I bricked my p3s with ftp range mod - let's fix it together

Joined
Jun 14, 2016
Messages
28
Reaction score
27
Age
54
I did range mod from Phantom 3 Standard range mod , let's do it together... and now my drone's RC doesn't create Wi-Fi access point. This topic is for those unfortunates who've done the same and don't know how to fix it. So please share your situation and ideas.
I used mac, filezilla and vim to change files. I defenitely forgot to do "chmod +x" which is thought to be crucial.
Today I brought my drone to the official repair service here in Moscow and I'm waiting now for their diagnosis, it should take up to 5 days thay said. It seemed that they have no special instruments for reuploading healthy firmware to RC and drone using service connectors or smth, but who knows..

UPDATE:

With common effort, the way to recover has been discovered. Basically, all you need is to connect to TX, RX, GND pins of Wi-Fi module board with UART TTL adapter and open serial console(see pictures here I bricked my p3s with ftp range mod - let's fix it together and here I bricked my p3s with ftp range mod - let's fix it together). Then you should prevent u-boot from loading linux kernel by pressing ESC key and type to u-boot console the next commands(thanks ElMalo):

MI124
DRAM: 32 MB
Flash: 8 MB
In: serial
Out: serial
Err: serial
Press ESC to abort autoboot in 1 seconds
ar7240> setenv bootargs board=DJI-WM305 console=ttyS0,115200 root=/dev/mtdblock5 init=/sbin/init mtdparts=ath-nor0:256k@0k(u-boot),64k@256k(u-boot-env),896k@320k(kernel1),3008k@1216k(rootfs1),896k@4224k(kernel2),3008k@5120k(rootfs2),64k@8128k(art),3904k@320k(firmware1),3904k@4224k(firmware2),8192k@0k(all)

And then

ar7240> bootm 0x9f420000

This will allow you to boot backup copy of system. After that you'll be able to mount main root filesystem:

mkdir /tmp/flash

And then mount it:

mount -t jffs2 mtd3 /tmp/flash

Then you can go to /tmp/flash/etc/init.d folder and repair the rcS.

In order to recover drone you should repeat all the steps but connect UART to gimbal's board. Here are the pictures of pins you need to connect with your UART adapter.


Thanks everyone who participated in the research!
 
Last edited:
Sorry to hear about the 'Bricking'!

I have followed the progress of the mod from the start as not only do I own a P3S with poor video since the FW upgrade but I have a long interest in electronics and RF stuff (Radio Ham and all that boring stuff)

I can only hope that there is a way to access the RC via the USB port and have searched the net without any mention of this BUT!!! One piece of hope is that from pictures posted of people's RCs opened up for other mods, I can see that the RC USB port has FOUR wires connected inside the case.

To my mind this means it isn't just for power but is a proper data connection!

There used to be a windows driver for the P2 I believe? I think something similar would be needed here otherwise it would take some real low-level connectivity stuff to get in.

Best of luck! I am still searching and asking colleagues who work in the field of wifi and programmable devices.....
 
  • Like
Reactions: beshanoe
hear's a thought....if you reset the RC wifi by pushing the gimbal wheel UP and flapping SW2 or is it SW1??? anyway.....

what happens if you take the gimbal wheel all the way DOWN and flap it??? would be nice if it reset the entire RC!!
 
Thanks! I've also tried to research on RC's usb and what I have found is that DJI win driver from P2 installs successfully and COM device DJI CONTROLLER appears, but other software for P2 like Phantom Assistant don't see connected RC. Moreover, I tried to connect to this COM device using terminal apps but no luck here as well. I managed to determine which chip is the heart of RC, it's Atheros AR9344 or similar SoC, it has advanced Wifi capabilities as well Ethernet ones. I wish RCs had service Ethernet-port to access console, but it had no. Not to mention it's quite difficult to reach the chip, it's hidden under radiator and thermo-stuff. So the special flashing tool is definitely needed here. Another idea is to dump memory chip and flash it with fixed firmware somehow.
 
hear's a thought....if you reset the RC wifi by pushing the gimbal wheel UP and flapping SW2 or is it SW1??? anyway.....

what happens if you take the gimbal wheel all the way DOWN and flap it??? would be nice if it reset the entire RC!!
I tried many different manipulations with RC, wifi resetting sequence doesn't seem to have any effect on RC, however flapping SWs without touching the gimbal wheel results in RC's beeping but Wifi is still not there.
 
Its all coming back to me now!! I've done a very small amount of fiddlear$1ng around with things like this in security/door-control systems and hotel wifi points....

I am guessing that we need to gain access to the serial interface on the AR9344...this would take an old-school pc with a serial port or a serial-USB converter. Then using Putty or a similar prog you can access basic commands on the chip. New firmware/software would be loaded via TFTP.

Just hoping to prod someones latent tech ability by my 'thinking out load' here
 
OK now in full dog with-a-bone mode!!

I am running with a total guess but just maybe using something like USB to UART Bridge VCP Drivers | Silicon Labs

it might just be possible to use Putty and connect to the serial int on the RC??

My remote is fine but I am going to try this in a bit and will report back. If a connection is possible then the flash via TFTP method may become possible or we may even be able to change those file permissions through the serial SSH connection!

I am way beyond my comfort zone here so don't hold your breath!
 
  • Like
Reactions: Davey B
I'll follow this thread too. Have you looked at the datasheet? http://cykey.ca/~cykey/airport/AR9344.pdf
Thanks....yes I have it on screen amongst a million other windows! lol

tried the UART driver and Putty connection but win 10 says 'Can't open COM1'

I have probably made a schoolboy error but just trying to help out here. I am hoping they have built the rc so that you can connect to the chip via serial although some devices have internal connections or need a few wires soldering in the right place....right out of my depth here!?!?!??
 
there are tx/rx/gnd on the RC main board under 2.4g module, should be serial console port
 
what about the D+ and D- marked pins by the usb socket? data lines maybe?
I believe that this way is closed for mere mortals, it's maybe connected to some intermediate chip with proprietary protocol. Though I've seen projects for connecting RC to PC in orger to control flight simulator but I haven't tried it. They should somehow communicate using this protocol
 
what about the D+ and D- marked pins by the usb socket? data lines maybe?
D+ and D- are USB data lines.
RX TX are most likey serial lines, do you have a picture ?

There is one BOOTO. Boot Option. Wondering if that can be used to reflash somehow.
 

Recent Posts

Members online

Forum statistics

Threads
143,066
Messages
1,467,352
Members
104,933
Latest member
mactechnic