It's not butter, but it's root.

Overview

margerine

Episode 2: Revenge of the ¯\_(ツ)_/¯

margerine is a root exploit and adb enabler for the DJI Air Unit (wm150), Caddx Vista (lt150), FPV Goggles V1 (gl150), and FPV Googles V2 (gl170/gp150) from the same people that brought you USB Video Out.

Currently only works reliably on Windows and Mac OS X, Linux has strange issues in the USB stack - YMMW.

tl;dr;

Use Node.js version 16.x

Install nodejs and the Javascript dependencies:

npm install

Remove your SD card for the duration of the exploit, power up the victim device, connect it via USB and run:

node margerine.js unlock

Have fun! consider donating and join us on our Discord.

Troubleshooting

  • waving wand, result e0 - make sure you've followed all the instructions below, reboot your Goggles and try again. It should eventually work.
  • The device might change it's COM port number on Windows (eg. COM4 -> COM5) in the middle of the exploit and error out. That's a good sign! Look up the new COM port in Device Manager (if auto detect didn't work for you) and re-run the exploit to finish everything up.
  • The device being exploited should not be connected to anything else; i.e. Googles to AU or AU to Goggles.
  • Make sure there's no SD card in your device.
  • V2 Goggles must be flashed from DIY mode to 01.00.0606.
    • Checking the menus in DIY mode is insufficient. Make sure Assistant says "Refresh" next to 0606, rather than "Downgrade". If you see "Downgrade", go ahead and downgrade.
    • If you've flashed to 01.02.0015 in drone mode the exploit won't work and you can't downgrade at the moment, sorry.
    • Despite the bigger version number 01.02.0020 in drone mode, goggles can be downgraded to 0606 in DIY mode.

Other notes

  • Requires an internet connection. Certain signing procedure happens on Drone-Hacks server kindly provided by @bin4ry
  • Takes few minutes. Make sure your battery is not too low when powering AU/Vista from a quad.
  • You have to run node margerine.js lock before the Assistant will allow you to flash firmwares again.
  • Disables SELinux for you
  • On *150 remounts /proc/cmdline so that mp_state=engineering, which enables adb
  • With great power comes great responsibility - you CAN bootloop/brick your device if you modify or delete important files. There are currently no low level recovery methods available.

What can I do with this?

  • Play Doom
  • Customize the UI theme in /system/gui/xml/themes/defult/theme.xml
  • Pair an Air Unit (or Vista) to another Air Unit using /system/bin/modem_info.sh reverse on one of them.
  • Talk to connected devices via TCP or UDP. Goggles are 192.168.41.1 and air side is 192.168.41.2.
  • Debug USB devices such as input on V2 Goggles (no OTG on V1) by adb shell-ing into a connected Vista/AU and then using adb connect 192.168.41.1 && adb shell to debug wirelessily.
  • Build stuff with the latest Android NDK armv7 architecture, target platform 23.
    • A modified Directfb framebuffer library is available for drawing to an ARGB target to be overlaid on top of the video feed.
    • Direct access to the framebuffer is not available, except via special undocumented DMI bullsh*t.
    • Check out the dfbdoom project.
  • Reverse engineer stuff with IDA, Ghidra and/or Frida.

Advanced usage

node margerine --help
margerine <command>

Commands:
  margerine unlock [serialport]    unlock device and enable adb
  margerine lock [serialport]      disable adb and relock device

Options:
  --help     Show help                                                 [boolean]
  --version  Show version number                                       [boolean]

How does this work

Magic unicorn dust and sprinkles. For the time being, we're keeping the details private.

To-do

  • Chroot for any/all modifications
    • to enable using one of the GPIO keys to skip loading modifications during startup
  • Some kind of package manager
    • ipkg seems like an embeddable option
    • Device doesn't have internet access by default
      • Just adb push packages?
      • Route RNDIS
  • A launcher
    • Needs hooking or injecting directly into the existing GUI
  • More documentation
  • Eventually create a nice web GUI

It's spelled margarine

No, it's not.

Credits

While this is an original exploit by Joonas Trussmann, it would not have been even remotely possible without work by @tmbinc and @bin4ry. Also a shout out to the rest of the OG's for all their work on dji-firmware-tools.

Special thanks go to: @jaanuke, @funnel and @fichek over on our Discord.

Support the effort

This took A LOT of my free time over the past year. If you'd like, you can send some ETH to 0xbAB1fec80922328F27De6E2F1CDBC2F322397637 or BTC to 3L7dE5EHtyd2b1tXBwdnWC2MADkV2VTbrq or buy me a coffe. I would really appreciate it.

Comments
  • Vista Fcc 700 and 1200 Mw hacks not working after frameware update

    Vista Fcc 700 and 1200 Mw hacks not working after frameware update

    Hi everybody , I can not get the Vista storage pops up in my drives , i have tried every method but the storage does not show up , please help , i am stuck with 25 mw ...

    opened by rezaFpv 11
  • Goggles firmware out of date - latched message.

    Goggles firmware out of date - latched message.

    Hello everyone. I have the firmware version 1.2.0000 on the DJI Goggles. Unfortunately, the system forces me to uprade to version 0015. There is a latched message. Is there a way to go ahead without upgrading to 0015? Thank you for your help. I can repay you with a donation.

    opened by dereksynkopa 10
  • Not an issue just a question

    Not an issue just a question

    I pulled the root files from my v2 goggles and i wanted to ask what does the debug menu do.I kinda don't want to risk my goggles just asking if anybody has tried it.

    https://ibb.co/f8X5PHL https://ibb.co/D9FFRgC

    opened by Hrisfpv 8
  • Specify requirement to use Node.js version 16.x

    Specify requirement to use Node.js version 16.x

    I tried this on Node v14 and it failed to run, erroring with

    couldn't do the magic. please read the notes in README.md, restart your device and try again
    TypeError [ERR_UNKNOWN_ENCODING]: Unknown encoding: base64url
        at Buffer.toString (buffer.js:803:11)
        at /Users/robin/dev/margerine/src/exploit.js:1:81335
        at new Promise (<anonymous>)
        at /Users/robin/dev/margerine/src/exploit.js:1:76415
        at async /Users/robin/dev/margerine/margerine.js:49:16
        at async wrapSentry (/Users/robin/dev/margerine/src/utils.js:134:5) {
      code: 'ERR_UNKNOWN_ENCODING'
    }
    
    opened by robinduckett 5
  • Air Unit Recording

    Air Unit Recording

    I fly with fixed wings and quadcopters, on fixed wings I use air units and on quadcopters I use caddx vista. I like to record videos on the air units, but when I change from quadcopter to fixed wing, the recording on the air unit is disabled and I often forget to reactivate it from the glasses. there would be no way that the glasses automatically switch the recording mode according to the unit used?

    question 
    opened by Ciurrone 2
  • Serialport issue

    Serialport issue

    Get this message on Ubuntu

    margerine-master$ node margerine.js unlock internal/modules/cjs/loader.js:638 throw err; ^

    Error: Cannot find module 'serialport' at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15) at Function.Module._load (internal/modules/cjs/loader.js:562:25) at Module.require (internal/modules/cjs/loader.js:692:17) at require (internal/modules/cjs/helpers.js:25:18) at Object. (/home/mindaugas/Downloads/margerine-master(1)/margerine-master/margerine.js:1:20) at Module._compile (internal/modules/cjs/loader.js:778:30) at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10) at Module.load (internal/modules/cjs/loader.js:653:32) at tryModuleLoad (internal/modules/cjs/loader.js:593:12) at Function.Module._load (internal/modules/cjs/loader.js:585:3)

    opened by minzukas 2
  • Complete dump

    Complete dump

    Hallo, is there already a complete dump of all files availible to take a look on the files? Maybe it's not an issues, but I do not know where I can ask this think.

    opened by druckgott 2
  • Why obfuscate the code?

    Why obfuscate the code?

    Hey, great project - thank you.

    I am really interesting in learning how the exploit works - obfuscating the code does not make this any easier. Just wondering why you decided to obfuscate? I would understand it if it was to make DJIs life harder to patch the hole, but it seems it is patched with their "latest" firmware anyway, no?

    opened by stylesuxx 2
  • Getting both OSDs, Vista goes to low power immediately, cannot toggle in/out of OSD mode….

    Getting both OSDs, Vista goes to low power immediately, cannot toggle in/out of OSD mode….

    Ok, bear with me a bit lol.

    I rooted googles and vista units, everything reports fine and if I switch on the debug stuff in the googles, it all works as expected and everything is up to date.

    Firstly, I get both lots of OSD’s, the DJI one comes on then after a few seconds the entire DJI OSD goes off, and comes back on with the Betaflight one on top of it, once this happens the vista unit goes into low power mode almost immediately but if I disable the Betaflight osd on both the googles and vista, the DJI OSD works fine and the vista doesn’t go into low power mode (I’ve got a fan on it and the wtf.fpv configurator reports the temp to be no more than 60C).

    I’ve seen mention online that to enable the Betaflight OSD you push and hold the back button for 5 seconds, if I do that with the BOSD enabled at startup, nothing happens (presumably because the OSD is operating) but if I do that with the BOSD not enabled in the startup menu in the configurator, after 3 seconds the googles go into the screensaver mode and I have to press any button to get back to the FPV view.

    What an I doing something wrong?

    any help much appreciated…..

    opened by TestPilotIan 1
  • Exploits shared with FPV Drone?

    Exploits shared with FPV Drone?

    Would this root facilitate rooting the FPV Drone?

    That might facilitate a whole new world of new features, PID tuning, etc.

    I assume some of the exploits are common since you said you shared some with Dronehacks and they also require the drone on firmware 1.02.0000 to work.

    opened by anethema 1
  • Couldnt patch startup

    Couldnt patch startup

    First of all, thank you very much for this aweseome work!

    I have a GP150 on 01.00.0606 (v2, maybe i misunderstood the compatibility? -> what is DIY mode?)

    Wand is working but has problems patching the startup: COM port is the same during the complete process

    found GP150 (v2) waiting for device to reboot asking nicely waving wand asking again, this time with some gusto waiting for device to reboot waiting for device to reboot leaving something to remember me by couldn't patch startup, retrying leaving something to remember me by couldn't patch startup, retrying leaving something to remember me by couldn't patch startup, retrying leaving something to remember me by couldn't patch startup, retrying leaving something to remember me by couldn't patch startup, retrying leaving something to remember me by couldn't patch startup, retrying leaving something to remember me by couldn't do the magic. please read the notes in README.md, restart your device and try again couldn't patch startup, sorry

    opened by Blueforcer 1
  • DJI goggles notification:

    DJI goggles notification: "Firmware versions do not match"

    Although I updated all my Vista's and my goggles v1 to V01.00.0606 I get a DJI based pop-up notification which reports: "Firmware versions do not match. Use DJI Assistant 2 (DJI FPV Series) to upgrade." at the very beginning of the transmission. The video transmission and the msp-osd is working. If I click on "Check" I can see that the goggles and the vista have the correct and equal FW version. If I click on "Skip" everything is working as expected. Due my goggles and vista's are rooted I can't check the FW version anymore with DJI Assistant 2 because it reports "Cannot load firmware list".

    How can I get rid of this nasty pop-up when I start the transmission? Is there a way to supress it anyway?

    opened by Nimrasol 1
  • Custom osd turns off betaflight osd

    Custom osd turns off betaflight osd

    Hey guys

    Just completed the root and wtfos install completed the betaflight cli commands required and while all was successfully completed when I turn off the dji custom osd I lose the entire betaflight osd. Also to note I don't have access to the betaflight menu on the goggles not exactly sure where I have gone wrong if at all?

    Cheers

    opened by Levit8fpv 2
  • Goggle Notification when Goggles and air unit are on different versions of wtfOS

    Goggle Notification when Goggles and air unit are on different versions of wtfOS

    If someone has a whole fleet of quads things may get a little weird. It would be nice to know if I forgot to update one of them and the firmware version isn't the same as the goggles.

    opened by rochford77 1
  • found GP150 and reboots but can't continue

    found GP150 and reboots but can't continue

    I can't seem to get beyond this, It looks promising but then catches this error, I've tried rebooting and redoing this procedure dozens of times so far, any tips?

    v01.00.060

    found GP150 waiting for device to reboot asking nicely This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). The promise rejected with the reason: unexpected response seq and no more packets to try

    opened by mdunlap 2
  • Updated DUML Implementation

    Updated DUML Implementation

    Updated the DUML lib with newer versions. Added DUML Session that matches responses with requests/routes unmatched messages. Changed the serial library to register an event listener instead of blocking polling.

    opened by D3VL-Jack 0
  • Lua controled video overlay

    Lua controled video overlay

    Hi, Do you think that it's possible to implement lua scripting to draw on a video overlay ? There would be great to simply load lua script to sd card, which would utilize telemetry data and draw whatever we want, let say virtual obstacle, augmented reality things, etc... Kris

    opened by krzysztofkuczek 1
Releases(v1.2.2)
  • v1.2.2(Sep 10, 2022)

  • v1.2.1(Sep 10, 2022)

  • v1.2.0(Sep 8, 2022)

    margerine is now open source, under an MIT license.

    Added shell command to execute command on rooted devices without adb enabled. Probably fixed some bugs.

    Source code(tar.gz)
    Source code(zip)
  • v1.0.0(Mar 15, 2022)

    You might've heard hushed voices talking about a DJI FPV root exploit for over a year now. You might've seen some blurry videos of Doom running on what looks suspiciously like a pair of your favorite digital HD goggles. Or you might've been warned not to upgrade to V01.02.0015 because something cool is coming.

    After more than a year of banging our heads against the table here it is!

    The fpv.wtf team presents: margerine, a root exploit and adb enabler for the DJI Air Unit, Caddx Vista, FPV Goggles V1, and FPV Googles V2.

    V1.0.0 is rather barebones and as such, is primarily intended for developers wanting to join in on the fun. You get full root access on the aforementioned devices, which allows you to play with a ton of hidden settings and features, build new and port existing software with the Android NDK and generally get yourself into trouble. And we mean trouble: don't go modifying system files all willy-nilly as you very much can brick your device if you don't know what you're doing. The exploit itself however is completely safe.

    There's still tons more work to do, expect margerine to become more reliable and for useful mods to become available in the near future. Right after we catch up on the day jobs we've been neglecting. In the long term, this allows us to modify most of the functionality on the device and be the un-paid developers DJI clearly so badly needs.

    A big thanks to @tmbinc without whose help this would never have been possible. The man is a legend.

    More thanks go out to: @bin4ry, @jaanuke, @funneld, and @fichek.

    Join us on our Discord.

    Yours truly, @Joonas and the rest of the fpv.wtf gang.

    PS: This release is still a little touch-and-go on Goggles V2. When in doubt:

    Have you tried turning it off and on again?

    Source code(tar.gz)
    Source code(zip)
Owner
fpv.wtf
fpv.wtf
A "Basic-to-Lisp" compiler. But Basic is not real Basic, and Lisp is not real Lisp.

Basic2Lisp A "Basic-to-Lisp" compiler. But Basic is not real Basic, and Lisp is not real Lisp. Syntax Print-Sth Put some-value to standard output. PRI

Hana Yabuki 5 Jul 10, 2022
👇 Bread n butter utility for component-tied mouse/touch gestures in Svelte.

svelte-gesture svelte-gesture is a library that lets you bind richer mouse and touch events to any component or view. With the data you receive, it be

Robert Soriano 29 Dec 21, 2022
👇 Bread n butter utility for component-tied mouse/touch gestures in Solid.

solid-gesture solid-gesture is a port of @use-gesture/react which lets you bind richer mouse and touch events to any component or view. With the data

Robert Soriano 8 Sep 30, 2022
WAMpage - A WebOS root LPE exploit chain

WAMpage WAMpage - A WebOS root LPE exploit chain This exploit is mainly of interest to other researchers - if you just want to root your TV, you proba

David Buchanan 45 Dec 2, 2022
This package enables you to mount your Remix app at a different path than root

Remix Mount Routes This package enables you to mount your Remix app at a different path than root. ?? Installation > npm install -D remix-mount-routes

Kiliman 26 Dec 17, 2022
Solidity NFT whitelist contract example using MerkleTree.js for constructing merkle root and merkle proofs.

MerkleTree.js Solidity NFT Whitelist example Allow NFT minting only to whitelisted accounts by verifying merkle proof in Solidity contract. Merkle roo

Miguel Mota 65 Dec 29, 2022
A TypeScript implementation of High-Performance Polynomial Root Finding for Graphics (Yuksel 2022)

Nomial Nomial is a TypeScript implementation of Cem Yuksel's extremely fast, robust, and simple root finding algorithm presented in the paper "High-Pe

Peter Boyer 10 Aug 3, 2022
Types generator will help user to create TS types from JSON. Just paste your single object JSON the Types generator will auto-generate the interfaces for you. You can give a name for the root object

Types generator Types generator is a utility tool that will help User to create TS Interfaces from JSON. All you have to do is paste your single objec

Vineeth.TR 16 Dec 6, 2022
With this script you can bypass both root detection and ssl pinning for your android app.

frida_rootansslbypas ██████╗ ██████╗ ██████╗ ████████╗ █████╗ ███╗ ██╗██████╗ ███████╗███████╗██╗ ██████╗ ██╗ ██╗██████╗ █████╗

themalwarenews 14 Dec 24, 2022
Find root-affix combinations of English words.

Find root-affixes of word 查找英语单词的词根词缀组合。 查找规则 直接返回小于等于长度为 2 的单词 先获取单词原形,还原复数、比较级、过去式等单词形式 再通过穷举获得所有的词根词缀组合 然后去除不完整的组合,即该拼写组合 != 单词 在所有符合条件的组合中,比较所有组合的

null 18 Dec 22, 2022
Storybook Addon Root Attributes to switch html, body or some element attributes (multiple) at runtime for you story

Storybook Addon Root Attributes What is this This project was inspired by le0pard/storybook-addon-root-attribute The existing library received only on

정현수 5 Sep 6, 2022
🧩 TypeScript utility type in order to ensure to return only properties (not methods) containing values in primitive types such as number or boolean (not Value Objects)

?? TypeScript Primitives type TypeScript utility type in order to ensure to return only properties (not methods) containing values in primitive types

CodelyTV 82 Dec 7, 2022
A Browser extension that not only makes your browsing experience safe but makes it optimized

Sia Sia is a browser extension that not only makes your browsing experience safe but makes it optimized Table of Contents About The Project Built With

Arun Govind M 14 Feb 23, 2022
WhyProfiler is a CPU profiler for Jupyter notebook that not only identifies hotspots but can suggest faster alternatives.

Introduction WhyProfiler is a CPU profiler for Jupyter notebook that not only identifies hotspots but can suggest faster alternatives. It is powered b

Robusta 44 Dec 5, 2022
🪐 The IPFS gateway for NFT.Storage is not "another gateway", but a caching layer for NFTs that sits on top of existing IPFS public gateways.

nftstorage.link The IPFS gateway for nft.storage is not "another gateway", but a caching layer for NFT’s that sits on top of existing IPFS public gate

NFT.Storage 37 Dec 19, 2022
our features are few but we provide the best and it is not uncommon to find in other npmjs

hikki-me our features are few but we provide the best and it is not uncommon to find in other npmjs Installation Install hikki-me with npm npm install

(Anto) 10 Jul 10, 2022
BttrLazyLoading is a Jquery plugin that allows your web application to defer image loading until images are scrolled to but not only

BttrLazyLoading.js BttrLazyLoading is a Jquery plugin that allows your web application to defer image loading until images are scrolled to but not onl

Julien Renaux 410 Dec 14, 2022
Plain JavaScript version of jQuery's slideToggle(), slideDown(), & slideUp(), but does not use display: none.

dom-slider It works like jQuery's slideToggle(), slideDown(), & slideUp(), but does not use display: none. Uses CSS3 transitions and element.scrollHei

Brenton Cozby 56 Dec 27, 2022