it would detect. I did this first on the Inspire 1 Pro (X3) with a firmware mod. I changed the vertical performance variables where I set 8 and -8. It pulls and descends awesome. When you change the height limit and airport section, tell me if it works.

Here is the 1.1.2 file and the instructions.

DJI 1.1.2 - Google Drive

drive.google.com

If only it was that easy. The M2 has those parameters locked out as well. With Super-Patcher I was able to modify the locked parameters in the actual firmware itself. Instead of locking it to 500m I changed this code in the firmware to be unlimited.

Unfortunately DJI is using a ARM chip in the M2s that has safezone. Safezone is an encrypted partition on the chip. It isn’t just encrypted but the encryption key is actually burned INTO the chip’s hardware. If you try to flash a custom firmware to the m2 to the unencrypted partition it will ask the encrypted partition to sign the new firmware. Because we don’t have access to this part of the drone it will not sign the new firmware and the firmware update will fail. It’s like a catch 22. You need the encryption key to get the encryption key which we don’t have. Even wiping the chip clean won’t wipe the encrypted part of the chip and so it will not take an unsigned firmware. If you try to unsign an already signed firmware to modify it that will break the signature and then become unsigned in need of a signature and the catch 22 cycle starts over. This is a simplified explanation.

Super-Patcher won’t work on M2

AntDX316 · Oct 14, 2019

zappy54 said:
I to kept the FCC Mod which made a lot difference. the boost didn't make much difference

so you boosted to 1.8W and it made no real difference to FCC? You upgraded to .510 and the FCC mod remained?

AntDX316 · Oct 14, 2019

brett8883 said:
I don’t work for NLD and I haven’t used their paid service but I do know those guys and know how all the mods originated. If you have issues with it you should contact their support.

If only it was that easy. The M2 has those parameters locked out as well. With Super-Patcher I was able to modify the locked parameters in the actual firmware itself. Instead of locking it to 500m I changed this code in the firmware to be unlimited.

Unfortunately DJI is using a ARM chip in the M2s that has safezone. Safezone is an encrypted partition on the chip. It isn’t just encrypted but the encryption key is actually burned INTO the chip’s hardware. If you try to flash a custom firmware to the m2 to the unencrypted partition it will ask the encrypted partition to sign the new firmware. Because we don’t have access to this part of the drone it will not sign the new firmware and the firmware update will fail. It’s like a catch 22. You need the encryption key to get the encryption key which we don’t have. Even wiping the chip clean won’t wipe the encrypted part of the chip and so it will not take an unsigned firmware. If you try to unsign an already signed firmware to modify it that will break the signature and then become unsigned in need of a signature and the catch 22 cycle starts over. This is a simplified explanation.

Super-Patcher won’t work on M2

You cannot mod the parameters with NLD on .510 anymore?

zappy54 · Oct 14, 2019

AntDX316 said:
so you boosted to 1.8W and it made no real difference to FCC? You upgraded to .510 and the FCC mod remained?

yes

AntDX316 · Oct 14, 2019

zappy54 said:
yes

What was your maximum range with FCC Boost and maximum with FCC no boost?

GadgetGuy · Oct 14, 2019

brett8883 said:
Super-Patcher won’t work on M2

The M2 has those parameters locked out as well. With Super-Patcher I was able to modify the locked parameters in the actual firmware itself. Instead of locking it to 500m I changed this code in the firmware to be unlimited.

Unfortunately DJI is using a ARM chip in the M2s that has safezone. Safezone is an encrypted partition on the chip. It isn’t just encrypted but the encryption key is actually burned INTO the chip’s hardware. If you try to flash a custom firmware to the m2 to the unencrypted partition it will ask the encrypted partition to sign the new firmware. Because we don’t have access to this part of the drone it will not sign the new firmware and the firmware update will fail. It’s like a catch 22. You need the encryption key to get the encryption key which we don’t have. Even wiping the chip clean won’t wipe the encrypted part of the chip and so it will not take an unsigned firmware. If you try to unsign an already signed firmware to modify it that will break the signature and then become unsigned in need of a signature and the catch 22 cycle starts over. This is a simplified explanation.

Thanks for confirming my understanding. It doesn't sound like Super-Patcher will work on the M2 any time soon, if ever. For those that need M2 mods, currently NLD is the only solution, and only under older FW, and only if you have never installed the DJI anti-rollback Trojan Horse, that was recently embedded into the .400 update.

Mountain climbing, for those unfamiliar with it, is exceeding the 500m max altitude limit, while legally climbing up a mountainside slope to reach the summit, and fly over the top of it, to see the other side. EVO will do 800m, but even that is usually not enough. Currently, only the P4 series and MP series are capable of modification to enable mountain climbing, but not the M2.