Close
0%
0%

DJI FPV - Battery Breakout Mod [3]: Breakout Board

Based on my first tests, I built a breakout board for the DJI FPV Racer drone. Here, I want to share some of the results and files.

Public Chat
Similar projects worth following
After decrypting most of the DUML messages between the drone and the battery, I came to realise that there doesn't seem to be a viable way to decrypt the encrypted authentication part. Without this, the drone refuses to start the motors.

Now, I would like to explain the workaround that I have developed and it works quite well for me.

This part is still under construction. So some parts may change a bit in the next few days.


YouTube: https://www.youtube.com/@AirCruiserFPV
Discord: https://discord.gg/Yfan8F3epY
Mail: aircruiserfpv+hackaday@gmail.com
Thingiverse: https://www.thingiverse.com/thing:5715815

Contents

  • Principle
  • Perfboard Tests
  • The First Flight
  • Disassembling the DJI Battery
  • SBCB <> Breakout Perfboard Connection
  • No Magic Without the Appropriate Software



Principle

I haven't found a practical way to reproduce/decrypt the authentication between the smart battery controller board and the drone. Therefore, I decided to scrap my plan to fully replace the control board. My new attempt was to build a board that communicates with the drone most of the time. However, when the drone requests authentication, the communication will be forwarded to the original smart battery control board (SBCB). After authentication has been successfully completed, the modboard should handle further communication. But as it turns out, only one command must be manipulated for my approach to work. Therefore, I changed my strategy, as shown in the sketch below.

The new approach was to put my mod between the original SBCB and the drone. My mod should parse all DUML messages and forward them both ways. The data must be modified before forwarding only when the GetPushDynamicData command (CMDset 13, CMDID 2) is sent from the battery to the drone. So you can say it is a kind of "man-in-the-middle attack". Since my mod allows batteries from other manufacturers to be used instead of the original DJI batteries, the name Battery Breakout Board is probably appropriate.




Perfboard Tests

The images below shows the electronic schematic of the first perfboard test and a picture of it. A simple buck converter was used to step down the input voltage from the battery (19.2V - 25.2V) to 5V to power a Teensy 4.0 development board. This board uses 3.3V logic like the SBCB, so my first thought was to adjust the buck converter to 3.3V output voltage. But it's not recommended to drive the Teensy directly with 3.3V, so I didn't do it ;)

I chose to use the same RS485 communication ICs that I found on the SBCB to ensure that these chips could not be the source of misbehavior. The only problem was that these were SMD chips, which cannot be easily hand-soldered onto a perfboard. But with a little practice and patience I managed to do it. I used the reference design suggested in the Texas Instruments IC datasheet. The data sheet recommends the use of termination resistors to eliminate line reflections. I tested some values and found 10 kOhm to be a good choice. But there was a large range without any noticeable problems.

The digital inputs and outputs of the two SN65HVD75 ICs were connected to UART1 and UART2 of the Teensy 4 development board. The active pins of the driver and receiver of the ICs are connected (for each IC). Therefore, the SN65HVD75 can send data when the pins are set HIGH (3.3V) and receive data when they are set LOW (GND).

It must be mentioned that with this configuration, serial ports 1 and 2 must be configured to send and receive inverted signals.

Serial1.begin(115200, SERIAL_8N1_RXINV_TXINV);
Serial2.begin(115200, SERIAL_8N1_RXINV_TXINV);

 As you can see the additional parameters are 8 data bits, 1 stop bit, no parity bit and 115200 bps.


The First Flight

As you can guess from the picture and video, the perfboard version was a mess. It was very bulky and it took a lot of work and effort to solder it. Unexpectedly, however, it worked perfectly.



Disassembling the DJI Battery

I suggest reading the battery disassembly section of the first part of this project for more information: https://hackaday.io/project/184677-dji-fpv-battery-breakout-mod-1-first-tests/details

Carefully open the original DJI battery. There are two small screws that you will need to remove. In addition to four clips, there is some sort of double-sided tape that holds the battery cover in place. The LiPo cells are also stuck to the floor with double-sided adhesive tape. It's a little difficult to remove, but possible. Be careful not to damage the LiPo cells or the SBCB when opening the case. 

... Read more »

Modcase_Reflector2.stl

"Mirror" for the reflector

Standard Tesselated Geometry - 684.00 bytes - 01/05/2023 at 23:21

Download

Modcase_Cover.stl

Back cover of the mod case

Standard Tesselated Geometry - 69.42 kB - 01/05/2023 at 23:20

Download

Modcase_Button.stl

Button (recommended to be printed with TPU)

Standard Tesselated Geometry - 99.11 kB - 01/05/2023 at 23:20

Download

Modcase_Reflector1.stl

Reflects the light of the SBCB leds to the "windows" of the mod case

Standard Tesselated Geometry - 135.53 kB - 01/05/2023 at 23:20

Download

Modcase.stl

Mod case

Standard Tesselated Geometry - 454.96 kB - 01/05/2023 at 23:20

Download

View all 8 files

View all 2 project logs

Enjoy this project?

Share

Discussions

Steve Casanova wrote 01/27/2024 at 18:11 point

Did you try to hack the drone's firmware? 

https://i.imgur.com/mQOWKIv.png

  Are you sure? yes | no

Jar wrote 05/31/2023 at 11:54 point

No Magic?  wishful!

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates