Apeman A70 original firmware/flash dump

[ipdown]

Hello all, I have dead A70 action camera that does not turns on. It charges the battery, but does not shows any signs of activity and does not respond to button presses.
I still have to unsolder the flash and read it to see what is inside the chip. Other than that, the cam is based on NT96655 and the image sensor is marked as GC2023-V2.0. The flash chip is marked 25Q32FVSIG,
which should be 32 Mbit / 4MB, and I have a hardware that should be able to read/program it. There is a chance the the camera has some HW problem, but still I would like to try reprogramming it with a fresh firmware, and who knows, that could do the trick. So, if anyone has the firmware for that cam I would be very grateful to get it. I tried to contact Apeman support by email, they responded, but asked me about the FW version that is currently on the camera, and I couldn't tell it as the camera is dead. Even if they gave me the FW update, it is not an flash image, and must be something packed/encrypted, so that is of not use.

Thank you!

[nutsey]

Hi,

Could you share the flash chip dump?

[ipdown]

Sure, I will. I am on a vacation trip, in a few days I will be back home.
Is there a way to find out if a flash dump is intact and not corrupted? Like CRC/checksum somewhere? I want to believe that my camera have software problem, and not bad hardware,
because it worked nicely before going to the box for few months. After that it refuses to start at all. Batteries are charged, measured 4.2v each.

[nutsey]

Is there a way to find out if a flash dump is intact and not corrupted? Like CRC/checksum somewhere?

You can crop the firmware from your dump and use the ntkcalk tool from here: http://dc.p-mc.eu/tools/novatek/cmd

[ipdown]

Here is my dump, not had any time yet to check it out with ntkcalk:

https://ipdown.net/tbd/apeman_a70.bin

The file sha256 sum must be: a11fc25c8842a816e1d985fc124180a921c0904244577000eb 12040f29dffa04

Linking it because even zipped it cannot be directly attached because of size.

If anyone can check for me if the file looks OK (checksums, etc..) I would be very grateful.
In case it is corrupted, it would be nice to get working copy, or maybe compatible firmware from other cam, if that is possible at all.

[ipdown]

The file seems to be OK, I successfully extracted both partitions, second one is bigger has a lot of string refs to eCos, some HTMLs and JPEG files according to binwalk.
Some readable strings found in the first partition:

R/W error
Loader check fail
FW check fail
FullComp
NonComp
655B_DDR3_LV1_3_1024Mb 05/18/2015 10:46:40
fail
Ua Ldr
rd fail
verify fail
Ud FW
!!FW CODE SIZE > FLASH SIZE!!
RFlsh
FCompress
flash open fail
PCmp
Nrml
F compress
LD655
FW96655A.BIN
LD96655A.BIN
FW96655T.BIN
Loader NT96655 Start ...
FW96655C.BIN
I-S-M
FAT16
FAT12
FAT32
OCR timeout
spi flg ERR
MID=
TYPE=
,SIZE=

If the file is OK, then it must be faulty hardware

[nutsey]

Yes, your dump looks just fine. Recheck all ribbon cables.

[ipdown]

Some pics from inside follows

Sensor module with lens:



Wifi module:


Buttons and front (sensor) side:


Back (LCD) side:


All the mess:

[ipdown]

You mean you saw in the somewhere in code of firmware file that the sensor is IMX206? And that does not matches with what is on the ribbon cable of the sensor?

[nutsey]

I was wrong, your dump is for GC2023. My fault.

[ipdown]

What is in the first 2348 bytes of the flash image? Is it executable code?
I see some test pads on the pcb, could it be uart for debugging, hmm. will check it tomorrow