无人机安全知识地图

阶段 A：能把无人机跑起来
  1.1 构成
  1.2 PX4 / ArduPilot
  1.6 SITL 仿真环境

阶段 B：能看懂它在说什么
  1.3 MAVLink（一）
  1.4 MAVLink（二）
  Pymavlink 入门

阶段 C：能看懂它和 ROS 怎么连
  1.5 ROS → MAVROS

阶段 D：建立安全视角
  1.7 常见漏洞
  2.2 端口侦察
  2.3 数据嗅探 / 指纹 / 分析
  2.1 Wi-Fi 安全审计

阶段 E：进入 MAVLink 安全研究
  MAVLink 安全总述（一）（二）
  传感器型消息欺骗
  状态型消息欺骗

阶段 F：受控注入与任务完整性实验
  注入基础（一）（二）
  起飞与飞行条件分析
  航线篡改 / 任务替换

阶段 G：组件攻击面
  Wi-Fi 服务
  ROS 服务

阶段 H：未知协议分析
  AI 辅助逆向实体无人机通信协议

Ubuntu 24.04 LTS
├── Git / build-essential
├── PX4-Autopilot
├── Gazebo
├── QGroundControl（可选但强烈推荐）
├── Python 3 + venv
├── pymavlink
├── Wireshark / tshark / tcpdump
├── nmap
├── ROS 2 Jazzy
└── MAVROS

sudo apt update
sudo apt install -y \
  git curl wget vim tmux htop jq \
  build-essential python3 python3-pip python3-venv \
  wireshark tshark tcpdump nmap net-tools iproute2 aircrack-ng

python3 --version
git --version
nmap --version
tshark --version

mkdir -p ~/uav-sec-lab/{code,pcap,notes,missions,logs}
cd ~/uav-sec-lab

cd ~
git clone https://github.com/PX4/PX4-Autopilot.git --recursive
bash ./PX4-Autopilot/Tools/setup/ubuntu.sh

cd ~/PX4-Autopilot
make px4_sitl gz_x500

cd ~/PX4-Autopilot
make px4_sitl

help
commander status
mavlink status
uorb top
listener vehicle_status
listener vehicle_attitude
listener vehicle_global_position
param show SYS_AUTOSTART

python3 -m venv ~/uav-sec-lab/.venv
source ~/uav-sec-lab/.venv/bin/activate
python -m pip install -U pip
pip install pymavlink

python - <<'PY'
from pymavlink import mavutil
print('pymavlink import OK')
print('dialect:', mavutil.mavlink.WIRE_PROTOCOL_VERSION)
PY

source ~/uav-sec-lab/.venv/bin/activate

sudo apt update
sudo apt install -y ros-jazzy-desktop ros-dev-tools

echo 'source /opt/ros/jazzy/setup.bash' >> ~/.bashrc
source /opt/ros/jazzy/setup.bash

ros2 run demo_nodes_cpp talker

ros2 run demo_nodes_py listener

# 查看ROS2发行版本
cici@9ue33pro:/tools$ echo $ROS_DISTRO
jazzy
#两个终端都配置source
cici@9ue33pro:/tools$ source /opt/ros/jazzy/setup.bash

sudo apt update
sudo apt install -y ros-jazzy-mavros ros-jazzy-mavros-extras

ros2 run mavros install_geographiclib_datasets.sh

ros2 pkg executables mavros | grep -i geographic

                    Ground Control Station
                        QGroundControl
                              |
                           MAVLink
                              |
      -------------------------------------------------
      |                                               |
Flight Controller    飞控主板                Companion Computer
PX4 / ArduPilot                              Linux / ROS / AI
      |                                               |
      | uORB / Control                                | ROS2
      |                                               |
 IMU / GPS / Baro -------------------------- camera / lidar
      |
  Mixer / Allocator
      |
     ESC   电子调速器
      |
    Motors

传感器采样
   ↓
状态估计 EKF
   ↓
位置 / 速度 / 姿态状态
   ↓
飞行模式 / 导航器
   ↓
控制器
   ↓
控制分配
   ↓
执行器输出

commander      → 状态机、arm/disarm、failsafe
navigator      → Mission / RTL / navigation
mavlink        → MAVLink 通信
EKF2           → 状态估计
mc_pos_control → 多旋翼位置控制
mc_att_control → 多旋翼姿态控制

mavlink status
commander status
listener vehicle_status
listener estimator_status

cd ~/ardupilot
./Tools/autotest/sim_vehicle.py -v ArduCopter --console --map -w

sim_vehicle.py --console --map -w

status
mode
param show ARMING_CHECK

STX
LEN
INCOMPAT FLAGS
COMPAT FLAGS
SEQ
SYSID
COMPID
MSGID (3 bytes)
PAYLOAD
CHECKSUM
SIGNATURE (optional)

HEARTBEAT
SYS_STATUS
ATTITUDE
GLOBAL_POSITION_INT
GPS_RAW_INT
LOCAL_POSITION_NED
COMMAND_LONG
COMMAND_ACK
MISSION_COUNT
MISSION_ITEM_INT
MISSION_REQUEST_INT
MISSION_ACK
PARAM_VALUE

cd ~/uav-sec-lab/code
nano mav_listener.py

from pymavlink import mavutil
from collections import Counter
import time

connection = mavutil.mavlink_connection('udpin:127.0.0.1:14550')

print('[*] waiting for heartbeat...')
connection.wait_heartbeat()
print('[+] heartbeat:', connection.target_system, connection.target_component)

counter = Counter()
last_report = time.time()

while True:
    msg = connection.recv_match(blocking=True, timeout=1)
    if msg is None:
        continue

    name = msg.get_type()
    if name == 'BAD_DATA':
        continue

    counter[name] += 1

    if time.time() - last_report >= 5:
        print('\n=== last interval / cumulative message counts ===')
        for k, v in counter.most_common(15):
            print(f'{k:28s} {v}')
        last_report = time.time()

source ~/uav-sec-lab/.venv/bin/activate
python ~/uav-sec-lab/code/mav_listener.py

Sender
  |
  | COMMAND_LONG
  v
Flight Controller
  |
  | COMMAND_ACK
  v
Sender

GCS                       FCU
 |--- MISSION_COUNT ------>|
 |<-- MISSION_REQUEST_INT -|
 |--- MISSION_ITEM_INT ---->|
 |<-- MISSION_REQUEST_INT -|
 |--- MISSION_ITEM_INT ---->|
 |<------ MISSION_ACK ------|

from pymavlink import mavutil

m = mavutil.mavlink_connection('udpin:127.0.0.1:14550')

interesting = {
    'COMMAND_LONG', 'COMMAND_ACK',
    'MISSION_COUNT', 'MISSION_REQUEST', 'MISSION_REQUEST_INT',
    'MISSION_ITEM', 'MISSION_ITEM_INT', 'MISSION_ACK',
    'PARAM_VALUE'
}

while True:
    msg = m.recv_match(blocking=True, timeout=1)
    if msg and msg.get_type() in interesting:
        print(msg)

Node       节点
Topic      发布/订阅
Service    请求/响应
Action     长时间任务
Parameter  参数

ros2 node list
ros2 topic list
ros2 service list
ros2 action list
ros2 param list

ros2 topic type /某个topic

ros2 topic echo /某个topic

ros2 topic hz /某个topic

ros2 interface show sensor_msgs/msg/Imu

Flight Controller
      |
    MAVLink
      |
    MAVROS
      |
 ------------------------------------------------
 |                   ROS 2                       |
 Topics / Services / Parameters / TF / Nodes

MAVLink ATTITUDE
       ↓
MAVROS plugin
       ↓
ROS geometry/sensor message

MAVLink attack surface
+
DDS discovery
+
ROS nodes
+
Topics
+
Services
+
Companion computer OS

                    +-------------------+
                    | QGroundControl    |
                    +---------+---------+
                              |
                           MAVLink
                              |
+--------------+     +--------v--------+     +-------------+
| Python Lab   |<--->| PX4 SITL        |<--->| Gazebo      |
| pymavlink    |     | localhost only  |     | Physics     |
+--------------+     +--------+--------+     +-------------+
                              |
                           MAVROS
                              |
                    +---------v---------+
                    | ROS 2             |
                    +-------------------+

mkdir -p ~/uav-sec-lab/{pcap,logs,code,missions}

date | tee -a ~/uav-sec-lab/logs/session.log
ss -lunp | tee -a ~/uav-sec-lab/logs/session.log

sudo tcpdump -i lo -nn -s0 -w ~/uav-sec-lab/pcap/px4_lab.pcap udp

tshark -r ~/uav-sec-lab/pcap/px4_lab.pcap -q -z conv,udp

mavlink

01_before.pcap
02_during.pcap
03_after.pcap
notes.md

                 UAV SYSTEM
                     |
   --------------------------------------
   |           |          |             |
 Wireless    MAVLink     ROS/DDS       Firmware
   |           |          |             |
 Wi-Fi/RF   commands    topics        boot/update
             mission    services
             params
   |
 Ground Station / Cloud / Mobile App

硬件漏洞：调试接口未关闭、硬件后门、传感器易干扰、加密芯片缺失。
固件漏洞：未修复开源组件漏洞、固件明文存储、完整性校验缺失、安全启动未开启、调试信息泄露。
通信漏洞：WiFi弱口令（CVE-2023-6951）、MAVLink无认证、ROS无授权、RTSP未授权访问、GPS信号易欺骗。
软件漏洞：ROS节点劫持、MAVROS数据校验缺失、机载计算机Linux系统漏洞、网页服务SQL注入/目录遍历、相机信息泄露/篡改。

ip link
nmcli device status
nmcli dev wifi list

iw dev
iw phy

printf '%s\n' 'password123' 'DroneLab-Weak-2026' 'a-long-random-passphrase' > ~/uav-sec-lab/lab_words.txt

aircrack-ng ~/uav-sec-lab/pcap/own_ap_handshake.cap \
  -w ~/uav-sec-lab/lab_words.txt

# 停止无线网卡服务
sudo airmon-ng check kill
# 开启监听模式（wlan0为网卡名）
sudo airmon-ng start wlan0
# 扫描附近WiFi信号，获取BSSID、信道、加密方式
sudo airodump-ng wlan0mon

# -c：信道，--bssid：目标WiFi MAC，-w：保存握手包
sudo airodump-ng -c 6 --bssid 02:00:00:00:01:00 -w capture wlan0mon

“这是一台无人机”

“这台主机开放 UDP 14550、TCP 22、HTTP 8080；其中哪个属于飞控，哪个属于伴随计算机？”

ip -br addr

sudo tcpdump -i lo -nn udp

sudo tcpdump -i lo -nn -s0 \
  -w ~/uav-sec-lab/pcap/mavlink_session.pcap \
  udp

sudo tcpdump -i lo -nn \
  'udp port 14540 or udp port 14550 or udp port 14551'

tshark -r ~/uav-sec-lab/pcap/mavlink_session.pcap -q -z conv,udp

tshark -r ~/uav-sec-lab/pcap/mavlink_session.pcap \
  -T fields -e frame.time_relative -e frame.len | head

Endpoints
↓
Conversations
↓
Protocol Hierarchy
↓
UDP/TCP stream
↓
Message timing
↓
Payload / protocol fields

格式合法
CRC 基本正确

发送者可信
发送者有权限
消息没有被恶意构造

L1 Transport
UDP / Serial / RF

L2 Framing
MAVLink v1/v2 frame

L3 Identity
SYSID / COMPID

L4 Authorization
谁有权发 COMMAND / MISSION / PARAM？

L5 Operational Safety
飞控是否会因为异常命令进入危险状态？

HEARTBEAT
ATTITUDE
GPS_RAW_INT
COMMAND_LONG
MISSION_ITEM_INT
PARAM_SET

Confidentiality impact
Integrity impact
Availability impact
Authorization requirement

from pymavlink import mavutil

m = mavutil.mavlink_connection('udpin:127.0.0.1:14550')
print('[*] waiting heartbeat')
m.wait_heartbeat()
print('[+] system:', m.target_system)
print('[+] component:', m.target_component)

while True:
    msg = m.recv_match(type='HEARTBEAT', blocking=True)
    print(msg.to_dict())

from pymavlink import mavutil
from collections import defaultdict
import time

m = mavutil.mavlink_connection('udpin:127.0.0.1:14550')
counts = defaultdict(int)
t0 = time.time()

while True:
    msg = m.recv_match(blocking=True, timeout=1)
    if msg is not None and msg.get_type() != 'BAD_DATA':
        counts[msg.get_type()] += 1

    if time.time() - t0 >= 10:
        for k, v in sorted(counts.items(), key=lambda x: -x[1])[:20]:
            print(f'{k:30s} {v/10:.1f} msg/s')
        counts.clear()
        t0 = time.time()

msg = m.recv_match(blocking=True)
print(
    msg.get_srcSystem(),
    msg.get_srcComponent(),
    msg.get_type()
)

GPS
IMU
Barometer
Magnetometer
Optical Flow
Rangefinder
Vision Pose

from pymavlink import mavutil
from collections import defaultdict
import time

PORT = 14660
m = mavutil.mavlink_connection(f'udpin:127.0.0.1:{PORT}')

last = defaultdict(float)

print(f'[*] listening on localhost:{PORT}')
while True:
    msg = m.recv_match(blocking=True, timeout=1)
    if not msg or msg.get_type() == 'BAD_DATA':
        continue

    key = (msg.get_srcSystem(), msg.get_srcComponent(), msg.get_type())
    now = time.time()
    delta = now - last[key] if last[key] else 0
    last[key] = now

    print(
        f'sys={msg.get_srcSystem():3d} '
        f'comp={msg.get_srcComponent():3d} '
        f'type={msg.get_type():20s} '
        f'dt={delta:.3f}'
    )

from pymavlink import mavutil
import time

TARGET_HOST = '127.0.0.1'
PORT = 14660
if TARGET_HOST != '127.0.0.1':
    raise SystemExit('localhost-only lab')

m = mavutil.mavlink_connection(
    f'udpout:{TARGET_HOST}:{PORT}',
    source_system=42,
    source_component=1,
)

while True:
    m.mav.heartbeat_send(
        mavutil.mavlink.MAV_TYPE_QUADROTOR,
        mavutil.mavlink.MAV_AUTOPILOT_PX4,
        0,
        0,
        mavutil.mavlink.MAV_STATE_ACTIVE,
    )
    time.sleep(1)

from pymavlink import mavutil
import time

TARGET_HOST = '127.0.0.1'
PORT = 14660
if TARGET_HOST != '127.0.0.1':
    raise SystemExit('localhost-only lab')

# 故意声明成和 legit sender 相同的 system/component。
m = mavutil.mavlink_connection(
    f'udpout:{TARGET_HOST}:{PORT}',
    source_system=42,
    source_component=1,
)

while True:
    m.mav.heartbeat_send(
        mavutil.mavlink.MAV_TYPE_GCS,
        mavutil.mavlink.MAV_AUTOPILOT_INVALID,
        0,
        0,
        mavutil.mavlink.MAV_STATE_CRITICAL,
    )
    time.sleep(1.3)

sys=42 comp=1 HEARTBEAT ...
sys=42 comp=1 HEARTBEAT ...

正常 GPS 5 Hz
突然出现 100 Hz 同类消息
→ suspicious

t0: lat=31.20 lon=121.50
0.1s 后：lat=40.71 lon=-74.00
→ 物理上不可能

GPS says: east 30 m/s
IMU / optical flow says: almost stationary
→ inconsistency

from pymavlink import mavutil
from math import radians, sin, cos, sqrt, atan2
import time

m = mavutil.mavlink_connection('udpin:127.0.0.1:14550')

prev = None
R = 6371000.0

def distance_m(lat1, lon1, lat2, lon2):
    p1, p2 = radians(lat1), radians(lat2)
    dp = radians(lat2 - lat1)
    dl = radians(lon2 - lon1)
    a = sin(dp/2)**2 + cos(p1)*cos(p2)*sin(dl/2)**2
    return 2 * R * atan2(sqrt(a), sqrt(1-a))

while True:
    msg = m.recv_match(type='GLOBAL_POSITION_INT', blocking=True, timeout=2)
    if not msg:
        continue

    now = time.time()
    lat = msg.lat / 1e7
    lon = msg.lon / 1e7

    if prev:
        dt = now - prev[0]
        d = distance_m(prev[1], prev[2], lat, lon)
        speed = d / dt if dt > 0 else 0
        if speed > 80:  # 示例阈值，不是通用飞行规则
            print(f'[ALERT] impossible-looking jump: {speed:.1f} m/s')
        else:
            print(f'[OK] {speed:.1f} m/s')

    prev = (now, lat, lon)

HEARTBEAT
SYS_STATUS
EXTENDED_SYS_STATE
BATTERY_STATUS
STATUSTEXT

MAV_STATE_ACTIVE

MAV_STATE_CRITICAL

同一逻辑身份在 2 秒内出现互斥状态
→ identity_conflict

格式验证？
身份验证？
授权？
状态机条件？
安全保护？

Level 1：回环协议靶场
不连接飞控，只观察消息接受

Level 2：SITL
连接模拟飞控，验证状态机

Level 3：真实硬件
只允许在明确授权 + 安全场地 + 去桨/约束条件下

from pymavlink import mavutil
import time

HOST = '127.0.0.1'
PORT = 14660
if HOST != '127.0.0.1':
    raise SystemExit('localhost-only')

m = mavutil.mavlink_connection(
    f'udpout:{HOST}:{PORT}',
    source_system=50,
    source_component=190,
)

for i in range(20):
    m.mav.named_value_float_send(
        int(time.time() * 1000) & 0xffffffff,
        b'LAB_TEST',
        float(i),
    )
    time.sleep(0.2)

connected?
↓
health checks OK?
↓
arming allowed?
↓
armed?
↓
flight mode permits operation?
↓
setpoint / mission available?
↓
controller acts

commander status
listener vehicle_status

disarmed
→ arm
→ takeoff
→ hover
→ land
→ disarm

DISARMED
  |
  | arm checks pass
  v
ARMED
  |
  | takeoff
  v
IN_AIR
  |
  | land
  v
LANDED
  |
  | disarm
  v
DISARMED

mode GUIDED
arm throttle
takeoff 10

COMMAND_LONG
COMMAND_ACK
HEARTBEAT
EXTENDED_SYS_STATE
GLOBAL_POSITION_INT

MISSION_COUNT
MISSION_REQUEST_INT
MISSION_ITEM_INT
MISSION_ACK

1. GCS 上传 Mission A
2. 记录 Mission A
3. 本地第二个受控客户端连接 SITL
4. 通过正常 Mission API 上传 Mission B
5. GCS 再次下载任务
6. 验证任务是否发生变化
7. 分析“为什么第二个客户端被接受”

Mission Items
↓
canonical serialization
↓
SHA-256
↓
mission fingerprint

import hashlib
import json

mission = [
    {"seq": 0, "cmd": 16, "lat": 47.0, "lon": 8.0, "alt": 20},
    {"seq": 1, "cmd": 16, "lat": 47.0001, "lon": 8.0001, "alt": 30},
]

canonical = json.dumps(
    mission,
    sort_keys=True,
    separators=(',', ':'),
).encode()

print(hashlib.sha256(canonical).hexdigest())

Wi-Fi router
Linux companion computer
camera server
video streaming
web UI
SSH
MAVLink router
ROS 2

ss -lntup

nmap -sT -sV 127.0.0.1

nmap -sT -sV 192.168.56.20

22/tcp  SSH        → admin plane
80/tcp  HTTP       → management UI
554/tcp RTSP       → video
14550/udp MAVLink  → control/telemetry
DDS ports          → ROS 2 middleware

ss -lntup

sudo ufw status verbose

sudo ufw default deny incoming
sudo ufw default allow outgoing

User Wi-Fi
   X
   | 不应直接抵达飞控控制端口
   v
Gateway / firewall
   |
Companion network
   |
MAVLink router
   |
Flight controller

source /opt/ros/jazzy/setup.bash
ros2 run demo_nodes_cpp talker

source /opt/ros/jazzy/setup.bash
ros2 node list
ros2 topic list
ros2 topic info /chatter
ros2 topic echo /chatter --once

“同一个 DDS 网络里大家都能说话”

“这个 node 只能 publish A，subscribe B，不能调用 C。”

ros2 security --help

ros2 security create_keystore --help
ros2 security create_key --help

Acquire data
↓
Find framing
↓
Find length
↓
Find sequence / counter
↓
Find command / type
↓
Infer payload fields
↓
Find checksum / CRC
↓
Build parser
↓
Build state model
↓
Validate hypotheses

idle
throttle up
yaw left
button A

idle_01.bin ... idle_20.bin
throttle_01.bin ...
yaw_01.bin ...
button_a_01.bin ...

import os
import random
import struct

# frame:
# AA 55 | LEN | TYPE | SEQ | X(int16) | Y(int16) | BAT(uint8) | CRC8
# 学习时假装你不知道格式。

def crc8(data):
    c = 0
    for b in data:
        c ^= b
    return c

os.makedirs('captures', exist_ok=True)

seq = 0
for label, typ, xbase, ybase in [
    ('idle', 1, 0, 0),
    ('forward', 2, 100, 0),
    ('left', 3, 0, -100),
    ('button_a', 9, 0, 0),
]:
    with open(f'captures/{label}.bin', 'wb') as f:
        for _ in range(30):
            x = xbase + random.randint(-3, 3)
            y = ybase + random.randint(-3, 3)
            bat = random.randint(70, 90)
            payload = struct.pack('<BBhhB', typ, seq & 0xff, x, y, bat)
            body = bytes([len(payload)]) + payload
            frame = b'\xaa\x55' + body + bytes([crc8(body)])
            f.write(frame)
            seq += 1

mkdir -p ~/uav-sec-lab/code/toyproto
cd ~/uav-sec-lab/code/toyproto
python generator.py
xxd captures/idle.bin | head
xxd captures/forward.bin | head

xxd -p captures/idle.bin | tr -d '\n' | grep -o 'aa55' | wc -l

cmp -l captures/idle.bin captures/forward.bin | head -30

from pathlib import Path
from collections import Counter

FRAME_LEN = 11  # 逆向过程中这是你的假设，不一定正确

def frames(path):
    data = Path(path).read_bytes()
    return [data[i:i+FRAME_LEN] for i in range(0, len(data), FRAME_LEN)
            if len(data[i:i+FRAME_LEN]) == FRAME_LEN]

for file in Path('captures').glob('*.bin'):
    fs = frames(file)
    print('\n', file)
    for off in range(FRAME_LEN):
        values = [f[off] for f in fs]
        unique = len(set(values))
        common = Counter(values).most_common(3)
        print(f'offset={off:02d} unique={unique:02d} common={common}')

magic/header
counter/timestamp
command/control field
battery/sensor

1. 20 个已经对齐的 frame
2. 每个 frame 的实验动作标签
3. byte offset 变化率
4. 你的猜测
5. 问它“提出可证伪的假设”

Offset 0-1 永远是 AA55；offset2 永远是 07；offset4 每帧+1；
在 forward 样本里 offset5-6 接近 100，idle 接近 0。
请给出三个字段布局假设，并告诉我下一步如何设计实验区分它们。

这串 hex 是什么？帮我破解。

连接本地 MAVLink
↓
列出 system/component
↓
统计 message rate
↓
打印关键状态
↓
检测来源冲突
↓
保存 JSONL 日志

--endpoint udpin:127.0.0.1:14550
--duration 60
--json log.jsonl

Unexpected SYSID
Unexpected COMPID
Message rate spike
Position jump
Impossible state transition
Duplicate/conflicting identity
Unsigned critical traffic（如果环境启用了 signing policy）

[INFO] system 1 discovered
[WARN] HEARTBEAT rate changed 1Hz -> 15Hz
[ALERT] same SYSID/COMPID produced conflicting autopilot types
[ALERT] position jump implies 932m/s

Mission download
↓
normalize
↓
SHA-256
↓
compare with approved hash
↓
audit log

nodes
publishers
subscribers
services
actions
parameters
DDS domain

high-risk bridge node
flight-control related topic
write-capable services
unexpected publisher

ip -br addr
ip route
ss -lntup
sudo tcpdump -i lo -nn udp
nmap -sT -sV 127.0.0.1
tshark -r file.pcap -q -z conv,udp

help
commander status
mavlink status
uorb top
listener vehicle_status
listener vehicle_attitude
listener vehicle_local_position
listener vehicle_global_position
param show <NAME>

cd ~/PX4-Autopilot
make px4_sitl gz_x500

./Tools/autotest/sim_vehicle.py -v ArduCopter --console --map -w

ros2 node list
ros2 topic list
ros2 topic info <topic>
ros2 topic echo <topic> --once
ros2 topic hz <topic>
ros2 service list
ros2 action list
ros2 param list
ros2 interface show <type>

from pymavlink import mavutil
m = mavutil.mavlink_connection('udpin:127.0.0.1:14550')
msg = m.recv_match(blocking=True)
print(msg.get_type())
print(msg.get_srcSystem(), msg.get_srcComponent())
print(msg.to_dict())

★★★★★ 无人机数据流 / 控制链
★★★★★ PX4 Commander / Navigator / EKF 的角色
★★★★★ MAVLink frame / SYSID / COMPID / message ID
★★★★★ HEARTBEAT / COMMAND / MISSION
★★★★★ Pymavlink receive / parse
★★★★★ SITL
★★★★★ tcpdump / Wireshark
★★★★★ 身份认证、完整性、授权、重放
★★★★★ 状态机
★★★★★ Mission 完整性

★★★★☆ ROS 2 node/topic/service
★★★★☆ MAVROS
★★★★☆ nmap / ss
★★★★☆ Linux 网络
★★★★☆ 异常检测
★★★★☆ MAVLink 2 signing 概念

★★★☆☆ Wi-Fi 握手原理
★★★☆☆ ArduPilot 与 PX4 全面源码差异
★★★☆☆ DDS 底层协议
★★★☆☆ 复杂 RF PHY

大规模公网扫描
未授权 Wi-Fi 攻击
无线干扰 / jamming
真实无人机飞行中的注入测试
真实设备去安全限制
固件持久化植入
规避检测技巧