Need help changing Wifi Mode on Innovv K2 / NT 96663 BG

[Frostie]

Hi all.

I would like to ask for some help changing the Wifi mode of my Innovv K2 Motorbike Dashcam.

When the Camera starts up, it runs in Wifi AP Mode and offers the SSID INNOVV_K2_<xxxx>, where <xxxx> are the last four digits of the device serial number. At my camera, this is 026a. So the complete SSID is INNOVV_K2_026a.
Using the Novatek Wifi Commands, I can set a different SSID/Password and change the Wifi mode to STA (Mode 1) to make the camera join my Test WLan, but unfortunately these settings are not saved. On next reboot, the camera is back at AP Mode.
What I would like to do is, changing the firmware so that the camera starts up in STA mode.

I already have UART access to the camera and therefore the cmd, ecos and exam console. And by comparing different dumps, I was able to find the bytes in memory which are (probably) responsible for the Wifi. But as these bytes are only switching from 00 to 01, I am unable to find them within the firmware. There are no patterns I can search for and I have absolutely no knowledge in programming of embedded devices.

So I would like to ask the more experienced people here: Is there a realistic chance to find the responsible bytes for the Wifi Mode within the firmware? Can anybody give me some guidance how to find them or even help me?
I've put some files in a dropbox link, which may help:

Dropbox-Link

- Original firmware (packed and unpacked)
- Dump of camera running in AP Mode
- Dump of camera running in STA mode and joined my test WLan
- Boot-Log of AP Mode
- Log of changing Wifi Mode to STA and joining my WLan (by Wifi Commands)
- Memory Map (sys mem command)

SSID/Password in AP Mode: INNOVV_K2_026a / 12345678
SSID/Password in STA Mode K2-Test / 12345678

The bytes I found, which may be resposible for the Wifi mode are.
80 57 bc 24 => changing these from 00 to 01 and reconnecting Wifi will make the camera switch to STA Mode
80 57 bf e0 => this changes from 00 to 01 when issuing the wifi command for switching to STA mode, too. But changing only this will not make the camera switch to STA mode.

Any help would be greatly be appreciated.

Frostie

 

[mc_cam]

Hi Frostie
With your already established connections with the INNOVV K2 manufacturers (to the extent that they actively support your reverse engineering by supplying you with a development unit and encouragement), would it not be best to work directly with the company's software developer and the source code rather than attempting to decipher the binary output?
Have you asked Liu 'Rock' (the INNOVV owner and your direct correspondent) for access to the development files?
Cheers
mc_cam

 

[Frostie]

Hi mc_cam
I must admit, that I never thought about that. Mainly because I don't have any knowledge in programming such devices. Searching for patterns in a firmware is one thing, understanding a more or less unknown language is another thing. But you are right...I could give it a try and ask Rock for the files.

 

[mc_cam]

Hi Frostie
You may find that Rock is not employing in-house developers.
There may be some joy to be found by liaising with 'nutsey' and friends, starting with this link:

Novatek's 4K30 SoC - NT96683. - GoPrawn action and dash cam forums

Seems like we're going to see very interesting action cam SoCs producers competition in 2018. One of those is Novatek with its long-awaited NT96683 chipset

www.goprawn.com

Cheers