fc40 camera

[compmc]

So on the FC40 camera sound subject, the user manual "PHANTOM FC40 User Manual V1.02
January 8th, 2014 Revision" shows on page 20 the camera, and has chart showing these headings;
LED Status / Conditions / Sound, with the possibility of 1,2,3 and 5 beeps of sound from the camera under the "Sound" heading, corresponding with the different appearance of the lights under the "LED Status" heading, and the appropriate condition explanation under the "Conditions" heading.
So I found that my manual listed above has been revised, to V 1.04 dated 1/27/2014
Now the camera sound reference is gone! imagine that!
My FC40 does not make any beeping sounds. My phone logged into the settings screen shows; date & time, format sd card, info, and under the info tab shows, app version 1.07 the camera connects with the phone and displays as it should, quite nicely!

On another forum (DJI Guys) (FC40), one of the phone screen shots, shows in the settings, options to adjust; date & time, sound, format, default settings and info. the other screen shots show version app 1.01,

Well the picture of the phone will not show.

Does anybody here have the same results as me? What results do you have?

Is there an update for the camera that I need to perform?
Thanks

 

[FatKevinSmith]

My camera app version says 1.08 but this is the version of the FC40 app and not the firmware of the camera. If you connect your device to the camera (go to web address of 192.168.1.1 once your wifi connects to the camera) you will see that the manufacturer of the camera is Ambarella. The onboard webserver in the camera is based on Cherokee so its a LINUX/UNIX OS. I cannot find any drivers or firmware updates for the camera because I cannot find this model camera on Ambarella's website (also, there's no camera FW on the DJI website)...

There is a misc folder that appears once you format the card and save the time/settings. There is a text file (named Version) that holds some basic config info, here's what it looks like:

ver = V1102
cal = 0x06
MAC = 58:12:XX:XX:XX:XX
MODEL = U40_NO_CODEC
PART = A06

Also, when the camera is attached to a PC via USB, and you press the power button, the LED will switch from red to green. At that point, your PC installs some kind of webcam driver (I think it was called UVC_Webcam) and it gets recognized as a 720p webcam. Thing is, even then it will not pick up any audio, as I tested this with the Skype loopback number.

So basically we know its an Ambarella manufactured camera (same company that makes the GoPro guts) using what I am guessing is their A6 chip. That is strictly the camera silicon. The web interface looks like DJI tried to completely wipe out so it cannot be accessed from a web browser.

There also appears to be a reset button hole next to the wifi symbol. Don't know if it resets the camera to Ambarella manufacturer defaults, or if it's just a reset button that puts it back to the 192.168.1.1 IP address if it was somehow able to be changed.

The strange thing is that Ambarella doesn't seem to manufacture any 720p only cameras, and their A6 reference device supports 1080p. The other strange thing that I noted earlier, is that when DJI requested FCC approval for this camera, they asked for all the technical info about it to be suppressed. I am beginning to wonder if this is a 1080p camera that they dumbed down in firmware so as not to be closer competition with the Phantom Vision. Obviously there are some significant differences between this camera and the one on the vision, aside from the other differences, but to the less informed consumer, having those kind of specs would lead some to believe that the differences weren't significant enough to warrant the price difference.. who knows? I guess eventually it will be hacked if this is the case.

 

[compmc]

Great response! Good work! Thanks for your efforts, really informative. I did see the FCC info regarding the propitiatory intellectual property argument, and asking for the 180 day reprieve.

So it would be great as a 1080p, I suppose I'll wait for hacking?

 

[FatKevinSmith]

These things aren't widespread enough yet for the real hackers to get into them. Who knows if the FC40 will ever be popular enough to warrant someone popping open the camera and taking a whack at it? With my limited skills, I surely won't be the one making any breakthroughs

One thing to note is the video stream is about 500kBps, so 10 minutes of video will be about 300 megs. Obviously no need to get a huge microSD capacity when you can get 6 10-minute videos on a 2GB card, and these things are only like $5 nowadays.

 

[FatKevinSmith]

If anyone is good with busybox linux, you can connect to the camera with your ipad or laptop or whatever, and telnet to it (again, 192.168.1.1) on the usual port 23. You'll get a logon prompt. Just use the username default w/ no password and you're in.

Not sure where to go from there. Also, for some reason the camera will power down on you after a few minutes, which is really annoying. I guess the FC40 mobile app has a heartbeat and if it doesn't detect it, it will power off the camera... which makes it difficult. Haven't tried connecting more than one mobile device to it at the same time but it should be possible.

 

[jamerd]

I am just curious dose DJI offer the camera as a replacement for both the FC40 and the vision.

Dennis

 

[BladHaund]

If anyone is good with busybox linux, you can connect to the camera with your ipad or laptop or whatever, and telnet to it (again, 192.168.1.1) on the usual port 23. You'll get a logon prompt. Just use the username default w/ no password and you're in.
Not sure where to go from there. Also, for some reason the camera will power down on you after a few minutes, which is really annoying. I guess the FC40 mobile app has a heartbeat and if it doesn't detect it, it will power off the camera... which makes it difficult. Haven't tried connecting more than one mobile device to it at the same time but it should be possible.

Thanks, this got me started. You can press the record button and start recording to prevent the camera to go to sleep.

Now, I have some basic knowledge of *nix systems, but nothing beyond simple commands.
You can navigate the folder structure by using the cd command. You start in default's home dir, so cd .. twice brinks you up to filesystem root.
ls lists the folder contents
vi filename opens the file in a simple viewer, so you may check out the file contents. Being a *nix system, most files are plaintext, so there's info to be gathered by reading the file. Exit vi by pressing CTRL+Z.

The systems does not seem to be very customized, because I could only find ambarella default stuff and many executables are present, even if the functions are not implemented (ex: ustream, dropbox, etc.). I couldn't find the camera config file, so as to try and modify something.

Reading some threads on a GoPro forum, it seems that Ambarella systems are made up of various parts, besides the *nix system being present a RTOS system and a DSP system. It seems the RTOS part is responsible for the video, at least on the GoPro.

That's about the limits of my knowledge. We need someone more knowledgeable in *nix systems and embedded systems, maybe we can find out more.

Anyway, the *nix part is opensource and they are supposed to release the source code for everything that's not proprietary.

 

[J.James]

Re: fc40 camera put a .txt file today on my card that was ne

Re: fc40 camera put a .txt file today on my card that was never there before today called dsp.log and its got all sorts of stuff that looks like configuration codes. don"t know if this will be helpful to any one to figure out what it all means or if messing with it and editing it will allow any one to change any thing in the camera
------------------------------------------------------------------------------------------------------------------------------------------
[code:th2:14321] TH2 MEMD memd_hl_wait_ll_complete: start to wait at , 85129794
[code:th1:14322] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 257412
[code:th1:14323] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 244395
[code:th1:14324] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 231567
[code:th1:14325] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 218922
[code:th1:14326] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 206276
[code:th1:14327] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 193581
[code:th1:14328] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 180782
[code:th2:14329] TH2 MEMD memd_hl_wait_ll_complete: waited out at , 85224335
[code:th2:14330] TH2 MEMD log_memd_result : start at , 85224651
[code:th2:14331] TH2 MEMD log_memd_result : end at , 85224802
[code:th1:14332] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 167954
[code:th2:14333] TH2 MEMD memd_send_msg : send at , 85233024
[code:th2:14334] TH2 MEMD memd_hl_init_basic_dram_buf_talbe : start at , 85233421
[code:th2:14335] TH2 MEMD memd_hl_init_basic_dram_buf_talbe : end at , 85237211
[code:th2:14336] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_pure_encoder_process: start reorder at , 85240807
[code:th2:14337] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_pure_encoder_process: end reorder at , 85241626
[code:th2:14338] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_pure_encoder_process: start dpb at , 85243231
[code:th2:14339] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_pure_encoder_process: end dpb at , 85243425
[code:th1:14340] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 154934
[code:th2:14341] TH2 MEMD memd_hl_init_dma: start at , 85246772
[code:th2:14342] TH2 MEMD memd_hl_setup_whole_flexible_smem_allocation: start at , 85246885
[code:th2:14343] TH2 MEMD memd_hl_setup_whole_flexible_smem_allocation: end at , 85248192
[code:th2:14344] setup smvmax=40
[code:th2:14345] setup smvmax=40
[code:th2:14346] setup smvmax=40
[code:th2:14347] setup smvmax=40
[code:th2:14348] TH2 MEMD memd_hl_init_dma: end at , 85253127
[code:th2:14349] TH2 MEMD memd_hl_wait_ll_complete: start to wait at , 85253628
[code:th1:14350] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 141880
[code:th1:14351] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 129032
[code:th1:14352] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 116324
[code:th1:14353] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 103571
[code:th1:14354] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 90902
[code:th1:14355] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 78242
[code:th1:14356] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 65574
[code:th1:14357] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 52935
[code:th2:14358] TH2 MEMD memd_hl_wait_ll_complete: waited out at , 85347422
[code:th2:14359] TH2 MEMD log_memd_result : start at , 85347723
[code:th2:14360] TH2 MEMD log_memd_result : end at , 85347880
[code:th2:14361] TH2 MEMD memd_send_msg : send at , 85355952
[code:th2:14362] TH2 MEMD memd_hl_init_basic_dram_buf_talbe : start at , 85356402
[code:th1:14363] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 39905
[code:th2:14364] TH2 MEMD memd_hl_init_basic_dram_buf_talbe : end at , 85361143
[code:th2:14365] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_pure_encoder_process: start reorder at , 85363911
[code:th2:14366] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_pure_encoder_process: end reorder at , 85364412
[code:th2:14367] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_encoder_process_one_round: end to process main at , 85364598
[code:th2:14368] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_encoder_process_one_round: start to process second at , 85365542
[code:th2:14369] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_encoder_process_one_round: end to process second at , 85366308
[code:th1:14370] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 26881
[code:th1:14371] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 14143
[code:th1:14372] turbo command timer setup non TURBO_COMMAND_SUB_PERIOD: 1340
[code:th1:14373] CAPTURE_MODE_EIS_turbo_command_mechanism_2_check_update
[code:th1:14374] CAPTURE_MODE_EIS_trubo_command_mechanism_2_get_eis_coeff step from dram 0x0
[code:th1:14375] CAPTURE_MODE_EIS_trubo_command_mechanism_2_get_eis_coeff not performed step with NULL eis_udpate_addr
[code:th1:14376] CAPTURE_MODE_EIS_turbo_command_mechanism_2_check_update not performed
[code:th1:14377] CAPTURE Start to wait command 1 at , 85401102
[code:th1:14378] CAPTURE Finished to wait command 1 at , 85438984
[code:th1:14379] CAPTURE start to wait command 2 at , 85439079
[code:th1:14380] CAPTURE Finished to wait command 2 at , 85441785
[code:th1:14381] idspdrv_compose_idsp_cfg Sec:3 Mode:0 Table:0x0000 Size:256 Addr:0x40569c0 [end]
[code:th1:14382] CAPTURE mctf_hl_wait_one_picture: start_wait_mctf at , 85451014
[code:th1:14383] CAPTURE mctf_hl_wait_one_picture: end_wait_mctf at , 85451252
[code:th1:14384] CAPTURE mctf_hl_wait_one_picture: start_wait_sec_3 at , 85451405
[code:th1:14385] CAPTURE mctf_hl_wait_one_picture: end_wait_sec_3 at , 85451537
[code:th1:14386] CAPTURE mctf_hl_wait_one_picture: end_wait_sec_4 at , 85451561
[code:th1:14387] CAPTURE mctf_hl_wait_one_picture: end_wait_sec_4 at , 85451593
[code:th1:14388] TH1 MCTF mctf_hl_start_one_picture: start_send_msg at 85451895
[code:th1:14389] TH1 MCTF mctf_hl_start_one_picture: end_send_msg at 85452267
[code:th1:14390] TH1 MCTF mctf_hl_start_one_picture: end_start_sec_3 at 85452388
[code:th1:14391] CAPTURE Finished capture perform at , 85453080
[code:th1:14392] idspdrv DIGITAL GAIN mul 10340 10000 10000 22790
[code:th1:14393] TH1 sendInterrupt at , 85459822
[code:th1:14394] preview_state_prev_B_prepare_thread_mode_ex1: prev_A_duplicate_stat is 0
[code:th1:14395] CAPTURE start_code_enc_th2_main start at , 85467532
[code:th1:14396] CAPTURE start_code_enc_th2_main end at , 85468089
[code:th1:14397] CAPTURE Finished capture handling at , 85468276
[code:th1:14398] CAPTURE CAPTURE_MODE_14_encoder_post_perform_one_capture: no need to process anything since its the cmd_deadliline is not negative at , 85468732
[code:th1:14399] CAPTURE Prepareing the capture cmd here at , 85470278
[code:th1:14400] idspdrv_compose_idsp_cfg Sec:1 Mode:1 Table:0x0000 Size:256 Addr:0x402a040 [end]
[code:th1:14401] CAPTURE Start compute act win at , 85473839
[code:th1:14402] video_process cfg actual zoom_y_start_frac 0 zoom_x_start_frac 0
[code:th1:14403] video_process cfg actual VIDEO_PROCESS_WIN_GET_ACT_WIN_HEIGHT 712 VIDEO_PROCESS_WIN_GET_ACT_WIN_WIDTH 1280
[code:th1:14404] video_process cfg actual VIDEO_PROCESS_WIN_GET_ACT_WIN_LEFT_EDGE 0 VIDEO_PROCESS_WIN_GET_ACT_WIN_TOP_EDGE 0
[code:th1:14405] CAPTURE finished compute act win at , 85474211
[code:th1:14406] capture_calc_cfa_output_for_zooming: *p_cfaOutputNumRows is 712
[code:th1:14407] capture_calc_cfa_output_for_zooming: *p_cfaOutputNumCols is 1280
[code:th1:14408] idspdrv_set_vin_active_win raw x:0 y:0 w:1280 h:712
[code:th1:14409] idspdrv_set_vin_active_win act x:0 y:0 w:1280 h:712
[code:th2:14410] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_encoder_process_one_round: start to process main at , 85476997
[code:th1:14411] idspdrv CFA H phase inc 00000000 00002000 Zoom 00000000 00000000
[code:th1:14412] idspdrv CFA V phase inc 00000000 00002000 Zoom 00000000 00000000
[code:th2:14413] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_pure_encoder_process: start set coding properties at , 85480730
[code:th2:14414] last pts is 1069068 extra pts interval is 0
[code:th2:14415] last pts is 1081080
[code:th1:14416] idspdrv AAA_STATISTICS_SETUP (AWB) w 52 h 44 active_w 52 activ_h 44
[code:th1:14417] idspdrv AAA_STATISTICS_SETUP (AE) w 106 h 88 output_w 1280 output_h 712
[code:th1:14418] idspdrv AAA_STATISTICS_SETUP (AF) w 140 h 140 active_w 140 activ_h 140
[code:th2:14419] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_pure_encoder_process: end set coding properties at , 85483120
[code:th2:14420] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_pure_encoder_process: start reorder at , 85486316
[code:th2:14421] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_pure_encoder_process: end reorder at , 85491277
[code:th2:14422] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_encoder_process_one_round: end to process main at , 85491789
[code:th2:14423] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_encoder_process_one_round: start to process second at , 85494110
[code:th1:14424] idspdrv_compose_idsp_cfg Sec:2 Mode:5 Table:0x0000 Size:9216 Addr:0x402b0c0 [end]
[code:th1:14425] CAPTURE Finished command preparing at , 85497999
[code:th1:14426] thread_event_flag_get_cb()->capturing_frame_time_limit : 371371
[code:th1:14427] thread_event_flag_get_cb()->latest_captured_frame_time : 85438800 : Current time is 85498191
[code:th2:14428] TH2 MEDIAPROCESS MEDIA_PROCESS_MODE_4_encoder_process_one_round: end to process second at , 85498596
[code:th1:14429] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 311020
[code:th1:14430] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 298216
[code:th1:14431] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 285554
[code:th1:14432] turbo command timer setup TURBO_COMMAND_SUB_PERIOD: 272865

 

[dragonash]

hey guys, maybe we can combine the findings of my post and yours

viewtopic.php?f=20&t=14019

We were able to change the SSID of the camera. Although it wont save on reboot - yet.

I never thought of getting the camera to become 1080p. My initial thought was to rename it and trick DJI's extender into thinking it was a vision camera

 

[Ohary]

I'm a little confused. Are you guys saying it may be possible to upgrade the FC40 to a better definition camera?

 

[dragonash]

I'm a little confused. Are you guys saying it may be possible to upgrade the FC40 to a better definition camera?

the simple answer:

results are inconclusive

 

[jerrymac12000]

I have had my FC40 for about three months now, and everything seemed to be working well until this weekend. The camera works well for FPV but a purple tint has starts to show up as I view the monitor and as I view the videos or look at this the still pictures. As the camera moves in the air, the purple fades in and out of the monitor. The angle of the camera does not affect the purple image. It changes as the quad Flys.

I have tried to read the threads referencing the camea, but nothing really shows up about the problem. I think the photo sensor in the camera Iis going bad. Any ideas?

 

[BladHaund]

hey guys, maybe we can combine the findings of my post and yours
viewtopic.php?f=20&t=14019
We were able to change the SSID of the camera. Although it wont save on reboot - yet.
I never thought of getting the camera to become 1080p. My initial thought was to rename it and trick DJI's extender into thinking it was a vision camera

I don't think it's possible or feasible to convert it to 1080p. What I do think it's possible is to enhance the pitiful pictures resolution. The other OEM cameras from the same family shoot photos in 5 Mpx, whereas the FC40 camera only captures photo in 720p. I believe this is a deliberate cripple at DJI's request, in order not to compete with the Phantom Vision. And, if it's done in software, all we need is to find the proper config file where these settings are stored.

 

[helmuteke]

in the attachment you find all the files on the FC40 cam.

Also there are pics who show the 5MP and 1080 mode.

so it's up to us to hack this camera who has more functions that DJI tell us

 

[dragonash]

in the attachment you find all the files on the FC40 cam.

Also there are pics who show the 5MP and 1080 mode.

so it's up to us to hack this camera who has more functions that DJI tell us

What pics are you talking about? Have links to show up?

 

[helmuteke]

these 2 files you find on the device

 

[dragonash]

these 2 files you find on the device

interesting.
wish we had someone that could tinker with it!

 

[BladHaund]

Disassembling the .apk of the FC40 app reveals some interesting info.

From some string file:

<string name="page_setup_video_resolution">Video Resolution</string>
    <string name="page_setup_video_resolution_fullhd">Full HD(1080p30)</string>
    <string name="page_setup_video_resolution_hdp60">HD(720p60)</string>
    <string name="page_setup_video_resolution_hdp30">HD(720p30)</string>
    <string name="page_setup_video_resolution_vga">VGA(640X480)</string>
    <string name="page_setup_photo_resolution">Photo Resolution</string>
    <string name="page_setup_photo_resolution_16mp">16MP</string>
    <string name="page_setup_photo_resolution_5mp">5MP</string>
    <string name="page_setup_photo_resolution_3mp">3MP</string>

Don't know if the actual hardware in the FC40 camera is capable of all this, though.

Judging from the resources in the file, not much customization went towards DJI's product. The Unieye app resources are all there.

I've used this handy little tool: http://code.google.com/p/easy-apk-dissassembler/
As my knowledge of Android programming is close to nil, poking around the disassembled files is all I can do, though. Maybe someone among you has a friend that has a friend that is an Android developer and would be so kind to take a look in the .apk, if there's any info to be gathered from there...

 

[aardpig]

Hi folks --

I've figured out how to (reversibly) change the SSID on the FC40 camera. Turns out that at boot-up, the real-time operating system which manages the camera (and runs Linux as a task) reads from the file autoexec.ash on the SD card. This file contains a sequence of commands which are interpreted by Ambarella's ambsh shell. The SSID change is achieved sending a couple of commands to the Linux task from the ambsh shell, to alter the SSID.

Specifics: create the autoexec.ash file in the top-level directory of the SD card, with the following contents:

sleep 30
lu_util exec 'sed -e "s/FC40_[A-Za-z0-9]*/FC40_AARDPIG/" -i /tmp/wifi/ap.conf'
lu_util exec 'sh /tmp/wifi/ap.conf'

IMPORTANT: This file must be saved with Unix (linefeed) line-breaks, not Windows line-breaks. Google for how to do this.

Let's go through the file line-by-line, to see how it works:

• The first line causes the shell to sleep (wait) for 30 seconds. This is (approximately) the time it takes for the Linux task to get up and running after we switch the camera on. We have to wait for this start-up complete before we change the SSID, otherwise the change may be overwritten by the default SSID; 30 seconds is my estimate of how long this takes (judging from how long the status LED on the camera takes to switch from flashing to constant).
• The second line sends a command to the Linux task, which uses the standard sed tool to change the SSID in the WiFi configuration script (/tmp/wifi/ap.conf) from FC40_something to FC40_AARDPIG. When you create your own file, you should change FC40_AARDPIG to whatever SSID you wish. (Note, however, that the FC40 smartphone app expects the camera SSID to begin with 'FC40_').
• The third line sends another command to the Linux task, which actually runs the WiFi configuration script to change the SSID.

A better approach, IMHO, would be to use the wpa_cli tool to change the SSID directly, rather than fussing with the /tmp/wifi/ap.conf script; but I haven't yet managed to get this working.

A big kudos for figuring out how to do this should go to this thread discussing the GoPro Hero camera; turns out that the GoPro software is also made by Ambarella, so there are quite a few commonalities.

cheers,

A

 

[Jesolins]

Gents,
Great work here!
Anyone know the SSID of the Unieye or the Aiptek air2u clone that uses the Unieye application? I think it is U2-XXXXXX. Example from a youtube video: U2-FE47A2. It would be worthy to change the SSID in order to see if it will work with the Unieye applications which are much more capable than the DJI app, i.e. zooming, multi viewing, etc. Also the Unieye has not only iphone and android, but also a PC app. Here in the downloads tab at the bottom of this link: http://www.aiptek.de/index.php/en/products/air2u/mobile-cameras/mobileeyes-hd

For those who don't know this, the FC40 is easily range extended without FC40 SSID modification by using a router with DD-WRT or a dedicated extender such as an Amped SR1000. https://www.youtube.com/watch?v=0Xr_CHLscqo

Here is a thread for adding an external antenna to the FC40 with some good info and photos on how to take it apart: http://www.phantompilots.com/viewtopic.php?t=18388&p=167984

Cheers,
Jim