How to root your DJI Mavic Pro, Phantom 4 and Inspire 2 using DUMLRacer and completely remove NFZ

Here’s a two-part guide on how to “root” your DJI Mavic Pro, Phantom 4 and Inspire 2 drone and once done, how to then completely remove the built-in No Fly Zone (NFZ) database.

PART ONE - ROOTING YOUR DRONE

At this point I’ll hand you over to digdagt0 and another of his excellent videos. This explains how to root your drone. My explanation below is in case that video ever gets pulled.

You can ignore references to anti-rollback and firmwares, this is a multipurpose tool, but for this guide you simply need to know that you need root access before going any further :+1:

I performed this mod on my DJI Mavic Pro which is running the .700 firmware.

It’s quite straight forward and very low risk. Be sure to have a fully charged battery in your drone before you begin.

First up, before you do anything, you need to gain root access to your drone.

In order to do this you first need to download a tool called DUMLRacer:

{DOWNLOAD FROM THE MEMBERS ONLY CATEGORY}

DUMLRacer is a tool which exploits a bug in DJI firmware and allows you to gain root access to the underlying Android operating system and enable the Android Debug Bridge (ADB).

It’s a Java tool, so you’ll need Java installed. To find out if you have, open a Command Prompt (this guide assumes you’re running Windows) and type:

java -version

If you get a version number in response, you’re good to go. If Windows has no idea what you’re talking about, go grab Java from here, it’s free: https://java.com/en/download/

With Java confirmed and DUMLRacer downloaded you can now power on your aircraft, connect it to your computer and open DJI Assistant.

Check you can see your drone in Assistant, leave it open, then
bring up a command prompt and CD to the folder you placed the .JAR file in.

Type the following in to the command prompt:

java -jar DUMLRacer.jar AC

You’ll be asked which COM port you want to use and it recommends one for you. You MUST close DJI Assistant before entering the com port number.

At this point DUMLRacer will start talking directly to your drone and it will begin to try the exploits. This can take anything from two minutes to fifteen minutes. Mine took three attempts, the first one hung so I had to bomb out of it, the second one didn’t win, third time lucky for me.

You need to win both races for the exploit to stick.

That’s it, part one all done. You now (and forever more) have root access to your drone.

PART TWO - REMOVING NO FLY ZONES (NFZ) FROM YOUR AIRCRAFT

For this part, you’ll need to download the Android ADB Tools:

{DOWNLOAD FROM THE MEMBERS ONLY CATEGORY}

To see which version of the DJI Precise Fly Safe Database your aircraft has, go to the ‘About’ section in your GO4 app. You’ll see here mine was on v01.00.01.07:

The version number is irrelevant, I’m just showing you in the above pic how to check :slight_smile:

Power on your drone and connect via USB as normal.

Then open a command prompt and CD to your adb tools directory and type:

adb.exe shell

You should get a response along the lines of:

“root@wm220”

Now type the following:

mount -o remount,rw /amt
cd amt
rm -r nfz

That’s it, the entire NFZ database has now been removed from your drone.

Hang on though, DJI aren’t daft (well…), there’s a backup of the NFZ database which must also be removed, otherwise it’ll restore itself right back.

In your adb shell window, type:

cd ..
cd /data/upgrade/backups
ls

You’ll see a big long list of files now.

Look for a filename along the lines of:

wm220_0905_vXX.XX.XX.XX_XXXXXXXX.pro.fw.sig

The 0905 part is the import piece here, this is the module containing the NFZ database.

Once you’ve identified the file in question, type the following, replacing the X’s with your exact filename:

rm -r wm220_0905_vXX.XX.XX.XX_XXXXXXXX.pro.fw.sig

Then reboot the drone and got put the kettle on - you’re done :+1:

In order to confirm, simply go back to the About section of the GO4 app where you’ll be pleasantly greeted with a DJI Precise Fly Safe Database version of 00.00.00.00 :blush:

That’s it, the whole NFZ removal takes just a few minutes.

Be sure to have rooted your drone first.

NOTE 1 - If you install a firmware update after doing this mod you will undo all your hard work (and NFZs will be back on your drone in the blink of an eye)

NOTE 2 - Removing the NFZ database from your drone allows you to fly in certain places that DJI don’t want you flying in. It probably goes without saying, but I’ll give it a mention anyway: Don’t be a dick.

11 Likes

Awesome post.

Thanks for taking time mate.

I’m not really needing to remove Nfzs but like the idea of mixing modules of a new and old firmware to get the best of both worlds.

Going to look into this more. I’m guessing gaining root access will be part of the process so will give video a watch.

Cheers.

4 Likes

No problem!

I’m just trying to share all the knowledge I gain while modding with these fascinating devices and apps :smiley:

(app modding guide to follow soon, not got time to type it all up yet)

I live close to a football stadium - too bloody close thanks to DJI. Their bloody stupid circle shaped NFZs had me constantly having to jump through hoops just to take off from my house. It did my tree in :roll_eyes:

The NATS NFZs are really good, proper irregular polygons around the actual object / issue. No blanket radius NFZs like DJI do.

I can now fly in peace with no poxy warnings for stuff that’s about a mile away :+1:

For my MP, I went the Dumldore v3 roiute… back to 700, adjusted parameters for NFZ, then rolled forward using the modded 4.100 (DankDownloader).

A little less fiddly, I think. (That’s not a criticism … just a guesstimate.)

Also, digdat0’s new updated video for Dumldore v3 is really excellent and easy to follow (other than he talks fast) … covers the rolling back, parameter changes, and roll forward with mod 4.100

(Not that yours isn’t excellent. :stuck_out_tongue: )

The new vid …

Expect endless “hovering in my back garden (300m from internaltional airport runway) at minimum agl” pics/vids/panoramas/etc …
… or perhaps not. :smiling_imp:

(Sorry, @PingSpike … kind of not fully relevant to your post.)

1 Like

Dave, I rolled back to .700 using DUMLdore and dank downloader.

What is the modded 4.100 speak talk of?

1 Like

Brings all the features back to the official 4.100 without the AC modules, and hence you get all the features (panos, etc) but without overwriting the changed parameters and these can still be accessed and changed.
Not tried using the latest features since doing this. It was raining today. (I did hover to check I could. :stuck_out_tongue: )

Jump to 17:30 in that vid.

Awesome. So I don’t have to remove the modules myself.
They have created a firmware without them that can be flashed over .700.

Exactly what I’m looking for! Cheers

1 Like

Indeed - I can at least hover in the garden to check things, without having to walk >1km.

Yup. That was what convinced me to try it … wanted to keep Panos.
#I :heart: Panos

Wet tomorrow - until late - will check they work tomorrow evening.

2 Likes

So - one advantage of @PingSpike 's method above … because, afterwards, it doesn’t even know NFZs exist, you won’t get warnings that you are in one and your device telling you to land … with associated beeping. (Albeit my phone volume is normally near zero and won’t hear them … in this immediate post-firmware tinkering, I’m thinking I ought to hear them. :stuck_out_tongue: )

Indeed :smiley:

thank you for sharing this with us

You’re welcome :smiley:

1 Like

please can you help me , when i try with adb.exe shell command it tell me no device find

I’m sorry mate, not sure I can help with connectivity issues.

Perhaps take a look at this one:

Is there anyone local to Staffordshire that can help with modding my pro ? Not confident and don’t want to brick it.

Not local, but in my experience in modding many things, Iphones/Playstations/enigma boxes (TV) never bricked one yet… ( not saying it cant happen tho…) if not confident, go down the route of No Limitz drones, it does all the hard work for you… Might not do it all, but its pretty much a 1 click, modding solution… if you follow @PingSpike guide, and watch the video a couple of times, its fairly straightforward. which i know is very daunting to those who are not too tech savvy… And if you do, always test flight first local to take off point…, then venture further… It probably could be done remotely via “Anydesk” a Remote access prog) i do a lot of TV boxes that way… hope this helps…

1 Like

Hey! I just did this and the files is deleted… But now it says theres a version module mismatch (Duh) and wont fly… any ideas?

you get sorted? not sure of the mismatch error, but try a factory reset, and start again,

1 Like

Sadly no. Getting the same error, they mustve updated it. Additionally I tried to modify the DB file by removing it, editing the gps locations on the file, then putting it back on the drone and it was able to tell it had been edited and once again forced me to update it :frowning: