Reversing Novatek NT966xx firmware.

[nutsey]

Managed to compile a command line tool capable to pack/unpack firmware files used by Novatek based cams. Now I can see another possible way of hacking NT based products with SPI NOR flash contents modifications.

[nutsey]

Here is the command line tool for unpacking Novatek FW .bin files: https://drive.google.com/file/d/0B4t...ew?usp=sharing
This tool works with firmware files containing one packed file. You'll have to split your files if it is more than one FW combined into the file.
Password for archive is "GoPrawn.com".

Based on BFC tool from BCL package by Marcus Geelnard.

[juniornove]

Can someone help me? I put a microsd on sjcam m20 with the firmware sj6legend, the m20 locked, tried to put the electronic device of the m20, but does not recognize

[nutsey]

Did you flashed your M20 cam with SJ6 firmware?

[nutsey]

WinXP driver for older Novatek devices.

[Parffilm]

Win7 driver for Novatek 96660.upload please.I will be grateful for any help you can provide.

[nutsey]

Do you have USB flashing software for it?

[Parffilm]

No.I have only F68 with black screen after unsuccessful upgrade.

[nutsey]

You can try flashing this dump (F68 and SOOCOO C30 are VERY similar inside): https://drive.google.com/file/d/0B4t...ZIYVNDRVE/view
But you'll need to desolder flash IC and upload dump image into it with a USB SPI programmer.

[Parffilm]

May I write in section,part for Russian.

[nutsey]

I'm glad to have a dump of a Novatek 660 firmware (thanx regzno and MSW users from 4pda):
https://drive.google.com/file/d/0B4t...ew?usp=sharing

Dumped from MX 25L3206E flash chip. Should work with IMX078 equipped Elephone Explorer Pro, SOOCOO C30 V1.0, Discovery Adventures DS300 and one of SJ8000 compatible.

[Pruikki]

what to do with this? any programs to open it up?
i have half broken SJ8000 to test hacking on with
что вы думаете

[nutsey]

You need a SPI programmer and basic soldering skills to flash this dump into proper SOC8 IC chip.

[Pruikki]

So...not possible then. need some real modding. well damn.
thank you sir!

would ambarella A9 with Xiaomi yi 2 be possible to edit?(bitrates) in theory , what do you think?

thanks!

[nutsey]

A9 has limited script functionality but it's possibe to patch a FW to add this feature.

[kotysoft]

Hi there.

nutsey how can I pack fw back?

[nutsey]

Novatek chips support both packed and non-packed firmware files so there is no need to pack it back.

[kotysoft]

So, in theory, I just have to rename it to FIRMWARE.bin, copy to SD and it will update as usual? Did you already tried it?

[kotysoft]

0903 nanoQ dashcam (Novatek 96655) just ignoring the unpacked firmware.bin

[nutsey]

I suppose the boot loader compares the checksum and doesn't let it to be flashed.

[AntiVirGear]

http://imgur.com/a/54zdC

This doesn't looks like Novatek!
It says "SPCA6330M-HHM11"

[nutsey]

@AntiVirGear Yep.

[nutsey]

DENOVA script for unpacking Novatek NT96650/NT96660-series SoC firmware. See readme.txt.

https://drive.google.com/file/d/0B4t...ew?usp=sharing

[nutsey]

Here is very interesting SoC model list from recent unpacked FW for NT96660 chip:

• NT96660
• NT96663
• NT96665
• NT96668
• NT96665YI
• NT96668YI
• NT96660YI
• NT96022YI
• NT96663YI

[dincekara]

Hi, i have a sjcam m10 <novatek 96650> . its frezze on logo when startup. i try all fw and loader bin files but there not fix it. can u help me?

[nutsey]

What was the cause for this camera behaviour?

[dincekara]

i dont know maybe wrong fw

[[email protected]]

DENOVA script for unpacking Novatek NT96650/NT96660-series SoC firmware. See readme.txt.

https://drive.google.com/file/d/0B4t...ew?usp=sharing

Hi there,
good to see someone made progress while I lost interest in it. I have holidays now and some sparetime and would love to get back into it. Tried downloading your unpacker, unfortunately gdrive thinks it is infected and prevents any downloads. Could you mirror it somewhere?

EDIT: Ok, managed to get the file through a 3rd party google drive application, its basically a wrapper for bfc, right?

[nutsey]

Yes, it is based on modified bfc (several bugs were fixed in order to get it working). The main issue now is to find out how to calculate the checksum.

[nutsey]

By the way, I'm not 100% sure, but it seems like extracted FW parts can be flashed back after editting in unpacked form.

[[email protected]]

I'm on the checksum part right now. I'm starting with finding out which area of the binary is used to calculate it. But it's behaving weird..

[nutsey]

Good luck! Hope you will manage to reveal how it works. I gave up after 3 days of trying

[[email protected]]

Just took me an hour to realize that the DWORD before checksum is the binary filesize haha

[nutsey]

Yes, but for some stupid reason the loader does not compare this value before flashing. That's why there are so many bricked Novatek devices.

[[email protected]]

There are many bricked NTK devices? Didn't know that. I'm trying to flash firmwares with random bits flipped but the loader wont accept it due to checksum fail.. even changing some zero bytes in the header before the checksum results in a invalid firmware: So I assume all bytes except the ones from the checksum are used to calculate it.

"NPT
Loader B40SB Start ...

655B_DDR3_LV1_3_2048Mb 09/26/2015 09:27:27

RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR RRRRRRRRRRRRRRNonComp

FW check fail"

[nutsey]

There are some dead bricked NTKs, not 'so many' indeed. My mistake.
Here is an example: 660 based Soocoo C30 and its clones were switched to V2 hardware revision at once (they had to use different SPI memory chips, twice capacity) so when you try to flash the older V1 hardware with a firmware intended to use with newer version the cam gets bricked. I mean the problem was not in checking the checksum with the loader, but in not comparing the FW file with the hardware presented.

[[email protected]]

Oh I see. I get it now. But same applies to ambarella firmwares afaik.

Seems like the checksum only is a WORD or the higher bytes are a constant: 55 aa.
checked some firmwares from different cameras and this seems to be the same for every firmware:
SJ9000: 55 aa 38 f7
SJ9000: 55 aa 70 73
SG DC: 55 aa ca e8
SG DC: 55 aa 58 9b

[nutsey]

@[email protected] Great results, thanx a lot for your efforts!

A little addition to this:

 
 //algorithm: short chksm; little endian         //        init: chksm=?;         //        for every byte in firmware binary except checksum address at 0x6c,0x6d,0x6e,0x6f         //            evenb: chksm-=<BYTE>         //            oddb:  chksm-=<BYTE>*0x100         //        done

Offsets of skipped bytes for the 2nd FW partition (if any) are 0x46c-f