Fixing flash in DM365 chip within Ph3 Pro gimbal

[quaddamage]

DM365 uses USB for OUTPUT. That output is supposed to be connected to deserializer, which then outputs the data in parallel for FPGA (logic gates can't take serialized data, and USB is Universal _Serial_ Bus).

Both the FPGA and the deserializer (Cypress USB controller) are located on OFDM board.

So the message `Init libusb faild!` basically means that the USB connection isn't working.
Fix the connection.

Look, there's even a pinout of the connection:
O-Gs wiki: Gimbal top board ribbon cable connector to ofdm module

 

[gmtandi]

Hey!

Got a P3Pro from a friend, crashed, arm hit the nand... reballed and resoldered the nand flash, no led (not even a single blink/ neither red/green), no video signal... bootlog as follows, any hint? Camera controls not working, neither can not see sd card in app... the gimbal calibration works ok, all voltage TPs are also ok...

found out that the ribbon cable was damaged... after fixing it now DJI logo on a black screen apeared on the app, earlier a gray screen was apearing.. bootlog is up-to-date . still no image, 0 fps, video lost
...

no luck attaching bootlog in post, neither could'nt paste here.... so uploaded to paste bin

Untitled - Pastebin

Pastebin.pl is a website where you can store code/text online for a set period of time and share to anybody on earth

pastebin.pl

...

On u0 pins i get only a boot loop. i don't know if it is normal... like

Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
---------------------------------------------
Cortex Boot-Up Success

Cortex freq: 504000000
ARM freq: 132000000
DDR freq: 528000000
Core freq: 216000000
iDSP freq: 264000000
AXI freq: 168000000
AHB freq: 108000000
APB freq: 54000000
UART freq: 1846153
SD0 freq: 15428571
SD1 freq: 15428571
---------------------------------------------

Start WDT timer OK.
Magic: 0x87651234 0x4 0x789aedcf
System WARM boot.
Detecting
........

 

[quaddamage]

Gimbal LED is controlled by Ambarella, the same chip from which you've gathered logs at U0 interface.
So my hint is: read about Ambarella at O-Gs wiki.

All success stories I've heard about fixing Ambarella were either resoldering or just keeping it on until it miraculously went through the bootloader. I don't think anyone reflashed it manually. Though allegedly there are tools `ambalink` and `ambausb` which allow to do that.

 

[gmtandi]

All success stories I've heard about fixing Ambarella were either resoldering or just keeping it on until it miraculously went through the bootloader. I don't think anyone reflashed it manually. Though allegedly there are tools `ambalink` and `ambausb` which allow to do that.

Good, I don't have stencil for rebaling the ram neither the Ambarella SoC, so my last try on it will be reflow on RAM and Ambarella...

When I opened the case I have noticed that the qr code sticker on top of DM365's NAND was burned also the DM365 nand was misaligned and some of the "bga pins" not touching the board. I don't know if that was caused by another tech, or by the crash.. Ater reballing DM365's NAND I've been able to access DaVinci shell... Even after that I was not able to receive video on APP, so I tried your trick to reprogram the bootloader, no luck... but hey, Linux is running on DM365 so that is not the problem at now and seems that the NAND chip is fine..

I got this P3 pro is from friend, he sent to 2 tech before sending to me, the other techs said will need to replace the entire gimbal and maybe the main board... I've noticed that seems that the original flex cable (the flat one for motors/camera) has been replaced, so I am not sure if the cable could influence in it booting or not...

As for Ambarella, do you have any idea about what does it try to "detect" on boot? I have read many times the wiki, but there are some things that I could'nt find answer by there... May be the fault could be on another microcontroller on the board?

The red/green led should light/blink once power is supplied to the board, even without any flex cable connected? I mean, Ambarella should boot even on that conditions?
...
Also, I've noticed that when I was reballing the Ambarella's NAND, I tried to boot without NAND soldered on board and got no reply trought U0, so I think the Ambarella's NAND is ok as when it is soldered on the board I got reply, is it ok?
...
I have noticed from my Ambarella bootlog that some frequencies (arm/sd0/sd1) are lower than the ones i've seen by here (from other users), what could be done on that? May it be some kind of bad firmware/update?

 

[quaddamage]

As for Ambarella, do you have any idea about what does it try to "detect" on boot? I have read many times the wiki, but there are some things that I could'nt find answer by there... May be the fault could be on another microcontroller on the board?

That's a good lead. The chip reboots after "Detecting" message, without printing "done" after that. I wonder if that code comes from bootrom, or bootloader.

The red/green led should light/blink once power is supplied to the board, even without any flex cable connected? I mean, Ambarella should boot even on that conditions?

Yes. Modules boot even when disconnected. Davinci will reboot, but will properly load Linux first.

 

[gmtandi]

I did reflow on the Ambarella and ddr module, no luck.... jost noticed that after sending [ESC] (key) trought serial, i have received "AmbaTools>" shell... there i found some commands.., show command show no partition, while diag command causes instant "boot loop"

AmbaTools> help
help [command]
Get help on [command], or a list of supported commands if a command is omitted.
The following commands are supported:
show
erase
diag
writew
readw

show

show ptb - flash partition table
show meta - flash meta table

AmbaTools> show ptb

AmbaTools> show meta

: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1
: sblk: -1 nblks: -1

crc32: 0xffffffff

diag

Do Device diag
diag ddr [rotate|pattern] [test loop count(0 for infinite loop)] [Dram Size]diag nand verify all

...

this thread is for DM365, i will continue my research on github, thank you for your patience friend

 

[Edoman]

openssl des3 -d -k Dji123456 -in P3X_FW_V01.07.0060_m0800.bin

hello this file is encrypted and i can't open it i get an error with openssl can you help me i need uImage files

Dji123456 ? why

 

[Edoman]

openssl des3 -d -k Dji123456 -in P3X_FW_V01.07.0060_m0800.bin

hello this file is encrypted and i can't open it i get an error with openssl can you help me i need uImage files

Dji123456 ? why

 

[quaddamage]

hello this file is encrypted and i can't open it i get an error with openssl can you help me i need uImage files

Dji123456 ? whyView attachment 122782

the OpenSSL used when dji made the firmware used MD5 as hashing algorithm. Use proper param to set it.

 

[Edoman]

dji, bellenimi MD5'i karma algoritma olarak kullandığında kullanılan OpenSSL. Ayarlamak için uygun param kullanın.

Do you know the parameters, how can I do it?
can you give me the files?

bana dosyaları verir misin

 

[cheddarman]

I've seen this "flashing" thing on several drone forums over the years, and have not a clue what you're all talking about

 

[quaddamage]

Do you know the parameters, how can I do it?

The proper parameter is on O-Gs wiki. That would be very easy to figure out by yourself.

 

[aleksadamov]

Guys, maybe this will help. Drone was bought in 2016, had 1 flight, than month ago upgraded. So now i have same problem:

[00242782]Version checking[2]...
[00242874][03 06][00] v2.4.20.50 -> v2.4.20.50
[00242959][03 05][00] v34.2.0.9 -> v34.2.0.9
[00243010][04 00][00] v1.48.0.0 -> v1.48.0.0
[00243135][11 00][00] v1.8.0.0 -> v1.8.0.0
[00243262][11 01][00] v1.8.0.0 -> v2.0.0.33, firmware v1.8.0.0 not support.
[00243310][11 01][00] v1.8.0.0 -> v2.0.0.33
[00243413][12 00][00] v1.12.0.0 -> v1.12.0.0
[00243523][12 01][00] v1.12.0.0 -> v1.12.0.0
[00243628][12 02][00] v1.12.0.0 -> v1.12.0.0
[00243727][12 03][00] v1.12.0.0 -> v1.12.0.0
[00256275][15 00][00] device not detected.
[00256363][17 00][00] v1.1.1.7 -> v1.1.1.7
[00256483][17 01][00] v1.0.2.7 -> v1.0.2.7
[00256559][19 00][00] v1.0.8.96 -> v1.0.8.96
[00256604][01 00][00] v1.32.5432 -> v1.32.5432
[00256655][01 01][00] v1.32.5432 -> v1.32.5432
[00269202][08 00][00] device not detected.
[00269300][09 00][05] v4.1.0.0 -> v4.1.0.0
[00269347]Packet upgrade failed at version checking.

BUT! When i fly with the first battery, Everything is perfect, just there is no transmit, sometimes writes "weak signal" And when it out of energy i change battery, and the second one just magically turn transmittion on. I don't understand how it works. Just today tried the third time 1,7km away, and it was working perfectly. But when paste another battery it doesn't work. When i turn home both batteries don't work. Lookes like when smth hit up and it starts to work.

Check with multimeter whether the wires you soldered really provide 3.3V to the BT00/BT01 pins.

If they do, and the chip doesn't enter the boot mode - that would probably mean that the pins are not connected to the chip.

 

[KachemakDiver]

If it was me, I’d reflash the nand chip.

 

[Shehab1998]

Guys can anyone help with this problem please

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[mj2019]

hi every one, hope ur all fine. a new challenge if u like to contribute

Dji smart battery replacement attempt

hi every one, since am along some one else who may think that phantom 3 is still air worthy, and since not a lot of batteries are still available for this craft in market or if any is still there the quality or price maybe a concern so i tried to solve this by using our hobby avalable 4s lipo s...

phantompilots.com

 

[guewald]

Hello
I have a damager P3P gimbal top board. Put a brand new NAND on the boar, flash all partitions but the boot seems not finding the kernel.
Someone with similar issue?

 

[quaddamage]

flash all partitions but the boot seems not finding the kernel.

That's correct assessment. There is no kernel at expected address, no primary and no secondary.

How exactly did you flashed the kernel? Command lines?

 

[guewald]

That's correct assessment. There is no kernel at expected address, no primary and no secondary.

How exactly did you flashed the kernel? Command lines?

I follow the instructions on Flashing firmware on DaVinci media processors
Using USB stick
They seems to flash correctly

 

[quaddamage]

Err.. you've loaded `uImage` to memory (RAM) at 0x80008000.
Then you've overwritten that (in RAM) with `uImage_recovery`.
And then you tried to load and boot kernel from the NAND (which you did not modified at all).

You seem to be missing NAND write commands.