You have no items in your shopping cart.
Thursday, July 29, 2021 5:23:40 PM

Howto: Rooting DJI Crystal Sky

one year ago
#5291 Quote
I followed the instructions on the first post and it worked on v3.0.2.0. Some corrections to that post:

You can downgrade to v02.06.06.00 from v3.0.2.0. You download the file from DJI's site here: and follow their instructions. BUT the root method works on v3.0.2.0 just fine.

Also the full gapps works as well, but don't really need everything there so pico is just fine.

Unfortunately DroneDeploy does not work. The version on the play store says unsupported device. I found an older version and sideloaded it. With the pico gapps it would show the welcome screen, I tap next, then it would get stuck on a white screen. So i flashed the full gapps and now it just crashes right away :/. Also my DJI Pilot app doesn't run, but DJI GO v4 works.
one year ago
#5591 Quote
Fone wrote:
Also my DJI Pilot app doesn't run, but DJI GO v4 works.

Hi Fone,

Well, on my rooted and pico GAPPS CS both Pilot and Go 4 app work.
But since updated Pilot app doesn't support my Inspire 2 anymore it's kind of wasted.

10 months ago
#6173 Quote
Rooted and dd backup went perfect with Win10 machine on a CrystalSky with FW v3.0.2.0, very easy. Easier than some phones I have rooted/custom recoveries. I didn't attempt play store yet as it may not be needed. Reading some post looks like it can be done with v3.0.2.0 but I'm only going to take the risk if its needed. Is flashing xposed with chainfire a possibility? Has anyone  attempted it yet? One problem I  have is AFWall+ (donated) mewesr version it runs for few minutes then force closes and refuses to open untill I clear data, then only opens again for a minute, I'll try to find an older backed up apk and see if that stops force closings.
Robert Black, MD
9 months ago
#6200 Quote
droni wrote:
Do you mean using flashfire and SuperSU? I don't know, for me it looks like an additional unecessary step:

First of all, we want to avoid persistent root as it can be detectable by apps.
I didn't notice any behaivior of DJI Go 4.3.16 and Pilot 1.7.0 on a rooted device,
but I didn't give it a very deep look. Didn't even decompile the bytecode of the stock apps, just made sure they work as before.

There are other DJI daemons that run as root and can detect (persistently) rooted device with 99% probability if they wish to do so.
These methods involve looking up several system properties that can only been changed when the device is rooted. If the values don’t match an unrooted device it’ll flag it as rooted. (Super)su and Busybox binaries are often present on rooted devices, so a simple file system check can detect it as well.
Some root handlers mount the /system partition as read-write, another way etc.

Losing warranty, bricking, is only one reason why we want to avoid it.
So SuperSU and other things you would probably don't care about on
an emulator - are extremely important here.
The guide should be focused about gaining a temp root, install the stuff (Gapps, apks, firewall rules that you need, reboot and go to a clean state.
By clean I mean system-wise unrooted, with your stuff installed and working.
This part is totally missing from your guide for now.
People who want persistent root can go all the way further and install the
unstable garbage like SuperSU, but it shouldn't be a default for all.

Also we want to make sure it's future proof for any next updates, as it will
be less trivial for DJI and other apps to check for device modifications,
we can safely sideload/update any userspace app without worries.

Back to the original question, no - that method will not work since the original installd will check for the following manifests:
> dji.pilot.pad, com.DeviceTest,

In the patched installd, this check is zeroed out with 'a's:
<, aaa.aaaaaaaaaa, aaaaaaaaaa.aaaaaaa.aaaa.aaaa

Here are both files -

To patch, just replace /system/bin/installd with the patched one.

Hi Droni, Thx for this interesting post. Is there a more in detail guide to how only get the installd in system/bin?
9 months ago
#6207 Quote
The copy/overwrite needs to be done with ES Explorer Pro as it handles properly overwriting a file with read/only partitions etc. If you try to modify it directly, the unmodified version would be restored automatically from a cache, erasing your changes.

9 months ago
#6208 Quote
minakk wrote:
The copy/overwrite needs to be done with ES Explorer Pro as it handles properly overwriting a file with read/only partitions etc. If you try to modify it directly, the unmodified version would be restored automatically from a cache, erasing your changes.

Hi Minakk. Good info. will give it a go
9 months ago
#6361 Quote
My wrote:
Got the root from under Windows10 on v3.00.02.00.

Hi there,

Managed to get root too from under Windows10 on v3.00.02.00.
Used the old files I downloaded to get root on the Crystalsky running v2.x

I do have a problem though with FlashFire v0.73 not willing to run.
When fired up, it will properly ask for root admission and then runs some internal routines and force closes somewhere on Checking for Pro...

Never had a FlashFire Pro version. Tried downloading again from  other sites as well, but all keep force closing.

Has anybody any clue as to how to solve this issue?

***EDIT 1***
Managed to overcome the issue by downloading the light version from here:

Next problem I now face is that I cannot flash the newly downloaded Gapps ARM 5.1 pico for some reason. :(
Downloaded that package from official site:

And yes, I did download the correct version as I have Android v5.1.1 running.

This is kind of sad as it was the whole reason I tried to upgrade the old playstore v17.4.28-all because it apparently doesn't run under firmware v3.00.02.00 anymore. (Yeah, tried clearing cache and data from Play store app too)

***EDIT 2***
Seems the problem of not being able to flash Gapps resides with the FlashFire app I installed.

***EDIT 3***
Still trying.
Seems like the problem of Playstore not working anymore might be that after the firmware update, there is no device ID for Google servers to be found on the device as the directory /data/data/ is nowhere to be found...

I suppose that would get installed when flashing Gapps, but the flashing tool from Chainfire won't work any more...

Hope anyone else did manage and is willing to share howto.

It worked out.
Read 2 posts below :)


Reason for chain fire pro close, 2 ways to fix it his newer all has line of code to read tour system clock, turn off auto time, and set year of device to something like 2012, another bypass to shut Down is you can keep time/date up to date but play store can't be installed.
Robert Black, MD
9 months ago
#6362 Quote
My wrote:
Yeah, figured as much.

Here's the thought. Don't install the new firmware if you want to root and install the google play store.

Well here you go.

I managed to get Gapps and all working!

Finally a simple factory reset and reinstalling FlashFire and then flashing Gapps did the trick.

Now over to the second Crystalsky :D


This method works perfect for  v3.0.2.0. , root ,su , backup with dd, facorty reset, flash fire, flash gapps.

Was having trouble till I read your factory reset part, thank you.
Robert Black, MD
2 months ago
#6566 Quote
you'll give Super User access to your apps. Most times when an app needs root you will get a popup from SU. You can now close SU.  vidmate app  mobdro apk