some guy doing an FCC hack permanent for RC pro Controller

[DAFlys]

The interesting thing is that adb "unauthorized device" appears only after the second RC restart. Probably, after the first restart with the fcc hack, some "cleaning" routine is also started, so after the second restart, the device is unauthorized.

I tracked down all the adb commands it runs abd have the files it copies. After the patching it deletes what it copies.

What I can’t figure out is getting the initial authorisation.

 

[Dmitry Sistor]

What I can’t figure out is getting the initial authorisation.

DUML commands

 

[edyno]

Yes, de facto it is copied to the device in to the tmp directory where the file fcc.tar is unpacked, its rights are set, run and finally deleted. Among other things, the ELF file modifies the target file "libDexHelper.so"
The adb authorization itself is still a mystery to me..

 

[edyno]

DUML commands

Dmitry, if you know which ones and are willing to share, just direct me. Alternatively, CMD_ID and PAYLOAD are enough for me

 

[Dmitry Sistor]

Dmitry, if you know which ones and are willing to share, just direct me. Alternatively, CMD_ID and PAYLOAD are enough for me

CMD_ID 226

 

[edyno]

CMD_ID 226

bingo, thank you Dmitry. At least I moved a bit in this mystery

 

[Dmitry Sistor]

bingo, thank you Dmitry. At least I moved a bit in this mystery

using Wireshark you can make a dump and find all the necessary commands in it

 

[edyno]

using Wireshark you can make a dump and find all the necessary commands in it

Excellent, thank you Dmitry for all the information. I will try to succeed

 

[NorbertG59]

We all know that by interchanging controllers ie: RC to R N1 you have to unbind and bind every time you want to use either Controller, my question is by unbinding controller do you lose hack or does it stay permanent?

 

[Berf]

I'm a bit concerned about this triggering virus software. Has anyone really investigated why this is happening. Is this software installing a trojan on your PC? Imagine the damage a keylogger could do if installed on your PC. All passwords become compromised.

I'd not install this until I knew more about WHY it is triggering virus programs. Some earlier posts indicate it may allow a haker(s) to remote into your PC, which is about the worst threat out there.

 

[edyno]

I'm a bit concerned about this triggering virus software. Has anyone really investigated why this is happening. Is this software installing a trojan on your PC? Imagine the damage a keylogger could do if installed on your PC. All passwords become compromised.

I'd not install this until I knew more about WHY it is triggering virus programs. Some earlier posts indicate it may allow a haker(s) to remote into your PC, which is about the worst threat out there.

It has already been clarified here in this forum in the past.

 

[Berf]

It has already been clarified here in this forum in the past.

Where?

 

[Berf]

The trojan contained is called Win32/Wacatac.H!ml... see here: Trojan:Win32/Wacatac.H!ml threat description - Microsoft Security Intelligence

It facilitates Remote Execution Attacks (effectively, it enables an attacker to gain access to an infected system, with the privileges to run whatever code they choose on the target.

I am still trawling through the system-level changes the executable made when run in the VM... and I'll let you all know if it is doing anything excessively malign... but, in the meantime, you definitely want to be careful (because Remote Execution Attacks are basically the highest-level risk you can possibly expose your computers to)

You mean this reply, that indicates it enable remote execution attacks? Seems like this is a pretty dangerous trojan to me. I wouldn't run this on any PC of mine.

 

[edyno]

Where?

some guy doing an FCC hack permanent for RC pro Controller

That’s obviously because DAFly didn’t buy the hack from Sincoder. I did purchase it from Sincoder and he solved and addressed my issue very quickly. I’m sure it’s no coincidence that those who paid 75% more, are the people who are supporting the grifter. It’s almost like some bizarre form of...

mavicpilots.com

 

[DAFlys]

You mean this reply, that indicates it enable remote execution attacks? Seems like this is a pretty dangerous trojan to me. I wouldn't run this on any PC of mine.

Just run up a virtual machine and run it from there.

 

[Flashheart]

You mean this reply, that indicates it enable remote execution attacks? Seems like this is a pretty dangerous trojan to me. I wouldn't run this on any PC of mine.

The majority of antivirus vendors report this file as safe. I opened it in a Sandbox and could find nothing sinister.
I think the exploit used to gain access to the underlying Android OS on the DJI RC triggers a generic response from some antivirus vendors.

VirusTotal

 

[DAFlys]

We all know that by interchanging controllers ie: RC to R N1 you have to unbind and bind every time you want to use either Controller, my question is by unbinding controller do you lose hack or does it stay permanent?

Unbinding has no effect on the hack, only updating the firmware or a reset would remove it.

 

[NorbertG59]

Appreciated!

 

[DAFlys]

Anyone found with .0600 Installed and the hack installed that the max altitude is maxed out and can’t be reduced?

 

[NorbertG59]

Anyone found with .0600 Installed and the hack installed that the max altitude is maxed out and can’t be reduced?

Not that I tried or dream of trying but you will still get a warning in the Fly app when you reach 400 ft (120 m). If your limit is set to 500 m in DJI Fly App, and you climb past the 120m the app will keep showing you a warning.

I