Crowdfund hacker to build custom firmware?

Status
Not open for further replies.
Good luck trying to get an app to work with it on the IPhone. They sandbox that pretty tight and they don't like mods.

Some good features of a hacked firmware:

* No altitude limit
* Report on wind conditions aloft (wind speed; turbulence)
* Report on weather conditions aloft (Barametric pressure; temperature)
* NFZ zapper
* Blackbox (Onboard telemetry over every move like on an airplane.)
* Rig the speaker that plays the beeps on the P3 to be a speaker system that you can play your voice over using the microphone of you cell phone.
* Easier uploads to healthydrones.
* Bird hunter mode (Just kidding -- I think...)

I know some of these are rouge but hey -- so is hacked firmware.

Apps can be "modified" and side-loaded in iOS without jailbreaking the iOS device, really easily actually.
 
  • Like
Reactions: jimerb
DM36x initialization passed!
UBL Product Vesion : DJI-GRC-SUPER-UBL-1.0-rc0(2014-09-19)
Dji UBL Version: 1.51(Sep 19 2014 - 16:13:09)
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000019.
DONE
Jumping to entry point at 0x81080000.

U-Boot Product Vesion : DJI-GRC-Uboot-1.0-rc1(2015-01-27)
U-Boot 2010.12-rc2-svn-Dji (Jan 27 2015 - 18:45:11)
Cores: ARM 486 MHz
DDR: 360 MHz
I2C: ready
DRAM: 128 MiB
NAND: 128 MiB
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
*** Warning - bad CRC, using default environment

Net: Ethernet PHY: GENERIC @ 0xff
DaVinci-EMAC


Loading from nand0, offset 0x4a0000
Image Name: Linux-2.6.32.17-davinci1
Created: 2014-11-21 4:02:48 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4024480 Bytes = 3.8 MiB
Load Address: 80008000
Entry Point: 80008000
## Booting kernel from Legacy Image at 80700000 ...
Image Name: Linux-2.6.32.17-davinci1
Created: 2014-11-21 4:02:48 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4024480 Bytes = 3.8 MiB
Load Address: 80008000
Entry Point: 80008000
Loading Kernel Image ... OK
OK

Starting kernel ...

[ 0.000000] Kernel Product Vesion : DJI-GRC-Kernel-1.0-rc8(2014-11-21)
[ 0.000000] Linux version 2.6.32.17-davinci1 (root@dji) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #3 PREEMPT Fri Nov 21 12:02:46 HKT 2014
[ 0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
[ 0.000000] CPU: VIVT data cache, VIVT instruction cache
[ 0.000000] Machine: DaVinci DM36x EVM
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] DaVinci dm36x_rev1.2 variant 0x8
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping off. Total pages: 12192
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rw dm365_imp.oper_mode=0 video=davincifb:vid0=0,10K:vid1=0,10K:eek:sd0=1920x1080X16,8100K mem=48MB
davinci_enc_mngr.ch0_output=COMPOSITE davinci_enc_mngr.ch0_mode=pal ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs ip=off lpj=1077248
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Memory: 48MB = 48MB total
[ 0.000000] Memory: 44464KB available (3632K code, 444K data, 116K init, 0K highmem)
[ 0.000000] SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] NR_IRQS:245
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] Calibrating delay loop (skipped) preset value.. 215.44 BogoMIPS (lpj=1077248)
[ 0.000000] Mount-cache hash table entries: 512
[ 0.000000] CPU: Testing write buffer coherency: ok
[ 0.000000] DaVinci: 8 gpio irqs
[ 0.000000] NET: Registered protocol family 16
[ 0.090000] bio: create slab <bio-0> at 0
[ 0.100000] DM365 IPIPE initialized in Continuous mode
[ 0.100000] SCSI subsystem initialized
[ 0.100000] usbcore: registered new interface driver usbfs
[ 0.100000] usbcore: registered new interface driver hub
[ 0.100000] usbcore: registered new device driver usb
[ 0.110000] vpss vpss: dm365_vpss vpss probed
[ 0.110000] vpss vpss: dm365_vpss vpss probe success
[ 0.110000] ch0 default output "COMPOSITE", mode "PAL"
[ 0.110000] pinmux1:0x00145555
[ 0.110000] VPBE Encoder Initialized
[ 0.120000] cfg80211: Using static regulatory domain info
[ 0.120000] cfg80211: Regulatory domain: US
[ 0.120000] (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp )
[ 0.120000] (2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
[ 0.120000] (5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[ 0.120000] (5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[ 0.120000] (5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[ 0.120000] (5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
[ 0.120000] (5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
[ 0.120000] cfg80211: Calling CRDA for country: US
[ 0.120000] Switching to clocksource timer0_1
[ 0.120000] musb_hdrc: version 6.0, pio, host, debug=0
[ 0.140000] musb_hdrc: USB Host mode controller at fec64000 using PIO, IRQ 12
[ 0.140000] musb_hdrc musb_hdrc: MUSB HDRC host driver
[ 0.140000] musb_hdrc musb_hdrc: new USB bus registered, assigned bus number 1
[ 0.140000] usb usb1: configuration #1 chosen from 1 choice
[ 0.140000] hub 1-0:1.0: USB hub found
[ 0.140000] hub 1-0:1.0: 1 port detected
[ 0.140000] NET: Registered protocol family 2
[ 0.140000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.140000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.140000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.140000] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.140000] TCP reno registered
[ 0.140000] NET: Registered protocol family 1
[ 0.140000] RPC: Registered udp transport module.
[ 0.140000] RPC: Registered tcp transport module.
[ 0.140000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.150000] kfile init
[ 0.150000] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[ 0.150000] msgmni has been set to 86
[ 0.150000] alg: No test for stdrng (krng)
[ 0.150000] io scheduler noop registered (default)
[ 0.190000] davincifb davincifb.0: dm_osd0_fb: Initial window configuration is invalid.
[ 0.190000] davincifb davincifb.0: dm_osd0_fb: 1920x1080x16@0,0 with framebuffer size 8100KB
[ 0.190000] davincifb davincifb.0: dm_vid0_fb: 0x0x16@0,0 with framebuffer size 10KB
[ 0.200000] davincifb davincifb.0: dm_osd1_fb: Initial window configuration is invalid.
[ 0.210000] davincifb davincifb.0: dm_osd1_fb: 1920x1080x4@0,0 with framebuffer size 4050KB
[ 0.210000] davincifb davincifb.0: dm_vid1_fb: 0x0x16@0,0 with framebuffer size 10KB
[ 0.260000] venc off init
[ 0.260000] hdmi status init
[ 0.260000] DM365 IPIPEIF probed
[ 0.270000] imp serializer initialized
[ 0.270000] davinci_previewer initialized
[ 0.270000] davinci_resizer initialized
[ 0.270000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 0.270000] serial8250.0: ttyS0 at MMIO 0x1c20000 (irq = 40) is a 16550A
[ 0.740000] console [ttyS0] enabled
[ 0.740000] serial8250.0: ttyS1 at MMIO 0x1d06000 (irq = 41) is a 16550A
[ 0.750000] brd: module loaded
[ 0.760000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron NAND 128MiB 3,3V 8-bit)
[ 0.770000] Creating 4 MTD partitions on "davinci_nand.0":
[ 0.780000] 0x000000000000-0x0000004a0000 : "bootloader"
[ 0.790000] 0x0000004a0000-0x000000e00000 : "kernel"
[ 0.800000] 0x000000e00000-0x000007f00000 : "filesystem"
[ 0.800000] 0x000000000000-0x000008000000 : "all"
[ 0.810000] davinci_nand davinci_nand.0: controller rev. 2.3
[ 0.820000] UBI: attaching mtd2 to ubi0
[ 0.830000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 0.830000] UBI: logical eraseblock size: 126976 bytes
[ 0.840000] UBI: smallest flash I/O unit: 2048
[ 0.840000] UBI: sub-page size: 512
[ 0.850000] UBI: VID header offset: 2048 (aligned 2048)
[ 0.850000] UBI: data offset: 4096
[ 1.020000] usb 1-1: new high speed USB device using musb_hdrc and address 2
[ 1.170000] usb 1-1: configuration #1 chosen from 1 choice
[ 1.170000] hub 1-1:1.0: USB hub found
[ 1.180000] hub 1-1:1.0: 2 ports detected
[ 1.310000] UBI: attached mtd2 to ubi0
[ 1.310000] UBI: MTD device name: "filesystem"
[ 1.320000] UBI: MTD device size: 113 MiB
[ 1.330000] UBI: number of good PEBs: 904
[ 1.330000] UBI: number of bad PEBs: 0
[ 1.330000] UBI: max. allowed volumes: 128
[ 1.340000] UBI: wear-leveling threshold: 4096
[ 1.340000] UBI: number of internal volumes: 1
[ 1.350000] UBI: number of user volumes: 1
[ 1.350000] UBI: available PEBs: 0
[ 1.360000] UBI: total number of reserved PEBs: 904
[ 1.360000] UBI: number of PEBs reserved for bad PEB handling: 9
[ 1.370000] UBI: max/mean erase counter: 11/1
[ 1.370000] UBI: image sequence number: 1249621002
[ 1.380000] UBI: background thread "ubi_bgt0d" started, PID 343
[ 1.390000] console [netcon0] enabled
[ 1.390000] netconsole: network logging started
[ 1.390000] Initializing USB Mass Storage driver...
[ 1.400000] usbcore: registered new interface driver usb-storage
[ 1.410000] USB Mass Storage support registered.
[ 1.460000] usb 1-1.2: new high speed USB device using musb_hdrc and address 3
[ 1.580000] usb 1-1.2: configuration #1 chosen from 4 choices
[ 1.590000] usbcore: registered new interface driver usbtest
[ 1.600000] i2c /dev entries driver
[ 1.600000] Linux video capture interface: v2.00
[ 1.610000] vpfe_init
[ 1.610000] vpfe-capture: vpss clock vpss_master enabled
[ 1.620000] vpfe-capture vpfe-capture: v4l2 device registered
[ 1.630000] vpfe-capture vpfe-capture: video device registered
[ 1.630000] No sub devices registered
[ 1.640000] Trying to register davinci display video device.
[ 1.640000] layer=c1feb400,layer->video_dev=c1feb564
[ 1.650000] Trying to register davinci display video device.
[ 1.650000] layer=c1feb800,layer->video_dev=c1feb964
[ 1.660000] davinci_init:DaVinci V4L2 Display Driver V1.0 loaded
[ 1.670000] watchdog watchdog: heartbeat 1 sec
[ 1.670000] TCP cubic registered
[ 1.680000] NET: Registered protocol family 17
[ 1.680000] lib80211: common routines for IEEE802.11 drivers
[ 1.690000] ksocket init
[ 1.710000] encrypt device:atsha204 found
[ 1.800000] mfi_i2c_client addr:17
[ 1.800000] Clocks: disable unused mmcsd0
[ 1.800000] Clocks: disable unused mmcsd1
[ 1.800000] Clocks: disable unused spi0
[ 1.800000] Clocks: disable unused spi1
[ 1.800000] Clocks: disable unused spi2
[ 1.800000] Clocks: disable unused spi3
[ 1.800000] Clocks: disable unused spi4
[ 1.800000] Clocks: disable unused pwm0
[ 1.800000] Clocks: disable unused pwm1
[ 1.800000] Clocks: disable unused pwm2
[ 1.800000] Clocks: disable unused pwm3
[ 1.800000] Clocks: disable unused timer1
[ 1.800000] Clocks: disable unused timer3
[ 1.800000] Clocks: disable unused emac
[ 1.800000] Clocks: disable unused voice_codec
[ 1.800000] Clocks: disable unused asp0
[ 1.800000] Clocks: disable unused rto
[ 1.800000] Clocks: disable unused mjcp
[ 1.870000] davinci_emac_probe: using random MAC addr: 5e:e0:ed:2b:bb:8e
[ 1.880000] emac-mii: probed
[ 1.920000] UBIFS: recovery needed
[ 1.970000] UBIFS: recovery completed
[ 1.980000] UBIFS: mounted UBI device 0, volume 0, name "rootfs"
[ 1.980000] UBIFS: file system size: 110342144 bytes (107756 KiB, 105 MiB, 869 LEBs)
[ 1.990000] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 2.000000] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 2.010000] UBIFS: default compressor: lzo
[ 2.010000] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 2.020000] VFS: Mounted root (ubifs filesystem) on device 0:13.
[ 2.020000] Freeing init memory: 116K

Filesystem Product Vesion : DJI-Filesystem-1.0-rc2
Runing /etc/init.d/rcS
[ 2.400000] usb 1-1.2: USB disconnect, address 3
[ 3.620000] CMEMK module: built on Jul 30 2014 at 10:21:45
[ 3.620000] Reference Linux version 2.6.32
[ 3.640000] File /home/u/work/svn/dec_grc/src/dvsdk/dvsdk_dm368_4_02_00_06/ linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/cmem/src/module/cmemk.c
[ 3.660000] allocated heap buffer 0xc7000000 of size 0x4400000
[ 3.680000] heap fallback enabled - will try heap if pool buffer is not available
[ 3.690000] CMEM Range Overlaps Kernel Physical - allowing overlap
[ 3.700000] CMEM phys_start (0x1000) overlaps kernel (0x80000000 -> 0x83000000)
[ 3.700000] cmemk initialized
[ 3.730000] IRQK module: built on Jul 30 2014 at 10:21:09
[ 3.730000] Reference Linux version 2.6.32
[ 3.750000] File /home/u/work/svn/dec_grc/src/dvsdk/dvsdk_dm368_4_02_00_06/ linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/irq/src/module/irqk.c
[ 3.770000] irqk initialized
[ 3.810000] EDMAK module: built on Jul 30 2014 at 10:19:34
[ 3.810000] Reference Linux version 2.6.32
[ 3.830000] File /home/u/work/svn/dec_grc/src/dvsdk/dvsdk_dm368_4_02_00_06/ linuxutils_2_26_01_02/packages/ti/sdo/linuxutils/edma/src/module/edmak.c
[ 4.020000] exFAT: Version 1.2.9
[ 4.430000] usb 1-1.1: new high speed USB device using musb_hdrc and address 4
[ 4.570000] usb 1-1.1: configuration #1 chosen from 1 choice
[ 4.830000] usb 1-1.2: new high speed USB device using musb_hdrc and address 5
[ 4.950000] usb 1-1.2: configuration #1 chosen from 4 choices
settime failed
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
[ 11.460000] usb_applehid: probe of 1-1.2:1.0 failed with error -1
[ 11.480000] usbcore: registered new interface driver usb_applehid
[ 11.500000] usb applehid module init ok
[ 11.550000] iap2 device transport connected
[ 11.570000] 68013 connected
[ 11.600000] usbcore: registered new interface driver usb_68013
[ 11.600000] usb 68013 module init ok
sulogin: no password entry for root
login[507]: root login on 'ttyS0'
#Process /etc/profile...
root@Dji-Pro:~# encrypt check ok
init libusb successed!!!
usbmuxd disabled
usbsocket_init OK
usbsocket_create_handle ok, port:22345, bCanRecv:1
usbsocket_create_handle ok, port:22346, bCanRecv:0
latency1:33332
latency2:33000
latency3:30000
displaybuffnum1:4
displaybuffnum2:9
start decode stream from 68013
decode init ok, main thread exit
watchdog timeout:5
get 1765 version,200040a 1090000
get FPGA version,10107ee 101083b
68013 exist
encrypt chip exist
Osd_Init_Font succeed
 
  • Like
Reactions: hotelzululima
Start WDT timer OK.
Magic: 0x87651234 0x3 0x789aedc8
System WARM boot.
Continue to booting up ......


---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 17600000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 27000000
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting done ......

[00000000][CA9_0] [DJI] Start WDT of 20 seconds for boot up......

[00000000][CA9_0] [Version 1.0.11824], Oct 16 2015, 14:06:46


[00000000][CA9_0] [DJI] SD Updater Version [v01.26.4315] Build Nov 5 2015 15:33:09


[00000333][CA9_0] [DJI] Stop WDT.

[00000333][CA9_0] [DJI] Firmware updating......

[00000333][CA9_0] Card In Slot.
[00000634][CA9_0] SD clock source, frequency = 216000000
[00000634][CA9_0] SDCalcClk for SD card initiation:: Actual Clk = 140625, pCLK = 128
[00000653][CA9_0] start to check media
[00000660][CA9_0] AmbaSD_InitCard - SD_CARD OK
[00000664][CA9_0] Packet Detected / c:\P3X_FW_V01.06.0040.bin /.

[00000672][CA9_0] [DJI] Try Ddr Param 0.

[00000673][CA9_0] Back up partion data ......
[00028949][CA9_0] Image "System Software" is found!
[00028949][CA9_0] Image "DSP uCode" is found!
[00028949][CA9_0] Image "System ROM Data" is found!
[00028949][CA9_0] Image "Linux Kernel" is found!
[00028949][CA9_0] Image "Linux Root FS" is found!
[00028949][CA9_0] Start firmware CRC check...

[00028949][CA9_0] Checking System Software
[00032599][CA9_0] Verifying image CRC ... done
[00032599][CA9_0] length: 9195328
[00032599][CA9_0] crc32: 0x6e93a81e
[00032599][CA9_0] ver_num: 1.0
[00032599][CA9_0] ver_date: 2015/11/5
[00032599][CA9_0] img_len: 9195072
[00032599][CA9_0] mem_addr: 0x0e600000

[00032599][CA9_0] Checking DSP uCode
[00034153][CA9_0] Verifying image CRC ... done
[00034153][CA9_0] length: 3889408
[00034153][CA9_0] crc32: 0xd97b99c4
[00034153][CA9_0] ver_num: 1.0
[00034153][CA9_0] ver_date: 2015/11/5
[00034153][CA9_0] img_len: 3889152
[00034153][CA9_0] mem_addr: 0x0ff00000

[00034154][CA9_0] Checking System ROM Data
[00038801][CA9_0] Verifying image CRC ... done
[00038801][CA9_0] length: 11624704
[00038801][CA9_0] crc32: 0xc6dfedab
[00038801][CA9_0] ver_num: 1.0
[00038801][CA9_0] ver_date: 2015/11/5
[00038801][CA9_0] img_len: 11624448
[00038801][CA9_0] mem_addr: 0x03c00000

[00038801][CA9_0] Checking Linux Kernel
[00040814][CA9_0] Verifying image CRC ... done
[00040814][CA9_0] length: 5038864
[00040814][CA9_0] crc32: 0xf6a51577
[00040814][CA9_0] ver_num: 1.0
[00040814][CA9_0] ver_date: 2015/11/5
[00040814][CA9_0] img_len: 5038608
[00040814][CA9_0] mem_addr: 0x00508000

[00040814][CA9_0] Checking Linux Root FS
[00051507][CA9_0] Verifying image CRC ... done
[00051507][CA9_0] length: 26870016
[00051507][CA9_0] crc32: 0xb7355472
[00051507][CA9_0] ver_num: 1.0
[00051507][CA9_0] ver_date: 2015/11/5
[00051507][CA9_0] img_len: 26869760
[00051507][CA9_0] mem_addr: 0x00001000

[00052085][CA9_0] Program "System Software" to NAND flash ...
[00054611][CA9_0] Done
[00054855][CA9_0] Program "DSP uCode" to NAND flash ...
[00055897][CA9_0] Done
[00056618][CA9_0] Program "System ROM Data" to NAND flash ...
[00059726][CA9_0] Done
[00060041][CA9_0] Program "Linux Kernel" to NAND flash ...
[00061402][CA9_0] Done
[00063066][CA9_0] Program "Linux Root FS" to NAND flash ...
[00070290][CA9_0] Done
[00070625][CA9_0] [DJI] Done!


[00070625][CA9_0] [DJI] Reboot......
 
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 3.8.0 (zhongwenhui@Precision-T5600) (gcc version 4.7.3 (Sourcery CodeBench Lite 2013.05-24) ) #1 PREEMPT Fri Apr 24 16:48:01 CST 2015
[ 0.000000] CPU: ARMv7 Processor [413fc090] revision 0 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instructio n cache
[ 0.000000] Machine: Ginkgo
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] Ambarella: AHB = 0x60000000[0xe0000000],0x01000000 0
[ 0.000000] Ambarella: APB = 0x70000000[0xe8000000],0x01000000 0
[ 0.000000] Ambarella: PPM = 0x00000000[0x80000000],0x00500000 16
[ 0.000000] Ambarella: AXI = 0xf0000000[0xf0000000],0x00030000 0
[ 0.000000] Ambarella: PPM2 = 0x0e600000[0x8e600000],0x319fffff 9
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 57150
[ 0.000000] Kernel command line: ubi.mtd=8 root=ubi0:linux rootfstype=ubifs console=ttyS2 nr_cpus=1 maxcpus=0
[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] __ex_table already sorted, skipping sort
[ 0.000000] Memory: 225MB = 225MB total
[ 0.000000] Memory: 223000k/223000k available, 7400k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0x4e800000 - 0x80000000 ( 792 MB)
[ 0.000000] lowmem : 0x40000000 - 0x4e100000 ( 225 MB)
[ 0.000000] modules : 0x3f000000 - 0x40000000 ( 16 MB)
[ 0.000000] .text : 0x40008000 - 0x404b76a4 (4798 kB)
[ 0.000000] .init : 0x404b8000 - 0x404d5514 ( 118 kB)
[ 0.000000] .data : 0x404d6000 - 0x40516560 ( 258 kB)
[ 0.000000] .bss : 0x40516560 - 0x405349cc ( 122 kB)
[ 0.000000] NR_IRQS:416
[ 0.000000] sched_clock: 32 bits at 96MHz, resolution 10ns, wraps every 44739ms
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] SYSCLK:UART[24000000]
[ 0.000000] console [ttyS2] enabled
[ 0.201718] Calibrating delay loop... 499.71 BogoMIPS (lpj=249856)
[ 0.217676] pid_max: default: 32768 minimum: 301
[ 0.222444] Mount-cache hash table entries: 512
[ 0.227670] CPU: Testing write buffer coherency: ok
[ 0.232987] Setting up static identity map for 0x8ae9b0 - 0x8aea18
[ 0.243538] devtmpfs: initialized
[ 0.261726] NET: Registered protocol family 16
[ 0.267366] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 0.276839] Ambarella ginkgo:
[ 0.279943] chip id: 9000
[ 0.282778] board type: 3
[ 0.285586] board revision: 65
[ 0.288824] system configuration: 0x00000130
[ 0.296209] set ocp = 10000
[ 0.302760] aipc_spin_lock_setup done
[ 0.306605] aipc_mutex_init done
[ 0.361676] bio: create slab <bio-0> at 0
[ 0.369409] remoteproc0: c0_and_c1 is available
[ 0.374240] remoteproc0: Note: remoteproc is still under development and considered experimental.
[ 0.383245] remoteproc0: THE BINARY FORMAT IS NOT YET FINALIZED, and backwar d compatibility isn't yet guaranteed.
[ 0.393976] remoteproc0: registered virtio0 (type 7)
[ 0.401267] remoteproc0: powering up c0_and_c1
[ 0.405902] remoteproc0: Booting fw image dummy, size 0
[ 0.411258] remoteproc0: remote processor c0_and_c1 is now up
[ 0.419358] virtio_rpmsg_bus virtio0: rpmsg host is online
[ 0.425666] virtio_rpmsg_bus virtio0: creating channel AmbaRpdev_CLK addr 0x400
[ 0.434259] Bluetooth: Core ver 2.16
[ 0.438720] NET: Registered protocol family 31
[ 0.443286] Bluetooth: HCI device and connection manager initialized
[ 0.449694] Bluetooth: HCI socket layer initialized
[ 0.454632] Bluetooth: L2CAP socket layer initialized
[ 0.459744] Bluetooth: SCO socket layer initialized
[ 0.465972] virtio_rpmsg_bus virtio0: creating channel aipc_rpc addr 0x401
[ 0.473037] Switching to clocksource ambarella-cs-timer
[ 0.521215] NET: Registered protocol family 2
[ 0.526530] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.533812] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.540224] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.546742] TCP: reno registered
[ 0.550019] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.555901] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.562480] NET: Registered protocol family 1
[ 0.567287] RPC: Registered named UNIX socket transport module.
[ 0.573376] RPC: Registered udp transport module.
[ 0.578130] RPC: Registered tcp transport module.
[ 0.582855] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.590289] virtio_rpmsg_bus virtio0: creating channel aipc_vfs addr 0x402
[ 0.602386] msgmni has been set to 435
[ 0.609989] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
[ 0.617535] io scheduler noop registered
[ 0.621518] io scheduler deadline registered
[ 0.625849] io scheduler cfq registered (default)
[ 0.631332] ambarella-uart.2: ttyS2 at MMIO 0x70014000 (irq = 123) is a ambuart
[ 0.641426] brd: module loaded
[ 0.656308] loop: module loaded
[ 0.661443] ambarella-nand ambarella-nand: in ecc-[6]bit mode
[ 0.667333] ambarella_nand: Use On Flash BBT
[ 0.671842] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit), 256MiB, page size: 2048, OOB size: 64
[ 0.683944] ambarella_nand_config_flash: 0x00000000, 0x03c00150
[ 0.689922] chip->subpagesize = 2048
[ 0.693941] Bad block table found at page 131008, version 0xFF
[ 0.700132] Bad block table found at page 130944, version 0xFF
[ 0.706511] ambarella-nand ambarella-nand: ambarella_nand_scan_partitions: Partition infomation found!
[ 0.716577] Creating 15 MTD partitions on "NAND 256MiB 3,3V 8-bit":
[ 0.722962] 0x000000000000-0x000000020000 : "Bootstrap"
[ 0.730733] 0x000000020000-0x000000060000 : "Partition Table"
[ 0.739179] 0x000000060000-0x0000000a0000 : "Bootloader"
[ 0.747024] 0x0000000a0000-0x0000001a0000 : "SD Firmware Update Code"
[ 0.755969] 0x0000001a0000-0x0000021a0000 : "System Software"
[ 0.764182] 0x0000021a0000-0x0000026a0000 : "DSP uCode"
[ 0.772281] 0x0000026a0000-0x0000035a0000 : "System ROM Data"
[ 0.780585] 0x0000035a0000-0x000003fa0000 : "Linux Kernel"
[ 0.788534] 0x000003fa0000-0x000007ba0000 : "Linux Root FS"
[ 0.796770] 0x000007ba0000-0x0000099a0000 : "Linux Hibernation Image"
[ 0.805840] 0x0000099a0000-0x00000e180000 : "Storage1"
[ 0.814923] 0x00000e180000-0x00000e980000 : "Storage2"
[ 0.822555] 0x00000e980000-0x00000f880000 : "Index for Video Recording"
[ 0.831832] 0x00000f880000-0x00000fe20000 : "User Settings"
[ 0.839933] 0x00000fe20000-0x00000ffc0000 : "Calibration Data"
[ 0.849629] mousedev: PS/2 mouse device common for all mice
[ 0.855559] =====RTC ever lost power=====
[ 0.859637] =====RTC ever lost power=====
[ 0.863674] =====RTC ever lost power=====
[ 0.867701] =====RTC ever lost power=====
[ 0.871728] =====RTC ever lost power=====
[ 0.876269] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
[ 0.886269] TCP: cubic registered
[ 0.889761] Initializing XFRM netlink socket
[ 0.894178] NET: Registered protocol family 17
[ 0.898733] NET: Registered protocol family 15
[ 0.903375] VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
[ 0.914790] UBI: attaching mtd8 to ubi0
[ 1.097175] UBI: scanning is finished
[ 1.108771] UBI: attached mtd8 (name "Linux Root FS", size 60 MiB) to ubi0
[ 1.115720] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 1.122539] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 1.129255] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 1.136145] UBI: good PEBs: 480, bad PEBs: 0, corrupted PEBs: 0
[ 1.142077] UBI: user volume: 2, internal volumes: 1, max. volumes count: 128
[ 1.149223] UBI: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1276099015
[ 1.158274] UBI: available PEBs: 0, total reserved PEBs: 480, PEBs reserved for bad PEB handling: 40
[ 1.167428] UBI: background thread "ubi_bgt0d" started, PID 409
[ 1.173454] console [netcon0] enabled
[ 1.177167] netconsole: network logging started
[ 1.181732] =====RTC ever lost power=====
[ 1.185797] ambarella-rtc ambarella-rtc: setting system clock to 2014-01-01 0 0:00:05 UTC (1388534405)
[ 1.240475] UBIFS: mounted UBI device 0, volume 0, name "linux", R/O mode
[ 1.247317] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 1.256473] UBIFS: FS size: 34283520 bytes (32 MiB, 270 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
[ 1.266136] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 1.271211] UBIFS: media format: w4/r0 (latest is w4/r0), UUID F008148E-B5E3-439B-9816-FBB5D018DD0B, small LPT model
[ 1.283073] VFS: Mounted root (ubifs filesystem) readonly on device 0:12.
[ 1.291061] devtmpfs: mounted
[ 1.294726] Freeing init memory: 116K
Starting mdev...
Initializing random number generator... read-only file system detected...done
Starting network...
[ 2.107120] =====RTC ever lost power=====
Set system time from hwclock
[ 2.173027] virtio_rpmsg_bus virtio0: creating channel aipc_rfs addr 0x403
[ 2.196435] virtio_rpmsg_bus virtio0: creating channel AmbaRpdev_LinkCtrl addr 0x404
[ 2.235772] virtio_rpmsg_bus virtio0: creating channel dji_app addr 0x405
binder2 15 linux_util_svc
[ 2.508162] cfg80211: Calling CRDA to update world regulatory domain
/usr/local/share/script/preload.sh: line 8: /usr/local/share/script/wifi_softmac.sh: not found
Starting sshd: OK

skip hibernation
[ 3.380864] =====RTC ever lost power=====
Set system time from hwclock
User Setting Step 1 Finish
[ 3.511272] ambafs_create MISC
mkdir: can't create directory '/tmp/fuse_d/MISC': No such device
/usr/local/share/script/wifi_start.sh: line 62: can't create /tmp/fuse_d/MISC/wifi.conf: nonexistent directory
cat: can't open '/tmp/wifi0_mac': No such file or directory
There is no WIFI interface!
/etc/init.d/S52wifi: line 24: boot_done: not found
[ 3.782129] usbcore: registered new interface driver usbfs
[ 3.804134] usbcore: registered new interface driver hub
[ 3.835119] usbcore: registered new device driver usb
[ 4.106439] usbcore: registered new interface driver cdc_subset
[ 4.174433] usbcore: registered new interface driver cy7c68013a_dji
[ 4.238154] Debug Flag: 0x00000000
[ 4.252547] virtio_rpmsg_bus virtio0: creating channel dji_sock addr 0x406
[ 4.301613] virtio_rpmsg_bus virtio0: creating channel dji_usbdrv addr 0x407
[ 4.365822] virtio_rpmsg_bus virtio0: creating channel dji_test addr 0x408
failed to open binding port with code -1
[hdr_merge]starting...
[ 4.428808] virtio_rpmsg_bus virtio0: creating channel echo_cortex addr 0x409
rpc client exit
User Setting Step 2 Finish
/ # mmap phy addr(0x20000000) -> virt addr(0x16c7e000)
mmap phy addr(0x00000000) -> virt addr(0x06c7e000)
MemMap ok
init ipc ok
[hdr_merge]preparing...
[hdr_merge]registering server...
binder2 14 hdr_merge_svr
[hdr_merge]start looping...
 
-------------------------------------------------------------------------------
Loader release Time:Sep 22 2015 11:29:12

JumpAddress=0x0800df21

App Release Time:Sep 24 2015 12:57:28

HardVer:FC550_BCPU_V1.0
LoaderVer:0x00010f74
AppVer:0x00010f89

AskVer:
Four Thirds version[0x101a]
Transmission speed[2500kbps]
L_ID.MemberID=[0x1]
L_ID.LensID.ModelID=[0x1001]
L_ID.LensID.HardVer=[0]
SIGMA 30mm F2.8 EX DN
Private1 =[33 35 38 0 0 0 1 10 1e 0 f9 2 0 9 16 3 1c 9 f 0 50 6 2c 1 9b b2 ff ff ff 4f fc d3 dd e3 e8 ec ef f1 f2 f3 f5 f6 f7 f8 f9 f9 fa fa fb fb fc fc fc fc fc fc fc fc fc fc fc fc fd fd fd ]
Private2 =[0xfd]
Private3 =[0xfdfd 0xfdfd 0xfdfd ]
LAF_Z_POS[0] =[253]
LAF_Z_POS[1] =[254]
LAF_Z_POS[2] =[254]
LAF_Z_POS[3] =[255]
L_DIS_LD[0][0][0]=[32767]
L_DIS_LD[0][0][1]=[-1]
L_DIS_LD[0][0][2]=[-12]
L_DIS_LD[0][0][3]=[-17]
L_DIS_LD[1][0][0]=[-13]
L_DIS_LD[1][0][1]=[-13]
L_DIS_LD[1][0][2]=[-18]
L_DIS_LD[1][0][3]=[-15]
L_DIS_LD[2][0][0]=[-15]
L_DIS_LD[2][0][1]=[0]
L_DIS_LD[2][0][2]=[0]
L_DIS_LD[2][0][3]=[0]
L_DIS_R[0][0]=[32]
L_DIS_R[0][1]=[65]
L_DIS_R[0][2]=[3]
L_DIS_R[0][3]=[0]
L_DIS_M[0][0]=[32]
L_DIS_M[0][1]=[65]
L_DIS_M[0][2]=[3]
L_DIS_M[0][3]=[0]
L_DIS_E[0][0][0]=[0]
L_DIS_E[0][0][1]=[0]
L_DIS_E[0][0][2]=[0]
L_DIS_E[0][0][3]=[0]
L_DIS_E[1][0][0]=[0]
L_DIS_E[1][0][1]=[0]
L_DIS_E[1][0][2]=[0]
L_DIS_E[1][0][3]=[0]
L_DIS_E[2][0][0]=[0]
L_DIS_E[2][0][1]=[0]
L_DIS_E[2][0][2]=[0]
L_DIS_E[2][0][3]=[0]
L_EXP_FLG =[0]
L_WOB_AMP_MAX_15Hz =[0]
L_WOB_AMP_MAX_30Hz =[0]
L_WOB_AMP_MAX_60Hz =[64968]
L_WOB_AMP_MAX_120Hz =[64941]
L_WOB_AMP_MIN_15Hz =[64928]
L_WOB_AMP_MIN_30Hz =[64924]
L_WOB_AMP_MIN_60Hz =[112]
L_WOB_AMP_MIN_120Hz =[118]
L_WOB_MOV_MAX_15Hz =[122]
L_WOB_MOV_MAX_30Hz =[125]
L_WOB_MOV_MAX_60Hz =[22]
L_WOB_MOV_MAX_120Hz =[18]
L_FOC_MOV_MAX_30Hz =[15]
L_FOC_MOV_MAX_60Hz =[13]
L_FOC_MOV_MAX_120Hz =[0]
L_AP_SPEED_MAX[0] =[0]
L_AP_SPEED_MAX[1] =[0]
L_AP_SPEED_MAX[2] =[0]
L_AP_SPEED_MAX[3] =[0]
L_AP_SPEED_MIN[0] =[0]
L_AP_SPEED_MIN[1] =[0]
L_AP_SPEED_MIN[2] =[0]
L_AP_SPEED_MIN[3] =[0]
L_AP_SPEED_SIL[0] =[0]
L_AP_SPEED_SIL[1] =[0]
L_AP_SPEED_SIL[2] =[0]
L_AP_SPEED_SIL[3] =[0]
L_AP_SW_W[0] =[0]
L_AP_SW_W[1] =[0]
L_AP_SW_W[2] =[6]
L_AP_SW_N[0] =[0]
L_AP_SW_N[1] =[12288]
L_AP_SW_N[2] =[1536]
L_AP_SW_T[0] =[10241]
L_AP_SW_T[1] =[4608]
L_AP_SW_T[2] =[0]
TD_LDmax =[0]
TD_LDmin =[3840]
N_LDPmax =[3584]
L_FOC_MOV_MIN_TIME =[0]
AskDataM data length parse error
AskDataM data length is [429]
Parse length is [410]
Ring[3], Value[65280]

AskDatM_CA:
The CA data can not acquire by AskDataM_CA.
Because the mFTS verision is lower than 1.20A


Init lens ok!
 
Should we migrate this to a private area somehow so DJI isn't watching as we work and closing holes ?


Sent from my iPad using PhantomPilots mobile app
 
If Andrew_by indeed does what what ALL of us p3p pilots would LOVE to have, then he deserves a nice piece of that pie. He joined just before I did and had posted nothing until these. I am a noob at the P3P, but not flying smaill rcs. I have 12 hrs flight time now, but wish to filmprofessional fireworks is my end goal. I don't like being restricted at ALL! My largest shoot is 1/2 mile from a runway, so therefore well within the NFZ. They close this small airport for 45 minutes due to the large shells proximity to the runway. I obviously unlocked the NFZ, but those that follow the law(rules, local regulations) shouldn't be restricted because there are those that just want to fly up a mile high just cause they can. Always going to be bad apples, but I love the idea of this thread. People coming together in pursuit of something that we should have ANYWAY. Just my 2 cents. Thanks to everyone for what they are doing!
 
all P3 firmware consists only hole) . one big hole..) and for close them , they need redesign too much codes... i think it very expensive.
 
  • Like
Reactions: blu3g3
all P3 firmware consists only hole) . one big hole..) and for close them , they need redesign too much codes... i think it very expensive.

OK just trying to protect our little idea here lol
Keep up the good work !!!:)
 
I would equally assume there was a JTAG interface or similar for loading firmware at the factory and to recover "bricked" installs. What we need is a complete teardown with high resolution images including inside the flight controller and camera. Anybody found such images?

If not, this could be what we need to raise funds for. Anybody willing to donate a dead P3?

You guys are entirely out of my league. I don't even know what you're discussing. What I do know is that this has become ridiculous. As a Marine, I am livid that a Chinese company is dictating how and where I must fly!

I m now a retired businessman. I've built, grown and successfully sold three businesses. I have done business with some of the largest companies in the world.

I'm in to help where I can, which may be very limited. I have a crashed P3Pro that could be donated. It could be rebuilt and flown which is what my plan was as all systems are operational. Needs a shell, probably new motors and the camera rebuilt. Everything does function, including the camera. If I could be assured that all of my personal data would be destroyed and it wouldn't be used to be rebuilt and privately used, I'd donate it to this cause. I have another P3Pro, P2V+ and a Solo so I don't need it.

I'd also be willing to help financially if I saw and understood where this was going and how we would get there. I would also have to make sure I wouldn't be opening up myself or my family to any undo liabilities.

I hope I can somehow help.

Jerry
 
At first I didn't think it would be necessary but the think about it, it might be a good idea about a private area. I am willing either way. I'm just so glad we found other people who are fed up enough to do something about it.
 
Andrew, based on your findings, what do you think is the best approach? Modify what they have or build software from scratch to get what we'really trying to accomplish?
 
I'll donate. if I saw any progress! I don't even know what you're discussing with all these techical terms! LOL!!!!
 
This stuff is over my head but I'm glad someone is working on a workaround. DJI trying to be the drone police will be the beginning of the end for them.
 
Status
Not open for further replies.

Recent Posts

Members online

No members online now.

Forum statistics

Threads
143,093
Messages
1,467,581
Members
104,976
Latest member
cgarner1