Finally I got my hands on a Parrot AR.Drone! 299 Euros bought me a wifi-pilotable quadro-copter with linux inside. It is marketed as a drone which is controlled by an iPhone app. However there is a demo Android app (which i did not test, yet) and the control protocol is documented (plain old AT commands).

After making a few first flight attempts (using my brothers iPad) it was about time to take a closer look at the embedded linux stuff inside the drone. Not wanting to tear down the drone (yet!) and search for a serial interface, I decided to take a shot at the wifi.

The communication between the iP(ad|od|hone) app and the drone is carried out using an unencrypted adhoc wifi. What a great secure concept…. So, I hooked up an Asus wifi ap (running openwrt) to the adhoc wifi and gave nmap a try:

Interesting ports on 192.168.1.1:
Not shown: 65532 filtered ports
PORT STATE SERVICE
21/tcp open ftp
23/tcp open telnet
2049/tcp closed nfs
MAC Address: 00:26:7E:30:B5:C8 (Unknown)

Yep, it’s sporting an open telnet. And (you might already have guessed it) it drops you to a root shell without asking for a password. I am expecting to see a “Drone-be-gone” app in the appstore or market place very soon…
Probably all you need to do is to kill the closed source control binary named “programm.elf” or just type “reboot” if you see one of those drones fly by. And down it will go. Again, splendid security!

So, let’s have a looksy at the CPU:

Processor : ARM926EJ-S rev 5 (v5l)
BogoMIPS : 233.47
Features : swp half thumb fastmult edsp java
CPU implementer : 0×41
CPU architecture: 5TEJ
CPU variant : 0×0
CPU part : 0×926
CPU revision : 5
Cache type : write-back
Cache clean : cp15 c7 ops
Cache lockdown : format C
Cache format : Harvard
I size : 32768
I assoc : 4
I line length : 32
I sets : 256
D size : 16384
D assoc : 4
D line length : 32
D sets : 128

Hardware : Mykonos Parrot platform
Revision : 0904
Serial : 0000000000000000

and the 128 MB memory:

MemTotal: 126036 kB
MemFree: 105472 kB
Buffers: 0 kB
Cached: 3404 kB

The drone has an Atheros AR6000 wifi. Both cameras (front and bottom) are exposed ad V4L devices. And we are running a 2.6.27 kernel:

Linux myhost 2.6.27.47-parrot-01227-g93dde09 #1 PREEMPT Fri Jul 2 15:23:06 CEST 2010 armv5tejl GNU/Linux

So, it’s a great device for playing/hacking at a good price! But, the total lack of security (open wifi, open root shell) is really bad for a product that is pushed to average-joe consumers through major electronic retail stores!