Cracking Open a DJI Drone: From Locked-Down Firmware to Playing With TEEs

Millions of consumer drones are in everyday use, capturing photos, mapping sites, and inspecting infrastructure, sold to anyone who wants one. Yet the same cheap, off-the-shelf aircraft have also become a defining tool of modern conflict, modified and repurposed for surveillance and more. Much of that power comes from how much an ordinary retail drone can be changed once its internals are understood: its firmware, its software, and the protections meant to lock it down. Knowing what can be altered on a device sold to anyone, and how far those changes can reach, grows more important as these aircraft fly around and above people. DJI, one of the largest drone manufacturers, sells its drones as secure and backs that up with published security white papers. For my Master's thesis I set out to test those claims through hands-on vulnerability research. I extracted the firmware from a current-generation DJI mini drone, reverse engineered the services running on it, and used AI to bridge static analysis and fuzzing, letting me explore its attack surface far faster than manual review would allow. In this talk, I start from a closed production device where every debug option is disabled, and walk through the steps that eventually let me communicate directly with the Trusted Execution Environments on the device. I detail the design and setup of the fuzzer that uncovered the initial vulnerability, then show how I escalated privileges to reach deeper into the drone.