Firmware mod request: Crosstour CT9500 (Hi3559v100)

[Philaphlous]

Here's a link to a review with a firmware update zip: https://www.wagex.org/?p=263

I'd like to increase the bite rate of this camera and I'm not sure where to start with the firmware mod. I've been reading other threads on how to do it but I'm still lost...I'd really like some help??

I supposedly ordered the f500 soocoo which is supposed to be an imx458 + hi3559v200 setup. Excited to do a full teardown of it to confirm.

[nutsey]

Which CT9500 version do you have? Older 4K30 or newer 4K50?

[Philaphlous]

Older 4k30. Wish I had the newer one...

[Philaphlous]

I don't think the GETFWINFO script works for the firmware for the CT9500... I've tried to play around with it with no luck... I'm not sure how to get a backup other than the zip newer firmware that i provided in the link above...

[nutsey]

You'll need to patch the 'paramdef' file with a hex-editor. Are you able to do it?

[Philaphlous]

I actually just cancelled my order for the SOOCOO F500 and I think I'm going to get the newer CT9500 instead. It's like a $5 difference so why not..plus I'll get it WAY sooner and I believe the specs more than the SOOCOO F500.

[nutsey]

It would be great to see the difference between old and new cams.

[Philaphlous]

I'll let you know. I get the camera tomorrow hopefully. I'll do an in depth review, Im very curious to see what chip it uses because the hi3559v200 doesn't support 4k above 30fps... Neither does the imx377... So a teardown is coming too.

[nutsey]

"Neither does the imx377"
It can work at 12M 60 fps suitable for 4K60 with EIS.

[Philaphlous]

You were right...


Is there any way I can edit the bitrate through the hex editor or do I still need something to unpack it more? I'm not sure what to look for...


FYI this is for the hi3599V200 chipset

[nutsey]

Could you please share this firmware?

[Philaphlous]

https://drive.google.com/file/d/13he...ew?usp=sharing

[nutsey]

Thank you! The sensor is IMX458. 4K50 is most likely to be fake.

[nutsey]

The 4K50 version is slightly more complicated to modify than the 4K30 one. Can you confirm that default h.264 bitrate for 1080p30 is 46 Mbps?

[Philaphlous]

Here's the link to the unpacked .bin file: https://drive.google.com/file/d/1gVn...ew?usp=sharing

Bitrate is as follows: https://drive.google.com/file/d/17_B...ew?usp=sharing
Looks like its: 46635kbps as you stated....

[nutsey]

Can you please share a 4k50 footage raw sample (not youtube)?

[Philaphlous]

I'll upload that here soon. Do I need to unpack the jffs2 file to get at the bitrates? I haven't seen anything yet in the bin that references particular bit rates for a particular camera setting...

Here it is: https://drive.google.com/file/d/16ES...ew?usp=sharing (This is 4k30fps btw)

[nutsey]

You've got two ways to modify bitrates here:
1. Unpack 'rawparam' file, edit it and repack it back.
2. Unpack 'appfs.jffs2', edit '/param/paramdef' file and repack jffs2 filesystem.

[nutsey]

Older CT9500s have this 'paramdef' file already in unpacked state included into fw update package.

[Philaphlous]

What would be the easiest way to "unpack" these files? I've started to look into this specifically for the jfffs2 and it looks like there's a Ubuntu program called jefferson that might accomplish that?? I'm on windows 10 so I'm literally just using a hex editor...7zip or notepad to look at the files...not sure where to start

[Philaphlous]

The only thing I see in the "rawparam" is the camera settings like 4k50 4k30 h265 h254 etc.... nothing about bitrate. I'm guessing like you said its going to be in the jffs2 file which I'm trying to create a bootable usb stick for ubuntu so I can try and unpack it...

[nutsey]

The 4k30 bitrate value (little endian) for h.264 is at 0x22B4, the next dword is for h.265.

[Philaphlous]

Where are you seeing that?
This is what my hex looks like: https://drive.google.com/file/d/1oag...ew?usp=sharing

[nutsey]

Yes, it's right there. Check the dword at the 0x22B4 offset. It's 0x0000C800 = 51200 Kbps...

[Philaphlous]

ok I think I see what you mean...so I just increase the 51200 to say 60000 and start from there?
https://drive.google.com/file/d/17ZI...ew?usp=sharing

[nutsey]

Exactly! This hardware should handle bitrates up to 100 Mbps with EIS off. Make sure to use a memory card fast enough to do the job.

[Philaphlous]

Hmmm... I'm just trying to flash the stock firmware and I'm unzipping the files...coping all the files into the SD card and then turning the SD card on after putting it into the camera and it just boots up like normal....

[Philaphlous]

I'll format the SD card from the camera...take it out, load each file into the root folder of the SD card (not into the DCIM folder) and put it back in the camera...nothing happens...

[nutsey]

You need to find out how to turn your device into recovery mode.

[Philaphlous]

So when I extract the rawparam with 7zip I get a rawparam~ file... How do I re-pack it into the original rawparam after I've made the change to that particular value? I'm guessing the firmware isn't recognizing that its a different serial number so it's not actually updating the firmware... I'm wondering if I have to find a way to change the version of the firmware in order to prompt it to update...

[Philaphlous]

When I try to repack the rawparam~ file into the rawparam that's open in 7zip I get a "Not implemented" error and it doesn't seem to work... Also, in the rawparam~ file, the hex specifically names the firmware version, which is currently "V4.1.0.2-A". I've modified that line to say "V4.1.0.4-A" hoping that it will prompt an update...wondering if that will fix the firmware to flash...

[Philaphlous]

So 7zip gives me the yellow.! With an error that says "there is some data after the payload data". I've tried another program, renaming it a.rar and.zip and none of it fixed the issue... Can I just delete the ~ at the end of the rawparam and give that ago without repacking it? I can't get 7zip to repack it so I'm kinda at a loss.... I emailed crosstour that sent me the original firmware. Their flash instructions were just to format the SD card then turn it on with the firmware files and it should flash... I think it's seeing that it's the same version and not flashing...maybe I should ask them for an older version of firmware?

[Philaphlous]

Has anyone ever tried the autoexec.ach on a crosstour dash cam or is that something specific to yi cameras? I'm wondering if I could mod the bitrates with something like this: https://dashcamtalk.com/forum/thread...5/#post-439161

[nutsey]

autoexec.ash hacks work only with Ambarella cams. Here we can add similar feature by calling a bash script with himm commands for memory patching during init.

[Philaphlous]

OK! I've been doing research on the bash script...looks like it might be able to work.. I have a test platform with my old CT9500 so I think I'll test the scripting with that before I move it over to my new camera... Here's the link again to the OLD camera firmware: https://drive.google.com/drive/folde...41?usp=sharing
I've searched for 512000 has a integer number but I get like 6 different values in the paramdef file.. I'm not sure which one actually edits the bitrate according to this set of firmware... I think I can use a sed command in the bash file to edit the hex value of this file... I just need to know what I'm looking for...

[nutsey]

Here is your older paramdef with doubled 1080p30 bitrates : https://drive.google.com/file/d/1NVq...ew?usp=sharing

[Philaphlous]

IT won't let me flash anything on the old camera... I'm guessing it has something to do with the config file at the beginning of the firmware? Like the quiet function or something that's kicking out if the firmware version is the same...?

[nutsey]

Do you know how to get into recovery mode?

[Philaphlous]

Still haven't been able to find the recovery mode.

[nutsey]

Can't help you with it as I don't have this device.

[Philaphlous]

FINALLY! I went for it (on the OLD CT9500) and changed the firmware version at the end of the paramdef and paramdef.bak. I changed them to something like V2.5.0.5-A and it flashed!!! I'm trying your firmware on the old camera now. Seems like if there's a significant firmware version number change it'll flash... Now for the new camera firmware... I'm not sure how to address it since the paramdef is within some type of zip file...I'm not sure if I should unpack it and just rename it without the ~ and give that a try with the new firmware number change???

Edit: I just tried your firmware and I believe it just bricked my older CT9500...RIP... I don't think I'll be able to reflash the old firmware...
The light still blinks blue on boot as it normally does but it doesn't boot...just black screen. I've tried flashing back the firmware but maybe it actually doesn't flash bc it's the same version...I'll keep trying.

[Philaphlous]

SO update.... I'm not sure about unpackaging the files then trying to flash them... I cannot repackage them in 7zip so I'm not sure if I Can flash them without repacking them with the same file name... Last thing I want to do is brick my camera like I did the older one...

I think the biggest thing is the actual lens... its so wide and there's so much distortion that if I had a better one it would make a world of a difference. I still have my stock lens from my older CT9500 which I don't think is much better but once i get my new 3.8mm lens which I ordered 2, I'll give all 3 a try... I'll have to entirely disassemble the camera but the good news is I can focus the lens with my laptop and using it as a webcam! So that will be incredibly easy which was my biggest worry!

[Philaphlous]

Quick update on this. Nutsey...I still need help...

I'm able to write script in a bash.sh file and the problem is when I turn my camera on...I can switch from video to photo mode but I can't record or take pictures with the script or go into the settings... once I take the card out and swap it..it works just fine... so I know the code is doing something at least...

Here's what I think is going to edit the bitrate... I just don't know the syntax order...

This is the code in Notepad++ bash.sh

case
constexpr static const VENC_H265_CBR_S defH265Cbr =
{
.u32BitRate = 20480
};
constexpr static const VENC_H265_VBR_S defH265Vbr =
{
.u32MaxBitRate = 20480
};

constexpr static const VENC_H265_AVBR_S defH265AVbr =
{
.u32MaxBitRate = 20480
};

break;

[nutsey]

This is the code in Notepad++ bash.sh

case
constexpr static const VENC_H265_CBR_S defH265Cbr =
{
.u32BitRate = 20480
};
constexpr static const VENC_H265_VBR_S defH265Vbr =
{
.u32MaxBitRate = 20480
};

constexpr static const VENC_H265_AVBR_S defH265AVbr =
{
.u32MaxBitRate = 20480
};

break;

This does not look like a bash code. Where did you get it?