Low-Level Wifi Protocol Reverse Engineering

[Yoghurt]

Does that suggest that a talented software engineer could develop an app that could display the video stream from any DJI drone flying in the area?

I am a software engineer. That may answer your question. But to be fair, my scenario contains some major restrictions. Such as: No channel hopping and using the Drone in Wifi-Mode. Both isn't the default configuration.

 

[Yoghurt]

Here is the final camera-feed. It is as perfect as it can get. Enjoy

 

[RulyAtmaja]

Here is the final camera-feed. It is as perfect as it can get. Enjoy

link is broken,, btw any nice work

 

[JoelS]

I am using Dronelink to do automated flight plans. It is giving me an error that there is magnetic field interference on a regular basis. Dronelink said on the forum to just ignore the warnings. There is a problem with the DJI's SDK.

 

[JoelS]

I found Dji-Firmware-tools which do contain communication dissectors for DUML packets. Intermediate and final security research results will be posted on a private blog and may find its way into a thesis. Upon interest I can keep you guys posted.

Count me in. New to drone and this forum, not rc. >20 years, rc nitro helis, mostly. Long time member of Runryder forum, which folded due to Mark getting divorced. Trying to learn some programming, late in life. Hard road. Interested in SDK software, so this would be interesting for me.

 

[surfbird]

Project is on GitHub, but far from being complete.

Current features:

1. Automatic drone and operator detection
2. UDP traffic sniffing and tools to analyse the traffic, including live-filtering capabilities
3. Record flights and export them as *.pcap
4. Simulate previous flights by importing *.pcap files
5. Raw UDP to DUML protocol conversion, compatible with dissectors

Working on all relevant platforms. Tested on Windows and Linux.

Nice work!!

I've been reversing the protcol be decopile old sdk. They are not encrypted. You can actually send messages with the latest sdk, using the middle layer with obfuscated names. Then you can send whatever you like over occusync, the middle layer makes all coding for you

Did you get any futher with stick inputs over wifi? I havn't really understood if it's the same dumldore the RC uses or if it'
s specific commands when in wifi mode?