Successful Rooting of Rm500 (also known as the smart controller)

[amstar]

It’s been a bit long. A combination of Kingo Root + adb shell and fast boot oem unlock + custom recovery and guess work.
Details coming after more testing. It will reset the device but seems to be for the better.

 

[amstar]

It’s been a bit long. A combination of Kingo Root + adb shell and fast boot oem unlock + custom recovery and guess work.
Details coming after more testing.

This will reset the device but actually seems to be better. It seems that the RC is boosted as the signal strength is way better. Need to get some official numbers means extra equipment. Man how do you keep spending on this.

$700 for a android locked bootloader running only dji go with reduced range. Only this company can manage this. Shameless is the word that comes to mind.

Can anyone even imagine an android RC (don’t mind customized, not expecting nexus style) with unlocked bootloader, innately boosted, App Store compatible from DJI @ $700?

 

[brett8883]

It’s been a bit long. A combination of Kingo Root + adb shell and fast boot oem unlock + custom recovery and guess work.
Details coming after more testing. It will reset the device but seems to be for the better.

Nice work! When you upload the steps we can award you the most valuable hack of the year award.

Excellent work my friend!

 

[DebianDog]

Oh nice!

This thing is screaming for a custom ROM

 

[ehenderson410]

I know a little bit about a whole lot, a whole lot about a little, and everything about nothing, and maybe this is a stupid question, but will this open up the possibility of using this with the mavic 1? Probably not, right?

 

[ehenderson410]

Oh nice!

This thing is screaming for a custom ROM

And yeah, what he said

 

[paulatkin73]

This will reset the device but actually seems to be better. It seems that the RC is boosted as the signal strength is way better. Need to get some official numbers means extra equipment. Man how do you keep spending on this.

$700 for a android locked bootloader running only dji go with reduced range. Only this company can manage this. Shameless is the word that comes to mind.

Can anyone even imagine an android RC (don’t mind customized, not expecting nexus style) with unlocked bootloader, innately boosted, App Store compatible from DJI @ $700?

hi, how do you explain difference in the radio output if the android device itself is rooted? that sounds odd.

but, what is more important - did you try to run a regular litchi app after rooting - does it communicate with the RC after that - when you power up the drone? or still does not?

 

[amstar]

It does. All android apps need google play store permissions to run. If play store app does not open and google services do not run, third party apps do not run properly.
The difference in radio output is from from my anecdotal observations at the strength of the signal before and after.
Previously with the topography that I fly in where there are hills and quite a bit of radio interference from high cell towers I could only go 2-2.5 miles before the signal would start to cut out. Now, yesterday I flew about 4.5 miles before I had to turn around more because of the battery. The RC became warm, there was active cooling, seems Iike a fan or something inside etc. behaving like a boosted device.
The only issue is that the root doesn’t seem to be holding and the boot loader becomes locked again. Adb and fastboot oem unlocking is mostly a thing of the past and there are better methods like magisk but a lack of oem unlock in developer options with lack of a custom ROM compatible with this tapped down weird version of Nougat makes rooting and customization particularly difficult in this case.
You can actually test this RC with the Xiaomi Mi tool.


I think DJI may soon push out an update but meanwhile I’m testing more stable options.

 

[Paradigm]

I'm rather new to this, so I'm trying to understand what happened.

You "rooted" the DJI Smart Controller, meaning you gained access to the system underneath the software that you're normally locked to. It's essentially an Android device, e.g. an Android tablet that's set up to just run the DJI Go (or similar app.)

You did this and now your drone flies nearly 2X as much? You did not change any parameters other than just getting access to the OS underneath?

Why would just gaining that type of access boost your range? Intuition would lead me to believe you'd have to change parameters, perhaps to increase power to the antenna/increase signal strength... I'm not sure here, I'm just shooting from the hip.

Does the device stay like that? Meaning you do this once and you will always have the increased range. Or do you have to do it each time you fly? Are there any other changes and unforeseen differences, such as not being able to update the Smart Controller or something?

Sorry for the millions of questions.

I'm getting more and more interested in such things, especially something like No Limit Dronez. The more I think about it the more I'm upset with DJI for not letting one at least turn off the nannies if they chose to.

 

[amstar]

Before I reply to that let me describe the root process I used first:
Warning:As I quote from FORUM.XDA-DEVELOPERS:
"Your warranty is now void. I'm not responsible for bricked devices, dead SD cards,thermonuclear war, or you getting fired because the alarm app failed. Please do some research if you have any concerns re this,YOU are choosing to make these modifications"
1. Download and Install KingoRoot to PC.
2. Install the apk file of KingoRoot and install on RC.
3. Download Android SDK Platform for windows from-Tools: SDK Platform Tools release notes | Android Developers or Minimal ADB & Fastboot: StackPath...
4. Go to TWRP Website: Devices, download the Official TWRP App: me.twrp.twrpapp-26.apk from this link : No Play Store? Download the latest version here and install TWRP on the RC.
5. Enable developer mode on RC and enable USB debugging.
6. Connect device to PC via the USB C cable.
7. Open the folder of "Kingo ROOT", open "tools"
8 Open Powershell or a cmd window here.
9. Run the command: adb devices
10. If it shows a serial number, your device is recognized and you can continue with the process. Otherwise, ensure you’ve performed the above steps correctly.
11. Boot RC into bootloader mode using the following command:adb reboot bootloader
12. Once the RC is in bootloader mode, issue the following command to unlock bootloader: fastboot flashing unlock OR fastboot oem unlock
13. You will get a confirmation screen on your device, press confirm button on the RC. This will begin the bootloader unlocking process
14. Once the bootloader is unlocked the RC will reboot into bootloader mode, then boot it into system using the command:fastboot reboot
15. During reboot, it will go through a factory reset and then finally boot into system.
16. Root RC with KingoRoot app. An app called Kingo Link will appear after successful root. Confirm root with TWRP.
17. Flash TWRP recovery.
18. Done.
Google play services are now activated.
NOW THE ISSUES
1. Root is lost as soon as the RC is switched off. In the absence of OEM unlock Switch in developer options this becomes really onerous.
2. No custom ROMS incl Groovy Android, Resurrection Remix, LineageOS, NutOS, Omni, Oxygen work.
3. RM500 is used by Xiaomi in some of their devices. In fact if you check the RC out with XiaoMiTool - Change rom to your Xiaomi device easily!
it will show bootloader status, availability of custom ROMs etc. all of which are locked down.
SOME INTERESTING FEATURES OPERATING THE RC WITH ROOT
1. Of course all google services operate incl apps on google play incl Litchi, HDSync etc.
2. Transmitting power seems to be boosted which I'm trying to understand.
3. No change in DJIgo app but the RC is definitely curbed down in its abilities.

So more work needs to be done. I documented some of the features that I discovered so more minds can work on this.
DJI probably is going to release an update in future as it says that the RC will be compatible with future DJI ACs.

 

[DebianDog]

You did this and now your drone flies nearly 2X as much? You did not change any parameters other than just getting access to the OS underneath?

I was a bit confused too at first but it is the "DJI Force Boost" app that does it. I downloaded the APK but I think it needs root to make the controller non-FCC complaint with its signal. Honestly did not want to mess with it as I have enough hobbies right now. But it looks like it runs the radio at 1.5 Watts by altering files in \Android\data\dji.go.v4\files

 

[paulatkin73]

so, together with the 'DJI force boost' - does it essentially replace the whole API that is used to communicate with the radio? and everything still works after that?
it is very interesting and, frankly, incredibly annoying, if so.

as the reason for litchi not to work on the SC, from what was communicated before, was the necessity to use a new API in order for SC to function. if all that was a total BS - then, well, i dunno what to think.

 

[amstar]

Litchi does not work with the SC in its native state because google play and services have been rendered incompatible in the DJI ROM.

 

[Greg6032]

Litchi does not work with the SC in its native state because google play and services have been rendered incompatible in the DJI ROM.

Hi

You are not right
You can install Litchi from Amazon AppStore
It is was specially made for CS monitor
Witch run Android 5.1 and do not support
Google play
I think Litchi can not work on Smart controller
Not because some hardware configuration
But because it is do not have permission
To communicate with hardware
Same problem with DJI pilot app
To run this programs correct they need to have full access to hardware but for some reason
DJI do not want allow this

 

[Giftedone]

Before I reply to that let me describe the root process I used first:
Warning:As I quote from FORUM.XDA-DEVELOPERS:
"Your warranty is now void. I'm not responsible for bricked devices, dead SD cards,thermonuclear war, or you getting fired because the alarm app failed. Please do some research if you have any concerns re this,YOU are choosing to make these modifications"
1. Download and Install KingoRoot to PC.
2. Install the apk file of KingoRoot and install on RC.
3. Download Android SDK Platform for windows from-Tools: SDK Platform Tools release notes | Android Developers or Minimal ADB & Fastboot: StackPath...
4. Go to TWRP Website: Devices, download the Official TWRP App: me.twrp.twrpapp-26.apk from this link : No Play Store? Download the latest version here and install TWRP on the RC.
5. Enable developer mode on RC and enable USB debugging.
6. Connect device to PC via the USB C cable.
7. Open the folder of "Kingo ROOT", open "tools"
8 Open Powershell or a cmd window here.
9. Run the command: adb devices
10. If it shows a serial number, your device is recognized and you can continue with the process. Otherwise, ensure you’ve performed the above steps correctly.
11. Boot RC into bootloader mode using the following command:adb reboot bootloader
12. Once the RC is in bootloader mode, issue the following command to unlock bootloader: fastboot flashing unlock OR fastboot oem unlock
13. You will get a confirmation screen on your device, press confirm button on the RC. This will begin the bootloader unlocking process
14. Once the bootloader is unlocked the RC will reboot into bootloader mode, then boot it into system using the command:fastboot reboot
15. During reboot, it will go through a factory reset and then finally boot into system.
16. Root RC with KingoRoot app. An app called Kingo Link will appear after successful root. Confirm root with TWRP.
17. Flash TWRP recovery.
18. Done.
Google play services are now activated.
NOW THE ISSUES
1. Root is lost as soon as the RC is switched off. In the absence of OEM unlock Switch in developer options this becomes really onerous.
2. No custom ROMS incl Groovy Android, Resurrection Remix, LineageOS, NutOS, Omni, Oxygen work.
3. RM500 is used by Xiaomi in some of their devices. In fact if you check the RC out with XiaoMiTool - Change rom to your Xiaomi device easily!
it will show bootloader status, availability of custom ROMs etc. all of which are locked down.
SOME INTERESTING FEATURES OPERATING THE RC WITH ROOT
1. Of course all google services operate incl apps on google play incl Litchi, HDSync etc.
2. Transmitting power seems to be boosted which I'm trying to understand.
3. No change in DJIgo app but the RC is definitely curbed down in its abilities.

So more work needs to be done. I documented some of the features that I discovered so more minds can work on this.
DJI probably is going to release an update in future as it says that the RC will be compatible with future DJI ACs.

So if i understand this statement correct you have done it and it works wothout any problem. I bought a mavic 2 enterprise dual flymore combo with smartcontroller. I saw a video of german guy showcasing the dual with the smart controller and decided to get the same. To my dissmay i found the smart controller does not work on the dual. The supplier i bought it from did not mention anything that it will not work the idiot just wanted to make a sale. If you tell me rooting it works without issues that i do not need to worry about the warrantee i will do it. If you are not sure please let me know. My drone gets delivered tomorrow and if i cant use it i wanna return it for a refund. And if they do not wanna return it they gonna be **** sure i will make a scene. So please let me know if it works. I understand the whole excercise and will be abke to do it. But need to make sure.

 

[amstar]

It’s better you return it. The SC does not support M Enterprise as of now and there is no way to know if rooting will help as it only gains access to the base OS. What you have is a firmware incompatibility at present which has to fixed by rewriting code ie future updates.

 

[brett8883]

So if i understand this statement correct you have done it and it works wothout any problem. I bought a mavic 2 enterprise dual flymore combo with smartcontroller. I saw a video of german guy showcasing the dual with the smart controller and decided to get the same. To my dissmay i found the smart controller does not work on the dual. The supplier i bought it from did not mention anything that it will not work the idiot just wanted to make a sale. If you tell me rooting it works without issues that i do not need to worry about the warrantee i will do it. If you are not sure please let me know. My drone gets delivered tomorrow and if i cant use it i wanna return it for a refund. And if they do not wanna return it they gonna be **** sure i will make a scene. So please let me know if it works. I understand the whole excercise and will be abke to do it. But need to make sure.

Unfortunately rooting the device isn’t gonna solve that problem. I agree that you are best off returning it. It’s just like there’s no way to get the Mavic Pro Controller to control a Phantom 4 Pro v2 even though they both use Ocusync. The smart controller just isn’t compatable with the M2ED.

 

[brett8883]

Before I reply to that let me describe the root process I used first:
Warning:As I quote from FORUM.XDA-DEVELOPERS:
"Your warranty is now void. I'm not responsible for bricked devices, dead SD cards,thermonuclear war, or you getting fired because the alarm app failed. Please do some research if you have any concerns re this,YOU are choosing to make these modifications"
1. Download and Install KingoRoot to PC.
2. Install the apk file of KingoRoot and install on RC.
3. Download Android SDK Platform for windows from-Tools: SDK Platform Tools release notes | Android Developers or Minimal ADB & Fastboot: StackPath...
4. Go to TWRP Website: Devices, download the Official TWRP App: me.twrp.twrpapp-26.apk from this link : No Play Store? Download the latest version here and install TWRP on the RC.
5. Enable developer mode on RC and enable USB debugging.
6. Connect device to PC via the USB C cable.
7. Open the folder of "Kingo ROOT", open "tools"
8 Open Powershell or a cmd window here.
9. Run the command: adb devices
10. If it shows a serial number, your device is recognized and you can continue with the process. Otherwise, ensure you’ve performed the above steps correctly.
11. Boot RC into bootloader mode using the following command:adb reboot bootloader
12. Once the RC is in bootloader mode, issue the following command to unlock bootloader: fastboot flashing unlock OR fastboot oem unlock
13. You will get a confirmation screen on your device, press confirm button on the RC. This will begin the bootloader unlocking process
14. Once the bootloader is unlocked the RC will reboot into bootloader mode, then boot it into system using the command:fastboot reboot
15. During reboot, it will go through a factory reset and then finally boot into system.
16. Root RC with KingoRoot app. An app called Kingo Link will appear after successful root. Confirm root with TWRP.
17. Flash TWRP recovery.
18. Done.
Google play services are now activated.
NOW THE ISSUES
1. Root is lost as soon as the RC is switched off. In the absence of OEM unlock Switch in developer options this becomes really onerous.
2. No custom ROMS incl Groovy Android, Resurrection Remix, LineageOS, NutOS, Omni, Oxygen work.
3. RM500 is used by Xiaomi in some of their devices. In fact if you check the RC out with XiaoMiTool - Change rom to your Xiaomi device easily!
it will show bootloader status, availability of custom ROMs etc. all of which are locked down.
SOME INTERESTING FEATURES OPERATING THE RC WITH ROOT
1. Of course all google services operate incl apps on google play incl Litchi, HDSync etc.
2. Transmitting power seems to be boosted which I'm trying to understand.
3. No change in DJIgo app but the RC is definitely curbed down in its abilities.

So more work needs to be done. I documented some of the features that I discovered so more minds can work on this.
DJI probably is going to release an update in future as it says that the RC will be compatible with future DJI ACs.

Great work! And so will this root stick? I think you said earlier you were having trouble getting it stay rooted?

 

[RBDrones]

What would happen if you flashed magisk via twrp?

 

[brett8883]

What would happen if you flashed magisk via twrp?

If you figure it out NoLimitDronez is offering up to a $10,000 reward.