MiVue Firmware Modification

StrangeOrange

New Member
Joined
Apr 25, 2016
Messages
15
Reaction score
7
Country
Afghanistan
Dash Cam
Mio MiVue 388, 588
Hello,

Has anyone tried making changes to the firmware on a Mio MiVue device? Mine's a 588 but I think the procedure is similar across all the 5xx as well as possibly 6xx device range.

The firmware file SD_CarDV.bin is neither compressed nor encrypted, an can be sifted through with utilities such as strings or binwalk, and potentially interesting areas can then be modified with a hex editor.

There is a certain obstacle with the checksum being verified upon attempting to flash a new firmware. One way to go around this restriction is to use a hardware programmer with a desoldered memory chip. It has been documented (originally in Russian), although the author's objective was to recover from a hardware brick, so just for experimentation's sake it might seem like an overkill.

Another solution would be to recalculate the checksum after modifying the firmware. The 16-byte hash is stored in the firmware file at bytes 16-31 (bytes 0-15 are the common header, and the actual flashable firmware file starts at offset 32).

If anyone tried experimenting with the firmware, please share your findings.

Fun fact: along with one of the previous versions of the 588 firmware, Mio accidentally posted all the tools they themselves use to generate the SD_CarDV.bin file. Unfortunately, having realized their mistake, they eventually updated the download to remove them. The file name was MiVue588_SD_CarDV_VS00.0C.06.FT1.zip , and the download had the size of 10.7 MB, while the updated file without the tools, available from Mio's website as of now, is just 5.2 MB.
 
Last edited:
Hi again,

It seems no-one is really interested in it here but:
Yes, it's possible to modify the firmware. I've just managed to do it with my MiVue 588.

MiVue Watermark Gone.jpg

What can be changed:
  • Remove speech message upon startup
  • Remove the MiVue588 watermark that could not be otherwise switched off
  • Correct the speed unit from Kmh to km/h
  • Correct the filename of DEVICE.XML so that it's not all-uppercase (to Device.xml)
  • Replace the startup warning screen
Further changes are possible, this is just what I came up with at the moment. Sounds, images, text messages can all be replaced. The code can be altered too, although this part is more tricky.

The procedure is, briefly, as follows:
  1. Obtain a flashable firmware file you want to start with. The filename will be SD_CarDV.bin.
  2. Strip the first 32 bytes from that file. You can use dd or a GUI hex editor such as Frhed.
  3. Make any changes you want to the firmware file, for example with the hex editor linked above. It's all there in the open, unencrypted and uncompressed.
  4. Use the attached sdbin.exe utility to generate a 32-byte header for the firmware, so that the device accepts it for flashing.
  5. Flash the firmware the usual way.
Bytes #15-#31 (counting from 0) of the header are an MD5-based checksum calculated by this utility, and will change anytime there is a change to the firmware. With this in mind, work with the file stripped of the first 32 bytes, and only generate the header when you are ready to flash it.

Disclaimer: This is advanced stuff and there is no established software procedure to recover from a brick due to broken or improperly-flashed firmware. I'm just sharing the information; whatever you do with it, you do at your own peril.
 

Attachments

  • sdbin.exe.zip
    5.8 KB · Views: 122
Last edited:
Hi

Is there any utility to update or add to the speed camera / safety camera file?
 
does anyone have the file MiVue588_SD_CarDV_VS00.0C.06.FT1.zip , with the size of 10.7 MB with all the additional tools??
 
Ok I have the mio converter program and the excel format for creating the speed cam file. Thanks
 
It seems no-one is really interested in it here but:

No quite ... ;)

Hello and thank you for the info.

And YES, I AM really interested. As a matter of fact I am SOOO interested that just joined DashCamTalk. :D

I got a MiVue 580, latest firmware (apparently): VS00.0B.EB.FA1N

Had a quick look/browse on the SD_CarDV.bin :eek:

Could you give some more specific details as in where and what to modify?.
First steps are to remove that senseless and irrational logo from my videos.

Thank you in advance
 
I AM really interested ... ;)

Definitively not lack of interest but time constrains ...

All done!!
"All" I wanted to do, anyway, that was that annoying logo.

It IS quite straightforward and StrangeOrange has done all the work to make it so easy ...

I have a Navman MiVue 580, as it is sold in Australia.

What I have done to remove the logo is (again, as described above by StrangeOrange):

1. Get the latest firmware .bin file.
2. With hex editor chop_off the first 32 bytes of SD_CarDV.bin
3. Search for string MiVue580
4. Replace with hex00
5. Save as SD_CarDV-nologo.bin (or something else).
6. In a Windows environment run CMD, set directories and then run: sdbin.exe SD_CarDV-nologo.bin that will generate SD_CarDV.bin
7. Copy SD_CarDV.bin on the memory card, install card and update dashcam firmware.
8. The logo is now gone.
(I "guess" it could be replaced with number plates, ID, names or whatever, haven't tried.)

Good luck and happy motoring :)
 
Last edited:
Ok. I also played around with the bin file for the Mivue 568 touch :)

I changed the logo:
FILE170525-152818.MOV_snapshot_00.00_[2017.05.25_16.29.10].jpg

Is there a way to remove the speed recording somehow in the bin file ?

Also it is possible to extract all the Images and wav files from the bin file to change them :) But I don't care much to change anything. I only turned off the safety warning screen into the goodbye logo :D
 
SBIN.exe. is a nice virus! Thank you ! I need the original firmware read with a memory programmer. Does anyone have it?
 
Last edited:
SBIN.exe. is a nice virus! Thank you ! >:p I need the original firmware reded with a memory programmer. Does anyone have it?

What is SBIN.exe ?
Are you refering to SDBIN.exe ???
I used SDBIN.exe as provided by StrangeOrange and had no problems.
Do you understand that only writes a header? Don't you?

Care to clarify what on earth do you mean with "I need the original firmware reded with a memory programmer."
reded???? You meant "read", past tense of verb to read ?? As in: I need the original firmware read with a ...

If you are after the original firmware for the MiVue580 check Navman website. But I am not sure what version you will need. Are you in Romania? The one I downloaded is for Australia.
Is that what you are after? ? ? ? ?
 
Yes, sorry, you are right. I meant to say that I need the complete content from the memory chip, maybe someone had desoldered the memory chip from board and read the BIN file. I have "MiVue 588 " dashcam and when I power it on, it displays the loading screen and then nothing but a black screen. No response from any key, no reset.
 
Sorry but I don't have access to a 588 ...

Did you try copying a 588 firmware .BIN file on the SD and then restarting?

Back to my 580, when modified .BIN files weren't correct I got a "Parity error".
Your 588 seem to show a different behavior, booting up but then doing nothing. May be is a hardware problem?
No ideas really.

But good luck.
 
PLZ anyone share MiVue588_SD_CarDV_VS00.0C.06.FT1.zip
 
PLZ anyone share MiVue588_SD_CarDV_VS00.0C.06.FT1.zip
I don't have this file, sorry. I was looking for it too but the only person I found who had saved it, deleted it before I could get a copy.
 
Last edited:
I was wondering if we could change the reserved space for emergency recordings, I use a 128GB card in my 538 and "only" get 78 GB for recordings, rest is reserved for emergency recordings
 
Greetings to all!
The algorithm described here is suitable for old firmwares, for processors, which, apparently, are not used in modern devices.
In modern devices, for example, on Mstar 8428Q processors, the firmware code has an additional header, in which, obviously, some checksums are stored, because any change in the firmware code leads to a complete inoperability of the device, even if the checksum in the header is recalculated.
Changing pictures and sounds in partitions with images of file systems goes well and the device works after that. But changes in the firmware code require recalculation of some checksums, in addition to the one in the header of the entire container with the firmware.
Does anyone know what and how is calculated there?
 
Back
Top