Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Reversed a Drone and Landed It with My PC

hardbreak.wiki

Post reply on HN
Print view View original

41–50 of 51 posts

Re: I Reversed a Drone and Landed It with My PC

#41

Post by 05 »

makira wrote: post #31
magnat wrote: post #24

Earlier quoted context omitted.

Lots of no-name or DIY drones use flight controller running a BetaFlight [1] firmware, which is open source and quite hackable. If you want low-level real-time programmatic control (like manipulating servos, lights or camera), that is most likely the easiest way. There is also ArduPilot [2] firmware, which is focused more on the high-level control (like managing GPS waypoints and autonomous takeoff/landing). In both…

Any reason BetaFlight doesn't appear to have even basic pre-shared key symmetric encryption? Some ciphers aren't that CPU intensive.

Crossfire supports encryption. Mainline ELRS can't add encryption support because the whole idea of ELRS was to reduce LoRa packet size to the bare minimum needed for 4 full res channels + a bit extra for arming and time multiplexed aux channels. There's some discussion on protocol security and scope here [0]. I'm sure these days there are multiple LoRa based links (independent and ELRS forks) that support authenticated encryption.

[0] https://github.com/ExpressLRS/ExpressLRS/pull/1411

Re: I Reversed a Drone and Landed It with My PC

#42

Post by palata »

hw-f3nter wrote: post #39
palata wrote: post #30

I am confused... isn't Parrot's ground SDK open source? https://github.com/Parrot-Developers/groundsdk-android Why reverse it?

For context, this drone was reversed back in 2018 as part of my bachelor thesis. At the time, the SDK hadn’t been released yet I believe, so reversing was the only available option. Recently, I revisited this work and decided to include it on my new hardware hacking wiki - HardBreak.

Hmm. Parrot has had SDKs for their drones years (at least 5) before 2018. Maybe it happened during the few months between the moment they shipped the Anafi and the moment they shipped the corresponding SDK, then.

But anyway, for educational purposes it's interesting to reverse engineer anything you want!

Re: I Reversed a Drone and Landed It with My PC

#43

Post by [deleted] »

chrisdalke wrote: post #34
palata wrote: post #30

I am confused... isn't Parrot's ground SDK open source? https://github.com/Parrot-Developers/groundsdk-android Why reverse it?

That was my thought, at least one of those packets in their snooping (src. port 14551 / dest port 14550) is the standard Mavlink port to send to the GCS. I wonder if the proprietary packet they decoded here is actually just a MAV_CMD_DO_SET_MODE setting the drone into a takeoff flight mode.

[deleted]

Re: I Reversed a Drone and Landed It with My PC

#44

Post by echoangle »

numpad0 wrote: post #32
theamk wrote: post #16

Earlier quoted context omitted.

What are you talking about? The Anafi drone uses regular wifi, with ESSID and password, and that's how the security is achieved. There is no need for additional encryption on protocol level. It's really the best way - instead of making ad-hoc security mechanisms, rely on well-researched and well-tested wifi security. (That first sentence, "Start by connecting your PC to the Parrot Anafi’s Wi-Fi network", really carri…

They used to have root shell on telnet in early consumer drones. It was a long time ago, but that can't happen by accident; they could have used dropbear with known fixed password, Wi-Fi MAC as password, etc. They also had wildly different mass than competitors - realistically DJI - at same price/performance ranges. So I assumed ever since that they have their unique opinions about security and architecture of a flyi…

> They used to have root shell on telnet in early consumer drones.

Is that a problem as long as the drone WiFi is protected?

Re: I Reversed a Drone and Landed It with My PC

#45

Post by hw-f3nter »

palata wrote: post #42
hw-f3nter wrote: post #39

Earlier quoted context omitted.

For context, this drone was reversed back in 2018 as part of my bachelor thesis. At the time, the SDK hadn’t been released yet I believe, so reversing was the only available option. Recently, I revisited this work and decided to include it on my new hardware hacking wiki - HardBreak.

Hmm. Parrot has had SDKs for their drones years (at least 5) before 2018. Maybe it happened during the few months between the moment they shipped the Anafi and the moment they shipped the corresponding SDK, then. But anyway, for educational purposes it's interesting to reverse engineer anything you want!

I think I searched for the corresponding SDK back then, but couldn't find anything. Maybe I was just too stupid haha

Yeah I learned a lot doing it!

Re: I Reversed a Drone and Landed It with My PC

#46

Post by saidinesh5 »

makira wrote: post #31
magnat wrote: post #24

Earlier quoted context omitted.

Lots of no-name or DIY drones use flight controller running a BetaFlight [1] firmware, which is open source and quite hackable. If you want low-level real-time programmatic control (like manipulating servos, lights or camera), that is most likely the easiest way. There is also ArduPilot [2] firmware, which is focused more on the high-level control (like managing GPS waypoints and autonomous takeoff/landing). In both…

Any reason BetaFlight doesn't appear to have even basic pre-shared key symmetric encryption? Some ciphers aren't that CPU intensive.

Betaflight doesn't really care about what Radio receiver you're using - as long as it can talk to it over uart (/SPI) via one of its supported protocols like crsf, ibus, sbus etc..

If you really want encryption, you can simply use a PiZero that talks CRSF to Betaflight and has an encrypted channel to your ground station over 4G LTE/Wifi/Wfb-ng/what not.

But if you're dealing with 4G and PiZero, might as well use Ardupilot + mavlink. Those tools already support this use case much better.

Betaflight is more of a proximity racing drone kind of use case. Only recently did it's GPS return to home functionality got some improvements.

Re: I Reversed a Drone and Landed It with My PC

#48

Post by baybal2 »

jdietrich wrote: post #40
magnat wrote: post #35

Earlier quoted context omitted.

BetaFlight doesn't deal with over-the-air bits, it just receives PWM/PPM/S-Bus/whatever signals your receiver provides. There is no point to have encryption in firmware, because connection between RX and FC is hardwired and can be trusted. Lack of OTA frames encryption, as far as I can tell, is mostly due to legacy reasons. In DYI FPV there are only couple of transmission standards, most of them using 2.4GHz FHSS or…

The threat model for most FPV pilots (either hobbyists or people in Ukraine) doesn't really include hijacking of the air link. It's trivial to just shoot something down with interference, sometimes inadvertently. Pretty much everyone in FPV is now using ExpressLRS, which is an open protocol. If you want an encrypted air link, then the best option I'm aware of is the proprietary TBS Crossfire protocol. https://www.exp…

[dead]

Re: I Reversed a Drone and Landed It with My PC

#49

Post by palata »

hw-f3nter wrote: post #45
palata wrote: post #42

Earlier quoted context omitted.

Hmm. Parrot has had SDKs for their drones years (at least 5) before 2018. Maybe it happened during the few months between the moment they shipped the Anafi and the moment they shipped the corresponding SDK, then. But anyway, for educational purposes it's interesting to reverse engineer anything you want!

I think I searched for the corresponding SDK back then, but couldn't find anything. Maybe I was just too stupid haha Yeah I learned a lot doing it!

Sounds good! I just wasn't sure if I was missing something. Good work otherwise!

Re: I Reversed a Drone and Landed It with My PC

#50

Post by Saris »

makira wrote: post #31
magnat wrote: post #24

Earlier quoted context omitted.

Lots of no-name or DIY drones use flight controller running a BetaFlight [1] firmware, which is open source and quite hackable. If you want low-level real-time programmatic control (like manipulating servos, lights or camera), that is most likely the easiest way. There is also ArduPilot [2] firmware, which is focused more on the high-level control (like managing GPS waypoints and autonomous takeoff/landing). In both…

Any reason BetaFlight doesn't appear to have even basic pre-shared key symmetric encryption? Some ciphers aren't that CPU intensive.

Betaflight doesn't handle communications, but also it's just meant for hobby FPV usage.

If you want autonomous stuff with more advanced features ArduCopter is the way to go.

Post reply on HN