User Tools

Site Tools

Translations of this page:

howto:dji_ftpd_aes_unscramble

This is an old revision of the document!


dji_ftp_aes_unscramble

When you get FTP access to your DJI, you can push files to the aircraft using normal FTP commands (to a limited subset of directories due to /system being read only).

But, downloading is another matter. DJI modified the FTPD that is built into their firmware, to stop people getting access to the files, in an attempt to hide the fact that their aircraft is using GPL software contrary to the software licenses of those GPL components.

A number of people have already solved how to upload/download from an aircraft. There is even dumldore available to backup firmware, or push any version of firmware to your aircraft using these methods. But, this is a windows app. This wiki page is a DRAFT document, and still incomplete. Please feel free to contribute to the ongoing development of these instructions to move files to and from a DJI aircraft using FTP. Eventually, I want to expand this out to explain how to backup a firmware image file from a DJI device.

1. Toolchain

Install your toolchain as per the instructions here. You only need to do this once… but check the instructions to see if there are any new tools that you may need.

2. Get the DJI_ftpd_aes_unscramble magic

If this is your first time using duml, you will need to checkout the code from git.

cd ~/Documents/
git clone https://github.com/MAVProxyUser/DJI_ftpd_aes_unscramble.git
cd DJI_ftpd_aes_unscramble

If you have done this before and you want to make sure you have the latest code, you just need to sync to the most recent version

cd ~/Documents/DJI_ftpd_aes_unscramble
git pull

3. Now What?

Through earlier work, we have the decryption key. Before encrypting, DJI also do some XOR operations on the first 16 bytes of the input document, to try and prevent people from reverse engineering their encryption. In the python approach below, this is taken care of. The initial decryption code was created by Hostile (aka MavProxyUser). Subsequent patches were submitted by Czokie to deal with the XOR tweaks, as well as stripping PKCS7 padding at the end of the decrypted file.

This method is published here.

howto/dji_ftpd_aes_unscramble.1501245738.txt.gz · Last modified: 2017/07/28 12:42 by czokie