Hacking Q3H (allwinner v3 - Camdroid)

Here is your script.bin converted ... its 99% the same
http://pastebin.com/TvquvdEZ


These are differences compared with winmerge
[gpio_ir_key]
gpio_ir_used = 1 / 0

and name
machine = "beike4k30imx179s-sdv"
machine = "fuxin4k30imx179s-sdv"

I would flash your firmware if I had the recovery program... you have an IR sensor too or something?

MM357 : http://pastebin.com/4RjU1aRz
Q8 Camera http://pastebin.com/8tUdikuJ

I think 357 is made by your factory, q8 is from my factory
 
Last edited:
That was not my uboot, just found a fex image to share. Mine's here.
 

Attachments

  • F60B_mtdblock0.zip
    102.2 KB · Views: 10
Here is that one: http://pastebin.com/pxKuzivz

You have a different LCD and are using the IMX179 module... so maybe you have the real sensor?

Also debug mode is on vs off on my camera.

The difference between 719s and 719 is number of modes and frame rates. Ie 179s has 4k30fps and 179 is only 15fps. I think if you load 719s you will have more modes? Also height and a couple of things are different so who knows.
 
Last edited:

Attachments

  • imx179.jpg
    imx179.jpg
    61.7 KB · Views: 17
thegamut said:
Ie 179s has 4k30fps and 179 is only 15fps.
Click to expand...
Just checked. F60B shoots 4k with 30fps, not 15. But it skips every 6th frame, so provides real 25fps 4k footage (certainly interpolated from 1080).
 
jokiin said:
this method is often used when frequency is set to 50Hz but frame rate is 30fps
Click to expand...
It records 25 fps and adds a copy of 5th frame to produce dummy 30fps footage regardless of light source freq. setting.
 
I was looking at the first mode and assumed that would be it.

.data:000017CC DCD imx179_4k_v3 ; isp_cfg
.data:000017CC DCD 0 ; isp_ir_cfg
.data:000017CC DCD 0xCC0 ; width
.data:000017CC DCD 0x990 ; height
.data:000017CC DCD 0 ; hoffset
.data:000017CC DCD 0 ; voffset
.data:000017CC DCD 0xD70 ; hts
.data:000017CC DCD 0x139F ; vts
.data:000017CC DCD 0xF7F4900 ; pclk
.data:000017CC DCD 0x26CD78C0 ; mipi_bps
.data:000017CC DCD 0xF ; fps_fixed
.data:000017CC DCD 1 ; bin_factor
.data:000017CC DCD 0x10 ; intg_min
.data:000017CC DCD 0x13950 ; intg_max
.data:000017CC DCD 0x10 ; gain_min
.data:000017CC DCD 0x100 ; gain_max
.data:000017CC DCD 0 ; width_input
.data:000017CC DCD 0 ; height_input
Click to expand...

Here is 22fps
.data:000017CC DCD imx179_4k_v3 ; isp_cfg
.data:000017CC DCD 0 ; isp_ir_cfg
.data:000017CC DCD 0xCC0 ; width
.data:000017CC DCD 0x72C ; height
.data:000017CC DCD 0 ; hoffset
.data:000017CC DCD 0x132 ; voffset
.data:000017CC DCD 0xD70 ; hts
.data:000017CC DCD 0xD6C ; vts
.data:000017CC DCD 0xF7F4900 ; pclk
.data:000017CC DCD 0x26AEF440 ; mipi_bps
.data:000017CC DCD 0x16 ; fps_fixed
.data:000017CC DCD 1 ; bin_factor
.data:000017CC DCD 0x10 ; intg_min
.data:000017CC DCD 0xD620 ; intg_max
.data:000017CC DCD 0x10 ; gain_min
.data:000017CC DCD 0x100 ; gain_max
.data:000017CC DCD 0xCC0 ; width_input
.data:000017CC DCD 0x72C ; height_input
Click to expand...

3200x1800 (scaled look at input)

.data:000017CC DCD imx179_4k_v3 ; isp_cfg
.data:000017CC DCD 0 ; isp_ir_cfg
.data:000017CC DCD 0xC80 ; width
.data:000017CC DCD 0x708 ; height
.data:000017CC DCD 0 ; hoffset
.data:000017CC DCD 0x132 ; voffset
.data:000017CC DCD 0xD70 ; hts
.data:000017CC DCD 0xBC6 ; vts
.data:000017CC DCD 0xF7F4900 ; pclk
.data:000017CC DCD 0x26AEF440 ; mipi_bps
.data:000017CC DCD 0x19 ; fps_fixed
.data:000017CC DCD 1 ; bin_factor
.data:000017CC DCD 0x10 ; intg_min
.data:000017CC DCD 0xBBC0 ; intg_max
.data:000017CC DCD 0x10 ; gain_min
.data:000017CC DCD 0x100 ; gain_max
.data:000017CC DCD 0xCC0 ; width_input
.data:000017CC DCD 0x72C ; height_input
Click to expand...


I found a 2k and a 1080P made from 3264x1836 and some from lower resolutions. Seems there are options and its not necessarily made from 1080P. You could run logcat through adb and see what resolutions it makes out of what when it configures the image processor.

Another thing to note is these are sensor settings since I see nothing about encoding there. That is TBD, maybe its in one of the v4l modules.
 
thegamut said:
I see nothing about encoding there
Click to expand...
Sure it would be nice to find GOP settings. I-frame interval by default is set to 30 and lowering it to 8 or 16 value could add a little quality.
 
You could record all I frames too and change the profile + boost the bit rate. I'd like to grab the bayer data and see what the image you are imputing the encoder really looks like. The 1080P theory doesn't match the modules.

I'm waiting on the recovery solution still. Without one its too easy to brick.
 
thegamut said:
The 1080P theory doesn't match the modules.
Click to expand...
I've made some thorough comparisons using resolution targets. According to the results my F60B cam can only do 1080p30 and 720p60 for sure.
 
yes, right now I have a boot loop. 720P60 and 1080P have the most data on mine but nobody makes a sensor that is 1920x1080. Its probably the real modes of the hardware encoder.

from what I've read in the firmware it goes 3K*2K Bayer -> 720/1080 YUV -> Post processing/stretch -> file
 
Last edited:
thegamut said:
The binary is in /system so if that is DD'able without bricking it can be modified.
Click to expand...
How can it be DD'ed into read-only squashfs partition? Or you mean modifying the binary and reflashing it back to camera?
 
All those files are on the squashfs partition which can be written to as a block device. The camera is back, I have a real full phoenix img now. It unpacks, maybe there is a way to boot off SD instead of rewriting the nand. Its all regular allwinner stuff but there is no source except some of the V4L functions.
 
Somebody hooked me up. Now you have the header. I believe most of the stuff is in full_img.fex so one could be reconstructed.

[FILELIST]

{filename = INPUT_DIR .. "sys_config.fex", maintype = "COMMON ", subtype = "SYS_CONFIG100000",},
{filename = INPUT_DIR .. "config.fex", maintype = "COMMON ", subtype = "SYS_CONFIG_BIN00",},
{filename = INPUT_DIR .. "split_xxxx.fex", maintype = "COMMON ", subtype = "SPLIT_0000000000",},
{filename = INPUT_DIR .. "sys_partition.fex", maintype = "COMMON ", subtype = "SYS_CONFIG000000",},
{filename = INPUT_DIR .. "boot0_spinor.fex", maintype = "BOOT ", subtype = "BOOT0_0000000000",},
{filename = INPUT_DIR .. "boot0_sdcard.fex", maintype = "12345678", subtype = "1234567890BOOT_0",},
{filename = INPUT_DIR .. "boot0_spinand.fex", maintype = "12345678", subtype = "1234567SPINAND_0",},
{filename = INPUT_DIR .. "u-boot.fex", maintype = "12345678", subtype = "UBOOT_0000000000",},
{filename = INPUT_DIR .. "fes1.fex", maintype = "FES ", subtype = "FES_1-0000000000",},
{filename = INPUT_DIR .. "full_img.fex", maintype = "12345678", subtype = "FULLIMG_00000000",},
{filename = INPUT_DIR .. "usbtool.fex", maintype = "PXTOOLSB", subtype = "XXXXXXXXXXXXXXXX",},
{filename = INPUT_DIR .. "aultools.fex", maintype = "UPFLYTLS", subtype = "XXXXXXXXXXXXXXXX",},
{filename = INPUT_DIR .. "aultls32.fex", maintype = "UPFLTL32", subtype = "XXXXXXXXXXXXXXXX",},
{filename = INPUT_DIR .. "cardtool.fex", maintype = "12345678", subtype = "1234567890CARDTL",},
{filename = INPUT_DIR .. "cardscript.fex", maintype = "12345678", subtype = "1234567890SCRIPT",},
{filename = INPUT_DIR .. "sunxi_mbr.fex", maintype = "12345678", subtype = "1234567890___MBR",},
{filename = INPUT_DIR .. "dlinfo.fex", maintype = "12345678", subtype = "1234567890DLINFO",},
{filename = INPUT_DIR .. "boot.fex", maintype = "RFSFAT16", subtype = "BOOT_FEX00000000",},
{filename = INPUT_DIR .. "Vboot.fex", maintype = "RFSFAT16", subtype = "VBOOT_FEX0000000",},
{filename = INPUT_DIR .. "rootfs.fex", maintype = "RFSFAT16", subtype = "ROOTFS_FEX000000",},
{filename = INPUT_DIR .. "Vrootfs.fex", maintype = "RFSFAT16", subtype = "VROOTFS_FEX00000",},
{filename = INPUT_DIR .. "cfg.fex", maintype = "RFSFAT16", subtype = "CFG_FEX000000000",},
{filename = INPUT_DIR .. "Vcfg.fex", maintype = "RFSFAT16", subtype = "VCFG_FEX00000000",},
{filename = INPUT_DIR .. "boot_logo.fex", maintype = "RFSFAT16", subtype = "BOOT_LOGO_FEX000",},
{filename = INPUT_DIR .. "Vboot_logo.fex", maintype = "RFSFAT16", subtype = "VBOOT_LOGO_FEX00",},
{filename = INPUT_DIR .. "shutdown_logo.fex", maintype = "RFSFAT16", subtype = "SHUTDOWN_LOGO_FE",},
{filename = INPUT_DIR .. "Vshutdown_logo.fex", maintype = "RFSFAT16", subtype = "VSHUTDOWN_LOGO_F",},
{filename = INPUT_DIR .. "env.fex", maintype = "RFSFAT16", subtype = "ENV_FEX000000000",},
{filename = INPUT_DIR .. "Venv.fex", maintype = "RFSFAT16", subtype = "VENV_FEX00000000",},


[IMAGE_CFG]

version = 0x00100234; --> Format version
subversion = 0x00000060; --> Format subversion (imgRePacker)
pid = 0x00001234; --> USB peripheral ID
vid = 0x00008743; --> USB vendor ID
hardwareid = 0x0100; --> Hardware ID
firmwareid = 0x0100; --> Firmware ID
filelist = FILELIST
Click to expand...

btw, img in first post.
 
Last edited:
The DD method of flashing rootfs works. Too bad the SDV application sets 8000hz audio and doesn't want to record when you remove that format.

for some reason when I tamper with the wav files and it changes the FS file size the camera won't start. it might be that permissions get messed up when replacing files instead of just editing.


squashfs isn't working, it has an extra 0x200 flag on it, using the -Xbcj flag produces 0x400, so something is wrong with the recompression that inhibits boot even though the startup sound plays.

I was able to get a boot editing rootfs but not changing the file size of the config file. I now have no click sound by default, 8m picture setting too, etc. here: http://ge.tt/7ELSZ1d2

Like this:
squash squashfs-root output.bin -comp xz -root-owned -Xbcj x86

All the posted firmwares boot up too, one had the screen flipped and colors messed up.
Finally it let me get rid of the wav files. No more click/shutter in first post.

Update:

This image has a few differences.

Resolutions are done differently, the 2k doesn't have the dancing noise anymore. 1080P60 and 2k have higher bit rate, others have lower bit rate. The zoom is gone too.
 
Last edited:
You must log in or register to reply here.
Back
Top