Hacking the BETAFPV P1 Air Unit: Hijacking Someone Else's Video Over a Digital Radio Link
A detailed write-up of the BETAFPV P1 Air Unit digital video transmitter has been published on Habr. The author explains that the FPV video market used to have only a handful of digital system makers, which you could count on one hand: DJI, Walksnail, HDZero and Siyi. Now BETAFPV, HGLRC and others have released their own systems, and enthusiasts quickly noticed that they all share the same boards with Artosyn chips.
Inside the P1 Air Unit there is an Artosyn AR9311 SoC running Linux 4.9 and BusyBox, while a separate AR8030 chip running FreeRTOS handles the radio link. The author found a UART with a root console, and the password turned out to be among a few context-based candidates. This is exactly the kind of case where the manufacturer apparently did not expect anyone to look inside.
The most interesting part comes next. Replacing the encoder stream as a whole did not work: the goggles can decode it, but not reliably. So the author used LD_PRELOAD to intercept the function that sends frames to the hardware H.265 encoder, swapping the pixels at the encoder input. As a result, the goggles show a foreign picture as if it came from the native camera. A curious detail is that the encoder compresses each 1080p frame in two independent strips (1920×560 and 1920×552), probably to keep latency low.
I think articles like this are useful even for people who just fly: they explain how the new, inexpensive digital systems are built and why they are so easy to research. Anyone interested in reverse engineering should read the full text.
Source: Habr
Inside the P1 Air Unit there is an Artosyn AR9311 SoC running Linux 4.9 and BusyBox, while a separate AR8030 chip running FreeRTOS handles the radio link. The author found a UART with a root console, and the password turned out to be among a few context-based candidates. This is exactly the kind of case where the manufacturer apparently did not expect anyone to look inside.
The most interesting part comes next. Replacing the encoder stream as a whole did not work: the goggles can decode it, but not reliably. So the author used LD_PRELOAD to intercept the function that sends frames to the hardware H.265 encoder, swapping the pixels at the encoder input. As a result, the goggles show a foreign picture as if it came from the native camera. A curious detail is that the encoder compresses each 1080p frame in two independent strips (1920×560 and 1920×552), probably to keep latency low.
I think articles like this are useful even for people who just fly: they explain how the new, inexpensive digital systems are built and why they are so easy to research. Anyone interested in reverse engineering should read the full text.
Source: Habr
Comments 0
Leave the first comment, in any language.
Log in to comment