DJI Mavic Mini CE fake GPS lock

README.md

DJI Mavic Mini boost

Upd. Hack implemented in web browser, no Python required. YouTube instructions.

Подробная инструкция на Русском языке.

Step 1: fly your drone to US

1. On Android phone install:
   1. Fake GPS
   2. DJI Fly 1.1.2 - the old version. Uninstall your current DJI Fly, find v.1.1.2 on apr mirror. After applying the hack remove the v.1.1.2 and install the fresh DJI Fly app again from Google Play.
2. Do this in-house, under a roof, where GPS signal is lost. Set your location to USA or Bolivia. Launch DJI Fly, connect remote controller (RC), start RC. Turn on your aircraft (AC). Message "Updating you current settings to match local regulations" will appear.
3. Shut down AC, RC and quit DJI Fly app.

Step 2: send some bytes to the remote controller

You will need a computer with Windows, Mac OS or Linux and Python installed.

Install python module pySerial: pip install pyserial or python -m pip install pyserial

Connect RC to the computer with USB cable. Turn on the RC. It will appear as a serial port. List available serial ports:

python -m serial.tools.list_ports -v

On Mac OS X connected RC was displayed as

/dev/cu.usbmodemFA131
    desc: Gadget Serial v2_4
    hwid: USB VID:PID=2CA3:0008 LOCATION=250-1.3

Edit MiniBoost.py file: replace "COM5" with "/dev/cu.usbmodemFA131" or whatever the port name is in your case.

Apply the hack:

python MiniBoost.py

All done

Now the quad will continue to "think" it is in the selected country, and both 2.4 GHz and 5.8 GHz ranges will be available.

Rollback

To unroll the hack, use the second file MiniStock.py the same way. It will restore the RC to factory state. After connecting the drone it will update itself to the local regional radio settings.

MiniBoost.py

import serial
comport = "COM5"
ser = serial.Serial(comport, 9600)
command1 = b'\x55\x0e\x04\x66\x2a\x1b\x07\x27\x40\x06\xfb\x02\xac\x35'
ser.write(command1)
print ('You have hacked Your Mini')

MiniStock.py

import serial
comport = "COM5"
ser = serial.Serial(comport, 9600)
command1 = b'\x55\x0e\x04\x66\x2a\x1b\x25\xf9\x40\x06\xfb\x03\x9c\x37'
ser.write(command1)
print ('Your Mini is in initial stock state')

@gb160 Hey, glad you enjoyed it. I take no credits for the byte sequence itself: found it somewhere in the forums and just rushed to share. Some said these byte tricks only change a single setting for a "country" mode to some special value ("Z" ?), maybe intended for tech service of the drone.
Can only suggest to dig the config file in the drone, if you can find access, to see the original value, and the value after sending the sequence.
Or, maybe have a beer with someone from DJI authorized service to learn the internals 😄

@sergiks No problem buddy , thanks for getting back to me. It's no huge problem if it stays in FCC mode permanently. Its funny... I spent ages researching how to get the drone into FCC mode, now I'm researching getting it out of FCC mode 😂
If anyone else reads this and has any ideas then please reply !

@sergiks any idea if this hack will work for RC-N3 (RC151) and Mini 4 pro? With Location changer I manage to only change the Bandwidth but still in CE mode

@sergiks Hi, quick question. In the browser hack it says not to update beyond 1.6.9 version of the DJI FLY, which only works on Android 10 and lower, are there any updates on that? Because i don't want to fly with my really old phone. Cheers, thanks for the hack all around, it works great

@popovluka hei, I don't think there will be any update since DJI learned about the backdoor and patched it in later versions.

@vescobg-a11y I am pretty sure the hack is NOT going to work with the mentioned equipment.