How to read Tello Firmware v01.04.78.01? (Tools for .pro.fw.sig files)

[leandjb]

Yesterday i found a set tool in GitHub for extracting and modding firmwares of DJI drones. But i don't understand how use it?

LINK:
o-gs/dji-firmware-tools

i was trying the command " ./dji_imah_fwsig.py -vvv -u -i wm004_0000_v01.04.78.01_20181206.pro.fw.sig " but don't run!

The ERROR is:

Opening for extraction and un-signing
Error: Unexpected magic value in main header; input file is not a signed image.

Can someone solve this?

 

[briest]

Tello is Ryze construction on Intel processor, DJI just promotes it. I'm afraid that tools made for DJI won't fit.

 

[leandjb]

I don't think so. The DJI Mavic Pro firmware is in .pro.fw.sig format like a Ryze Tello. Then is possible read it.

Adicionally, you can verify in smartphone the following firmware config:

Android PATH:
0/Android/data/com.ryzerobotics.tello/files/fw_config/wm004_01.01.0074_firmware_config.xml

 

[briest]

Well, good luck then, if you succeed, we'd all be grateful

 

[quaddamage]

So much time has passed, and noone looked further into the firmware?
Not sure if it means that noone with real knowledge touches Tello, or this is a niche product in general...

Anyway, here is some info.
And some for the firmware.

So it is in MA2x format developed by Movidius. It's not decrypted before flashing, it seem to be flashed directly in that form. This means there has to be a bootloader within the chip (probably not made by DJI, as format is developed by Movidius), which reads and decrypts the firmware to memory.

Which means the encryption algorithm and keys are within that bootloader.
So to understand Tello firmware, it should be enough to have Myriad2 chip hacked in _any_ device, as firmware extractor should be the same.

It also means that the tools used for Mavics won't help much for Tello. Tools for Myriad2 are needed.

Details on the chips, and the firmware:

GitHub - MrJabu/RyzeTelloFirmware: Firmware images for hacking, reverse engineering, and teardown of the Ryze / DJI / Intel Movidius Tello

Firmware images for hacking, reverse engineering, and teardown of the Ryze / DJI / Intel Movidius Tello - MrJabu/RyzeTelloFirmware

github.com

Tello is Ryze construction on Intel processor, DJI just promotes it.

That company Ryze, what's its history? Who works there? What other products do they have?

How can you not see that Ryze is just DJI, created by DJI and having DJI employees?
I have a feeling Tello is sold under a different company, for the same reason noone bothered to look into its software for so long.

 

[Rocky336]

in

So much time has passed, and noone looked further into the firmware?
Not sure if it means that noone with real knowledge touches Tello, or this is a niche product in general...

Anyway, here is some info.
And some for the firmware.

So it is in MA2x format developed by Movidius. It's not decrypted before flashing, it seem to be flashed directly in that form. This means there has to be a bootloader within the chip (probably not made by DJI, as format is developed by Movidius), which reads and decrypts the firmware to memory.

Which means the encryption algorithm and keys are within that bootloader.
So to understand Tello firmware, it should be enough to have Myriad2 chip hacked in _any_ device, as firmware extractor should be the same.

It also means that the tools used for Mavics won't help much for Tello. Tools for Myriad2 are needed.

Details on the chips, and the firmware:

GitHub - MrJabu/RyzeTelloFirmware: Firmware images for hacking, reverse engineering, and teardown of the Ryze / DJI / Intel Movidius Tello

Firmware images for hacking, reverse engineering, and teardown of the Ryze / DJI / Intel Movidius Tello - MrJabu/RyzeTelloFirmware

github.com

That company Ryze, what's its history? Who works there? What other products do they have?

How can you not see that Ryze is just DJI, created by DJI and having DJI employees?
I have a feeling Tello is sold under a different company, for the same reason noone bothered to look into its software for so long.

have you got anything on the myriad development kit? I just found some forums talking about how you need to be a huge company to have access to mdk

 

[quaddamage]

That is true, in general. But after some talks on Slack (currenly Mattermost), I was able to get a copy.
Only compiled binaries though, I'm pretty sure corporations get source code.

Hint: it's always easier to achieve anything there if you share some info yourself. Be it board photos, descriptions of pads, dissector for a packet, some related software - anything which shows that you know what you're doing and you're sharing stuff.