I need help modifying the firmware on my old Mavic Mini 1

[top7chip]

I need someone to give me a clue about why the NFZ cannot be modified in version V01.00.0600, but it can in the previous version V01.00.0500.
Comparing firmware versions 0500 and 0600, I see that they are practically identical. The only slight change is in module 0306, which corresponds to the FC; the rest of the modules are completely the same. As for the Anti-Rollback, I assume it is just a simple counter to prevent installing previous versions and is not related to the NFZ behavior. That’s why I believe that if DJI changed something to prevent the NFZ from being altered, it must be inside the FC module.
Interestingly, the Mavic Mini 1 has two flash memories: a small 25Q16 TSOP8 (2 Mb) where the FC module is stored, and a NAND where the rest is stored. Today I read the FC memory, and I think I’ll be able to replace module 0306 from version 0600 with the one from version 0500 without much trouble. I suppose I’ll end up with a 0600 firmware that has all the modules from 0500 and Anti-Rollback 2 instead of 1. I wonder if this actually works, the Drone-Hacks program would allow me to perform the NFZ hack?

[mefistotelis]

Comparing firmware versions 0500 and 0600, I see that they are practically identical. The only slight change is in module 0306, which corresponds to the FC

Firmwares often differ only by one module, especially later ones as the product matures.

As for the Anti-Rollback, I assume it is just a simple counter to prevent installing previous versions and is not related to the NFZ behavior.

I can't remember how it was in Mini, but in general SoCs have efuses.
When such fuse is burnt, it cannot be restored. So the only way to accept older software for a chip which checks efuses on startup, is to modify said software to either skip the check, or to alter the image so that the check still passes.

For flash memory - each uC or SoC in these drones has its own software, either internal or in an external chip. I'm sure you can quickly figure out which chip matches what.

https://github.com/o-gs/dji-firmware-tools/wiki/WM160-Main-Processing-Core-Board

[top7chip]

Hello.
I managed to write the 0306 module from version 0500 into the flash memory, but I’m not sure if I did it correctly.
The version number that appears is not the one it should be, although it also doesn’t correspond to the 0600 firmware version.The PCB boots and connects to the Drone Hacks application.It also doesn’t allow me to download the parameters.

Is it possible to load only the 0306 module into the drone using DUML?

[mefistotelis]

Is it possible to load only the 0306 module into the drone using DUML?

I always did that by just creating a smaller firmware package, though I had the drone altered to accept the OGs signature for FW files at that point (or to skip signature check entirely).

In general, there is a module within the drone which handles receiving the FW package, checking signatures and doing first stage decryption. Then it sends the resulting binaries to destination modules. The signature part was once a simple dji_verify binary. But since Mavic Air, the signature checking work is done within ARM TrustZone - virtualized environment beyond yet another level of encryption. I can't remember which module does that in the Mini, or whether it uses TZ.

For Drone-Hacks help, go to their discord.