Welcome to PhantomPilots.com

Sign up for a weekly email of the latest drone news & information

Guide: How to fix bricked P3S (FTP range mod)

Discussion in 'Standard/4k Discussion' started by jackhadrill, Jun 24, 2016.

  1. jackhadrill

    Joined:
    May 4, 2016
    Messages:
    130
    Likes Received:
    54
    Location:
    United Kingdom
    Hello!!

    The P3S range mod that Ojcze Nasz discovered is absolutely incredible, however there are a few people (like me) who managed to brick their Phantoms rendering them useless!
    I hope no one minds, I've collated the steps into a PDF in the hope that it makes some peoples' lives a little easier.

    Anyway - PDF guide HERE

    Hope this helps!


    Credit to everyone who helped discover the mod, and fix the bricks - beshanoe, sparkymarky, Ojcze Nasz, TDKUK, ElMalo, BaDvs3viL - sorry if I missed anyone! I take no credit for finding the fix myself, only collating it.
     
    Argoxp, Ojcze Nasz, Argonaise and 2 others like this.
  2. jackhadrill

    Joined:
    May 4, 2016
    Messages:
    130
    Likes Received:
    54
    Location:
    United Kingdom
    I'm most definitely not a fan of 'bumping' posts - particularly given my lack of experience on this forum, but I believe that this remains useful for a lot of people.

    I forgot to add as well, if *for whatever reason* DJI changes their FTP/root password, perhaps this could be the new way in? What do you think?
     
  3. BaDvs3viL

    Joined:
    Jun 13, 2016
    Messages:
    133
    Likes Received:
    38
    Location:
    Chicago
    Cool, glad to see people getting their birds back in the air!
     
  4. sparkymarky

    Joined:
    Oct 20, 2015
    Messages:
    66
    Likes Received:
    3
    Location:
    Wales
    As one got a copy of RCs files, which I need to fix my bricked RC and drone, as seem to missing?
     
  5. BaDvs3viL

    Joined:
    Jun 13, 2016
    Messages:
    133
    Likes Received:
    38
    Location:
    Chicago
    If you follow the guide, it is pulling the RCs file from the back up flash.
     
  6. sparkymarky

    Joined:
    Oct 20, 2015
    Messages:
    66
    Likes Received:
    3
    Location:
    Wales
    Okay I'll give that a go, as I thought you have modify my accessing via ftp and Notepad++.

    If have look at one of last feeds, you can what I did? on I bricked my p3s with ftp range mod - let's fix it together
     
  7. sparkymarky

    Joined:
    Oct 20, 2015
    Messages:
    66
    Likes Received:
    3
    Location:
    Wales
    Help, I thought I had solution to fix it, I don't it happen to drone.

    What commands I need to using Vim?

    As this what going on with RC?

    Any suggestion?
    bootm 0x9f420000

    see rcS: applet not found below?

    U-Boot 1.1.4 (Mar 24 2016 - 12:37:01)

    MI124
    DRAM: 32 MB
    Flash: 8 MB
    In: serial
    Out: serial
    Err: serial
    Press ESC to abort autoboot in 1 seconds
    ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/de¶©–c½[Õ init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)

    ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)

    ar7240>

    ar7240>

    ar7240> bootm 0x9f420000

    ## Booting image at 9f420000 ...
    Image Name: MIPS OpenWrt Linux-3.10.49
    Created: 2015-08-20 3:19:32 UTC
    Image Type: MIPS Linux Kernel Image (lzma compressed)
    Data Size: 905294 Bytes = 884.1 kB
    Load Address: 80060000
    Entry Point: 80060000
    Verifying Checksum at 0x9f420040 ...OK
    Uncompressing Kernel Image ... OK

    Starting kernel ...

    [ 0.000000] Linux version 3.10.49 (yello@ubuntu) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r2635) ) #14 Thu Aug 20 11:19:19 CST 2015
    [ 0.000000] bootconsole [early0] enabled
    [ 0.000000] CPU revision is: 0001974c (MIPS 74Kc)
    [ 0.000000] SoC: Atheros AR9342 rev 2
    [ 0.000000] Clocks: CPU:560.000MHz, DDR:450.000MHz, AHB:225.000MHz, Ref:40.000MHz
    [ 0.000000] Determined physical RAM map:
    [ 0.000000] memory: 02000000 @ 00000000 (usable)
    [ 0.000000] User-defined physical RAM map:
    [ 0.000000] memory: 02000000 @ 00000000 (usable)
    [ 0.000000] Initrd not found or empty - disabling initrd
    [ 0.000000] Zone ranges:
    [ 0.000000] Normal [mem 0x00000000-0x01ffffff]
    [ 0.000000] Movable zone start for each node
    [ 0.000000] Early memory node ranges
    [ 0.000000] node 0: [mem 0x00000000-0x01ffffff]
    [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
    [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
    [ 0.000000] Kernel command line: board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all) mem=32M rootfstype=squashfs,jffs2 noinitrd
    [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
    [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
    [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
    [ 0.000000] Writing ErrCtl register=00000000
    [ 0.000000] Readback ErrCtl register=00000000
    [ 0.000000] Memory: 29180k/32768k available (2102k kernel code, 3588k reserved, 363k data, 220k init, 0k highmem)
    [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    [ 0.000000] NR_IRQS:51
    [ 0.000000] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
    [ 0.070000] pid_max: default: 32768 minimum: 301
    [ 0.070000] Mount-cache hash table entries: 512
    [ 0.080000] NET: Registered protocol family 16
    [ 0.080000] MIPS: machine is DJI WM305
    [ 0.290000] ath_usb_init: id: 1122
    [ 0.360000] bio: create slab <bio-0> at 0
    [ 0.360000] Switching to clocksource MIPS
    [ 0.370000] NET: Registered protocol family 2
    [ 0.370000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
    [ 0.380000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
    [ 0.390000] TCP: Hash tables configured (established 512 bind 512)
    [ 0.390000] TCP: reno registered
    [ 0.390000] UDP hash table entries: 256 (order: 0, 4096 bytes)
    [ 0.400000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    [ 0.410000] NET: Registered protocol family 1
    [ 0.430000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
    [ 0.430000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    [ 0.440000] msgmni has been set to 56
    [ 0.450000] io scheduler noop registered
    [ 0.450000] io scheduler deadline registered (default)
    [ 0.460000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
    [ 0.480000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
    [ 0.490000] console [ttyS0] enabled, bootconsole disabled
    [ 0.490000] console [ttyS0] enabled, bootconsole disabled
    [ 0.500000] ar934x-hs-uart.0: ttyATH0 at MMIO 0x18500000 (irq = 14) is a AR934X UART
    [ 0.510000] ath79-spi ath79-spi: master is unqueued, this is deprecated
    [ 0.520000] m25p80 spi0.0: found s25fl064k, expected m25p80
    [ 0.530000] m25p80 spi0.0: s25fl064k (8192 Kbytes)
    [ 0.530000] 10 cmdlinepart partitions found on MTD device ath-nor0
    [ 0.540000] Creating 10 MTD partitions on "ath-nor0":
    [ 0.540000] 0x000000000000-0x000000040000 : "u-boot"
    [ 0.550000] 0x000000040000-0x000000050000 : "u-boot-env"
    [ 0.560000] 0x000000050000-0x000000130000 : "kernel1"
    [ 0.560000] 0x000000130000-0x000000420000 : "rootfs1"
    [ 0.570000] 0x000000420000-0x000000500000 : "kernel2"
    [ 0.580000] 0x000000500000-0x0000007f0000 : "rootfs2"
    [ 0.580000] 0x0000007f0000-0x000000800000 : "art"
    [ 0.590000] 0x000000050000-0x000000420000 : "firmware1"
    [ 0.600000] 0x000000420000-0x0000007f0000 : "firmware2"
    [ 0.600000] 0x000000000000-0x000000800000 : "all"
    [ 0.610000] g_ether gadget: using random self ethernet address
    [ 0.610000] g_ether gadget: using random host ethernet address
    [ 0.620000] usb0: MAC 06:eb:10:2f:af:e0
    [ 0.630000] usb0: HOST MAC fa:06:18:1a:10:4b
    [ 0.630000] g_ether gadget: Ethernet Gadget, version: Memorial Day 2008
    [ 0.640000] g_ether gadget: g_ether ready
    [ 0.640000] TCP: cubic registered
    [ 0.650000] NET: Registered protocol family 17
    [ 0.650000] 8021q: 802.1Q VLAN Support v1.8
    [ 1.440000] jffs2: notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    [ 1.460000] VFS: Mounted root (jffs2 filesystem) readonly on device 31:5.
    [ 1.470000] Freeing unused kernel memory: 220K (802c9000 - 80300000)

    init started: BusyBox v1.22.1 (2015-06-29 19:28:31 CST)

    starting pid 219, tty '': '/etc/init.d/rcS'
    rcS: applet not found

    can't open /dev/ttyS0: No such file or directory

    process '/bin/ash --login' (pid 220) exited. Scheduling for restart.

    can't open /dev/ttyS0: No such file or directory

    process '/bin/ash --login' (pid 221) exited. Scheduling for restart.

    can't open /dev/ttyS0: No such file or directory

    process '/bin/ash --login' (pid 222) exited. Scheduling for restart.

    can't open /dev/ttyS0: No such file or directory

    process '/bin/ash --login' (pid 223) exited. Scheduling for restart.

    can't open /dev/ttyS0: No such file or directory

    process '/bin/ash --login' (pid 224) exited. Scheduling for restart.

    can't open /dev/ttyS0: No such file or directory
    ^C
    process '/bin/ash --login' (pid 225) exited. Scheduling for restart.

    any suggestion?[/QUOTE]
    [/QUOTE]
     
  8. jackhadrill

    Joined:
    May 4, 2016
    Messages:
    130
    Likes Received:
    54
    Location:
    United Kingdom
    I've read through this and can only suggest trying to force a firmware reset to see if it will fix any of the built-in firmware issues. To do this, download the 1.6.80 .bin file from DJI Phantom Accessories & Tips - Phantom Help, put it in the root of a freshly formatted FAT32 SD card, insert it into the camera (whilst attached to the drone), and then hold down the re-link button whilst turning on the drone. Leave it for 20-30 minutes (my camera got very hot) and then that should have hopefully fixed the backup firmware for you :) The bird still needs fixing however, the firmware install will most likely fail :/
     
  9. mwisnia

    Joined:
    Jul 1, 2016
    Messages:
    1
    Likes Received:
    0
    Guys thanks a lot for helping guys like me in unbricking their drones! Not sure what I'm doing wrong but when I bridge the reset with gnd on the arduino yun it brings the tx led on and I'm unable to connect via putty at all :( any thoughts?
     
  10. sparkymarky

    Joined:
    Oct 20, 2015
    Messages:
    66
    Likes Received:
    3
    Location:
    Wales
    Do you need to short reset with gnd? Why don't you short RX and TX, on the Arduino and start putty. Press a fews keys to see if get response back from the keys you pressed.
     
  11. jackhadrill

    Joined:
    May 4, 2016
    Messages:
    130
    Likes Received:
    54
    Location:
    United Kingdom
    Shorting TX and GND is required to bypass the ATMEGA. Removing the ATMEGA chip will have the same effect
     
  12. Adrian Ling Di Yeuan

    Joined:
    Jun 18, 2016
    Messages:
    13
    Likes Received:
    0

    The PDF file link is dead bro, possibly can you provide a new link? I could not download it.
     
  13. jackhadrill

    Joined:
    May 4, 2016
    Messages:
    130
    Likes Received:
    54
    Location:
    United Kingdom
    Sure, my hosting provider somehow managed to send a power surge through my server, killing the disks. I've got a backup on my computer which I'll send over if you email me. My email address can be found on my profile :)
     
  14. Dmitri Feldman

    Joined:
    Jul 31, 2016
    Messages:
    10
    Likes Received:
    0
    Sorry, if I in my foolishness broke the RcS file in the backup file system, too, is there a way to fix this. Or should I buy a new controller?
     
  15. Mukesh

    Joined:
    Jul 31, 2016
    Messages:
    2
    Likes Received:
    0

    Hi the link does not seem to work can you please provide another link. Thanks
     
  16. Yurandex

    Joined:
    Aug 13, 2016
    Messages:
    2
    Likes Received:
    0
    Hi from Moscow!
    Cool! Thanks! Worked! UART was connected, and I made kickback of the rcS file! It is good that they used OPEN WRT as an operating system!!
     
  17. armour

    Joined:
    Sep 8, 2016
    Messages:
    9
    Likes Received:
    3
    Hi Jack, could you please post PDF? Thanks
     
  18. godtec

    Joined:
    Sep 14, 2016
    Messages:
    6
    Likes Received:
    0
    ME three!