Hello Tello Pilot!
Join our DJI Tello community & remove this banner.
Sign up

Tello. Whats possible?

Krag

Well-known member
Joined
Mar 22, 2018
Messages
252
Reaction score
201
Tello is an amazing little machine for the price. And they gave us a good start on an SDK. But it is currently limited to a few simple commands. What should it be possible to do given the hardware?

Beyond the commands the sdk already supports we should be able to do the following since it is already being done by the app,
Take picture and video.
Configure drone and camera.
Get battery state.
Capture camera stream.

I would hope there is additional data (like orientation) being sent to the phone that is not displayed in the client. If not getting at that data might require patching firmware.

Personally I would like to get at the video stream for processing on the phone and possibly do a follow me mode. I would also like to see if it would be possible to operate them in a swarm. Currently you can only control one because they all use the same ip.

What else?
 
Some resources to help the discussion.

I found some info on the processor in the Tello. It is a pretty capable part.
Hello Tello - Ryze Announces Intel Myriad VPU Powered Toy Drone | Machine Vision Technology | Movidius
http://uploads.movidius.com/1441734401-Myriad-2-product-brief.pdf

And the firmware can apparently be dumped by using GoodFET.
http://www.openpilotlegacy.org/TelloFirmware.tgz

Lastly the android tello app apk can be downloaded directly from apkpure and dissembled using dex2jar and jd-gui.
pxb1988/dex2jar
Java Decompiler
 
From looking at the code in the APK. The video might be rtp video sent to UDP port 6038 on the phone. Thats all I have time to figure out tonight.
 
Last edited:
  • Like
Reactions: deadprogram
More info from the code. Here are all the parameters in the flight controller state. Looks like plenty of interesting stuff to mess around with.

Code:
public class FlyControllerEntity
{
  public int batteryLow;
  public int batteryLower;
  public int batteryPercentage;
  public int batteryState;
  public int cameraState;
  public int downVisualState;
  public int droneBatteryLeft;
  public int droneFlyTimeLeft;
  public int droneHover;
  public int eMOpen;
  public int eMSky;
  public int eMgroud;
  public int eastSpeed;
  public int electricalMachineryState;
  public int factoryMode;
  public int flyMode;
  public int flySpeed;
  public int flyTime;
  public int frontIn;
  public int frontLSC;
  public int frontOut;
  public int gravityState;
  public int groundSpeed;
  public int height;
  public int imuCalibrationState;
  public int imuState;
  public int lightStrength;
  public int northSpeed;
  public int outageRecording;
  public int powerState;
  public int pressureState;
  public int smartVideoExitMode;
  public int temperatureHeight;
  public int throwFlyTimer;
  public int wifiDisturb;
  public int wifiStrength;
  public int windState;
 
What's possible ?
Actually if you have 2 or more tello and a software to emulate several wifi connections on your computer, you can control several tello in a swarm with a py script and make them...dance !
 
  • Like
Reactions: tuxevil
More random stuff I have figured out.
  • The Tello app for Android will run on the Nox PC emulator and successfully connect to the drone if on the same wifi network. This should make sniffing the connection traffic easier. All the phone app is doing is connecting to 192.168.10.1 no matter what network it is actually on.
  • On android at least the flight logs are much larger than I would expect. A few seconds is 100k. They don't seem to be compressed or encrypted. But I can't figure out what they contain. From looking at the code it seems to be a subset of the raw packet data sent from the drone to the phone. Each chunk of data starts with 0x55 xx. Where xx=length of chunk. Camera info maybe?
  • You can get the android debugging logs (adb logcat) and see that there is a fair amount of debug logging that might be helpful. Especially around video decoding. Some of it is in Chinese but google translate does a great job.
  • The udp video port is probably 6038 on the phone. I haven't gotten any data out of it yet tho.

I continue to be impressed by the tech on this drone. It is amazing to just watch it hover. Its using a complex ballet of atmo pressure, ir cameras and optical flow.
 
Got another comment from RYZE on the dji forum regarding sharing the video feed:

"Hi, that’s an awesome idea! We’re not working on that at the moment but I’ll pitch it to the team and see what they think. Thanks for your feedback!"

So ... maybe if people keep asking about it, they will share access?
 
I wish they would do it soon or not at all. Its going to be a pain to reverse engineer this and it would suck if they just came out with a proper SDK in the end.
 
More.
  • Trying to sniff the packets with Android Packet Capture doesn't work because I don't think it supports UDP. A similar app tPacketCapture prevents the app from connecting to the Tello because because it doesn't support SSL. There may be other utils that will work.
  • The Tello (@192.168.10.1) opens TCP port 9999. I don't know if the app connects to this port or not. I haven't gotten anything out of it yet.
 
What's possible ?
Actually if you have 2 or more tello and a software to emulate several wifi connections on your computer, you can control several tello in a swarm with a py script and make them...dance !

Like they did in the Olympics? Did they use Tellos for that?
 
More.
  • Trying to sniff the packets with Android Packet Capture doesn't work because I don't think it supports UDP. A similar app tPacketCapture prevents the app from connecting to the Tello because because it doesn't support SSL. There may be other utils that will work.
  • The Tello (@192.168.10.1) opens TCP port 9999. I don't know if the app connects to this port or not. I haven't gotten anything out of it yet.
Hi, Krag. Thanks for working on this, first of all.

I ran into the same issue with tPacketCapture, but did not get as far as you to determine the cause. So you are saying that the phone is attempting to connect to drone using SSL? Can you please provide more details?

I am currently trying to capture the packets going between the phone and drone using Wireshark, but do not yet quite have my setting correct. Ideally someone can come up with a pcap file with all the traffic, and then we can all collaborate on deciphering the protocol.
 
Got another comment from RYZE on the dji forum regarding sharing the video feed:

"Hi, that’s an awesome idea! We’re not working on that at the moment but I’ll pitch it to the team and see what they think. Thanks for your feedback!"

So ... maybe if people keep asking about it, they will share access?
Can you please provide a link to exactly which forum you mean? That way, some of us here can chime in and also make the same request, so we can indicate to Ryze that there is a lot of interest in this subject.
 
I ran into the same issue with tPacketCapture, but did not get as far as you to determine the cause. So you are saying that the phone is attempting to connect to drone using SSL? Can you please provide more details?
I am not totally sure about that but that is what I am thinking. When using Packet Capture with SSL the app is able to connect but I am not able to capture packets. I think this is because the app uses UDP for at least part of the comms and Packet Capture doesn't capture them. And tPacketCapture with no ssl does capture the app sending a UDP handshake to the Tello but doesn't connect.

There are other network sniffing utils but they require root and I don't have that on my phone. Now that I have Nox running the Tello app I was going to to try that.
 
I have just been looking at Android. Does anyone know about sniffing/hacking on iOS? I don't know if it would be easier or not.
 
I have just been looking at Android. Does anyone know about sniffing/hacking on iOS? I don't know if it would be easier or not.
I expect that it will be much easier to continue on your current path, since itunes app store apps are not going to be able to run in any simulator without source code and compiling in xcode.
 
Thanks! I don’t understand their hesitation to share it. I’m thinking of buying a parrot mambo since there is software to access its video ... I think they loose customers by closing access
 
  • Like
Reactions: deadprogram
I scanned all the ports up to 10000 using nmap and only found the following open:
Port Service
67/UDP unknown
8889/UDP unknown
9000/TCP Abyss

I am currently going through the source code and there are not any obvious streaming URLs, could it be stored in data that it gets from the drone?
 

New Posts

Members online

Forum statistics

Threads
5,690
Messages
39,934
Members
17,023
Latest member
Repiv

New Posts