Toy drones are everywhere. You can pick up an Eachine E88 or E58 for under $30, fly it around your living room, and have a decent time. But what happens when the official app stops working, the manufacturer disappears, or you simply want to understand what’s actually happening between your phone and that spinning plastic in the air?
That question is what started this project.
The Goal
Build a fully custom WiFi flight controller for Eachine E88/E58 toy drones, running on an M5Stack AtomS3 attached to an M5Stack Atomic Battery Base — a compact ESP32-S3 assembly with a built-in LCD, RGB LED, LiPo battery, and a single face button. No phone required. No official app. Full control over every byte sent to the drone.
The complete build process for the black drone — which we called Maritaca Force 1 — is documented in a YouTube playlist where you can follow the project from the very beginning, including hardware assembly, initial tests, and first flights. Watch the Maritaca Force 1 build playlist on YouTube.
The Hardware
M5Stack AtomS3 + Atomic Battery Base
The AtomS3 is a compact development board built around the ESP32-S3 (240 MHz dual-core, 8 MB Flash, 2 MB PSRAM), attached to the M5Stack Atomic Battery Base which adds a LiPo battery and an IP5306 power management IC. Together they form the controller unit used in this project:
- Built-in 0.85″ 128×128 LCD (GC9107 driver, SPI) — small but enough for a real flight HUD
- Built-in RGB LED via M5Unified
- One face button (BtnA, GPIO 41) — the entire UI runs through this single input
- WiFi 2.4 GHz built in — connects directly to the drone’s access point
- LiPo battery via Atomic Battery Base — USB-C charging, fits in one hand
- Battery level read directly via I2C (
0x75) — no extra library needed, just two register reads
The Drones — Eachine E88 Clones
Both drones are E88 clones that expose a WiFi access point, stream MJPEG video over UDP, and accept flight commands via UDP packets using a protocol derived from the Eachine E58 family.
We have two drones in this project:
- Maritaca Force 1 (black drone,
WIFI_8K_variant) — 8-byte UDP packets on port 8090 - Dr.One (grey drone,
FLOW-WIFIvariant) — 88-byte wrapped packets on port 8800, with optical flow altitude hold
Both were fully reverse-engineered from packet captures. No SDK, no documentation.
The Build System
The firmware is written in C++ using PlatformIO and the Arduino framework, targeting the m5stack-atoms3 board. The only external library dependency is M5Unified — everything else (WiFi, BLE, UDP) comes from the ESP32 Arduino core.
Why Not Just Use the App?
- The official apps are garbage. Laggy, ad-infested, and they break with OS updates.
- Learning. Reverse engineering a proprietary UDP protocol from packet captures is a genuinely interesting exercise.
- Control. Once you own the protocol, you can do things the app never supported — like controlling the drone with a physical BLE gamepad, or using the board’s accelerometer as a tilt controller.
- The AtomS3 fits in your pocket. A dedicated hardware controller with a real display is more satisfying than a phone app.
What’s Coming in This Series
- Part 1 (this post) — Hardware and motivation
- Part 2 — Reverse engineering the UDP protocol with packet captures
- Part 3 — Firmware architecture: HAL pattern, non-blocking loop, flight state machine
- Part 4 — Accelerometer tilt control
- Part 5 — BLE HID gamepad host on ESP32 (iPega PG-9021S)
- Part 6 — Second drone: FLOW-WIFI reverse engineering
Enjoy
[]’s
PopolonY2k
2 thoughts on “Building a Custom Drone Controller from Scratch — Part 1: Hardware and Motivation”