Proposal for Reverse Engineering Forum

[Wildseyed]

Given that the X-Star is now a legacy product, with no SDK, and no new cameras, is there anyone here that would be interested in exploring the exposed interfaces and hardware for the benefit of all X-Star owners?

There are several topics that I have already ventured into:
1. Battery Teardown/Rebuild/Repurpose. If I cannot get cell replacements, I can harvest the connector for bench power to the drone.
2. NuttShell (nsh) console supported commands. If you plug the drone to PC via usb, you can use a terminal emulator like PUTTY to access the command console of the drone. Baud rate is 115200.
3. Gimbal interface plate Pinout. If we can sniff out the signals, itmay be possible to integrate other cameras.
4. Firmware extraction and decompiling. I have already been able to extract the contents of the BIN file, but there is a single .zlib bundle in there. I have not found the right way to inflate this into individual files yet.
5. Brain Surgery. If all else fails, stick a NAVIO2 in the body, and convert to use standard LiPo batteries.

 

[Quadrotor]

Given that the X-Star is now a legacy product, with no SDK, and no new cameras, is there anyone here that would be interested in exploring the exposed interfaces and hardware for the benefit of all X-Star owners?

There are several topics that I have already ventured into:
1. Battery Teardown/Rebuild/Repurpose. If I cannot get cell replacements, I can harvest the connector for bench power to the drone.
2. NuttShell (nsh) console supported commands. If you plug the drone to PC via usb, you can use a terminal emulator like PUTTY to access the command console of the drone. Baud rate is 115200.
3. Gimbal interface plate Pinout. If we can sniff out the signals, itmay be possible to integrate other cameras.
4. Firmware extraction and decompiling. I have already been able to extract the contents of the BIN file, but there is a single .zlib bundle in there. I have not found the right way to inflate this into individual files yet.
5. Brain Surgery. If all else fails, stick a NAVIO2 in the body, and convert to use standard LiPo batteries.

I am very interested in this, but don't want to engage in potentially damaging experimentation until such time as a needed replacement part is not available at a reasonable price.

Battery rebuilding seems like a reasonable prospect. I don't think old X-Star batteries should be discarded, because the internal electronics will generally still be in good working order and the odds are good that compatible replacement cells are available somewhere.

As to the .zlib, have you looked at the 'DICTID' specified in RFC 1950 RFC 1950 - ZLIB Compressed Data Format Specification version 3.3 to learn the compression method and flags?

 

[yrless]

I've been pondering this myself for months......I'm most interested in a firmware re-write as I believe the hardware is pretty stellar (especially compared to DJI stuff)......do we know if the XSP is Pixhawk-driven?

I would propose stripping down the code to achieve the best flight and camera control characteristics.....discard consumer-oriented features like auto-land, etc and just concentrate on creating a great flying machine with precision gimbal control. The fw we have today tries to do too much with mediocre results all around...shows lack of development resources.

 

[Wildseyed]

Is there any indication that the firmware is based on Pixhawk? That would make things a lot easier. Last time I had the case apart I should have take pictures of all the boards and chips. It is very likely that Autel didn't completely reinvent the wheel, but to what degree is not yet clear. If they did use pixhawk code, They should be compelled to release the sources, or be in violation of some open source license. Isn't Pixhawk based on ArduPilot?

 

[arto.inetco]

I remember reading somewhere on this forum, that the Pix4 Pro was the FC in the XSP...
I agree autel should provide the pinout for the gimbal...
I will be watching and provide any info I can...
arto

 

[Wildseyed]

Here is some useful information from Muhammad Al-Rawi detailing a partial teardown of an X-Star Premium. One bit that I found particularly interesting is his observation that the camera gimbal is most likely using USB for camera communications, and CAN, or some other bus for gimbal control. Six of the pads are for power and ground.

(Partial) Teardown: Autel X-Star Premium

 

[Wildseyed]

Here is evidence in support of the PX4 link to X-Star flight control. The X-Star Log Viewer was created using Mission Planner source code, which means internally the X-Star is probably making use of MAVLINK. The software developer highlights the protocol differences between PX4 and XSP in orange.

Docs

 

[yrless]

He has an interesting observation about a possible CanBus communication link....Autel is after all the king of inexpensive CanBus ODBII readers.
Unfortunately there's no smoking gun in his pictures that would point to a stock Pixhawk board but its kinda neat that he took the time to document his travails.
The one thing I can tell you about the 900MHz video system is that its a standard 6MHz video channel...I verified that a while back with my SDR spectrum analyzer so at least one major component is known to be plain vanilla......eat the elephant in small bites

 

[yrless]

Here is evidence in support of the PX4 link to X-Star flight control. The X-Star Log Viewer was created using Mission Planner source code, which means internally the X-Star is probably making use of MAVLINK. The software developer hiesyghlights the protocol differences between PX4 and XSP in orange.

Docs

.....yes...totally agree here....I've pulled the log files apart in detail and actually use them for post-processing...they are in fact mavlink based although the format in V2 firmware has been changed to obscure this fact.

 

[yrless]

We closed the thread a while back but if you have a few minutes you can read through the stuff that we did concerning V2 log files:

Program no longer reads the log files with the new Beta Firmware. · Issue #6 · tomSny/XStarLogViewer · GitHub

My alias is the same as here...yrless.
At the bottom of the thread you can see that we sorted it all out.

 

[Wildseyed]

PX4 lineage is confirmed. If you connect a USB cable to the front of the bird, Windows will detect a serial USB device. Using PUTTY, you can access this serial console at 115200 baud. Just like PX4, the X-Star is running NuttX OS. Only a subset of commands are supported, but you can type:

nsh> top

and get a listing of the process currently running. MAVLIK is there. UAVCAN is also there. Other commands that might be useful:
perf
echo
set
rgbled
mh
sh
sleep
test
usleep
sercon
bl_update
boardinfo
hil
mixer
nshterm
pwm

These are the ones I could find. There are more.

 

[Wildseyed]

He has an interesting observation about a possible CanBus communication link....Autel is after all the king of inexpensive CanBus ODBII readers.
Unfortunately there's no smoking gun in his pictures that would point to a stock Pixhawk board but its kinda neat that he took the time to document his travails.
The one thing I can tell you about the 900MHz video system is that its a standard 6MHz video channel...I verified that a while back with my SDR spectrum analyzer so at least one major component is known to be plain vanilla......eat the elephant in small bites

Let me clarify that PX4 is autopilot software. It runs on both 8-bit and 32-bit micros, on several hardware platforms, so you should not expect to see anything like a Pixhawk (hardware) inside the X-Star.
As for the video feed, I will look into getting one of those USB receivers, and see if the video signal is in fact viewable.

 

[yrless]

Let me clarify that PX4 is autopilot software. It runs on both 8-bit and 32-bit micros, on several hardware platforms, so you should not expect to see anything like a Pixhawk (hardware) inside the X-Star.
As for the video feed, I will look into getting one of those USB receivers, and see if the video signal is in fact viewable.

Understood....I was just curious to see how off-the-shelf they may have gone in development...would have been a hoot to see a pixhawk board in there. After I get some work items out of the way I'll upload a screen grab of the 900 mhz waveform.

 

[yrless]

PX4 lineage is confirmed. If you connect a USB cable to the front of the bird, Windows will detect a serial USB device. Using PUTTY, you can access this serial console at 115200 baud. Just like PX4, the X-Star is running NuttX OS. Only a subset of commands are supported, but you can type:

nsh> top

and get a listing of the process currently running. MAVLIK is there. UAVCAN is also there. Other commands that might be useful:
perf
echo
set
rgbled
mh
sh
sleep
test
usleep
sercon
bl_update
boardinfo
hil
mixer
nshterm
pwm

These are the ones I could find. There are more.

Wow, holy crap...I just re-read your comments......do you think it would respond to Ground Control Station??

 

[yrless]

Here's a shot of the 900MHz video signal....unfortunately the SDR doesn't give me a terribly wide view bandwidth but its 6 MHz wide if you manually scroll up to the end point of the signal.....definitely digital in nature.

 

[Jagerbomb52]

RC Groups - View Single Post - Autel Robotics EVO

 

[Trainmaster]

Wildseyed is on to something here. I've long been surprised that more reverse engineering had not been done by Autel buyers. This, and the lack of replacement parts were my apprehensions when choosing a drone. Unfortunately, Autel has dumped the platform after I'm in for a grand. But I have a life full of old stuff that I maintain, refurbish and keep going. I don't know much about the software that keeps these things in the air, but I'm able to learn and look forward to reading more about the XSP's working as you guys get deeper into it...

 

[Wildseyed]

Here is the link to information on how the Autel Robotics XSP firmware is updated. I still have not figure out how to inflate the extracted BIN file. I did have partial sucess with the binwalk utility, which extracted the BIN file into something recognizable; a .zlib package. I've tried several approaches, but I think I need to compile openssl with zlib support first. In any case, if anyone has skills, please jump in.

6. Application level functions - UAVCAN

 

[Wildseyed]

FCC ID 2AGNTAC5809A X-Star Series by Autel Robotics Co., Ltd.

Some FCC application links

 

[Wildseyed]

Graphical interface for exploring UAVCAN bus.

Overview - UAVCAN

This might work over the usb connector, but I can't be sure yet. For sure there must be an access point to the CAN Bus somewhere on the main board. Next time I have the case open, I will need to take a close look at the silkscreen and pads.