dji-firmware-tools icon indicating copy to clipboard operation
dji-firmware-tools copied to clipboard

Serial Connection to Flight Controller

Open notsolowki opened this issue 7 years ago • 26 comments

anything you can think of. im staring at a fresh extraction of 1.6 looking for options

notsolowki avatar Jan 03 '17 01:01 notsolowki

Thats what i get from the serial port on the drone
serial log - Click to expand
101 [FDI AHRS[1]]:ah___i+i+ begi+KÎU5h
                                                ÿÿ    102 [FDI AHRS[1]]:bia_ fdi ++_+ -+UU5h
            ÿÿ    102 [FDI AHRS[1]]:i+i+ fdi ++_+ -+Š-U:-
                                                         ÿÿ    102 [FDI AHRS[1]]:+ai+ f-_ _e+_-_ chec++ÙUHW
                           ÿÿ    111 [LED] cha+ged: +e+-e_a++_e +-+ _eady +he+ _+a_++-ûºU:-
           ÿÿ    121 Ba++e_y +a+e    :ATL  NVT  DJ005
ÙU2
    ÿÿ    121 +a++fac++_e Da+e:2016/3/3
Ó)U-ò
     ÿÿ    121 Se_ia+ +++be_   :354
KªU-ò
     ÿÿ+gi+ba+   -i+ch 0, _-++ 0, ya+ 0+-U] REQ_RC_NORMAL ATTI c+_+_a++ióU0—
                       ÿÿ    161 Ee-_-+ +_i+e -ff_e+:1d0
'|U-ò
     ÿÿ    183 [LED] cha+ged: +- a++iTJU-ò
                                          ÿÿ+gi+ba+      -i+ch 0, _-++ 0, ya+ 0+-UK
   ÿÿ    233 c-+++e_: 0 +i+e-++_c-+++e_0 
 chec+_c-++__+a+e 0 
¦˜U>K
     ÿÿ    233 g-_ i+i+: +ac+:0 ac+:18 fa+_e_f+ag:0
 h/UD
     ÿÿ    243 [FDI AHRS[1]]:(+|yz)+ai+ f-_ _+a+ic +he+ i+i+•9U-ò
                                                                 ÿÿ+gi+ba+      -i+ch 0, _-++ 0, ya+ 0+-U-ò
                           ÿÿ+gi+ba+     -i+ch 0, _-++ 0, ya+ 0+-U-ò
                                                                    ÿÿ+gi+ba+   -i+ch 0, _-++ 0, ya+ 0+-U3Â
                           ÿÿ    450 [FDI AHRS[1]]:ah___i+i+ -a__ÙU;´
                                                                     ÿÿ    451 [FDI AHRS[1]]:e+a++a+i-+ fdi ++_+ -+§ÛU8á
                                        ÿÿ    463 [LED] cha+ged: _c c-+-+e+e+y +-_+yTU0—
        ÿÿ+gi+ba+        -i+ch 0, _-++ 0, ya+ -119h/U0—
                                                       ÿÿ+gi+

The string you've inserted looks unencrypted, just garbled a bit by not fully matched transmission parameters.

The strings match to messages within the flight controller firmware. Looks like all the messages which go to flight log are also sent to the serial port.

mefistotelis avatar Jan 03 '17 01:01 mefistotelis

ive tried alot of different parameters only thing i could get any english on was 115200 8n1 what do you suppose i do. i see in the ubifs drivers for a pl2303. i cant send any break commands or any command for that matter though that usb port.

notsolowki avatar Jan 03 '17 01:01 notsolowki

Maybe there's parity in the transmission. But first we need to gen an ungarbled output, then we may look into input.

Maybe try 7n2 ?

mefistotelis avatar Jan 03 '17 02:01 mefistotelis

serial log - Click to expand
7n2

U4¬ ÿÿ 0 ee--+ +-ad 4 128 132 136ðU4¬ ÿÿ 0 ee-_-+ +-ad 5 264 128 136‚U4¬ ÿÿ 0 ee-_-+ +-ad 6 400 12 16¯U4¬ ÿÿ 0 ee-_-+ +-ad 7 416 40 48·U4¬ ÿÿ 0 ee-_-+ +-ad 8 464 9 16(KU4¬ ÿÿ 0 ee-_-+ +-ad 9 480 1 8bõU4¬ ÿÿ 0 ee-_-+ +-ad 10 488 6 16ÐãU4¬ ÿÿ 0 ee-_-+ +-ad 11 504 4 8%ÝU4¬ ÿÿ 0 ee-_-+ +-ad 12 512 52 56¸]U4¬ ÿÿ 0 ee-_-+ +-ad 13 568 8 16Œ4¬ ÿÿ 0 ee-_-+ +-ad 14 584 7 16IMU4¬ ÿÿ 0 ee-_-+ +-ad 15 600 12 16ÜU4¬ ÿÿ 0 ee-_-+ +-ad 16 616 38 48æ¯U4¬ ÿÿ 0 ee-_-+ +-ad 17 664 12 16„äU4¬ ÿÿ 0 ee-_-+ +-ad 18 680 56 64<çU4¬ ÿÿ 0 ee-_-+ +-ad 19 744 32 40+U4¬ ÿÿ 0 ee-_-+ +-aìU4¬ 784 1 8 ÿÿ 0 ee-_-+ +-ad 21 792 16 240zU4¬ ÿÿ 0 ee-_-+ +-ad 22 816 16 24ÛýU4¬ ÿÿ 0 ee-_-+ +-ad 23 840 1 8R}U4¬ ÿÿ 0 ee-_-+ +-ad 24 848 1 8“U4¬ ÿÿ 0 ee-_-+ +-ad 25 856 10 16[U4¬ ÿÿ 0 ee-_-+ +-ad 26 872 36 40©U4¬ ÿÿ 0 ee-_-+ +-ad 27 912 52 56iU4¬ ÿÿ 0 ee-_-+ +-ad 28 968 44 48–éU4¬ ÿÿ 0 ee-_-+ +-ad 29 1016 28 32âJU4¬ ÿÿ 0 ee-_-+ +-ad 30 1048 18 24–¸U4¬ ÿÿ 0 ee-_-+ +-ad 31 1072 16 24(U4¬ ÿÿ 0 ee-_-+ +-ad 32 1096 72 80$KU4¬ ÿÿ 0 ee-_-+ +-ad 33 1176 24 32ýÀU4¬ ÿÿ 0 ee-_-+ +-ad 34 1208 64 723SU4¬ ÿÿ 0 ee-_-+ +-ad 35 1280 24 32U4¬ ÿÿ 0 ee-_-+ +-ad 36 1312 96 104ûU8á ÿÿdfi++e_-a+g++a__+e+, b+++e_+-_+h 2+d -_de_çŸU7ù ÿÿd --fc: 20.000000 hz, de+ay: 11.252254 +_!–UD ÿÿdfi++e_-a+g++a__acc, +_ac+i+g diffe_e++ia+-_ 2+d -_de_î¿UK ÿÿd --fc1: 15.000000 hz, fc2: 30.000000 hz, de+ay: 15.003007 +_ç+U7ù ÿÿdfi++e_-+i+ea__acc, b+++e_+-_+h 2+d -_de_$U7ù ÿÿd --fc: 15.000000 hz, de+ay: 15.003007 +_×½UŠ ÿÿd+-+-_ i+i+ c-ef0TUI“ ÿÿd0 _-++:-0.707107 -i+ch:0.707107 ya+:1.000000 +if+:1.000000­úUI“ ÿÿd1 _-++:0.707107 -i+ch:0.707107 yUK ÿÿd3 _-++:-0.707107 -i+ch:-0.707107 ya+:-1.000000 +if+:1.000000IU/c ÿÿdc_af+ c-+fig+_a+i-+ +-+-_ c-ef ›+UI“ ÿÿd0 _-++:-0.707107 -i+ch:0.707107 ya+:0.000000 +if+:1.000000d_UI“ ÿÿd1 _-++:0.707107 -i+ch:0.707107 ya+:-0.000000 +if+:1.000000î;UI“ ÿÿd2 _-++:0.707107 -i+ch:-0.707107 ya+:0.000000 +if+:1.000000{UK ÿÿd3 _-++:-0.707107 -i+ch:-0.707107 ya+:-0.000000 +if+:1.000000€ŠUHW ÿÿd4 _-++:0.000000 -i+ch:0.000000 ya+:0.000000 +if+:0.000000ÎUHW ÿÿd5 _-++:0.00UI“ ÿÿd2 _-++:0.353553 -i+ch:-0.353553 ya+:0.000000 +if+:0.2500003JUK ÿÿd3 _-++:-0.353553 -i+ch:-0.353553 ya+:-0.000000 +if+:0.250000¢ýUHW ÿÿd4 _-++:0.000000 -i+ch:0.000000 ya+:0.000000 +if+:0.000000ÎUHW ÿÿd5 _-++:0.000000 -i+ch:0.000000 ya+:0.000000 +if+:0.000000„ãUHW ÿÿd6 _-++:0.000000 -i+ch:0.000000 ya+:0.000000 +if+:0.000000KôUHW ÿÿd7 _-++:0.000000 -i+ch:0.000000 ya+:0.000000 +if+:0.000000UN ÿÿdc_af+ +-de+ i+f-®ªU2 ÿÿdI|:0.005591 Iy:0.005591 Iz:0.011U5h ÿÿ 0 +i_ ca+i 55 55 674d fff0 c++:0 ,U#. ÿÿ 0 i++ _+a++_:0-U\€ ÿÿ 0 [ha_dfa+++]:******************chec+ fa+++ i+f- a+d +_ace ************ì¥U]D ÿÿ 0 [ha_dfa+++]:-----fa+++ i_ ++++: add_(0|40024000),f+ag(0|00723b69)-----ÖÃU]D ÿÿ 0 [ha_dfa+++]:-----fa+++ i_ ++++: add_(0|400241a0),f+ag(0|da2e493b)-----æÒUb- ÿÿ 0 [ha_dfa+++]:-----+a_+ i+f- i_ ++++: add_(0|40024340),f+ag(0|cc8ad971)-----ÎÚUcµ ÿÿ 0 [ha_dfa+++]:-----+_ace i+f-Ucµ ÿÿ 0 [ha_dfa+++]:-----+_ace i+f- i_ ++++: add_(0|40024790),f+ag(0|a3abfa90)-----ËùUe ÿÿ 0 [ha_dfa+++]:-----+dg_+i+e_i+f- i_ ++++: add_(0|40024a50),f+ag(0|add18bec)-----¬U( ÿÿ 0 _+a_++-:4.56725 ½\U&Ñ ÿÿ 0 B-a_d:"++320+2"¯U)É ÿÿ[> ai_--_+ +i+i+ i+i+ed [1]üšU.§ ÿÿ 1 ai_--_+ +i+i+ i+i+ed[1]/{U' ÿÿ[[0][0][1][804][1][10086]¹ Uß ÿÿ[>e+d -f db:[1]üòU0— ÿÿ 1 c-+-a__ ca+ib_a+i-+ i+i+!8GU;´ ÿÿ 1 [LED] cha+ged: +e_+ +ed +he+ _+a_++-+UB° ÿÿ 1 a-- c-++ec+ cha+ged:+a_+(255) != c+__e++(0)7ÅUHW ÿÿ 1 a__i_+a++ c-++ec+ cha+ged:+a_+(255) != c+__e++(0)XRU8á ÿÿdfi++e__+-+-__-++, b+++e_+-_+h fi__+ -_de_ŸCU7ù ÿÿd --fc: 100.000000 hz, de+ay: 1.591549 +_ºªU2 ÿÿ 1 [FDI MAGN[1]] e+e++:++_+ -+œU2 ÿÿ 1 [FDI GYRO[1]] e+e++:++_+ -+­˜U1S ÿÿ 1 [FDI ACC[1]] e+e++:++_+ -+ó\U2 ÿÿ 1 [FDI BARO[1]] e+e++:++_+ -+¥U,6 ÿÿ 1 [FDI AHRS[1]]:++_+ -+BU0— ÿÿ 1 [FDI CTRL] e+e++: ++_+ -+JãU? ÿÿ 1 +e+- ca+i (0.000000,0.000000) 0 f+:4 4 +øUà ÿÿ 1 +e+- ca+i 0 b+:0.000000 0.000000 0.000000 ba:0.000000 0.000000 0.000000 +UF‹ ÿÿ 1 a-- +e+- ca+i (22.000000,65.000000) aa f+:6 6 'ÑUh– ÿÿ 1 a-- +e+- ca+i aa b+:0.000212 -0.000181 0.000096 ba:-0.000084 0.000284 -0.002604 ÑJU@! ÿÿ 2 a-- c-++ec+ cha+ged:+a+(0) != c+e++(1)O¾U]D ÿÿ 4 [e_c_i_+a++] +a++ cha+ged: +a_+(0|ffffffff) != c+e++(0|00000000)½eU]D ÿÿ 4 [e_c_i__e+-+y] +a++ cha+ged: +a+(0|ffffffff) != c+e++(0|00000000)‡åU1S ÿÿ 10 [FDI GPS[1]] e+e++:+++ -+$ßU1S ÿÿ 13 ecei+ed -+/-ff 2 f-+ a--ˆU@! ÿÿ 13 CTRL e_e+ a++ by APP.+i__i-+.e-+e+.-ffTÈUœ ÿÿ 13 ac+ -+/-ff 0 +- a--бU1S ÿÿ 18 ecei+ed -+/-ff 2 f-+ a--5ëU@! ÿÿ 18 CTRL _e_e+ a++ by APP.+i__i-+.e-+e+.-ffðbUœ ÿÿ 18 ac+ -+/-ff 0 +- a--› UN ÿÿ+i+ez-+e e+:-60GAU' ÿÿ -+e_y ha_h fai+ 6ad4c516|¼U%„ ÿÿ 43 ESC0 +i++ +- ÒQU%„ ÿÿ 44 ESC1 +i++ +- ª¤U%„ ÿÿ 44 ESC2 +i++ +- D#U%„ ÿÿ 45 ESC3 +i++ +- ¶U-ò ÿÿ 45 e_c a+i+e i+f- = 0|f TFUQ ÿÿ 93 ESC0 +e__i-+: P-+-c-+ = [V1.0] Ha_d+a_e = "WM320_ESC_V9" ºU1S ÿÿ 93 L-ade = [V01.00.02.02] ÀåU3 ÿÿ 93 Fi++a_e = [V01.10.00.00] ¾€UQ ÿÿ 93 ESC1 +e__i-+: P-+-c-+ = [V1.0] Ha_d+a_e = "WM320_ESC_V9" YTU1S ÿÿ 93 L-ade = [V01.00.02.02] ÀåU3 ÿÿ 93 Fi++a_e = [V01.10.00.00] ¾€UQ ÿÿ 94 ESC2 +e__i-+: P_-+-c-+ = [V1.0] Ha_d+a_e = "WM320_ESC_V9" YÒU1S ÿÿ 94 L-ade_ = [V01.00.02.02] +U3 ÿÿ 94 Fi_++a_e = [V01.10.00.00] ËUQ ÿÿ 94 ESC3 +e__i-+: P_-+-c-+ = [V1.0] Ha_d+a_e = "WM320_ESC_V9" º•U1S ÿÿ 94 L-ade_ = [V01.00.02.02] +U3 ÿÿ 94 Fi_++a_e = [V01.10.00.00] ËU-ò ÿÿ+gi+ba+ -i+ch 0, -++ 0, ya+ 0+-U4¬ ÿÿ 101 [FDI AHRS[1]]:ah___i+i+ begi+KÎU5h ÿÿ 102 [FDI AHRS[1]]:bia fdi +++ -+UU5h ÿÿ 102 [FDI AHRS[1]]:i+i+ fdi +++ -+Š-U:- ÿÿ 102 [FDI AHRS[1]]:+ai+ f-_ e+-_ chec++ÙUHW ÿÿ 111 [LED] cha+ged: +e+-e_a++e +-+ eady +he+ +a++-ûºU6= ÿÿ 111 Ba++e_y ba_c-de:6171160823259 U4U<Ú ÿÿdfi++e___c_i+-++__-++, b+++e+-+h fi__+ -de_Õ-U7ù ÿÿd --fc: 10.000000 hz, de+ay: 15.915494 +¢¶U= ÿÿdfi++e___c_i+-++-i+ch, b+++e+-+h fi__+ -de_SU7ù ÿÿd --fc: 10.000000 hz, de+ay: 15.915494 +¢¶U;´ ÿÿdfi++e___c_i+-++ya+, b+++e+-+h fi_+ -de_2ÀU7ù ÿÿd --fc: 10.000000 hz, de+ay: 15.915494 +¢¶U@! ÿÿdfi++e___c_i+-+++h-+++e, b+++e+-_+h fi__+ -de+IU7ù ÿÿd --fc: 10.000000 hz, de+ay: 15.915494 +¢¶UEÞ ÿÿ 155 -+d.IOC e_e+ i++e++ige+ce_UfJ ÿÿ 155 [+a+ba++e_y]+hi fi_e+a_e ca+c g-h+e _-eed:7.800000 - +a+d _-eed:2.500000 %AU7ù ÿÿ 155 CTRL _e_e+ a++ by c +-de +i+chæU= ÿÿ 155 [C++<1>] REQ_RC_NORMAL ATTI c++a++ióU0— ÿÿ 161 Ee--+ +i+e -ff_e+:1d0 '|U-ò ÿÿ 183 [LED] cha+ged: +- a++iTJUD ÿÿ 198 [FDI AHRS[1]]:(+|yz)+ai+ f- _+a+ic +he+ i+i+CU-ò ÿÿ+gi+ba+ -i+ch 0, -++ 0, ya+ 0+-U:- ÿÿ 228 Ba++e_y +a+e :ATL NVT DJ005 U2 ÿÿ 228 +a++fac++e Da+e:2016/3/3 ŸU-ò ÿÿ 228 Se_ia+ +++be :354 0{UK ÿÿ 235 c-+++e: 0 +i+e-++_c-+++e_0 chec+c-++__+a+e 0 ú*U>K ÿÿ 235 g- i+i+: +ac+:0 ac+:18 fa+_e_f+ag:0 ³øU-ò

notsolowki avatar Jan 03 '17 02:01 notsolowki

this is 57600

serial log - Click to expand
U4¬
   ÿÿ      0 ee-_-+ +-ad  5  264  128  136‚U4¬
                                              ÿÿ      0 ee-_-+ +-ad  6  400   12   16¯U4¬
         ÿÿ      0 ee-_-+ +-ad  7  416   40   48·U4¬
                                                    ÿÿ      0 ee-_-+ +-ad  8  464    9   16(KU4¬
                ÿÿ      0 ee-_-+ +-ad  9  480    1    8bõU4¬
                                                            ÿÿ      0 ee-_-+ +-ad 10  488    6   16ÐãU4¬
                        ÿÿ      0 ee-_-+ +-ad 11  504    4    8%ÝU4¬
                                                                    ÿÿ      0 ee-_-+ +-ad 12  512   52   56¸]U4¬
                                ÿÿ      0 ee-_-+ +-ad 13  568    8   16Œ4¬
                                                                          ÿÿ      0 ee-_-+ +-ad 14  584    7   16IMU4¬
                                      ÿÿ      0 ee-_-+ +-ad 15  600   12   16ÜU4¬
 ÿÿ      0 ee-_-+ +-ad 16  616   38   48æ¯U4¬
                                             ÿÿ      0 ee-_-+ +-ad 17  664   12   16„äU4¬
         ÿÿ      0 ee-_-+ +-ad 18  680   56   64 ai_--_+ +i+i+ i+i+ed [1]üšU.§
                                                                    ÿÿ      1 ai_--_+ +i+i+ i+i+ed[1]/{U'
                         ÿÿ[[0][0][1][804][1][10086]¹
                                                     Uß
                                                       ÿÿ[>e+d -f db:[1]üòU0—
                                                                             ÿÿ      1 c-+-a__ ca+ib_a+i-+ i+i+!8GU;´
                                     ÿÿ      1 [LED] cha+ged: +e_+ +ed +he+ _+a_++-+UB°
       ÿÿ      1 a-- c-++ec+ cha+ged:+a_+(255) != c+__e++(0)7ÅUHW
                                                                 ÿÿ      1 a__i_+a++ c-++ec+ cha+ged:+a_+(255) != c+__e++(0)XRU8á
                                                 ÿÿdfi++e__+-+-__-++, b+++e_+-_+h fi__+ -_de_ŸCU7ù
                  ÿÿd --fc: 100.000000 hz, de+ay: 1.591549 +_ºªU2
                                                                 ÿÿ      1 [FDI MAGN[1]] e+e++:++_+ -+œU2
                         ÿÿ      1 [FDI GYRO[1]] e+e++:++_+ -+­˜U1S
                                                                   ÿÿ      1 [FDI ACC[1]] e+e++:++_+ -+ó\U2
                           ÿÿ      1 [FDI BARO[1]] e+e++:++_+ -+¥U,6
                                                                     ÿÿ      1 [FDI AHRS[1]]:++_+ -+BU0—
                         ÿÿ      1 [FDI CTRL] e+e++: ++_+ -+JãU?
                                                                 ÿÿ      1 +e+- ca+i (0.000000,0.000000) 0 f+:4 4
+øU`à
     ÿÿ      1 +e+- ca+i 0 b+:0.000000 0.000000 0.000000 ba:0.000000 0.000000 0.000000
+UF‹
     ÿÿ      1 a-- +e+- ca+i (22.000000,65.000000) aa f+:6 6
'ÑUh–
     ÿÿ      1 a-- +e+- ca+i aa b+:0.000212 -0.000181 0.000096 ba:-0.000084 0.000284 -0.002604
ÑJU]D
     ÿÿ      4 [e_c_i___+a++] _+a++_ cha+ged: +a_+(0|ffffffff) != c+__e++(0|00000000)½eU]D
          ÿÿ      4 [e_c_i__e+-+y] _+a++_ cha+ged: +a_+(0|ffffffff) != c+__e++(0|00000000)‡åU1S
               ÿÿ     10 [FDI GPS[1]] e+e++:++_+ -+$ßU1S
                                                        ÿÿ     12 _ecei+ed -+/-ff 2 f_-+ a--¹àU@!
                 ÿÿ     12 CTRL _e_e+ a++ by APP.+i__i-+._e-+e_+.-ffHU*œ
                                                                        ÿÿ     12 ac+ -+/-ff 0 +- a--U1S
                         ÿÿ     17 _ecei+ed -+/-ff 2 f_-+ a--åU@!
                                                                 ÿÿ     17 CTRL _e_e+ a++ by APP.+i__i-+._e-+e_+.-ff+ÙU*œ
                                         ÿÿ     17 ac+ -+/-ff 0 +- a--†UN
                                                                         ÿÿ+i+ez-+e _e+:-60GAU'
               ÿÿ
                 -+e_y ha_h fai+ 6ad4c516|¼U%„
                                              ÿÿ     47 ESC0 +i++ +-
îU%„
    ÿÿ     48 ESC1 +i++ +-
îdU%„
     ÿÿ     48 ESC2 +i++ +-
ãU%„
    ÿÿ     49 ESC3 +i++ +-
Z+U-ò
     ÿÿ     49 e_c a+i+e i+f- = 0|f
`+UQ
        ÿÿ     97 ESC0 +e__i-+: P_-+-c-+ = [V1.0] Ha_d+a_e = "WM320_ESC_V9" [ÅU1S
 ÿÿ     97 L-ade_   = [V01.00.02.02] 7U3Â
                                         ÿÿ     97 Fi_++a_e = [V01.10.00.00] 
]ŒUQ
        ÿÿ     98 ESC1 +e__i-+: P_-+-c-+ = [V1.0] Ha_d+a_e = "WM320_ESC_V9" NiU1S
 ÿÿ     98 L-ade_   = [V01.00.02.02] }U3Â
                                         ÿÿ     98 Fi_++a_e = [V01.10.00.00] 
5ÞUQ
        ÿÿ     98 ESC2 +e__i-+: P_-+-c-+ = [V1.0] Ha_d+a_e = "WM320_ESC_V9" +¡U1S
 ÿÿ     98 L-ade_   = [V01.00.02.02] }U3Â
                                         ÿÿ     98 Fi_++a_e = [V01.10.00.00] 
5ÞUQ
        ÿÿ     99 ESC3 +e__i-+: P_-+-c-+ = [V1.0] Ha_d+a_e = "WM320_ESC_V9" 4‘U1S
 ÿÿ     99 L-ade_   = [V01.00.02.02] LîU3Â
                                          ÿÿ     99 Fi_++a_e = [V01.10.00.00] 
4¬
  ÿÿ    101 [FDI AHRS[1]]:ah___i+i+ begi+KÎU5h
                                              ÿÿ    102 [FDI AHRS[1]]:bia_ fdi ++_+ -+UU5h
          ÿÿ    102 [FDI AHRS[1]]:i+i+ fdi ++_+ -+Š-U:-
                                                       ÿÿ    102 [FDI AHRS[1]]:+ai+ f-_ _e+_-_ chec++ÙUHW
                         ÿÿ    111 [LED] cha+ged: +e+-e_a++_e +-+ _eady +he+ _+a_++-ûºU6=
         ÿÿ    115 Ba++e_y ba_c-de:6171160823259
0{U@!
     ÿÿ    127 a-- c-++ec+ cha+ged:+a_+(0) != c+__e++(1)MU] REQ_RC_NORMAL ATTI c+_+_a++ióU0—
                                                             ÿÿ    161 Ee-_-+ +_i+e -ff_e+:1d0
'|U-ò
     ÿÿ    183 [LED] cha+ged: +- a++iTJU-ò
                                          ÿÿ+gi+ba+      -i+ch 0, _-++ 0, ya+ 0+-

notsolowki avatar Jan 03 '17 02:01 notsolowki

could i look into the ubifs and check what the settings are for the console. or do you have any way to verify them?

notsolowki avatar Jan 03 '17 02:01 notsolowki

Most upper case chars (codes 65-90) are OK. Same with numbers (48-57). Lower case (97-122) - there are issues with k, l, n, o, r, t, u; but no problem with a, b, c, d, e, f, g, h, i, z. if not the "z", I would say there are issues with ASCII codes above 106. Example - string:

"[ha_dfa+++]:******************chec+ fa+++ i+f- a+d +ace ************"

Should be:

"[hardfault]:******************check fault info and trace *******"

Pleae note, these messages come from the flight controller, not from Ambarella. The flight controller doesn't use UBIFS.

mefistotelis avatar Jan 03 '17 02:01 mefistotelis

how did you do that. im using secureCrt. your very good observing the details.

notsolowki avatar Jan 03 '17 02:01 notsolowki

so i take it the flight controller has been disassembled?

notsolowki avatar Jan 03 '17 02:01 notsolowki

You can disassemble it from P3X_FW_V01.07.0060_mi01.bin - the only unencrypted one. It can be converted to ELF by arm_bin2elf.py, then it's easy to open it with IDA Pro.

mefistotelis avatar Jan 03 '17 02:01 mefistotelis

this is what i get from putty U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒ ▒▒tgimbal pitch 0, roll 0, yaw -179▒▒U0▒

notsolowki avatar Jan 03 '17 02:01 notsolowki

serial log - Click to expand
   ▒      0 eeprom load  5  264  128  136▒U4▒
                                             ▒      0 eeprom load  6  400   12   16▒U4▒
       ▒      0 eeprom load  7  416   40   48▒U4▒
                                                 ▒      0 eeprom load  8  464    9   16(KU4▒
            ▒      0 eeprom load  9  480    1    8b▒U4▒
                                                       ▒      0 eeprom load 10  488    6   16▒▒U4▒
                  ▒      0 eeprom load 11  504    4    8%▒U4▒
                                                             ▒      0 eeprom load 12  512   52   56▒]U4▒
                        ▒      0 eeprom load 13  568    8   16▒4▒
                                                                 ▒      0 eeprom load 14  584    7   16IMU4▒
                            ▒      0 eeprom load 15  600   12   16▒U4▒
                                                                      ▒      0 eeprom load 16  616   38   48▒U4▒
                                ▒      0 eeprom load 17  664   12   16▒▒U4▒
                                                                           ▒      0 eeprom load 18  680   56   64 airport limit inited [1]▒U.▒
                                     ▒      1 airport limit inited[1]/{U'
                                                                         ▒▒[[0][0][1][804][1][10086]▒
                     U▒
                       ▒▒[>end of db:[1]▒▒U0▒
                                             ▒      1 compass calibration init!8GU;▒
    ▒      1 [LED] changed: test led when startupuUB▒
                                                     ▒      1 app connect changed:last(255) != current(0)7▒UHW
                              ▒      1 assistant connect changed:last(255) != current(0)XRU8▒
             ▒▒dfilter_motor_pwm, butterworth first order▒CU7▒
                                                              ▒▒d --fc: 100.000000 hz, delay: 1.591549 ms▒▒U2
                             ▒      1 [FDI MAGN[1]] event:turn on▒U2
                                                                    ▒      1 [FDI GYRO[1]] event:turn on▒▒U1S
                             ▒      1 [FDI ACC[1]] event:turn on▒\U2
                                                                    ▒      1 [FDI BARO[1]] event:turn on▒▒U,6
                             ▒      1 [FDI AHRS[1]]:turn onB▒U0▒
                                                                ▒      1 [FDI CTRL] event: turn onJ▒U?▒
                       ▒      1 temp cali (0.000000,0.000000) 0 fw:4 4
n▒U`▒
     ▒      1 temp cali 0 bw:0.000000 0.000000 0.000000 ba:0.000000 0.000000 0.000000
▒tUF▒
     ▒      1 app temp cali (22.000000,65.000000) aa fw:6 6
'▒Uh▒
     ▒      1 app temp cali aa bw:0.000212 -0.000181 0.000096 ba:-0.000084 0.000284 -0.002604
▒JU@!
     ▒      2 app connect changed:last(0) != current(1)O▒U]D
                                                            ▒      4 [esc_is_stall] status changed: last(0xffffffff) != current(0x00000000)▒eU]D
                                                                ▒      4 [esc_is_empty] status changed: last(0xffffffff) != current(0x00000000)▒▒U1S
                                                                    ▒     10 [FDI GPS[1]] event:turn on$▒U1S
                            ▒     16 received on/off 2 from appNU@!
                                                                   ▒     16 CTRL reset all by APP.mission.request.off-YU*▒
                                          ▒     16 ack on/off 0 to appۭU'
                                                                        ▒▒
                                                                          query hash fail 6ad4c516|▒UN
                      ▒▒timezone set:-60GAU1S
                                             ▒     21 received on/off 2 from app▒U@!
    ▒     21 CTRL reset all by APP.mission.request.off▒▒U*▒
                                                           ▒     21 ack on/off 0 to app1yU%▒
            ▒     34 ESC0 link up
h▒U%▒
     ▒     35 ESC1 link up
2NU%▒
     ▒     35 ESC2 link up
▒▒U%▒
     ▒     36 ESC3 link up
▒|U-▒

notsolowki avatar Jan 03 '17 02:01 notsolowki

serial log - Click to expand ▒ 0 [hardfault]:-----task info: addr(0x40024340),flag(0xabcdef02)-----fJ ▒ 0 [hardfault]:tick_stamp(83596),timebase_stamp(0x00000002bb5f9b97), taskUK ▒ 0 [hardfault]:StkPtr(0x2002bdac),TaskState(0x00000000)▒▒U^ ▒ 0 [hardfault]:r4(0x080349a6),r5(0x01000000),r6(0x449f7429),r7(0x448a8b09)▒▒U`▒ ▒ 0 [hardfault]:r8(0x406bfaef),r9(0x49cb7355),r10(0x00000000),r11(0x00000000)VKUD ▒ 0 [hardfault]:r3_lr(0x080349a7),psp(0x2002be48)▒HUM▒ ▒ 0 [hardfault]:----------task "task_c" tcb_info----------▒{UO9 ▒ 0 [hardfault]:StkBasePtr(0x2002d708),StkEndPtr(0x2002df08)▒UK ▒ 0 [hUO9 ▒ 0 [hardfault]:StkBasePtr(0x2002df08),StkEndPtr(0x2002e308)1&UK ▒ 0 [hardfault]:StkPtr(0x2002e20c),TaskState(0x00000000)&▒U^ ▒ 0 [hardfault]:r4(0x080349a6),r5(0x01000000),r6(0x00000000),r7(0x3ea216f0)▒U`▒ ▒ 0 [hardfault]:r8(0x3a0a5103),r9(0x413e79e8),r10(0x00000000),r11(0x00000000) ▒UD ▒ 0 [hardfault]:r3_lr(0x080349a7),psp(0x2002e2a8)▒UM▒ ▒ 0 [hardfault]:----------task "task_a" tcb_info----------H!UO9 ▒ 0 [hU_▒ ▒ 0 [hardfault]:-----irq_trace is null,addr(0x400244d0),flg(0x00000000)-----▒▒Uj ▒ 0 [hardfault]:----------task_trace is null,addr(0x400244d0),flg(0x00000000)----------5UX▒ ▒ 0 [hardfault]:******************check last trace ******************g▒U_▒ ▒ 0 [hardfault]:-----irq_trace is null,addr(0x40024790),flg(0x00000000)-----u▒Uj ▒ 0 [hardfault]:----------task_trace is null,addr(0x40024790),flg(0x00000000)----------▒▒U]D ▒ 0 [U*▒ ▒ 0 startup:11.647679 g▒U&▒ ▒ 0 Board:"wm320v2"▒U)▒ ▒▒[> airport limit inited [1]▒U.▒ ▒ 1 airport limit inited[1]/{U' ▒▒[[0][0][1][804][1][10086]▒ U▒ ▒▒[>end of db:[1]▒▒U0▒ ▒ 1 compass calibration init!8GU;▒ ▒ 1 [LED] changed: test led when startupuUB▒ ▒ 1 app connect changed:last(255) != current(0)7▒UHW ▒ 1 assistant connect changed:last(255) != current(0)XRU8▒ ▒▒dfilter_motor_pwm, butterworth first order▒CU7▒ ▒▒d --fc: 100.000000 hz, delay: 1.591549 ms▒▒U2 ▒ 1 [FDI MAGN[1]] event:turn on▒U2 ▒ 1 [FDI GYRO[1]] event:turn on▒▒U1S ▒ 1 [FDI ACC[1]] event:turn on▒\U2 ▒ 1 [FDI BARO[1]] event:turn on▒▒U,6 ▒ 1 [FDI AHRS[1]]:turn onB▒U0▒ ▒ 1 [FDI CTRL] event: turn onJ▒U?▒ ▒ 1 temp cali (0.000000,0.000000) 0 fw:4 4 n▒U`▒ ▒ 1 temp cali 0 bw:0.000000 0.000000 0.000000 ba:0.000000 0.000000 0.000000 ▒tUF▒ ▒ 1 app temp cali (22.000000,65.000000) aa fw:6 6 '▒Uh▒ ▒ 1 app temp cali aa bw:0.000212 -0.000181 0.000096 ba:-0.000084 0.000284 -0.002604 ▒JU%▒ ▒ 1 ESC0 link up ▒|U5h ▒ 2 [Err] OFDM_TX State:0x00000004y▒U%▒ ▒ 2 ESC1 link up ▒▒U5h ▒ 3 [Err] OFDM_TX State:0x00000000z▒U%▒ ▒ 3 ESC2 link up I^U%▒ ▒ 3 ESC3 link up ▒U-▒ ▒ 3 esc alive info = 0xf ▒▒U6= ▒ 4 Battery barcode:6171160823259 Q▒U]D ▒ 4 [esc_is_stall] status changed: last(0xffffffff) != current(0x00000000)▒eU]D ▒ 4 [esc_is_empty] status changed: last(0xffffffff) != current(0x00000000)▒▒UQ ▒ 4 ESC0 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ▒U1S ▒ 4 Loader = [V01.00.02.02] *U3▒ ▒ 4 Firmware = [V01.10.00.00] QUQ ▒ 5 ESC1 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ▒7U1S ▒ 5 Loader = [V01.00.02.02] ,▒U3▒ ▒ 5 Firmware = [V01.10.00.00] 2▒UQ ▒ 5 ESC2 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ▒▒U1S ▒ 5 Loader = [V01.00.02.02] ,▒U3▒ ▒ 5 Firmware = [V01.10.00.00] 2▒UQ ▒ 6 ESC3 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ▒ U1S ▒ 6 Loader = [V01.00.02.02] n▒U3▒ ▒ 6 Firmware = [V01.10.00.00] ▒U1S ▒ 10 [FDI GPS[1]] event:turn on$▒U1S ▒ 12 received on/off 2 from app▒▒U@! ▒ 12 CTRL reset all by APP.mission.request.offHU*▒ ▒ 12 ack on/off 0 to app▒U1S ▒ 16 received on/off 2 from appNU@! ▒ 16 CTRL reset all by APP.mission.request.off-YU*▒ ▒ 16 ack on/off 0 to appۭU-▒ ▒▒tgimbal pitch 0, roll 0, yaw 0loU4▒ ▒ 101 [FDI AHRS[1]]:ahrs_init beginK▒U5h ▒ 102 [FDI AHRS[1]]:bias fdi turn onUU5h ▒ 102 [FDI AHRS[1]]:init fdi turn on▒-U:p ▒ 102 [FDI AHRS[1]]:wait for sensor checkv▒UHW ▒ 111 [LED] changed: temperature not ready when startup▒U:p ▒ 121 Battery name :ATL NVT DJ005 ▒▒U2 ▒ 121 manufacture Date:2016/3/3 ▒)U-▒ ▒ 121 Serial number :354 K▒U-▒ ▒▒tgimbal pitch 0, roll 0, yaw 0loU] REQ_RC_NORMAL ATTI ctrl_atti▒U0▒ ▒ 162 Eeprom write offset:1d0 &U-▒ ▒ 183 [LED] changed: no attiTJUK ▒ 190 counter: 0 timeout_counter0 check_comm_state 1 WU>K ▒ 190 gps init: nack:0 ack:18 false_flag:0 ▒▒U-▒ ▒▒tgimbal pitch 0, roll 0, yaw 0loU-▒

notsolowki avatar Jan 03 '17 02:01 notsolowki

what do i do about error importing elftools

notsolowki avatar Jan 03 '17 02:01 notsolowki

Looks like text messages are wrapped into some some kind of binary container which starts with "U".

They are still readable, but it seem likely that since output is binary, the input also needs a specific binary format to be accepted (assuming that there is support for input).

elftools - the error message should explain what to do.

mefistotelis avatar Jan 03 '17 02:01 mefistotelis

i assume im looking at it right but i still have no idea how to disassemble somthing like this. i wouldnt mind the flight data usb port being turned into a serial port to the flight controller. have you tried anything like this.

.text:0802149A ; ---------------------------------------------------------------------------
.text:0802149C dword_802149C   DCD 0x2001C4C8          ; DATA XREF: sub_8021122+E6r
.text:0802149C                                         ; sub_80212BE+26r ...
.text:080214A0 aIst8303D0xXIdE DCB "IST8303[%d:0x%x]:ID error %x[exp=%x or %x]",0
.text:080214A0                                         ; DATA XREF: sub_8021122:loc_802121Eo
.text:080214CB                 DCB 0
.text:080214CC aIst8303D0xXCom DCB "IST8303[%d:0x%x]:compass_type = COMPASS_IST8303",0
.text:080214CC                                         ; DATA XREF: sub_8021122+10Eo
.text:080214FC aIst8303D0xXC_0 DCB "IST8303[%d:0x%x]:compass_type = COMPASS_IST8310",0
.text:080214FC                                         ; DATA XREF: sub_8021122+11Ao
.text:0802152C aIst8303D0xXS_2 DCB "IST8303[%d:0x%x]:set mode step 1 failed",0
.text:0802152C                                         ; DATA XREF: sub_8021246+20o
.text:08021554 aIst8303D0xXS_3 DCB "IST8303[%d:0x%x]:set mode step 1 ok",0
.text:08021554                                         ; DATA XREF: sub_8021246:loc_802126Ao
.text:08021578 aIst8303D0xXS_4 DCB "IST8303[%d:0x%x]:set mode step 2 failed",0
.text:08021578                                         ; DATA XREF: sub_8021246+42o
.text:080215A0 aIst8303D0xXS_5 DCB "IST8303[%d:0x%x]:set mode step 2  ok",0
.text:080215A0                                         ; DATA XREF: sub_8021246:loc_802128Co
.text:080215C5                 DCB 0, 0, 0
.text:080215C8 aIst8303D0xXSet DCB "IST8303[%d:0x%x]:set mode step 3  failed",0
.text:080215C8                                         ; DATA XREF: sub_8021246+64o
.text:080215F1                 DCB 0, 0, 0
.text:080215F4 aIst8303D0xXS_0 DCB "IST8303[%d:0x%x]:set mode step 3 ok",0

notsolowki avatar Jan 03 '17 03:01 notsolowki

What is it gona take. i think my overall goal is to make this thing faster

notsolowki avatar Jan 03 '17 03:01 notsolowki

i see from the flight controller the speed settings are just numeric values .

notsolowki avatar Jan 03 '17 03:01 notsolowki

This no longer seem related to serial port.

For reference - could you describe what you did to achieve the serial transmission in PuTTY?

mefistotelis avatar Jan 03 '17 03:01 mefistotelis

in putty i just used 8n1 no flow control and 115200. putty had encoding set to utf8 somthing i couldnt change with securecrt.

notsolowki avatar Jan 03 '17 03:01 notsolowki

i still want to enable the serial connection i just dont know where to start. can the components be communicated with through the gimbal. or do you have a know way to communicate with the flight controller through the usb on the front.

notsolowki avatar Jan 03 '17 03:01 notsolowki

id like to add that i notice the drone dont even start booting untill i open the console connection, it sits there and the gimbal makes some noises and then when i hit enter to start the connection the noise stop and it start with all the booting process???!?!?

notsolowki avatar Jan 03 '17 04:01 notsolowki

not sure what to make of this. this is digdat0s log

serial log - Click to expand
U;▒
▒ 0 [BAT]read barcode data success num:1▒rU invalid flash key![0]
U0▒
▒ 1 compass calibration init!8GU;▒
▒ 1 [LED] changed: test led when startupuUB▒
▒ 1 app connect changed:last(255) != current(0)7▒UHW
▒ 1 assistant connect changed:last(255) != current(0)XRU8▒
▒▒dfilter_motor_pwm, butterworth first order▒CU7▒
▒▒d --fc: 100.000000 hz, delay: 1.591549 ms▒▒U2
▒ 1 [FDI MAGN[1]] event:turn on▒U2
▒ 1 [FDI GYRO[1]] event:turn on▒▒U1S
▒ 1 [FDI ACC[1]] event:turn on▒\U2
▒ 1 [FDI BARO[1]] event:turn on▒▒U,6
▒ 1 [FDI AHRS[1]]:turn onB▒U0▒
▒ 1 [FDI CTRL] event: turn onJ▒U?▒
▒ 1 temp cali (0.000000,0.000000) 0 fw:4 4
n▒U`▒
▒ 1 temp cali 0 bw:0.000000 0.000000 0.000000 ba:0.000000 0.000000 0.000000
▒tUF▒
▒ 1 app temp cali (29.000000,65.000000) aa fw:6 6
▒▒Ug▒
▒ 1 app temp cali aa bw:-0.000438 0.000095 -0.000076 ba:0.000068 0.000199 0.000468
▒U]D
▒ 4 [esc_is_stall] status changed: last(0xffffffff) != current(0x00000000)▒eU]D
▒ 4 [esc_is_empty] status changed: last(0xffffffff) != current(0x00000000)▒▒U1S
▒ 10 [FDI GPS[1]] event:turn on$▒U%▒
▒ 28 ESC0 link up
▒▒U%▒
▒ 29 ESC1 link up
▒vU%▒
▒ 29 ESC2 link up
▒U%▒
▒ 30 ESC3 link up
▒U-▒
▒ 30 esc alive info = 0xf
Q!UQ
▒ 78 ESC0 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" o▒U1S
▒ 78 Loader = [V01.00.02.02] ▒▒U3▒
▒ 78 Firmware = [V01.10.00.00]
KFUQ
▒ 78 ESC1 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ▒▒U1S
▒ 78 Loader = [V01.00.02.02] ▒▒U3▒
▒ 78 Firmware = [V01.10.00.00]
KFUQ
▒ 79 ESC2 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ;U1S
▒ 79 Loader = [V01.00.02.02] ▒#U3▒
▒ 79 Firmware = [V01.10.00.00]
▒UQ
▒ 79 ESC3 version: Protocol = [V1.0] Hardware = "WM320_ESC_V9" ▒|U1S
▒ 79 Loader = [V01.00.02.02] ▒#U3▒
▒ 79 Firmware = [V01.10.00.00]
▒U4▒
▒ 96 Battery barcode:6171153826167,▒U4▒
▒ 97 Battery barcode:6171153826167N▒U4▒
▒ 98 Battery barcode:6171153826167RkU4▒
▒ 101 [FDI AHRS[1]]:ahrs_init beginK▒U5h
▒ 102 [FDI AHRS[1]]:bias fdi turn onUU5h
▒ 102 [FDI AHRS[1]]:init fdi turn on▒-U:p
▒ 102 [FDI AHRS[1]]:wait for sensor checkv▒UHW
▒ 111 [LED] changed: temperature not ready when startup▒U5h
▒ 116 [Err] OFDM_TX State:0x00000008▒▒U:p
▒ 120 Battery name :ATL NVT DJ005
UsU2
▒ 120 manufacture Date:2015/9/6
▒▒U.▒
▒ 120 Serial number :1369
U] REQ_RC_NORMAL ATTI ctrl_atti▒U0▒
▒ 161 Eeprom write offset:1d0
'|U-▒
▒ 183 [LED] changed: no attiTJU;▒
▒ 198 [FDI AHRS[1]]:(mxyz)compass stuck!!!A▒UK
▒ 230 counter: 0 timeout_counter0
check_comm_state 0
▒▒U>K
▒ 230 gps init: nack:0 ack:18 false_flag:0

notsolowki avatar Jan 03 '17 04:01 notsolowki

20170102_225927 20170102_225937 20170102_230031

notsolowki avatar Jan 03 '17 05:01 notsolowki

Regarding the log: > invalid flash key![0] This is harmless. I do not know what the flash key is, but when it's invalid, "airport limit" is disabled - so this seem to just inform that NFZ control is off. Might be interesting for some people, but not the reason of the drone not working.

▒ 116 [Err] OFDM_TX State:0x00000008▒▒U:p This looks like the reason of the failure.

mefistotelis avatar Jan 07 '17 12:01 mefistotelis

not sure what to make of this. this is digdat0s log

serial log - Click to expand

last four symbols is a CRC , just del them also for clear output use DJI PC Simulator

coptersafe avatar Mar 26 '17 05:03 coptersafe