Hacking the Parrot A.R. Drone

Drones. They're all over the news lately, and it seems that you can't get away from them. From their use in Afghanistan and other far-away places, to monitoring farmers and crops domestically, they're everywhere. Their robotic nature and all-seeing camera eyes lead one toward visions of a Skynet-like army of mechanical flying hunter-seekers chasing after humans and terminating them one by one—or maybe that's just me, and I've watched too many science-fiction movies.

However, there's a less death-inducing version of a drone that's available to us, the non-military nerds, and it's available today. It's the Parrot A.R. Drone, a semi-autonomous, largely automated quadracopter. I'd call it a toy, but it's as close to a toy as a smartphone or a tablet. This “toy” has some pretty wild potential, and it's masked and presented as a cute, fun plaything.

Figure 1. The A.R. Drone, Flying

The A.R. Drone is, at its heart, a $299 radio-controlled quadracopter. Its four rotors provide stability and ease of flight without the pilot having to worry about offsetting the torque of a single rotor or dealing with the complexities of flying a conventional tail-rotor helicopter design. Although there are a few toys that do this on the market today, the A.R. Drone justifies its cost by taking this a little further—it is controlled by a smartphone (or tablet), and uses an onboard computer running Linux to do a heavy amount of in-flight stabilization and computation to make the drone simple to fly for even the most novice of radio-control pilots.

Figure 2. AR Drone Screenshot

The A.R. Drone has a bunch of onboard instrumentation. There's two cameras, one in the nose and one in the belly, and the cameras feed video back to the smartphone app for first-person perspective while flying. It's also got an onboard ultrasonic altimeter and an accelerometer to measure tilt and acceleration. Using these instruments in concert with the smartphone app allows the A.R. Drone to do things for you that are usually really hard, such as station-keeping while hovering with the wind blowing. The pilot doesn't have to compensate for the wind, as the A.R. Drone does all the hard work. The smartphone app has very intuitive controls, as well. To take off, you simply tap the “Take Off” button at the bottom of the screen, and the drone will lift off and hover in front of you, approximately two feet off the ground. From there, you just tap and hold on the left side of the screen to engage the accelerometer controls, and tilt your smartphone in the direction you want the drone to go. On the right side of the screen, you just tap and hold, then slide up and down to control altitude, or slide left and right to spin the drone around. If you lift both fingers from the phone's screen, the drone will stop all maneuvers and station-keep, hovering in place.

Onboard, the A.R. Drone really is a flying computer, coupled to a Wi-Fi access point. There also are two versions of the A.R. Drone: version 1.0 and 2.0. I was able to pick up the 1.0 version for $100 on-line as a refurbished item, but if you can afford it, the 2.0 version brings much-needed improvements, such as a 720p video camera in the nose and a faster CPU. Table 1 shows the hardware breakdown.

As you can see, there's a definite advantage to the A.R. Drone 2.0, but the 1.0 is still a capable unit. All my investigations apply to the 1.0, but should apply to the 2.0 version as well.

Since the smartphone app relies on the fact that you pair your phone or tablet with the access point inside the A.R. Drone, I figured that'd be the ideal place to start poking around at the little guy. I pointed my laptop at the access point that the drone broadcasts (ardrone_27515 in my case) and got an IP address on the “network”. I then pointed the “nmap” tool at the IP address of the drone, which was 192.168.1.1:

bash-3.2$ nmap -O 192.168.1.1
	
Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-07 10:39 PST
Nmap scan report for 192.168.1.1
Host is up (0.0019s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE
21/tcp open  ftp
23/tcp open  telnet
MAC Address: 00:26:7E:62:03:8A (Parrot SA)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop

OS detection performed. Please report any incorrect 
 ↪results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.06 seconds

Well, look at that. The A.R. Drone has an FTP server and a Telnet server, with both running and open. That Telnet server is just too inviting of a target, so let's just give that a try:

bash-3.2$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
	
	
BusyBox v1.14.0 (2012-08-20 14:37:54 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
	
#

That's nifty. It looks like the A.R. Drone's Telnet server drops you right to a root shell running BusyBox, without any kind of authentication at all. It's not the best for security, but it's great for just hacking around.

Let's run a couple commands and see what's going on on this little guy. First, I'll check the CPU and see if it is what I think it is (a little ARM processor):

# cat /proc/cpuinfo
Processor       : ARM926EJ-S rev 5 (v5l)
BogoMIPS        : 233.47
Features        : swp half thumb fastmult edsp java 
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant     : 0x0
CPU part        : 0x926
CPU revision    : 5
Cache type      : write-back
Cache clean     : cp15 c7 ops
Cache lockdown  : format C
Cache format    : Harvard
I size          : 32768
I assoc         : 4
I line length   : 32
I sets          : 256
D size          : 16384
D assoc         : 4
D line length   : 32
D sets          : 128

Hardware        : Mykonos Parrot platform
Revision        : 0904
Serial          : 0000000000000000

There's a little ARM CPU there. Let's check RAM and see how much the A.R. Drone has available once it's all running and has its services alive:

# free
	 total     used     free   shared   buffers
  Mem:  126068    23644   102424        0         0
 Swap:       0        0        0
Total:  126068    23644   102424

It looks like the A.R. Drone has a very large portion of its memory available (102MB out of 128MB). That might be handy if you ever decide to hack the drone further and run your own software on the drone. For now though, let's just continue with investigating the drone itself, and try to get a computer to control the drone instead of the smartphone application. Here are some more basics about the A.R. Drone's running Linux distribution:

# uname -a
Linux myhost 2.6.27.47-parrot #1 PREEMPT Mon Aug 20 
 ↪14:46:29 CEST 2012 armv5tejl GNU/Linux
	
# df -h
Filesystem      Size     Used Available Use% Mounted on
ubi1:system    12.0M     7.0M      4.4M  61% /
tmp            61.6M    32.0K     61.5M   0% /tmp
dev            61.6M        0     61.6M   0% /dev
ubi0:factory    4.8M    44.0K      4.5M   1% /factory
ubi2:update    13.2M   160.0K     12.3M   1% /update
ubi2:data      67.5M     1.3M     62.7M   2% /data

There's a lot more stuff to investigate on the A.R. Drone's filesystem and operating system, but in the interest of time, I'll cut to the chase. All the really interesting bits of the software—the stuff that makes it fly—is in /bin, and there are a few processes listening on weird ports like 5554, 5555 and 5556. It's also running a DHCP server (the udhcpd dæmon), so that the smartphone app can get an IP address once the phone or tablet associates with the Wi-Fi network that the drone creates.

It's the processes running on those ports 5554, 5555 and 5556 that I'm going to continue to explore. If you can feed the right kind of data to the A.R. Drone on these ports, you can replace the smartphone app with your own program, running on a computer. That'd give you the ability to begin to make the drone truly autonomous. Exploring how to make the drone fly is beyond the scope of this article, as it'd involve reverse-engineering the A.R. Drone protocol and writing your own software. However, there's a lot of smart people out there on the Internet, and they've done that for you. Let's start off by trying out “drone-browser” (see Resources), a rudimentary Web-based UI for the A.R. Drone.

drone-browser is written in node.js, as is a lot of the other software available for the A.R. Drone. To get it going, you need a node interpreter and a copy of the software from the project's git repository. See the sidebar “Getting drone-browser Running” for more information. Once you have drone-browser going, you'll get a browser-based GUI, as shown in Figure 3.

Figure 3. A Screenshot of drone-browser

sudo apt-get install node

git clone https://github.com/functino/drone-browser.git

node ./server.js

Once you have drone-browser running, you can control the A.R. Drone via keyboard commands or button-presses in the Web browser window. Be warned, however, that the controls are not nearly as refined as the smartphone application, and there is no “auto-stop” command. When you command the drone to fly forward, it will—until it receives a stop command or runs into an obstacle. Don't do what I did and attempt this in the house—I nearly ran the drone into my wife as she sat at her desk.

So, drone-browser is a good first step to start playing with computer control, but it's not a way to control your A.R. Drone programmatically. In order to enable full Terminator-style hunter-killer mode, you'll need another piece of software—something that will let you write a program on the computer and translate it into the instructions the drone can accept. This exists already, and it's called node-ar-drone (see Resources for more information).

node-ar-drone lets you write relatively straightforward JavaScript code that can be interpreted into instructions to fly the drone. Installing node-ar-drone is straightforward, as described in the sidebar. As per node-ar-drone's documentation, the fastest way to control the drone is with an interactive program. Begin by creating a file called repl.js that contains the following instructions (example borrowed from the project documentation):

var arDrone = require('ar-drone');
var client  = arDrone.createClient();
client.createRepl();

Then, just run your code, and issue the commands at the command line:

node ./repl.js
// Make the drone takeoff
drone> takeoff()
true
// Wait for the drone to takeoff
drone> clockwise(0.5)
0.5
// Let the drone spin for a while
drone> land()
true
// Wait for the drone to land

The drone should take off, spin clockwise, and then land. Now, you can create a fully autonomous program that will do the same thing. However, be careful when doing this, as once you run the program, the drone will be under the command of the computer and not your control. Make sure you observe the right safety precautions. The A.R. Drone may be a toy, but it's got four rotating blades and could cause injury if it flew into someone. I've run this example code from the project's Web site, and my drone successfully took off, pivoted in a circle and landed—all autonomously:

var arDrone = require('ar-drone');
var client  = arDrone.createClient();
	
client.takeoff();
	
client
  .after(5000, function() {
    this.clockwise(0.5);
  })
  .after(3000, function() {
    this.stop();
    this.land();
  });

The A.R. Drone may be marketed as a toy, but it's sophisticated enough to be the basis for a flying robot that can interact with its environment, avoid obstacles and perform tasks—all on its own. It needs only the right code, running on a computer, to give it enough smarts to do the job.