Welcome to PhantomPilots.com

Sign up for a weekly email of the latest drone news & information

Guide: How to fix bricked P3S (FTP range mod)

Discussion in 'Standard' started by jackhadrill, Jun 24, 2016.

  1. jackhadrill

    Joined:
    May 4, 2016
    Messages:
    130
    Likes Received:
    54
    Location:
    United Kingdom
    Hello!!

    The P3S range mod that Ojcze Nasz discovered is absolutely incredible, however there are a few people (like me) who managed to brick their Phantoms rendering them useless!
    I hope no one minds, I've collated the steps into a PDF in the hope that it makes some peoples' lives a little easier.

    Anyway - PDF guide HERE

    Hope this helps!


    Credit to everyone who helped discover the mod, and fix the bricks - beshanoe, sparkymarky, Ojcze Nasz, TDKUK, ElMalo, BaDvs3viL - sorry if I missed anyone! I take no credit for finding the fix myself, only collating it.
     
    Argoxp, Ojcze Nasz, Argonaise and 2 others like this.
  2. jackhadrill

    Joined:
    May 4, 2016
    Messages:
    130
    Likes Received:
    54
    Location:
    United Kingdom
    I'm most definitely not a fan of 'bumping' posts - particularly given my lack of experience on this forum, but I believe that this remains useful for a lot of people.

    I forgot to add as well, if *for whatever reason* DJI changes their FTP/root password, perhaps this could be the new way in? What do you think?
     
  3. BaDvs3viL

    Joined:
    Jun 13, 2016
    Messages:
    134
    Likes Received:
    38
    Location:
    Chicago
    Cool, glad to see people getting their birds back in the air!
     
  4. sparkymarky

    Joined:
    Oct 20, 2015
    Messages:
    66
    Likes Received:
    3
    Location:
    Wales
    As one got a copy of RCs files, which I need to fix my bricked RC and drone, as seem to missing?
     
  5. BaDvs3viL

    Joined:
    Jun 13, 2016
    Messages:
    134
    Likes Received:
    38
    Location:
    Chicago
    If you follow the guide, it is pulling the RCs file from the back up flash.
     
  6. sparkymarky

    Joined:
    Oct 20, 2015
    Messages:
    66
    Likes Received:
    3
    Location:
    Wales
    Okay I'll give that a go, as I thought you have modify my accessing via ftp and Notepad++.

    If have look at one of last feeds, you can what I did? on I bricked my p3s with ftp range mod - let's fix it together
     
  7. sparkymarky

    Joined:
    Oct 20, 2015
    Messages:
    66
    Likes Received:
    3
    Location:
    Wales
    Help, I thought I had solution to fix it, I don't it happen to drone.

    What commands I need to using Vim?

    As this what going on with RC?

    Any suggestion?
    bootm 0x9f420000

    see rcS: applet not found below?

    U-Boot 1.1.4 (Mar 24 2016 - 12:37:01)

    MI124
    DRAM: 32 MB
    Flash: 8 MB
    In: serial
    Out: serial
    Err: serial
    Press ESC to abort autoboot in 1 seconds
    ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/de¶©–c½[Õ init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)

    ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)

    ar7240>

    ar7240>

    ar7240> bootm 0x9f420000

    ## Booting image at 9f420000 ...
    Image Name: MIPS OpenWrt Linux-3.10.49
    Created: 2015-08-20 3:19:32 UTC
    Image Type: MIPS Linux Kernel Image (lzma compressed)
    Data Size: 905294 Bytes = 884.1 kB
    Load Address: 80060000
    Entry Point: 80060000
    Verifying Checksum at 0x9f420040 ...OK
    Uncompressing Kernel Image ... OK

    Starting kernel ...

    [ 0.000000] Linux version 3.10.49 (yello@ubuntu) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r2635) ) #14 Thu Aug 20 11:19:19 CST 2015
    [ 0.000000] bootconsole [early0] enabled
    [ 0.000000] CPU revision is: 0001974c (MIPS 74Kc)
    [ 0.000000] SoC: Atheros AR9342 rev 2
    [ 0.000000] Clocks: CPU:560.000MHz, DDR:450.000MHz, AHB:225.000MHz, Ref:40.000MHz
    [ 0.000000] Determined physical RAM map:
    [ 0.000000] memory: 02000000 @ 00000000 (usable)
    [ 0.000000] User-defined physical RAM map:
    [ 0.000000] memory: 02000000 @ 00000000 (usable)
    [ 0.000000] Initrd not found or empty - disabling initrd
    [ 0.000000] Zone ranges:
    [ 0.000000] Normal [mem 0x00000000-0x01ffffff]
    [ 0.000000] Movable zone start for each node
    [ 0.000000] Early memory node ranges
    [ 0.000000] node 0: [mem 0x00000000-0x01ffffff]
    [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
    [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
    [ 0.000000] Kernel command line: board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all) mem=32M rootfstype=squashfs,jffs2 noinitrd
    [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
    [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
    [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
    [ 0.000000] Writing ErrCtl register=00000000
    [ 0.000000] Readback ErrCtl register=00000000
    [ 0.000000] Memory: 29180k/32768k available (2102k kernel code, 3588k reserved, 363k data, 220k init, 0k highmem)
    [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    [ 0.000000] NR_IRQS:51
    [ 0.000000] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
    [ 0.070000] pid_max: default: 32768 minimum: 301
    [ 0.070000] Mount-cache hash table entries: 512
    [ 0.080000] NET: Registered protocol family 16
    [ 0.080000] MIPS: machine is DJI WM305
    [ 0.290000] ath_usb_init: id: 1122
    [ 0.360000] bio: create slab <bio-0> at 0
    [ 0.360000] Switching to clocksource MIPS
    [ 0.370000] NET: Registered protocol family 2
    [ 0.370000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
    [ 0.380000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
    [ 0.390000] TCP: Hash tables configured (established 512 bind 512)
    [ 0.390000] TCP: reno registered
    [ 0.390000] UDP hash table entries: 256 (order: 0, 4096 bytes)
    [ 0.400000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    [ 0.410000] NET: Registered protocol family 1
    [ 0.430000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
    [ 0.430000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    [ 0.440000] msgmni has been set to 56
    [ 0.450000] io scheduler noop registered
    [ 0.450000] io scheduler deadline registered (default)
    [ 0.460000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
    [ 0.480000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
    [ 0.490000] console [ttyS0] enabled, bootconsole disabled
    [ 0.490000] console [ttyS0] enabled, bootconsole disabled
    [ 0.500000] ar934x-hs-uart.0: ttyATH0 at MMIO 0x18500000 (irq = 14) is a AR934X UART
    [ 0.510000] ath79-spi ath79-spi: master is unqueued, this is deprecated
    [ 0.520000] m25p80 spi0.0: found s25fl064k, expected m25p80
    [ 0.530000] m25p80 spi0.0: s25fl064k (8192 Kbytes)
    [ 0.530000] 10 cmdlinepart partitions found on MTD device ath-nor0
    [ 0.540000] Creating 10 MTD partitions on "ath-nor0":
    [ 0.540000] 0x000000000000-0x000000040000 : "u-boot"
    [ 0.550000] 0x000000040000-0x000000050000 : "u-boot-env"
    [ 0.560000] 0x000000050000-0x000000130000 : "kernel1"
    [ 0.560000] 0x000000130000-0x000000420000 : "rootfs1"
    [ 0.570000] 0x000000420000-0x000000500000 : "kernel2"
    [ 0.580000] 0x000000500000-0x0000007f0000 : "rootfs2"
    [ 0.580000] 0x0000007f0000-0x000000800000 : "art"
    [ 0.590000] 0x000000050000-0x000000420000 : "firmware1"
    [ 0.600000] 0x000000420000-0x0000007f0000 : "firmware2"
    [ 0.600000] 0x000000000000-0x000000800000 : "all"
    [ 0.610000] g_ether gadget: using random self ethernet address
    [ 0.610000] g_ether gadget: using random host ethernet address
    [ 0.620000] usb0: MAC 06:eb:10:2f:af:e0
    [ 0.630000] usb0: HOST MAC fa:06:18:1a:10:4b
    [ 0.630000] g_ether gadget: Ethernet Gadget, version: Memorial Day 2008
    [ 0.640000] g_ether gadget: g_ether ready
    [ 0.640000] TCP: cubic registered
    [ 0.650000] NET: Registered protocol family 17
    [ 0.650000] 8021q: 802.1Q VLAN Support v1.8
    [ 1.440000] jffs2: notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    [ 1.460000] VFS: Mounted root (jffs2 filesystem) readonly on device 31:5.
    [ 1.470000] Freeing unused kernel memory: 220K (802c9000 - 80300000)

    init started: BusyBox v1.22.1 (2015-06-29 19:28:31 CST)

    starting pid 219, tty '': '/etc/init.d/rcS'
    rcS: applet not found

    can't open /dev/ttyS0: No such file or directory

    process '/bin/ash --login' (pid 220) exited. Scheduling for restart.

    can't open /dev/ttyS0: No such file or directory

    process '/bin/ash --login' (pid 221) exited. Scheduling for restart.

    can't open /dev/ttyS0: No such file or directory

    process '/bin/ash --login' (pid 222) exited. Scheduling for restart.

    can't open /dev/ttyS0: No such file or directory

    process '/bin/ash --login' (pid 223) exited. Scheduling for restart.

    can't open /dev/ttyS0: No such file or directory

    process '/bin/ash --login' (pid 224) exited. Scheduling for restart.

    can't open /dev/ttyS0: No such file or directory
    ^C
    process '/bin/ash --login' (pid 225) exited. Scheduling for restart.

    any suggestion?[/QUOTE]
    [/QUOTE]
     
  8. jackhadrill

    Joined:
    May 4, 2016
    Messages:
    130
    Likes Received:
    54
    Location:
    United Kingdom
    I've read through this and can only suggest trying to force a firmware reset to see if it will fix any of the built-in firmware issues. To do this, download the 1.6.80 .bin file from DJI Phantom Accessories & Tips - Phantom Help, put it in the root of a freshly formatted FAT32 SD card, insert it into the camera (whilst attached to the drone), and then hold down the re-link button whilst turning on the drone. Leave it for 20-30 minutes (my camera got very hot) and then that should have hopefully fixed the backup firmware for you :) The bird still needs fixing however, the firmware install will most likely fail :/
     
  9. mwisnia

    Joined:
    Jul 1, 2016
    Messages:
    1
    Likes Received:
    0
    Guys thanks a lot for helping guys like me in unbricking their drones! Not sure what I'm doing wrong but when I bridge the reset with gnd on the arduino yun it brings the tx led on and I'm unable to connect via putty at all :( any thoughts?
     
  10. sparkymarky

    Joined:
    Oct 20, 2015
    Messages:
    66
    Likes Received:
    3
    Location:
    Wales
    Do you need to short reset with gnd? Why don't you short RX and TX, on the Arduino and start putty. Press a fews keys to see if get response back from the keys you pressed.
     
  11. jackhadrill

    Joined:
    May 4, 2016
    Messages:
    130
    Likes Received:
    54
    Location:
    United Kingdom
    Shorting TX and GND is required to bypass the ATMEGA. Removing the ATMEGA chip will have the same effect
     
  12. Adrian Ling Di Yeuan

    Joined:
    Jun 18, 2016
    Messages:
    13
    Likes Received:
    0

    The PDF file link is dead bro, possibly can you provide a new link? I could not download it.
     
  13. jackhadrill

    Joined:
    May 4, 2016
    Messages:
    130
    Likes Received:
    54
    Location:
    United Kingdom
    Sure, my hosting provider somehow managed to send a power surge through my server, killing the disks. I've got a backup on my computer which I'll send over if you email me. My email address can be found on my profile :)
     
  14. Dmitri Feldman

    Joined:
    Jul 31, 2016
    Messages:
    10
    Likes Received:
    0
    Sorry, if I in my foolishness broke the RcS file in the backup file system, too, is there a way to fix this. Or should I buy a new controller?
     
  15. Mukesh

    Joined:
    Jul 31, 2016
    Messages:
    2
    Likes Received:
    0

    Hi the link does not seem to work can you please provide another link. Thanks
     
  16. Yurandex

    Joined:
    Aug 13, 2016
    Messages:
    2
    Likes Received:
    0
    Hi from Moscow!
    Cool! Thanks! Worked! UART was connected, and I made kickback of the rcS file! It is good that they used OPEN WRT as an operating system!!
     
  17. armour

    Joined:
    Sep 8, 2016
    Messages:
    9
    Likes Received:
    3
    Hi Jack, could you please post PDF? Thanks
     
  18. godtec

    Joined:
    Sep 14, 2016
    Messages:
    6
    Likes Received:
    0
    ME three!
     
Loading...
Similar Threads - Guide fix bricked Forum Date
Newbie here...Question : Does the GPS/ap automatically disable the drone within FCC proximity guidel Introductions Jan 12, 2018
Comprehensive DJI Battery Guide General Discussion Nov 22, 2017
New 'FAA Aeronautical Chart User's Guide' Published Rules and Regulations Nov 17, 2017
A Guide on Configuring a Argtek Data Extender Standard Oct 18, 2017
Part 107 Study Guide Rules and Regulations Sep 28, 2017