Welcome
Welcome to goprouser

You are currently viewing our boards as a guest, which gives you full access to view most discussions and access.. By joining our free community, you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content, and access many other special features. In addition, registered members also see less advertisements. Registration is fast, simple, and absolutely free, so please, join our community today! Any issues email goprousergroup@gmail.com

Gopro HD 960 Firmware hack

The Interface BUS or Rear Port. Discuss projects or creative uses.

Gopro HD 960 Firmware hack

Postby jpleveillee » Wed Jul 27, 2011 4:19 am

Some news on my progress.

With IDA Pro ,I finally managed to disassemble the firmware and begin to slowly understand how it work and do some reverse engineering on it.
I think I found where to patch in the binary to disable the anti-flicker for good to remove the annoying jello effect.
I patched the firmware and I flashed it on my cam.
Now I will need to build a jello maker machine to test my patch.

In the serial console there is an utility called "t".
using the following command: "t img" + parameters..
there is a lot of option to disable/enable/set the exposure, anti-flicker ,white balance, raw capture and a lot of other options.
Here is the documentation on this utility:

Code: Select all

Usage: t img -mepraw [mode] [shutter_idx] [agc_idx]: Video/Still manual-exposure raw capture
mode = 0, Video Raw Capture
mode = 1, Still Raw Capture
shutter_idx, by Driver
agc_idx, by Driver


Usage: t img -blc: get the current black level
t img -blc [val]: set the current black level
t img -blc cal_rd: read the calibration black level values
t img -blc cal_rst: reset the calibration black level values


Usage: t img -me [mode] [shutter_idx] [agc_idx]: Video/Still manual-exposure raw capture
mode = v, Video Raw Capture
mode = s, Still Raw Capture
shutter_idx, by Driver
agc_idx, by Driver


Usage: t img -raw [mode] [num]: Video/Still raw capture
mode = 0, Video Raw Capture (section 1)
mode = 1, Still Raw Capture (section 1)
num = 1~100, Capture numbers


Usage: t img -3a [on|off|]: turn on/off 3A
img -3a [info] : display 3A status

video ae_info: ev:%4d sht:%4d agc:%4d iris:%4d dgain:%4d flash:%d
still ae_info: ev:%4d sht:%4d agc:%4d iris:%4d dgain:%4d flash:%d
Usage: t img -ae [on|off]: turn on/off AE
img -ae [info] : display AE status
img -ae [slowshutter] : turn on/off slowshutter

Usage: t img -awb [on|off]: turn on/off AWB
img -awb [info] : display AWB status

------------------->>>>AF cap setting information<<<<---------%d
--------------->>>>continuous AF cap setting<<<<----------------------
-------------------->>>>still AF cap setting<<<<---------------------------
Usage: t img -af [on|off]: turn on/off AF
img -af [capinfo] : display AF status
img -af [cap] : set AF capability
img -af [cst] : set continuous AF setting
img -af [sst] : set still AF setting
img -af [ifc] : still af quality check
img -af [snap] : take pictures

Usage: t img -adj [on|off]: turn on/off ADJ
img -adj [info] : display ADJ

t img -adj load [mode] [path]: read header file from SD card
mode = [v|s], v: video mode s: still mode

t img -adj status [mode]: show the current status of video/still adjust parameters
mode = [v|s], v: video mode s: still mode

Usage: t img -lens [cmd] [p1] [p2] [p3]:
Supported cmd:
linfo: lens information
init: initial lens
park: lens park
zi: Zoom in
zo: Zoom Out
zpi: Zoom PI On/Off
zst: Get Zoom status
fn: Focus Near
ff: Focus Far
fpi: Focus PI On/Off
fst: Get Focus status
iris: Set aperture
irisq: Query aperture index to set to desired Fno
irist: Get aperture status
sh: Shutter Operation
zck: Check and test Zoom motor
fck: Check and test Focus motor
cal: Calibrate lens


Usage: t img -agc: get the current agc of sensor
t img -agc range: get the min/max agc value
t img -agc [db]: set the current agc of sensor
db = [min db] ... [max db]
(3|6|9|12.... has to be multiple of 3)


Usage: t img -agcidx [v1] [v2] [v3]: AGC_Idx change and Capture
v1 = 0~161, v2 = v3 = " ", Changing the AGC_Idx
v1 = v2 = 0~161, v3 = " ", Changing the AGC_Idx and one Video-Raw
Capturing
v1 < v2, 0~161, v3 = " ", Changing the AGC_Idx and Continue
Video-Raw Capturing with 1-step
v1 < v2, 0~161, v3, 1~10, Changing the AGC_Idx and Continue
Video-Raw Capturing with v3-step


binning_modebinning_modebinning_modebinning_modebinning_modebinning_mode =%d
Usage: t img -bpc [command] [param]... :bad pixel correction utility

t img -bpc set [mode] [level] [value]: set bad pixel correction
mode = [v|s], v: video mode s: still mode
level = [0..5], 0: static, 1-5: dynamic
value = [0..255], fixed value (8bits) of bad pixel mask

t img -bpc init: init detection process
t img -bpc exit: exit detection process

t img -bpc run [mode][type][num][thd][db][time]: run detection process
mode = [v|s], v: video mode s: still mode
type = [0|1], 0: bright pixel 1: dark pixel
num = [1..30], picture number
thd = [0..200], detection threshold, 0%%-100%%
db = [0,3,6..21], sensor agc in db
time = [30|50|60|100], sensor shutter time in 1/time sec

t img -bpc pack [mode]: compress bad pixel mask
t img -bpc unpack [mode]: cdecompress bad pixel mask
mode = [v|s], v: video mode s: still mode

t img -bpc load: load compressed bad pixel mask from preference
t img -bpc save: save compressed bad pixel mask to preference
t img -bpc info: display bad pixel information

t img -bpc test [mode]: set a test pattern (4x4 grid) for bad pixel mask
mode = [v|s], v: video mode s: still mode

t img -bpc wr[mode][filename]: save to bad pixel map to SD card
mode = [v|s], v: video mode s: still mode

t img -bpc rd [mode][filename]: load bad pixel map to ARM form SD card
mode = [v|s], v: video mode s: still mode

t img -bpc verify [mode]: verify bad pixel bitmap
mode = [v|s], v: video mode s: still mode

t img -bpc set2 [level][correction_mode]: set dynamic bad pixel correction

Usage: t img -dzoom info: get digital zoom information
t img -dzoom status: get digital zoom status
t img -dzoom [dir] [speed] [dist]: digital zoom control
dir = 0, ZOOM IN
dir = 1, ZOOM OUT
dir = 2, STOP
speed = [1..5] 1 is slowest, 5 is fastest
dist = relative step from current position


Usage: t img -agc: get the current fine gain of sensor
t img -agc range: get the min/max fine gain value
t img -agc [idx]: set the current fine gain of sensor
idx = [min index] ... [max index]


Usage: t img -f_tst [mode]: Strobe Test
mode = 0, Display the Strobe Status
mode = 1, Charge the Strobe and Fire
mode = 2, Manually Enable the Strobe Charging
mode = 3, Manually Disable the Strobe Charging
mode = 4, Automatic Charging the Strobe


Usage: t img -fr [mode] [fr]:set frame rate of slow shutter
mode = 1, SENSOR_HD
mode = 2, SENSOR_SD
mode = 4, SENSOR_HD_PAL
mode = 5, SENSOR_SD_PAL
mode = 8, SENSOR_SDWIDE
mode = 9, SENSOR_SDWIDE_PAL
fr = [60|30|15|8|4]


Usage: t img -iris: get the current iris
t img -iris range: get the min/max iris value
t img -iris [idx]: set the current iris value
idx = [min index] ... [max index]


Usage: t img -bfd on : turn on ucode bad frame detection(BFD)
t img -bfd off : turn off ucode bad frame detection(BFD)


Usage: t img -eis on|off: turn on|off eis
t img -eis log [filename] [sec]: log gyro data
filename = filename of the saved file
sec = how many seconds


Usage: t img -sht_cc [v1] [v2] [v3]: E-Shutter change and Capture
v1 = 1~511, v2 = v3 = " ", Changing the E-Shutter
v1 = v2 = 1~511, v3 = " ", Changing the E-Shutter and one Video-Raw
Capturing at agc = 0dB
v1 < v2, 1~511, v3 = " ", Changing the E-Shutter and Continue
Video-Raw Capturing with 1-step at agc = 0dB
v1 < v2, 1~511, v3, 2~50, Changing the E-Shutter and Continue
Video-Raw Capturing with v3-step at agc = 0dB


Usage: t img -vnc [mode] [enable] [tile] [pattern]: test vignette compensation
mode = [v|s], v: video mode s: still mode
enable = 0:disable, 1:enable
tile = 0:64Hx64V, 1:64Hx128V,
2:128Hx64V, 3:128Hx128V
pattern = [0..3], hard-coded pattern


Usage: t img -flicker [mode]: set antiflicker algorithm
mode = [0..2]


t img -wb_cal [v1] [v2] [v3] [v4]: White Balance Adjust
v1 = 0, 1, 2, 3 or 4, 0: Calculate the Golden Gain
1: Calculate the Low Color-Temperature AWB Adjust Gain
2: Calculate the High Color-Temperature AWB Adjust Gain
3: Reset the AWB Adjusting Gain(1024)
4: Save and Show the AWB Adjusting Gain
5: Show the AWB Adjusting Gain
v2 , if v1 = 1, or 2, v2 is meaning the reference Ravg
v3 , if v1 = 1, or 2, v3 is meaning the reference Gavg
v4 , if v1 = 1, or 2, v4 is meaning the reference Bavg


Usage: t img -vin [mode]: choose HD/SD/PHOTO mode
mode = [0..2]
mode = 0, HD mode
mode = 1, SD mode
mode = 2, PHOTO mode
mode = 3, SDWIDE mode
mode = 4, HD 30 mode


Usage: t img -aeb [num] [ev_bias 0] ... [ev_bias num]:
num = 1..5
ev_bias = -127..127 with 32 unit EV

Usage: t img -face ldimg [file name] [width] [height] [action]: load test image file
[action]:1 : face tracking, 2: smile detection, 3: red eye removal
t img -face ftrack 1 : face tracking enable
t img -face ftrack 0 : face tracking disable
t img -face strack 1 : smile detection enable
t img -face strack 0 : smile detection disable


Usage: t img -exif load [file name] : load test image file
img -exif [last] : get exif data of last image file in sd card
img -exif [cur] : get exif data of current image file in sd card


Usage: t img [OPTION] VALUE...
Supported options:
-3a: 3A(AE/AWB/AF/ADJ) control
-aeb: AEB test function
-agc: agc control
-agcidx: agcidx control
-bfd: turn on/off ucode bad frame detection(BFD)
-blc: black level correction
-bpc: bad pixel correction
-dzoom: digital zoom control
-eis: electronic image stabilizer(EIS) test function
-face: Face Detect test function
-fagc: fine agc control
-flicker: antiflicker test function
-f_tst: strobe test
-fr: slow shutter control
-iris: iris control
-idsp: idsp information
-lens: lens calibration and test functions
-mem: profile of ucode's memory usage
-raw: still/video raw capture
-raw_enc: raw-encode function
-sht_cc: e-shutter change and capture
-vnc: vignette compensation
-vin: video input function
-exif: private exif info
Try 't img [OPTION] --help' for more information.

[reg_addr] : audio codec internal register address (in decimal) .....
[no] : how many following registers value will be read out .....




JP
jpleveillee
 
Posts: 8
Joined: Wed Jun 29, 2011 8:47 am

Re: Gopro HD 960 Firmware hack

Postby Rambo » Wed Jul 27, 2011 8:49 am

JP, nice work, i didn't expect you to make such rapid progress so soon after i hooked you up with IDA Pro.

1. Can you explain why you think turning off anti flicker will aid in reducing jello, i've not looked at this before?
2. Can you list what your priority is to patch, ie up the bitrate, lock exposure, etc.

Thanks and congratulations on the early but rapid progress.
R
Support our Sponsors - Click the Links
Gon'Feel GPS & PHYSICS OVERLAYS on your VIDEOS - NEW
Spinpod : TimeLapse Motion System
Snake River Prototyping - BlurFix - NEW PRODUCTS OUT NOW
Sports Camera Hire & Sales Australia
Hobby Mounts UK
Outdoor Equipment Rentals
Hardened Power Systems
Cam-Do
Fotodiox Pro - NEW PRODUCTS OUT NOW
AccessoryHero UK - FlowMow
User avatar
Rambo
Site Admin
 
Posts: 5578
Joined: Thu Sep 04, 2008 2:34 pm
Location: Mooloolaba, Qld Au

Re: Gopro HD 960 Firmware hack

Postby DavidSykes » Wed Jul 27, 2011 10:06 pm

Can you tell me the IDA Pro settings for disassembling the firmware ?

I am particulary interested in how stereo synchronisation works.

I suspect the slave receives the pixel clock and frame synch pulse from the Master and then changes the frequency of its phase-locked loop until both frame pulses are synchronised.
DavidSykes
 
Posts: 2
Joined: Wed Jul 27, 2011 10:00 pm

Re: Gopro HD 960 Firmware hack

Postby jpleveillee » Sat Jul 30, 2011 3:49 pm

I am new to IDA Pro
So I used the default settings with ARM selected as processor.
With the default settings it disassemble a lot of the firmware.bin

JP
jpleveillee
 
Posts: 8
Joined: Wed Jun 29, 2011 8:47 am

Re: Gopro HD 960 Firmware hack

Postby suryaprihadi » Wed Aug 03, 2011 3:43 am

Dang, I wish I know more about this things........but its great to hear of any progress ( even though I hardly understand it...hehehehe )..........yeahhh !!!!!!
I am a Forum Sponsor not because I sell stuff.
I owe my knowledge to this forum and I would like to do some payback.
.
suryaprihadi
Forum Sponsor
Forum Sponsor
 
Posts: 3949
Joined: Fri May 28, 2010 3:52 am

Re: Gopro HD 960 Firmware hack

Postby daewootech » Sat Aug 20, 2011 5:15 am

fantastic work, any luck in progress?
-----
http://www.daewootech.net
http://www.youtube.com/daewootech
User avatar
daewootech
 
Posts: 51
Joined: Tue Apr 19, 2011 9:30 am
Location: San Jose, Ca

Re: Gopro HD 960 Firmware hack

Postby Catalyph » Fri Sep 09, 2011 10:56 am

Any progress?
I would like to see better night performance =)
Or 1080p Recording on the 960!
Catalyph
 
Posts: 1
Joined: Fri Sep 09, 2011 10:52 am


Return to GoPro Interface BUS

Who is online

Users browsing this forum: No registered users and 0 guests

suspicion-preferred