User Tools

Site Tools


howto:p3fcchardmod

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
howto:p3fcchardmod [2019/07/28 19:55]
digdat0 fot
howto:p3fcchardmod [2019/08/01 02:56] (current)
digdat0 lots of changes
Line 1: Line 1:
-====== Tools to force FCC mode in p3/i1 ======+====== Tools to force FCC mode in Phantom 3 Inspire 1 aircraft ​======
  
-This page is intended to document tools which can be used to force FCC mode in the Phantom 3 and Inspire 1 series.+This page is intended to document tools which can be used to force FCC mode in the Phantom 3 and Inspire 1 series. ​Alot of this content is derived from github discussion, credits to mefistotelis for his tool creations. https://​github.com/​o-gs/​dji-firmware-tools/​issues/​10
  
-Derived from https://​github.com/​o-gs/​dji-firmware-tools/​issues/​10 mostly+A method has been created to enable FCC mode as well as changing other transmission settingsThis requires extracting ​firmware ​for your Phantom 3 or Inspire 1 Remote control, modifying some settings, saving and re-compiling the firmware file. You will then need to install the firmware file onto the remote control to take effect.
  
-=== lightbridge_stm32_hardcoder.py ​===+====== ​Toolset ====== 
 +Make sure to review this GitHub with more info: https://​github.com/​o-gs/​dji-firmware-tools
  
-Values it can extract ​and allow to modify:+Create a folder, maybe named "​P3FCC" ​and then download all of the files below into it.
  
-  ​* "​name" ​"​og_hardcoded.lightbridge_stm32.packet_received_attenuation_override"​ +  ​- Download [[https://github.com/o-gs/dji-firmware-tools/​raw/​master/​amba_sys2elf_template.elf|amba_sys2elf_template.elf]] 
-  * "​description"​ : "What to do when received a packet with transceiver power set request; 0 use the received attenuation value, 1 override the value with constant one",​ +  ​- Download [[https://github.com/​o-gs/​dji-firmware-tools/​raw/​master/​amba_sys_hardcoder.py|amba_sys_hardcoder.py]] 
-  * "​name"​ : "​og_hardcoded.lightbridge_stm32.packet_received_attenuation_value"​ +  ​- Download [[https://github.com/​o-gs/​dji-firmware-tools/​raw/​master/​arm_bin2elf.py|arm_bin2elf.py]] 
-  ​* "​description" ​"​Constant attenuation value used when packet_received_attenuation_override is enabled; unit depends on OFDM board type",​ +  ​- Download [[https://github.com/​o-gs/​dji-firmware-tools/​raw/​master/​arm_bin2elf_template.elf|arm_bin2elf_template.elf]]  
-  * "​name"​ : "​og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx1_fcc"​ +  ​- Download [[https://github.com/​o-gs/​dji-firmware-tools/​raw/​master/​dji_xv4_fwcon.py|dji_xv4_fwcon.py]] 
-  * "​description"​ : "​Transceiver attenuation value for board type 3 with Analog Devices chip, change by 1 means 0.25 dBm", +  ​- Download [[https://github.com/​o-gs/​dji-firmware-tools/​raw/​master/​lightbridge_stm32_hardcoder.py|lightbridge_stm32_hardcoder.py]]
-  ​* "​name" ​"​og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx2_fcc"​ +
-  * "​description"​ : "​Transceiver attenuation value for board type 3 with Analog Devices chip, change by 1 means 0.25 dBm", +
-  ​* "​name" ​"​og_hardcoded.lightbridge_stm32.board_ar0_attenuation_tx1_ce"​ +
-  * "​description"​ : "​Transceiver attenuation value for board type 0 with Artosyn chip, change by 1 means 1 dBm",​ +
-  * "​name"​ : "​og_hardcoded.lightbridge_stm32.board_ar0_attenuation_tx2_ce"​ +
-  ​* "​description" ​"​Transceiver attenuation value for board type 0 with Artosyn chip, change by 1 means 1 dBm",​ +
-  * "​name"​ : "​og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx1_ce"​ +
-  * "​description"​ : "​Transceiver attenuation value for board type 4 with Analog Devices chip, change by 1 means 0.25 dBm", +
-  ​* "​name" ​"​og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx2_ce"​ +
-  * "​description"​ : "​Transceiver attenuation value for board type 4 with Analog Devices chip, change by 1 means 0.25 dBm",​ +
-  * "​name"​ : "​og_hardcoded.lightbridge_stm32.power_zone_selection_override"​ +
-  * "​description"​ : "What to do when power zone is about to be selected from geo coordinates;​ 0 - set the value based on geolocation,​ 1 - override the value and set to FCC",+
  
-Usage 
  
-Steps to get to extract+Pre-reqs: 
 +  - Have installed Python 3 https://​www.python.org/​downloads/​ 
 +      NOTE: Make sure to SET PATH for Python during install. If you don't know what this means, google it.  
 +  - Install the following modules via pip install 
 +    - elftools 
 +    - pyelftools 
 +    - pycryptodome 
 +    - capstone 
 +    - keystone 
 +    - keystone-engine
  
-  ​dji_xv4_fwcon.py -vvv -x -p <​firmwarename.bin>​ +Once these libraries are all installed you can use the tools to decrypt the firwmare files. 
-  ​arm_bin2elf.py -vv -e -b 0x000a000 --section .ARM.exidx@0x019300:​0 --section .bss@0x1ff6000:​0x4000 ​\ + 
- ​--section .bss2@0x1ffe000:​0x1000 --section .bss3@0x1bff6000:​0x2400 --section .bss4@0x1c01a000:​0x2400 ​\ +== Firmware Files == 
- ​--section .bss5@0x40022000:​0x50000 --section .bss6@0x400ee000:​0x200 --section .bss7@0xe0004000:​0x1200 ​\+ 
 +We are targetting the 1400 or 1401 modules. The 1400 module is for the GL300A controller, the 1401 is for the GL300B/C controllers. <Need to include Inspire RC model> 
 + 
 +You need to access the RC firmware files. You can find them on the [[https://​github.com/​cs2000/​DankDroneDownloader|DankDroneDownloader]] site 
 + 
 +Direct links available as well: 
 + 
 +Phantom 3 RC: 
 +<insert URL's for download>​ 
 + 
 +Inspire RC: 
 + 
 +<insert URL's for download>​ 
 + 
 +Once downloaded, move the file into same folder as the files you downloaded earlier. 
 + 
 +== Extract the firmware file == 
 + 
 +You will go through these steps: 
 + 
 +   ​- Extract main firmware file 
 +   - Convert 1400/1401 module to ELF format 
 +   - Extract settings from the firmware file 
 +   - Edit the settings 
 +   - Re-make the firmware file 
 +   - Install the firmware file 
 + 
 +Extracting the file: 
 + 
 +  - Drop to a command prompt, Start->​Run->​CMD.exe 
 +  - Navigate to the folder where the files are located. CD\p3FCC <​enter>​ 
 +  - Type the following command: 
 +     dji_xv4_fwcon.py -vvv -x -p <​firmwarename.bin>​ 
 +  ​- Now, open the folder and you should see the .1401 file. 
 +  - You can then type this command 
 +     arm_bin2elf.py -vv -e -b 0x000a000 --section .ARM.exidx@0x019300:​0 --section .bss@0x1ff6000:​0x4000 
 + ​--section .bss2@0x1ffe000:​0x1000 --section .bss3@0x1bff6000:​0x2400 --section .bss4@0x1c01a000:​0x2400 
 + ​--section .bss5@0x40022000:​0x50000 --section .bss6@0x400ee000:​0x200 --section .bss7@0xe0004000:​0x1200
  ​-p ​ <​firmwarename_m1401.bin>​  ​-p ​ <​firmwarename_m1401.bin>​
-  ​lightbridge_stm32_hardcoder.py -vvv -x -e <​firmwarename__m1401.elf>​+  ​- you should see the .1401 elf file in the folder. 
 +  - You can now type this command: 
 +     lightbridge_stm32_hardcoder.py -vvv -x -e <​firmwarename__m1401.elf>​ 
 +  - This will extract the settings and you can edit them in notepad or similar editting apps
  
 +
 +== Values it can extract and allow to modify ==
 +
 +^ Parameter Name ^ Description^
 +^ og_hardcoded.lightbridge_stm32.packet_received_attenuation_override ^ What to do when received a packet with transceiver power set request; 0 - use the received attenuation value, 1 - override the value with constant one|
 +^ og_hardcoded.lightbridge_stm32.packet_received_attenuation_value ^ Constant attenuation value used when packet_received_attenuation_override is enabled; unit depends on OFDM board type|
 +^ og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx1_fcc ^ Transceiver attenuation value for board type 3 with Analog Devices chip, change by 1 means 0.25 dBm|
 +^ og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx2_fcc ^ Transceiver attenuation value for board type 3 with Analog Devices chip, change by 1 means 0.25 dBm|
 +^ og_hardcoded.lightbridge_stm32.board_ar0_attenuation_tx1_ce ^ Transceiver attenuation value for board type 0 with Artosyn chip, change by 1 means 1 dBm|
 +^ og_hardcoded.lightbridge_stm32.board_ar0_attenuation_tx2_ce ^ Transceiver attenuation value for board type 0 with Artosyn chip, change by 1 means 1 dBm|
 +^ og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx1_ce ^ Transceiver attenuation value for board type 4 with Analog Devices chip, change by 1 means 0.25 dBm|
 +^ og_hardcoded.lightbridge_stm32.board_ad3_attenuation_tx2_ce ^ Transceiver attenuation value for board type 4 with Analog Devices chip, change by 1 means 0.25 dBm|
 +^ og_hardcoded.lightbridge_stm32.power_zone_selection_override ^ What to do when power zone is about to be selected from geo coordinates;​ 0 - set the value based on geolocation,​ 1 - override the value and set to FCC|
  
  
  
 ==== Direct commands comm_mkdupc.py ===== ==== Direct commands comm_mkdupc.py =====
 +You can also use the tool comm_mkdupc.py to send commands to the RC to see the status or change status. ​
 +
 These are commands to the RC plugged in via USB to PC using comm_mkdupc.py. This tool is a DUML Packet Builder with hex string output. https://​github.com/​o-gs/​dji-firmware-tools These are commands to the RC plugged in via USB to PC using comm_mkdupc.py. This tool is a DUML Packet Builder with hex string output. https://​github.com/​o-gs/​dji-firmware-tools
  
 +  * To set CE:
  
  
-  * To set CE: +comm_mkdupc.py -vv --sender_type=PC --sender_index=1 --receiver_type=OFDM_Ground --ack_type=ACK_After_Exec --cmd_set=OFDM --cmd_id=6 --seq_num=5552 --payload_hex="​F7 FF 00"
-./comm_mkdupc.py -vv --sender_type=PC --sender_index=1 --receiver_type=OFDM_Ground --ack_type=ACK_After_Exec --cmd_set=OFDM --cmd_id=6 --seq_num=5552 --payload_hex="​F7 FF 00"+
  
  
   * To set FCC:   * To set FCC:
-./comm_mkdupc.py -vv --sender_type=PC --sender_index=1 --receiver_type=OFDM_Ground --ack_type=ACK_After_Exec --cmd_set=OFDM --cmd_id=6 --seq_num=5553 --payload_hex="​F7 FF 01"+ 
 + 
 +comm_mkdupc.py -vv --sender_type=PC --sender_index=1 --receiver_type=OFDM_Ground --ack_type=ACK_After_Exec --cmd_set=OFDM --cmd_id=6 --seq_num=5553 --payload_hex="​F7 FF 01"
  
  
   * To disallow the RC to reset the value by itself:   * To disallow the RC to reset the value by itself:
-./comm_mkdupc.py -vv --sender_type=PC --sender_index=1 --receiver_type=OFDM_Ground --ack_type=ACK_After_Exec --cmd_set=OFDM --cmd_id=6 --seq_num=5554 --payload_hex="​F9 FF 01"+ 
 + 
 +comm_mkdupc.py -vv --sender_type=PC --sender_index=1 --receiver_type=OFDM_Ground --ack_type=ACK_After_Exec --cmd_set=OFDM --cmd_id=6 --seq_num=5554 --payload_hex="​F9 FF 01" 
  
   * To check (query) currently set zone:   * To check (query) currently set zone:
-./comm_mkdupc.py -vv --sender_type=PC --sender_index=1 --receiver_type=OFDM_Ground --ack_type=ACK_After_Exec --cmd_set=OFDM --cmd_id=7 --seq_num=5555 --payload_hex="​F7 FF"+comm_mkdupc.py -vv --sender_type=PC --sender_index=1 --receiver_type=OFDM_Ground --ack_type=ACK_After_Exec --cmd_set=OFDM --cmd_id=7 --seq_num=5555 --payload_hex="​F7 FF"
    
  
  
 +
 +==== Install ====
 +Need to add install steps.
  
 ==== Misc ==== ==== Misc ====
 P1765Fw3.bin means something, service file name? gs_ofdm.bin?​ P1765Fw3.bin means something, service file name? gs_ofdm.bin?​
- +1400 is probably used only by GL300a/b; the c version likely uses m1401
- +
- +
-m1400 is probably used only by GL300a/b; the c version likely uses m1401+
howto/p3fcchardmod.txt · Last modified: 2019/08/01 02:56 by digdat0