Skip to content

Instantly share code, notes, and snippets.

@Aciid
Created August 15, 2018 13:06
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Aciid/1d3b1479994cfd1e22f65cda9fb577a7 to your computer and use it in GitHub Desktop.
Save Aciid/1d3b1479994cfd1e22f65cda9fb577a7 to your computer and use it in GitHub Desktop.
Parrot ANAFI MPP peristance hack via firmware

1GB NAND SIMULATION sudo modprobe nandsim first_id_byte=0xec
second_id_byte=0xd3
third_id_byte=0x51
fourth_id_byte=0x95


dmesg [ 1541.400413] [nandsim] warning: read_byte: unexpected data output cycle, state is STATE_READY return 0x0 [ 1541.400415] [nandsim] warning: read_byte: unexpected data output cycle, state is STATE_READY return 0x0 [ 1541.400416] [nandsim] warning: read_byte: unexpected data output cycle, state is STATE_READY return 0x0 [ 1541.400416] [nandsim] warning: read_byte: unexpected data output cycle, state is STATE_READY return 0x0 [ 1541.400419] [nandsim] warning: write_byte: command (0x90) wasn't expected, expected state is STATE_READY, ignore previous states [ 1541.400421] nand: device found, Manufacturer ID: 0xec, Chip ID: 0xd3 [ 1541.400421] nand: Samsung NAND 1GiB 3,3V 8-bit [ 1541.400423] nand: 1024 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 1541.400435] flash size: 1024 MiB [ 1541.400435] page size: 2048 bytes [ 1541.400436] OOB area size: 64 bytes [ 1541.400436] sector size: 128 KiB [ 1541.400437] pages number: 524288 [ 1541.400437] pages per sector: 64 [ 1541.400437] bus width: 8 [ 1541.400438] bits in sector size: 17 [ 1541.400438] bits in page size: 11 [ 1541.400439] bits in OOB size: 6 [ 1541.400439] flash size with OOB: 1081344 KiB [ 1541.400440] page address bytes: 5 [ 1541.400440] sector address bytes: 3 [ 1541.400441] options: 0x8 [ 1541.403047] Scanning device for bad blocks [ 1541.403062] [nandsim] warning: write_byte: command (0x0) wasn't expected, expected state is STATE_READY, ignore previous states [ 1541.429912] Creating 1 MTD partitions on "NAND 1GiB 3,3V 8-bit": [ 1541.429916] 0x000000000000-0x000040000000 : "NAND simulator partition 0" [ 1541.431711] [nandsim] warning: CONFIG_MTD_PARTITIONED_MASTER must be enabled to expose debugfs stuff


sudo modprobe ubi


aciid@ubuntu:/Desktop/mpp3$ flash_erase /dev/mtd0 0 0 flash_erase: error!: /dev/mtd0 error 13 (Permission denied) aciid@ubuntu:/Desktop/mpp3$ sudo !! sudo flash_erase /dev/mtd0 0 0 Erasing 128 Kibyte @ 3ffe0000 -- 100 % complete


ubireader_display_info mpp3-linux.ubi ubireader_utils_info mpp3-linux.ubi

aciid@ubuntu:/Desktop/mpp3$ sudo ubiformat /dev/mtd0 -y -f mpp3-linux.ubi -O 2048 -s 1024 ubiformat: mtd0 (nand), size 1073741824 bytes (1024.0 MiB), 8192 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes libscan: scanning eraseblock 8191 -- 100 % complete
ubiformat: 8192 eraseblocks are supposedly empty ubiformat: flashing eraseblock 185 -- 100 % complete
ubiformat: formatting eraseblock 8191 -- 100 % complete
aciid@ubuntu:
/Desktop/mpp3$


aciid@ubuntu:~/Desktop/mpp3$ sudo mkdir /media/ubiorig


aciid@ubuntu:/Desktop/mpp3$ sudo ubiattach -p /dev/mtd0 -O 2048 UBI device number 0, total 8192 LEBs (1040187392 bytes, 992.0 MiB), available 7547 LEBs (958287872 bytes, 913.9 MiB), LEB size 126976 bytes (124.0 KiB) aciid@ubuntu:/Desktop/mpp3$ ubiattach -h


aciid@ubuntu:~/Desktop/mpp3$ sudo mount -t ubifs ubi0 /media/ubiorig


MPP (RC) is already rooted, try something else Wrote greetings into the one /etc files


sudo /usr/sbin/mkfs.ubifs -m 2048 -e 126976 -c 4096 -x lzo -f 8 -k r5 -p 1 -l 5 -r /media/ubiorig img-708586_0.ubifs

Comment out flags in file img-708586.ini sudo /usr/sbin/ubinize -p 131072 -m 2048 -O 2048 -s 2048 -x 1 -Q 708586 -o img-708586.ubi ubifs-root/mpp3-linux.ubi/img-708586/img-708586.ini


aciid@ubuntu:~/Desktop/mpp3$ scp root@192.168.1.78:/private/var/mobile/Containers/Data/Application/F80FB1A7-B333-4C17-AB92-49E3048F95CC/Library/Preferences/com.parrot.freeflight6.plist .


Modify mpp3-update.tar.gz as follows remove original mpp3-linux.ubi and replace it with the created img-708586.ubifs ( this file is created when you run ubinize )


On your macbook, edit the com.parrot.freeflight6.plist md5sum inside to match the mpp3-update.tar.gz Replace mpp3_update.tar.gz in iOS datastorage


Run update on controller via freeflight6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment