Parrot Bebop 2 drone software analysis

Introduction

Parrot Bebop 2 is a drone released in 2016 from the company Parrot. It has a 1080p camera, weights 525 grams, has a built in GPS, ultrasonic sensors, visual positioning system and operates over a Wi-Fi connection. It’s quite an old drone, but it stil has a lot of potential. The manufacturer didn’t try to block consumers from modifying their software, which is unlike other companies, who hide what software the device is running under the hood. This drone has a community of people who research and modify the software of it.

It’s not a surprise that this drone is running Linux as it’s operating system that has some simillarites to Android. This drone is essentially a flying linux computer. Today I will analyse the drone’s software.

When you turn on the drone, it creates a Wi-Fi access point which you can connect to using your phone and control it with an Android app called FreeFlight Pro. The drone can also be controlled using a SkyController 1 & 2. The controller pairs to the drone and you connect the phone to the controller using a usb cable to view the video feed, information, etc.

Gaining shell access

I’m going to connect to the drone’s Wi-Fi access point with my computer and use nmap, a network scanner tool to scan for open ports.

After connecting to the drone’s Wi-Fi, running ifconfig in the terminal reveals that the drone assigned this IP address to my computer: 192.168.42.3

We can guess that the default gateway of the drone is 192.168.42.1. Now lets scan it with nmap and see which ports are open.

The drone has the ports 21, 23 and 9050 exposed. I’m interested in the port 23, which is telnet. Telnet is a terminal emulation that enables a user to connect to a remote host or device using a telnet client and send commands. Let’s try to connect to the drone’s shell using telnet.

The drone uses BusyBox that provides simple implementations of common Linux commands. Now that I connected to the drone’s shell using telnet, let’s research more about the OS it runs.

Analysing the system

Running cat /proc/version reveals that it’s running Linux with 3.4.11 kernel that was built in June 6, 2018.

Linux version 3.4.11+ (jenkins@9aee54538868) (gcc version 4.6.3 (Sourcery CodeBench Lite 2012.03-57) ) #1 SMP PREEMPT Wed Jun 6 12:02:19 UTC 2018

Now let’s see what hardware the drone uses by running the cat /proc/cpuinfo command.

Processor       : ARMv7 Processor rev 7 (v7l)
processor       : 0
BogoMIPS        : 1561.54

processor       : 1
BogoMIPS        : 1560.02

Features        : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x2
CPU part        : 0xc09
CPU revision    : 7

Hardware        : Milos board
Revision        : 0002
Serial          : 0000000000000000

Looks like it uses an Arm based processor, ARMv7

Running the cat /proc/partitions command we can see that it uses eMMC memory.

major minor  #blocks  name

 179        0    7634944 mmcblk0
 179       16       4096 mmcblk0boot1
 179        8       4096 mmcblk0boot0

By using the cat /proc/meminfo command, we can see the memory info.

MemTotal:         297016 kB
MemFree:          214036 kB
Buffers:            1476 kB
Cached:            19248 kB
SwapCached:            0 kB
Active:            36088 kB
Inactive:          12120 kB
Active(anon):      32960 kB
Inactive(anon):      924 kB
Active(file):       3128 kB
Inactive(file):    11196 kB
Unevictable:        5964 kB
Mlocked:            5972 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                12 kB
Writeback:             0 kB
AnonPages:         33472 kB
Mapped:            11596 kB
Shmem:               956 kB
Slab:               9824 kB
SReclaimable:       3816 kB
SUnreclaim:         6008 kB
KernelStack:         880 kB
PageTables:         1080 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:      267312 kB
Committed_AS:     102864 kB
VmallocTotal:     499712 kB
VmallocUsed:      224072 kB
VmallocChunk:     224248 kB

We can understand that in total the system has 297.016 Megabytes of memory.

Running the top command, we can see the current running processes and the load captured in this moment.

Let’s look at how many mounted filesystems the drone has with df command.

Filesystem           1K-blocks      Used Available Use% Mounted on
ubi1:system              43236     34912      6080  85% /
udev                    148420       792    147628   1% /dev
shm                     148508       132    148376   0% /dev/shm
tmp                     148508        32    148476   0% /tmp
ubi0:factory              4928       112      4532   2% /factory
ubi2:data                 9060       340      8220   4% /data
ubi2:update              28668        32     27140   0% /update
/dev/mmcblk0           7514984   6036972   1478012  80% /data/ftp/internal_000

The internal_000 folder contains drone’s flight data, logs and recordings/photos.

Let’s have a look at the binaries in /bin directory.

Bebop’s 2 drone flight control software is called dragon-prog. It exists in /usr/bin/dragon-prog. This program controls the drone’s flying.

If you would like to read more about modifying the drone’s software, you can find it here. The guide is for the Bebop (not Bebop 2), but since they are very simillar in software and hardware, it should also work on Bebop 2.

I also need to mention the micro USB port on the drone. It’s used for connecting the drone to the computer to transfer photos, videos or flight logs. However, this port also opens a possibility to connect other devices, like a 4G modem or other gadgets. I will cover that in the next post.

I hope you found that interesting, thanks for reading.