some guy doing an FCC hack permanent for RC pro Controller

DAFlys · Apr 6, 2023

edyno said:
The interesting thing is that adb "unauthorized device" appears only after the second RC restart. Probably, after the first restart with the fcc hack, some "cleaning" routine is also started, so after the second restart, the device is unauthorized.

I tracked down all the adb commands it runs abd have the files it copies. After the patching it deletes what it copies.

What I can’t figure out is getting the initial authorisation.

Dmitry Sistor · Apr 6, 2023

DAFlys said:
What I can’t figure out is getting the initial authorisation.

DUML commands

edyno · Apr 6, 2023

Yes, de facto it is copied to the device in to the tmp directory where the file fcc.tar is unpacked, its rights are set, run and finally deleted. Among other things, the ELF file modifies the target file "libDexHelper.so"
The adb authorization itself is still a mystery to me..

edyno · Apr 6, 2023

Dmitry Sistor said:
DUML commands

Dmitry, if you know which ones and are willing to share, just direct me. Alternatively, CMD_ID and PAYLOAD are enough for me

Dmitry Sistor · Apr 6, 2023

edyno said:
Dmitry, if you know which ones and are willing to share, just direct me. Alternatively, CMD_ID and PAYLOAD are enough for me

CMD_ID 226

edyno · Apr 6, 2023

Dmitry Sistor said:
CMD_ID 226

bingo, thank you Dmitry. At least I moved a bit in this mystery

Dmitry Sistor · Apr 6, 2023

edyno said:
bingo, thank you Dmitry. At least I moved a bit in this mystery

using Wireshark you can make a dump and find all the necessary commands in it

edyno · Apr 6, 2023

Dmitry Sistor said:
using Wireshark you can make a dump and find all the necessary commands in it

Excellent, thank you Dmitry for all the information. I will try to succeed

NorbertG59 · Apr 7, 2023

We all know that by interchanging controllers ie: RC to R N1 you have to unbind and bind every time you want to use either Controller, my question is by unbinding controller do you lose hack or does it stay permanent?

Berf · Apr 7, 2023

I'm a bit concerned about this triggering virus software. Has anyone really investigated why this is happening. Is this software installing a trojan on your PC? Imagine the damage a keylogger could do if installed on your PC. All passwords become compromised.

I'd not install this until I knew more about WHY it is triggering virus programs. Some earlier posts indicate it may allow a haker(s) to remote into your PC, which is about the worst threat out there.

edyno · Apr 7, 2023

Berf said:
I'm a bit concerned about this triggering virus software. Has anyone really investigated why this is happening. Is this software installing a trojan on your PC? Imagine the damage a keylogger could do if installed on your PC. All passwords become compromised.

I'd not install this until I knew more about WHY it is triggering virus programs. Some earlier posts indicate it may allow a haker(s) to remote into your PC, which is about the worst threat out there.

It has already been clarified here in this forum in the past.

Berf · Apr 7, 2023

edyno said:
It has already been clarified here in this forum in the past.

Where?

Berf · Apr 7, 2023

FlowDrone said:
The trojan contained is called Win32/Wacatac.H!ml... see here: Trojan:Win32/Wacatac.H!ml threat description - Microsoft Security Intelligence

It facilitates Remote Execution Attacks (effectively, it enables an attacker to gain access to an infected system, with the privileges to run whatever code they choose on the target.

I am still trawling through the system-level changes the executable made when run in the VM... and I'll let you all know if it is doing anything excessively malign... but, in the meantime, you definitely want to be careful (because Remote Execution Attacks are basically the highest-level risk you can possibly expose your computers to)

You mean this reply, that indicates it enable remote execution attacks? Seems like this is a pretty dangerous trojan to me. I wouldn't run this on any PC of mine.

edyno · Apr 7, 2023

Berf said:
Where?

some guy doing an FCC hack permanent for RC pro Controller

That’s obviously because DAFly didn’t buy the hack from Sincoder. I did purchase it from Sincoder and he solved and addressed my issue very quickly. I’m sure it’s no coincidence that those who paid 75% more, are the people who are supporting the grifter. It’s almost like some bizarre form of...

mavicpilots.com

DAFlys · Apr 9, 2023

Berf said:
You mean this reply, that indicates it enable remote execution attacks? Seems like this is a pretty dangerous trojan to me. I wouldn't run this on any PC of mine.

Just run up a virtual machine and run it from there.

Flashheart · Apr 9, 2023

Berf said:
You mean this reply, that indicates it enable remote execution attacks? Seems like this is a pretty dangerous trojan to me. I wouldn't run this on any PC of mine.

The majority of antivirus vendors report this file as safe. I opened it in a Sandbox and could find nothing sinister.
I think the exploit used to gain access to the underlying Android OS on the DJI RC triggers a generic response from some antivirus vendors.

VirusTotal

DAFlys · Apr 11, 2023

NorbertG59 said:
We all know that by interchanging controllers ie: RC to R N1 you have to unbind and bind every time you want to use either Controller, my question is by unbinding controller do you lose hack or does it stay permanent?

Unbinding has no effect on the hack, only updating the firmware or a reset would remove it.

NorbertG59 · Apr 11, 2023

Appreciated!

DAFlys · Apr 11, 2023

Anyone found with .0600 Installed and the hack installed that the max altitude is maxed out and can’t be reduced?

NorbertG59 · Apr 11, 2023

DAFlys said:
Anyone found with .0600 Installed and the hack installed that the max altitude is maxed out and can’t be reduced?

Not that I tried or dream of trying but you will still get a warning in the Fly app when you reach 400 ft (120 m). If your limit is set to 500 m in DJI Fly App, and you climb past the 120m the app will keep showing you a warning.

I