Announcement

Collapse
No announcement yet.

iCatch (Sunplus) firmware hacks.

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • iCatch (Sunplus) firmware hacks.

    There are several ways to update an iCatch camera firmware. One of those is in-camera update with a BRN (SPHOST.BRN by default) file placed to the root of the memory card.

    So let's see what's the structure of such BRN files:
    Click image for larger version

Name:	brn-header.png
Views:	921
Size:	10.3 KB
ID:	10334

    0x000-0x1FF byte range is the fw header. It has 'SUNP BURN FILE' title at the 0x000 offset. Then at 0x010 we have the fw filesize (little-endian dword) and six offsets of firmware partitions at 0x14, 0x18, 0x1C, 0x20, 0x24 and 0x28. Another partition starts right after the header thus it has no special offset here. The header ends with a CRC (checksum) value at 0x1FC.
    Donate here if you want to support my efforts and this site. Other options for gratefulness are also available on request.

    Email me if you have any offers, requests or ideas.

  • #2
    BRN partitions:
    0 - ISP bootloader,
    1 - AIMG FAT16,
    2 - BIMG FAT12,
    3 - CIMG (not used ?),
    4 - firmware BIN file,
    5 - Bad pixel calibration info,
    6 - DRAM settings.
    Donate here if you want to support my efforts and this site. Other options for gratefulness are also available on request.

    Email me if you have any offers, requests or ideas.

    Comment


    • #3
      do you have ram map of cameras? i 'd like to reflash dead camera, but it looks its only allow to use terminal commands. such dump and others...so i'd like to write firmware directly to RAM to allow update VIA SD card...

      Comment


      • #4
        Originally posted by nutsey View Post
        There are several ways to update an iCatch camera firmware. One of those is in-camera update with a BRN (SPHOST.BRN by default) file placed to the root of the memory card.

        So let's see what's the structure of such BRN files:
        Click image for larger version

Name:	brn-header.png
Views:	921
Size:	10.3 KB
ID:	10334

        0x000-0x1FF byte range is the fw header. It has 'SUNP BURN FILE' title at the 0x000 offset. Then at 0x010 we have the fw filesize (little-endian dword) and six offsets of firmware partitions at 0x14, 0x18, 0x1C, 0x20, 0x24 and 0x28. Another partition starts right after the header thus it has no special offset here. The header ends with a CRC (checksum) value at 0x1FC.
        Hey. I did not understand which part of the file is checked for CRC and which CRC algorithm?

        Comment


        • nutsey
          nutsey commented
          Editing a comment
          Check the sumpatch.exe tool at any modern iCatch FRM software.

        • Zormax
          Zormax commented
          Editing a comment
          I don’t understand how to run sumpatch.exe and what command line to write ..

      • #5
        Originally posted by nutsey View Post
        The header ends with a CRC (checksum) value at 0x1FC.
        Help please describe the example of running sumpatch.exe and what command line to write ...

        Comment


        • nutsey
          nutsey commented
          Editing a comment
          I didn't try it, but I found this:
          sumpatch `bin' [-s `skip'] `patch_ofs'

        • Zormax
          Zormax commented
          Editing a comment
          This work:
          sumpatch.exe firmware.bin 508

          508 == 0x1FC - 1
          Last edited by Zormax; 08-23-2019, 03:40 PM.

      • #6
        And? Can you modify firmware? Can you add digital stabilization in firmware (SPCA6350 can do this)?

        Comment

      Working...
      X