Novatek firmware mod -- help needed

jhann

New Member
Joined
Mar 28, 2023
Messages
6
Reaction score
0
Location
NY
Country
United States
I am trying to mod the bitrate on my Novatek 96675 based cam, but all the goprawn threads are down and the tools referenced here are all old. Is anyone still around that can help with this? Attached is the firmware.
 

Attachments

  • FW96675A_20220729_529C_DB-1_V1.15N.zip
    2.8 MB · Views: 13
Thanks for responding. I tried doing that and it flashes then won't work. I have to reflash the original firmware to get it to work again. Anything I can do to provide you more info fortroubleshooting?
 
Thanks for responding. I tried doing that and it flashes then won't work. I have to reflash the original firmware to get it to work again. Anything I can do to provide you more info fortroubleshooting?
Make sure, when you saved your changes using JNovatekDec, that your file size does not increase.

Bitrate/resolution/fps shouldn't be a problem, thats a 4 byte number, you should be able to go up to 4294967295.
Strings (such as translation tables) and Icons (+boot logo), have to be the same size, otherwise the entire file will be offset and instructions wont run properly.

If:
- The light does not flash when updating: Checksum failed.
- The light does flash, but after boot nothing happens: Your file size has increased, instructions now have the wrong offset.

If all else fails, try using a hex editor.
BC Hobbyist has a tutorial on this, although a bit complicated:

JNovatekDec should give you the address where the resolution tables are located, you should be able to edit those manually.
 
Ok, here is what happens:

Original firmware

Code:
===================================================================================
 NTKFWinfo - python script for work with Novatek firmware files

 Copyright © 2022 Dex9999(4pda.to) aka Dex aka EgorKin(GitHub, etc.)
===================================================================================
NVTPACK_FW_HDR2 found
NVTPACK_FW_HDR2_VERSION found
Found 4 partitions
Firmware file ORIG_CRC:0x254F CALC_CRC:0x254F
 -------------------------------------------------- PARTITIONS INFO ---------------------------------------------------
|  ID   START_OFFSET  END_OFFSET         SIZE       ORIG_CRC   CALC_CRC                        TYPE                    |
 ----------------------------------------------------------------------------------------------------------------------
   1     0x000000B0 - 0x00000AFC          2636       0x26EC     0x26EC       MODELEXT INFO, Chip:NT96675, Build:20220729
   2     0x00000AFC - 0x0024C5C0       2407108       0xE5C6     0xE5C6       BCL1, LZMA 9055844 packed to 2407092 bytes
   3     0x0024C5C0 - 0x0028F23C        273532       0x2061     0x2061       uboot
   4     0x0028F23C - 0x002EF054        392728       0xF551     0xF551       BCL1, LZMA 1084300 packed to 392712 bytes
===================================================================================
 NTKFWinfo - python script for work with Novatek firmware files
 Show full FW info, allow extract/replace/uncompress/compress partitions, fixCRC

 Copyright © 2022 Dex9999(4pda.to) aka Dex aka EgorKin(GitHub, etc.)
===================================================================================
NVTPACK_FW_HDR2 found
NVTPACK_FW_HDR2_VERSION found
Found 4 partitions
Firmware file size 3 076 180 bytes

I modify the bitrate from 8160 to 9600 at address 0084699c in Novadec and save. Compare to original uncompressed extracted partition it is the same size. Use NTKFWinfo to compress and fix CRC:

Code:
(base) PS C:\Users\User\Documents\MotorDV\firmware> python .\NTKFWinfo.py -i .\db-1\FW96675A.bin -c 2
===================================================================================
 NTKFWinfo - python script for work with Novatek firmware files
 Show full FW info, allow extract/replace/uncompress/compress partitions, fixCRC

 Copyright © 2022 Dex9999(4pda.to) aka Dex aka EgorKin(GitHub, etc.)
===================================================================================
NVTPACK_FW_HDR2 found
NVTPACK_FW_HDR2_VERSION found
Found 4 partitions
Firmware file size 3 076 180 bytes
Compress .\db-1\FW96675A.bin-uncomp_partitionID2 to partition ID 2 at 0x00000AFC
'rm' is not recognized as an internal or external command,
operable program or batch file.
Partition ID 2 - CRC fixed
Firmware file size 3 028 404 bytes
Firmware file ORIG_CRC:0x254F CALC_CRC:0x1640, CRC fixed
(base) PS C:\Users\User\Documents\MotorDV\firmware> python .\NTKFWinfo.py -i .\db-1\FW96675A.bin
===================================================================================
 NTKFWinfo - python script for work with Novatek firmware files
 Show full FW info, allow extract/replace/uncompress/compress partitions, fixCRC

 Copyright © 2022 Dex9999(4pda.to) aka Dex aka EgorKin(GitHub, etc.)
===================================================================================
NVTPACK_FW_HDR2 found
NVTPACK_FW_HDR2_VERSION found
Found 4 partitions
Firmware file size 3 028 404 bytes
Firmware file ORIG_CRC:0x1640 CALC_CRC:0x1640
 -------------------------------------------------- PARTITIONS INFO ---------------------------------------------------
|  ID   START_OFFSET  END_OFFSET         SIZE       ORIG_CRC   CALC_CRC                        TYPE                    |
 ----------------------------------------------------------------------------------------------------------------------
   1     0x000000B0 - 0x00000AFC          2636       0x26EC     0x26EC       MODELEXT INFO, Chip:NT96675, Build:20220729
   2     0x00000AFC - 0x00240B1E       2359330       0xE0F0     0xE0F0       BCL1, LZMA 9055844 packed to 2359314 bytes
   3     0x00240B20 - 0x0028379C        273532       0x2061     0x2061       uboot
   4     0x0028379C - 0x002E35B4        392728       0xF551     0xF551       BCL1, LZMA 1084300 packed to 392712 bytes
 ----------------------------------------------------------------------------------------------------------------------

Now starting at ID 3 the offset is different. Is this a problem?
 
That shouldn’t be a problem, no.
Compression can vary in file size and the tool automatically sets the size and checksum headers correctly.
 
That shouldn’t be a problem, no.
Compression can vary in file size and the tool automatically sets the size and checksum headers correctly.
Just tried flashing it. Lights blink then stop blinking, then I wait 5 minutes and turn it on, I get blink a few blinks then another blink or two and it stops and does nothing.
 
Just tried flashing it. Lights blink then stop blinking, then I wait 5 minutes and turn it on, I get blink a few blinks then another blink or two and it stops and does nothing.
Odd... can you send me the firmware file you modified?
I can't think of anything that would make it fail, JNovatek not updating the checksum properly maybe or NTKFWInfo not packing it/updating headers properly?

I've tested NTKFWInfo on my NT96670 and it works fine, making changes using JNovatek I have not tested yet.
Sadly the only way you could check why its failing is by soldering a few wires to the UART port (if there is even a connection on the board) and connecting to it using a terminal program.
 
Odd... can you send me the firmware file you modified?
I can't think of anything that would make it fail, JNovatek not updating the checksum properly maybe or NTKFWInfo not packing it/updating headers properly?

I've tested NTKFWInfo on my NT96670 and it works fine, making changes using JNovatek I have not tested yet.
Sadly the only way you could check why its failing is by soldering a few wires to the UART port (if there is even a connection on the board) and connecting to it using a terminal program.
Sure. Thanks again for taking a look at this.
 

Attachments

  • FW96675A-modified.zip
    2.7 MB · Views: 3
Well, I didn't find anything wrong with the modified version.
The checksums are in OK, so is the file size.
I even tried to use JNovatek to change the bitrate for my dashcam, and it booted up and worked.
I tried modifying the same bitrate you changed and the files are identical.

What I recommend you trying is, when you update the camera, once it stops blinking:
Stick the SD-card back into your computer and delete the firmware file off of it.
Then try to normally boot your camera.

What I think is happening is the following:

1. UBOOT starts the update procedure once it finds "FW96675A.bin" on the SD root.
2. Update process completes.
3. UBOOT tries to delete the update file, which is probably under a different name (probably), or something else which fails.
4. The camera shuts off.
5. The camera boots back on, and the cycle repeats, because the firmware file is still on the SD root.

Normally when you update your dashcam it should restart once the update is complete and delete the firmware file.
If that doesn't work, then I'm really out of ideas...
 
Well, I didn't find anything wrong with the modified version.
The checksums are in OK, so is the file size.
I even tried to use JNovatek to change the bitrate for my dashcam, and it booted up and worked.
I tried modifying the same bitrate you changed and the files are identical.

What I recommend you trying is, when you update the camera, once it stops blinking:
Stick the SD-card back into your computer and delete the firmware file off of it.
Then try to normally boot your camera.

What I think is happening is the following:

1. UBOOT starts the update procedure once it finds "FW96675A.bin" on the SD root.
2. Update process completes.
3. UBOOT tries to delete the update file, which is probably under a different name (probably), or something else which fails.
4. The camera shuts off.
5. The camera boots back on, and the cycle repeats, because the firmware file is still on the SD root.

Normally when you update your dashcam it should restart once the update is complete and delete the firmware file.
If that doesn't work, then I'm really out of ideas...
Does it matter that the DB-1 has two cameras?
 
Does it matter that the DB-1 has two cameras?
I don't think so.

The logic thing to do to reduce costs is:
- Processor in the front sensor, which does processing for both sensors.
- Second (back) sensor is connected with a cable to the front sensor.

Software wise, changing the bitrate shouldn't break the software even if there are 1 or 2 sensors.
Did removing the firmware after update work or?
 
Back
Top