Bebop 2 macmode brick

[xBoggyBx]

Hello,

Apologies if this is the wrong place to post.

So I’ve soft-bricked my Bebop 2 by enabling MAC filtering in /sbin/broadcom_setup.sh, then commented out the filter but forgot to comment out macmode 2.

I have a UART connector and can view the boot sequence. All looks fine.

Any idea how I can recover it?

.Booting in mode NAND
jumping to 0x00100000 len 46000
ðnand_flash: Toshiba 2048 bytes per page, 1 Gbits (x8), 1.8V, timing ONFI 4
Parrotboot for target MILOS, git version ecos-bootloader-p7-start-343-gb32f66c, built on Dec 14 2015

P7R4
P7MU Revision 2
Crystal Frequency: 26000000 Hz
RAM config name: Milos - Dual NT5CC128M16CP-DI - CL11, CWL8 @750MHz 750 Mhz
Milos rev: 3

but 0
Scaning start 8M (size 16M), page shift 11 eb size 131072
vid_hdr_offset 2048, data_offset 4096 leb_size 126976
image_seq is 68d9e15d
new volume 4
new volume 0
nand_flash: I/O error
skipping bad block 5888
new volume 1
nand_flash: I/O error
skipping bad block 7424
parsed 8192 pages
vol0 : main_boot 29/67 ebs
vol1 : alt_boot 36/53 ebs
volume 0 : "main_boot" ok (3682304)
Attempt booting on UBI volume with ID 0...
plf: loading E_TEXT section to addr 0x82000000 size 3661248... done.
plf: loading U_BOOTLOADER section to addr 0x80700000 size 208... done.
Booting Linux...' boxinit.serialno=P742PB2K170000C0D270  calib=0x001C003A mtdparts=nand0:8M(Pbootloader),16M(Pmain_boot),8M(Pfactory),50M(Psystem),46M(Pupdate) console=ttyPA0,115200 loglevel=8 ubi.mtd=Pfactory ubi.mtd=Psystem ubi.mtd=Pupdate root=ubi1:system rootfstype=ubifs quiet androidboot.bootloader=ecos-bootloader-p7-start-343-gb32f66c '
boxinit: starting 'rcs-init'
boxinit: starting 'shpoison'
boxinit: starting 'udevd'
boxinit: starting 'jubamountd'
boxinit: starting 'flash_bldc'
boxinit: property 'persist.debuggable' doesn't exist while expanding '${persist.debuggable}'
boxinit: cannot expand '${persist.debuggable}'
boxinit: skipping command 'setprop'
boxinit: starting 'crashdumpd'
boxinit: starting 'ledd'
boxinit: starting 'kmsgd'
boxinit: starting 'flird'
boxinit: process 'flash_bldc', pid 82 exited
boxinit: starting 'dnsmasq_eth0'
boxinit: starting 'bcmlogd'
boxinit: starting 'ptpd'
boxinit: starting 'fvt6'
boxinit: starting 'macgyverd'
boxinit: starting 'inetd'
boxinit: starting 'avahi-daemon'
[FIRMWARE UPDATER] Boot # : Scanning /update for updates ...
[FIRMWARE UPDATER] Boot # :  searching PLF file named *.plf...
[FIRMWARE UPDATER] Boot # : Scanning /data/ftp/internal_000 for updates ...
[FIRMWARE UPDATER] Boot # :  searching PLF file named *.plf...
boxinit: starting 'publisherd'
boxinit: process 'rcs-init', pid 54 exited
boxinit: untracked pid 1176 'find' exited
boxinit: process 'fvt6', pid 471 exited
boxinit: starting 'running_mode'
boxinit: process 'running_mode', pid 1298 exited

[anafifan]

Use telnet over USB (with cord) to access system.

[xBoggyBx]

Thanks for the reply. Do you have any experience with this and care to elaborate?

When I start telnetd on the drone (via 4 short-presses), the USB connection presents as an RNDIS device in Windows, though I was not able to find any RNDIS/USB ethernet drivers that could properly enable any IP stack for it in Windows 10/11. I gave that up and didn’t attempt on a Linux system.

Instead I focused on the stock firmware installation process since I could see it testing for firmware on boot. Without access to /bin/updater/dgwl.txt I couldn’t configure it to reinstall the latest firmware, and attempts to fake a newer version in existing firmwares failed due, I assume, to hash checks as it always considered them corrupt and skipped them.

It is configured out of the box to allow downgrade to 0.0.0 and 3.3.x per dgwl.txt. I finally located a 3.3 firmware online, loaded it to a thumbdrive, plugged it into the drone’s USB port, and it downgraded on boot. Then I upgraded it back to 4.7.1 via the app.

Going forward the first thing I’ll do is add 4.7.1 to dgwl.txt so I can reinstall the latest firmware via USB if I brick it again.