Capture packets from OcuSync 2.0

[robinlegrand]

Hi, for a project I want to see how the OcuSync 2.0 could work for my DJI drone mini 2. I want to do some reverse engineering but I don't find any documentations to record the packet, so you think that it's possible to perform this ?

And if you have a solution, it will be a plesure to learn something.

Have a nice day,
Robin

[mefistotelis]

The Wireshark dissectors currently support analyzing packets sent over UART, Ethernet/Wifi and USB.
For easy route, sniff a link using one of these.

The Occusync, like Wifi, USB etc., is just a wrapper protocol for DUML packets.
Occusync uses LTE transceivers built into a SoC, so there's no way to physically tap to the line with packets. Sniffing the transmission would require software solution - logging to the SoC console and enabling capture there. When rooted, you have access to all the relevant interfaces.

But there could be a simpler way, depending on what you want to achieve- some DUML packets are likely routed to interfaces outside of the chip - this is how DJI Assistant software works. As first try, you may want to sniff and analyze this communication.

[robinlegrand]

Thank you for your prompt response, by the way my final goal on this project is to take control of the drone by hacking it. But for now I just try to understand how everything works and how to perform this with a wireless connection. And if I don't succeed I will work on the capture and the exploitation of the DroneID.

I will keep update the community if I find something interesting !

[Miljoenen]

Holy thread resurrection, Batman!

How'd you get along, @robinlegrand, did you manage to hack any drones?