Nextbase 412GW NT966XX firmware checksum issue

[incomingone]

Hi there

Been reading lots of posts from nutsey and [email protected] about the NT966XX firmware format. (thanks to those guys)

Was seriously considering buying a NT966XX based Nextbase 412GW dashcam, only to find latest firmware has a horrible logo stamped over the top left of the video - and it's not removable as the company likes the idea of advertising when videos are posted online.

That immediately stopped my planned purchase, but I was so annoyed I decided to look at their firmware. https://www.nextbase.co.uk/wp-conten...6/FW96660A.bin

bfc-v24.exe works fine for decompression
ntkcalc-v051.exe -c recalculates the checksum in the uncompressed file at 0x6e fine (compared to unchanged original decompressed file)

However ntkcalc-v051.exe -c doesn't come up with the same compressed file checksum at 0x04 though (compared to unchanged original file).

I think I read some of these cams use a base value that needs to be added, but comparing other original firmwares for this device don't have the same compressed checksum difference as those calculated by ntkcalc (I have other examples of stock firmware so I know this)

I don't even have one of these so can't test, but does the firmware always have to be recompressed to be flashed? (with a valid 0x04 checksum)?

Also I note if I decompress, and recompress I end up with totally different file sizes. Maybe that doesn't matter?

(LZ77 FullComp)

Original: 4998076 bytes
Decompressed: 6712048 bytes
Recompressed: 2825444 bytes

Any help appreciated. I don't have one of these as I say but seems a lot of other people have these cameras and are forced to downgrade to old versions of firmware to avoid enforced marketing (that was not apparent when they bought them).

Already found and removed the logo but need to repackage properly - would like to help people affected if I can.

Thanks

[nutsey]

Hi, this fw consists of two partitions, but it is not necessary to modify them both.

1. Use DENOVA script to unpack this firmware.
2. Make changes in 1.bin file (remove logos etc).
3. Repack 1.bin with bfc by [email protected]
4. Flash it.

[incomingone]

Thanks the the response

ntfwtool.exe v0.1b crashes on this firmware, so the denova.bat script doesn't complete. Did it work for you? An updated version maybe?

The 2 partition fw does explain the size issue though - thanks!

And if I manually copy the BCL1 partitions to respective files and do the checksum it matches - but only I use the length specified in the compressed header (+0x10 for the header itself). For the first partition this means 0x28 bytes are ignored between the end of partition 1 and the start of partition 2. I guess I can just leave these out of a recombined file (only partition 1 would be changed, recompressed and then the unaltered compressed part 2 file appended) or reinsert them manually? Don't like that without knowing for they are for though

FYI the bytes are:

90 BE 27 88 CD 36 C2 4F A9 87 73 A8 48 4E 84 B1 28 00 00 00 44 BB 00 00 01 00 00 00 4C 57 2C 00 1D EF 11 00 01 00 00 00

At least I can stop looking in IDA now - though I did find the checksum algo which of course looks to be as already known.

Thanks again for the help.

edit: ah I see that partition footers are not unknown. As far as I can see this should just be reinserted at the correct place in a new file or if it worked for me the denova.bat would do this ("footer.bin").

Also I downloaded v0.8 of denova.zip though the denova.bat itself identifies as v0.7 in case that is relevant.

[incomingone]

Don't worry if have no time to look at this - following a post I made on a different forum offering a non-logo version of the firmware to owners, the manufacturer has responded (in less than 1 day) and seems to have changed it's position from "tough - no plans to give you the option of disabling our logo on your video we now enforce" to "ok we'll do it for any and all models if you contact support to request the firmware".

I am paraphrasing their response. Happy with that result and as I am buying a NT966XX dashcam anyway (though not from this company) the firmware knowledge gained in certainly useful