I bricked my p3s with ftp range mod - let's fix it together

Hello guys! I am new on this forum. Have the same problem - tried to do the range mod with ftp but didnt use notepad++ (actually i did it with standart notepad from windows 10) and after that my RC and bird became bricks. So i bought the correct UART (2102), solded tx, rx and gnd to the rc wifi module, installed putty, set speed to 115200, connected it all and saw the correct loading code. But ESC button does not work! I double and tripple checked the soldering but it just does not want to work. So i cant abort the autoboot to load the backup copy and save my rcs files... Any ideas how to make ESC button working in putty?
Thanks!

Would it possible post a copy of the RCS file for RC zipped, as need a copy. As I couldn't recover my RC I only recovered my drone.
 
My 4K is flying again !!!!! Thank you all for your knowledge and your efforts. BTW You dont have to disassemble the gimbal on 4k to get to the solder points. The wifi card sits under the sensor panel.
Can u tell hiw to fix. 4k
I try and stuck. And try to solder on wifi and not loading. When solder the wifi. U connect all cable or just power to make it on.

Plzz help

Sent from my SM-N9005 using PhantomPilots mobile app
 
The guy that posted that video doesn't know what he's doing and gives zero credit to those who discovered the mod and fix. PuTTY is the only program you need to use.

Hi, Bro.

Thanks to you, my rc works (have a vacation in Bali, I'll buy you a coffee :)). I tried to recover the drone and I deleted ^M already, but the drone still cannot bind with rc. I also tried to bound the drone with the new rc, cannot bind. Any clue?
 
Can u tell hiw to fix. 4k
I try and stuck. And try to solder on wifi and not loading. When solder the wifi. U connect all cable or just power to make it on.

Plzz help

Sent from my SM-N9005 using PhantomPilots mobile app

I connected power and gimbal. The sensor panel was to fiddly to connect so i did not connect it. As it appears you dont have to connect it.
 
Hi all,, i think i bricked my drone.. :( RC is working fine, connecting and i can move the gimbal. but no wifi connection and i can not FTP/Telnet on drone. RC is fine.. Any solutions ??

I did try to upgrade on 1.6.8 but it beeps continuesly after starting to upgrade its like Deeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee....... all the time.
Tryed waiting about 1 hour,, and also tryed 1.5.7 force downgrade,, and same.. Formated sd card, tryed another,, nothing works..
 
Last edited:
I came across funny problem while fixing bricked bird, I connected to bird and pressed ESC to cancel autoboot. Ran setenv and bootm, the bird normally completed boot process, enabling wifi and connected to RC. By this time DJI GO recognized my P3S, video came back, and the system was back to normal.

However, I turned off and turned on bird's power, then I let it complete boot process automatically, but it came across the error "/etc/init.d/rcS Not found" then it locked in loop "/dev/ttyS0 not found" and it got back to the state before the fix has done.

It is interesting, because /etc/init.d/rcS is intact, I overwritten normal bird's file on it, no carriage return (^M), file is on mode 775 and is executable. Moreover, when I boot it manually with bootm command, it normally brings wifi up and shows telnet prompt. I don't know the difference of those two boot methods, but I have no idea now. Please advise me if you know about it.

Thank you.
 
I got mine all setup and will take some pics in a bit.
Hi ,not working run run run restart how to stop this boot? serial.jpg
 
Press ESC to abort autoboot in 1 seconds
ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)

And then

ar7240> bootm 0x9f420000

This will allow you to boot backup copy of system. After that you'll be able to mount main root filesystem:

mkdir /tmp/flash
And then mount it:

mount -t jffs2 mtd3 /tmp/flash

Then you can go to /tmp/flash/etc/init.d and repair the rcS.
**********************************************
I'll probably use unbuntu,as mostly use Windows and abit of Ubuntu

I had look at your steps, did you used Gedit for example to view and edit init.d file
For Example:
gedit /tmp/flash/etc/init.d
what needs to be changed in the init.d file?

As haven't had look what contains in the init.d file.

Did you just save the file and did you use any unmounts commands?

cheers

Hi,not stop autoboot ESC press serial.jpg run run run
 
I did range mod from Phantom 3 Standard range mod , let's do it together... and now my drone's RC doesn't create Wi-Fi access point. This topic is for those unfortunates who've done the same and don't know how to fix it. So please share your situation and ideas.
I used mac, filezilla and vim to change files. I defenitely forgot to do "chmod +x" which is thought to be crucial.
Today I brought my drone to the official repair service here in Moscow and I'm waiting now for their diagnosis, it should take up to 5 days thay said. It seemed that they have no special instruments for reuploading healthy firmware to RC and drone using service connectors or smth, but who knows..

UPDATE:

With common effort, the way to recover has been discovered. Basically, all you need is to connect to TX, RX, GND pins of Wi-Fi module board with UART TTL adapter and open serial console(see pictures here I bricked my p3s with ftp range mod - let's fix it together and here I bricked my p3s with ftp range mod - let's fix it together). Then you should prevent u-boot from loading linux kernel by pressing ESC key and type to u-boot console the next commands(thanks ElMalo):

MI124
DRAM: 32 MB
Flash: 8 MB
In: serial
Out: serial
Err: serial
Press ESC to abort autoboot in 1 seconds
ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)

And then

ar7240> bootm 0x9f420000

This will allow you to boot backup copy of system. After that you'll be able to mount main root filesystem:

mkdir /tmp/flash

And then mount it:

mount -t jffs2 mtd3 /tmp/flash

Then you can go to /tmp/flash/etc/init.d folder and repair the rcS.

In order to recover drone you should repeat all the steps but connect UART to gimbal's board. Here are the pictures of pins you need to connect with your UART adapter.


Thanks everyone who participated in the research!

Hi,
Thanks to everyone here, I can recover the wifi signal both rc and phantom. But sadly I still can't bind rc with phantom. My question, are the rcS file both in the rc and the drone the same? Or maybe there are a slightly differences between them? I just re write the content of all the rcS files (rcS, rcS_ap, rcS_aphand, rcS_cli) in the phantom same with rc. Would you please or anyone here upload the original rcS files from the phantom? I've got the original rcS files of the rc from Killabear.
Thank you very much
 
Last edited:
Hi,
Thanks to everyone here, I can recover the wifi signal both rc and phantom. But sadly I still can't bind rc with phantom. My question, are the rcS file both in the rc and the drone the same? Or maybe there are a slightly differences between them? I just re write the content of all the rcS files (rcS, rcS_ap, rcS_aphand, rcS_cli) in the phantom same with rc. Would you please or anyone here upload the original rcS files from the phantom? I've got the original rcS files from Killabear.
Thank you very much
If you had read the earlier pages in this thread, you would have seen the command that restores a working copy of the rcS file from the device itself. Read back a bit and I'm sure you'll find it :)
 
  • Like
Reactions: Yudhistira5
1. open your putty window,
means choose com port and speed press ok (uart has to be disconnected)
2. Conect your Uart(already soldered to a drone, or remote) to the USB
3. 'switch on' remote controller or a Drone
4. immediately press escape.
5. Fallow the instruction (1st post)

(cp2102 will work rx, tx, gnd, just them three need to be connected)

Hi,the ESC does not stop running longerserial.jpg
 
You have to change UART TTL adapter to another one. That is only way.

I got my RC and quad fixed today. Here is how it went down in putty window:

Code:
?H¦¦¦¦?1.1.4 (Aug  5 2015 - 17:33:50)

MI124
DRAM:  32 MB
Flash:  8 MB
In:  serial
Out:  serial
Err:  serial
Press ESC to abort autoboot in 1 seconds
ar7240>
nknown command 'ry 'help'
ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5  init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320  k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@812  8k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)
ar7240> bootm 0x9f420000
## Booting image at 9f420000 ...
  Image Name:  MIPS OpenWrt Linux-3.10.49
  Created:  2015-08-20  3:21:32 UTC
  Image Type:  MIPS Linux Kernel Image (lzma compressed)
  Data Size:  905320 Bytes = 884.1 kB
  Load Address: 80060000
  Entry Point:  80060000
  Verifying Checksum at 0x9f420040 ...OK
  Uncompressing Kernel Image ... OK

Starting kernel ...

[  0.000000] Linux version 3.10.49 (yello@ubuntu) (gcc version 4.8.3 (OpenWrt/  Linaro GCC 4.8-2014.04 r2635) ) #15 Thu Aug 20 11:21:27 CST 2015
[  0.000000] bootconsole [early0] enabled
[  0.000000] CPU revision is: 0001974c (MIPS 74Kc)
[  0.000000] SoC: Atheros AR9342 rev 2
[  0.000000] Clocks: CPU:560.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:40.00  0MHz
[  0.000000] Determined physical RAM map:
[  0.000000]  memory: 02000000 @ 00000000 (usable)
[  0.000000] User-defined physical RAM map:
[  0.000000]  memory: 02000000 @ 00000000 (usable)
[  0.000000] Initrd not found or empty - disabling initrd
[  0.000000] Zone ranges:
[  0.000000]  Normal  [mem 0x00000000-0x01ffffff]
[  0.000000] Movable zone start for each node
[  0.000000] Early memory node ranges
[  0.000000]  node  0: [mem 0x00000000-0x01ffffff]
[  0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[  0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32  bytes
[  0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pag  es: 8128
[  0.000000] Kernel command line:  board=DJI-WM305 console=ttyS0,115200 root=/  dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-  env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(roo  tfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)  mem=32M rootfstype=squashfs,jffs2 noinitrd
[  0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[  0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[  0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[  0.000000] Writing ErrCtl register=00000000
[  0.000000] Readback ErrCtl register=00000000
[  0.000000] Memory: 29180k/32768k available (2102k kernel code, 3588k reserve  d, 363k data, 220k init, 0k highmem)
[  0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[  0.000000] NR_IRQS:51
[  0.000000] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
[  0.070000] pid_max: default: 32768 minimum: 301
[  0.070000] Mount-cache hash table entries: 512
[  0.080000] NET: Registered protocol family 16
[  0.080000] MIPS: machine is DJI WM305
[  0.290000] ath_usb_init: id: 1122
[  0.360000] bio: create slab <bio-0> at 0
[  0.370000] Switching to clocksource MIPS
[  0.370000] NET: Registered protocol family 2
[  0.380000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[  0.380000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[  0.390000] TCP: Hash tables configured (established 512 bind 512)
[  0.390000] TCP: reno registered
[  0.400000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[  0.400000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[  0.410000] NET: Registered protocol family 1
[  0.430000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[  0.430000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT  Y) (c) 2001-2006 Red Hat, Inc.
[  0.440000] msgmni has been set to 56
[  0.450000] io scheduler noop registered
[  0.450000] io scheduler deadline registered (default)
[  0.460000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[  0.480000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[  0.490000] console [ttyS0] enabled, bootconsole disabled
[  0.490000] console [ttyS0] enabled, bootconsole disabled
[  0.500000] ar934x-hs-uart.0: ttyATH0 at MMIO 0x18500000 (irq = 14) is a AR93  4X UART
[  0.510000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[  0.520000] m25p80 spi0.0: found s25fl064k, expected m25p80
[  0.530000] m25p80 spi0.0: s25fl064k (8192 Kbytes)
[  0.530000] 10 cmdlinepart partitions found on MTD device ath-nor0
[  0.540000] Creating 10 MTD partitions on "ath-nor0":
[  0.540000] 0x000000000000-0x000000040000 : "u-boot"
[  0.550000] 0x000000040000-0x000000050000 : "u-boot-env"
[  0.560000] 0x000000050000-0x000000130000 : "kernel1"
[  0.560000] 0x000000130000-0x000000420000 : "rootfs1"
[  0.570000] 0x000000420000-0x000000500000 : "kernel2"
[  0.580000] 0x000000500000-0x0000007f0000 : "rootfs2"
[  0.580000] 0x0000007f0000-0x000000800000 : "art"
[  0.590000] 0x000000050000-0x000000420000 : "firmware1"
[  0.600000] 0x000000420000-0x0000007f0000 : "firmware2"
[  0.600000] 0x000000000000-0x000000800000 : "all"
[  0.610000] g_ether gadget: using random self ethernet address
[  0.620000] g_ether gadget: using random host ethernet address
[  0.620000] usb0: MAC -----------------------
[  0.630000] usb0: HOST MAC ------------------
[  0.630000] g_ether gadget: Ethernet Gadget, version: Memorial Day 2008
[  0.640000] g_ether gadget: g_ether ready
[  0.650000] TCP: cubic registered
[  0.650000] NET: Registered protocol family 17
[  0.650000] 8021q: 802.1Q VLAN Support v1.8
[  1.000000] g_ether gadget: high-speed config #1: CDC Ethernet (ECM)
[  1.550000] jffs2: notice: (1) jffs2_build_xattr_subsystem: complete building  xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 o  rphan) found.
[  1.560000] VFS: Mounted root (jffs2 filesystem) readonly on device 31:5.
[  1.570000] Freeing unused kernel memory: 220K (802c9000 - 80300000)
init started: BusyBox v1.22.1 (2015-06-29 19:28:31 CST)
starting pid 219, tty '': '/etc/init.d/rcS'
[  2.600000] Loading modules backported from Linux version master-2014-05-22-0  -gf2032ea
[  2.600000] Backport generated by backports.git backports-20140320-37-g5c33da  0
[  2.860000] cfg80211: Calling CRDA to update world regulatory domain
[  2.880000] cfg80211: World regulatory domain updated:
[  2.890000] cfg80211:  DFS Master region: unset
[  2.890000] cfg80211:  (start_freq - end_freq @ bandwidth), (max_antenna_gai  n, max_eirp), (dfs_cac_time)
[  2.900000] cfg80211:  (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 m  Bm), (N/A)
[  2.910000] cfg80211:  (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 m  Bm), (N/A)
[  2.920000] cfg80211:  (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 m  Bm), (N/A)
[  2.930000] cfg80211:  (5170000 KHz - 5250000 KHz @ 160000 KHz), (N/A, 2000  mBm), (N/A)
[  2.940000] cfg80211:  (5250000 KHz - 5330000 KHz @ 160000 KHz), (N/A, 2000  mBm), (0 s)
[  2.940000] cfg80211:  (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000  mBm), (0 s)
[  2.950000] cfg80211:  (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 m  Bm), (N/A)
[  2.960000] cfg80211:  (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0  mBm), (N/A)
## Error: "country" not defined
sh: GB: unknown operand
[  3.840000] cfg80211: Calling CRDA for country: US
[  3.850000] cfg80211: Regulatory domain changed to country: US
[  3.850000] cfg80211:  DFS Master region: FCC
[  3.860000] cfg80211:  (start_freq - end_freq @ bandwidth), (max_antenna_gai  n, max_eirp), (dfs_cac_time)
[  3.870000] cfg80211:  (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 m  Bm), (N/A)
[  3.870000] cfg80211:  (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 1700 m  Bm), (N/A)
[  3.880000] cfg80211:  (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2300 m  Bm), (0 s)
[  3.890000] cfg80211:  (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 m  Bm), (N/A)
[  3.900000] cfg80211:  (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 40  00 mBm), (N/A)
[  3.920000] ieee80211 phy0: Atheros AR9340 Rev:0 mem=0xb8100000, irq=47
Thu Aug 20 03:22:01 UTC 2015
now in bacup partitions,no restore firmware2
## Error: "country" not defined
Successfully initialized wpa_supplicant
[  5.650000] device usb0 entered promiscuous mode
[  5.650000] br-lan: port 1(usb0) entered forwarding state
[  5.660000] br-lan: port 1(usb0) entered forwarding state
[  5.670000] device wlan0 entered promiscuous mode
starting pid 460, tty '/dev/ttyS0': '/bin/ash --login'


BusyBox v1.22.1 (2015-06-29 19:28:31 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@dji:/# mkdir /tmp/flash
root@dji:/# mount -t jffs2 mtd3 /tmp/flash[  20.680000] br-lan: port 1(usb0) en  tered forwarding state

[  61.870000] jffs2: notice: (598) jffs2_build_xattr_subsystem: complete buildi  ng xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0  orphan) found.
root@dji:/# cd ./etc/init.d/
root@dji:/etc/init.d# cd /tmp/flash/ && rm -rf ./etc/init.d/rcS && cp -r /etc/in
it.d/rcS ./etc/init.d/ && chmod +x ./etc/init.d/rcS
root@dji:/tmp/flash#
 
Pictures:
 

Attachments

  • mod4.jpg
    mod4.jpg
    271.2 KB · Views: 444
  • mod1.jpg
    mod1.jpg
    278.2 KB · Views: 502
  • mod3.jpg
    mod3.jpg
    329.4 KB · Views: 606
  • mod2.jpg
    mod2.jpg
    242.9 KB · Views: 453

Recent Posts

Members online

No members online now.

Forum statistics

Threads
143,096
Messages
1,467,620
Members
104,981
Latest member
brianklenhart