OnAirAviation · Experimental
Decode DJI drones with an SDR
OnAir receives DJI drones. DJI drones on 2.4 and 5.8 GHz, receive only: wideband OFDM burst trains are classified by their shape (OcuSync-like, Lightbridge-like, unknown wideband OFDM) from the width, burst period, duty cycle and cyclic-prefix correlation, with a confidence and a clear note that this is a guess from the signal shape; DJI DroneID (the OcuSync 2 broadcast: Zadoff-Chu roots 600 and 147, turbo code, CRC-24) is decoded to the drone's serial number, position, home point and pilot position as sent in the clear. Needs 16 Msps or more (HackRF at 20 Msps; Pluto, bladeRF, USRP). The encrypted video link is never decoded.
What DJI drones is
DJI drone links use wideband OFDM on 2.4 and 5.8 GHz. OnAir classifies the bursts by shape and can read the DroneID broadcast of supported models; this is a guess from the signal, never a certain identification.
Frequencies and where it is used
Drones, 2.4 / 5.8 GHz.
In OnAir the tuning shortcut is Drones, 2.4 / 5.8 GHz; you can enter any frequency your radio reaches.
What OnAir shows for DJI drones
DJI drones on 2.4 and 5.8 GHz, receive only: wideband OFDM burst trains are classified by their shape (OcuSync-like, Lightbridge-like, unknown wideband OFDM) from the width, burst period, duty cycle and cyclic-prefix correlation, with a confidence and a clear note that this is a guess from the signal shape; DJI DroneID (the OcuSync 2 broadcast: Zadoff-Chu roots 600 and 147, turbo code, CRC-24) is decoded to the drone's serial number, position, home point and pilot position as sent in the clear. Needs 16 Msps or more (HackRF at 20 Msps; Pluto, bladeRF, USRP). The encrypted video link is never decoded.
This receiver is built from the published specification and checked end to end on simulated signals. It has had little or no testing on real transmissions yet, so reports and recordings on Discord are welcome.
Which radio you need
This mode sits at a high frequency, so check that your radio tunes it: a HackRF covers 1 MHz to 6 GHz, and RTL-SDR stops near 1.7 GHz. Some modes at these frequencies also need a fast radio (10 to 20 Msps) or a dish and an LNB.
Questions about DJI drones
Can I decode DJI drones with an RTL-SDR?
Probably not: an RTL-SDR tunes up to about 1.7 GHz. A HackRF (1 MHz to 6 GHz) or another wideband radio is the usual choice for this frequency range.
Is it legal to receive DJI drones?
Receiving aircraft broadcasts is legal in many countries, but some restrict listening to or using what you hear. OnAir is a receiver. Check the rules where you live.
Can I try DJI drones in OnAir without a radio?
Yes. Most modes include a built-in synthetic test signal, so you can open the screen and try the controls before you own a radio.
Try it without a radio
OnAir includes built-in synthetic test signals for most modes, so you can open this screen, see the layout and try the controls before you own a radio. The Tour button walks you through the app.