Novatek firmware tools (updated: 2017-05-26)

Tobi@s

Well-Known Member
App Developer
Joined
Nov 12, 2013
Messages
1,361
Likes
812
Location
Bavaria
Country
Germany
Dash Cam
some
#1
Hello,
this thread contains command line tools for modifying Novatek single (for now) image firmwares. I will update it everytime I update one of the tools or add a new one.

ntkcalc (v0.5.1)
ntkcalc_img.png
Description: This tool is able to calculate the checksum of Novatek firmware images in raw or BCL format. For non-default images it can calculate the baseval for checksum calculation as well.

Usage:
  • Baseval calulation: ntkcalc -b firmware.bin
    Use this only with stock non modified firmware images, otherwise the calculated result is wrong

  • Checksum calculation (default baseval): ntkcalc -c firmware.bin
    This will output the checksum for raw and BCL compressed firmware images
    optional: -cw: This flag will write the calculated checksum at the correct address in the binary

  • Checksum calculation (custom baseval): ntkcalc -c firmware.bin 0xYYYY
    YYYY is the calculated baseval, the tool will add this to the calculated checksum
    Required for every firmware image with a baseval different to 0x0000, for example nanoQ firmwares.
    optional: -cw: This flag will write the calculated checksum at the correct address in the binary
Warning! Using this tool to validate modified firmwares and flashing them will most likely void your warranty. Also, no one but you is responsible for everything that results in flashing the modified firmware.

Download: (please do not mirror!)


bfc (v2.1) (Basic compression library for Novatek)
bfc_img.png
Description: Bfc is part of the "Basic compression library". It's also used by Novatek - but slightly modified. This version of bfc is also modified, to generate valid compressed images.

Usage (new syntax!):

  • Decompressing a single image: bfc d compressed.bin unpacked.bin
    -> Extracts the archive at address 0x0 to unpacked.bin
  • Decompressing from custom address: bfc d compressed.bin unpacked.bin 0x234874
    -> Extracts the archive at address 0x234874(or whatever you enter) to unpacked.bin
  • Extracting PartComp archives: bfc x partcomp.bin unpacked.bin
    -> Extracts the PartComp binary at address 0x000b0000 to unpacked.bin
  • Compressing: bfc c unpacked.bin compressed.bin
    -> Compresses a binary file using lz77 compression (used in novatek FullComp firmwares)
Download: (please do not mirror!)
 
Last edited:

regzno

New Member
Joined
Mar 9, 2017
Messages
2
Likes
0
Country
Ukraine
#2
Hello ! BFC tool crashes during Soocoo C30 V1 and SJ5000x firmware decompress on Win7 32bit and VMWare WinXP 32 bit. Soocoo C30 V2 firmware decompressing without errors.
 
OP
OP
Tobi@s

Tobi@s

Well-Known Member
App Developer
Joined
Nov 12, 2013
Messages
1,361
Likes
812
Location
Bavaria
Country
Germany
Dash Cam
some
#3
Please share the firmware and also try DENOVA tool from @nutsey
I guess the firmware has multiple partitions which are unsupported by bfc
 
OP
OP
Tobi@s

Tobi@s

Well-Known Member
App Developer
Joined
Nov 12, 2013
Messages
1,361
Likes
812
Location
Bavaria
Country
Germany
Dash Cam
some
#5
It's a multi-image binary, thats why bfc fails.
Strange that DENOVA doesnt detect this. @nutsey have a look at 0x2764c4, I have no idea why DENOVA does not see this. I thought it searches the binary for the pattern BCL1
@regzno Dunno why DENOVA didn't work for you, but it does for me:
Code:
DENOVA Novatek firmware unpacking script by nutsey for GoPrawn.com v0.5

2 partitions found.

1st BCL partition is saved as DENOVA/1.bcl

decompress DENOVA/1.tmp to DENOVA/1.bin...
Input file: 2581676 bytes
Output file: 4971908 bytes

2nd BCL partition is saved as DENOVA/2.bcl


Done. Check DENOVA folder for extracted files. Press any key to exit...
 
Last edited:
Joined
Apr 15, 2017
Messages
19
Likes
7
Country
Switzerland
Dash Cam
iTracker mini0806, 0906 beta
#8
Hello @Tobi@s

Thanks for watching, but first enjoy easter!

I just read that thing about multiple and single partition files and checked on a different computer (an old XP VM):

Code:
C:\Viofo_A119\DENOVA Novatek FW unpacking script>denova.bat FWBA119.bin
DENOVA Novatek firmware unpacking script by nutsey for GoPrawn.com v0.5

1 partition found.

FullComp partition type detected.

decompress tempfile.bin to DENOVA/1.tmp...
Input file: 4065324 bytes
Output file: 6251972 bytes
error: end offset is lower than start offset
1 errors occurred.
error: no such output file: DENOVA/1.bin
1 errors occurred.

Done. Check DENOVA folder for extracted file. Press any key to exit...
So it's only one partition which should be ok. But I just saw that the 2.02 firmware (which generates a zero sized decompressed file) is quite larger than the 1.1 firmware that I can decompress.

Code:
C:\Viofo_A119\Novatek command line tools>bfc-v01.exe d FWBA119_v1.1.bin FWBA119_v1.1_decomp.bin
LZ77 decompress FWBA119_v1.1.bin to FWBA119_v1.1_decomp.bin...
Input file: 2752328 bytes
Output file: 5947324 bytes

C:\Viofo_A119\Novatek command line tools>bfc-v01.exe d FWBA119_v2.02.bin FWBA119_v2.02_decomp.bin
LZ77 decompress FWBA119_v2.02.bin to FWBA119_v2.02_decomp.bin...
Input file: 4065332 bytes
Output file: 6251972 bytes

C:\Viofo_A119\Novatek command line tools>dir *.bin
 Volume in drive C has no label.
 Volume Serial Number is 5089-DCC7

 Directory of C:\Viofo_A119\Novatek command line tools

29.08.2016  08:53         2'752'344 FWBA119_v1.1.bin
16.04.2017  19:58         5'947'324 FWBA119_v1.1_decomp.bin
21.02.2017  09:41         4'065'348 FWBA119_v2.02.bin
16.04.2017  19:59                 0 FWBA119_v2.02_decomp.bin
Cheers,
Martin
 
OP
OP
Tobi@s

Tobi@s

Well-Known Member
App Developer
Joined
Nov 12, 2013
Messages
1,361
Likes
812
Location
Bavaria
Country
Germany
Dash Cam
some
#9
Hello @Tobi@s

Thanks for watching, but first enjoy easter!

I just read that thing about multiple and single partition files and checked on a different computer (an old XP VM):

Code:
C:\Viofo_A119\DENOVA Novatek FW unpacking script>denova.bat FWBA119.bin
DENOVA Novatek firmware unpacking script by nutsey for GoPrawn.com v0.5

1 partition found.

FullComp partition type detected.

decompress tempfile.bin to DENOVA/1.tmp...
Input file: 4065324 bytes
Output file: 6251972 bytes
error: end offset is lower than start offset
1 errors occurred.
error: no such output file: DENOVA/1.bin
1 errors occurred.

Done. Check DENOVA folder for extracted file. Press any key to exit...
So it's only one partition which should be ok. But I just saw that the 2.02 firmware (which generates a zero sized decompressed file) is quite larger than the 1.1 firmware that I can decompress.

Code:
C:\Viofo_A119\Novatek command line tools>bfc-v01.exe d FWBA119_v1.1.bin FWBA119_v1.1_decomp.bin
LZ77 decompress FWBA119_v1.1.bin to FWBA119_v1.1_decomp.bin...
Input file: 2752328 bytes
Output file: 5947324 bytes

C:\Viofo_A119\Novatek command line tools>bfc-v01.exe d FWBA119_v2.02.bin FWBA119_v2.02_decomp.bin
LZ77 decompress FWBA119_v2.02.bin to FWBA119_v2.02_decomp.bin...
Input file: 4065332 bytes
Output file: 6251972 bytes

C:\Viofo_A119\Novatek command line tools>dir *.bin
 Volume in drive C has no label.
 Volume Serial Number is 5089-DCC7

 Directory of C:\Viofo_A119\Novatek command line tools

29.08.2016  08:53         2'752'344 FWBA119_v1.1.bin
16.04.2017  19:58         5'947'324 FWBA119_v1.1_decomp.bin
21.02.2017  09:41         4'065'348 FWBA119_v2.02.bin
16.04.2017  19:59                 0 FWBA119_v2.02_decomp.bin
Cheers,
Martin
They added another partition, now its a multi-image binary. Unfortunately this requires "manual" reassembling (joining the two partitions)

Nevertheless DENOVA 0.5 works:
upload_2017-4-17_23-15-26.png
 
Joined
Apr 15, 2017
Messages
19
Likes
7
Country
Switzerland
Dash Cam
iTracker mini0806, 0906 beta
#10
Thanks for checking. I can't make it work, don't know why.

Anyway, I've decided to try a Mini0806. Your other tools work fine :)
 
OP
OP
Tobi@s

Tobi@s

Well-Known Member
App Developer
Joined
Nov 12, 2013
Messages
1,361
Likes
812
Location
Bavaria
Country
Germany
Dash Cam
some
#12
BFC has received an update to v1.1 to comply with Novatek code alignment rules
 
Last edited:
OP
OP
Tobi@s

Tobi@s

Well-Known Member
App Developer
Joined
Nov 12, 2013
Messages
1,361
Likes
812
Location
Bavaria
Country
Germany
Dash Cam
some
#13
Upcoming project: Novatek Movie Parameter editor:

This editor will be able to parse unpacked novatek firmware binaries and apply modifications to it.

Finding the movieparam struct was the most difficult thing... Regex for byte arrays dont exist...........

Proof of concept:
upload_2017-5-18_17-59-21.png
 
OP
OP
Tobi@s

Tobi@s

Well-Known Member
App Developer
Joined
Nov 12, 2013
Messages
1,361
Likes
812
Location
Bavaria
Country
Germany
Dash Cam
some
#14
BFC just received another update. Initially I planned to just add decompression from a specific address to support multi-image binaries but I found a critical access violation bug during testing..

Changelog:
-fixed access violation bug
-removed unneeded compression algorithms
-modified parameter syntax: bfc compression now no longer requires you to enter the algorithm (since it only supports lz77 now)
-added "multi-image" support, well at least kind of: You can now provide the offset of the bcl compressed partition you want to unpack and bfc will start extracting at that address

New syntax:
Compression:
Code:
bfc c compressme.bin compressed.bin
Decompression:
Code:
bfc d compressed.bin uncompressed.bin
bfc d compressed.bin uncompressed0.bin 0xaabbccdd
This release is also part of a preparation to build modular applications for a soon to be released GUI-wrapper


EDIT:
bfc mod 2.1 is released as well.. Download from my page (linked in op)
This release supports PartComp extraction via 'x' command:
Code:
bfc x partcomp.bin extracted.bin
Sources are online as well
 
Last edited:
OP
OP
Tobi@s

Tobi@s

Well-Known Member
App Developer
Joined
Nov 12, 2013
Messages
1,361
Likes
812
Location
Bavaria
Country
Germany
Dash Cam
some
#17
Working on an addition for bngui, a Resource editor, PoC strings editor shown below, bitmap/sounds/bootlogo/... should be easily possible as well. But theres one problem: Every resource has a fixed size and cant be adjusted dynamically (well not as dynamically as with ambarella and their RomFS contents)
(Language 6 - 9 show weird characters since i dont have cyrillic support installed on my computer)
upload_2017-6-15_0-14-11.png
 
Joined
Jan 28, 2018
Messages
40
Likes
3
Country
Ukraine
#20
In DUMP:
Settings:
offset = 0x1EF000 litele-Endian len = 4
0xCC 05 == China
0x200 - number Version

All ID lang
leng 00 == Engl, 01 = Franc, 02 == Esp, 03 == Deatch, 04 == Ital, 05 == China1, 06 == China2, 07 == Русский...

?
Question:
- Where in the firmware update This ID?
 

Similar threads

Top