Skip to main content

Hacking the Potensic Atom drone to fly pre-generated waypoint missions

1. Overview: Drone Tasking Manager (DroneTM)

About a year ago, a joint initiative between the Humanitarian OpenStreetMap Team (HOT) and NAXA began the development of the Drone Tasking Manager (DroneTM).

What is DroneTM?

Hardware Support

2. The Potensic Atom Series

Comparison

Note

Potensic currently imposes a 30 waypoint limit per mission in it’s apps. This needs further testing to assess if it’s a hard or soft limit.

3. Technical Exploration

Existing Attempts

An excellent community project by @koen-aerts reverse-engineered the proprietary flight log format for Potensic drones:

Waypoint Planning in DroneTM

Storing Waypoints In The Atom

The map.db Waypoint File

Note

Android File Access: A Quick Primer

An aside on how Android sanboxed filesystem works per-app since Android 14.

There are two storage options for apps:

  1. Each app gets it own sandboxed storage to work with, to prevent privileged access to the entire filesystem: /data/data/<package.name>/.
  2. Shared storage is also available if permission is granted, under: /storage/emulated/0/Android/data/<package.name>/.

However:

  • In order to copy the map.db file across to a place on the phone that the PotensicPro app can read, we need to copy to this sandboxed filesystem.
  • The sandboxed filesystem is only accessible directly from the app code, unless the device is rooted, or the app uses a debuggable flag in it’s manifest (see more info below).

We have two options:

  1. Mod the PotensicPro app further, to read map.db from shared storage instead.
  2. Use ADB to interact with the sandboxed storage, via ‘run-as’ the required user.

An Existing Modded App

The process to make an existing APK ‘debuggable’:

# Gen a new signing key
docker run -it --rm -v $PWD:/home/makedebuggable -u makedebuggable ghcr.io/spwoodcock/make-debuggable:2025-05-11 /scripts/keygen.sh

# Mod the APK to be debuggable
docker run -it --rm -v $PWD:/home/makedebuggable -u makedebuggable ghcr.io/spwoodcock/make-debuggable:2025-05-11 /scripts/makeDebuggable.py apk PotensicPro-V6.6.1
-E443.apk PotensicPro-V6.6.1-E443-debug.apk debuggable.keystore debuggable pwpwpw

4. Implementing Waypoint Generation

Inspecting The Waypoint Database

# First ensure the db is not being accessed
./adb shell am force-stop com.ipotensic.potensicpro

# This approach doesn't work due to permission issues
#./adb shell run-as com.ipotensic.potensicpro cp /data/data/com.ipotensic.potensicpro/databases/map.db /sdcard/Android/data/com.ipotensic.potensicpro/files/

# This works (we use base64 encode to avoid encoding issues between shells, e.g. powershell vs bash, see below)
./adb exec-out run-as com.ipotensic.potensicpro base64 /data/data/com.ipotensic.potensicpro/databases/map.db > map.db.b64
# I then copied this across to WSL decoding base64
dos2unix map.db.b64
base64 -d map.db.b64 > map.db

# For a Linux-only workflow, it would be simpler to just:
cat map.db | ./adb exec-in run-as com.ipotensic.potensicpro /data/data/com.ipotensic.potensicpro/databases/map.db

Note

A note about shell encoding… how I wasted 2hrs of my life.

Originally I was using: ./adb exec-out run-as com.ipotensic.potensicpro cat /data/data/com.ipotensic.potensicpro/databases/map.db > map.db

This failed as I was testing using Powershell instead of bourne / bash. After some hex inspection I noticed the encoding was wrong in the copied file headers.

In PowerShell, using redirection (>) causes the new files to be encoded in Windows UTF-16LE encoding, while Unix-like filesystems require UTF-8. Making the file not a valid SQLite file.

So I swapped to the base64 encoding approach above, that should be cross compatible between different terminals!

Creating A Waypoint File

See Stay Tuned below to follow up on the progress here.

Limitations

The SQLite format used isn’t particularly sophisticated. Basically we have:

As a result, three major limitations has been identified:

DJI obviously have an advantage here and clearly have a big team of software engineers at their disposal. The Waypoint Markup Language (WPML) is a very professional and infinitely configurable spec in comparison.

Importing The Generated File To A Phone

# Cleanup old journal files
./adb shell run-as com.ipotensic.potensicpro rm -f databases/map.db-journal

# Overwrite db
base64 map.db > map.db.b64
# Linux
./adb shell run-as com.ipotensic.potensicpro sh -c "'base64 -d > databases/map.db'" < map.db.b64
# Powershell
Get-Content -Raw "map.db.b64" | ./adb shell run-as com.ipotensic.potensicpro sh -c "'base64 -d > databases/map.db'"

ADB In The Browser

Stay Tuned