Hacking Q3H (allwinner v3 - Camdroid)

Hey Pete I actually have the same as that backup I was hoping I had something newer or different but nope. My dash cam is ambrella if I spelled that right
Hey Bond hehe ;) I'm not sure, but if your camera partially works when flashing Allwinner firmwares, then likely your camera has Allwinner chip and some other sensor. So it may not be or have Ambarella chip. Those are usually for high end stuff like Xiaomi Yi and real GoPro. Too bad. We could use a good chip that runs Linux/Android in a camera for $50. :rolleyes: By the way, if you can discover which LCD (model/driver/whatnot) your camera uses by searching online, or extract and convert to fex (text) the script.bin from your own original firmware full_img.fex backup (if you still have it or can make it), then get the "lcd_driver_name" in the script.fex file and then try to get or build the right firmware file combo based on your previous experiments and based on this lcd info. Here is full_img.fex and 0 thru 6 little img files backup of my yellow cam. This is lcd info from the F60B firmware:
Code:
[lcd0_para]
lcd_used = 1
lcd_driver_name = "ili9341"
lcd_if = 1
lcd_x = 240
lcd_y = 320
lcd_width = 108
lcd_height = 64
lcd_dclk_freq = 16
lcd_pwm_used = 1
lcd_pwm_ch = 0
lcd_pwm_freq = 50000
lcd_pwm_pol = 1
lcd_pwm_max_limit = 255
lcd_hbp = 60
lcd_ht = 405
lcd_hspw = 30
lcd_vbp = 340
lcd_vt = 670
lcd_vspw = 2
lcd_frm = 1
lcd_hv_clk_phase = 0
lcd_hv_sync_polarity = 0
lcd_gamma_en = 0
lcd_bright_curve_en = 1
lcd_cmap_en = 0
lcd_cpu_mode = 1
lcd_cpu_te = 1
lcd_cpu_if = 14
lcd_hv_if = 0
lcd_hv_srgb_seq = 0
lcd_rb_swap = 1
lcdgamma4iep = 22
lcd_bl_en = port:PB13<1><0><2><1>
lcd_power = port:PB12<1><0><2><0>
 =
lcd_gpio_0 = port:PC4<1><0><2><1>
lcdd3 = port:PD1<2><0><2><default>
lcdd4 = port:PD2<2><0><2><default>
lcdd5 = port:PD3<2><0><2><default>
lcdd6 = port:PD4<2><0><2><default>
lcdd7 = port:PD5<2><0><2><default>
lcdd10 = port:PD6<2><0><2><default>
lcdd11 = port:PD7<2><0><2><default>
lcdd12 = port:PD8<2><0><2><default>
lcdclk = port:PD18<2><0><3><default>
lcdde = port:PD19<2><0><3><default>
lcdhsync = port:PD20<2><0><3><default>
lcdvsync = port:PD21<2><0><3><default>
just a quickly thought up idea... buena suerte

and if you're feeling adventurous, users nutsey and thegamut lead me to Russian language forums about these cameras. I took Russian class last year so I can read cyrillic and I remember a few words... Also, I think those users are good in Russian. but I haven't yet found anything so useful there compared to here (and goprawn). still looking. mostly just for fun hehe.
http://4pda.ru/forum/index.php?showtopic=706191
http://4pda.ru/forum/index.php?showtopic=759392
cheers.
 
Last edited:
I upload some boot_logo and shutdown_logo files.
You can find it on:
https://www.mediafire.com/folder/upm2r7ap6w5q6/Edit

I will update this folder with new logos later.

Good work. I chose the drone logos. However, I had to open and re-save jpg files with setting 100% compression, but not exceed 131072 bytes each file. A magnitude 5 to 10 sharpen operation on each jpg looks nice and increases the file size slightly but still under 131072. Original compression was 97 or 98. Used Image > Information menu item in IrfanView to get image file info.

Video of boot logo | Video of shutdown logo


Currently my logos are progressively encoded JPEG files. On my camera, a black screen appears instead a welcome logo screen when I use progressive format. Unfortunately, I have not updated these files yet to baseline encoding format. This weekend I should be able to do this.

Meantime, I've written some scripts that allow you to convert progressively encoded JPEG image files to baseline. I should also upload this scripts during next weekend.
 
Pete my driver is "st7789v" and just for clarity I have 2 "fuxin4k30imx179-sdv" cameras and 1 "Model: Samoon A7810
Processor: Ambarella A7 LA70" dash cam. The Samoon takes better video in my opionion.
 
"fuxin4k30imx179-sdv" the hint is in the name, imx179 sensor, not imx179s sensor. Imx179s images (ie no sounds, etc) don't load the imx179 module so they won't boot to anything but ADB + black screen. You can mix and match kernels/scripts/rootfs most of the time. Keep the script + kernel and change the rootfs and to load the patches. If you have the original script you just have to inject it into what you're trying, even another camera's stock firmware.
 
"fuxin4k30imx179-sdv" the hint is in the name, imx179 sensor, not imx179s sensor. Imx179s images (ie no sounds, etc) don't load the imx179 module so they won't boot to anything but ADB + black screen. You can mix and match kernels/scripts/rootfs most of the time. Keep the script + kernel and change the rootfs and to load the patches. If you have the original script you just have to inject it into what you're trying, even another camera's stock firmware.
Thanks can you give me example for what I can mix and match? Am I just keeping my stock kernel and script and adding other stuff?
 
ie imx179.ko from another fw, whole rootfs from another firmware. pretty much your last sentence. I also made an all module kernel that reads rootfs from sd.
 
I could flash F60-ext2-thegamut--- sticks at logo.
i could flash F60-std--- screen is inverted and so are the colors
I could flash tansuofaxian-imx179-20160830--- screen is inverted and so are the colors
i could flash F60B_firmware_20160514V4.0_backup_crane_sl603tsfx-YellowCase-BootShutdownLogosDrone-Phoenix_IMG--- no screen but full function
I could flash F60-cst--- blank screen no sound just blue led
Wont flash F60-beike
Howdy. I see... You tried some other firmwares from goprawn?
I found this recently for Excelvan Q8
https://www.goprawn.com/forum/allwi...mnivision-ov4689-action-cameras?p=994#post994
and maybe look for more there.
 
My top reasons for shutdown/restart were loose or bent battery pins and the wifi app. It would look like its recording on the phone but the camera had stopped and then auto powered off. With the pins I would bump the camera and it would restart or power off.

I should put a guide to using ext2 at some point because adb push is a much easier way to test changing settings in the module. Last thing I messed with is limiting digital gain, I think its one of the reasons that low light is so bad. Nothing too awesome yet since it messes with the auto exposure but it was 200x easier to test than the other settings. The current IMX179s modifications produce pretty decent video when there is enough light. Changing the AE pattern to stop favoring the sky so much might help too.

My long term thought was to figure out why v4l-ctl settings don't stick and then control the camera with adb over wifi. 12bit raw modes are available and while there is no bandwith to record video, the stills would be nice.

https://uloz.to/!3e4FlnceD6R6/backup-zip is OV4689, 2k is full size. the only fixes are turning off post processing in the module like sharpening, denoise, etc.

Hello,

I'm hacking my camera again. I have succesfully extracted squashfs from IMG and replaced logos using scripts provided in this thread. I'm jist wondering, where should I switch off post processing. Do you have any ideas please?

Thanks

Vit Soucek
 
I cant get anything custom to work can someone with a modifications make an img from my full fex or img?
 
Hello trying to access udp flux from cam (Excelvan Q8) on PC with VLC.

For the time nothing work. But can obtain udp video flux. (join dirty python 2.7 files)
What I found for now:
1 - http (80) Requests seem's optional
- GET /system/build.prop HTTP/1.1
- GET /data/sunxi.db HTTP/1.1
- GET /data/menu.cfg HTTP/1.1
- GET /system/etc/settings.xml HTTP/1.1
- GET /system/etc/info.xml HTTP/1.1
With header :
User-Agent: NetFox
RANGE: bytes=0-
Host: 192.168.100.1
Connection: Keep-Alive
Accept-Encoding: gzip

2- tcp (6666)
a- authent hex-stream (admin 12345) :
abcd00810000011061646d696e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003132333435000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
b- ???
abcd000000000112
c- ???
abcd00040000a02501000000
d- ???
abcd00000000a034
e- ???
abcd0008000001ff0000000000000000
f- maintain video udp flux on if send in loop (every 2s)
abcd00040000a02a01000000

3- udp (6669)
dont realy understand...
- one 24 bytes packet
pattern exemple on 2 cycles
"bcde0010004300024e000000000000000000000042000000"
"bcde0010004c00024e000000000000000000000064000000"

- few 1008 bytes packets
pattern exemple on 1 cycle (the first bytes of 3 first 1008 packets)
"bcde03e80044 000100000001419a40817f6d5680b89b8beaecf9cc96417bad...."
"bcde03e80045 00013837a16bea77389a90d22bc985b90340249b314b289c6....."
"bcde03e80046 0001373edae50340797ef7d60ac2838faa84949c408f929cc0b....."
seem's to be "bcde03e800" and increasing "44", "45", "46"....

- one variable bytes packet
700 bytes packet (1st cycle last variable packet)
"bcde02b400420001 5ea5d510d5273323633ce856c0f49f76b92288ef28ef65bc8f83....."

549 bytes packet (2nd cycle last variable packet)
"bcde021d004b0001 c5b29291ea8e68a45ea51965c0ed6bca6ed4c8abcb76664adb5f....."

In my computer VLC seems to not detect stream (but present in wireshark)
udp://@0.0.0.0:6669 (does nothing.)

regards
 

Attachments

  • python27-dirty-poc.zip
    1.2 KB · Views: 13
Last edited:
Hello trying to access udp flux from cam (Excelvan Q8) on PC with VLC. ...
hello. ooh very interesting! you are quite handy with Python. Maybe you have seen my previous posts here. I captured raw tcp/ip traffic between a smartphone and the F60B camera with tcpdump when Wimius-XDV (or compatible app) was connected and displaying live video. Too bad the auth handshake on tcp 6666 is tricky to reverse engineer. the app and camera re-auths every few seconds? huh that's overkill I think. and video feed on udp 6669 also seems to be proprietary/non-standard. :eek: If you have done similar work on other cameras, I would like to read it.

Another thing I wonder is how the one app HotShot changes wifi ssid and password (in mtd2 system or mtd3 config)?
change-wifi-ssid-name-and-password-hotshot-app-f60b-camera2-jpg.27398

Thanks for your work. Cheers
 
I cant get anything custom to work can someone with a modifications make an img from my full fex or img?
hey James. how's your cam hacking? We can work together to make something happen. Are you mix-n-matching or editing binary .so/.ko files directly?

I learned a few things from people on goprawn, mostly how to mix some files together from diff sources to pack up new full_img.fex recipes. but effectively editing binary .so/.ko files in hexadecimal like thegamut/nutsey do is a bit too much for me right now. so yeah i know i can take a 2-system.img file that has imx179 (for my f60b) from any original firmware listed on page one post #8 on goprawn and use it with my other pieces 0/1/3/4/5/6. so for a simple example, i did this:
here - https://dashcamtalk.com/forum/threads/hacking-q3h-allwinner-v3-camdroid.20507/page-10#post-298724

Well, you said you have two fuxin4k30imx179-sdv cameras? but which firmwares are loaded? maybe one of these (from goprawn)?
• Fuxin (campark boot logo) 2016-05-09 (shows C20160716V03)
• Fuxin (excelvan boot logo) 2016-08-12 (shows C20160810V2.3)
and how would you like to modify your firmwares? improved video or sound?

and you said you could flash my F60B firmware 20160514V4.0 crane_sl603 but no screen but full function? I see... okay, in this case if you still want to use that firmware then I think this is what you can do: get your original script.bin or one that works in your camera from a firmware using 'read_script.bat' and write this script.bin to my 0-uboot.img or to full_img.fex using 'write_script.bat'. and make a new full_img.fex using 'refex.bat'. see links below. otherwise, changing individual files inside 2-system.img for example requires unsquashfs/mksquashfs and adding 0 (zeros) to the end of the new 2-system.img that would be built. i can help with that. let me know if I'm going the right or wrong way all of this... hehe

https://dashcamtalk.com/forum/threads/hacking-q3h-allwinner-v3-camdroid.20507/page-10#post-298713
https://www.dropbox.com/s/z1sir2lapm4paq7/unfex_refex_jpg2img_scriptbin_scripts(2)-NMD-dashcamtalk.zip?dl=1
*EDIT* these scripts are updated: http://www.mediafire.com/file/rbr2vhv23xr1c2r/3-unfex-refex-scripts.rar

cheers -Peter
 
Last edited:
  • Like
Reactions: NMD
In the firmware backup script posted to this forum:
" https://dashcamtalk.com/forum/attachments/backup-script-zip.25246/ "

I added a Y/N prompt for whether or not to compress all the backup files into 'backup.zip' archive. Just for fun, a simple goprawn banner will be an inline comment in the zip too. I could change the banner to Dashcamtalk if that would be better ;)
download - https://www.dropbox.com/s/n1p5oeikxj21f5i/backup-script-zipcompress.zip?dl=0

If you prefer better RAR compression, then get this script pack:
download - https://www.dropbox.com/s/m9rmzo7azbjl3zs/backup-script-rarcompress.zip?dl=0

* also a Mac OSX version of the backup script (with zip compression):
download - https://www.dropbox.com/s/kb1y0gxbohgqjxo/backup-script-MacOSX.zip?dl=0

2016-11-25 17_30_58-backup.zip - WinRAR.jpg

*EDIT* and here is a video to show you how to backup the camera's firmware.
 
Last edited:
Hi !
I deleted my previous posts.
In short i flashed the FW File from first post and it bricked my Cam, could not flash backup (from another user with same cam) as i did not realize Phoenix tool needs to have IMG selected to show connected cam. May write that LOUD AND CLEAR in the first post.
I stumbled across it reading the whole thread the second time :)

Now i am back to start, need to find out how to improve my cam now...

This is my cam, Gearbest "Sports Camera 4k", this is what phoenix says:

phoenix_info.JPG

Greetings,

Ender
 
At the bottom of the 1st post its there in pictures. Select IMG, hit no.
 
Hi !
Yes, now i know how it is meant :) Hey, i THANK you guys, just saying its unusual so write it in CAPITAL Letters somewhere so noobs like me dont fall for it :)

I still have no idea how to imrove my cam, just lost 5 hours because of this stupid mis- or no- undesrtanding.
Now i know that i cannot be bricked i feel more confident :)

Ender
 
Last edited:
Hi !
Yes, now i know how it is meant :) Hey, i THANK you guys, just saying its unusual so write it in CAPITAL Letters somewhere so noobs like me don't fall for it :). I still have no idea how to improve my cam, just lost 5 hours because of this stupid mis- or no- understanding. Now i know that i cannot be bricked i feel more confident :)
Ender

First, read ALL topics (threads) in goprawn forums
https://www.goprawn.com/forum/allwinner-cams

If you (still) have a copy of your camera's original firmware, either working inside the cam, or a file online, please share it here and share it in goprawn.com forums. Use a backup script posted above https://dashcamtalk.com/forum/threads/hacking-q3h-allwinner-v3-camdroid.20507/page-11#post-301213

and proceed from there...
 
Hi !
Yes, after my first failure i (yet have to) read up on:
-which options CAN be adjusted
-which one do i want to change
-how to do it-

The backup of my cam (well not mine but an exact duplicate) is already in the list, thats how i unbricked my camera.
Greetings,
Ender
 
Hello guys i have the Q3h-2 i think pic related
53640580-160d-44e6-8a97-08cb67565436
MSgJN7p.jpg
, have this sensor sony 179A can i upgrade or mod my firmware to get better performance or image?
 
Back
Top