Hello Tello Pilot!
Join our DJI Tello community & remove this banner.
Sign up

Communication protocol

sandsmark

New member
Joined
Jan 20, 2019
Messages
1
Reaction score
4
I wanted to try to run my own code on my drone, so I started poking around.

Someone dumped the entire firmware from the onboard storage, but unfortunately it seems like this is encrypted similarly to other DJI drones. And noone seems to have managed to get the keys to this yet, otherwise it would be simple to port the tools from here: o-gs/dji-firmware-tools

So then I started trying to interface with it over USB. By pressing the power button in some random order it eventually goes into some recovery mode where it appears as a USB ACM/serial adapter. I tried just connecting a serial adapter, but got nothing meaningful back. But the comm_serialtalk.py tool from the above repo seemed to be able to communicate, so it seems like it uses the DJI Universal Packet Container over serial.

Then I started looking at the UDP protocol for controlling it over wifi, and it seems pretty similar (same weird size encoding) though not identical; compare Low-Level Protocol to o-gs/dji-firmware-tools

It seems to possibly share some of the command IDs as well. I got a couple of 0x43 and 0x44 packets from it, which according to the wiki here are error responses, which makes sense since I don't know what I'm doing. But when connected I got a ton of 0xe packets from it, and while 0xe isn't documented in the wiki here according to the protocol dissectors for DUPC it's a heartbeat (which makes sense): o-gs/dji-firmware-tools


But it doesn't seem like everything matches, so I wonder if anyone has looked into this already, tried to match the known DUPC commands to what the app sends via UDP over wifi?
 

tello_ar

Well-known member
Joined
Dec 29, 2018
Messages
46
Reaction score
17
Location
Maryland, USA
I am somewhat under the impression that Ryze is primarily behind the development of this small drone and if you're having trouble with reverse engineering using the DJI route, it may not work as expected.
It is my impression that the Tello mostly is built around the Myriad 2 chip and maybe that might be angle of attack to take here. I couldn't find out too much about it, but didn't try as hard as other have.

This might perhaps point you in the right direction of the core philosophy driving the Tello from within it's Myriad 2:
http://eyesofthings.eu/wp-content/uploads/deliverables/EoT_D3.3.pdf
Good luck.
 

New Threads

Members online

Forum statistics

Threads
3,242
Messages
25,065
Members
8,353
Latest member
andalou