Fixing flash in DM365 chip within Ph3 Pro gimbal

Err.. you've loaded `uImage` to memory (RAM) at 0x80008000.
Then you've overwritten that (in RAM) with `uImage_recovery`.
And then you tried to load and boot kernel from the NAND (which you did not modified at all).

You seem to be missing NAND write commands.
Sorry, i have low skills on programing. I'm about 1 day reading all the related content on Github and trying to do it right but no success yet. Try it again with nand write comands but still no success
Captura de tela 2023-02-07 104225.jpg
 
i have low skills on programing
"programming" is a term typically reserved for writing programs. It has nothing to do with using already made tools to perform an action.

Try asking yourself what actions you want to perform, and then finding commands for those actions.
 
"programming" is a term typically reserved for writing programs. It has nothing to do with using already made tools to perform an action.

Try asking yourself what actions you want to perform, and then finding commands for those actions.
Sorry for the used term. English is not my native language.
I'm an hardware guy so i have several limitations understanding this kind of operations/structures (kernel, encryptions, partition etc) but i'm doing my best trying to larn a litle bit of this.
About asking myselft what actions i want, i really don't know because as i say a i dont know about this structures. This is why i posted here trying to find some help.
I'm very thankful for the informations that you already have put here.
If you guys can give me some tips maybe i can do progress on this and share my experience with the community.
 
My tutorial is here:

With the one from O-Gs, there shouldn't be much issue.

Just read everything carefully - especially the part about flashing rootfs.

In none of the tutorials there is the `boot` command used. But you seem to insist on using it. How did you come up with that?
 
My tutorial is here:

With the one from O-Gs, there shouldn't be much issue.

Just read everything carefully - especially the part about flashing rootfs.

In none of the tutorials there is the `boot` command used. But you seem to insist on using it. How did you come up with that?
as the board is not booting on turning it on i simply tried it :sweatsmile:
I will read it again more carefully thanks
 
Just getting into this. I have avoided it for too long. I recently decided to work on what I call DJI antiques. I just got the video working on a Phantom 2 vision plus. Now for the P3 pro. I am so excited.
 
hi there , still flying the phantom3 se,s pro and adv through 2024 :p :p :p :cool:
this drone no matter what u invest in newer ones cannot be forgotten, may still fly as sexy as the first days, actually i modded it by digdat0 methods on u tube for increased speed and no altitude restrictions
To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.
..

. i have a question too much out of topic i will post it here hopping some one is still interested in the phantom 3 as i am...
my objective is to remove the drone id of the phantom3 that it sends to dji aeroscope .
using the above method of modding in video the parameters of flight controller of the phantom3 are all able to be edited... but i donot see any parameter mentioning drone id , id, i hope fully can find some one who can help ... which parameter sends out the drone id of the phantom 3





a ward of caution not to get me wrong in terms of my intentions "am not in the US and no regulations for drones are there in my country, i rarely fly out of line of sight only filming nature like cliffs mountains or in nature away from cities, and advice not to be smart and fly drones near airports"
 
  • Like
Reactions: Droneted
Is there an alternative download site for the TI Utilities needed to flash NAND/Davinci DM368xx? The TI repository for these tools is long deprecated, and I've spent a few hours searching, including the GitHub for the HW/FW for DJI products. I have the needed .bin for extracting the 0800 FW region, but don't see a generic way to flash this. I'm working with several X5's that exhibit the typical 0800/1500 'device not detected' error, and I realize the Cypress (1500) chip cannot be 'contacted' due to its pipeline being through the DM368. Uboot is successful up to this point, so I think if I can flash the DM368 NAND, I may get the video transmission back on these cameras. They record still and video to SD just fine and all other modules appear intact, functional and with working FW. I sincerely appreciate any help in finding appropriate flash tools for serial flash!
 
Is there an alternative download site for the TI Utilities needed to flash NAND/Davinci DM368xx? The TI repository for these tools is long deprecated, and I've spent a few hours searching, including the GitHub for the HW/FW for DJI products. I have the needed .bin for extracting the 0800 FW region, but don't see a generic way to flash this. I'm working with several X5's that exhibit the typical 0800/1500 'device not detected' error, and I realize the Cypress (1500) chip cannot be 'contacted' due to its pipeline being through the DM368. Uboot is successful up to this point, so I think if I can flash the DM368 NAND, I may get the video transmission back on these cameras. They record still and video to SD just fine and all other modules appear intact, functional and with working FW. I sincerely appreciate any help in finding appropriate flash tools for serial flash!

i didnt understand much of what you wrote but it sounds like you have no video feed and want to get it back, in which case follow my video guide and use the flash tool.

If its been stored for a long time it has a 70% chance of repair if its had a torn ribbon then that is practically nil chance of repair

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.
dont forget to sub and like if it fixes the issue.
 
  • Like
Reactions: Droneted
i didnt understand much of what you wrote but it sounds like you have no video feed and want to get it back, in which case follow my video guide and use the flash tool.

If its been stored for a long time it has a 70% chance of repair if its had a torn ribbon then that is practically nil chance of repair

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.
dont forget to sub and like if it fixes the issue.
Thanks VERY MUCH for the info! These cameras (X5) are used with the Inspire 1 V1 Pro. The TI serial flash utility isn't available any longer from the TI site, but I DID find in part of a download from 'gaucho', so hopefully, that will work. As for your guide, will the P3 utility that you use in your video successfully flash the DM368 on an X5 board. From the hours of reading this forum, the Inspire Pilot's forum, and the GitHub for the DJI modules, it appears that the NAND for these DaVinci (DM36xxx) chips, as implemented by DJI in their various cameras, is essentially the same. If that's the case, your tool will be GREAT and simple to use as a fix. Otherwise, I'll have to dump the NAND contents from a working X5 and flash that to the non-working cameras with the serial flash utility, I think. It your P3 tool/s will work, please let me know and I'll find them and use them!
Thanks yet again!
-Mike
 
it appears that the NAND for these DaVinci (DM36xxx) chips, as implemented by DJI in their various cameras, is essentially the same.
It definitely does the same function, but there most likely are some minor differences. Using the U-boot from Ph3 would probably work (but since you said you've already extracted module 0800, you can just use the one from there). But the further we go (with kernel, and then user space software), the higher the chance there are some minor differences. Maybe In1 uses different video bit rate, maybe it uses some different GPIO lines - we can't tell if they're 100% compatible.

Also note, most wrapper tools are only able to flash u-boot. So if you're seeing "ERROR: can't get kernel image!" on the serial console, or if the kernel starts booting - these tools will not help. Use the `dji-firmware-tools` instruction in that case.

Finally,
I'll have to dump the NAND contents from a working X5 and flash that to the non-working cameras with the serial flash utility, I think.

This TIs `sfh.exe` utility is only really designed to flash u-boot. For kernel, there's a different procedure. Though I guess you could use the same way to flash the kernel, but you'd have to get sources of the `sfh.exe` and modify it to write to different place, and to expect larger input binary. Or I don't know, maybe the command line parameters it supports are enough to cheat it into flashing the kernel.

But you won't be able to flash root filesystem using `sfh.exe`, as it doesn't support the hardware parity which UBI File System utilizes (root filesystem is made with UbiFS). With invalid hardware checksums, sectors will be marked as bad after first read - so it will boot at most once.

You will find proper instructions for writing the root filesystem on github.

There's also the encrypted partition - it can be copied normally, but its content is different for each drone, as it's encrypted using a key stored in external SHA204 chip. So if rewriting everything from a specific board, it might be wise to save the content of this one. There are ways to make everything work without it, but this adds yet another level of complication to the whole process.
 
Last edited:
  • Like
Reactions: crash1sttime
i didnt understand much of what you wrote but it sounds like you have no video feed and want to get it back, in which case follow my video guide and use the flash tool.

If its been stored for a long time it has a 70% chance of repair if its had a torn ribbon then that is practically nil chance of repair

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.
dont forget to sub and like if it fixes the issue.
Excellent video. I use it
 
i
It definitely does the same function, but there most likely are some minor differences. Using the U-boot from Ph3 would probably work (but since you said you've already extracted module 0800, you can just use the one from there). But the further we go (with kernel, and then user space software), the higher the chance there are some minor differences. Maybe In1 uses different video bit rate, maybe it uses some different GPIO lines - we can't tell if they're 100% compatible.

Also note, most wrapper tools are only able to flash u-boot. So if you're seeing "ERROR: can't get kernel image!" on the serial console, or if the kernel starts booting - these tools will not help. Use the `dji-firmware-tools` instruction in that case.

Finally,


This TIs `sfh.exe` utility is only really designed to flash u-boot. For kernel, there's a different procedure. Though I guess you could use the same way to flash the kernel, but you'd have to get sources of the `sfh.exe` and modify it to write to different place, and to expect larger input binary. Or I don't know, maybe the command line parameters it supports are enough to cheat it into flashing the kernel.

But you won't be able to flash root filesystem using `sfh.exe`, as it doesn't support the hardware parity which UBI File System utilizes (root filesystem is made with UbiFS). With invalid hardware checksums, sectors will be marked as bad after first read - so it will boot at most once.

You will find proper instructions for writing the root filesystem on github.

There's also the encrypted partition - it can be copied normally, but its content is different for each drone, as it's encrypted using a key stored in external SHA204 chip. So if rewriting everything from a specific board, it might be wise to save the content of this one. There are ways to make everything work without it, but this adds yet another level of complication to the whole process.
great science fiction that i can understand 10% of those instructions:p:p
any way am still stuck and need to think a way to make a lipo fly my phantom3... its not me, a lot of us who may still need the phantom3 will find no more dji or ulternative replica batteries for the p3.... did any one solve this so there is a method to do as he do:rolleyes:
by the way its a great project nothing is mentioned about ... its not only the phantom3 a lot of dji drones the mavics too can share doing this diy battery (although newer mavic batteries are much more successful in endurance , performance , and long life), but it is still a need to make ur battery instead of the only smart one provided
 
Excellent video. I use it
BTW, I have confirmed (with two X5 cameras) that the application 'gaucho' created can successfully flash the Video Encoder/Live Feed board (containing the TI ...368 DaVinci chip), restoring the video feed to the transmitter/GO app.
 
BTW, I have confirmed (with two X5 cameras) that the application 'gaucho' created can successfully flash the Video Encoder/Live Feed board (containing the TI ...368 DaVinci chip), restoring the video feed to the transmitter/GO app.
do us a favor if u can putthe thing together in a video and post it on youtube so u can help others!!! by the way earlier we were stuck in some gimbals reflashing on the phantom3pro so maybe ur method may help in some cases, thanks in advance
 
do us a favor if u can putthe thing together in a video and post it on youtube so u can help others!!! by the way earlier we were stuck in some gimbals reflashing on the phantom3pro so maybe ur method may help in some cases, thanks in advance
I've written an extensive (8 page) 'tutorial' on how to do it, but I don't think the forum will allow such a lengthy post. The only difference in the process for flashing an X5 (from a P3P), is the board (Live View Encoder Board in the case of the X5) and location and naming of the pads on same. Otherwise, the process is IDENTICAL to that for a P3P camera/gimbal combo board. If (when, I'm sure) I get another 'bricked' X5, I'll film/take stills of the process, but my lengthy document is very detailed in the entire process from mechanical disassembly to the pad-to-FTDI hookup, to flashing, to reassembly. There is no other change from the P3P process. The use of the P3PV10 app is unchanged, including the images it flashes to NAND. I think that many of the DJI cameras that utilize the TI 365/368 DaVinci chips use the same firmware, and same locations/start points in NAND for same. I can certainly confirm the X5 does, at any rate! If there's a way to upload a Word document to the forum, I'm happy to share my 'tutorial'.
 
  • Like
Reactions: mj2019
Attaching PDF (converted from Word) 'tutorial' I wrote about the process for an X5. Note that I have not tested this with an X5S or X5R, as I do not have those cameras. It's worked (so far) on three 'standard' X5 cameras from Inspire 1 Pro aircraft.
 

Attachments

! by the way earlier we were stuck in some gimbals reflashing on the phantom3pro so maybe ur method may help in some cases, thanks in advance

see my post 332
 
  • Like
Reactions: Mark The Droner
Attaching PDF (converted from Word) 'tutorial' I wrote about the process for an X5. Note that I have not tested this with an X5S or X5R, as I do not have those cameras. It's worked (so far) on three 'standard' X5 cameras from Inspire 1 Pro aircraft.

Just an FYI the flashing tool you refer to was written by me, the link to it which you might want to include in your PDF, maybe put the link at the top with a suggestion of what tools are needed


also if you can send me a picture of the wiring i can rewrite the tool and call it X5flash and add it to my repository i will also add the manual to the tool as well if you want.

I dont visit the forum often so feel free to drop me an email at [email protected]
 
  • Like
Reactions: Mark The Droner
Just an FYI the flashing tool you refer to was written by me, the link to it which you might want to include in your PDF, maybe put the link at the top with a suggestion of what tools are needed


also if you can send me a picture of the wiring i can rewrite the tool and call it X5flash and add it to my repository i will also add the manual to the tool as well if you want.

I dont visit the forum often so feel free to drop me an email at [email protected]
My sincerest apologies! I've read thousands of posts, etc. I sincerely hope the 'by me a coffee' in your GUI compensates YOU! I'm a software developer by trade, and was absolutely interested in 'resurrecting' the cameras we have (law enforcement), as a challenge. THANK YOU for your efforts in combining what most folks would find a daunting task of extracting, decrypting, separating, re-encrypting and then uploading firmware to specific chipsets in the DJI hardware! It makes things MUCH simpler!
 

Members online

No members online now.

Forum statistics

Threads
143,514
Messages
1,471,057
Members
105,489
Latest member
AlienzEyes