Hacking Parrot MiniDrones

Let’s go to overview the Jumping Sumo, we are going to telnet it, and have a look inside:


$ telnet 192.168.2.1
Trying 192.168.2.1...
Connected to 192.168.2.1.
Escape character is '^]'.

Here It is the shell It is a busybox Linux shell.

Let take a look to the filesystem:

[JS] $ ls
bin dev home mnt sys usr www
data etc lib proc tmp var
debugfs factory media sbin update version.txt


These are the partitions and the mounted filesystem


[JS] $ df -h
Filesystem Size Used Available Use% Mounted on
ubi1:system 26.3M 22.7M 2.3M 91% /
tmp 14.2M 56.0K 14.1M 0% /tmp
dev 14.2M 0 14.2M 0% /dev
ubi0:factory 4.6M 188.0K 4.1M 4% /factory
ubi2:update 28.0M 24.0K 26.5M 0% /update
ubi2:data 31.9M 5.0M 25.2M 17% /data



[JS] $ mount
rootfs on / type rootfs (rw)
ubi1:system on / type ubifs (rw,relatime)
tmp on /tmp type tmpfs (rw,relatime)
proc on /proc type proc (rw,relatime)
dev on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
sys on /sys type sysfs (rw,relatime)
ubi0:factory on /factory type ubifs (ro,relatime)
ubi2:update on /update type ubifs (rw,sync,relatime)
ubi2:data on /data type ubifs (rw,relatime)


Let’s see dmesg in order to know the hardware


[JS] $ dmesg
256K(Pbootloader),16M(Pmain_boot),8M(Pfactory),32M(Psystem),73472K(Pupdate) console=ttyPA1,115200 loglevel=5 ubi.mtd=Pfactory,2048 ubi.mtd=Psystem,2048 root=ubi1:system rootfstype=ubifs ubi.mtd=Pupdate,2048 androidboot.bootloader=ecos-bootloader-omap3630-start-26-gbe3a3db
[ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] Memory: 32MB = 32MB total
[ 0.000000] Memory: 28932k/28932k available, 3836k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] DMA : 0xff000000 - 0xffe00000 ( 14 MB)
[ 0.000000] vmalloc : 0xc2800000 - 0xfc000000 ( 920 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xc2000000 ( 32 MB)
[ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB)
[ 0.000000] .init : 0xc0008000 - 0xc001c000 ( 80 kB)
[ 0.000000] .text : 0xc001c000 - 0xc0327000 (3116 kB)
[ 0.000000] .data : 0xc0340000 - 0xc035a520 ( 106 kB)
[ 0.000000] NR_IRQS:64
[ 0.000000] VIC @fc000000: id 0x00041808, vendor 0x41
[ 0.000000] timer load=0x1528a9, AHB bus 138 MHz, prescaling=1
[ 0.000000] Console: colour dummy device 80x30
[ 0.000602] Calibrating delay loop... 207.66 BogoMIPS (lpj=1038336)
[ 0.190043] pid_max: default: 32768 minimum: 301
[ 0.190643] Mount-cache hash table entries: 512
[ 0.191654] CPU: Testing write buffer coherency: ok
[ 0.196354] Parrot6 GPIO driver $Revision: 1.7 $
[ 0.197082] NET: Registered protocol family 16
[ 0.202402] Initializing JUMPING SUMO board ...
[ 0.202459] arm clk 416 Mhz, AHB bus 138 Mhz
[ 0.202495] board Jump Sumo (0x0a) rev 0x07 (rev tag 0x0000)
[ 0.202518] nand cfg 3.3V
[ 0.202533] efuse 0
[ 0.220052] p6 mux select pin @0xfd000054 : 0x50000000->0x54000000
[ 0.220098] parrot_board_rev = 0x 7
[ 0.220116] => JPSUMO_HW_07
[ 0.220141] p6 mux select pin @0xfd19006c : 0x00550500->0x00550520
[ 0.220170] p6 mux select pin @0xfd19006c : 0x00550520->0x005505a0
[ 0.220198] p6 mux select pin @0xfd19006c : 0x005505a0->0x005506a0
[ 0.220226] p6 mux select pin @0xfd19006c : 0x005506a0->0x00550aa0
[ 0.220254] p6 mux select pin @0xfd000058 : 0x05555555->0x04555555
[ 0.220282] p6 mux select pin @0xfd000058 : 0x04555555->0x00555555
[ 0.220310] p6 mux select pin @0xfd000058 : 0x00555555->0x00555455
[ 0.220338] p6 mux select pin @0xfd000058 : 0x00555455->0x00555055
[ 0.220381] p6 mux select pin @0xfd00005c : 0x00155555->0x00145555
[ 0.220410] p6 mux select pin @0xfd00005c : 0x00145555->0x00045555
[ 0.220435] Initializing Ethernet JTAG ...
[ 0.220454] ethernet is on jtag
[ 0.228308] ARM PL08x DMA controller driver $Revision: 1.3 $
[ 0.293305] bio: create slab at 0
[ 0.298868] SCSI subsystem initialized
[ 0.300790] Advanced Linux Sound Architecture Driver Version 1.0.23.
[ 0.305083] cfg80211: Calling CRDA to update world regulatory domain
[ 0.306355] Switching to clocksource timer2
[ 0.385941] NET: Registered protocol family 2
[ 0.386553] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.387615] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 0.387721] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.387785] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.387815] TCP reno registered
[ 0.387850] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.387909] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.388461] NET: Registered protocol family 1
[ 0.389882] RPC: Registered udp transport module.
[ 0.389929] RPC: Registered tcp transport module.
[ 0.389954] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.392792] P6 Watchdog driver loaded default (30 seconds)
[ 0.403715] io scheduler noop registered
[ 0.403969] io scheduler cfq registered (default)
[ 0.405439] Serial: Parrot5/5+ UART driver $Revision: 1.19 $
[ 0.405804] parrot5-uart.1: ttyPA1 at MMIO 0xd0080000 (irq = 6) is a PARROT5
[ 0.479648] console [ttyPA1] enabled
[ 0.500216] loop: module loaded
[ 0.506319] using cmd : ff
[ 0.509198] using cmd : 90
[ 0.511760] using cmd : 90
[ 0.514449] using cmd : 90
[ 0.517225] ONFI flash detected
[ 0.517257] using cmd : ec
[ 0.520296] using cmd : 90
[ 0.522880] NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
[ 0.522925] setting onfi mode 4
[ 0.525970] status : 00000003
[ 0.529096] start : 00000000
[ 0.531820] tim0 : 86161111
[ 0.534594] tim1 : 0000002d
[ 0.537445] cfg : 00000000
[ 0.540063] ecc : 2400c806
[ 0.542753] ctrl0 : 10000000
[ 0.545619] ctrl1 : 00000100
[ 0.548535] addrlo : ffffff00
[ 0.551436] addrhi : 00000000
[ 0.554388] irq status : 00000003
[ 0.557784] Scanning device for bad blocks
[ 0.564201] Bad eraseblock 149 at 0x0000012a0000
[ 0.568960] Bad eraseblock 153 at 0x000001320000
[ 0.611114] parrotpart partition parsing not available
[ 0.611210] 5 cmdlinepart partitions found on MTD device nand0
[ 0.611244] Creating 5 MTD partitions on "nand0":
[ 0.611286] 0x000000000000-0x000000040000 : "Pbootloader"
[ 0.613325] 0x000000040000-0x000001040000 : "Pmain_boot"
[ 0.615532] 0x000001040000-0x000001840000 : "Pfactory"
[ 0.617789] 0x000001840000-0x000003840000 : "Psystem"
[ 0.620036] 0x000003840000-0x000008000000 : "Pupdate"
[ 0.625155] UBI: attaching mtd2 to ubi0
[ 0.625204] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 0.625233] UBI: logical eraseblock size: 126976 bytes
[ 0.625256] UBI: smallest flash I/O unit: 2048
[ 0.625279] UBI: VID header offset: 2048 (aligned 2048)
[ 0.625303] UBI: data offset: 4096
[ 0.646727] UBI: max. sequence number: 92
[ 0.655780] UBI: attached mtd2 to ubi0
[ 0.655820] UBI: MTD device name: "Pfactory"
[ 0.655848] UBI: MTD device size: 8 MiB
[ 0.655870] UBI: number of good PEBs: 62
[ 0.655890] UBI: number of bad PEBs: 2
[ 0.655909] UBI: number of corrupted PEBs: 0
[ 0.655928] UBI: max. allowed volumes: 128
[ 0.655948] UBI: wear-leveling threshold: 4096
[ 0.655968] UBI: number of internal volumes: 1
[ 0.655987] UBI: number of user volumes: 1
[ 0.656005] UBI: available PEBs: 0
[ 0.656024] UBI: total number of reserved PEBs: 62
[ 0.656046] UBI: number of PEBs reserved for bad PEB handling: 2
[ 0.656072] UBI: max/mean erase counter: 2/1
[ 0.656091] UBI: image sequence number: 1739202486
[ 0.656165] UBI: attaching mtd3 to ubi1
[ 0.656201] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 0.656226] UBI: logical eraseblock size: 126976 bytes
[ 0.656248] UBI: smallest flash I/O unit: 2048
[ 0.656271] UBI: VID header offset: 2048 (aligned 2048)
[ 0.656294] UBI: data offset: 4096
[ 0.656975] UBI: background thread "ubi_bgt0d" started, PID 262
[ 0.742079] UBI: max. sequence number: 637
[ 0.751938] UBI: attached mtd3 to ubi1
[ 0.751977] UBI: MTD device name: "Psystem"
[ 0.752003] UBI: MTD device size: 32 MiB
[ 0.752025] UBI: number of good PEBs: 256
[ 0.752044] UBI: number of bad PEBs: 0
[ 0.752063] UBI: number of corrupted PEBs: 0
[ 0.752082] UBI: max. allowed volumes: 128
[ 0.752102] UBI: wear-leveling threshold: 4096
[ 0.752122] UBI: number of internal volumes: 1
[ 0.752141] UBI: number of user volumes: 1
[ 0.752160] UBI: available PEBs: 0
[ 0.752180] UBI: total number of reserved PEBs: 256
[ 0.752202] UBI: number of PEBs reserved for bad PEB handling: 2
[ 0.752227] UBI: max/mean erase counter: 6/1
[ 0.752247] UBI: image sequence number: 1088759499
[ 0.752319] UBI: attaching mtd4 to ubi2
[ 0.752354] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 0.752379] UBI: logical eraseblock size: 126976 bytes
[ 0.752401] UBI: smallest flash I/O unit: 2048
[ 0.752424] UBI: VID header offset: 2048 (aligned 2048)
[ 0.752448] UBI: data offset: 4096
[ 0.753000] UBI: background thread "ubi_bgt1d" started, PID 265
[ 0.944336] UBI: max. sequence number: 1104
[ 0.956262] UBI: attached mtd4 to ubi2
[ 0.956300] UBI: MTD device name: "Pupdate"
[ 0.956328] UBI: MTD device size: 71 MiB
[ 0.956351] UBI: number of good PEBs: 574
[ 0.956476] UBI: number of bad PEBs: 0
[ 0.956506] UBI: number of corrupted PEBs: 0
[ 0.956529] UBI: max. allowed volumes: 128
[ 0.956550] UBI: wear-leveling threshold: 4096
[ 0.956570] UBI: number of internal volumes: 1
[ 0.956590] UBI: number of user volumes: 2
[ 0.956609] UBI: available PEBs: 0
[ 0.956628] UBI: total number of reserved PEBs: 574
[ 0.956651] UBI: number of PEBs reserved for bad PEB handling: 5
[ 0.956676] UBI: max/mean erase counter: 3/1
[ 0.956695] UBI: image sequence number: 1135652819
[ 0.956789] i2c /dev entries driver
[ 0.957272] UBI: background thread "ubi_bgt2d" started, PID 269
[ 0.958407] Linux video capture interface: v2.00
[ 0.959282] ALSA device list:
[ 0.959323] No soundcards found.
[ 0.961716] parrot5-i2cm parrot5-i2cm.0: controller probe successfully
[ 0.965781] TCP cubic registered
[ 0.965835] NET: Registered protocol family 17
[ 0.966050] lib80211: common routines for IEEE802.11 drivers
[ 0.966092] lib80211_crypt: registered algorithm 'NULL'
[ 0.966119] Registering the dns_resolver key type
[ 0.994580] UBIFS: recovery needed
[ 1.027524] UBIFS: recovery deferred
[ 1.027579] UBIFS: mounted UBI device 1, volume 0, name "system"
[ 1.027603] UBIFS: mounted read-only
[ 1.027631] UBIFS: file system size: 30601216 bytes (29884 KiB, 29 MiB, 241 LEBs)
[ 1.027664] UBIFS: journal size: 1523712 bytes (1488 KiB, 1 MiB, 12 LEBs)
[ 1.027694] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 1.027718] UBIFS: default compressor: none
[ 1.027738] UBIFS: reserved for root: 1445370 bytes (1411 KiB)
[ 1.028914] VFS: Mounted root (ubifs filesystem) readonly on device 0:12.
[ 1.035689] Freeing init memory: 80K
[ 1.353202] UBIFS: completing deferred recovery
[ 1.384504] UBIFS: deferred recovery completed
[ 2.024927] UBIFS: mounted UBI device 0, volume 0, name "factory"
[ 2.030975] UBIFS: mounted read-only
[ 2.034446] UBIFS: file system size: 5967872 bytes (5828 KiB, 5 MiB, 47 LEBs)
[ 2.041826] UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
[ 2.048909] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 2.054664] UBIFS: default compressor: none
[ 2.058884] UBIFS: reserved for root: 281876 bytes (275 KiB)
[ 2.107601] UBIFS: recovery needed
[ 2.203223] UBIFS: recovery completed
[ 2.206853] UBIFS: mounted UBI device 2, volume 0, name "update"
[ 2.212744] UBIFS: file system size: 32505856 bytes (31744 KiB, 31 MiB, 256 LEBs)
[ 2.220446] UBIFS: journal size: 1650688 bytes (1612 KiB, 1 MiB, 13 LEBs)
[ 2.227720] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 2.233483] UBIFS: default compressor: none
[ 2.237702] UBIFS: reserved for root: 1535331 bytes (1499 KiB)
[ 2.289220] UBIFS: recovery needed
[ 2.352530] UBIFS: recovery completed
[ 2.356063] UBIFS: mounted UBI device 2, volume 1, name "data"
[ 2.361979] UBIFS: file system size: 36950016 bytes (36084 KiB, 35 MiB, 291 LEBs)
[ 2.369580] UBIFS: journal size: 1904640 bytes (1860 KiB, 1 MiB, 15 LEBs)
[ 2.376855] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 2.382620] UBIFS: default compressor: none
[ 2.386837] UBIFS: reserved for root: 1745239 bytes (1704 KiB)
[ 3.527210] usbcore: registered new interface driver usbfs
[ 3.546419] usbcore: registered new interface driver hub
[ 3.560878] usbcore: registered new device driver usb
[ 3.641734] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 3.656672] p6i-ehci p6i-ehci.0: Parrot 6+ On-Chip EHCI Host Controller
[ 3.663431] p6i-ehci p6i-ehci.0: new USB bus registered, assigned bus number 1
[ 3.706318] p6i-ehci p6i-ehci.0: irq 29, io base 0xc0400000
[ 3.726317] p6i-ehci p6i-ehci.0: USB 2.0 started, EHCI 1.00
[ 3.747206] hub 1-0:1.0: USB hub found
[ 3.750890] hub 1-0:1.0: 1 port detected
[ 3.913326] Initializing USB Mass Storage driver...
[ 3.927808] usbcore: registered new interface driver usb-storage
[ 3.933678] USB Mass Storage support registered.
[ 4.066363] usb 1-1: new high speed USB device using p6i-ehci and address 2
[ 4.247205] hub 1-1:1.0: USB hub found
[ 4.257063] hub 1-1:1.0: 3 ports detected
[ 4.567831] usb 1-1.1: new high speed USB device using p6i-ehci and address 3
[ 4.856315] usnd_init : debug_param 0
[ 4.859968] ultra_snd probe#
[ 4.887582] Ultra sound/ SPI driver probe done
[ 4.988641] start pwm clock
[ 5.279551] udev[415]: starting version 164
[ 8.609882] NET: Registered protocol family 10
[ 8.857124] Inserting bcm_dbus module
[ 9.084902] wl: module license 'Proprietary' taints kernel.
[ 9.091398] Disabling lock debugging due to kernel taint
[ 10.027127] bcm_rpc_up: waiting to be connected
[ 10.032634] bcm_rpc_buf_recv_mgn_high: Recvd:3 Version: 0x6257223
[ 10.032653] State: 3 Session:105
[ 10.041810] bcm_rpc_buf_recv_mgn_high: Reason: 0 Dongle Version: 0x6257223
[ 10.048658] bcm_rpc_buf_recv_mgn_high: Connected!
[ 10.088016] eth0: Broadcom BCMaa06 802.11 Wireless Controller 6.37.114.35 (r445129)
[ 10.112245] usbcore: registered new interface driver dbus_usbdev
[ 10.226849] udev[422]: renamed network interface eth0 to wifi_bcm
[ 16.396194] usbcore: registered new interface driver asix
[ 17.775478] usb 1-1.2: new high speed USB device using p6i-ehci and address 4
[ 18.440739] uvcvideo: Found UVC 1.00 device USB2.0 Camera (1e4e:0104)
[ 18.455170] uvcvideo: Forcing device quirks to 0x1000 by module parameter for testing purpose.
[ 18.491556] uvcvideo: Please report required quirks to the linux-uvc-devel mailing list.
[ 18.512298] uvcvideo: Failed to set UVC probe control : -32 (exp. 26).
[ 18.546236] input: USB2.0 Camera as /devices/platform/p6i-ehci.0/usb1/1-1/1-1.2/1-1.2:1.0/input/input0
[ 18.596730] usbcore: registered new interface driver uvcvideo
[ 18.602338] USB Video Class driver (1.1.1)
[ 18.687425] start pwm clock
[ 21.070189] uvcvideo: mmapping
[ 21.073564] uvcvideo: mmap on stream->queue
[ 21.079649] uvcvideo: mmapping
[ 21.079649] uvcvideo: mmapping
[ 21.082787] uvcvideo: mmap on stream->queue
[ 21.087757] uvcvideo: mmapping
[ 21.090972] uvcvideo: mmap on stream->queue
[ 21.097854] uvcvideo: mmapping
[ 21.101030] uvcvideo: mmap on stream->queue
[ 21.106020] uvcvideo: mmapping
[ 21.111926] uvcvideo: mmap on stream->queue
[ 21.128808] uvcvideo: mmapping
[ 21.132105] uvcvideo: mmap on stream->queue
[ 21.138561] uvcvideo: mmapping
[ 21.141474] uvcvideo: mmap on stream->queue
[ 21.146353] uvcvideo: mmapping
[ 21.149382] uvcvideo: mmap on stream->queue
[ 25.624390] wifi_bcm: no IPv6 routers present