Novatek (NT9665X) firmware studies

Edit 4: Also have a look at GoPrawn forums: https://www.goprawn.com/forum/novatek-cams

Hello,
I finally got something interesting to play with after I got a bit "bored" (well not really bored but it wasn't that exciting anymore) with Ambarella A2-A7 chipsets. A fancy SG96650GC which is based on Novatek NT96650 from @niko - thanks again ;)

The first thing I did after receiving the camera was disassembling it (well ok, I mounted it in the car before to test it) and soldering some wires to it to get access to the terminal and see the kernel messages :D

I didn't think that it would be that easy but it indeed worked:

It even features a little "shell" :)

I don't know where this will go at the moment, maybe the same path as Ambarella or maybe somewhere completely else. I'll try to obtain information about the firmware and memory layout through the shell, maybe I am able to find something interesting.

The firmware probably consists of two sections, regarding this debug output:
Code:
[LOAD-FW]
Total Sections = 2
   Section-01: Range[0x80000000~0x800B0000] Size=0x000B0000 (LOAD)
PL_begin
   Section-02: Range[0x800AF1F0~0x803C9910] Size=0x0031A720 (LOAD)
PL_end
PL is probably payload, it starts within the range of section 01 but is much bigger. No idea what that means, yet.

Will update this thread as soon as I discover something interesting.

Edit1:
There are multiple consoles:
CMD console, EXAM console and eCos console
cmd console - switch key: ">": module based console for debugging
exam console - switch key: "$": ? not implemented in SG dc
ecos console- switch key: "#": probably console of eCos for WiFi support (https://en.wikipedia.org/wiki/ECos ) not implemented in SG dc

Edit2:
Theory:
Bootloader is permanent - atleast it cant be flashed using firmware binaries. Maybe it can be updated via USB.
It loads the firmware binary to 0x80000000 and executes it (...to be continued)
Confirmed: https://dashcamtalk.com/cams/mobius/Novatek NT96650.pdf page 10 "On-chip Boot Strap Loader"
Sooo.. Are these cameras unbrickable? The bootloader cant be overwritten so it will always start. Bootloader also is responsible for firmware updates. After flashing a corrupted image the camera would still boot into the bootloader (and could start the update procedure again?)

Edit3 (for disassembling):
Architecture: MIPS32 24KEc
Memory load address: 0x80000000

Cheers
Tobi
You posed this a while back Tobi. I recently acquired the Wolverine data 8mm machine which uses the same chip. Connected the console and got the same startup message but cannot switch to the command mode. Did you just hit the ">" key? I actually noticed the switch CMD prompt when I initially connected the TX line to The TX line. It same on a few times but nothing after that (obviously the lines were connected wrong). Maybe it is some sort of escape sequence? Any ideas?
 
you need to press enter afterwards. But not all of the console types are implemented.
 
Thanks Tobi. I tried that but it did not work. Guess Wolverine turned off cmd console.
 
Hello all members :)

I'm very new at this forum, and I know that forum is dedicated for dash cams. But looks that you guys here are my last resort :oops:

I bought night vision scope brand PARD model NV-007 with camera recorder. Chip Genius detected as "Novatekn vt-DSC". After searching by VID (0603) and PID (8611) this website says that chip is "NTK96550 based camera".
My camera has menu in English, French, and some other languages, but not Czech which I would like to have. My friend has a unit with Czech language, which I don't have. I wrote to a producer 3 weeks ago, then I reiterate my email, but without any response until today. Czech distributor said that he will not provide me file with Czech language update., because I should buy camera from his distribution.

I know from UK distributor that the file with a firmware/update should be written on SD card, then should be put into the camera, then camera should be turned on, and bootloader will change the system - to the new firmware. If the firmware has Czech language, I would have Czech language in the camera menu.

So my questions are:
1. If I dig up a firmware from my friend unit (this one with a Czech language) - can I just write dug up file(s) on SD card, then I will be able to update my unit as described above? I mean - if I dug up the firmware from my friend's device, would it be the same as an update file to write on SD card.
2. If the answer for above is yes, how to "dig up" my friend's firmware? Dear @jokiin, you think only the way as @Tobi@s says?

(
if you can find someone that has the same camera as yours you may be able to backup their firmware to create a new firmware for yours

But: you have to get access to the shell which is impossible without hardware modifications

access to shell via uart is required.
 
I have this dash...
First you need to know the firmware version, otherwise all your blind flashing actions can turn a dashcam into a brick.
Ask the seller to send the firmware, describe the problems to him.
Dashcam power how is it connected?
What is wrong with Wifi? Doesn't the smartphone see him at all? Perhaps Wifi is turned off by default, try to press and hold different buttons and watch the appearance of Wifi.
Do you have the TimaCam app loaded on your smartphone? Without this application, you will not be able to access the settings in the dashcam Menu.
Sound can also be off in the menu.
Does your dashcam have an extra camera?
A lot of information on similar dashcams (Novatek 96658 and Sony IMX 323) is on Russian forums:



Google translate to help! ;)
 
The seller give me 5 software with name: FW96658A
All of this software isnt ok for my dash. With original software (I have it) work fine (wi-fi, video and sound) but shutdown after 1:20 min. With other software is same OR work 15min and shutdown and sound is jerky or wi-fi dont work.
 

Is there any way you could forward me any of those firmwares? I used the software posted earlier to boost bitrate but it looks like it's for the model without a screen. So while it works, it is 180 inverted, I cannot set the date/time and the screen doesn't work.

This is similar to my dashcam which has Novatek 96558 chipset and Sony 323 sensor with a ~2inch screen.

HTB1QD.IbcfrK1Rjy1Xdq6yemFXag.jpg_300x300.jpg


I'd really appreciate.

Thank you
 
Last edited:
All of this software isnt ok for my dash. With original software (I have it) work fine (wi-fi, video and sound) but shutdown after 1:20 min.
What Loop Recording do you have installed?
What size in duration and volume of video files are obtained when the dashcam is working?

If you have disabled Loop Recording mode (you set the value Off), it turns out that the dashcam records the video as action camera in one file, and in this case the maximum size of the video file will be limited to 4GB (these are file system limitations).
And as soon as a file of such a volume is recorded - dashcam will stop recording, and you will need to turn it On again so that it will record another 4GB / 1:20 hours

For dashcams of this type and depending on other settings, a 1 minute file can be 50 MB in volume. Then a simple arithmetic about your 1 hour. 20 min. (4000MB / 50 MB = 80 min)

Try resetting all settings to factory / default and checking the duration value the Loop Recording is set in the menu.
More often 1 minute is recommended.
 
Last edited:
I solved my issue with firmware for A305. I technically have A307 but the 305 firmware worked. I have full functionality back for the dashcam.

 
Back
Top