Reverse engineering, Web API, Live feed...etc

kotysoft

Member
Joined
Jun 11, 2016
Messages
71
Reaction score
44
Country
Hungary
Dash Cam
mini 0805, mini 0903
Hi everyone.
For first: I'm not an engineer or programmer. I'm just a enthusiastic user. I spent my whole night to research anything about capabilities of Novatek 96655 in the hope of changing bitrate, AE table, etc. During this research I found some intresting things. Maybe some of you already knew all of it, but I didn't found here in forum, so...

And sorry for my bad english knowledge and grammar mistake

WEB API
As you know, this camera can be controlled by wifi with applications, like FinalCam. These apps are using common http request to send commands and receive parameters. Fortunately it's not a rocket science, so once you connected your computer (or IOS, or Android, or anything) directly to your dashcam wifi, you can control it and read informations or download files!

How it works?
1.)
Enable Wifi on your 0903 (or any Novatek) dashcam
2.) Find and Connect (directly from PC or Mobile) to it's host with password (SSID and PW are written on dashcam screen)
3.) read below...

The NanoQ (and probably other Novatek 96655 dashcam) IP is: 192.168.1.254

If you just open this IP ( http://192.168.1.254 ) in your regular browser, it will display the folder structure of your SD card, and from here you can download them and also remove them (one-by-one)
Screenshot_2016-08-25-00-54-39.png


If you want to do something more, use this format:
http://192.168.1.254/?custom=1&cmd={command}&par={parameter}

Thanks to Nutsey @GoPrawn there is a full list of commands (not tested everyone on 0903 (yet)). Some of them will not work and some of them freezing/restarting your NanoQ..

1001 nul take photo returns filename and freepicnum or errcode
1002 enum set photo size freepicnum changes if changed
1003 nul get freepicnum
2001 start/stop 1/0 check maxrecordtime before start
2002 enum set video size maxrecordtime changes if changed
2003 on/off set looprec
2004 on/off set hdr (wdr?)
2005 enum set EV, 6=0
2006 on/off set mot.detect
2007 on/off set record audio
2008 on/off set date stamp
2009 nul shows max rec time with current bitrate
2010 enum liveview size
2011 on/off g-sensor sens. 0=off 3=max
2012 on/off autorec
2013 bitrate string vid bitrate kb/s
2014 bitrate string liveview bitrate
2015 start/stop 1/0 liveview
2016 nul shows current mov rec time in sec
2017 take video snapshot -13 exec fail
2018 save snapshot file -1 no file
3001 enum 0/1/2 phot/vid/play
3002 nul lists commands
3003 ssid string set ssid
3004 psw string set psw
3005 yy-mm-dd str
3006 hh-mm-ss str
3007 enum poweroff time
3008 enum lang
3009 enum tv format
3010 enum format SD
3011 nul defaults
3012 nul show ver
3013 nul FW update
3014 nul cmd status show
3015 nul file list
3016 nul ping cam
3017 nul get free space
3018 nul reconnect wifi
3019 nul get battery level 0=full 1=med 2=low 3=empty 4=exhstd 5=chargeon
3020 nul socket port 3333 error status
3021 nul save settings to flash
3022 get hw capacity st=0 val=3
3023 remove last user st=0
3024 get sd status 0=rem 1=ins 2=locked st=0 val=1
3025 http://115.29.201.46:8020/download/filedesc.xml
3026 http://192.168.1.254/FW96660A.bin
3029 shows SSID/psw <SSID>GITUP</SSID> <PASSPHRASE>12345678</PASSPHRASE>
3030 nul returns video mode list
3031 &str shows some cmds
3032 set network for STA mode SSID:psw
3033 turn on STA mode restart wifi with 3018 st=0
4001 file path string get thumbnail path+request path in capitals!!!
4002 file path string get preview path+request path in capitals!!!
4003 file path string delete 1 file req+path
4004 file path string del all
5001 returns 32k data NOR SPI flash?
/*--------------Photo----------------*/
NT_CAPTURE = 1001
NT_CAPTURESIZE = 1002
NT_FREE_PIC_NUM = 1003

/*--------------movie----------------*/
NT_RECORD = 2001
NT_MOVIE_REC_SIZE = 2002
NT_CYCLIC_REC = 2003
NT_MOVIE_HDR = 2004
NT_MOVIE_EV = 2005
NT_MOTION_DET = 2006
NT_MOVIE_AUDIO = 2007
NT_DATEIMPRINT = 2008
NT_MAX_RECORD_TIME = 2009
NT_MOVIE_LIVEVIEW_SIZE = 2010
NT_MOVIE_GSENSOR_SENS = 2011
NT_SET_AUTO_RECORDING = 2012
NT_MOVIE_REC_BITRATE = 2013
NT_MOVIE_LIVEVIEW_BITRATE = 2014
NT_MOVIE_LIVEVIEW_START = 2015
NT_MOVIE_RECORDING_TIME = 2016
NT_MOVIE_TRIGGER_RAW = 2017
NT_MOVIE_GET_RAW = 2018

/*--------------setup----------------*/
NT_MODECHANGE = 3001
NT_QUERY = 3002
NT_SET_SSID = 3003
NT_SET_PASSPHRASE = 3004
NT_SET_DATE = 3005
NT_SET_TIME = 3006
NT_POWEROFF = 3007
NT_LANGUAGE = 3008
NT_TVFORMAT = 3009
NT_FORMAT = 3010
NT_SYSRESET = 3011
NT_VERSION = 3012
NT_FWUPDATE = 3013
NT_QUERY_CUR_STATUS = 3014
NT_FILELIST = 3015
NT_HEARTBEAT = 3016
NT_DISK_FREE_SPACE = 3017
NT_RECONNECT_WIFI = 3018
NT_GET_BATTERY = 3019
NT_NOTIFY_STATUS = 3020
NT_SAVE_MENUINFO = 3021
NT_GET_HW_CAP = 3022
NT_REMOVE_USER = 3023
NT_GET_CARD_STATUS = 3024
NT_GET_DOWNLOAD_URL = 3025
NT_GET_UPDATEFW_PATH = 3026
NT_UPLOAD_FILE = 3027
NT_LIST_CAMERE = 3029

/*--------------playback----------------*/
NT_THUMB = 4001
NT_SCREEN = 4002
NT_DELETE_ONE = 4003
NT_DELETE_ALL = 4004

USAGE EXAMPLE:
Start recording: http://192.168.1.254/?custom=1&cmd=2001&par=1
Get free space (in bytes): http://192.168.1.254/?custom=1&cmd=3017
If you found something useful in values or formats or commands, please share!
Screenshot_2016-08-25-01-29-44.png


LIVE VIEW (streaming)
Nothing special. Just open the url in any player that supports RTSP protocoll (PC: VLC, KMPlayer Android: MxPlayer, etc) rtsp://192.168.1.254/{anyfilename}.mov
for example rtsp://192.168.1.254/dashcamtalk.mov

I'm still couldn't set the video size of streaming, currently it's 1920x1080@30 when not recording and 640x360@25 when recording for me.
UPDATE: When not recording, it's streaming the same feed you set for record resolution

Screenshot_2016-08-25-01-39-20.png


NOVATEK FIRMWARE
Well, credits still for Nutsey. He just made a simple command line tool to pack/unpack Novatek firmwares. It is just a very early version (v0.1) and not like AFT for ambarella...
>> LINK to his post <<

I'm still intrested in changing bitrates (and AE METERING table) in Novatek firmwares, so I tried something. I downloaded the 20160329_16M and 20160329_20M firmwares for NanoQ, then unpacked with NTWFTOOL then compared them with hex editor.
0903-hex01.jpg
0903-ida01.jpg

The first mismatch probably something about version or date/time I dont know. IMO the second difference is the bitrate. I just opened it in IDA, but unfortunately I'm still groping in the dark...
If anyone can Identify this format and how to convert it to decimal bitrate, then which line should I change in another Roms then I owe him/her a beer! :)
Code:
HEX for 16Mbps = 40 1F      IDA= DCD dword_1F3DC4+0x23C
HEX for 20Mbps = 10 27      IDA= DCD dword_2708C0+0x740

Aaand also I don't know yet how to use ntwftool to pack firmware back once edited :D

Well, I hope I gave a good start for curios 0903 users. I hope somebody with experience and skills will help us to continue investigation

UPDATE --------------------------

This morning I just got a new firmware to test from Rayman. It is same as 20160705 the only difference is the new option 1920x1080@30 BOOST resolution what has 20Mbps bitrate. Currently it's for TESTING purposes
>> Firwmare_20160825_test by Rayman <<

As usual, update on your own risk
 
Last edited:
Update: Maybe I'm wrong, but I found something related to Bitrate question:
Code:
40 1F <reversed> 1F 40 = in decimal 8000
10 27 <reversed> 27 10 = in decimal 10000

exactly the half of bitrate values (16000 and 20000)
Is it possible?

UPDATE 2: I checked 4 different ROMs (20160321, 20160329_16, 20160329_20, 20160705) and searched for previos hex values
Code:
FF FF FF FF 00 05 00 00 D0 02 00 00 1E 00 00 00 00 80 0C 00 00 00 00 00 50 03 00 00 E0 01 00 00 1E 00 00 00 00 40 06 00 00 00 00 00 80 02 00 00 E0 01 00 00 1E 00 00 00 00 40 06 00 00 00 00 00 80 02 00 00 68 01 00 00 1E 00 00 00 00 40 06 00 00 00 00 00 40 01 00 00 F0 00 00 00 1E 00 00 00 00 B0 04 00 00 00 00 00 80 07 00 00 38 04 00 00 1E 00 00 00 00
and found
Code:
A8 16 <reversed> 16 A8 = in decimal 5800
Basically on 1920x1080@30 PERFECT bitrate is about 12Mbps, so I think this value is the half of bitrate.

Since I still don't know how to pack back again the unpacked firmware, I cant test it yet :(
 
Last edited:
This is good stuff. Thank you.
 
And here it is!
0903-bitrates.jpg


search for
Code:
FF FF FF FF 00 05 00 00 D0 02 00 00 1E 00 00 00
in unpacked bin.

Ok, next step:
- How the hell can I pack it? :rolleyes:
- Does it needs any signature or checksum, or anything?
 
Last edited:
Regarding the Web API, some user have shared on internet, is same for all of Novatek cameras, how will you use the API?
 
I hope maybe some enthusiastic programmers who has 0903 will start to make PC/Linux/Mac software, like they did for Yi Dashcam, or a better Android app than FinalCam (since Finalcam has very limited functionality for this NanoQ) :)
 
I hope maybe some enthusiastic programmers who has 0903 will start to make PC/Linux/Mac software, like they did for Yi Dashcam, or a better Android app than FinalCam (since Finalcam has very limited functionality for this NanoQ) :)
General APP support recording and taking photo, what do you want more?
That tool is for Yi Action camera based on Linux system, not compatible with 0903 Novatek camera.
 
I know Yi Dashcam is not the same, this app was just an example what to do with the Web API commands.
I tought I'd help someone if I share this. But please tell me if it's a "guarded secret" of Manufacturers and I'll delete it!

---

This morning I just got a new firmware to test from Rayman. It is same as 20160705 the only difference is the new option 1920x1080@30 BOOST resolution what has 20Mbps bitrate. Currently it's for TESTING purposes
>> Firwmare_20160825_test by Rayman <<
 
Last edited:
I know Yi Dashcam is not the same, this app was just an example what to do with the Web API commands.
I tought I'd help someone if I share this. But please tell me if it's a "guarded secret" of Manufacturers and I'll delete it!

---

This morning I just got a new firmware to test from Rayman. It is same as 20160705 the only difference is the new option 1920x1080@30 BOOST resolution what has 20Mbps bitrate. Currently it's for TESTING purposes
>> Firwmare_20160825_test by Rayman <<
Don't delete anything. Please continue ;)
 
kotysoft: I've been working on a platform independent Python library/command line tool and web app (v.early stages for web app) for the YI Dashcam. Many commands are very similar, so I suspect elements of the code will work for other Novatek devices. Please see: https://dashcamtalk.com/forum/threads/yi-dash-cam-python-library-and-web-app.21100/

It should be possible to dynamically identify the connected camera (using things like the 3002 list commands and 3035 model name) and adapt the Python classes to abstract the differences. If there's interest and some volunteers for testing with other devices, I'd be willing to look into this.
 
kotysoft: I've been working on a platform independent Python library/command line tool and web app (v.early stages for web app) for the YI Dashcam. Many commands are very similar, so I suspect elements of the code will work for other Novatek devices. Please see: https://dashcamtalk.com/forum/threads/yi-dash-cam-python-library-and-web-app.21100/

It should be possible to dynamically identify the connected camera (using things like the 3002 list commands and 3035 model name) and adapt the Python classes to abstract the differences. If there's interest and some volunteers for testing with other devices, I'd be willing to look into this.
Yi dash cam also use Novatek chipset, so some commands are same.

We have done further on action cameras than others, like support custom boot/power off logo, Wi-Fi work in station mode.
 
Some interesting news finally come here. Thank you @kotysoft ! The only thing that prevented me to order mini0903 cam with novatek chipset is lack of possibility to change bitrate and AE table in firmware. I beleive the day we learn how to compile the flashable firmware with custom bitrates and AE tables will be the new birthday of 0903 dashcam. It's some kind of routine work to optimize image quality but it is the power of the community that make the dreams come true. God bless novatek cam users!
 
Some interesting news finally come here. Thank you @kotysoft ! The only thing that prevented me to order mini0903 cam with novatek chipset is lack of possibility to change bitrate and AE table in firmware. I beleive the day we learn how to compile the flashable firmware with custom bitrates and AE tables will be the new birthday of 0903 dashcam. It's some kind of routine work to optimize image quality but it is the power of the community that make the dreams come true. God bless novatek cam users!

Well... Don't forget: It's beautiful to unpack and edit things in firmware, but still unable to pack sign and flash :(

The coder guys need some help to solve the checksum algorythm :) https://dashcamtalk.com/forum/threads/nt96655-firmware-studies.18585/page-2

-----------
BTW few days ago I tought I've found the AE table but 2 new test firmwares (by @Rayman.Chan) are refuted.... Or maybe it is not changed...?

At another thread Rayman posted 3 versions of AE table. The 1st one (spot) looks proved my hypothesis about default metering. Found it in unpacked firmware, but the "official test" firmwares with modified AE Table didn't showed any difference at those bytes. Maybe it isn't changed at test FWs, maybe I found wrong bytes, don't know, and can't test (yet)

hypothesis only (PICTURE)
 
Last edited:
Sorry for cross-posting, but you guys here probably know more about different released firmwares.. Are there any more firmwares with different bitrate settings besides the one from OP? (20160329)
 
Sorry for cross-posting, but you guys here probably know more about different released firmwares.. Are there any more firmwares with different bitrate settings besides the one from OP? (20160329)

Check THIS thread at the bottom of the first page. Here the bitrates same, but the AE matrixes are different. Maybe useful for further investigation for you...?
 
How to change the firmware so that the wifi does not turn on, by the Wifi the bitrate above 20 does not work.
But the video input works fine with bitrate 36.
 
is anyone know hox to change the ip of the camera
i need to monitor more than one camera at the same time on a single laptop
thanks
 
If the camera can support station mode, then can connect the wireless router, and each camera has different IP.
 
Back
Top