No announcement yet.

NtkMPE 1.2 tool for customizing Novatek firmwares.

This is a sticky topic.
  • Filter
  • Time
  • Show
Clear All
new posts

  • NtkMPE 1.2 tool for customizing Novatek firmwares.

    Attention: Commercial use is strictly prohibited! You are using my tools at your own risk! Modifying firmware will probably void your warranty. I am not responsible for anything that might happen as a result of using my tools.


    Exchanged Flg1 with Aspect ratio id, you can now modify the aspect ratio through NtkMPE according to these enums:
    Fixed incompatibility with 0x0a and 0x0d bytes
    Changed name to NtkMPE to avoid possible legal issues
    Added Copy and paste functionality to table cells (CTRL+C & CTRL+V)
    Improved movie parameter struct detection pattern
    Added 5th column for further r&d (read only)
    Initial release

    About this tool: It allows you to modify movie parameters like width, height, fps and bitrate for different modes without using a hex editor.

    Usage: This tool only works with DECOMPRESSED firmware files. You need to decompress these first with bfc or a wrapper for bfc like denova or ntkautomator.
    Warning: BFC and its wrappers currently only support single image firmwares. You unpack/repack multi-image firmwares, yet.

    (firmware is unpacked at this stage)
    1. File -> Load firmware
    2. Modify the parameters (Bitrate is half of the target bitrate. Example: Target bitrate of 20mbps requires an input of 10000 (kbps)
    3. Press "Apply modifications"

    (4. repack and validate using tools like ntkcalc/denova/ntkautomator)


    Last edited by [email protected]; 08-19-2017, 12:01 AM.

  • #2
    [email protected] Thanks for the tool! Could you please add 2880x2160p24 and 2560x1440p30.
    Donate here if you want to support my efforts and this site.

    Email me if you have any offers, requests or ideas.


    • #3
      nutsey In theory it should find any bitrate struct inside the firmware.. But I applied some kind of heuristic to filter out false positives, maybe these are filtering your mentioned modes as well.. Could you please share a firmware sample including offset of the missing parameters?
      Last edited by [email protected]; 05-21-2017, 10:41 AM.


      • #4
        [email protected] Sure. Here is Hawkeye Firefly 7S firmware:

        PS: I unpack it with DENOVA 0.7
        Attached Files
        Last edited by nutsey; 05-21-2017, 11:19 AM.
        Donate here if you want to support my efforts and this site.

        Email me if you have any offers, requests or ideas.


      • #5
        Hm, now v1.1 can't find 2.7K mode (000A A005) for that firmware.

        But it found the list of audio sample rates.
        Click image for larger version

Name:	1_1.png
Views:	1524
Size:	17.8 KB
ID:	4180
        Last edited by nutsey; 05-21-2017, 04:10 PM.
        Donate here if you want to support my efforts and this site.

        Email me if you have any offers, requests or ideas.


      • #6
        Fixing this was a pain in the ass since I didnt realize that the misbehaving was due to 0x0a and 0x0d being misinterpreted as line endings....
        Updated application has been replaced on the server, just redownload it.
        Last edited by [email protected]; 05-21-2017, 08:12 PM.


        • #7
          Can someone for the love of god make a firmware that lends to explorer elite
          Or the ones you're doing?


          • #8
            I bought a Wolverine Super 8 film scanner a month ago and after getting a firmware update from the customer service and analyzing it a bit with a hex editor, I found it's based on the NT96650 chip.
            After further research I ended up here, and I found this amazing set of stickys with this collections of utilities for customizing NovaTek firmwares.

            So for I've been able to successfully use bnGui in the "non manual operation" mode - that is, I'm being able to get a .rbn after loading my firmware file and selecting "Unpack". Then I'm able to open that file in Ntkmpe, I see a list with different video modes/resolutions/bitrates and that, I'm able to make changes there and save the file, but thats all - then I try to compress it back again into a valid .bin firmware file in bnGui, but all I get is the following error apperaing on the "Log" window:

            | Ntk calculator v0.5.1 by [email protected] |
            | |
            | |
            +++ NATIVE ERROR +++
            Checksum magic invalid (432e).

            -------- Edit:

            Also tried:

            Compress --> opened my .rbn file, mode p, Baseval [hex] 000ab000 (the offset address I got in "Firmware information" mode from the only partition found), then the message "BFC Compressing..." appears and runs forever but nothing happens.

            And on command line did the following thing, too:
            $ bfc d my.rbn output.bin

            It outputs:
            LZ77 FullComp compress [email protected] to output.bin...
            Input file: XXXXX bytes

            ...and also gets stuck forever, taking 50% CPU resources...

            I wonder if I'm not doing things right and/or if this set of programs can be used to modify the firmware of my machine. Maybe if I could mail the firmware file to [email protected] to get some help. May this be possible?

            As I said, this machine is a frame-by-frame Super8 cinema film capture machine, but the output is flawed somehow in the sense that the native framerate of these old films are 18 or 24 fps, but the output file is always @ 30fps, forcing us to manually editing the file afterwards. Also the bitrate seems to be very low, producing lots of noticeable artifcats. My first aim would be to mitigate those problems.

            Any hints will be really appreciated

            ------- Edit 2:

            Ok, maybe this isn't the best topic to place my questions because they aren't related to ntkmpe at all but for bngui and I already found the instructions on how to integrate the codec modifications into a working firmware in its proper thread ( (thanks, Michi_65!!), but now the problem is that the program won't compress back my modified rbn file into a new bcl file

            Suggestions welcome, probably better in the referenced thread!
            Junior Member
            Last edited by Perepandel; 08-07-2017, 04:36 PM.


            • #9
              Thanks to
              nutseys aspect ratio discovery, NtkMPE received an update: Exchanged Flg1 with Aspect ratio id, you can now modify the aspect ratio through NtkMPE according to these enums:
              Last edited by [email protected]; 08-19-2017, 12:49 AM.


              • Alf
                Junior Member
                Alf commented
                Editing a comment
                Can you please check why aspect ratio fields show incorrect information for this firmware?

              • Tobi@s
                [email protected] commented
                Editing a comment
                Junior Member
                Alf this is strange. The firmware you linked uses a different movie param struct. The length of the struct in your firmware is only 20 bytes - the length of the struct NtkMPE tries to load is 52 bytes. (So NtkMPE shows values from the next entry as content of the current entry since it reads 32 bytes more than available for your struct)

                Is this a NT96658 chip? Seems like we've found an incompatibility here

              • Alf
                Junior Member
                Alf commented
                Editing a comment
                @[email protected] yes, it's a NT96658. My firmware is like a Frankenstein. Not only it uses different movie parameter structure, but also a weird config setup. It seeks for a config.txt file on SD card that is a simple text file with some Parameter="Value" pairs plus a text header indicating that it's a config file

              • nutsey
                nutsey commented
                Editing a comment
                660 and 65x SoCs have different bitrate tables. I guess this can be solved by adding some sort of chip detection - its name is in FW header.

            • #10
              Well it should be safe to use NtkMPE if you don't modify the aspect ratio value. Which camera is this?


            • #11
              Same struct size = 20 bytes in Git1 FWs (FW version 1.4 as example):

              Video Modes for view via WiFi
              ROM:80670C24 dword_80670C24: .word 0x500              # DATA XREF: sub_801F5178+C0o sub_801F5264+C0o ...
              ROM:80670C24                                          # 1280
              ROM:80670C28                 .word 0x2D0              # 720
              ROM:80670C2C                 .word 0x1E               # 30 FPS
              ROM:80670C30                 .byte 0
              ROM:80670C31                 .byte 0x80  # А
              ROM:80670C32                 .byte  0xC               # 3200 * 2 kbps
              ROM:80670C33                 .byte    0
              ROM:80670C34                 .word 0
              ROM:80670C38                 .word 0x350              # 848
              ROM:80670C3C                 .word 0x1E0              # 480
              ROM:80670C40                 .word 0x1E               # 30 FPS
              ROM:80670C44                 .byte 0
              ROM:80670C45                 .byte 0x40  # @
              ROM:80670C46                 .byte    6               # 1600 * 2 kbps
              ROM:80670C47                 .byte    0
              ROM:80670C48                 .word 0
              ROM:80670C4C                 .word 0x280              # 640
              ROM:80670C50                 .word 0x1E0              # 480
              ROM:80670C54                 .word 0x1E               # 30 FPS
              ROM:80670C58                 .byte 0
              ROM:80670C59                 .byte 0x40  # @
              ROM:80670C5A                 .byte    6               # 1600 * 2 kbps
              ROM:80670C5B                 .byte    0
              ROM:80670C5C                 .word 0
              ROM:80670C60                 .word 0x280              # 640
              ROM:80670C64                 .word 0x168              # 360
              ROM:80670C68                 .word 0x1E               # 30 FPS
              ROM:80670C6C                 .byte 0
              ROM:80670C6D                 .byte 0x40  # @
              ROM:80670C6E                 .byte    6               # 1600 * 2 kbps
              ROM:80670C6F                 .byte    0
              ROM:80670C70                 .word 0
              ROM:80670C74                 .word 0x140              # 320
              ROM:80670C78                 .word 0xF0               # 240
              ROM:80670C7C                 .word 0x1E               # 30 FPS
              ROM:80670C80                 .byte 0
              ROM:80670C81                 .byte 0xB0  # -
              ROM:80670C82                 .byte    4               # 1200 * 2 kbps
              ROM:80670C83                 .byte    0
              ROM:80670C84                 .word 0
              ROM:80670C88 Video Modes for record to SD Card
              ROM:80670C88 LOW framerate
              ROM:80670C88 dword_80670C88: .word 0x780              # DATA XREF: sub_801F5178+68o sub_801F5264+68o ...
              ROM:80670C88                                          # 1920
              ROM:80670C8C                 .word 0x438              # 1080
              ROM:80670C90                 .word 0x1E               # 30 FPS
              ROM:80670C94                 .byte 0x80
              ROM:80670C95                 .byte 0x9C
              ROM:80670C96                 .byte 0x1A               # 6812 * 2 kbps
              ROM:80670C97                 .byte    0
              ROM:80670C98                 .word 0
              ROM:80670C9C                 .word 0x500              # 1280
              ROM:80670CA0                 .word 0x3C0              # 960
              ROM:80670CA4                 .word 0x1E               # 30 FPS
              ROM:80670CA8                 .byte 0
              ROM:80670CA9                 .byte 0xA0  # а
              ROM:80670CAA                 .byte  0xF               # 4000 * 2 kbps
              ROM:80670CAB                 .byte    0
              ROM:80670CAC                 .word 0
              ROM:80670CB0                 .word 0x500              # 1280
              ROM:80670CB4                 .word 0x2D0              # 720
              ROM:80670CB8                 .word 0x3C               # 60 FPS
              ROM:80670CBC                 .byte    0
              ROM:80670CBD                 .byte 0xA0  # а
              ROM:80670CBE                 .byte  0xF               # 4000 * 2 kbps
              ROM:80670CBF                 .byte    0
              ROM:80670CC0                 .word 0
              ROM:80670CC4                 .word 0x500              # 1280
              ROM:80670CC8                 .word 0x2D0              # 720
              ROM:80670CCC                 .word 0x1E               # 30 FPS
              ROM:80670CD0                 .byte    0
              ROM:80670CD1                 .byte 0x60  # `
              ROM:80670CD2                 .byte    9               # 2400 * 2 kbps
              ROM:80670CD3                 .byte    0
              ROM:80670CD4                 .word 0
              ROM:80670CD8                 .word 0x350              # 848
              ROM:80670CDC                 .word 0x1E0              # 480
              ROM:80670CE0                 .word 0x3C               # 60 FPS
              ROM:80670CE4                 .byte    0
              ROM:80670CE5                 .byte 0xB0  # -
              ROM:80670CE6                 .byte    4               # 1200 * 2 kbps
              ROM:80670CE7                 .byte    0
              ROM:80670CE8                 .word 0
              ROM:80670CEC                 .word 0x280              # 640
              ROM:80670CF0                 .word 0x1E0              # 480
              ROM:80670CF4                 .word 0x1E               # 30 FPS
              ROM:80670CF8                 .byte    0
              ROM:80670CF9                 .byte 0xB0  # -
              ROM:80670CFA                 .byte    4               # 1200 * 2 kbps
              ROM:80670CFB                 .byte    0
              ROM:80670CFC                 .word 0
              ROM:80670D00 MEDIUM framerate
              ROM:80670D00                 .word 0x780              # 1920
              ROM:80670D04                 .word 0x438              # 1080
              ROM:80670D08                 .word 0x1E               # 30 FPS
              ROM:80670D0C                 .byte 0x7C
              ROM:80670D0D                 .byte 0x6A  # j
              ROM:80670D0E                 .byte 0x28  # (          # 10346 * 2 kbps
              ROM:80670D0F                 .byte    0
              ROM:80670D10                 .word 0
              ROM:80670D14                 .word 0x500              # 1280
              ROM:80670D18                 .word 0x3C0              # 960
              ROM:80670D1C                 .word 0x1E               # 30 FPS
              ROM:80670D20                 .byte    0
              ROM:80670D21                 .byte 0xC0  # L
              ROM:80670D22                 .byte 0x12               # 4800 * 2 kbps
              ROM:80670D23                 .byte    0
              ROM:80670D24                 .word 0
              ROM:80670D28                 .word 0x500              # 1280
              ROM:80670D2C                 .word 0x2D0              # 720
              ROM:80670D30                 .word 0x3C               # 60 FPS
              ROM:80670D34                 .byte    0
              ROM:80670D35                 .byte    0
              ROM:80670D36                 .byte 0x14               # 5120 * 2 kbps
              ROM:80670D37                 .byte    0
              ROM:80670D38                 .word 0
              ROM:80670D3C                 .word 0x500              # 1280
              ROM:80670D40                 .word 0x2D0              # 720
              ROM:80670D44                 .word 0x1E               # 30 FPS
              ROM:80670D48                 .byte    0
              ROM:80670D49                 .byte 0x80  # А
              ROM:80670D4A                 .byte  0xC               # 3200 * 2 kbps
              ROM:80670D4B                 .byte    0
              ROM:80670D4C                 .word 0
              ROM:80670D50                 .word 0x350              # 848
              ROM:80670D54                 .word 0x1E0              # 480
              ROM:80670D58                 .word 0x3C               # 60 FPS
              ROM:80670D5C                 .byte    0
              ROM:80670D5D                 .byte 0x40  # @
              ROM:80670D5E                 .byte    6               # 1600 * 2 kbps
              ROM:80670D5F                 .byte    0
              ROM:80670D60                 .word 0
              ROM:80670D64                 .word 0x280              # 640
              ROM:80670D68                 .word 0x1E0              # 480
              ROM:80670D6C                 .word 0x1E               # 30 FPS
              ROM:80670D70                 .byte    0
              ROM:80670D71                 .byte 0x40  # @
              ROM:80670D72                 .byte    6               # 1600 * 2 kbps
              ROM:80670D73                 .byte    0
              ROM:80670D74                 .word 0
              ROM:80670D78 HIGH framerate
              ROM:80670D78                 .word 0x780              # 1920
              ROM:80670D7C                 .word 0x438              # 1080
              ROM:80670D80                 .word 0x1E               # 30 FPS
              ROM:80670D84                 .byte 0x70
              ROM:80670D85                 .byte 0xE5  # х
              ROM:80670D86                 .byte 0x31  # 1          # 12773 * 2 kbps
              ROM:80670D87                 .byte    0
              ROM:80670D88                 .word 0
              ROM:80670D8C                 .word 0x500              # 1280
              ROM:80670D90                 .word 0x3C0              # 960
              ROM:80670D94                 .word 0x1E               # 30 FPS
              ROM:80670D98                 .byte    0
              ROM:80670D99                 .byte 0x40  # @
              ROM:80670D9A                 .byte 0x1F               # 8000 * 2 kbps
              ROM:80670D9B                 .byte    0
              ROM:80670D9C                 .word 0
              ROM:80670DA0                 .word 0x500              # 1280
              ROM:80670DA4                 .word 0x2D0              # 720
              ROM:80670DA8                 .word 0x3C               # 60 FPS
              ROM:80670DAC                 .byte    0
              ROM:80670DAD                 .byte 0x60  # `
              ROM:80670DAE                 .byte 0x1D               # 7520 * 2 kbps
              ROM:80670DAF                 .byte    0
              ROM:80670DB0                 .word 0
              ROM:80670DB4                 .word 0x500              # 1280
              ROM:80670DB8                 .word 0x2D0              # 720
              ROM:80670DBC                 .word 0x1E               # 30 FPS
              ROM:80670DC0                 .byte    0
              ROM:80670DC1                 .byte    0
              ROM:80670DC2                 .byte 0x19               # 6400 * 2 kbps
              ROM:80670DC3                 .byte    0
              ROM:80670DC4                 .word 0
              ROM:80670DC8                 .word 0x350              # 848
              ROM:80670DCC                 .word 0x1E0              # 480
              ROM:80670DD0                 .word 0x3C               # 60 FPS
              ROM:80670DD4                 .byte    0
              ROM:80670DD5                 .byte 0x80  # А
              ROM:80670DD6                 .byte  0xC               # 3200 * 2 kbps
              ROM:80670DD7                 .byte    0
              ROM:80670DD8                 .word 0
              ROM:80670DDC                 .word 0x280              # 640
              ROM:80670DE0                 .word 0x1E0              # 480
              ROM:80670DE4                 .word 0x1E               # 30 FPS
              ROM:80670DE8                 .byte    0
              ROM:80670DE9                 .byte 0x80  # А
              ROM:80670DEA                 .byte  0xC               # 3200 * 2 kbps
              ROM:80670DEB                 .byte    0
              ROM:80670DEC                 .word 0
              NtkMpe show some garbage modes firstly and loose first video modes at every High, MED, LOW framerate block at 0x670C88, 0x670D00, 0x670D78. Aspect ratio of course wrong.


              • #12
                Hi everyone. Small update info about bitrates - there is no "multiply by 2", but it`s bytes per second data.
                Look at my post before (just as example):
                ROM:80670C30 .byte 0
                ROM:80670C31 .byte 0x80
                ROM:80670C32 .byte 0xC # 3200 * 2 kbps
                ROM:80670C33 .byte 0
                more adequate record:
                ROM:80670C30                 .word 0xC8000            # 6400 kbps
                0xC8000 bytes/sec = 819200 bytes/sec = 819200/1024 = 800 Kbytes/sec = 800*8 = 6400 Kbits/sec

                So all 4 bytes should be parsed
                Junior Member
                Last edited by Dex; 01-29-2018, 12:13 PM.


                • #13
                  Hi! I just wanted to take a look into this to see if there were some new developments since last time I checked in. Unfortunately, I see there isnt

                  [email protected] , do you have any news?