Introduction: The problem

In june 2019 DJI released the RoboMaster S1, aimed at introducing robotics to young children,
the programming freedom is limited to the accompanying app which supports scratch-blocks and a limited version of Python.

About a year later DJI released the RoboMaster EP, standing for Educational Pack. It's release was accompanied with an open source Python SDK that runs on another computer and connects to the robot using simple TCP/UDP network traffic.
Naturally we (and many others) assumed the API was for the whole RoboMaster lineup, but unfortunately it isn't and the S1 simply refuses to connect.
The community has found the two models to be technically very similar and DJI could probably add the feature with a firmware update, DJI's motivation to not do so is outside the scope of this project.

Hacking the S1

Click for video:

This demo is from @Bruno Albuquerque who is at the forefront discovering the S1's true potential. He has published a guide on his website:
https://www.bug-br.org.br/s1_sdk_hack.zip
The guide is easy to follow, includes all the needed files (it isn't that much), and an explanation how and why the hack works.
This seems to have become the basis in the community, multiple examples can be found around the internet where people have successfully applied the hack.

By adding the API, the user can control all the actuators and read all the sensors (including the vision module).
The app still works as normal and recognizes the robot as an S1.

How it works

The RoboMaster app allow users to execute Python code on the robot, the Python interpreter is limited but DJI left a spot open which can be used to import the Python build-in modules, subprocess can be used to execute commands and discover some things:

1. RoboMaster robots run android 4.4
2. The Python subsystem runs with root privileges

ADB (Android Debug Bridge) is a great tool for developers to debug Android systems, the robot can be connected via usb and with the prior knowledge the following code can be executed in the app to enable ADB connections:

def root_me(module):
    __import__=rm_define.__dict__['__builtins__']['__import__']
    return __import__(module,globals(),locals(),[],0)

builtins=root_me('builtins')
subprocess=root_me('sub'+'process')
proc=subprocess.Popen('/system/bin/adb_en.sh',shell=True,executable='/system/bin/sh',stdout=subprocess.PIPE,stderr=subprocess.PIPE)

Then uploading SDK files from the RoboMaster EP, with minimal modifications for the S1, adds the API on the S1.
(As you can see DJI could add these files with a simple firmware update.)

Risks

The procedure has been done by multiple people and I haven't found anyone where this hasn't worked,
but there is of course a risk something will break, plus warranty will probably be voided.

Another risk is that DJI might patch it and prevent users from getting future updates, this was also Bruno Albuquerque's concern,
but to be fair this hasn't happened yet while it's been public for 7 months as of now, and there have been firmware updates from DJI.

Sources

Albuquerque, B. (2020, June 27). Robomaster S1 with EP SDK: Ball Tracking Demo. DJI FORUM. Retrieved November 11, 2021, from https://forum.dji.com/thread-219160-1-1.html.

Albuquerque, B. (2021, March 3). r/robomasters1 - robomaster S1 SDK hack. Reddit. Retrieved November 11, 2021, from https://www.reddit.com/r/RobomasterS1/comments/lwx45c/robomaster_s1_sdk_hack.