Announcement

Collapse
No announcement yet.

Firmware Caddx Tarsier 4k FPV drone split cam - hi3559v200

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Firmware Caddx Tarsier 4k FPV drone split cam - hi3559v200

    Hi

    I have crashed my Caddx Tarsier V1 drone cam enough times that it will no longer power on, so I decided to de-solder the flash memory and grab the firmware with my CH341A reader.

    Here are details of the camera (V2 but it's the same)
    https://caddxfpv.com/products/caddx-tarsier


    And here is the firmware
    Download caddxTarsierV1_firmware.bin https://1drv.ms/u/s!AstlGSqozNFRgV5b...mfpI-?e=VSev17

    The SOC is a hi3559v200 and it has a 4:3 sensor (12MP 1/2.9") according to the specs.

    I believe they may have intentionally crippled the cameras 4:3 modes to sell more box cams

    Click image for larger version

Name:	Caddx Tarsier Cropping.jpg
Views:	1071
Size:	295.9 KB
ID:	17183

    The above image shows how the 4:3 modes (1920 x 1440 @ 30 and 1920 x 1440 @ 60) are not centered and not sampling the whole sensor.

    Does anyone know where in the firmware this may be occurring and how it may be patched??
    Also can you achieve a wider field of view with a different lens ?

    Cheers
    Greg

  • #2
    Originally posted by sickgreg View Post
    Does anyone know where in the firmware this may be occurring and how it may be patched??
    Also can you achieve a wider field of view with a different lens ?
    Thanks for sharing!
    Sensor regs that set x/y offsets are inside the 'media_app.bin' file which is gzip packed into the 'media_app_zip.bin' in your dump.
    This lens will give you much wider fov: https://www.goprawn.com/forum/lens-a...2782#post12782
    Donate here if you want to support my efforts and this site.

    Email me if you have any offers, requests or ideas.

    Comment


    • #3
      Okay in Linux (Lubuntu) I installed binwalk and all the other packages as per this guide https://github.com/ReFirmLabs/binwal...ter/INSTALL.md
      I then ran
      Code:
      binwalk -e caddxTarsierV1_firmware.bin
      That created these files and directories

      Code:
      346154 6ED950.jffs2 C1AA48.jffs2 jffs2-root jffs2-root-4 u-boot.bin
      5C0000.jffs2 6EF608.jffs2 C20000.jffs2 jffs2-root-0 jffs2-root-5
      60020 70020 C405EC.jffs2 jffs2-root-1 jffs2-root-6
      61170 71170 C467CC.jffs2 jffs2-root-2 jffs2-root-7
      6E412C.jffs2 77188C.jffs2 jffs2-root-3 media_app.bin
      I see media_app.bin, now how do i open that?

      Also this cam has m8 lens not m12

      Comment


      • nutsey
        nutsey commented
        Editing a comment
        This is a binary file. You can open it with a hex editor like flexhex or winhex.

        Oh, M8 thread lenses are much more rare.

    • #4
      This is a binary file. You can open it with a hex editor
      I was hoping you weren't going to say that.

      As well as that .bin file, binwalk extracted a whole bunch of cool stuff. For example; /jffs2-root/fs-2/ where i found the "param" directory containing a bunch of files for example

      config_product_devmng.ini
      config_product_workmode_common.ini
      config_product_mediamode_1080p60_rec.ini
      config_product_mediamode_4k2k30_rec.ini
      config_product_mediamode_1440p60_rec.ini
      config_product_ldcv2cfg_1440p60.ini - (LDC. Could perhaps implement non-linear scaling here maybe??)
      ini2bin_board
      param.bin
      paramdef.bin

      There are a couple of files for each video / photo mode. The .ini are human readable files. So you don't think these xy offset values are somewhere there?
      Any ideas what string to search media_app.bin then?

      Cheers
      Greg

      PS here is jffs2-root extracted https://1drv.ms/u/s!AstlGSqozNFRgV_V...qsMpO?e=uzvejN

      Comment


      • nutsey
        nutsey commented
        Editing a comment
        Sensor regs are right after the 'imx458_write_register' text string.

    • #5
      Hey guys... I am just playing around with the Tarsier, and wondering, do you think their might be a way to output the 4K video other than WiFi? I am thinking somewhere at the board level, it must convert the signal from the sensor to digital and then to IP where its encoded and sent to the phone. Would be really cool if we could find a hardline method for the 4K sensor.

      Comment


      • #6
        a way to output the 4K video other than WiFi?
        That would be cool. I have a lot to learn about this stuff myself so i can only guess you could maybe utilize the chip's HDMI output (though are there pads/pins available?) and tell the firmware to play the stream there. Looking at the brief datasheet, https://www.silicondevice.com/file.u...ta%20Sheet.pdf , it says:

        Video recording mode: 3840 x [email protected] fps encoding for SD card storage + [email protected] fps sub-stream encoding for Wi-Fi VOD or preview

        and it says

        Playback mode: 3840 x [email protected] fps decoding + HDMI 3840 x [email protected] fps for TV display

        I think that even if you could physically connect somewhere, you can only see 720p preview anyway. Like i said though i am just taking guesses.

        Sensor regs are right after the 'imx458_write_register' text string
        I've been looking through hi3559v200 SDK and documentation to try to learn about this stuff but really I don't know much.

        Here is a screenshot of the hex editor, I copied and pasted a section of the file right after the string 'imx458_write_register' (actually there's meant to be one more 00 at the start). On the right is the Caddx Tarsier and on the left is the V50 action cam. I don't know how many bytes are these so called XY regs or in what format they are or what they are or what they should be...


        Click image for larger version

Name:	V50,Tarsier XY regs small.png
Views:	876
Size:	644.0 KB
ID:	17262‚Äč


        Do you know how the XY regs are encoded and how i can make sense of them?
        Also the Caddx Tarsier has FFFF every 10 bytes in this section of the file but the V50 does not. I wonder why that is (?)

        I'm a bit clueless but hopeful.

        Greg
        Attached Files

        Comment


        • nutsey
          nutsey commented
          Editing a comment
          Which 3559v200 SDK version do you have?

      • #7
        Hi3559V200_MobileCam_V1.0.1.2

        Comment


        • nutsey
          nutsey commented
          Editing a comment
          The IMX458 sensor regs are here: Hi3559V200_MobileCam_SDK_V1.0.1.2\amp\a7_liteos\mp p\component\isp\user\sensor\hi3559v200\sony_imx458 \imx458_sensor_ctl.c

          Most of those are the same with other modern Sony sensors, but a tech datasheet for the sensor is needed to get into the nuts and bolts.

      • #8
        Thanks.
        Have you got a link to imx458 data sheet?
        Does having the function imx458_write_register appearing in the binary tell you that that is what sensor the camera uses, or could it be something else and still keep that function name?

        Comment


        • nutsey
          nutsey commented
          Editing a comment
          Unfortunately I don't have this datasheet.
          In theory it can be named improperly, but I think this type of fraud is not very common.
      Working...
      X