Uten 4K - Need help dumping the Rom

[flaep]

Hi,

it recently purchased a Uten 4k and struggle to dump the ROM. It appear like the dd executable is not Part of the FW.
The overall behaviour is strange.
I can download any file from the filesystem by pointing a browser to it.
If I connect to the cam via wifi and for open "http://192.168.100.1/system/etc/settings.xml" it will download the settings.xml that is located in /system/etc/.
This works for any file I tried so far.

I also tried all day to capture the live stream with vlc, but the camera appears to only stream to the IP of the client running the app. Wireshark and Logcat are available.


Since the get info script fromt the big allwinner thread does not work, here is what i found out different other ways:

there is a info.xml file:

<?xml version="1.0" encoding="UTF-8"?>

<Infos>

    <Short>zhongxing</Short>

    <ProductType>0</ProductType>

    <ModelType>1</ModelType>

    <ScreenStruct>2</ScreenStruct>

    <SensorType>imx179s</SensorType>

    <ScreenType>st9341fxst</ScreenType>

    <CamType>lp6182</CamType>

    <FirmDate>20170720</FirmDate>

    <SubClient>zhongxing</SubClient>

</Infos>

Firmware:

Model: (there no name, its just blank)
Version: 20180426V3.3
Updated: 20180426
Manufacturer:(empty too)

PhoenixSuit:

Model: weishidaikang1gddr175-sdv
Firmware version: weishidaikang1gddr175_sdv-eng 4.2.2 JDQ39 eng.dv003.20180412.112...
Compile date: W. Europe Summer Time 2018-4-12 5:23: 6
Android: 4.2.2
Chip Type:Unknown CPU
Kernel version: Linux Version 3.4.39  ([email protected])

and it looks like this:

[Atarii]

I have this device. You can make a backup of the firmware by doing the following:

adb pull /dev/block/mtdblock0 0-uboot.img
adb pull /dev/block/mtdblock1 1-boot.img
adb pull /dev/block/mtdblock2 2-system.img
adb pull /dev/block/mtdblock3 3-config.img
adb pull /dev/block/mtdblock4 4-blogo.img
adb pull /dev/block/mtdblock5 5-slogo.img
adb pull /dev/block/mtdblock6 6-env.img

(assuming that adb is in your local Windows/Linux path and the current directory is writeable)

Alternatively, you can upload a busybox binary (such as https://busybox.net/downloads/binari...busybox-armv7l) and use that directly on the device too

[petesimon]

flaep - try this backup process and the script shown in the video https://www.youtube.com/watch?v=QrhPxpFFMrc
also try this other backup script http://pc.cd/mBq7

As Atarii said, you could use busybox dd commands after copying a busybox armv7l binary to the camera.
https://busybox.net/downloads/binaries/1.21.1/

[flaep]

Thank you for your replies. It worked.

I figured out the busybox executable way myself and just tried the adb way. Both worked.

I do however have one more partition and the sizes are different.

cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00001000 "uboot"
mtd1: 00280000 00001000 "boot"
mtd2: 00480000 00001000 "system"
mtd3: 00050000 00001000 "cfg"
mtd4: 00010000 00001000 "boot_logo"
mtd5: 00010000 00001000 "shutdown_logo"
mtd6: 00010000 00001000 "env"
mtd7: 00010000 00001000 "private"

When I try to use any unfex scripts it failes with the following error message:

UNFEX.BAT full_img.fex unpacking script by nutsey for GoPrawn.com

error: input file E:\cam\unfex-scripts\full_img.fex has a size of 8126464 bytes, cannot copy requested part.
1 errors occurred.
error: input file E:\cam\unfex-scripts\full_img.fex has a size of 8126464 bytes, cannot copy requested part.
1 errors occurred.
error: input file E:\cam\unfex-scripts\full_img.fex has a size of 8126464 bytes, cannot copy requested part.
1 errors occurred.
error: input file E:\cam\unfex-scripts\full_img.fex has a size of 8126464 bytes, cannot copy requested part.
1 errors occurred.
error: input file E:\cam\unfex-scripts\full_img.fex has a size of 8126464 bytes, cannot copy requested part.
1 errors occurred.
Done. Check REFEX folder for extracted files.
Press any key to exit...

uboot and boot are extracted, but the rest not. I can also get the script.bin. I guess the script needs to be modified to fit the sizes.

Here is a link to the full_img.fex https://www.dropbox.com/s/fre2ekv5rp0jrk1/full_img.fex?dl=0

[nutsey]

Thanks for sharing!

SoC:
Allwinner V3
Product:
crane1gddr4k30imx179s-sdv
Manufacturer:
lzm
Short id:
zhongxing
OEM id:
zhongxing
Camera type:
lp6182
FW orig. date:
20180102
FW mod. date:
20170720
Camera name:

Version:
20180125V3.3
LCD model:
st7789v
LCD resolution:
320x240
LCD count:
2
Sensor model:
imx175

[Atarii]

I think I had to use the unfex-scripts-getfwinfo_20171029_small_fw tool instead (found from https://4pda.ru/forum/index.php?showtopic=876889&st=360)

[nutsey]

Atarii It works with 8388608 firmwares, not 8126464.

[flaep]

nutsey do you have aworking unfex script for this firmware? i want to add and remove some files, but iam not sure how to tell what the right values for unfex and refex are. thank you for time, guys.

[Atarii]

nutsey - ah yes you're right, I think I actually used binwalk in the end.

flaep More testing needed on the script

[petesimon]

everyone:
thanks to nutsey, i modified the unfex-refex script to work with 8126464 bytes full_img.fex
download here - https://www.dropbox.com/s/6n6f4i8r3u...26464.zip?dl=0
read the "readme-small_fw_8126464.txt" file

flaep - your unpacked firmware data is also here - https://www.dropbox.com/s/63q6k7tqb3...radio.rar?dl=0