Novatek's 4K30 SoC - NT96683.

[nutsey]

Seems like we're going to see very interesting action cam SoCs producers competition in 2018.

One of those is Novatek with its long-awaited NT96683 chipset capable recording 4K30 with H.265 encoding support.

[petesimon]

I really like the NT (NTK) 96660 chipset paired with a Sony IMX078 (and better) sensor in budget cameras such as any of these: Soocoo C30 / Explorer Elite / Extral SJ8000 / (etc).

1080p / 60fps raw footage looks quite satisfactory for a $50 to $60 price. Link here - https://yadi.sk/d/PrcaYrUc3RSZHo

So now I am hoping to soon see a good selection of budget "SJ8" style cameras that have the new NT96683 chipset paired with any nice Sony IMX--- sensor.

Are any Blackview DV series that have NT96683/IMX--- for regular (not bulk) sale yet ? http://www.szdome.com/product-default-cid-94-1.html ?

[AussieKev]

SJ8 PLUS has NT96683 SoC and IMX117 sensor assume there will be copies around.

[petesimon]

AussieKev any SJ8 clones being sold yet?

[AussieKev]

petesimon Not seen any other NT96683 Action Cams pop up yet

[nutsey]

NT96683+OV12895 EZVIZ S6 action camera: https://www.ezvizlife.com/id/id/product/s6/861

[AussieKev]

nutsey EZVIZ Australia don't sell the S6 (or any action cams) sadly. Very strange.
Their S5+ has Ambarella A12 and the higher end ChipSip SoC 8Gb LPDDR3 + 2Gb Nand Flash but new S6 only 2Gb LPDDR3、1Gb Nand Flash which is odd? Wonder why the downgraded internal storage for their "Flagship"?
These companies never cease to amaze me with their decisions.

[nutsey]

Seems like that SJCAM is in the first flight here.

[AussieKev]

SJ8 types and specs

[nutsey]

NT96683 SPI flash structure (MTD partitions):

uitron
uitron ro
uboot
uboot ro
uenv
linux
linux ro
ramfs
rootfs
fat
dsp
dsp ro
pstore
pstore ro

[nutsey]

67x firmwares for wirelessless devices usually have only these partitions:
uenv
uitron(lzma)
uboot
[uboot(lz)]

[nutsey]

DV560 action camera by SZ DOME

Specs:

• SoC: Novatek NT96683
• CMOS Sensor: TBD (it should be 8M Sony IMX317 or 12M IMX277)
• LCD: 2" touchscreen
• Video modes: up to 4k30/1080p120
• Video encoding: H.264/AVC and H.265/HEVC
• USB: TypeC with mic-in function
• Battery: 1350mAh

DV560 has a selfie mirror and a strap hole. Seems like these features were inspired by Firefly 8-series design.

[petesimon]

is this or something else like this for sale yet?

[petesimon]

Victure AC900 is similar @Amazon http://amzn.com/B07L311D7M

video - https://www.youtube.com/watch?v=j4XxQdaO-SE&t=1

click the small picture.
|

[nutsey]

EZVIZ S6 action camera with 1/2.3" 12MP OV12895 CMOS sensor inside. Expected to be available in October.

[AussieKev]

LINK here https://www.ezvizlife.com/id/id/product/s6/861
Also OmniVisions new sensor looks impressive https://www.ovt.com/sensors/OV12895

[petesimon]

any shopping/retail links available yet?

[petesimon]

is this any better than SJCAM ?

i don't care for my SJ8 Plus NTK 96683 after using it several times because the latest firmware is buggy. the bugs cause jerky EIS video in 1080p 30fps and in 4k 30fps. SJCAM official support confirmed this. and the touch response is sometimes good / sometimes bad. and 2k60fps EIS is too "soft" and somewhat blurry. i always want to use EIS because I want smooth clear video. anyway, next month, i will try to sell it.

[nutsey]

A tip for updating NT96683 cams firmware: put the file named NVTDELFW to the root of your memory card when updating the firmware - FW96683A.bin will be deleted after update is done and you don't need to reformat your card or remove the file manually anymore.

[nutsey]

I wonder if anybody here is interested in hacking newer 675/683 chipsets?

[BCHobbyist]

Currently interested in Novatek NT96670 to 96683 dual partition unpacker and any other tools.

[nutsey]

These firmwares have several new features like LZMA compression and a new fw file header. I've already managed to unpack and repack the partition with AE/AWB/IQ/etc data in semi-manual mode.

[[email protected]]

Seem like they've switched from MIPS to ARM architecture in NT96683. Not sure if the SDK still allows both architectures, but previous ones have been MIPS all the time.

[nutsey]

No, it is still MIPS. <- Now I can confirm it is ARM, thanks for pointing out!

Have you got your Split cam?

[[email protected]]

Yes it arrived today.
Are you sure about that? Just had a short glimpse at the split cam firmware, yet.

[nutsey]

I was sure about it before you had asked.

Check the 1st 'ext' partition for
-D_BOARD_UITRON_ADDR_=
-D_BOARD_UITRON_SIZE_=
values to disassemble the uItron.

[nutsey]

I guess the chip has two ARM cores for uItron and Linux.

[nutsey]

The uItron partition (lz/BCL1) offset in 0802 fw is 0x165C (length 0x4345B4)

[[email protected]]

Alright, will have a closer look at it!
Cool thing is that they actually dumped the compiler flags into the binary

[nutsey]

0810 fw (named 0814 for some unknown reason): http://www.cnfpv.com/portal.php?mod=view&aid=125

[[email protected]]

Ok, so after unpacking the first partition I think I verified the ARM architecture. It's a arm binary with its specific vector table at the beginning.

Still wondering whether Novatek enforces use of ARM in NT96683 or if they offer support for both architectures.

Also after stumbling across the other BCL1 signatures: It's followed by a 25 01 algorithm identifier, do we have any info on that? The left over bytes of the known bcl header also look quite unrealistic

[nutsey]

New Novatek hw uses the following algos:
lz = 0x09
lzma = 0x0B
gz = 0x0C

These 0x0125 BCL1 headers look rather strange. I'd say it could be some ARM instructions starting right after the 'BCL1' bytes...

[nutsey]

[email protected] Have you tried connecting to the TX/RX pins?

[[email protected]]

Absolutely, it was the first thing I did and I've even built a little test environment for it

They've put some kind of coating onto the PCB so it was pretty hard to solder the UART wires onto it.



Seems like the 2nd core is used for linux, but the split cam does not make use of linux (probably only wifi enabled cameras).

I've also noticed that the micro hdmi connection is bad, it always loses connection after slightly touching the cable.
Might as well be the cable, but I think not, since it's brand new.

[nutsey]

My rig

[[email protected]]

Nice! Did yours get shipped with a heat sink or is this an aftermarket one?
Also how can you post pictures in comments? I can only post text?

Currently I'm examinging the memory of a full memory dump in IDA.
So far I've identified the Novatek loader at 0x00200000, uboot at 0x01200000 and the primary firmware at 0x01800000
Not sure about uboot but I think it's only used for booting linux - in our case (split cam without linux) it's not executed

[nutsey]

I've also noticed that the micro hdmi connection is bad, it always loses connection after slightly touching the cable.
Might as well be the cable, but I think not, since it's brand new.

Did not noticed this problem yet, but it is quite possible due to high pins density of micro-HDMI connectors.

Is there anything interesting available via UART?

[[email protected]]

Nothing special, but the bootloader prints a bit more information regarding what it's doing.
This is a flash and boot sequence: https://pastebin.com/dCjQL1fs

[nutsey]

[email protected]
"Did yours get shipped with a heat sink or is this an aftermarket one?"
This is a very old video card (from AGP era) memory chip heatsink.

"Also how can you post pictures in comments?"
I share pics with https://imgbb.com/ site and embed bbcodes for fullsize images.

"the memory of a full memory dump"
Have you desoldered the WSON flash chip to get the dump? Or did you use console commands?

[[email protected]]

I'm not a hardware guy so I was lucky to find some nice debug commands which allowed me to dump SRAM as well as the nand.
I've uploaded the nand dump to: http://git.p-mc.eu/ntk/nt96683-rever...ster/nand-dump and already extracted the different portions from it.
fw1 = novatek loader (Yay, we got access to the loader binary!)
fw3 = novatek firmware
fw4 = uboot bootloader image
fw5 = Linux kernel image
other fwX = unused
pstore1 = probably used for storing configurations?

nand0000 = raw nand dump
nand0001 = raw nand dump of sparse area

[nutsey]

Thanks for the very useful information!

What do you think about the FW96683T.bin file? Is it the uItron partition (fw3.bin in your dump) that can be loaded directly from the memory card without flashing to NAND?

[[email protected]]

I am currently analyzing the loader binary in IDA and hope to get a better understanding of it.
At the moment I'm not sure about the xxxxxxT.bin binary

[nutsey]

I've just checked and can say the *T.bin binary is the whole fw, not just the uITRON partition. It loads directly into memory from the microsd's root folder.

[[email protected]]

Yup, just checked it as well, very nice find!

[hc1982]

There are standard firmware names for 660 - FW96660A.bin and FW96660T.bin. The first one ("A") is usually changed to something else by manufacturer (e.g. cam model name etc), while "T" seems to be "Test" or "Temporary" one. I have managed to extract and decompress first partition from non-standard fw, renamed it as FW96660T.bin and adjusted some header bits (mark it as uncomressed and fully loaded into memory), and it was starting directly from sd card without flashing. But bootloader sets some flags in header related to it, so firmware update flow is initiated by uitron (that camera has unusual and non-standard firmware structure, with several overlays after first partition with font, jpeg files and something related to ADAS, and firmware is updated after camera normal full boot in 2 stages - during 1st stage uitron partiotion is extracted to sd card with FW96660T.bin name, and 2nd stage starts after reboot, with this temp bin loaded into memory and actual flashing is performed by it). So, I have patched it in several places to ignore bootloader flags related to temp boot, and it was working normally, even storing and loading user settings from pstore. I guess, the same idea should be applicable for 683.