mavproxyuser/dumlrub

Ruby port of PyDUML

DUMLrub

Ruby port of PyDUML

Main executables:

BackDatAssUp.rb - This mimics the "backup" button inside DUMLdore, with a bit more rigorous checks on structure. 
CherryPicker.rb - Tool to "reroll" firmware binaries with specific modules selected. 
LogJammer.rb - Standalone tool for reading upgrade00.log
RubaDubDUML.rb - analog of pyduml.py, used for pushing firmware binaries over serial via DUML protocol 

Git Submodule repos:

exploits - folder contains public and private exploits such as RedHerring converted to use RubaDubDUML as a library
firm_cache - individual firmware modules from DJI firmware 
bins - dji_system.bin stash

Awwwww it feels soooooo good.

Rub-a-dub-dub, Three men in a tub, And who do you think they be?

The butcher, the baker, the candlestick maker, Turn them out, knaves all three

https://en.wikipedia.org/wiki/Rub-a-dub-dub

#DeejayeyeHackingClub information repos aka "The OG's" (Original Gangsters)

http://dji.retroroms.info/ - "Wiki"

https://github.com/fvantienen/dji_rev - This repository contains tools for reverse engineering DJI product firmware images.

https://github.com/Bin4ry/deejayeye-modder - APK "tweaks" for settings & "mods" for additional / altered functionality

https://github.com/hdnes/pyduml - Assistant-less firmware pushes and DUMLHacks referred to as DUMBHerring when used with "fireworks.tar" from RedHerring. DJI silently changes Assistant? great... we will just stop using it.

https://github.com/MAVProxyUser/P0VsRedHerring - RedHerring, aka "July 4th Independence Day exploit", "FTPD directory transversal 0day", etc. (Requires Assistant). We all needed a public root exploit... why not burn some 0day?

https://github.com/MAVProxyUser/dji_system.bin - Current Archive of dji_system.bin files that compose firmware updates referenced by MD5 sum. These can be used to upgrade and downgrade, and root your I2, P4, Mavic, Spark, Goggles, and Mavic RC to your hearts content. (Use with pyduml or DUMLDore)

https://github.com/MAVProxyUser/firm_cache - Extracted contents of dji_system.bin, in the future will be used to mix and match pieces of firmware for custom upgrade files. This repo was previously private... it is now open.

https://github.com/MAVProxyUser/DUMLrub - Ruby port of PyDUML, and firmware cherry picking tool. Allows rolling of custom firmware images.

https://github.com/jezzab/DUMLdore - Even windows users need some love, so DUMLDore was created to help archive, and flash dji_system.bin files on windows platforms.

https://github.com/MAVProxyUser/DJI_ftpd_aes_unscramble - DJI has modified the GPL Busybox ftpd on Mavic, Spark, & Inspire 2 to include AES scrambling of downloaded files... this tool will reverse the scrambling

https://github.com/darksimpson/jdjitools - Java DJI Tools, a collection of various tools/snippets tied in one CLI shell-like application.

dumlrub's Issues

ConditionedRace needs to be brought in line with DUML/Upgrade

Since Upgrade.rb checks the progress of the upgrade process and blocks until it completes, ConditionedRace no longer works since it has to pound the ftp server during the upgrade process.

Mavic Remote

Guess it's not an 'issue' but more a remark/question/inquiry.
I've tried to downgrade my Mavic Remote with DUMLrub, but was unsuccessful.
My heart stopped for a couple of beats..
Logging into the remote with ftp showed the dji_system.bin was uploaded to the /upgrade folder?
but nothing happened.

It clearly states in your header which devices are supported, and it doesn't mention the remote.
Maybe explicitly state it is not supported?
I should have analyzed the .rb file.. indeed found nothing supporting the remote.

Thanks

FlightController.rb - current values same as default in output *.json

FlightController.rb - current values are same as default in output *.json file.
script is reading correct current values, but in cache json a current value is same as default.

Matrice600Pro support?

Are you going to support Matrice600Pro?

exploits.pub Conditioned Race needs updated for Mavic .1000

that script hits at 20% in

[1:33]
08-23 13:32:37.564 240 5787 I DUSS&63[sys_p1_load_upgrade_data:2737]:: upgrade file /cache/upgrade/unsignimgs//wm220_0907_v47.26.02.18_20170801.pro.fw is unencrypted.
08-23 13:32:37.638 240 5787 I DUSS&63[ sys_upgrade_p1_hw:3130]:: load upgrade data success
08-23 13:32:38.050 240 5787 I DUSS&63[sys_upgrade_up_from_scri:3192]:: tar results: modemarm.pro.fw
08-23 13:32:38.050 240 5787 I DUSS&63[sys_upgrade_up_from_scri:3192]:: tar results: modemdsp_gnd.pro.fw
08-23 13:32:38.050 240 5787 I DUSS&63[sys_upgrade_up_from_scri:3192]:: tar results: modemdsp_uav.pro.fw
08-23 13:32:38.050 240 5787 I DUSS&63[sys_upgrade_up_from_scri:3192]:: tar results: upgrade.sh
08-23 13:32:38.050 240 5787 I DUSS&63[sys_upgrade_up_from_scri:3192]:: tar results: dji_verify
08-23 13:32:38.051 240 5787 I DUSS&63[sys_upgrade_up_from_scri:3192]:: tar results: resign_img.sh
08-23 13:32:38.051 240 5787 I DUSS&63[sys_upgrade_up_from_scri:3200]:: busybox tar -xvf /data/upgrade/temp.zip -C /data/upgrade exit status 0, return 0
08-23 13:32:39.562 240 404 I DUSS&63[sys_up_status_push_threa: 993]:: +++++++ Sending upgrade status for upgrading_stage, len: 11, app_host=0xa01, mod_id=0xe9 (09.07), status 1, progress: 25, total_progress: 20
08-23 13:32:39.779 240 407 I DUSS&63[ sys_usb_switch: 316]:: mode: 0, up_status 4, conn_pc 1, conn_app_timeout 3, cam_rt_mode 0, cam_mode 5
08-23 13:32:41.562 240 404 I DUSS&63[sys_up_status_push_threa: 993]:: +++++++ Sending upgrade status for upgrading_stage, len: 11, app_host=0xa01, mod_id=0xe9 (09.07), status 1, progress: 25, total_progress: 20

-rwxrwxrwx media dhcp 1326 2017-07-28 14:09 resign_img.sh

we can probably use it for ConditionedRace.rb

I have no issue with this!

Just here to watch the race! Solid work!