Hacking Q3H (allwinner v3 - Camdroid)

Last edited:
NTK cameras aren't fully reverse engineered. I think the firmware is decompressed but no modifications made yet because of checksums.
 
NTK cameras aren't fully reverse engineered. I think the firmware is decompressed but no modifications made yet because of checksums.

Hmmm, but it is possible since I saw some UART-Solderpoints on my PCB
 
Hi all,
I made some updates on unfex_refex_jpg2img_scriptbin_scripts. Check it on:
http://www.mediafire.com/file/0499qyl9ck66y42/3A-unfex_refex_jpg2img_scriptbin_scripts(2).rar

Now you will find scriptbin_read.bat and a scriptbin_writ.bat. The first one is the same as the old one but now you can extract script.bin from full_img.fex or UNFEX/0-uboot.img. The second one allows you write script.bin info on full_img.fex or UNFEX/0-uboot.img.

Thanks! I extracted script.bin binary using your tool and converted it to script.fex text using Uberizer 1.8. It's for a F60B Huangle.Crane SL603 camera. Here it is with build.prop and a photo of firmware info screen included. See post #151 for more info...

 
Last edited:
  • Like
Reactions: NMD
Thanks! I extracted script.bin binary using your tool and converted it to script.fex text using Uberizer 1.8.

Can you provide more information about converting script.bin binary to script.fex using Uberizer?
It would be interesting to be able to perform this operation on windows.
 
Can you provide more information about converting script.bin binary to script.fex using Uberizer?
It would be interesting to be able to perform this operation on windows.

Sure. I will elaborate a little for other people reading this post. Links to a tool or file are in blue text. If any links are dead/don't work then let me know. See attached photos.
  • Do backup of camera firmware using backup cmd script (I got it from goprawn.com).
  • Use your tool unfex_refex_jpg2img_scriptbin_scripts(2) on the firmware backup full_img.fex file to get a script.bin file
  • Download and install Uberizer 1.8 . Files usually go in C:\program files (x86)\Technow\Uberizer folder.
  • Place a copy of your script.bin file into that Technow\Uberizer folder.
  • Open Uberizer_Offline.bat file (so you don't need to connect an Android device).
  • Choose option I, press enter, and option 9, press enter. Joy!
  • Use option 10 in that menu listing to edit/view the script.fex file or look again in C:\program files (x86)\Technow\Uberizer folder for script.fex and view it in Wordpad or Notepad++ (regular Notepad will show a single continuous line of text)
  • In the option I menu listing, there is option 11 to convert script.fex back to script.bin . I haven't tried that yet but I suppose it works.
  • *UPDATE* - newer backup script here and newer unfex/refex/jpg2img scripts here
2016-11-13 16_30_45-Uberizer_v1.8+ADB files.zip - WinRAR.jpg 2016-11-13 16_31_39-Uberizer_File_Explorer.jpg Uberizer1.8_Allwinner_Firmware_Menu_I.jpg Uberizer1.8_Allwinner_Firmware_Menu_Option_I_9.jpg
 
Last edited:
Someone please help this all to confusing. I have flashed many android phones, edited update zips, and scripts but I cant figure this out. I made a back up..flashed the no sound img shows successful but I'm stuck on the boot image. I tried fixedcalculations, newmoduleuniform, all same results. i then flashed the q3h recovery and now back to boot image with sound but still sticks there. Can someone walk me through a fix or I can upload my back for someone make a flash img for me. I just want no boot sound and some tweaked camera settings. Phonenix shows device as "fuxin4k30imx179-sdv but was using xdv app.
 
I upload some boot_logo and shutdown_logo files.
You can find it on:
https://www.mediafire.com/folder/upm2r7ap6w5q6/Edit
I will update this folder with new logos later.
Good work. I chose the drone logos. However, I had to open and re-save jpg files with setting 100% compression, but not exceed 131072 bytes each file. A magnitude 5 to 10 sharpen operation on each jpg looks nice and increases the file size slightly but still under 131072. Original compression was 97 or 98. Used Image > Information menu item in IrfanView to get image file info.

Video of boot logo | Video of shutdown logo

Here is a backup IMG for PhoenixSuite of my F60B Craine Sl603 camera, containing those drone photo boot/shutdown logos, but this time the front body is yellow and firmware date in info screen is 20160514V4.0 (as opposed to black front body and 02160515V4.0). I have two cameras now. ^_^
F60B-action-camera-Firmware-Version-20160515V4.0-V3-Yellow-jpeg-photo2-resize.jpg F60B-action-camera-Firmware-Version-20160515V4.0-V3-Yellow-jpeg-photo-resize.jpg

Also, I managed to change the camera's network name (SSID) and password in HotShot app, under ⚙ Settings, WiFi-Info. Give new SSID, old password and new password. Then Confirm. Then TURN OFF wifi on camera (up button). Wait 5 seconds. Turn on wifi again on camera. Joy! I suppose any letters/numbers up to fifteen maybe sixteen characters long will work. ^_^
Change Wifi SSID Name and Password HotShot app F60B camera2.jpg

Someday I gotta determine how to change my imx179.ko , libCedarX.so , libvideoresizer.so , and other run files in 2-system.img (rootfs?) from goprawn.com forums but without bricking the cam. ://

*EDIT* Some days ago I received a generic "F60R" crane sl609 camera from ebay similar to F60B crane sl603 but with wireless remote. Its factory firmware has motion detection feature for video only. So about 4 seconds of motion in %50 or more of the view usually triggers recording. Keep the camera motionless for a few seconds before you stop the recording; otherwise a new recording automagically starts.
To flash this firmware directly to another F60B crane camera, the 0-uboot.img should be patched by writing your camera's script.bin using Uberizer 1.8 (see other post in this thread). This firmware could not be directly flashed to my F60B crane sl603 20160514 probably because lcd_driver or whatnot was wrong. So I put together a mix recipe firmware pack that will flash right (at least for me), along with drone boot/shutdown logos. In this filesystem, there are new files "awmd" under /system/lib and /system/res for the new feature. Note: when using motion detection, your screen will have a running-man icon, and video files may be delete-protected in menu and in \lock folder not in \video folder on sdcard and file names will have _SOS after date_time. This happened on one but not all of my F60B(R) cameras.
download - https://www.dropbox.com/s/g1mzbvtkvla68zn/F60B-mod-backup-crane_sl609.xiapc.20160913+20160514-lcd_ili9341-IMG-FEX.zip?dl=1
Also a user on goprawn has F60R firmware with motion detection but for beike imx179s 20160604. Try this if you have a beike board or try to make a recipe mix.
download - https://www.dropbox.com/s/jng1xik56...ez_beike4k30imx179s.20160604_goprawn.rar?dl=1

Nice "addon" feature that maybe you can use? What do you think?
crane_sl609-xiapc.20160913-menu-settings-motiondetection.jpg F60B-mod-backup-crane_sl609.xiapc.20160913+20160514-locked-file-prompt1.jpg
awmd.png
 
Last edited:
I'm gonna try your backup Pete i'm not booting anyway
*Update so you backup boots but screen is blank but I can take videos and pics so I'm making progress
 
I'm gonna try your backup Pete i'm not booting anyway
*Update so you backup boots but screen is blank but I can take videos and pics so I'm making progress
All these different Allwinner cameras should be called "Alllosers" because trying to mod them is difficult/time consuming sometimes. ;) Anyway, I had blank boot logo and/or blank shutdown logo until I tweaked the jpg files so many times. You might try other logos, instead of drones.
Which camera name/model/hardware do you have? See this goprawn.com thread for a list. Also see my other post #151 for other firmware and files. Good luck. Cheers.
 
All these different Allwinner cameras should be called "Alllosers" because trying to mod them is difficult/time consuming sometimes. ;) Anyway, I had blank boot logo and/or blank shutdown logo until I tweaked the jpg files so many times. You might try other logos, instead of drones.
Which camera name/model/hardware do you have? See this goprawn.com thread for a list. Also see my other post #151 for other firmware and files. Good luck. Cheers.
Thanks for the reply. This is the model I have "[FJJ] Fuxin 4K30 sold as Q3H/SJ9000 (skier logo)" Will blank logo also cause a blank screen all the time? I made a backup when things were working correct.
 
Finally!!! I find the makeimg.zip that allowed me to turn my back-up into img to flash with phoenix...now I'm ready to flash some mods now that I know how to unbrick
 
Someone please help this all to confusing....
I understand your pain :confused:. I want better sound recording and higher video bitrate as users thegamut and nutsey have done (here and goprawn.com forums). But I cause a white-screen or fully brick my cam when I rebuild full_img.fex with those mods. Well, you're ahead of me with "fixedcalculations, newmoduleuniform". What are those?
 
I understand your pain :confused:. I want better sound recording and higher video bitrate as users thegamut and nutsey have done (here and goprawn.com forums). But I cause a white-screen or fully brick my cam when I rebuild full_img.fex with those mods. Well, you're ahead of me with "fixedcalculations, newmoduleuniform". What are those?
Lol no clue thats why I flashed them and got stuck on logo, now that I can unbrick in 101 seconds I ready to try all the img I can find that they posted. I was hoping to upload my backup and maybe they could infuse the video mods then I could flash it, but I guess I could just try unpacking the img they have and pack with my bin script to see if I can boot...the odd thing is camera sensor is suppose to be the imx179 but the company website says OV sensor
 
Finally!!! I find the makeimg.zip that allowed me to turn my back-up into img to flash with phoenix...now I'm ready to flash some mods now that I know how to unbrick. ... This is the model I have "[FJJ] Fuxin 4K30 sold as Q3H/SJ9000 (skier logo)" Will blank logo also cause a blank screen all the time? I made a backup when things were working correct.
good. i had to use the same tool in this goprawn post to make IMG file that is ~21.7 MB size for flashing in PhoenixSuit. Flashing full_img.fex from SD card inside the cam is too slooow. I guess stock firmware for your FJJ Fuxin (skiier logo) is this https://drive.google.com/file/d/0B4tyaJWIqCb_bUFiUEpSUFBwb1k/view
(from goprawn). or try another from dashcamtalk.
So if that works without modding it first, then afterwards mod the logos and make a new IMG and flash it in PhoenixSuit. My F60B backup files most likely won't work for your cam. Looking forward to seeing pics/videos of your logos. Now time to watch some sci-fi: Stranger Things, The Strain and Westworld.
*EDIT*
Hello everyone I'm new here, did some reading through the thread and have a basic understanding. I do have a question what firmware and or mods can I flash on this thing? Already performed backup. I have a HDKing Q3H version 20160810V2.3, updated 20160810, bootlogo skier with welcome
James. Hehe that sounds funny when I say it...like a Bond movie ;) hehe. One more thing... If your backup is only slightly different than other "Q3H" FJJ fuxian (skier logo) firmwares, such as different drivers for LCD or whatnot, then yeah you should post your full_img.fex and IMG Phoenix files here. Chow.
 
Last edited:
I could flash F60-ext2-thegamut--- sticks at logo.
i could flash F60-std--- screen is inverted and so are the colors
I could flash tansuofaxian-imx179-20160830--- screen is inverted and so are the colors
i could flash F60B_firmware_20160514V4.0_backup_crane_sl603tsfx-YellowCase-BootShutdownLogosDrone-Phoenix_IMG--- no screen but full function
I could flash F60-cst--- blank screen no sound just blue led
Wont flash F60-beike
 
good. i had to use the same tool in this goprawn post to make IMG file that is 22.7 MB size for flashing in PhoenixSuit. Flashing full_img.fex from SD card inside the cam is too slooow. I guess stock firmware for your FJJ Fuxin (skiier logo) is this https://drive.google.com/file/d/0B4tyaJWIqCb_bUFiUEpSUFBwb1k/view
(from goprawn). or try another from dashcamtalk.
So if that works without modding it first, then afterwards mod the logos and make a new IMG and flash it in PhoenixSuit. My F60B backup files most likely won't work for your cam. Looking forward to seeing pics/videos of your logos. Now time to watch some sci-fi: Stranger Things, The Strain and Westworld.
*EDIT*
James. Hehe that sounds funny when I say it...like a Bond movie ;) hehe. One more thing... If your backup is only slightly different than other "Q3H" FJJ fuxian (skier logo) firmwares, such as different drivers for LCD or whatnot, then yeah you should post your full_img.fex and IMG Phoenix files here. Chow.
Hey Pete I actually have the same as that backup I was hoping I had something newer or different but nope. My dash cam is ambrella if I spelled that right
 
Back
Top