Successful Rooting of Rm500 (also known as the smart controller)

[brett8883]

The smart controller is the only device that can take the video feed from a set of DJI HD fpv goggles and video out via hdmi. Its a function of the rom/device itself not the app.
The only other way for someone else to view the feed live is another set of goggles in spectator mode.
Currently there are guys spending 750$ for a SC that they have no other use for. It can't even be used as a controller. Just a monitor and or relay to a bigger monitor.

Ah ok.

 

[Remote Pilots Australia]

The smart controller is the only device that can take the video feed from a set of DJI HD fpv goggles and video out via hdmi. Its a function of the rom/device itself not the app.
The only other way for someone else to view the feed live is another set of goggles in spectator mode.
Currently there are guys spending 750$ for a SC that they have no other use for. It can't even be used as a controller. Just a monitor and or relay to a bigger monitor.

Now that’s something I didn’t know and very interesting. Still, it’s a damned expensive video adapter.

I’d be more impressed if it had a CPU/GPU that wasn’t 5 years obsolete when it was first released, double the RAM, a version of Android that was semi up to date and cleanly ported and could be relied upon to run the Go4 app even 90% as stably as my IOS devices without having to perform black magic and could run Litchi with a smooth video feed. Like everyone following this thread I’d love to see someone root and port another ROM to it but I honestly doubt it has the grunt to do much with it if they

I really didn’t want this to sound like a Smart Controller hate post. I so desperately want to like mine. The screen is great, it feels perfect in the hand .... the whole thing is just a prime example of a “what could have been” scenario.

If someone does manage to “root and rom” for an improved experience sign me up as a tester, or if DJI release a version with a good 8 core cpu and 6+ GB of RAM and at least Android 10 I’d pay even more than the $1100 Au they charge for this one out here. Until then, I’ll use mine when I can, I’ll even try this suggestion with my goggles and the HDMI feed as it sounds neat .. but my iPad mini 5 and standard controller are always going to be near to hand when it is a work job.

Regards

Ari

 

[KelvinFPV]

Now that’s something I didn’t know and very interesting. Still, it’s a damned expensive video adapter.

I’d be more impressed if it had a CPU/GPU that wasn’t 5 years obsolete when it was first released, double the RAM, a version of Android that was semi up to date and cleanly ported and could be relied upon to run the Go4 app even 90% as stably as my IOS devices without having to perform black magic and could run Litchi with a smooth video feed. Like everyone following this thread I’d love to see someone root and port another ROM to it but I honestly doubt it has the grunt to do much with it if they

I really didn’t want this to sound like a Smart Controller hate post. I so desperately want to like mine. The screen is great, it feels perfect in the hand .... the whole thing is just a prime example of a “what could have been” scenario.

If someone does manage to “root and rom” for an improved experience sign me up as a tester, or if DJI release a version with a good 8 core cpu and 6+ GB of RAM and at least Android 10 I’d pay even more than the $1100 Au they charge for this one out here. Until then, I’ll use mine when I can, I’ll even try this suggestion with my goggles and the HDMI feed as it sounds neat .. but my iPad mini 5 and standard controller are always going to be near to hand when it is a work job.

Regards

Ari

The goggles im referring to are the ones used on miniquads not dji drones.

 

[Remote Pilots Australia]

The goggles im referring to are the ones used on miniquads not dji drones.

Yes sir. Assumed as much.

 

[BillthefnW]

Before I reply to that let me describe the root process I used first:
Warning:As I quote from FORUM.XDA-DEVELOPERS:
"Your warranty is now void. I'm not responsible for bricked devices, dead SD cards,thermonuclear war, or you getting fired because the alarm app failed. Please do some research if you have any concerns re this,YOU are choosing to make these modifications"
1. Download and Install KingoRoot to PC.
2. Install the apk file of KingoRoot and install on RC.
3. Download Android SDK Platform for windows from-Tools: SDK Platform Tools release notes | Android Developers or Minimal ADB & Fastboot: StackPath...
4. Go to TWRP Website: Devices, download the Official TWRP App: me.twrp.twrpapp-26.apk from this link : No Play Store? Download the latest version here and install TWRP on the RC.
5. Enable developer mode on RC and enable USB debugging.
6. Connect device to PC via the USB C cable.
7. Open the folder of "Kingo ROOT", open "tools"
8 Open Powershell or a cmd window here.
9. Run the command: adb devices
10. If it shows a serial number, your device is recognized and you can continue with the process. Otherwise, ensure you’ve performed the above steps correctly.
11. Boot RC into bootloader mode using the following command:adb reboot bootloader
12. Once the RC is in bootloader mode, issue the following command to unlock bootloader: fastboot flashing unlock OR fastboot oem unlock
13. You will get a confirmation screen on your device, press confirm button on the RC. This will begin the bootloader unlocking process
14. Once the bootloader is unlocked the RC will reboot into bootloader mode, then boot it into system using the command:fastboot reboot
15. During reboot, it will go through a factory reset and then finally boot into system.
16. Root RC with KingoRoot app. An app called Kingo Link will appear after successful root. Confirm root with TWRP.
17. Flash TWRP recovery.
18. Done.
Google play services are now activated.
NOW THE ISSUES
1. Root is lost as soon as the RC is switched off. In the absence of OEM unlock Switch in developer options this becomes really onerous.
2. No custom ROMS incl Groovy Android, Resurrection Remix, LineageOS, NutOS, Omni, Oxygen work.
3. RM500 is used by Xiaomi in some of their devices. In fact if you check the RC out with XiaoMiTool - Change rom to your Xiaomi device easily!
it will show bootloader status, availability of custom ROMs etc. all of which are locked down.
SOME INTERESTING FEATURES OPERATING THE RC WITH ROOT
1. Of course all google services operate incl apps on google play incl Litchi, HDSync etc.
2. Transmitting power seems to be boosted which I'm trying to understand.
3. No change in DJIgo app but the RC is definitely curbed down in its abilities.

So more work needs to be done. I documented some of the features that I discovered so more minds can work on this.
DJI probably is going to release an update in future as it says that the RC will be compatible with future DJI ACs.

I found a link for Xiaomi device bootloader unlocks. Seems Xiaomi released the tool themselves, and changed their policy to allow consumer to do so. Here’s the link to the page:
https://c.mi.com/thread-1635834-1-1.html. Seems makes custom ROMS an available option.

I haven’t tried it yet, but getting closer to do so, all the time.

 

[robinbanks]

Any news? It's been 5 months since we had an update

 

[amstar]

Any news? It's been 5 months since we had an update

Since the couple of firmware updates and increased compatibility with other models, the best way to use the SC is to install the google framework and services so that you can download whichever app you want to download incl Litchi from the android App Store. For transmission boost you can easily do that with an app downloaded from dji.retroroms.com upto 1.5w. I’ve had no dropouts in image transmission or quality using this without any other modifications at 8000m.

 

[Daniil Zobov]

View attachment 69399View attachment 69400

So it appears to be clearer why none of the root solutions work. A bit more light comes into the inner workings of the SC due to some combination of multiple root methods and behavior of devices similar to rm500 and it seems that root permissions are granted on a per app basis. It’s a work in progress as a lot of writing is in Chinese. Boot loading pretty much is initiation of DJIgo, google play and services are disabled and so are random apps depending on the whether the architecture will support or not. This now gives a good picture of what DJI has envisioned of the “smart controller”. A stripped down android tab designed around the Go4 app driven by an Arm cortex processor similar to the Amazon Fire HD built around the Amazon market place.
I have unlocked the boot loader and root permissions are basically a yes or no option.
It has a whole bunch of Chinese social media apps pop up like We Chat etc and ads for more.
As of now appears to be designed for running the go4 app and that’s pretty much it, rooted or not.

Hello!
i'm trying to patch via magisk boot.img, but fastboot shows error when i'm trying to flash patched boot.img.

What i'm doing wrong?

 

[gmaninthesky]

Try Measure Ground Control (MGC) on Android for free from the Amazon App Store that works on the DJI Smart Controller (SC) without Google Play Services.

Amazon AppStore Install: The Amazon App

MGC within Amazon AppStore: Amazon.com: Measure Ground Control : Apps & Games

Instructions on Installing MGC on SC: How to Install Measure Ground Control onto a DJI Smart Controller or CrystalSky

MGC on the SC supports the Mavic 2 Pro, Matrice 300 and other aircraft that can be linked to the SC. MGC also supports the Crystal Sky with Cendence Controllers but not the DJI Monitor (used with P4P RTK). The MGC Android app uses Mapbox basemaps and Mapbox SDK vs Google basemap and SDK and has modifications to the DJI SDK implementation to allow for proper install to the SC from the Amazon Appstore with just a few clicks. MGC users have a choice of using mapbox or google maps in the apps settings when installing from the Google Play Store but does require the extended process of installing Google Play Services and self certifying the device with Google. See the install link above which details the google play install process on the SC.

The SC version of MGC will hit a small issue if attempting a US based LAANC authorization request near an airport using the deep link to the Airmap app which requires a special installer apk via https://s3.amazonaws.com/airmap-mobile/android/airmap.apk (access from SC to get apk). A workaround is to use the airmap app or another LAANC authorized app direct on the SC or via an alternate device to request flight authorization. For applying flight authorizations from DJI you can use the MGC app menu to perform DJI Flysafe Login and review apply unlocks to your connected aircraft from the embedded MGC airspace tool. Instructions on the process can be seen here Requesting and Applying GeoUnlock for DJI Drones and here for LAANC Requesting LAANC Authorization

Additionally, if you use the Google Sign in option in MGC on the SC, you will need to install the Opera browser from the Amazon AppStore and change the browser default to work around a new Google security change. The last tip for running 3rd party DJI flight apps on the SC is to set the flight app to not be battery optimized on the SC so it maximizes performance and doesn't die when battery reduces and device resource utilization increases. DJI did for the Go app that is pre-installed.

 

[servusli]

Before I reply to that let me describe the root process I used first:
Warning:As I quote from FORUM.XDA-DEVELOPERS:
"Your warranty is now void. I'm not responsible for bricked devices, dead SD cards,thermonuclear war, or you getting fired because the alarm app failed. Please do some research if you have any concerns re this,YOU are choosing to make these modifications"
1. Download and Install KingoRoot to PC.
2. Install the apk file of KingoRoot and install on RC.
3. Download Android SDK Platform for windows from-Tools: SDK Platform Tools release notes | Android Developers or Minimal ADB & Fastboot: StackPath...
4. Go to TWRP Website: Devices, download the Official TWRP App: me.twrp.twrpapp-26.apk from this link : No Play Store? Download the latest version here and install TWRP on the RC.
5. Enable developer mode on RC and enable USB debugging.
6. Connect device to PC via the USB C cable.
7. Open the folder of "Kingo ROOT", open "tools"
8 Open Powershell or a cmd window here.
9. Run the command: adb devices
10. If it shows a serial number, your device is recognized and you can continue with the process. Otherwise, ensure you’ve performed the above steps correctly.
11. Boot RC into bootloader mode using the following command:adb reboot bootloader
12. Once the RC is in bootloader mode, issue the following command to unlock bootloader: fastboot flashing unlock OR fastboot oem unlock
13. You will get a confirmation screen on your device, press confirm button on the RC. This will begin the bootloader unlocking process
14. Once the bootloader is unlocked the RC will reboot into bootloader mode, then boot it into system using the command:fastboot reboot
15. During reboot, it will go through a factory reset and then finally boot into system.
16. Root RC with KingoRoot app. An app called Kingo Link will appear after successful root. Confirm root with TWRP.
17. Flash TWRP recovery.
18. Done.
Google play services are now activated.
NOW THE ISSUES
1. Root is lost as soon as the RC is switched off. In the absence of OEM unlock Switch in developer options this becomes really onerous.
2. No custom ROMS incl Groovy Android, Resurrection Remix, LineageOS, NutOS, Omni, Oxygen work.
3. RM500 is used by Xiaomi in some of their devices. In fact if you check the RC out with XiaoMiTool - Change rom to your Xiaomi device easily!
it will show bootloader status, availability of custom ROMs etc. all of which are locked down.
SOME INTERESTING FEATURES OPERATING THE RC WITH ROOT
1. Of course all google services operate incl apps on google play incl Litchi, HDSync etc.
2. Transmitting power seems to be boosted which I'm trying to understand.
3. No change in DJIgo app but the RC is definitely curbed down in its abilities.

So more work needs to be done. I documented some of the features that I discovered so more minds can work on this.
DJI probably is going to release an update in future as it says that the RC will be compatible with future DJI ACs.

Hello
Rooting doesn't work for me. If I want to put the SC in bootloader mode, the display remains black and the SC is no longer responsive.

How can I root the SC?
Does it still work?

 

[devante]

I cannot get USB debugging to work. Smart Controller Firmware: v01.01.0064.
Developer options enabled, USB debugging enabled. ADB drivers installed, tested with another two android phones.
ADB devices does not show connected SC, authorize message on SC does not appear.

 

[bubuleur]

Hello
Rooting doesn't work for me. If I want to put the SC in bootloader mode, the display remains black and the SC is no longer responsive.

How can I root the SC?
Does it still work?

Hello,
I have the same problem as you the command turns off the smart controller how to give the other command?

 

[portrayu]

Before I reply to that let me describe the root process I used first:
Warning:As I quote from FORUM.XDA-DEVELOPERS:
"Your warranty is now void. I'm not responsible for bricked devices, dead SD cards,thermonuclear war, or you getting fired because the alarm app failed. Please do some research if you have any concerns re this,YOU are choosing to make these modifications"
1. Download and Install KingoRoot to PC.
2. Install the apk file of KingoRoot and install on RC.
3. Download Android SDK Platform for windows from-Tools: SDK Platform Tools release notes | Android Developers or Minimal ADB & Fastboot: StackPath...
4. Go to TWRP Website: Devices, download the Official TWRP App: me.twrp.twrpapp-26.apk from this link : No Play Store? Download the latest version here and install TWRP on the RC.
5. Enable developer mode on RC and enable USB debugging.
6. Connect device to PC via the USB C cable.
7. Open the folder of "Kingo ROOT", open "tools"
8 Open Powershell or a cmd window here.
9. Run the command: adb devices
10. If it shows a serial number, your device is recognized and you can continue with the process. Otherwise, ensure you’ve performed the above steps correctly.
11. Boot RC into bootloader mode using the following command:adb reboot bootloader
12. Once the RC is in bootloader mode, issue the following command to unlock bootloader: fastboot flashing unlock OR fastboot oem unlock
13. You will get a confirmation screen on your device, press confirm button on the RC. This will begin the bootloader unlocking process
14. Once the bootloader is unlocked the RC will reboot into bootloader mode, then boot it into system using the command:fastboot reboot
15. During reboot, it will go through a factory reset and then finally boot into system.
16. Root RC with KingoRoot app. An app called Kingo Link will appear after successful root. Confirm root with TWRP.
17. Flash TWRP recovery.
18. Done.
Google play services are now activated.
NOW THE ISSUES
1. Root is lost as soon as the RC is switched off. In the absence of OEM unlock Switch in developer options this becomes really onerous.
2. No custom ROMS incl Groovy Android, Resurrection Remix, LineageOS, NutOS, Omni, Oxygen work.
3. RM500 is used by Xiaomi in some of their devices. In fact if you check the RC out with XiaoMiTool - Change rom to your Xiaomi device easily!
it will show bootloader status, availability of custom ROMs etc. all of which are locked down.
SOME INTERESTING FEATURES OPERATING THE RC WITH ROOT
1. Of course all google services operate incl apps on google play incl Litchi, HDSync etc.
2. Transmitting power seems to be boosted which I'm trying to understand.
3. No change in DJIgo app but the RC is definitely curbed down in its abilities.

So more work needs to be done. I documented some of the features that I discovered so more minds can work on this.
DJI probably is going to release an update in future as it says that the RC will be compatible with future DJI ACs.

Any update on this process with latest firmware?

 

[Sappy]

Same here,
i coulnt get the SC into bootloader mode. I got an unknown device in device manager on Windows.
Anyone which driver needs to be installed?
Otherwise fastboot cant even recognize the device

 

[5ras]

Is there a procedure to downgrade a SC to an earlier version from the .bin file? I would like to downgrad go fly 4 to an earlier version. With go fly 5 for the mini this was quite easy, just the go 4 app refuses to downgrade, and deleting it via adb still does not allow installing an older .apk

 

[archaeo]

Is there a procedure to downgrade a SC to an earlier version from the .bin file? I would like to downgrad go fly 4 to an earlier version. With go fly 5 for the mini this was quite easy, just the go 4 app refuses to downgrade, and deleting it via adb still does not allow installing an older .apk

I have also been trying to downgrade the Go 4 app on my Rm500 to an earlier version as well. The hard reset on the Rm500 always brings it back to 4.3.54. I'm just trying to get it to 4.3.48 or earlier. Tried cloning, etc, but nothing works to get around the root blocking.

 

[sholihin]

View attachment 69399View attachment 69400

So it appears to be clearer why none of the root solutions work. A bit more light comes into the inner workings of the SC due to some combination of multiple root methods and behavior of devices similar to rm500 and it seems that root permissions are granted on a per app basis. It’s a work in progress as a lot of writing is in Chinese. Boot loading pretty much is initiation of DJIgo, google play and services are disabled and so are random apps depending on the whether the architecture will support or not. This now gives a good picture of what DJI has envisioned of the “smart controller”. A stripped down android tab designed around the Go4 app driven by an Arm cortex processor similar to the Amazon Fire HD built around the Amazon market place.
I have unlocked the boot loader and root permissions are basically a yes or no option.
It has a whole bunch of Chinese social media apps pop up like We Chat etc and ads for more.
As of now appears to be designed for running the go4 app and that’s pretty much it, rooted or not.

Hello, can you share the boot.img file? My RM500 using firmware version 01.01.0064 always fails to root.
I want to try using Magisk but need the boot.img file.