People that want to downgrade their FW on their phantom 3's

notsolowki · Jan 2, 2017

mefistotelis commented 3 hours ago • edited
The updater code checks rollback possibility by the value of min rollback version which is saved on the "black box" sdcard below flight controller (this is my assumption, not proven fact). In the extracted firmware, this version is stored as "ver_rollbk" in the "*_head.ini".

For example, version 01.10.0090 cannot be rolled back:

ver_latest=01.10.0090
ver_rollbk=01.10.0090
The "P3X_FW_DEBUG" allows updating to any version, without checking if it's already current version or whether it meets rollback restriction.

i hate copying everything he says over to here you need to take a look at his page. i might add i have removed and re-formated my internal sdcard before for no reason and all was good.

notsolowki · Jan 2, 2017

digdat0 i been meaning to say thankyou for risking your drone. im glad you were willing to sacrifice your drone to help us out. but its not a dead end yet.

but lets not forget forcing fw downgrade with P3X_FW_DEBUG · Issue #4 · mefistotelis/phantom-firmware-tools · GitHub

ferraript · Jan 2, 2017

Digdat0 said:
I have removed the internal SD card

and what was stored on that card? (besides DAT flight records)
because I believe that all those talks about formatting it and flashing any firmware are just hoax

notsolowki · Jan 2, 2017

Yea ii think it is. There was a bunch of .dat files. There may have been one more. Be really careful cutting the glue not to scrape off the tiny resistors. And make sure u have hidden files viewable

notsolowki · Jan 2, 2017

When i removed mine i didnt re-glue it because the frame above the battery compartment was sufficient at holding the sdcards cover in place

dobmatt · Jan 2, 2017

notsolowki said:
When i removed mine i didnt re-glue it because the frame above the battery compartment was sufficient at holding the sdcards cover in place

So, what's the conclusion?

chazz · Jan 2, 2017

dobmatt said:
log file shows update failure for 1700 and 1701 modules as not recognized. Anybody know what is it?

Dont know if anyone answered your question.So here ya go..

P3X_FW_V01.10.0090_mi10.ini
# DJI Firmware Container module header file.
# Stores firmware for visual positioning module 'camera'
# Generated on 2016-12-30 20:05:54
target=m1700
version=01.01.0263
encrypt_type=0
splvalue=0
reserved2=0001

P3X_FW_V01.10.0090_mi11.ini
# DJI Firmware Container module header file.
# Stores firmware for visual positioning module 'sonar'
# Generated on 2016-12-30 20:05:54
target=m1701
version=01.00.0519
encrypt_type=0
splvalue=0
reserved2=0001

notsolowki · Jan 2, 2017

i never noticed where the compass plug in on the drone. what board is it connected to

dobmatt · Jan 2, 2017

notsolowki said:
i never noticed where the compass plug in on the drone. what board is it connected to

Main board, comes up on side from beneath between shell and board edge, look for 4 prone ribbon wire, 3 white+1 gray ...

dobmatt · Jan 2, 2017

chazz said:
Dont know if anyone answered your question.So here ya go..

P3X_FW_V01.10.0090_mi10.ini
# DJI Firmware Container module header file.
# Stores firmware for visual positioning module 'camera'
# Generated on 2016-12-30 20:05:54
target=m1700
version=01.01.0263
encrypt_type=0
splvalue=0
reserved2=0001

P3X_FW_V01.10.0090_mi11.ini
# DJI Firmware Container module header file.
# Stores firmware for visual positioning module 'sonar'
# Generated on 2016-12-30 20:05:54
target=m1701
version=01.00.0519
encrypt_type=0
splvalue=0
reserved2=0001

Chazz, do you believe I should try to fly without this module updated? I'm not using VPS feature at all, it's disabled from within Go app. Anything else looks normal, although the Status page demands firmware upgrade. This is my fault anyway, I attempt to FW update without VPS module physically plugged in ... and this fault is permanently burned in bird memory no matter what I do to fix it. I wonder if "button forced" firmware upgrade will overwrite this scar ...

Apilot101 · Jan 2, 2017

notsolowki said:
it could be possible that they didnt encrypt the video stream for the sake of performance and latency but instead encrypted the transmission of commands to the aircraft. i dont think the internal sdcard has much if anything at ll to do with the firmware. im thinking about tearing into my camera and looking for a debug console. maybe the firmware could be extracted and replaced from there but i doubt it

I was thinking based of what was said on Github, that there might be a small file on the sdcard that the firmware looks for and tells the FW if its ok to do updating

notsolowki · Jan 2, 2017

i cant remember but i think there was one more file on there that had hidden attributes.

quaddamage · Jan 2, 2017

yes, one file - "SYS.DJI". You don't even need to remove the card to get to it - just set your drone into flight logs mode. This really changes the drone into bulky SD card reader, so you can do whatever you want with the card.

notsolowki · Jan 2, 2017

hey digdat0 open a serial console from the flight data usb port with putty and post your window from boot

Digdat0 · Jan 2, 2017

notsolowki said:
hey digdat0 open a serial console from the flight data usb port with putty and post your window from boot

i've tried com 1-8 and usb .. not sure what to put in for the address? do i need to be in flight mode?

here's a screenshot of the internal sd

notsolowki · Jan 2, 2017

sorry i should have put that info in there. try 8n1 115200 and no flow control. also if you check device manager and goto your serial ports it will say somthing like COM18 etc

notsolowki · Jan 2, 2017

no flight mode. just power it on and try to catch the info as fast as you can. after a couple seconds pull the usb cable so you can copy the text

notsolowki · Jan 2, 2017

mine look somthing like this

▒▒[[0][0][1][804][1][10086]▒
U▒
▒▒[>end of db:[1]▒▒U0▒
▒ 1 compass calibration init!8GU;▒
▒ 1 [LED] changed: test led when startupuUB▒
▒ 1 app connect changed:last(255) != current(0)7▒UHW
▒ 1 assistant connect changed:last(255) != current(0)XRU8▒
▒▒dfilter_motor_pwm, butterworth first order▒CU7▒
▒▒d --fc: 100.000000 hz, delay: 1.591549 ms▒▒U2
▒ 1 [FDI MAGN[1]] event:turn on▒U2
▒ 1 [FDI GYRO[1]] event:turn on▒▒U1S
▒ 1 [FDI ACC[1]] event:turn on▒\U2
▒ 1 [FDI BARO[1]] event:turn on▒▒U,6
▒ 1 [FDI AHRS[1]]:turn onB▒U0▒
▒ 1 [FDI CTRL] event: turn onJ▒U?▒
▒ 1 temp cali (0.000000,0.000000) 0 fw:4 4
n▒U`▒
▒ 1 temp cali 0 bw:0.000000 0.000000 0.000000 ba:0.000000 0.000000 0.000000
▒tUF▒
▒ 1 app temp cali (22.000000,65.000000) aa fw:6 6
'▒Uh▒
▒ 1 app temp cali aa bw:0.000212 -0.000181 0.000096 ba:-0.000084 0.000284 -0.002604
▒JU%▒
▒ 1 ESC0 link up
▒|U5h
▒ 2 [Err] OFDM_TX State:0x00000004y▒U%▒
▒ 2 ESC1 link up
▒▒U5h
▒ 3 [Err] OFDM_TX State:0x00000000z▒U%▒
▒ 3 ESC2 link up
I^U%▒
▒ 3 ESC3 link up
▒U-▒
▒ 3 esc alive info = 0xf
▒▒U6=
▒ 4 Battery barcode:6171160823259
Q▒U]D
▒ 4 [esc_is_stall] status changed: last(0xffffffff) != current(0x00000000)▒eU]D
▒ 4 [esc_is_empty] status changed: last(0xffffffff) != current(0x00000000)▒▒UQ
▒ 4 ESC0 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ▒U1S
▒ 4 Loader = [V01.00.02.02] U3▒
▒ 4 Firmware = [V01.10.00.00]
QUQ
▒ 5 ESC1 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ▒7U1S
▒ 5 Loader = [V01.00.02.02] ,▒U3▒
▒ 5 Firmware = [V01.10.00.00]
2▒UQ
▒ 5 ESC2 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ▒▒U1S
▒ 5 Loader = [V01.00.02.02] ,▒U3▒
▒ 5 Firmware = [V01.10.00.00]
2▒UQ
▒ 6 ESC3 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ▒ U1S
▒ 6 Loader = [V01.00.02.02] n▒U3▒
▒ 6 Firmware = [V01.10.00.00]
▒U1S
▒ 10 [FDI GPS[1]] event:turn on$▒U1S
▒ 12 received on/off 2 from app▒▒U@!
▒ 12 CTRL reset all by APP.mission.request.offHU▒
▒ 12 ack on/off 0 to app▒U1S
▒ 16 received on/off 2 from appNU@!
▒ 16 CTRL reset all by APP.mission.request.off-YU▒
▒ 16 ack on/off 0 to appۭU-▒
▒▒tgimbal pitch 0, roll 0, yaw 0loU4▒
▒ 101 [FDI AHRS[1]]:ahrs_init beginK▒U5h
▒ 102 [FDI AHRS[1]]:bias fdi turn onUU5h
▒ 102 [FDI AHRS[1]]:init fdi turn on▒-U

▒ 102 [FDI AHRS[1]]:wait for sensor checkv▒UHW
▒ 111 [LED] changed: temperature not ready when startup▒U

▒ 121 Battery name :ATL NVT DJ005
▒▒U2
▒ 121 manufacture Date:2016/3/3
▒)U-▒
▒ 121 Serial number :354
K▒U-▒
▒▒tgimbal pitch 0, roll 0, yaw 0loU<▒
▒▒dfilter_rc_input_roll, butterworth first order▒-U7▒
▒▒d --fc: 10.000000 hz, delay: 15.915494 ms▒▒U=
▒▒dfilter_rc_input_pitch, butterworth first orderSU7▒
▒▒d --fc: 10.000000 hz, delay: 15.915494 ms▒▒U;▒
▒▒dfilter_rc_input_yaw, butterworth first order2▒U7▒
▒▒d --fc: 10.000000 hz, delay: 15.915494 ms▒▒U@!
▒▒dfilter_rc_input_throttle, butterworth first ordervIU7▒
▒▒d --fc: 10.000000 hz, delay: 15.915494 ms▒▒UE▒
▒ 155 old.IOC reset intelligence_orientation_enabled7UE▒
▒ 155 [BATTERY]:reset default smart cfg - L1:1 L2:2▒.UfJ
▒ 155 [smart_battery]this fireware calc gohme speed:7.800000 - land speed:2.500000
%AU7▒
▒ 155 CTRL reset all by rc mode switch▒U=
▒ 155 [Ctrl<1>] REQ_RC_NORMAL ATTI ctrl_atti▒U0▒
▒ 162 Eeprom write offset:1d0
&U-▒
▒ 183 [LED] changed: no attiTJUK
▒ 190 counter: 0 timeout_counter0
check_comm_state 1
WU>K
▒ 190 gps init: nack:0 ack:18 false_flag:0
▒▒U-▒
▒▒tgimbal pitch 0, roll 0, yaw 0loU-▒