-
Notifications
You must be signed in to change notification settings - Fork 428
Firmware m0700
Target
Purpose
Versions
Structure
Boot process
OS and Libraries
Flashing
Interfaces
The module programs a Wi-Fi controller chip. Location of this chip:
- in FC200 camera, it is on FC200 Wifi board
- in WM301 Wifi air module, it is on WM301 Wifi Transceiver board
- in WM301 repeater on RC, it is on WM301 Wifi Repeater board
- in P3C, it is on WM321 Gimbal top board
- in other products, the location is unknown
The Wi-Fi controller acts as a host, allowing clients to connect to it. A connected client can receive live feed video from the drone, and exchange DUML packets, including telemetry data and control commands.
Below are known version of the module.
| Marking | Packages | Timestamp | Overview |
|---|---|---|---|
| TODO |
Specifics of the module structure changes between products.
Map of the NAND flash memory is as follows:
| Offset | Description | Content |
|---|---|---|
| 0000000 | U-boot | u-boot partitions |
| 0020000 | Kernel | uImage; the Linux Kernel normally used for booting |
| 03f0000 | Root Filesystem | |
| 07f0000 | Art | Boot bitmap image |
| 0800000 | End of flash |
No analysis of the booting procedure were performed.
The module uses OpenWRT as its firmware, with additional code which makes it transfer video feed and data.
The OpenWRT project is the best place for finding flashing information for specific Wi-Fi chips:
Connecting to the Wifi interface exposed by the device enables TCP connectivity to the chip, and in some products, also to other chips. Specific services available depend on specific device and firmware version. Since OpenWRT provides a lot of packages in its repositories, it is possible to configure the opkg tool and use bridged connection to install additional services, including web interface.
Known services available in unmodified products are listed below:
Ethernet on WM301 Wifi Repeater board
The Wifi chip is available at IP address 192.168.1.2. Exposed ports:
- SSH at port 22, login credentials are
root:19881209,
Ethernet on WM301 Wifi Transceiver board
The Wifi chip is available at IP address 192.168.1.1. Exposed ports:
- SSH at port 22, login credentials are
root:19881209,
Ethernet on WM321 Gimbal top board
The Wifi chip is available at IP address 192.168.1.2. Exposed ports:
- FTP at port 21, login credentials are
root:Big~9China; provides full access in FW up to v01.06.0080, chrooted access in newer, - SSH at port 22, login credentials unknown; only available if FW up to v01.06.0080,
- Telnet at port 23, login credentials unknown; only available if FW up to v01.06.0080,
The serial interface can be used to access shell on the OpenWRT Linux. It allows both input and output. Service pads which allow access to it are named as follows:
- in WM301 Wifi Repeater board, the names are UART_RX, UART_TX and GND.
Transmission configuration is 115200 8N1. It uses 3.3V logic.
This page is created by drone enthusiasts for drone enthusiasts.
If you see a mistake, or you know more about specific subject, or you see an area for improvement for the wiki - create an issue in this project and attach your patch (or describe the change you propose).