Non-root shell access options

[milenovic]

Is there any way to have non-root adb shell on Air2S?
I know of drone-hacks that grants root adb, and that works very well.
But I am more interested in testing some privledge escalation ideas myself.
Is there an easy way to run user level code or is this a secret exploit in its own right?

[andrezaolucas]

Adding some findings from the RC701 (wa345t / Matrice 4T) which might be relevant here.

The RC701 has ADB shell accessible as uid=shell (non-root), SELinux permissive. So the non-root access question is the
same starting point.

Privilege escalation attempts all blocked:

• eBPF LPE: kernel 5.4.210-qgki has the patch (R3 pointer arithmetic out of range, prohibited for !root)
• Frida Server: connects fine but ptrace ATTACH to root PIDs denied even with SELinux permissive (cross-uid block)
• adb root: blocked at adbd level

What I'm exploring next for LPE:

• EDL via PCB pads, QCS5430 (lahaina) is supported by bkerler/edl
• UART debug port, issue DJI Smartcontroller SDR UART debug port #270 confirmed read-only on RM500, curious if RC701 differs

Also confirmed: once root is achieved, dummy_verify.sh from o-gs/DJI_FC_Patcher is the correct approach — no private
key needed, just replace /vendor/bin/dji_verify with the wrapper.

Happy to share more technical details if useful.