[Link]
com/anarkiwi/samples2djidroneid
explain this repo please
also i want to understand some of the key words like DroneID does it mean the drone ID or like
a type of drones
This GitHub repository decodes DJI DroneID signals from software-defined radio (SDR)
recordings of I/Q samples. It processes raw radio data captured at specific frequencies (like
2.4295 GHz) and sample rates (15.36 MHz or higher) to extract unencrypted telemetry from DJI
drones using OcuSync 2.0 transmission.
Repo Purpose
The tool reveals sensitive drone details including serial number, GPS position
(latitude/longitude/altitude), velocity, yaw angle, controller position, and home point by
demodulating ~10 MHz-wide DroneID frames broadcast every few hundred milliseconds. It's
built on prior reverse-engineering efforts like proto17/dji_droneid (for signal demodulation)
and Kismet tools.[1]
Key Features
Supports only OcuSync 2.0 (non-WiFi DroneID); WiFi variants need other tools.
Outputs JSON with frame data, e.g., {"serial_no": "REDACTED", "latitude": ...,
"product_type": 63}.
Limitations: Slow with interference; fixed sample rates; detects frames via FFT and Zadoff-
Chu sequences.[2]
Usage Steps
Record I/Q data (float32, complex) with an SDR like Ettus B205mini targeting 2.4 GHz
DroneID frequencies.
Build via Docker: docker build -f Dockerfile . -t samples2djidroneid.
Run: docker run -v /tmp:/tmp -ti samples2djidroneid /tmp/your_recording.raw.
DroneID Explained
DroneID refers to DJI's proprietary broadcast protocol (not a drone model type or simple serial
number), similar to aviation "Remote ID" but predating regulations—it's an unencrypted RF
beacon for identification and telemetry. Modern DJI drones (e.g., Mini 2) transmit it via OcuSync
in 2.4 GHz to share position and operator data for safety/tracking, receivable by SDRs. It's not
user-configurable and reveals privacy-sensitive info like exact locations.[3] [2] [1]
What is Occusync 2.0 in DJI drones
OcuSync 2.0 is DJI's proprietary digital transmission technology for enhanced drone-to-
controller communication. It improves on earlier versions by supporting dual-band operation
(2.4 GHz and 5.8 GHz) with automatic switching to avoid interference.[10] [11] [12]
Core Features
It delivers low-latency video (1080p at 30fps) and control signals up to 8-10 km in ideal
conditions, with latencies around 120-130 ms. Unlike standard Wi-Fi, it uses software-defined
radio principles for better stability, range, and anti-interference via dynamic channel hopping.
[11] [13] [14] [10]
Used In
Found in drones like Mavic 2 series, Air 2, and Mini 2, where it handles live video feeds,
telemetry, and DroneID broadcasts over OcuSync links. Later evolutions like OcuSync 3.0 built
on this for even higher quality.[10] [11]
OcuSync 2.0 vs WiFi transmission comparison
OcuSync 2.0 outperforms WiFi transmission in DJI drones for range, stability, and interference
resistance. While both operate on 2.4/5.8 GHz bands, OcuSync uses proprietary optimizations
over standard WiFi protocols.[20] [21] [22]
Key Differences
Aspect OcuSync 2.0 WiFi (Enhanced)
Range Up to 8-10 km (FCC/CE ideal) [21] 2-4 km max, drops in interference [23] [24]
Latency 120-130 ms, consistent video feed [20] Higher, prone to lag/jitter [25]
Anti- Dynamic channel hopping, robust Basic switching, vulnerable in urban/WiFi-heavy
Interference encoding [21] [22] areas [23] [26]
Use Case Pro/consumer drones (Mini 2, Air 2) [20] Budget models (Mavic Mini) [24]
Cost/Complexity Higher hardware demands [21] Cheaper, simpler [22]
OcuSync excels in real-world tests like urban flights, maintaining signal where WiFi fails.[26]
⁂
Which DJI drones use OcuSync 2.0
DJI OcuSync 2.0 powers several mid-range and pro consumer drones from around 2019-2021. It's
found in models prioritizing range and stability over budget WiFi alternatives.[29] [30] [31]
Main Models
Model Key Notes [30] [31] [32]
Mavic 2 series (Pro, Zoom, Enterprise, Dual) Flagship launch platform for OcuSync 2.0; up to 8km range.
Mavic Air 2 Compact foldable with strong transmission.
Mini 2 Lightweight under 250g; major upgrade from Mini 1 WiFi.
Mavic 3 Classic (early variants) Some base models before full O3 upgrade.
These drones use it for DroneID broadcasts and video feeds, unlike newer O3/O4 lines (Mini 3
Pro, Air 3). Production largely phased out by 2023 for advanced successors.[29] [30]
Differences between DJI DroneID and standard
Remote ID
DJI DroneID and standard Remote ID both broadcast drone identification data but differ in
origin, protocol, encryption, and regulatory scope.[39] [40]
Key Differences
Aspect DJI DroneID [39] Standard Remote ID [40] [41]
FAA/ASTM/EASA regulated standard (post-
Origin Proprietary DJI system (pre-2021)
2023)
Broadcast OcuSync/WiFi (2.4 GHz), unencrypted
Bluetooth/WiFi (5 GHz preferred), encrypted
Method telemetry
Serial #, GPS (drone/controller/home), Serial/session ID, drone GPS/altitude/velocity,
Data Broadcast
velocity, yaw controller GPS (live)
Long-range SDR receivable (km+),
Range/Receiver Short-range (~1 km), app/scanner detectable
privacy-exposed
Voluntary/pre-regulatory; always on in
Compliance Mandatory for >250g drones; disable prohibited
newer DJI
Privacy Reveals exact operator positions Anonymized session IDs, no full telemetry
DJI integrated standard Remote ID into newer models (e.g., Mini 3+), sometimes alongside legacy
DroneID. DroneID predates regulations and leaks more data, while Remote ID prioritizes
standardized safety.[42] [40]
⁂
okay then how does the repo works exactly
The repo processes raw I/Q samples from SDR recordings to detect and decode unencrypted DJI
DroneID frames transmitted via OcuSync 2.0. It relies on FFT-based frame detection and
demodulation from upstream projects like proto17/dji_droneid.
Step-by-Step Workflow
1. Record Data: Capture complex float32 I/Q samples at 15.36 MHz (or 30.72 MHz) sample rate,
centered near DroneID frequencies like 2.4295 GHz (covers ~10 MHz frame bandwidth).
2. Build Tool: Use Docker: docker build -f Dockerfile . -t samples2djidroneid (Python-
based, 75% of code).
3. Run Decoder: docker run -v /tmp:/tmp -ti samples2djidroneid /tmp/your_recording.raw.
Scans for frames using power-of-two FFT sizes (1024 at 15.36 Msps).
4. Detection: Identifies DroneID via Zadoff-Chu sequences or spectrum peaks; slow with
interference (e.g., WiFi).
5. Decode & Output: Parses 88-byte frames (msgtype 16, version 2) into JSON: serial, GPS
(drone/controller/home), altitude, velocity, yaw, product type, etc.
Limitations
Handles only OcuSync 2.0 (not WiFi DroneID); requires clean/short recordings for speed; fixed
sample rates tied to LTE spacing.
i meant more of the decoding process like what is
the logic behind it
The repo's decoding logic reverse-engineers OcuSync 2.0 DroneID frames from raw I/Q samples
using signal processing and protocol analysis.
Core Decoding Steps
1. FFT Detection: Computes power-of-two FFTs (e.g., 1024-point at 15.36 Msps) across the ~10
MHz bandwidth to spot DroneID frame spectrograms—characteristic peaks from Zadoff-
Chu sequences (correlation sequences for sync).
2. Synchronization: Aligns frame start via known preamble patterns (magic byte 0x55,
length/version fields, CRC-8 header) extracted post-FFT energy thresholding.[49]
3. Demodulation: Converts I/Q to symbols using OFDM principles (OcuSync's modulation);
applies firmware-derived bit mapping, error correction, and soft-decision decoding for the
transit/command sections.[49]
4. Payload Parse: Decodes 88-byte frames (msgtype 16, v2): unpacks fixed fields like serial (24
bytes), GPS (lat/lon/alt x3 for drone/controller/home), velocity vector, yaw, product ID via
bit shifts/masks from reverse-engineered structs.
5. Output: Validates CRC, emits JSON; repeats on sliding windows for continuous frames
(broadcast every ~200-500 ms).
This pipeline, adapted from proto17/dji_droneid, assumes unencrypted OcuSync (not WiFi) and
clean signals—interference blurs FFT peaks, slowing detection.[49]
[Link]
okay what about this repo
The RUB-SysSec/DroneSecurity GitHub repo is a DroneID receiver for DJI OcuSync 2.0 drones,
developed by Ruhr University Bochum's Systems Security group. It processes live SDR data or
offline I/Q captures to decode unencrypted DroneID telemetry, tied to their NDSS 2023 paper on
DJI protocol vulnerabilities.[59] [60]
Repo Purpose
It extracts real-time drone details like serial number, GPS positions (drone/app/home), altitude,
velocity, yaw, and device type (e.g., "Mini 2") from ~88-byte frames—similar to
anarkiwi/samples2djidroneid but with live SDR support via GNU Radio or gr-droneid forks. The
project highlights privacy risks from DroneID's open broadcasts, unlike encrypted standard
Remote ID.[60] [59]
Key Components
Live/Offline Modes: Hooks into SDR hardware (e.g., HackRF) for real-time decoding or
processes .cfile/.raw captures.[59]
Output Format: JSON payloads with fields like {"pkt_len": 88, "version": 2, "latitude":
51.4468, "device_type": "Mini 2", "crc-packet": "c935"}.[59]
Related Tools: Links to their fuzzer repo (DroneSecurity-Fuzzer) for black-box DUML
protocol testing over USB, not yet fully public.[61]
This builds directly on the frame detection/demodulation logic discussed earlier (FFT peaks,
Zadoff-Chu sync, CRC validation).[59]
⁂
DroneSecurity vs anarkiwi samples2djidroneid
differences
RUB-SysSec/DroneSecurity and anarkiwi/samples2djidroneid both decode DJI OcuSync 2.0
DroneID from SDR I/Q data but target different use cases and maturity levels.[69] [70]
Key Differences
Aspect RUB-SysSec/DroneSecurity anarkiwi/samples2djidroneid
Primary Mode Live SDR + offline captures [70] Offline recordings only [69]
Implementation GNU Radio flowgraphs, Python scripts [70] Standalone Dockerized Python decoder [69]
Hardware Tested Ettus B205-mini (USRP) [70] Any SDR outputting float32 I/Q [69]
Output Stats, flight paths, JSON frames [71] Pure JSON frames [69]
Focus Research PoC from NDSS '23 paper [72] Optimized frame extraction tool [69]
Performance Not optimized for range/bad RF [70] Slow with interference, fixed rates [69]
DroneSecurity emphasizes live monitoring and protocol analysis for security research, while
samples2djidroneid prioritizes simple offline processing of captures. Both share FFT/Zadoff-
Chu detection roots from proto17/dji_droneid.[71] [70]
is droneID same as OcuSync , at what level each
one works
DroneID and OcuSync 2.0 are related but distinct: DroneID is not the same as OcuSync—it's a
specific application-layer protocol (telemetry payload) broadcast over the OcuSync 2.0
physical/radio link layer.[77] [78]
Protocol Levels
Level OcuSync 2.0 Role [79] [78] DroneID Role [80]
Physical Modulation (FHSS/OFDM), 10 MHz bandwidth, Payload data modulated onto OcuSync
(PHY) 2.4/5.8 GHz freq hopping [77] carrier
Frame sync (Zadoff-Chu seq), error correction, Encapsulated in fixed 88-byte OcuSync
MAC/Link
channel hopping frames (msgtype 16)
ID/telemetry only: serial, GPS×3, velocity,
Application General C2/video/control transport
yaw, etc.
OcuSync 2.0 provides the robust radio transport (like LTE-inspired waveforms for
range/stability), while DroneID rides on top as unencrypted identification broadcasts every
~200-500ms—out-of-band from encrypted C2/video streams. Repos decode DroneID by first
demodulating the OcuSync PHY signal via FFT, then parsing the ID payload.[78] [81]
⁂
How to decode DJI DroneID from OcuSync signals
with SDR
Decoding DJI DroneID from OcuSync signals with SDR involves capturing raw I/Q data and
processing it through signal detection, synchronization, demodulation, and payload parsing.
[88] [89]
Hardware Setup
Use an SDR like HackRF One, USRP B210, or Ettus B205mini tuned to 2.4 GHz band (e.g., 2.4295
GHz center) with ≥15.36 Msps sample rate to cover the 10 MHz OcuSync frame bandwidth.
Record complex float32 I/Q (.raw or .cfile) during drone flight—OcuSync 2.0 DroneID bursts
every 200-500 ms.[90]
Software Processing Steps
1. Signal Detection: Compute STFT/FFT spectrograms to spot ~10 ms DroneID bursts (Zadoff-
Chu peaks, LTE-like power spikes); threshold energy windows.[91] [89]
2. Synchronization: Correlate for preamble (0x55 magic byte, CRC-8 header); align OFDM
symbol timing.
3. Demodulation: QPSK/OFDM subcarrier extraction (brute-force constellation rotation);
descramble, turbo decode (LTE-inspired FEC) to bits.[89] [92]
4. Payload Decode: Parse 88-byte frame (msgtype 0x10, v2): extract serial (24B), GPS
lat/lon/alt (drone/controller/home), velocity, yaw via bitmasks.
Tools to Use
Tool/Repo Live/Offline Notes
anarkiwi/samples2djidroneid Offline Docker Python [88] Simplest for recordings; FFT sliding windows.
RUB-SysSec/DroneSecurity Live GNU Radio [93] Full flowgraph; stats/flight paths.
proto17/gr-droneid Live GNU Radio [94] Base for most; Octave/Matlab scripts.
DragonOS Focal Live/Offline [94] Prebuilt distro with decoders.
Start with samples2djidroneid for recordings: build Docker, run on .raw file → JSON output. Live
needs GNU Radio 3.10+ blocks from forks. Success requires clean SNR; urban WiFi interferes.[88]
[91]
⁂
Decoding DroneID from WiFi vs OcuSync
transports
DJI DroneID payloads can be decoded from both WiFi (Enhanced WiFi) and OcuSync transports,
but they differ significantly in signal characteristics, detection complexity, and tooling support.
[99] [100]
Key Comparison
Aspect WiFi Transport (Enhanced WiFi) [99] [100] OcuSync Transport [100]
Standard 802.11 OFDM (20/40 MHz channels, Proprietary FHSS/OFDM (10 MHz bursts,
Modulation
2.4/5.8 GHz) freq hopping)
Three packet types; embedded in Fixed 88-byte frames (msgtype 0x10, v2
Frame Structure
beacon/management frames preamble)
Detection Monitor mode sniffing (e.g., airodump-ng); FFT spectrogram peaks + Zadoff-Chu
Method parse SSIDs/beacons correlation [101]
Range Short (~1-2 km); standard WiFi limits Long (5-10 km); OcuSync range [102]
Wireshark, gr-dji-wifi, custom beacon GNU Radio (proto17/gr-droneid),
Tools
parsers [99] samples2djidroneid
SDR High rate (≥15.36 Msps); sliding FFT
Lower sample rate (20-80 Msps); easier sync
Requirements windows
Moderate (FHSS helps); needs clean 10
Interference Heavy (competes with all WiFi); channel scanning
MHz capture
Decoding Workflow Differences
WiFi DroneID: Capture 802.11 traffic in monitor mode → filter DroneID-specific SSIDs/beacon
payloads (e.g., serial in TLV fields) → extract telemetry. Works on budget drones like Mavic Mini;
real-time with commodity WiFi cards.[99]
OcuSync DroneID: Record raw I/Q → FFT for burst detection → OFDM demod (QPSK, turbo FEC)
→ CRC-validated payload parse. Used in Mini 2/Air 2; requires powerful SDRs like HackRF/USRP.
[100]
Most open-source repos (samples2djidroneid, RUB-SysSec) focus OcuSync due to richer
telemetry and research interest—WiFi decoding leverages mature WiFi tools but reveals less
data. Dual-support prototypes exist using HackRF pairs.[100] [99]
1. [Link]
2. [Link]
3. [Link]
4. [Link]
5. [Link]
6. [Link]
7. [Link]
8. [Link]
9. [Link]
10. [Link]
11. [Link]
12. [Link]
13. [Link]
14. [Link]
15. [Link]
16. [Link]
17. [Link]
18. [Link]
19. [Link]
ming-to-unlock-unlimited-/1319130233586238/
20. [Link]
21. [Link]
22. [Link]
23. [Link]
24. [Link]
25. [Link]
26. [Link]
27. [Link]
28. [Link]
29. [Link]
30. [Link]
31. [Link]
32. [Link]
33. [Link]
34. [Link]
d-drone-ranges-in-2026/
35. [Link]
36. [Link]
37. [Link]
38. [Link]
39. [Link]
40. [Link]
41. [Link]
42. [Link]
43. [Link]
44. [Link]
45. [Link]
46. [Link]
47. [Link]
48. [Link]
49. [Link]
50. [Link]
51. [Link]
52. [Link]
53. [Link]
54. [Link]
55. [Link]
[Link]
56. [Link]
57. [Link]
58. [Link]
59. [Link]
60. [Link]
61. [Link]
62. [Link]
63. [Link]
64. [Link]
65. [Link]
66. [Link]
67. [Link]
68. [Link]
69. [Link]
70. [Link]
71. [Link]
72. [Link]
73. [Link]
74. [Link]
75. [Link]
76. [Link]
7/85
77. [Link]
78. [Link]
79. [Link]
80. [Link]
81. [Link]
82. [Link]
83. [Link]
84. [Link]
th-guardian-air
85. [Link]
86. [Link]
87. [Link]
88. [Link]
89. [Link]
90. [Link]
91. [Link]
92. [Link]
93. [Link]
94. [Link]
95. [Link]
ng/2207/98181771?origin=viewer-recommendation-5
96. [Link]
97. [Link]
98. [Link]
99. [Link]
100. [Link]
101. [Link]
102. [Link]
103. [Link]
104. [Link]
105. [Link]
ng/2207/98181771?origin=course-suggestion-3
106. [Link]
107. [Link]
108. [Link]
dji-en-ocusync-2/