Hack into the DJI Robomaster S1 Battle Bot in 5 Minutes — Collabnix

Hack into the DJI Robomaster S1 Battle Bot in 5 Minutes — Collabnix

Play this article

When I saw the RoboMaster S1 for the first time, I was completely stoked. I was impressed by its sturdy look. It’s a powerful hefty drone weighing around 7 pounds and feels like a heavy tank. T he DJI Robomaster S1 is undoubtedly one of the most complex battling robot that you can build yourself and control with your smartphone. You can install a special app to play games, drive around, and even shoot small water-based pellets at targets or other RoboMaster flawlessly.

Everything about the S1 is extremely sturdy and well-built. It’s mostly heavy-duty plastic. The DJI RoboMaster S1 arrives completely disassembled requiring you to build it from the ground up using the 46 customizable components that make up the unit. It displays AI technology in six cool ways, including: line recognition, vision marker recognition, people recognition, clap recognition, gesture recognition, and S1 recognition. Line recognition allows users to program the S1 to cruise along a line placed on the ground. AI technology lets the S1 recognize gestures, sounds, and even other S1 robots. Working with the RoboMaster S1 opens the doorway to AI learning, giving you a practical introduction to the technologies of tomorrow.

In my previous blog post, I showed how to assemble Robomaster S1 for the first time. I also showed how to connect to Robomaster via Python and Scratch programming language. In this blog post, I will show you how to hack into Robomaster S1 bot in easy steps. Let’s get started -

What do you need?

Clone the repository

git clone [https://github.com/collabnix/robomaster](https://github.com/collabnix/robomaster)
  • Unzip the Android SDK Platform‐Tools somewhere in your system
  • Use the Intelligent Controller Micro USB Port and connect the S1 to your computer.
  • Start the Robomaster S1 application. Go to the Lab, create a new Python application and paste the following code:
def root_me(module): __import__=rm_log.__dict__['__builtins__']['__import__'] return __import__(module,globals(),locals(),[],0) builtins=root_me('builtins') subprocess=root_me('subprocess') proc=subprocess.Popen('/system/bin/adb_en.sh',shell=True,executable=' /system/bin/sh',stdout=subprocess.PIPE,stderr=subprocess.PIPE)
  • Ensure that you run the Code within the S1 Lab. If you followed the steps correctly there should be no compilation errors. The Console will show: Execution Complete
  • Ensure that you don’t close the S1 Application! Open an Explorer window and go to the directory which holds the earlier extracted Android Platform Tools. Open a PowerShell in this directory (Shift + Right‐Click)
  • It’s time to run the ADP command to list the devices:
.\adb.exe devices

You should see something like this:

.\adb.exe shell

DJI Specific Commands

dji dji_amt_board dji_derivekey dji_monitor dji_verify dji_blackbox dji_hdvt_uav dji_net.sh dji_vision dji_camera dji_log_control.sh dji_network dji_chkotp dji_mb_ctrl dji_sw_uav dji_cpuburn dji_mb_parser dji_sys

Checking IP address

ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet scope host lo valid_lft forever preferred_lft forever 8: rndis0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 0a:f8:f6:bb:55:64 brd ff:ff:ff:ff:ff:ff inet brd scope global rndis0 valid_lft forever preferred_lft forever 9: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 60:60:1f:cd:95:f7 brd ff:ff:ff:ff:ff:ff inet brd scope global wlan0 valid_lft forever preferred_lft forever

Checking the type of Hunter.py file

./hunter.py vision_ctrl.enable_detection(rm_define.vision_detection_marker)

Checking Memory Stats

127|root@xw607_dz_ap0002_v4:/system/bin # cat /proc/meminfo
MemTotal: 271708 kB
MemFree: 59076 kB
Buffers: 18700 kB
Cached: 94776 kB
SwapCached: 0 kB
Active: 117648 kB
Inactive: 58020 kB
Active(anon): 62724 kB
Inactive(anon): 136 kB
Active(file): 54924 kB
Inactive(file): 57884 kB
Unevictable: 500 kB
Mlocked: 0 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 271708 kB
LowFree: 59076 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 36 kB
Writeback: 0 kB
AnonPages: 62696 kB
Mapped: 12308 kB
Shmem: 176 kB
Slab: 12712 kB
SReclaimable: 6248 kB
SUnreclaim: 6464 kB
KernelStack: 2152 kB
PageTables: 1300 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 135852 kB
Committed_AS: 341612 kB
VmallocTotal: 745472 kB
VmallocUsed: 153220 kB
VmallocChunk: 432132 kB

Top Command

oot@xw607_dz_ap0002_v4:/system/bin # top
User 8%, System 13%, IOW 0%, IRQ 0% User 126 + Nice 0 + Sys 203 + Idle 1138 + IOW 2 + IRQ 0 + SIRQ 1 = 1470 PID PR CPU% S #THR VSS RSS PCY UID Name 14020 1 3% S 28 146468K 8588K fg root /system/bin/dji_camera 247 3 3% S 24 213128K 14876K fg root /system/bin/dji_vision 483 1 2% S 8 112412K 11072K unk root /data/python_files/bin/python 233 1 2% S 22 44460K 5232K fg root /system/bin/dji_hdvt_uav 239 0 1% S 15 31368K 4464K fg root /system/bin/dji_sw_uav 237 0 0% S 13 24208K 4092K fg root /system/bin/dji_network 41 0 0% S 1 0K 0K fg root kworker/0:1 245 1 0% S 6 31904K 20492K fg root /system/bin/dji_blackbox 69 1 0% S 1 0K 0K fg root mmcqd/0 243 1 0% S 27 50832K 9300K fg root /system/bin/dji_sys


Originally published at collabnix.com on September 3, 2021.

Did you find this article valuable?

Support Collabnix by becoming a sponsor. Any amount is appreciated!