Guide: How to fix bricked P3S (FTP range mod)

D

Deleted member 61170

Guest
Hello!!

The P3S range mod that Ojcze Nasz discovered is absolutely incredible, however there are a few people (like me) who managed to brick their Phantoms rendering them useless!
I hope no one minds, I've collated the steps into a PDF in the hope that it makes some peoples' lives a little easier.

Anyway - PDF guide HERE

Hope this helps!


Credit to everyone who helped discover the mod, and fix the bricks - beshanoe, sparkymarky, Ojcze Nasz, TDKUK, ElMalo, BaDvs3viL - sorry if I missed anyone! I take no credit for finding the fix myself, only collating it.
 
I'm most definitely not a fan of 'bumping' posts - particularly given my lack of experience on this forum, but I believe that this remains useful for a lot of people.

I forgot to add as well, if *for whatever reason* DJI changes their FTP/root password, perhaps this could be the new way in? What do you think?
 
Help, I thought I had solution to fix it, I don't it happen to drone.

What commands I need to using Vim?

As this what going on with RC?

Any suggestion?
bootm 0x9f420000

see rcS: applet not found below?

U-Boot 1.1.4 (Mar 24 2016 - 12:37:01)

MI124
DRAM: 32 MB
Flash: 8 MB
In: serial
Out: serial
Err: serial
Press ESC to abort autoboot in 1 seconds
ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/de¶©–c½[Õ init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)

ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)

ar7240>

ar7240>

ar7240> bootm 0x9f420000

## Booting image at 9f420000 ...
Image Name: MIPS OpenWrt Linux-3.10.49
Created: 2015-08-20 3:19:32 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 905294 Bytes = 884.1 kB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum at 0x9f420040 ...OK
Uncompressing Kernel Image ... OK

Starting kernel ...

[ 0.000000] Linux version 3.10.49 (yello@ubuntu) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r2635) ) #14 Thu Aug 20 11:19:19 CST 2015
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 0001974c (MIPS 74Kc)
[ 0.000000] SoC: Atheros AR9342 rev 2
[ 0.000000] Clocks: CPU:560.000MHz, DDR:450.000MHz, AHB:225.000MHz, Ref:40.000MHz
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 02000000 @ 00000000 (usable)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 02000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x01ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x01ffffff]
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
[ 0.000000] Kernel command line: board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all) mem=32M rootfstype=squashfs,jffs2 noinitrd
[ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 29180k/32768k available (2102k kernel code, 3588k reserved, 363k data, 220k init, 0k highmem)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:51
[ 0.000000] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
[ 0.070000] pid_max: default: 32768 minimum: 301
[ 0.070000] Mount-cache hash table entries: 512
[ 0.080000] NET: Registered protocol family 16
[ 0.080000] MIPS: machine is DJI WM305
[ 0.290000] ath_usb_init: id: 1122
[ 0.360000] bio: create slab <bio-0> at 0
[ 0.360000] Switching to clocksource MIPS
[ 0.370000] NET: Registered protocol family 2
[ 0.370000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[ 0.380000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[ 0.390000] TCP: Hash tables configured (established 512 bind 512)
[ 0.390000] TCP: reno registered
[ 0.390000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.400000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.410000] NET: Registered protocol family 1
[ 0.430000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.430000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.440000] msgmni has been set to 56
[ 0.450000] io scheduler noop registered
[ 0.450000] io scheduler deadline registered (default)
[ 0.460000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.480000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[ 0.490000] console [ttyS0] enabled, bootconsole disabled
[ 0.490000] console [ttyS0] enabled, bootconsole disabled
[ 0.500000] ar934x-hs-uart.0: ttyATH0 at MMIO 0x18500000 (irq = 14) is a AR934X UART
[ 0.510000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[ 0.520000] m25p80 spi0.0: found s25fl064k, expected m25p80
[ 0.530000] m25p80 spi0.0: s25fl064k (8192 Kbytes)
[ 0.530000] 10 cmdlinepart partitions found on MTD device ath-nor0
[ 0.540000] Creating 10 MTD partitions on "ath-nor0":
[ 0.540000] 0x000000000000-0x000000040000 : "u-boot"
[ 0.550000] 0x000000040000-0x000000050000 : "u-boot-env"
[ 0.560000] 0x000000050000-0x000000130000 : "kernel1"
[ 0.560000] 0x000000130000-0x000000420000 : "rootfs1"
[ 0.570000] 0x000000420000-0x000000500000 : "kernel2"
[ 0.580000] 0x000000500000-0x0000007f0000 : "rootfs2"
[ 0.580000] 0x0000007f0000-0x000000800000 : "art"
[ 0.590000] 0x000000050000-0x000000420000 : "firmware1"
[ 0.600000] 0x000000420000-0x0000007f0000 : "firmware2"
[ 0.600000] 0x000000000000-0x000000800000 : "all"
[ 0.610000] g_ether gadget: using random self ethernet address
[ 0.610000] g_ether gadget: using random host ethernet address
[ 0.620000] usb0: MAC 06:eb:10:2f:af:e0
[ 0.630000] usb0: HOST MAC fa:06:18:1a:10:4b
[ 0.630000] g_ether gadget: Ethernet Gadget, version: Memorial Day 2008
[ 0.640000] g_ether gadget: g_ether ready
[ 0.640000] TCP: cubic registered
[ 0.650000] NET: Registered protocol family 17
[ 0.650000] 8021q: 802.1Q VLAN Support v1.8
[ 1.440000] jffs2: notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 1.460000] VFS: Mounted root (jffs2 filesystem) readonly on device 31:5.
[ 1.470000] Freeing unused kernel memory: 220K (802c9000 - 80300000)

init started: BusyBox v1.22.1 (2015-06-29 19:28:31 CST)

starting pid 219, tty '': '/etc/init.d/rcS'
rcS: applet not found

can't open /dev/ttyS0: No such file or directory

process '/bin/ash --login' (pid 220) exited. Scheduling for restart.

can't open /dev/ttyS0: No such file or directory

process '/bin/ash --login' (pid 221) exited. Scheduling for restart.

can't open /dev/ttyS0: No such file or directory

process '/bin/ash --login' (pid 222) exited. Scheduling for restart.

can't open /dev/ttyS0: No such file or directory

process '/bin/ash --login' (pid 223) exited. Scheduling for restart.

can't open /dev/ttyS0: No such file or directory

process '/bin/ash --login' (pid 224) exited. Scheduling for restart.

can't open /dev/ttyS0: No such file or directory
^C
process '/bin/ash --login' (pid 225) exited. Scheduling for restart.

any suggestion?[/QUOTE]
[/QUOTE]
 
Help, I thought I had solution to fix it, I don't it happen to drone.

What commands I need to using Vim?

As this what going on with RC?

Any suggestion?
bootm 0x9f420000

see rcS: applet not found below?

U-Boot 1.1.4 (Mar 24 2016 - 12:37:01)

MI124
DRAM: 32 MB
Flash: 8 MB
In: serial
Out: serial
I've read through this and can only suggest trying to force a firmware reset to see if it will fix any of the built-in firmware issues. To do this, download the 1.6.80 .bin file from DJI Phantom Accessories & Tips - Phantom Help, put it in the root of a freshly formatted FAT32 SD card, insert it into the camera (whilst attached to the drone), and then hold down the re-link button whilst turning on the drone. Leave it for 20-30 minutes (my camera got very hot) and then that should have hopefully fixed the backup firmware for you :) The bird still needs fixing however, the firmware install will most likely fail :/
 
Guys thanks a lot for helping guys like me in unbricking their drones! Not sure what I'm doing wrong but when I bridge the reset with gnd on the arduino yun it brings the tx led on and I'm unable to connect via putty at all :( any thoughts?
 
Guys thanks a lot for helping guys like me in unbricking their drones! Not sure what I'm doing wrong but when I bridge the reset with gnd on the arduino yun it brings the tx led on and I'm unable to connect via putty at all :( any thoughts?

Do you need to short reset with gnd? Why don't you short RX and TX, on the Arduino and start putty. Press a fews keys to see if get response back from the keys you pressed.
 
Do you need to short reset with gnd? Why don't you short RX and TX, on the Arduino and start putty. Press a fews keys to see if get response back from the keys you pressed.
Shorting TX and GND is required to bypass the ATMEGA. Removing the ATMEGA chip will have the same effect
 
Hello!!

The P3S range mod that Ojcze Nasz discovered is absolutely incredible, however there are a few people (like me) who managed to brick their Phantoms rendering them useless!
I hope no one minds, I've collated the steps into a PDF in the hope that it makes some peoples' lives a little easier.

Anyway - PDF guide HERE

Hope this helps!


Credit to everyone who helped discover the mod, and fix the bricks - beshanoe, sparkymarky, Ojcze Nasz, TDKUK, ElMalo, BaDvs3viL - sorry if I missed anyone! I take no credit for finding the fix myself, only collating it.


The PDF file link is dead bro, possibly can you provide a new link? I could not download it.
 
Sure, my hosting provider somehow managed to send a power surge through my server, killing the disks. I've got a backup on my computer which I'll send over if you email me. My email address can be found on my profile :)
 
Sorry, if I in my foolishness broke the RcS file in the backup file system, too, is there a way to fix this. Or should I buy a new controller?
 
Hello!!

The P3S range mod that Ojcze Nasz discovered is absolutely incredible, however there are a few people (like me) who managed to brick their Phantoms rendering them useless!
I hope no one minds, I've collated the steps into a PDF in the hope that it makes some peoples' lives a little easier.

Anyway - PDF guide HERE

Hope this helps!


Credit to everyone who helped discover the mod, and fix the bricks - beshanoe, sparkymarky, Ojcze Nasz, TDKUK, ElMalo, BaDvs3viL - sorry if I missed anyone! I take no credit for finding the fix myself, only collating it.


Hi the link does not seem to work can you please provide another link. Thanks
 
Hi from Moscow!
Cool! Thanks! Worked! UART was connected, and I made kickback of the rcS file! It is good that they used OPEN WRT as an operating system!!
 

Members online

Forum statistics

Threads
143,066
Messages
1,467,354
Members
104,933
Latest member
mactechnic