Novatek firmware tools (updated: 2017-05-26)

Discussion in 'Firmware Modifications' started by Tobi@s, Jan 21, 2017.

  1. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    Hello,
    this thread contains command line tools for modifying Novatek single (for now) image firmwares. I will update it everytime I update one of the tools or add a new one.

    ntkcalc (v0.5.1)
    ntkcalc_img.png
    Description: This tool is able to calculate the checksum of Novatek firmware images in raw or BCL format. For non-default images it can calculate the baseval for checksum calculation as well.

    Usage:
    • Baseval calulation: ntkcalc -b firmware.bin
      Use this only with stock non modified firmware images, otherwise the calculated result is wrong

    • Checksum calculation (default baseval): ntkcalc -c firmware.bin
      This will output the checksum for raw and BCL compressed firmware images
      optional: -cw: This flag will write the calculated checksum at the correct address in the binary

    • Checksum calculation (custom baseval): ntkcalc -c firmware.bin 0xYYYY
      YYYY is the calculated baseval, the tool will add this to the calculated checksum
      Required for every firmware image with a baseval different to 0x0000, for example nanoQ firmwares.
      optional: -cw: This flag will write the calculated checksum at the correct address in the binary
    Warning! Using this tool to validate modified firmwares and flashing them will most likely void your warranty. Also, no one but you is responsible for everything that results in flashing the modified firmware.

    Download: (please do not mirror!)


    bfc (v2.1) (Basic compression library for Novatek)
    bfc_img.png
    Description: Bfc is part of the "Basic compression library". It's also used by Novatek - but slightly modified. This version of bfc is also modified, to generate valid compressed images.

    Usage (new syntax!):

    • Decompressing a single image: bfc d compressed.bin unpacked.bin
      -> Extracts the archive at address 0x0 to unpacked.bin
    • Decompressing from custom address: bfc d compressed.bin unpacked.bin 0x234874
      -> Extracts the archive at address 0x234874(or whatever you enter) to unpacked.bin
    • Extracting PartComp archives: bfc x partcomp.bin unpacked.bin
      -> Extracts the PartComp binary at address 0x000b0000 to unpacked.bin
    • Compressing: bfc c unpacked.bin compressed.bin
      -> Compresses a binary file using lz77 compression (used in novatek FullComp firmwares)
    Download: (please do not mirror!)
     
    Last edited: May 25, 2017
    Aussie Kev, am777, nutsey and 4 others like this.
  2. regzno

    regzno New Member

    Messages:
    2
    Likes Received:
    0
    Country:
    Ukraine
    Hello ! BFC tool crashes during Soocoo C30 V1 and SJ5000x firmware decompress on Win7 32bit and VMWare WinXP 32 bit. Soocoo C30 V2 firmware decompressing without errors.
     
  3. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    Please share the firmware and also try DENOVA tool from @nutsey
    I guess the firmware has multiple partitions which are unsupported by bfc
     
    nutsey likes this.
  4. regzno

    regzno New Member

    Messages:
    2
    Likes Received:
    0
    Country:
    Ukraine
    DENOVA tool console output:

    1 partition found.
    FullComp partition type detected.
    decompress tempfile.bin to DENOVA/1.tmp...
    Input file: 3801836 bytes
    Output file: 4971908 bytes​

    and then "ntfwtool.exe" crashed too.

    Link to Soocoo V1 firmware https://drive.google.com/open?id=0B8usOMLZuk4JWUhOQUVsR0ppNmc
     
  5. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    It's a multi-image binary, thats why bfc fails.
    Strange that DENOVA doesnt detect this. @nutsey have a look at 0x2764c4, I have no idea why DENOVA does not see this. I thought it searches the binary for the pattern BCL1
    @regzno Dunno why DENOVA didn't work for you, but it does for me:
    Code:
    DENOVA Novatek firmware unpacking script by nutsey for GoPrawn.com v0.5
    
    2 partitions found.
    
    1st BCL partition is saved as DENOVA/1.bcl
    
    decompress DENOVA/1.tmp to DENOVA/1.bin...
    Input file: 2581676 bytes
    Output file: 4971908 bytes
    
    2nd BCL partition is saved as DENOVA/2.bcl
    
    
    Done. Check DENOVA folder for extracted files. Press any key to exit...
     
    Last edited: Mar 10, 2017
    nutsey likes this.
  6. Squeaky Lobster

    Squeaky Lobster New Member

    Messages:
    10
    Likes Received:
    2
    Country:
    Switzerland
    Dash Cam:
    iTracker mini0806
  7. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    Will have a look at it :)
     
  8. Squeaky Lobster

    Squeaky Lobster New Member

    Messages:
    10
    Likes Received:
    2
    Country:
    Switzerland
    Dash Cam:
    iTracker mini0806
    Hello @Tobi@s

    Thanks for watching, but first enjoy easter!

    I just read that thing about multiple and single partition files and checked on a different computer (an old XP VM):

    Code:
    C:\Viofo_A119\DENOVA Novatek FW unpacking script>denova.bat FWBA119.bin
    DENOVA Novatek firmware unpacking script by nutsey for GoPrawn.com v0.5
    
    1 partition found.
    
    FullComp partition type detected.
    
    decompress tempfile.bin to DENOVA/1.tmp...
    Input file: 4065324 bytes
    Output file: 6251972 bytes
    error: end offset is lower than start offset
    1 errors occurred.
    error: no such output file: DENOVA/1.bin
    1 errors occurred.
    
    Done. Check DENOVA folder for extracted file. Press any key to exit...
    So it's only one partition which should be ok. But I just saw that the 2.02 firmware (which generates a zero sized decompressed file) is quite larger than the 1.1 firmware that I can decompress.

    Code:
    C:\Viofo_A119\Novatek command line tools>bfc-v01.exe d FWBA119_v1.1.bin FWBA119_v1.1_decomp.bin
    LZ77 decompress FWBA119_v1.1.bin to FWBA119_v1.1_decomp.bin...
    Input file: 2752328 bytes
    Output file: 5947324 bytes
    
    C:\Viofo_A119\Novatek command line tools>bfc-v01.exe d FWBA119_v2.02.bin FWBA119_v2.02_decomp.bin
    LZ77 decompress FWBA119_v2.02.bin to FWBA119_v2.02_decomp.bin...
    Input file: 4065332 bytes
    Output file: 6251972 bytes
    
    C:\Viofo_A119\Novatek command line tools>dir *.bin
     Volume in drive C has no label.
     Volume Serial Number is 5089-DCC7
    
     Directory of C:\Viofo_A119\Novatek command line tools
    
    29.08.2016  08:53         2'752'344 FWBA119_v1.1.bin
    16.04.2017  19:58         5'947'324 FWBA119_v1.1_decomp.bin
    21.02.2017  09:41         4'065'348 FWBA119_v2.02.bin
    16.04.2017  19:59                 0 FWBA119_v2.02_decomp.bin
    Cheers,
    Martin
     
  9. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    They added another partition, now its a multi-image binary. Unfortunately this requires "manual" reassembling (joining the two partitions)

    Nevertheless DENOVA 0.5 works:
    upload_2017-4-17_23-15-26.png
     
  10. Squeaky Lobster

    Squeaky Lobster New Member

    Messages:
    10
    Likes Received:
    2
    Country:
    Switzerland
    Dash Cam:
    iTracker mini0806
    Thanks for checking. I can't make it work, don't know why.

    Anyway, I've decided to try a Mini0806. Your other tools work fine :)
     
  11. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    Might be an issue with your OS, maybe @nutsey has an idea
     
  12. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    BFC has received an update to v1.1 to comply with Novatek code alignment rules
     
    Last edited: May 17, 2017
    Falsificator likes this.
  13. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    Upcoming project: Novatek Movie Parameter editor:

    This editor will be able to parse unpacked novatek firmware binaries and apply modifications to it.

    Finding the movieparam struct was the most difficult thing... Regex for byte arrays dont exist...........

    Proof of concept:
    upload_2017-5-18_17-59-21.png
     
    lacibaci and Falsificator like this.
  14. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    BFC just received another update. Initially I planned to just add decompression from a specific address to support multi-image binaries but I found a critical access violation bug during testing..

    Changelog:
    -fixed access violation bug
    -removed unneeded compression algorithms
    -modified parameter syntax: bfc compression now no longer requires you to enter the algorithm (since it only supports lz77 now)
    -added "multi-image" support, well at least kind of: You can now provide the offset of the bcl compressed partition you want to unpack and bfc will start extracting at that address

    New syntax:
    Compression:
    Code:
    bfc c compressme.bin compressed.bin
    Decompression:
    Code:
    bfc d compressed.bin uncompressed.bin
    bfc d compressed.bin uncompressed0.bin 0xaabbccdd
    This release is also part of a preparation to build modular applications for a soon to be released GUI-wrapper


    EDIT:
    bfc mod 2.1 is released as well.. Download from my page (linked in op)
    This release supports PartComp extraction via 'x' command:
    Code:
    bfc x partcomp.bin extracted.bin
    Sources are online as well
     
    Last edited: May 25, 2017
  15. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    How to identify different firmware types for uncompressing with bfc:

     
    nutsey and kamkar1 like this.
  16. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some

    Attached Files:

    Last edited: Jun 7, 2017
    lacibaci and Falsificator like this.
  17. Tobi@s

    Tobi@s Well-Known Member App Developer

    Messages:
    1,350
    Likes Received:
    801
    Location:
    Bavaria
    Country:
    Germany
    Dash Cam:
    some
    Working on an addition for bngui, a Resource editor, PoC strings editor shown below, bitmap/sounds/bootlogo/... should be easily possible as well. But theres one problem: Every resource has a fixed size and cant be adjusted dynamically (well not as dynamically as with ambarella and their RomFS contents)
    (Language 6 - 9 show weird characters since i dont have cyrillic support installed on my computer)
    upload_2017-6-15_0-14-11.png
     
Loading...

Share This Page