Firmware m0306
Target
Purpose
Versions
Structure
Boot process
OS and Libraries
Flashing
Interfaces
The firmware programs application part of a micro-controller. MCU model depends on device generation:
- P3X, P3S, P3C, P3XW, WM330, WM610 use STM32F427 chip
- WM100, WM220 use ATSAME70Q21 chip
Location of this chip:
- in P3X, P3S, P3C and P3XW it is on P3 Flight Controller board
- in WM100, it is on WM100 Main Processing Core Board
- in WM220, it is on WM220 Flight Controller and IMU board
- in WM330, it is on WM330 Flight Controller board
- in other products, it is placed on their respective flight controller boards
In products which make use of ARM TrustZone, FC firmware is no longer a separate module; it is instead part of the module which contains the TrustZone.
The software is responsible of controlling flight - it gathers inputs from IMU, compass, GPS, VPS and other boards, then uses it to provide stable flight by sending instructions to ESC controllers. It also reacts to user input received from Radio controller through OFDM board, or uploaded as series of pre-programmed waypoints. It is responsible of approving the flight - by checking status of ESCs, battery and other modules, and checking internal NFZ information. The flight controller has hundereds of configuration parameters, known as flyc_params.
There are two separate firmware version lines for different products, both running on the same hardware. One is marked 02.??.????, and the other is 03.??.????.
| Marking | Packages | Timestamp | Overview |
|---|---|---|---|
| 02.01.1543 | P3S_FW_V01.01.0008 P3X_FW_V01.01.0006 P3X_FW_V01.01.0008 | 2015-05-01 ... 2015-05-06 | First known version |
| 02.01.1554 | P3S_FW_V01.01.0009 P3X_FW_V01.01.0009 | 2015-05-12 | |
| 02.01.2305 | P3X_FW_V01.01.1003 | 2015-04-30 | |
| 02.02.1544 | P3S_FW_V01.02.0007 P3S_FW_V01.02.0008 P3X_FW_V01.02.0006 | 2015-06-12 ... 2015-06-17 | |
| 02.02.1555 | P3S_FW_V01.03.0020 P3X_FW_V01.01.1007 P3X_FW_V01.03.0020 | 2015-07-10 ... 2015-07-24 | |
| 02.02.1568 | P3C_FW_V01.00.0014_Beta | 2015-07-21 | |
| 02.02.1570 | P3C_FW_V01.00.0017_Beta P3C_FW_V01.00.0020 | 2015-07-30 ... 2015-08-12 | |
| 02.03.0010 | P3X_FW_V01.04.0005 | 2015-08-21 | |
| 02.03.0013 | P3C_FW_V01.01.0030 P3S_FW_V01.04.0010 P3X_FW_V01.04.0010 | 2015-09-02 | |
| 02.04.0005 | P3C_FW_V01.02.0040 P3S_FW_V01.05.0030 P3X_FW_V01.05.0030 | 2015-11-23 | |
| 02.04.2565 | P3XW_FW_V01.01.0000 | 2015-12-15 | |
| 02.04.2567 | P3C_FW_V01.03.0050 P3C_FW_V01.04.0050 P3S_FW_V01.06.0040 P3XW_FW_V01.02.0010 P3XW_FW_V01.03.0010 P3X_FW_V01.06.0040 WM610_FC550_FW_V01.08.00.92 WM610_FW_V01.08.00.92 | 2015-12-21 ... 2016-03-24 | |
| 02.04.3328 | P3C_FW_V01.04.0060 P3C_FW_V01.04.0060 P3S_FW_V01.07.0060 P3XW_FW_V01.03.0020 P3X_FW_V01.07.0060 | 2016-03-13 ... 2016-03-15 | Unencrypted |
| 02.04.3589 | P3C_FW_V01.05.0070 P3S_FW_V01.08.0080 P3XW_FW_V01.04.0030 P3X_FW_V01.08.0080 | 2016-04-05 | |
| 02.04.3845 | P3C_FW_V01.05.0074 P3C_FW_V01.06.0083 P3C_FW_V01.06.0086 P3C_FW_V01.07.0082 P3C_FW_V01.07.0084 P3C_FW_V01.07.0090 P3XW_FW_V01.04.0036 P3XW_FW_V01.05.0040 | 2016-04-18 ... 2016-11-08 | Unencrypted |
| 02.04.5127 | P3X_FW_V01.07.0043_beta | 2015-12-30 | |
| 02.04.5136 | P3X_FW_V01.09.0021 | 2016-04-12 | |
| 02.04.5138 | P3S_FW_V01.09.0060 P3X_FW_V01.09.0060 WM610_FC350Z_FW_V01.09.01.40 | 2016-05-19 ... 2016-11-09 | |
| 02.04.5143 | P3C_FW_V01.07.0086 | 2016-09-18 | |
| 02.04.5148 | P3S_FW_V01.10.0090 P3X_FW_V01.10.0090 | 2016-11-07 | |
| 03.01.1317 | MATRICE100_FW_V01.02.00.60 | 2016-02-18 | |
| 03.01.1342 | MATRICE100_FW_V01.02.00.70 | 2016-02-26 | |
| 03.01.1348 | MATRICE100_FW_V01.02.00.80 MATRICE100_FW_V01.02.00.90 | 2016-03-31 ... 2016-04-01 | |
| 03.01.1639 | MATRICE100_FW_V01.03.01.00_pc | 2016-04-11 | |
| 03.01.1723 | MATRICE100_FW_V01.03.02.55_pc | 2016-06-30 | |
| 03.01.3915 | MATRICE600_FW_V01.00.00.27 MATRICE600_FW_V01.00.00.27_nw | 2016-04-18 ... 2016-08-18 | |
| 03.01.3940 | A3_FW_V01.01.01.00 | 2016-04-28 | |
| 03.01.3943 | A3_FW_V01.01.02.00 | 2016-05-03 | |
| 03.01.5123 | MATRICE600_FW_V01.00.00.28 | 2016-05-05 | |
| 03.01.5163 | A3_FW_V01.02.00.00 | 2016-06-07 | |
| 03.01.5165 | A3_FW_V01.03.00.00 MATRICE600_FW_V01.00.00.39 MATRICE600_FW_V01.00.00.39_nw | 2016-06-08 ... 2016-08-18 | |
| 03.01.5166 | MATRICE600_FW_V01.00.00.42 MATRICE600_FW_V01.00.00.43 | 2016-09-27 ... 2016-09-28 | |
| 03.01.5243 | MATRICE600_FW_V02.00.00.21 | 2016-10-21 | |
| 03.02.2626 | MATRICE600_FW_V01.00.00.44 | 2016-09-29 | |
| 03.02.2652 | MATRICE600_FW_V01.00.0090 | 2016-09-29 | Unencrypted |
| 03.02.2655 | MATRICE600_FW_V02.00.00.95(polar) | 2016-10-21 | Unencrypted |
| 03.02.2814 | A3_FW_V01.04.00.00 A3_FW_V01.05.00.00 A3_FW_V01.06.00.00 | 2016-10-11 ... 2016-10-26 | |
| 03.02.2854 | A3_FW_V01.06.00.01 | 2016-10-26 | |
| 03.02.2859 | AM603_FW_V01.00.00.43 AM603_FW_V01.00.00.43(ESC) | 2016-10-19 ... 2016-10-20 | |
| 03.02.2863 | AM603_FW_V01.00.00.47 MATRICE600PRO_FW_V01.00.00.01 | 2016-10-17 ... 2016-10-20 | |
| 03.02.2867 | AM603_FW_V01.00.00.51 | 2016-10-21 | |
| 03.02.2871 | MATRICE600PRO_FW_V01.00.00.51 MATRICE600_FW_V01.00.00.51 | 2016-10-26 | |
| 03.02.2880 | AM603_FW_V01.00.00.70 | 2016-11-07 | |
| 03.02.2886 | AM603_FW_V01.00.00.80 | 2016-11-07 | |
| 03.02.3070 | AI900_AGR_FW_V01.00.00.80 AI900_AGR_FW_V01.00.00.81 AI900_AGR_FW_V01.00.00.83 MATRICE600PRO_FW_V01.00.00.53 MATRICE600PRO_FW_V01.00.00.54 MATRICE600PRO_FW_V01.00.00.55 MATRICE600PRO_FW_V01.00.00.63 MATRICE600_FW_V01.00.00.53 MATRICE600_FW_V01.00.00.54 | 2016-11-04 ... 2016-12-19 | |
| 03.02.3071 | AM603_FW_V02.00.00.12 | 2016-09-13 | Unencrypted |
| 03.02.3326 | MG1S_FW_V01.00.00.02 | 2016-11-29 | |
| 03.02.3609 | MATRICE600_FW_V01.00.00.56 | 2016-12-06 | |
| 03.02.3616 | MATRICE600PRO_FW_V01.00.00.60 MATRICE600PRO_FW_V01.00.00.61 MATRICE600PRO_FW_V01.00.00.62 MATRICE600PRO_FW_V01.00.00.64 MATRICE600_FW_V01.00.00.60 | 2016-12-14 ... 2016-12-19 | |
| 03.02.3838 | AI900_FW_V01.05.00.01 AM603_FW_V01.00.01.01 | 2016-12-19 | |
| 03.02.4094 | A3_FW_V01.00.00.32 A3_FW_V01.06.00.10 MATRICE600PRO_FW_V01.00.00.80 MATRICE600_FW_V01.00.00.80 N3_FW_V01.00.01.01 N3_FW_V01.01.01.00 | 2017-01-03 ... 2017-01-05 | |
| 10.00.0000 | A3_FW_V02.00.00.01 | 2016-07-08 | Version marking doesn't look right |
| 105.43.4889 | AI900_AGR_FW_V01.00.00.29 | 2016-09-28 | Unencrypted; version marking doesn't look right |
Most of the STMicroelectronics MCU firmwares are encrypted, but there are a few versions published without encryption. These are wrapped into xV4 container.
Atmel MCU firmwares are all double-encrypted. Not only are they closed within encrypted IM*H container, but the image inside is encrypted a second time, also using AES, but with different, FC-specific container.
The unencrypted firmware is a memory image of ARM binary. During startup, it is being loaded into memory at chip-specific address (0x8020000 for STM32, 0x420000 for ATSAME) and executed by the loader. Such memory images are usually prepared by first linking the file with all libraries, and then using objcopy -O binary to get the final file without ELF header. The ELF header can be re-created if the address and boundaries of sections are known.
The binary was most likely generated using IAR Embedded Workbench.
No analysis of the booting procedure were performed.
The image is based on uC/OS-III real time operating system.
Implementations using Atmel MCU contain code from at91lib SAM softpack. These implementations also use parts of u-boot code for SD-card support.
No signatures of other common libraries were found in the code.
Since this firmware is used on many various products, some of the flashing methods may not be listed here. Some methods may also not apply to a specific platform.
This method requires a working communication between the camera module and Flight Controller. Ambarella FW within camera and FC bootloader must be in working order.
Platforms which allow this method: P3X, P3S, P3C, P3XW, WM610.
See Flashing firmware via SD-card by official package in camera for details.
This method requires a working communication between the camera module and Flight Controller. Ambarella FW within camera and FC bootloader must be in working order. It also works properly only if the new firmware is unencrypted.
It is only supported on platforms which also allow updating by official package in camera.
See Flashing firmware via SD-card by firmware module in camera for details.
The drone needs to be connected to PC via USB cable, and Dji Assistant in a flavor for the specific model needs to be installed on the PC.
All platforms which have a version of Dji Assistant can be updated using this method.
On newer platforms this is the standard way of updating, and all it requires a connection to RC. But on WM330 it requires USB cable to be connected to the drone first and then to RC (to update FW on both), and on P3X and P3S only the RC can be updated this way.
The most independent and direct way of flashing is to connect a programmer board to the chip. For STMicroelectronics MCU, the STM STLink USB Programmer can be connected to proper pins of the Flight Controller board (SWD, SWDCLK, RES, GND, POWER), which allows flashing from PC using ST-LINK utility.
For Atmel MCUs, the OEM programmer is ATATMEL-ICE.
It is possible to hook to several interfaces to monitor and influence the flight controller.
Hooking a PC to the micro-USB connector in front of the drone gives access to an UART interface. Accessing this interface via terminal provides access to the flight logs in real-time. Transmission configuration is 115200 8N1. The interface also allow injecting commands to the drone, as long as they meet the DUML binary packet format.
The micro-controller uses several serial interfaces to communicate with other components. These interfaces can be easily monitored using USB UART module (also called USB to TTL converter, or FTDI adapter). The UART signal voltage needs to be 3.3V for the communication to work correctly. To connect to such interface, find corresponding RX and TX debug pads, and remember to connect ground as well. Transmission configuration is 115200 8N1.
The Flight Controller also contains flight parameters array, which contains hundreds of parameters and their bounds. Values of these flyc_params can be changed through mobile API or Dji Assistant app, and bounds can be extended by modifying array within the firmware binary (a python tool is available which does that).
The drone can be switched into "Flight logs mode" from a mobile application. This makes the flight controller provide access to its SD-card via the micro-USB connector on the front of the drone. The drone acts like a standard USB storage device, allowing both read and write access. The SD-card stores flight logs, but also contains information about rollback restrictions of the drone firmware.
This page is created by drone enthusiasts for drone enthusiasts.
If you see a mistake, or you know more about specific subject, or you see an area for improvement for the wiki - create an issue in this project and attach your patch (or describe the change you propose).