Novatek firmware tools (updated: 2018-08-06)

Tobi@s

Well-Known Member
App Developer
Joined
Nov 12, 2013
Messages
1,380
Reaction score
846
Location
Remote
Country
Germany
Dash Cam
none
Hello,
this thread contains command line tools for modifying Novatek single (for now) image firmwares. I will update it everytime I update one of the tools or add a new one.

ntkcalc (v0.7)
ntkcalc_img.png
Description: This tool is able to calculate the checksum of Novatek firmware images in raw or BCL format. For non-default images it can calculate the baseval for checksum calculation as well.

Usage:
  • Baseval calulation: ntkcalc -b firmware.bin
    Use this only with stock non modified firmware images, otherwise the calculated result is wrong

  • Checksum calculation (default baseval): ntkcalc -c firmware.bin
    This will output the checksum for raw and BCL compressed firmware images
    optional: -cw: This flag will write the calculated checksum at the correct address in the binary

  • Checksum calculation (custom baseval): ntkcalc -c firmware.bin 0xYYYY
    YYYY is the calculated baseval, the tool will add this to the calculated checksum
    Required for every firmware image with a baseval different to 0x0000, for example nanoQ firmwares.
    optional: -cw: This flag will write the calculated checksum at the correct address in the binary
Warning! Using this tool to validate modified firmwares and flashing them will most likely void your warranty. Also, no one but you is responsible for everything that results in flashing the modified firmware.

Download: (please do not mirror!)


bfc (v3.3) (Basic compression library for Novatek)
bfc_img.png

Description: bfc4ntk is a Ntk firmware packer/unpacker based on BCL (Basic compression library)


Usage (new syntax!):
1533516025829.png

Download: (please do not mirror!)
 

Attachments

  • bfc_img.png
    bfc_img.png
    10.4 KB · Views: 313
Last edited:
Hello ! BFC tool crashes during Soocoo C30 V1 and SJ5000x firmware decompress on Win7 32bit and VMWare WinXP 32 bit. Soocoo C30 V2 firmware decompressing without errors.
 
Please share the firmware and also try DENOVA tool from @nutsey
I guess the firmware has multiple partitions which are unsupported by bfc
 
It's a multi-image binary, thats why bfc fails.
Strange that DENOVA doesnt detect this. @nutsey have a look at 0x2764c4, I have no idea why DENOVA does not see this. I thought it searches the binary for the pattern BCL1
@regzno Dunno why DENOVA didn't work for you, but it does for me:
Code:
DENOVA Novatek firmware unpacking script by nutsey for GoPrawn.com v0.5

2 partitions found.

1st BCL partition is saved as DENOVA/1.bcl

decompress DENOVA/1.tmp to DENOVA/1.bin...
Input file: 2581676 bytes
Output file: 4971908 bytes

2nd BCL partition is saved as DENOVA/2.bcl


Done. Check DENOVA folder for extracted files. Press any key to exit...
 
Last edited:
Will have a look at it :)
 
Hello @Tobi@s

Thanks for watching, but first enjoy easter!

I just read that thing about multiple and single partition files and checked on a different computer (an old XP VM):

Code:
C:\Viofo_A119\DENOVA Novatek FW unpacking script>denova.bat FWBA119.bin
DENOVA Novatek firmware unpacking script by nutsey for GoPrawn.com v0.5

1 partition found.

FullComp partition type detected.

decompress tempfile.bin to DENOVA/1.tmp...
Input file: 4065324 bytes
Output file: 6251972 bytes
error: end offset is lower than start offset
1 errors occurred.
error: no such output file: DENOVA/1.bin
1 errors occurred.

Done. Check DENOVA folder for extracted file. Press any key to exit...

So it's only one partition which should be ok. But I just saw that the 2.02 firmware (which generates a zero sized decompressed file) is quite larger than the 1.1 firmware that I can decompress.

Code:
C:\Viofo_A119\Novatek command line tools>bfc-v01.exe d FWBA119_v1.1.bin FWBA119_v1.1_decomp.bin
LZ77 decompress FWBA119_v1.1.bin to FWBA119_v1.1_decomp.bin...
Input file: 2752328 bytes
Output file: 5947324 bytes

C:\Viofo_A119\Novatek command line tools>bfc-v01.exe d FWBA119_v2.02.bin FWBA119_v2.02_decomp.bin
LZ77 decompress FWBA119_v2.02.bin to FWBA119_v2.02_decomp.bin...
Input file: 4065332 bytes
Output file: 6251972 bytes

C:\Viofo_A119\Novatek command line tools>dir *.bin
 Volume in drive C has no label.
 Volume Serial Number is 5089-DCC7

 Directory of C:\Viofo_A119\Novatek command line tools

29.08.2016  08:53         2'752'344 FWBA119_v1.1.bin
16.04.2017  19:58         5'947'324 FWBA119_v1.1_decomp.bin
21.02.2017  09:41         4'065'348 FWBA119_v2.02.bin
16.04.2017  19:59                 0 FWBA119_v2.02_decomp.bin

Cheers,
Martin
 
Hello @Tobi@s

Thanks for watching, but first enjoy easter!

I just read that thing about multiple and single partition files and checked on a different computer (an old XP VM):

Code:
C:\Viofo_A119\DENOVA Novatek FW unpacking script>denova.bat FWBA119.bin
DENOVA Novatek firmware unpacking script by nutsey for GoPrawn.com v0.5

1 partition found.

FullComp partition type detected.

decompress tempfile.bin to DENOVA/1.tmp...
Input file: 4065324 bytes
Output file: 6251972 bytes
error: end offset is lower than start offset
1 errors occurred.
error: no such output file: DENOVA/1.bin
1 errors occurred.

Done. Check DENOVA folder for extracted file. Press any key to exit...

So it's only one partition which should be ok. But I just saw that the 2.02 firmware (which generates a zero sized decompressed file) is quite larger than the 1.1 firmware that I can decompress.

Code:
C:\Viofo_A119\Novatek command line tools>bfc-v01.exe d FWBA119_v1.1.bin FWBA119_v1.1_decomp.bin
LZ77 decompress FWBA119_v1.1.bin to FWBA119_v1.1_decomp.bin...
Input file: 2752328 bytes
Output file: 5947324 bytes

C:\Viofo_A119\Novatek command line tools>bfc-v01.exe d FWBA119_v2.02.bin FWBA119_v2.02_decomp.bin
LZ77 decompress FWBA119_v2.02.bin to FWBA119_v2.02_decomp.bin...
Input file: 4065332 bytes
Output file: 6251972 bytes

C:\Viofo_A119\Novatek command line tools>dir *.bin
 Volume in drive C has no label.
 Volume Serial Number is 5089-DCC7

 Directory of C:\Viofo_A119\Novatek command line tools

29.08.2016  08:53         2'752'344 FWBA119_v1.1.bin
16.04.2017  19:58         5'947'324 FWBA119_v1.1_decomp.bin
21.02.2017  09:41         4'065'348 FWBA119_v2.02.bin
16.04.2017  19:59                 0 FWBA119_v2.02_decomp.bin

Cheers,
Martin

They added another partition, now its a multi-image binary. Unfortunately this requires "manual" reassembling (joining the two partitions)

Nevertheless DENOVA 0.5 works:
upload_2017-4-17_23-15-26.png
 
Thanks for checking. I can't make it work, don't know why.

Anyway, I've decided to try a Mini0806. Your other tools work fine :)
 
Might be an issue with your OS, maybe @nutsey has an idea
 
BFC has received an update to v1.1 to comply with Novatek code alignment rules
 
Last edited:
Upcoming project: Novatek Movie Parameter editor:

This editor will be able to parse unpacked novatek firmware binaries and apply modifications to it.

Finding the movieparam struct was the most difficult thing... Regex for byte arrays dont exist...........

Proof of concept:
upload_2017-5-18_17-59-21.png
 
BFC just received another update. Initially I planned to just add decompression from a specific address to support multi-image binaries but I found a critical access violation bug during testing..

Changelog:
-fixed access violation bug
-removed unneeded compression algorithms
-modified parameter syntax: bfc compression now no longer requires you to enter the algorithm (since it only supports lz77 now)
-added "multi-image" support, well at least kind of: You can now provide the offset of the bcl compressed partition you want to unpack and bfc will start extracting at that address

New syntax:
Compression:
Code:
bfc c compressme.bin compressed.bin

Decompression:
Code:
bfc d compressed.bin uncompressed.bin
bfc d compressed.bin uncompressed0.bin 0xaabbccdd

This release is also part of a preparation to build modular applications for a soon to be released GUI-wrapper


EDIT:
bfc mod 2.1 is released as well.. Download from my page (linked in op)
This release supports PartComp extraction via 'x' command:
Code:
bfc x partcomp.bin extracted.bin

Sources are online as well
 
Last edited:
Working on an addition for bngui, a Resource editor, PoC strings editor shown below, bitmap/sounds/bootlogo/... should be easily possible as well. But theres one problem: Every resource has a fixed size and cant be adjusted dynamically (well not as dynamically as with ambarella and their RomFS contents)
(Language 6 - 9 show weird characters since i dont have cyrillic support installed on my computer)
upload_2017-6-15_0-14-11.png
 
And lang in icon bmp
 

Attachments

  • ico_DashCam_RU_12_34_CN.zip
    3.4 KB · Views: 19
In DUMP:
Settings:
offset = 0x1EF000 litele-Endian len = 4
0xCC 05 == China
0x200 - number Version

All ID lang
leng 00 == Engl, 01 = Franc, 02 == Esp, 03 == Deatch, 04 == Ital, 05 == China1, 06 == China2, 07 == Русский...

?
Question:
- Where in the firmware update This ID?
 
Back
Top