This page is intended to document tools which can be used to force FCC mode in the Phantom 3 and Inspire 1 series.

Derived from https://github.com/o-gs/dji-firmware-tools/issues/10 mostly

Values it can extract and allow to modify:

• “name” : “og_hardcoded.lightbridge_stm32.packet_received_attenuation_override”
• “description” : “What to do when received a packet with transceiver power set request; 0 - use the received attenuation value, 1 - override the value with constant one”,
• “name” : “og_hardcoded.lightbridge_stm32.packet_received_attenuation_value”
• “description” : “Constant attenuation value used when packet_received_attenuation_override is enabled; unit depends on OFDM board type”,
• “name” : “og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx1_fcc”
• “description” : “Transceiver attenuation value for board type 3 with Analog Devices chip, change by 1 means 0.25 dBm”,
• “name” : “og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx2_fcc”
• “description” : “Transceiver attenuation value for board type 3 with Analog Devices chip, change by 1 means 0.25 dBm”,
• “name” : “og_hardcoded.lightbridge_stm32.board_ar0_attenuation_tx1_ce”
• “description” : “Transceiver attenuation value for board type 0 with Artosyn chip, change by 1 means 1 dBm”,
• “name” : “og_hardcoded.lightbridge_stm32.board_ar0_attenuation_tx2_ce”
• “description” : “Transceiver attenuation value for board type 0 with Artosyn chip, change by 1 means 1 dBm”,
• “name” : “og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx1_ce”
• “description” : “Transceiver attenuation value for board type 4 with Analog Devices chip, change by 1 means 0.25 dBm”,
• “name” : “og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx2_ce”
• “description” : “Transceiver attenuation value for board type 4 with Analog Devices chip, change by 1 means 0.25 dBm”,
• “name” : “og_hardcoded.lightbridge_stm32.power_zone_selection_override”
• “description” : “What to do when power zone is about to be selected from geo coordinates; 0 - set the value based on geolocation, 1 - override the value and set to FCC”,

Usage

Steps to get to extract

• dji_xv4_fwcon.py -vvv -x -p <firmwarename.bin>
• arm_bin2elf.py -vv -e -b 0x000a000 –section .ARM.exidx@0x019300:0 –section .bss@0x1ff6000:0x4000 \

–section .bss2@0x1ffe000:0x1000 –section .bss3@0x1bff6000:0x2400 –section .bss4@0x1c01a000:0x2400 \ –section .bss5@0x40022000:0x50000 –section .bss6@0x400ee000:0x200 –section .bss7@0xe0004000:0x1200 \ -p <firmwarename_m1401.bin>

• lightbridge_stm32_hardcoder.py -vvv -x -e <firmwarename__m1401.elf>

These are commands to the RC plugged in via USB to PC using comm_mkdupc.py. This tool is a DUML Packet Builder with hex string output. https://github.com/o-gs/dji-firmware-tools

• To set CE:

./comm_mkdupc.py -vv –sender_type=PC –sender_index=1 –receiver_type=OFDM_Ground –ack_type=ACK_After_Exec –cmd_set=OFDM –cmd_id=6 –seq_num=5552 –payload_hex=“F7 FF 00”

• To set FCC:

./comm_mkdupc.py -vv –sender_type=PC –sender_index=1 –receiver_type=OFDM_Ground –ack_type=ACK_After_Exec –cmd_set=OFDM –cmd_id=6 –seq_num=5553 –payload_hex=“F7 FF 01”

• To disallow the RC to reset the value by itself:

./comm_mkdupc.py -vv –sender_type=PC –sender_index=1 –receiver_type=OFDM_Ground –ack_type=ACK_After_Exec –cmd_set=OFDM –cmd_id=6 –seq_num=5554 –payload_hex=“F9 FF 01”

• To check (query) currently set zone:

./comm_mkdupc.py -vv –sender_type=PC –sender_index=1 –receiver_type=OFDM_Ground –ack_type=ACK_After_Exec –cmd_set=OFDM –cmd_id=7 –seq_num=5555 –payload_hex=“F7 FF”

P1765Fw3.bin means something, service file name? gs_ofdm.bin?

m1400 is probably used only by GL300a/b; the c version likely uses m1401