Welcome to PhantomPilots.com

Sign up for a weekly email of the latest drone news & information

I bricked my p3s with ftp range mod - let's fix it together

Discussion in 'Standard/4k Discussion' started by beshanoe, Jun 15, 2016.

  1. beshanoe

    Joined:
    Jun 14, 2016
    Messages:
    28
    Likes Received:
    27
    I did range mod from Phantom 3 Standard range mod , let's do it together... and now my drone's RC doesn't create Wi-Fi access point. This topic is for those unfortunates who've done the same and don't know how to fix it. So please share your situation and ideas.
    I used mac, filezilla and vim to change files. I defenitely forgot to do "chmod +x" which is thought to be crucial.
    Today I brought my drone to the official repair service here in Moscow and I'm waiting now for their diagnosis, it should take up to 5 days thay said. It seemed that they have no special instruments for reuploading healthy firmware to RC and drone using service connectors or smth, but who knows..

    UPDATE:

    With common effort, the way to recover has been discovered. Basically, all you need is to connect to TX, RX, GND pins of Wi-Fi module board with UART TTL adapter and open serial console(see pictures here I bricked my p3s with ftp range mod - let's fix it together and here I bricked my p3s with ftp range mod - let's fix it together). Then you should prevent u-boot from loading linux kernel by pressing ESC key and type to u-boot console the next commands(thanks ElMalo):

    MI124
    DRAM: 32 MB
    Flash: 8 MB
    In: serial
    Out: serial
    Err: serial
    Press ESC to abort autoboot in 1 seconds
    ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)

    And then

    ar7240> bootm 0x9f420000

    This will allow you to boot backup copy of system. After that you'll be able to mount main root filesystem:

    mkdir /tmp/flash

    And then mount it:

    mount -t jffs2 mtd3 /tmp/flash

    Then you can go to /tmp/flash/etc/init.d folder and repair the rcS.

    In order to recover drone you should repeat all the steps but connect UART to gimbal's board. Here are the pictures of pins you need to connect with your UART adapter.
    [​IMG][​IMG][​IMG]

    Thanks everyone who participated in the research!
     
    #1 beshanoe, Jun 15, 2016
    Last edited: Jun 23, 2016
    ciro italy, paulgun, FPina and 6 others like this.
  2. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
    Sorry to hear about the 'Bricking'!

    I have followed the progress of the mod from the start as not only do I own a P3S with poor video since the FW upgrade but I have a long interest in electronics and RF stuff (Radio Ham and all that boring stuff)

    I can only hope that there is a way to access the RC via the USB port and have searched the net without any mention of this BUT!!! One piece of hope is that from pictures posted of people's RCs opened up for other mods, I can see that the RC USB port has FOUR wires connected inside the case.

    To my mind this means it isn't just for power but is a proper data connection!

    There used to be a windows driver for the P2 I believe? I think something similar would be needed here otherwise it would take some real low-level connectivity stuff to get in.

    Best of luck! I am still searching and asking colleagues who work in the field of wifi and programmable devices.....
     
    beshanoe likes this.
  3. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
    hear's a thought....if you reset the RC wifi by pushing the gimbal wheel UP and flapping SW2 or is it SW1??? anyway.....

    what happens if you take the gimbal wheel all the way DOWN and flap it??? would be nice if it reset the entire RC!!
     
  4. beshanoe

    Joined:
    Jun 14, 2016
    Messages:
    28
    Likes Received:
    27
    Thanks! I've also tried to research on RC's usb and what I have found is that DJI win driver from P2 installs successfully and COM device DJI CONTROLLER appears, but other software for P2 like Phantom Assistant don't see connected RC. Moreover, I tried to connect to this COM device using terminal apps but no luck here as well. I managed to determine which chip is the heart of RC, it's Atheros AR9344 or similar SoC, it has advanced Wifi capabilities as well Ethernet ones. I wish RCs had service Ethernet-port to access console, but it had no. Not to mention it's quite difficult to reach the chip, it's hidden under radiator and thermo-stuff. So the special flashing tool is definitely needed here. Another idea is to dump memory chip and flash it with fixed firmware somehow.
     
  5. beshanoe

    Joined:
    Jun 14, 2016
    Messages:
    28
    Likes Received:
    27
    I tried many different manipulations with RC, wifi resetting sequence doesn't seem to have any effect on RC, however flapping SWs without touching the gimbal wheel results in RC's beeping but Wifi is still not there.
     
  6. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
    nice! so the AR9344 is PCIe and operates as a USB Host according to google.....must have a back door!! similar techniques to TP-Link TL-WDR4310 [OpenWrt Wiki] ?

    I will carry on the hunt!
     
  7. Multicoptertec

    Joined:
    Mar 4, 2016
    Messages:
    1,083
    Likes Received:
    311
    Location:
    Apollo Beach, Florida
    You can reset all you want, but if the firmware is corrupt, you are just restarting the same routine. I also have been following the threads on this with great interest. I wonder if there is any way to force an update to the RC via the Go App.
     
  8. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
    I think you would need something like this; Das U-Boot [OpenWrt Wiki]

    in order to break into the dark world of that chip?? we need someone with more knowledge here!!
     
  9. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
    Its all coming back to me now!! I've done a very small amount of fiddlear$1ng around with things like this in security/door-control systems and hotel wifi points....

    I am guessing that we need to gain access to the serial interface on the AR9344...this would take an old-school pc with a serial port or a serial-USB converter. Then using Putty or a similar prog you can access basic commands on the chip. New firmware/software would be loaded via TFTP.

    Just hoping to prod someones latent tech ability by my 'thinking out load' here
     
  10. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
    OK now in full dog with-a-bone mode!!

    I am running with a total guess but just maybe using something like USB to UART Bridge VCP Drivers | Silicon Labs

    it might just be possible to use Putty and connect to the serial int on the RC??

    My remote is fine but I am going to try this in a bit and will report back. If a connection is possible then the flash via TFTP method may become possible or we may even be able to change those file permissions through the serial SSH connection!

    I am way beyond my comfort zone here so don't hold your breath!
     
    Davey B likes this.
  11. Foda

    Joined:
    Apr 8, 2016
    Messages:
    34
    Likes Received:
    8
    Location:
    Switzerland
  12. beshanoe

    Joined:
    Jun 14, 2016
    Messages:
    28
    Likes Received:
    27
    TDKUK likes this.
  13. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
    Thanks....yes I have it on screen amongst a million other windows! lol

    tried the UART driver and Putty connection but win 10 says 'Can't open COM1'

    I have probably made a schoolboy error but just trying to help out here. I am hoping they have built the rc so that you can connect to the chip via serial although some devices have internal connections or need a few wires soldering in the right place....right out of my depth here!?!?!??
     
  14. SingLag

    Joined:
    Jun 9, 2016
    Messages:
    73
    Likes Received:
    56
    there are tx/rx/gnd on the RC main board under 2.4g module, should be serial console port
     
  15. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
    I agree.....fiddly one!!!
     
  16. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
    what about the D+ and D- marked pins by the usb socket? data lines maybe?
     
  17. beshanoe

    Joined:
    Jun 14, 2016
    Messages:
    28
    Likes Received:
    27
    I believe that this way is closed for mere mortals, it's maybe connected to some intermediate chip with proprietary protocol. Though I've seen projects for connecting RC to PC in orger to control flight simulator but I haven't tried it. They should somehow communicate using this protocol
     
  18. Ojcze Nasz

    Joined:
    Jun 2, 2016
    Messages:
    226
    Likes Received:
    157
    D+ and D- are USB data lines.
    RX TX are most likey serial lines, do you have a picture ?

    There is one BOOTO. Boot Option. Wondering if that can be used to reflash somehow.
     
  19. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
  20. TDKUK

    Joined:
    May 12, 2016
    Messages:
    75
    Likes Received:
    20
    Location:
    Hertfordshire UK
    Robert Smith jr and pszem like this.