Experienced Tello repair

Murdock17x · Dec 9, 2021

I have been teaching drone flight to 7-16yo's for 5 years now. Our level 3 class is the repair of drones that have been damaged in the first 2 level classes... Most of the time it is just motor replacements and they are up and flying again BUT! We have a few drones that fail their internal system checks!!! Is there a list of what the different LED indicator lights mean??? We all know what the owner's manual says but what about the internal system check on startup stopping at green or yellow or the dreaded RED??? Or how about 2 slow blue with 4 fast blue or 1 slow 7 fast blue?

quaddamage · Dec 10, 2021

Since the firmware is encrypted, we can't get this information from reverse engineering the code which sets the LEDs, as was done for other drones.

BUT - for these other drones, besides LED indication, there were also packets sent with more readable explanation.
Maybe it's possible to connect to some kind of UART, or analyze the WiFi communication, to get the error info.

For example, here is the reverse engineered code from my beloved Phantom 3 - the 'errmsg' is a packet visible in communication sniffed from front USB of the drone:

C:

    if (sub_80708DE(41) && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 4;
        errmsg = "Off radius limit landed";
        mallow = 0;
    } else if ((sub_80708DE(9) == 1 || sub_80708DE(8) == 1) && !g_real__force_on.ignore_compass_error && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 1;
        errmsg = "Compass error!";
        mallow = 0;
    } else if (byte_20001E2C == 1 && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 2;
        errmsg = "Assistant protect!";
        mallow = 0;
    } else if (byte_200018A0 == 1 && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 3;
        errmsg = "Device lock protect!";
        mallow = 0;
    } else if (sub_80708DE(68) == 1 && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 5;
        errmsg = "IMU need adv-calib";
        mallow = 0;
    } else if (sub_8030922() && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 21;
        errmsg = "atti limit";
        mallow = 0;
    } else if (sub_8030A18() && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 24;
        errmsg = "bias limit";
        mallow = 0;
    } else if (sub_80708DE(69) == 1 && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 6;
        errmsg = "IMU SN ERROR";
        mallow = 0;
    } else if (sub_80288AA() && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 7;
        errmsg = "temper not ready";
        mallow = 0;
    } else if (sub_8047222() == 1 && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 8;
        errmsg = "Compass calibration!";
        mallow = 0;
    } else if (!byte_20001812[0] && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 26;
        errmsg = "IMU is initing!";
        mallow = 0;
    } else if (sub_80708DE(70) == 1 && g_real__status.control_real_mode && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 9;
        errmsg = "Attitude error!";
        mallow = 0;
    } else if (get_esc_status() && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 25;
        errmsg = "esc error!";
        mallow = 0;
    } else if (byte_20001C04[0] == 1 && (unsigned int)gh_set_craft_homepoint() < 3 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 10;
        errmsg = "novice mode without gps!";
        mallow = 0;
    } else if (get_battery_stat(COMPONENT_BATTERY_CELL) == 1 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 11;
        errmsg = "battery cell err stop motor!";
        mallow = 0;
    } else if (get_battery_stat(COMPONENT_BATTERY_COMM) == 1 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 12;
        errmsg = "battery communite err stop motor!";
        mallow = 0;
    } else if (get_battery_stat(COMPONENT_BATTERY_VOL) == 1 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 13;
        errmsg = "battery vol very low stop motor!";
        mallow = 0;
    } else if (get_battery_stat(COMPONENT_BATTERY_USR_LOW) == 1 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 14;
        errmsg = "battery user low land level stop motor!";
        mallow = 0;
    } else if (get_battery_stat(COMPONENT_BATTERY_MAIN_VOL_LOW) == 1 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 15;
        errmsg = "battery main vol low stop motor!";
        mallow = 0;
    } else if (get_battery_stat(COMPONENT_BATTERY_TEMP_VOL_LOW) == 1 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 16;
        errmsg = "battery temp and vol low stop motor!";
        mallow = 0;
    } else if (get_battery_stat(COMPONENT_BATTERY_SMART_LOW_LAND) == 1 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 17;
        errmsg = "battery smart low land stop motor!";
        mallow = 0;
    } else if (get_battery_stat(COMPONENT_BATTERY_BAT_NOT_RDY) == 1 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 18;
        errmsg = "battery bat not ready stop motor!";
        mallow = 0;
    } else if (sub_807AC58() == 1 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 23;
        errmsg = "in fly limit area ,need stop motor!";
        mallow = 0;
    } else if (!is_prod_activated() && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 22;
        errmsg = "Product not activation,stop motor!";
        mallow = 0;
    } else if (is_fw_upgrading() && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 27;
        errmsg = "system upgrade,stop motor!";
        mallow = 0;
    } else if (!sub_8049CA4(dword_20021B60, "ACT.Takeoff") && abs(*(float *)(byte_20002828+0x130)) >= 0.2618 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 30;
        errmsg = "too large tilt angle when auto take off,stop motor!";
        mallow = 0;
    } else if (sub_8040206(0) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 31;
        errmsg = "gyro is stuck!";
        mallow = 0;
    } else if (sub_8040206(1) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 32;
        errmsg = "acc is stuck!";
        mallow = 0;
    } else if (sub_8040206(2) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 33;
        errmsg = "compass is stuck!";
        mallow = 0;
    } else if (sub_8040206(3) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 34;
        errmsg = "press is stuck!";
        mallow = 0;
    } else if (sub_8040206(4) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 35;
        errmsg = "press is negative!";
        mallow = 0;
    } else if (sub_8040206(5) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 36;
        errmsg = "compass mod is huge!";
        mallow = 0;
    } else if (sub_8040206(6) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 37;
        errmsg = "gyro bias is large!";
        mallow = 0;
    } else if (sub_8040206(7) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 38;
        errmsg = "acc bias is large!";
        mallow = 0;
    } else if (sub_8040206(8) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 39;
        errmsg = "compass noise is large!";
        mallow = 0;
    } else if (sub_8040206(9) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 40;
        errmsg = "press noise is large!";
        mallow = 0;
    } else if (sub_8040206(10) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 42;
        errmsg = "press slope is large!";
        mallow = 0;
    } else if (sub_8040206(11) && !g_real__status.force_allow_start_motors && !byte_20001E24 && run_mode == 1) {
        motor_start_error_code = 43;
        errmsg = "ahrs error is large!";
        mallow = 0;
    } else if (sub_80708DE(0) == 1 && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 41;
        errmsg = "sn invalid!";
        mallow = 0;
    } else if (sub_807A5DC() && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 44;
        errmsg = "flash operating!";
        mallow = 0;
    } else if (sub_807BDCC() && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 46;
        errmsg = "out of whitelist area!";
        mallow = 0;
    } else if (!sub_80708DE(12) && !g_real__status.force_allow_start_motors) {
        motor_start_error_code = 45;
        errmsg = "gps disconnect!";
        mallow = 0;
    }

Dan · Dec 10, 2021

Murdock17x said:
I have been teaching drone flight to 7-16yo's for 5 years now. Our level 3 class is the repair of drones that have been damaged in the first 2 level classes... Most of the time it is just motor replacements and they are up and flying again BUT! We have a few drones that fail their internal system checks!!! Is there a list of what the different LED indicator lights mean??? We all know what the owner's manual says but what about the internal system check on startup stopping at green or yellow or the dreaded RED??? Or how about 2 slow blue with 4 fast blue or 1 slow 7 fast blue?

Hello
I cannot help you on that issue. We wood like to know what curriculum you are using as we do the same thing, have damaged drone that they can repaired. Any help appreciated. Thank you for what you do for our youth.

Murdock17x · Dec 11, 2021

quaddamage said:
Since the firmware is encrypted, we can't get this information from reverse engineering the code which sets the LEDs, as was done for other drones.

BUT - for these other drones, besides LED indication, there were also packets sent with more readable explanation.
Maybe it's possible to connect to some kind of UART, or analyze the WiFi communication, to get the error info.

For example, here is the reverse engineered code from my beloved Phantom 3 - the 'errmsg' is a packet visible in communication sniffed from front USB of the drone:

A big part of our issue right now is these are failing before the wifi is up to connect to them so skimming the data off isn't feasible. There has to be a way to flash the firmware over the usb connection vs over wifi?

Murdock17x · Dec 11, 2021

Dan said:
Hello
I cannot help you on that issue. We wood like to know what curriculum you are using as we do the same thing, have damaged drone that they can repaired. Any help appreciated. Thank you for what you do for our youth.

We have created our own as a hodgepodge of information from multiple different sources. Our level 3 started as a build from scratch but evolved into repairing older drones as they were piling up from bused motors!

quaddamage · Dec 11, 2021

Murdock17x said:
A big part of our issue right now is these are failing before the wifi is up to connect to them so skimming the data off isn't feasible. There has to be a way to flash the firmware over the usb connection vs over wifi?

You only want to flash the firmware?
That is not hard, though I doubt it will really fix anything.

Not that I ever tried it, but according to this page the FW is just written on a serial flash chip:

Firmware m0802

Tools for handling firmwares of DJI products, with focus on quadcopters. - o-gs/dji-firmware-tools

github.com

So it is loaded kind of similar to FPGAs, which receive their bitstream through serial transmission at start.

Just extract the FW module from update file, and flash it using any serial flash programmer.

(then again, I don't see how this helps with repairs; I doubt serial flash deprogramming happens often)