X5R SSD Info

damoncooper · May 2, 2016

A thread for gathering together of information about what the DJI X5R SSD is made of, how it's constructed, how it's formatted, etc. It's inevitable the conversation will swing to the "WTF" commentary about why it costs $1,500.00, but I'd like to try to keep this thread on the "what" and "how": and leave the "why" to other places.

InterMurph · May 2, 2016

Pure speculation, until I get another SSD to hack around with: each SSD is cryptographically signed, using the drive's serial number. It will be tricky to hack, but it can be done.

damoncooper · May 2, 2016

How the drive appears on a Mac system:

The SSD drive mounts as:

And has one visible user-accessible 533MB partition formatted as FAT named "DJI" in the 512GB device and it appears as a normal disk drive:

The "DJI" drive contains the following content:

damoncooper · May 2, 2016

The CineLight app when running and accessing the drive maintains the following open files and ports:

/
/Applications/CineLight.app/Contents/MacOS/CineLight
/Applications/CineLight.app/Contents/Frameworks/libVideoEncoder.dylib
/Applications/CineLight.app/Contents/Frameworks/libDngSDK.dylib
/usr/share/icu/icudt55l.dat
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/SystemAppearance.car
/private/var/folders/_z/sftsdr5n4wjbndrm8ztyrgkh0000gp/0/com.apple.LaunchServices-134502.csstore
/Applications/CineLight.app/Contents/Resources/ToolbarImportTemplate.png
/System/Library/Fonts/SFNSText-Regular.otf
/System/Library/Fonts/SFNSDisplay-Regular.otf
/Applications/CineLight.app/Contents/Resources/ToolbarEditTemplate.png
/Applications/CineLight.app/Contents/Resources/ToolbarExportTemplate.png
/Applications/CineLight.app/Contents/Resources/ToolbarLayoutLeftTemplate.png
/Applications/CineLight.app/Contents/Resources/ToolbarLayoutBottomTemplate.png
/Applications/CineLight.app/Contents/Resources/ToolbarLayoutRightTemplate.png
/Applications/CineLight.app/Contents/Resources/ToolbarDardThemeTemplate.tiff
/Applications/CineLight.app/Contents/Resources/ToolbarLightThemeTemplate.tiff
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/VibrantLightAppearance.car
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/Extras2.rsrc
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/Assets.car
/private/var/db/mds/system/mdsDirectory.db
/System/Library/Frameworks/Security.framework/Versions/A/PlugIns/csparser.bundle/Contents/MacOS/csparser
/Applications/CineLight.app/Contents/Resources/IconEditTemplate.tiff
/Applications/CineLight.app/Contents/Resources/IconCurveTemplate.tiff
/Applications/CineLight.app/Contents/Resources/IconDetailsTemplate.tiff
/Applications/CineLight.app/Contents/Resources/IconDngTemplate.tiff
/Applications/CineLight.app/Contents/Resources/IconInfoTemplate.tiff
/Applications/CineLight.app/Contents/Resources/IconCameraTemplate.tiff
/Applications/CineLight.app/Contents/Resources/IconVectorScopeTemplate.tiff
/Applications/CineLight.app/Contents/Resources/IconParadeTemplate.tiff
/Applications/CineLight.app/Contents/Resources/IconShareTemplate.tiff
/System/Library/Extensions/AppleIntelHD5000GraphicsGLDriver.bundle/Contents/MacOS/AppleIntelHD5000GraphicsGLDriver
/Applications/CineLight.app/Contents/Resources/IconZoomOutTemplate.tiff
/Applications/CineLight.app/Contents/Resources/IconZoomInTemplate.tiff
/Applications/CineLight.app/Contents/Resources/IconFitTemplate.png
/Applications/CineLight.app/Contents/Resources/IconPointerTemplate.tiff
/System/Library/Fonts/Helvetica.dfont
/Applications/CineLight.app/Contents/Resources/IconMoveTemplate.tiff
/System/Library/Fonts/SFNSText-Bold.otf
/System/Library/Fonts/SFNSDisplay-Bold.otf
/System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Resources/AppleKeyboardLayouts-L.dat
/System/Library/Caches/com.apple.IntlDataCache.le.kbdx
/private/var/db/mds/messages/se_SecurityMessages
/Applications/CineLight.app/Contents/Resources/IconFilm.tiff
/Applications/CineLight.app/Contents/Resources/DiskIconTemplate.png
/System/Library/Fonts/HelveticaNeueDeskInterface.ttc
/Applications/CineLight.app/Contents/Resources/LibraryIconTemplate.png
/Applications/CineLight.app/Contents/Resources/VideoPreviousTemplate.png
/Applications/CineLight.app/Contents/Resources/VideoPlayTemplate.png
/Applications/CineLight.app/Contents/Resources/VideoPauseTemplate.png
/Applications/CineLight.app/Contents/Resources/VideoNextTemplate.png
/System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/Resources/ArtFile.bin
/Library/Fonts/Courier New.ttf
/System/Library/Extensions/GeForceMTLDriver.bundle/Contents/MacOS/GeForceMTLDriver
/System/Library/Extensions/AppleIntelHD5000GraphicsMTLDriver.bundle/Contents/MacOS/AppleIntelHD5000GraphicsMTLDriver
/Applications/CineLight.app/Contents/Resources/VectorScope.tiff
/Library/Keychains/System.keychain
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/DarkAppearance.car
/System/Library/Keychains/SystemRootCertificates.keychain
/usr/lib/dyld
/private/var/db/dyld/dyld_shared_cache_x86_64h
/dev/null
/dev/null
/dev/null
count=2, state=0x12
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/SystemAppearance.car
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/VibrantLightAppearance.car
/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/Extras2.rsrc
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/Assets.car
/private/var/folders/_z/sftsdr5n4wjbndrm8ztyrgkh0000gp/C/com.nvidia.OpenGL/0206BA56-8CA6-33DD-B67D-48E5B0AD1CD5/5D60E93C5F275D42/5CBDE339-F195-3B1B-88AD-3AFA7F98F3E0.toc
/private/var/folders/_z/sftsdr5n4wjbndrm8ztyrgkh0000gp/C/com.nvidia.OpenGL/0206BA56-8CA6-33DD-B67D-48E5B0AD1CD5/5D60E93C5F275D42/5CBDE339-F195-3B1B-88AD-3AFA7F98F3E0.bin
/System/Library/CoreServices/SystemAppearance.bundle/Contents/Resources/DarkAppearance.car
FNetwork.defaultStorageSession
/dev/random
->0x756b37922ab1b1ab
->0x756b3792370d465b
/Users/dcooper/Library/Saved Application State/com.dji.CineLight.savedState/data.data
/Users/dcooper/Library/Saved Application State/com.dji.CineLight.savedState/windows.plist
/Users/dcooper/Library/Saved Application State/com.dji.CineLight.savedState/window_1.data
/Users/dcooper/Library/Saved Application State/com.dji.CineLight.savedState/window_2.data

damoncooper · May 2, 2016

Sampling the CineLight process in the Activity Monitor reveals the following thread call graphs. (Full extract attached)

Code:

Sampling process 1608 for 3 seconds with 1 millisecond of run time between samples
Sampling completed, processing symbols...
Analysis of sampling CineLight (pid 1608) every 1 millisecond
Process:         CineLight [1608]
Path:            /Applications/CineLight.app/Contents/MacOS/CineLight
Load Address:    0x108314000
Identifier:      com.dji.CineLight
Version:         0.9.17 (0.9.17)
Code Type:       X86-64
Parent Process:  ??? [1]

Date/Time:       2016-05-02 08:32:02.078 -0400
Launch Time:     2016-05-01 13:52:32.290 -0400
OS Version:      Mac OS X 10.11.4 (15E65)
Report Version:  7
Analysis Tool:   /usr/bin/sample
----

Call graph:
    2898 Thread_224632   DispatchQueue_1: com.apple.main-thread  (serial)
    + 2898 start  (in libdyld.dylib) + 1  [0x7fff980465ad]
    +   2898 NSApplicationMain  (in AppKit) + 1176  [0x7fff8f74f46c]
    +     2898 -[NSApplication run]  (in AppKit) + 682  [0x7fff8f785e84]
    +       2898 -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:]  (in AppKit) + 454  [0x7fff8f79132a]
    +         2898 _DPSNextEvent  (in AppKit) + 1067  [0x7fff8f791efa]
    +           2898 _BlockUntilNextEventMatchingListInModeWithFilter  (in HIToolbox) + 71  [0x7fff9a3c65af]
    +             2898 ReceiveNextEventCommon  (in HIToolbox) + 432  [0x7fff9a3c676f]
    +               2898 RunCurrentEventLoopInMode  (in HIToolbox) + 235  [0x7fff9a3c6935]
    +                 2898 CFRunLoopRunSpecific  (in CoreFoundation) + 296  [0x7fff987a1ed8]
    +                   2898 __CFRunLoopRun  (in CoreFoundation) + 1356  [0x7fff987a268c]
    +                     2898 __CFRunLoopServiceMachPort  (in CoreFoundation) + 212  [0x7fff987a31c4]
    +                       2898 mach_msg  (in libsystem_kernel.dylib) + 55  [0x7fff8bd573b3]
    +                         2898 mach_msg_trap  (in libsystem_kernel.dylib) + 10  [0x7fff8bd57f72]
    2898 Thread_224643   DispatchQueue_2: com.apple.libdispatch-manager  (serial)
    + 2898 _dispatch_mgr_thread  (in libdispatch.dylib) + 52  [0x7fff95bb7dcd]
    +   2898 _dispatch_mgr_invoke  (in libdispatch.dylib) + 216  [0x7fff95bb8165]
    +     2898 kevent_qos  (in libsystem_kernel.dylib) + 10  [0x7fff8bd5eefa]
    2898 Thread_224868: com.apple.NSEventThread
    + 2898 thread_start  (in libsystem_pthread.dylib) + 13  [0x7fff8eced351]
    +   2898 _pthread_start  (in libsystem_pthread.dylib) + 168  [0x7fff8ecef91a]
    +     2898 _pthread_body  (in libsystem_pthread.dylib) + 131  [0x7fff8ecef99d]
    +       2898 _NSEventThread  (in AppKit) + 149  [0x7fff8f8e7e99]
    +         2898 CFRunLoopRunSpecific  (in CoreFoundation) + 296  [0x7fff987a1ed8]
    +           2898 __CFRunLoopRun  (in CoreFoundation) + 1356  [0x7fff987a268c]
    +             2898 __CFRunLoopServiceMachPort  (in CoreFoundation) + 212  [0x7fff987a31c4]
    +               2898 mach_msg  (in libsystem_kernel.dylib) + 55  [0x7fff8bd573b3]
    +                 2898 mach_msg_trap  (in libsystem_kernel.dylib) + 10  [0x7fff8bd57f72]
    2898 Thread_224869: AFNetworking
    + 2898 thread_start  (in libsystem_pthread.dylib) + 13  [0x7fff8eced351]
    +   2898 _pthread_start  (in libsystem_pthread.dylib) + 168  [0x7fff8ecef91a]
    +     2898 _pthread_body  (in libsystem_pthread.dylib) + 131  [0x7fff8ecef99d]
    +       2898 __NSThread__start__  (in Foundation) + 1351  [0x7fff8d858d64]
    +         2898 +[AFURLConnectionOperation networkRequestThreadEntryPoint:]  (in CineLight) + 204  [0x108333f1c]
    +           2898 -[NSRunLoop(NSRunLoop) run]  (in Foundation) + 74  [0x7fff8d847cb8]
    +             2898 -[NSRunLoop(NSRunLoop) runMode:beforeDate:]  (in Foundation) + 270  [0x7fff8d847dd9]
    +               2898 CFRunLoopRunSpecific  (in CoreFoundation) + 296  [0x7fff987a1ed8]
    +                 2898 __CFRunLoopRun  (in CoreFoundation) + 1356  [0x7fff987a268c]
    +                   2898 __CFRunLoopServiceMachPort  (in CoreFoundation) + 212  [0x7fff987a31c4]
    +                     2898 mach_msg  (in libsystem_kernel.dylib) + 55  [0x7fff8bd573b3]
    +                       2898 mach_msg_trap  (in libsystem_kernel.dylib) + 10  [0x7fff8bd57f72]
    2898 Thread_224872: com.apple.NSURLConnectionLoader
    + 2898 thread_start  (in libsystem_pthread.dylib) + 13  [0x7fff8eced351]
    +   2898 _pthread_start  (in libsystem_pthread.dylib) + 168  [0x7fff8ecef91a]
    +     2898 _pthread_body  (in libsystem_pthread.dylib) + 131  [0x7fff8ecef99d]
    +       2898 __NSThread__start__  (in Foundation) + 1351  [0x7fff8d858d64]
    +         2898 +[NSURLConnection(Loader) _resourceLoadLoop:]  (in CFNetwork) + 412  [0x7fff91f71111]
    +           2898 CFRunLoopRunSpecific  (in CoreFoundation) + 296  [0x7fff987a1ed8]
    +             2898 __CFRunLoopRun  (in CoreFoundation) + 1356  [0x7fff987a268c]
    +               2898 __CFRunLoopServiceMachPort  (in CoreFoundation) + 212  [0x7fff987a31c4]
    +                 2898 mach_msg  (in libsystem_kernel.dylib) + 55  [0x7fff8bd573b3]
    +                   2898 mach_msg_trap  (in libsystem_kernel.dylib) + 10  [0x7fff8bd57f72]
    2898 Thread_224875: com.apple.CFSocket.private
    + 2898 thread_start  (in libsystem_pthread.dylib) + 13  [0x7fff8eced351]
    +   2898 _pthread_start  (in libsystem_pthread.dylib) + 168  [0x7fff8ecef91a]
    +     2898 _pthread_body  (in libsystem_pthread.dylib) + 131  [0x7fff8ecef99d]
    +       2898 __CFSocketManager  (in CoreFoundation) + 762  [0x7fff987e04fa]
    +         2898 __select  (in libsystem_kernel.dylib) + 10  [0x7fff8bd5e07a]
    2898 Thread_224917
      2898 thread_start  (in libsystem_pthread.dylib) + 13  [0x7fff8eced351]
        2898 _pthread_start  (in libsystem_pthread.dylib) + 168  [0x7fff8ecef91a]
          2898 _pthread_body  (in libsystem_pthread.dylib) + 131  [0x7fff8ecef99d]
            2898 cuosPosixThreadStartFunc(void*)  (in libclh.dylib) + 41  [0x7fff97bfb929]
              2898 intHandlerMain  (in libclh.dylib) + 336  [0x7fff975ff210]
                2898 cuosEventWait  (in libclh.dylib) + 190  [0x7fff97bfab3e]
                  2898 mach_msg  (in libsystem_kernel.dylib) + 55  [0x7fff8bd573b3]
                    2898 mach_msg_trap  (in libsystem_kernel.dylib) + 10  [0x7fff8bd57f72]

Total number in stack (recursive counted multiple, when >=5):
        5       _pthread_body  (in libsystem_pthread.dylib) + 131  [0x7fff8ecef99d]
        5       _pthread_start  (in libsystem_pthread.dylib) + 168  [0x7fff8ecef91a]
        5       mach_msg  (in libsystem_kernel.dylib) + 55  [0x7fff8bd573b3]
        5       mach_msg_trap  (in libsystem_kernel.dylib) + 0  [0x7fff8bd57f68]
        5       thread_start  (in libsystem_pthread.dylib) + 13  [0x7fff8eced351]

Sort by top of stack, same collapsed (when >= 5):
        mach_msg_trap  (in libsystem_kernel.dylib)        14490
        __select  (in libsystem_kernel.dylib)        2898
        kevent_qos  (in libsystem_kernel.dylib)        2898

ianwood · May 2, 2016

It was reported before on RC groups that the standard OE tools for the SSD are blocked. This is likely a feature that is enabled in the Samsung firmware. What someone needs to test is if a non-DJI drive will be recognized/formatted by the camera.

The Editor · May 2, 2016

ianwood said:
...................What someone needs to test is if a non-DJI drive will be recognized/formatted by the camera.

I bet I already know the answer to that one.

ianwood · May 27, 2016

Not only are these things ridiculously priced, they're impossible to find. Who knows a retailer that has them available for immediate shipping?

Can't believe I am considering buying into this extortion!

damoncooper · May 27, 2016

ianwood said:
Not only are these things ridiculously priced, they're impossible to find. Who knows a retailer that has them available for immediate shipping?

Can't believe I am considering buying into this extortion!

I bought 3 additional that I'm told shipped yesterday from Shenzen. Using borrowed for now

ianwood · May 28, 2016

I found a 3 pack. Should be here next week with the X5R and the reader.

Selling my backup (never used) X5 if anyone wants it! (New Zenmuse X5 camera with 15mm lens)

Bozz · May 29, 2016

We need the guys in the FBI, i bet could do this, they know how to hack and crack in to anything. hehehe

gramanauskas · Jun 23, 2016

Thanks for the posts! Random question. Where you received the 3 drives, how were they packaged? Anything that would make it hard to repackage them?

bujaman · Aug 17, 2016

Has anyone made any progress on this?

crwoo · Aug 18, 2016

has someone tried cloning it with Acronis or similar disk cloning software? i would like to try it, but i don't have a DJI SSD. my none DJI SSD that fits in the slot doesn't work.

The Editor · Aug 18, 2016

crwoo said:
has someone tried cloning it with Acronis or similar disk cloning software? i would like to try it, but i don't have a DJI SSD. my none DJI SSD that fits in the slot doesn't work.

Cloning won't work as the security is actually written into the ROM on the drive itself.
DJI currently have these locked up pretty tight.
After all - it is a large revenue generator for them so it is worth them spending on the security/encryption to keep it proprietary.