NtkMPE 1.2 tool for customizing Novatek firmwares.

[[email protected] Member Find all posts View Profile Close [email protected]]

Attention: Commercial use is strictly prohibited! You are using my tools at your own risk! Modifying firmware will probably void your warranty. I am not responsible for anything that might happen as a result of using my tools.

Changelog:
1.2:
Exchanged Flg1 with Aspect ratio id, you can now modify the aspect ratio through NtkMPE according to these enums: https://www.goprawn.com/forum/action...=5989#post5989
1.1.2:
Fixed incompatibility with 0x0a and 0x0d bytes
1.1:
Changed name to NtkMPE to avoid possible legal issues
Added Copy and paste functionality to table cells (CTRL+C & CTRL+V)
Improved movie parameter struct detection pattern
Added 5th column for further r&d (read only)
1.0:
Initial release

About this tool: It allows you to modify movie parameters like width, height, fps and bitrate for different modes without using a hex editor.

Usage: This tool only works with DECOMPRESSED firmware files. You need to decompress these first with bfc or a wrapper for bfc like denova or ntkautomator.
Warning: BFC and its wrappers currently only support single image firmwares. You unpack/repack multi-image firmwares, yet.

(firmware is unpacked at this stage)
1. File -> Load firmware
2. Modify the parameters (Bitrate is half of the target bitrate. Example: Target bitrate of 20mbps requires an input of 10000 (kbps)
3. Press "Apply modifications"

(4. repack and validate using tools like ntkcalc/denova/ntkautomator)

Screenshot:


Download: http://dc.p-mc.eu/ntk_tools/NtkMPE.jar

[nutsey _m_o0_m_ Find all posts View Profile Close nutsey]

[email protected]

Member

Find all posts

View Profile

Close

[email protected] Thanks for the tool! Could you please add 2880x2160p24 and 2560x1440p30.

[[email protected] Member Find all posts View Profile Close [email protected]]

nutsey

_m_o0_m_

Find all posts

View Profile

Close

nutsey In theory it should find any bitrate struct inside the firmware.. But I applied some kind of heuristic to filter out false positives, maybe these are filtering your mentioned modes as well.. Could you please share a firmware sample including offset of the missing parameters?

[nutsey _m_o0_m_ Find all posts View Profile Close nutsey]

[email protected]

Member

Find all posts

View Profile

Close

[email protected] Sure. Here is Hawkeye Firefly 7S firmware:
https://drive.google.com/open?id=0B4...lRyNWdMeWhDTDQ

PS: I unpack it with DENOVA 0.7

[[email protected]]

Fixed it, new version and changelog in first post

[nutsey]

Great! Thanx for the update!
I'm not sure it is any useful but what do you think about adding 'ratio' column?
Another things to edit which are pretty simple to implement are Photo resolutions and AE Table(-s).

[[email protected]]

not too sure if ratio is useful. Might think about it
Yeah will provide other editor as well in the future.
But at first I'm going to make ntkcalc/bfc multi image compatible

[nutsey _m_o0_m_ Find all posts View Profile Close nutsey]

Hm, now v1.1 can't find 2.7K mode (000A A005) for that firmware.

But it found the list of audio sample rates.

[[email protected]]

Oh.. Will have a look at it again and push a update shortly
It's really hard optimizing the search algorithm since there is only a fine line between matching way too much structs and missing some (like 2.7k in this case)

[nutsey]

That's why I've chosen comparing with all possible resolutions in my GETBITS script

[nutsey]

By the way, thanx for the credits @About window

[[email protected]]

The reason why I did not go that route is that it wont find modified parameters (apart from bitrate) this way.

Honor to whom honor is due

[[email protected] Member Find all posts View Profile Close [email protected]]

Fixing this was a pain in the ass since I didnt realize that the misbehaving was due to 0x0a and 0x0d being misinterpreted as line endings....
Updated application has been replaced on the server, just redownload it.

[funaro13 Junior Member Find all posts View Profile Close funaro13]

Can someone for the love of god make a firmware that lends to explorer elite
Or the ones you're doing?

[Perepandel Junior Member Find all posts View Profile Close Perepandel]

Hi!
I bought a Wolverine Super 8 film scanner a month ago and after getting a firmware update from the customer service and analyzing it a bit with a hex editor, I found it's based on the NT96650 chip.
After further research I ended up here, and I found this amazing set of stickys with this collections of utilities for customizing NovaTek firmwares.

So for I've been able to successfully use bnGui in the "non manual operation" mode - that is, I'm being able to get a .rbn after loading my firmware file and selecting "Unpack". Then I'm able to open that file in Ntkmpe, I see a list with different video modes/resolutions/bitrates and that, I'm able to make changes there and save the file, but thats all - then I try to compress it back again into a valid .bin firmware file in bnGui, but all I get is the following error apperaing on the "Log" window:

+-----------------------------------+
| Ntk calculator v0.5.1 by [email protected] |
| https://dashcamtalk.com/forum |
| https://www.goprawn.com/forum |
+-----------------------------------+
+++ NATIVE ERROR +++
Checksum magic invalid (432e).

-------- Edit:

Also tried:

Compress --> opened my .rbn file, mode p, Baseval [hex] 000ab000 (the offset address I got in "Firmware information" mode from the only partition found), then the message "BFC Compressing..." appears and runs forever but nothing happens.

And on command line did the following thing, too:
$ bfc d my.rbn output.bin

It outputs:
LZ77 FullComp compress [email protected] to output.bin...
Input file: XXXXX bytes

...and also gets stuck forever, taking 50% CPU resources...
---------------

I wonder if I'm not doing things right and/or if this set of programs can be used to modify the firmware of my machine. Maybe if I could mail the firmware file to [email protected] to get some help. May this be possible?

As I said, this machine is a frame-by-frame Super8 cinema film capture machine, but the output is flawed somehow in the sense that the native framerate of these old films are 18 or 24 fps, but the output file is always @ 30fps, forcing us to manually editing the file afterwards. Also the bitrate seems to be very low, producing lots of noticeable artifcats. My first aim would be to mitigate those problems.

Any hints will be really appreciated

------- Edit 2:

Ok, maybe this isn't the best topic to place my questions because they aren't related to ntkmpe at all but for bngui and I already found the instructions on how to integrate the codec modifications into a working firmware in its proper thread (https://www.goprawn.com/forum/action...and-line-tools) (thanks, Michi_65!!), but now the problem is that the program won't compress back my modified rbn file into a new bcl file

Suggestions welcome, probably better in the referenced thread!

[[email protected] Member Find all posts View Profile Close [email protected]]

Thanks to

nutsey

_m_o0_m_

Find all posts

View Profile

Close

nutseys aspect ratio discovery, NtkMPE received an update: Exchanged Flg1 with Aspect ratio id, you can now modify the aspect ratio through NtkMPE according to these enums: https://www.goprawn.com/forum/action...=5989#post5989

[Alf]

Can you please check why aspect ratio fields show incorrect information for this firmware? https://yadi.sk/d/kWolqXgJ3M9Z2A

[[email protected]]

Alf

Junior Member

Find all posts

View Profile

Close

Alf this is strange. The firmware you linked uses a different movie param struct. The length of the struct in your firmware is only 20 bytes - the length of the struct NtkMPE tries to load is 52 bytes. (So NtkMPE shows values from the next entry as content of the current entry since it reads 32 bytes more than available for your struct)

Is this a NT96658 chip? Seems like we've found an incompatibility here

[Alf]

@[email protected] yes, it's a NT96658. My firmware is like a Frankenstein. Not only it uses different movie parameter structure, but also a weird config setup. It seeks for a config.txt file on SD card that is a simple text file with some Parameter="Value" pairs plus a text header indicating that it's a config file https://yadi.sk/i/NWmsSFsz3M9dTX

[nutsey]

660 and 65x SoCs have different bitrate tables. I guess this can be solved by adding some sort of chip detection - its name is in FW header.

[[email protected] Member Find all posts View Profile Close [email protected]]

Well it should be safe to use NtkMPE if you don't modify the aspect ratio value. Which camera is this?

[Alf]

It's a JOOY A1 DVR. https://www.aliexpress.com/item/JOOY...587611239.html
Yes, NtkMPE is working great when I don't touch aspect values, thank you. Just checked this by modifying and flashing FW.

[Dex Junior Member Find all posts View Profile Close Dex]

Same struct size = 20 bytes in Git1 FWs (FW version 1.4 as example):

Video Modes for view via WiFi
ROM:80670C24 dword_80670C24: .word 0x500              # DATA XREF: sub_801F5178+C0o sub_801F5264+C0o ...
ROM:80670C24                                          # 1280
ROM:80670C28                 .word 0x2D0              # 720
ROM:80670C2C                 .word 0x1E               # 30 FPS
ROM:80670C30                 .byte 0
ROM:80670C31                 .byte 0x80  # А
ROM:80670C32                 .byte  0xC               # 3200 * 2 kbps
ROM:80670C33                 .byte    0
ROM:80670C34                 .word 0
ROM:80670C38
ROM:80670C38                 .word 0x350              # 848
ROM:80670C3C                 .word 0x1E0              # 480
ROM:80670C40                 .word 0x1E               # 30 FPS
ROM:80670C44                 .byte 0
ROM:80670C45                 .byte 0x40  # @
ROM:80670C46                 .byte    6               # 1600 * 2 kbps
ROM:80670C47                 .byte    0
ROM:80670C48                 .word 0
ROM:80670C4C
ROM:80670C4C                 .word 0x280              # 640
ROM:80670C50                 .word 0x1E0              # 480
ROM:80670C54                 .word 0x1E               # 30 FPS
ROM:80670C58                 .byte 0
ROM:80670C59                 .byte 0x40  # @
ROM:80670C5A                 .byte    6               # 1600 * 2 kbps
ROM:80670C5B                 .byte    0
ROM:80670C5C                 .word 0
ROM:80670C60
ROM:80670C60                 .word 0x280              # 640
ROM:80670C64                 .word 0x168              # 360
ROM:80670C68                 .word 0x1E               # 30 FPS
ROM:80670C6C                 .byte 0
ROM:80670C6D                 .byte 0x40  # @
ROM:80670C6E                 .byte    6               # 1600 * 2 kbps
ROM:80670C6F                 .byte    0
ROM:80670C70                 .word 0
ROM:80670C74
ROM:80670C74                 .word 0x140              # 320
ROM:80670C78                 .word 0xF0               # 240
ROM:80670C7C                 .word 0x1E               # 30 FPS
ROM:80670C80                 .byte 0
ROM:80670C81                 .byte 0xB0  # -
ROM:80670C82                 .byte    4               # 1200 * 2 kbps
ROM:80670C83                 .byte    0
ROM:80670C84                 .word 0
ROM:80670C88
ROM:80670C88 Video Modes for record to SD Card
ROM:80670C88 LOW framerate
ROM:80670C88 dword_80670C88: .word 0x780              # DATA XREF: sub_801F5178+68o sub_801F5264+68o ...
ROM:80670C88                                          # 1920
ROM:80670C8C                 .word 0x438              # 1080
ROM:80670C90                 .word 0x1E               # 30 FPS
ROM:80670C94                 .byte 0x80
ROM:80670C95                 .byte 0x9C
ROM:80670C96                 .byte 0x1A               # 6812 * 2 kbps
ROM:80670C97                 .byte    0
ROM:80670C98                 .word 0
ROM:80670C9C
ROM:80670C9C                 .word 0x500              # 1280
ROM:80670CA0                 .word 0x3C0              # 960
ROM:80670CA4                 .word 0x1E               # 30 FPS
ROM:80670CA8                 .byte 0
ROM:80670CA9                 .byte 0xA0  # а
ROM:80670CAA                 .byte  0xF               # 4000 * 2 kbps
ROM:80670CAB                 .byte    0
ROM:80670CAC                 .word 0
ROM:80670CB0
ROM:80670CB0                 .word 0x500              # 1280
ROM:80670CB4                 .word 0x2D0              # 720
ROM:80670CB8                 .word 0x3C               # 60 FPS
ROM:80670CBC                 .byte    0
ROM:80670CBD                 .byte 0xA0  # а
ROM:80670CBE                 .byte  0xF               # 4000 * 2 kbps
ROM:80670CBF                 .byte    0
ROM:80670CC0                 .word 0
ROM:80670CC4
ROM:80670CC4                 .word 0x500              # 1280
ROM:80670CC8                 .word 0x2D0              # 720
ROM:80670CCC                 .word 0x1E               # 30 FPS
ROM:80670CD0                 .byte    0
ROM:80670CD1                 .byte 0x60  # `
ROM:80670CD2                 .byte    9               # 2400 * 2 kbps
ROM:80670CD3                 .byte    0
ROM:80670CD4                 .word 0
ROM:80670CD8
ROM:80670CD8                 .word 0x350              # 848
ROM:80670CDC                 .word 0x1E0              # 480
ROM:80670CE0                 .word 0x3C               # 60 FPS
ROM:80670CE4                 .byte    0
ROM:80670CE5                 .byte 0xB0  # -
ROM:80670CE6                 .byte    4               # 1200 * 2 kbps
ROM:80670CE7                 .byte    0
ROM:80670CE8                 .word 0
ROM:80670CEC
ROM:80670CEC                 .word 0x280              # 640
ROM:80670CF0                 .word 0x1E0              # 480
ROM:80670CF4                 .word 0x1E               # 30 FPS
ROM:80670CF8                 .byte    0
ROM:80670CF9                 .byte 0xB0  # -
ROM:80670CFA                 .byte    4               # 1200 * 2 kbps
ROM:80670CFB                 .byte    0
ROM:80670CFC                 .word 0
ROM:80670D00
ROM:80670D00 MEDIUM framerate
ROM:80670D00                 .word 0x780              # 1920
ROM:80670D04                 .word 0x438              # 1080
ROM:80670D08                 .word 0x1E               # 30 FPS
ROM:80670D0C                 .byte 0x7C
ROM:80670D0D                 .byte 0x6A  # j
ROM:80670D0E                 .byte 0x28  # (          # 10346 * 2 kbps
ROM:80670D0F                 .byte    0
ROM:80670D10                 .word 0
ROM:80670D14
ROM:80670D14                 .word 0x500              # 1280
ROM:80670D18                 .word 0x3C0              # 960
ROM:80670D1C                 .word 0x1E               # 30 FPS
ROM:80670D20                 .byte    0
ROM:80670D21                 .byte 0xC0  # L
ROM:80670D22                 .byte 0x12               # 4800 * 2 kbps
ROM:80670D23                 .byte    0
ROM:80670D24                 .word 0
ROM:80670D28
ROM:80670D28                 .word 0x500              # 1280
ROM:80670D2C                 .word 0x2D0              # 720
ROM:80670D30                 .word 0x3C               # 60 FPS
ROM:80670D34                 .byte    0
ROM:80670D35                 .byte    0
ROM:80670D36                 .byte 0x14               # 5120 * 2 kbps
ROM:80670D37                 .byte    0
ROM:80670D38                 .word 0
ROM:80670D3C
ROM:80670D3C                 .word 0x500              # 1280
ROM:80670D40                 .word 0x2D0              # 720
ROM:80670D44                 .word 0x1E               # 30 FPS
ROM:80670D48                 .byte    0
ROM:80670D49                 .byte 0x80  # А
ROM:80670D4A                 .byte  0xC               # 3200 * 2 kbps
ROM:80670D4B                 .byte    0
ROM:80670D4C                 .word 0
ROM:80670D50
ROM:80670D50                 .word 0x350              # 848
ROM:80670D54                 .word 0x1E0              # 480
ROM:80670D58                 .word 0x3C               # 60 FPS
ROM:80670D5C                 .byte    0
ROM:80670D5D                 .byte 0x40  # @
ROM:80670D5E                 .byte    6               # 1600 * 2 kbps
ROM:80670D5F                 .byte    0
ROM:80670D60                 .word 0
ROM:80670D64
ROM:80670D64                 .word 0x280              # 640
ROM:80670D68                 .word 0x1E0              # 480
ROM:80670D6C                 .word 0x1E               # 30 FPS
ROM:80670D70                 .byte    0
ROM:80670D71                 .byte 0x40  # @
ROM:80670D72                 .byte    6               # 1600 * 2 kbps
ROM:80670D73                 .byte    0
ROM:80670D74                 .word 0
ROM:80670D78
ROM:80670D78 HIGH framerate
ROM:80670D78                 .word 0x780              # 1920
ROM:80670D7C                 .word 0x438              # 1080
ROM:80670D80                 .word 0x1E               # 30 FPS
ROM:80670D84                 .byte 0x70
ROM:80670D85                 .byte 0xE5  # х
ROM:80670D86                 .byte 0x31  # 1          # 12773 * 2 kbps
ROM:80670D87                 .byte    0
ROM:80670D88                 .word 0
ROM:80670D8C
ROM:80670D8C                 .word 0x500              # 1280
ROM:80670D90                 .word 0x3C0              # 960
ROM:80670D94                 .word 0x1E               # 30 FPS
ROM:80670D98                 .byte    0
ROM:80670D99                 .byte 0x40  # @
ROM:80670D9A                 .byte 0x1F               # 8000 * 2 kbps
ROM:80670D9B                 .byte    0
ROM:80670D9C                 .word 0
ROM:80670DA0
ROM:80670DA0                 .word 0x500              # 1280
ROM:80670DA4                 .word 0x2D0              # 720
ROM:80670DA8                 .word 0x3C               # 60 FPS
ROM:80670DAC                 .byte    0
ROM:80670DAD                 .byte 0x60  # `
ROM:80670DAE                 .byte 0x1D               # 7520 * 2 kbps
ROM:80670DAF                 .byte    0
ROM:80670DB0                 .word 0
ROM:80670DB4
ROM:80670DB4                 .word 0x500              # 1280
ROM:80670DB8                 .word 0x2D0              # 720
ROM:80670DBC                 .word 0x1E               # 30 FPS
ROM:80670DC0                 .byte    0
ROM:80670DC1                 .byte    0
ROM:80670DC2                 .byte 0x19               # 6400 * 2 kbps
ROM:80670DC3                 .byte    0
ROM:80670DC4                 .word 0
ROM:80670DC8
ROM:80670DC8                 .word 0x350              # 848
ROM:80670DCC                 .word 0x1E0              # 480
ROM:80670DD0                 .word 0x3C               # 60 FPS
ROM:80670DD4                 .byte    0
ROM:80670DD5                 .byte 0x80  # А
ROM:80670DD6                 .byte  0xC               # 3200 * 2 kbps
ROM:80670DD7                 .byte    0
ROM:80670DD8                 .word 0
ROM:80670DDC
ROM:80670DDC                 .word 0x280              # 640
ROM:80670DE0                 .word 0x1E0              # 480
ROM:80670DE4                 .word 0x1E               # 30 FPS
ROM:80670DE8                 .byte    0
ROM:80670DE9                 .byte 0x80  # А
ROM:80670DEA                 .byte  0xC               # 3200 * 2 kbps
ROM:80670DEB                 .byte    0
ROM:80670DEC                 .word 0

NtkMpe show some garbage modes firstly and loose first video modes at every High, MED, LOW framerate block at 0x670C88, 0x670D00, 0x670D78. Aspect ratio of course wrong.

[Dex Junior Member Find all posts View Profile Close Dex]

Hi everyone. Small update info about bitrates - there is no "multiply by 2", but it`s bytes per second data.
Look at my post before (just as example):

ROM:80670C30 .byte 0
ROM:80670C31 .byte 0x80
ROM:80670C32 .byte 0xC # 3200 * 2 kbps
ROM:80670C33 .byte 0

more adequate record:

ROM:80670C30                 .word 0xC8000            # 6400 kbps

0xC8000 bytes/sec = 819200 bytes/sec = 819200/1024 = 800 Kbytes/sec = 800*8 = 6400 Kbits/sec

So all 4 bytes should be parsed

[Perepandel Junior Member Find all posts View Profile Close Perepandel]

Hi! I just wanted to take a look into this to see if there were some new developments since last time I checked in. Unfortunately, I see there isnt

[email protected]

Member

Find all posts

View Profile

Close

[email protected] , do you have any news?

[[email protected]]

I have to admit that I'm currently not working on this project. Maybe If I get bored during writing my thesis in the next months

[jfoust]

Have you described your efforts to create new firmware for the film scanners on any other web page? I'd like to learn more about what you've done. https://www.reddit.com/r/8mm/comment...s_kodak_reelz/

[[email protected]]

I may have documented my initial approaches at dashcamtalk.com
But unfortunately no real documentation on how I did the successful cracking of integrity checks