jpleveillee wrote:if it can help someone, I just found the way to dump, hex edit and reflash the firmware from the camera serial console with firmfl.

Nice work, I've been meaning to post a message about this too - I did the same a couple of days ago too.
https://plus.google.com/104261803881547 ... JoF2D2trmv

Is there a need to dump when the FW is readily available online for download?? My understanding was dumping was only required if FW was not public.

I exchanged PM with Jean-Pierre today.

He has the GoPro 960.
No firmware updates have been published for that model by GoPro.

Mike,

if you dump the 3D firmware of your GoPro HD, what is the difference to the firmware update published by GoPro?

Jan

janmartin wrote:if you dump the 3D firmware of your GoPro HD, what is the difference to the firmware update published by GoPro?

I expect it's just the same. The command gave options to dump the same images that are known to be in the firmware file.
I didn't both comparing - I was focused of flashing working firmware onto my non working camera.

The camera runs a general purpose operating system PrKERNELv4. On top of that is Ambarella's code and GoPro's drivers for hardware they've added. Recreating this development environment without access to the Ambarella A2 SDK and GoPro's code occurs as a monumental project. I would love to get access to GoPro's SVN repository and the code in it.

- Mike

Has anybody contacted guys from GoPro already, asking them for making parts of the project open source?

dougie wrote:Has anybody contacted guys from GoPro already, asking them for making parts of the project open source?

Yes Dougie, approaches were made to GoPro who politely told them to buzz off, this was some time ago. It coincided with Gopro requesting i remove this thread from the forum. I declined and the decision cost me very valuable contact within and some doors were closed that i have had access to for a number of years. Because of this i would hope that any future breakthroughs are shared here and are open to all members not just the people that participate here and considered part of an inner circle. I respect the work you're all doing and although I'm not particularly interested in the day to day posting, i am interested in any breakthroughs in firmware control that can modify the camera for the benefit of the members here.

This forum has been a point of contact and a portal to share information on FW and BUS interfaces, some of you have commercial interests, some of you are only hobbyist/enthusiasts, but i ask that you continue to converse with members that may have an interest but are not as knowledgeable as yourselves.

*Off soapbox*

As Jean-Pierre has a GoPro 960 model, that answers my question re: need for dumping.

I'll be in San Francisco (Half Moon Bay - home of GP) in 2 weeks and plan on visiting a few key people there, i'll see what info i can get.

well, just coming back from my workbench... a bit disappointed after checking communications between Camera and LCD.

Because I wasn't able to identify an EEprom inside the camera like in the Sync-Cable, I thought it would be easy to set the camera in LCD mode.
However...

I can confirm that there's communication on the i2c Bus when switching on the camera!
I can further confirm, that one of the ID lines turns the LCD on and off (timeout after last button pressed)

I don't have found out on which line(s) the LCD tells the camera to change mode (button on LCD pressed)

At this point it would be easy having someone who has the internal serial port connected, and who could tell the messaging when LCD or Battery Backpack connected and camera turned on.

BR
Ralf

dougie wrote:I can confirm that there's communication on the i2c Bus when switching on the camera!

Is that i2c communication specific to the LCD? It would be normal to see i2c comms at startup as there are other things on that bus. I think there's an audio device and a video device.

StompSC's investigation into the LCD found a eeprom on the back of the PCB and a video decoder on the i2c bus. the-gopro-hero-hd-bus-interface-t797-200.html#p16956
Is that what you're seeing too?

- Mike

Sorry for being impatient, but I think I'm close to it....

EEPRom ID for the LCD is 9 ... but before I had to do this awful stuff again...






...and this is what I got out of it: (Turn Camera on with LCD attached, push LCD Button long (twice) and shut down camera again)

Code: Select all

   _____         ___.                        .__  .__
  /  _  \   _____\_ |__ _____ _______   ____ |  | |  | _____
/  /_\  \ /     \| __ \\__  \\_  __ \_/ __ \|  | |  | \__  \
/    |    \  Y Y  \ \_\ \/ __ \|  | \/\  ___/|  |_|  |__/ __ \_
\____|__  /__|_|  /___  (____  /__|    \___  >____/____(____  /
        \/      \/    \/     \/            \/               \/
Ambarella System Software Running on PrKERNELv4
----------------------------------------------------------------
Ambarella(R) Copyright (C) 2004-2007

Branch: SDK20100506
Built: wpmeng@szbuild Tue Mar 29 19:46:10 CST 2011

Memory Usage:
fios/dma:           0xc0000000 - 0xc007ffff [0x00080000]
rtos + app:         0xc0100000 - 0xc07ee81f [0x006ee820]
cached heap:        0xc07f0000 - 0xc349ffff [0x02cb0000]
non-cached heap:    0xc34a0000 - 0xc34fffff [0x00060000]
dsp:                0xc3500000 - 0xc7ffffff [0x04b00000]
total memory: 0x08000000
cache id trademark: 0x41
cache id architecture: 0x6
Architecture (ARMv5TEJ)
cache id part number: 0x926
cache id revision: 0x5
cache type: write back
separate i-cache and d-cache
cache type d-cache size: 16 KB
cache type d-cache associativities: 0x4
cache type d-cache multiplier: 0x0
cache type d-cache line size: 32 byte
cache type i-cache size: 16 KB
cache type i-cache associativities: 0x4
cache type i-cache multiplier: 0x0
cache type i-cache line size: 32 byte
Initialize Host Port Tx Module
rtc in pwc mode
Initialize SCM
Initialize STK task
Initialize debou task
Initialize FL1 block driver ...
fl1prf2 - fat pages:32, dat pages:32, fat buf:4, data buf:8
Initialize SD0 block driver ...
sdprf2 - fat pages:64, dat pages:32, fat buf:4, data buf:8
Initialize SD2 block driver ...
sdprf2 - fat pages:64, dat pages:32, fat buf:4, data buf:8
Initialize AMB flash host controller
HYNIX HY27US08561A_32MB_PG512 with (id: 0xad75ad75) (banks: 1)
Initialize AMB SD host controller 0
ROMFS: initialized
FW_PART: initialized
**** UCLD START 189 ****
tlv320aic3101_init()
Load main(code) ucode to 0xc7e00000 successful, size = 581552
Load sub0(me) ucode to 0xc7f00000 successful, size = 824796
Load default binary ucode to 0xc7eb9c00 successful, size = 262144
**** UCODE DONE 396 ****
**** AORC DONE 396 ****
tlv320aic3101_sfreq_conf()
IIS flag (0x00)
TLV320AIC3101 ADC flag (0x44)
TLV320AIC3101 DAC flag (0xd8)
tlv320aic3101_sfreq_conf()
Global audio cachable heap is created successfully......
Global audio cachable heap is created successfully(10)......
Global audio non-cache heap is allocated successfully......
Global audio non-cache heap is created successfully (11)......
audio tasks init done
DRAM_DSP_BASE register setting is 0x7E007F
Initialize cavlc task
Format cache 385048 1104 1160
bits buffer addr = 0xC33CA7E0
desc buffer is zero or negative
AMBA_YUVMON: the YUV device didn't support auto detect
allocate tsmux_par_t size 3280
allocate data_tracksize 96
allocate tsmux_misc_t 224
allocate tsmux_par_t size 3280
allocate data_tracksize 96
allocate tsmux_misc_t 224
AMBA tsmux was inited before, maybe avchd already init
register illegal video signal id
Recoder module init OK
-----------------c2305ce0 32
-----------------c2305d00 32
========== cavlc encode init ===========
========== cavlc encode init ===========
Player state transition manager ready
Player video pipeline controller ready
Playback video manager ready
========== cavlc decode init ===========
DeMux manager ready
Player photo pipeline controller ready
Playback photo manager ready
DeMux manager ready
Player sound pipeline controller ready
Playback sound manager ready
DeMux manager ready
Player thumb pipeline controller ready
Playback thumb manager ready
DeMux manager ready
State transition manager ready, mbx_id = 5
CAVLC Boot.........
Host control manager ready
@@@@@@@@@@@@@@@  DemoApp start to init  --- 474
Recorder Mux Manager ready, mbxid = 6
Player DeMux manager ready
amba_editor_task is ready
[yqx]app_init_status
[3D]off 3d init===================>
[yqx]sys_status.pref->adc3_lcd_emb_shutdown=707
[yqx]sys_status.pref->adc3_lcd_emb_turn_on=727
SENSOR OUTPUT
Dummy LCD
Unknown YUV signal
[app_init_herobus_id] app_yhdc5170_idc_rd_24aa00:9
[yqx]app_init_herobus_id sys_status.hero_bus_id 0x9
@@@@@@ (VOUT-0 SW. Scalar) Remain HEAP_MPLID: 27779196 @@@@@@
@@@@@@ (VOUT-0 OSD Buffer) Remain HEAP_MPLID: 25935960 @@@@@@
@@@@@@ (G-Blending Buffer) Remain HEAP_MPLID: 24753812 @@@@@@
[load_calib_data] calib_id:2  calib_size:4096 size:4096
[CAL]load calib ID:2 size:4096
[load_calib_data] calib_id:3  calib_size:430080 size:430080
[CAL]load calib ID:3 size:430080
[load_calib_data] calib_id:4  calib_size:2048 size:2048
[CAL]load calib ID:4 size:2048
[CAL]init site 01: enable:1 status:0x00 size:2048(af)
init_gyro_params, MEAN_X:52, MEAN_Y:52, STD_X:0, STD_Y:0
init_gyro_params, SENSE_X:21504, SENSE_Y:21504
[CAL]init site 02: enable:1 status:0x00 size:256(gyro)
[CAL]init site 03: enable:1 status:0x00 size:256(mshutter)
[CAL]init site 04: enable:1 status:0x00 size:256(iris)
[CAL]init site 05: enable:1 status:0x00 size:512(lsc)
[CAL]init site 06: enable:1 status:0x00 size:71680(vignette)
[CAL]init site 07: enable:1 status:0x04 size:256000(badpixel)
[CAL]init site 08: enable:1 status:0x01 size:256(wb)
[CAL]init site 09: enable:1 status:0x00 size:256(iso)
[CAL]init site 10: enable:1 status:0x00 size:256(blc)
[app_init_yhdc5170_mode] sys_status.pref->def_mode 0
[app_init_yhdc5170_mode] sys_status.pref->def_mode offset -21521
[yqx]sys_status.hero_bus_id9
set_device
[yqx] av_jack_event_cvbs_switch_handler
[yqx]do_lcd_on
[yqx] current battery adc is 826
[yqx] current temperature is smaller than 70.
amba_img_select_video_source +++ > start
amba_img_select_video_source +++ > sensor_init
[yqx]sensor_init mode=5
Chip Version = 6145
Chip Version = 6145
###Binning mode:1
=== This is Micron MT9P401 ver#8 ===
----- Enering img_init_slowshutter  TIME:933 -----
----- Leaving img_init_slow_shutter TIME:933 -----
amba_img_select_video_source +++ > 3
amba_img_select_video_source +++ > 4
amba_img_select_video_source +++ > 5
amba_img_select_video_source +++ > byebye
vout device_h=576 display_h=576 video_h =576
vout device_h=576 display_h=576 video_h =576
vout device_h=576 display_h=576 video_h =576
ON : dsp default configuration

-----------Flicker rate : 60Hz.-----------
-------------Frame rate :  60.------------


------Set wb gain zero!!-------

----- Enering img_set_slowshutter T:950 FR:50 to 30-----
Not support the frame rate
default cmd buffer has created
OFF : dsp default configuration
================ Booting DSP start to encode
**** BOOT START 953 ****
wait_load_ucode_done(1)
del UCLD task
===============================
u_code version = 2010/7/12 17.0
===============================
[GPIO43][1]
@@@@@@@@@@@@@@@@@@@@  DemoApp boot DSP  --- 969
**** BOOT DONE in ENCODE_MODE, time: 1015 ****
DSP boot done in ENCODE_MODE
*** Chip ID: 0 ***
================ Booting DSP end
unpacked badpixel mask: page:1 count:140 size:5942 byte
build bad pixel maps
====This frame rate not supported====
======hb = 440, vb = 167========
Micron 5MHD slow shutter

-----------Flicker rate : 60Hz.-----------
-------------Frame rate :  60.------------

Flashlight mode is OFF
DemoApp DCF set to type 2
DemoApp DCF format set to MP4, audio CODEC set to AAC

-----------Flicker rate : 50Hz.-----------
-------------Frame rate :  50.------------

*****************************************************************
*                                                               *
*                           ambsh ;)                            *
*                                                               *
*****************************************************************

rtos mesg enabled
dsp mesg disabled
type 'help' for help

a:\> ###### set_max_file_num fnum 9
@@@@@@@@@@@@@@@  DemoApp start to handle messages  --- 1575
Card inserted: D
@@@@@@@@@@@@@@@  DemoApp boot to preview  --- 1586
[yqx] REC_DSC_SENSOR_GUI_SHOW_BASIC
[yqx] only BAT1
[jim] usb connect =0

[app_test_extra_trick] OK test_trick_id:0
[yqx]handler_on_herobus_eeprom
handler_on_herobus_eeprom data 9
handler_on_herobus_id 9

-----------Enable anti flicker detection -----------
No DBOS was registered.
@@@@@@@@@@@@@@@  DemoApp boot to record  --- 1959
[app_check_special]sys_status.mvrecover=0
[jim] usb connect =0

[yqx]init_lcd
Initialize USB BITSTREAM Class
[jim] usb connect =0


-----------Anti flicker : 50Hz.-----------

FRMON_VDSP: 3019ms past validating Vdsp monitor.
[jim] usb connect =0

[jim] usb connect =0

Finalize USB BITSTREAM Class
Initialize USB BITSTREAM Class
[jim] usb connect =0

[jim] usb connect =0

[jim] usb connect =0

Finalize USB BITSTREAM Class
Initialize USB BITSTREAM Class
[jim] usb connect =0

[jim] usb connect =0

[jim] usb connect =0

application receives user command 0xFFFE0035
Finalize USB BITSTREAM Class
Initialize USB BITSTREAM Class
[jim] usb connect =0

[jim] usb connect =0

[yqx] view_start
audio encode flow mem had been released
wait for entering timer mode
entering timer mode successfully
DSP change mode done in DECODE_MODE
[yqx]_my_pb_video new state
[yqx] only BAT1
[jim] usb connect =0

application receives user command 0xFFFEA035
[jim] usb connect =0

Finalize USB BITSTREAM Class
Initialize USB BITSTREAM Class
[jim] usb connect =0

[jim] usb connect =0

application receives user command 0xFFFE0035
[jim] usb connect =0

vout device_h=576 display_h=576 video_h =576
vout device_h=576 display_h=576 video_h =576
vout device_h=576 display_h=576 video_h =576
default cmd buffer has created
ON : dsp default configuration
default cmd buffer has created
OFF : dsp default configuration
DSP change mode done in ENCODE_MODE
@@@@@@@@@@@@@@@  DemoApp boot to preview  --- 18435
[app_check_special]sys_status.mvrecover=0
[yqx] REC_DSC_SENSOR_GUI_SHOW_BASIC
[yqx] only BAT1
[jim] usb connect =0

[app_test_extra_trick] OK test_trick_id:0

-----------Enable anti flicker detection -----------
Finalize USB BITSTREAM Class
Initialize USB BITSTREAM Class
[jim] usb connect =0

application receives user command 0xFFFEA035
2s lcd button clear
[jim] usb connect =0


-----------Anti flicker : 50Hz.-----------

[jim] usb connect =0

FRMON_VDSP: 3020ms past validating Vdsp monitor.
Finalize USB BITSTREAM Class
Initialize USB BITSTREAM Class
[jim] usb connect =0

application receives user command 0xFFFE000A
[yqx] lcd_emb_power_handler
[jim] usb connect =0

[jim] usb connect =0

=========================
======= Power Off =======
=========================
mw_storage_sync sd:D: 0
mw_storage_sync fl:A: 0
application receives user command 0xFFFEA00A
Finalize USB BITSTREAM Class
Initialize USB BITSTREAM Class
@Shutdown System

some news on my progress with the firmware.

I had problem with the crc check of the firmfl utility.
When a .bin firmware file is modified, the crc is not the same as the original file and firmfl do not proceed with the flash.
I found that the checksum value is at position 0x00000800h of each bin files.
When we modify a .bin we need to update the crc in the firmware .bin with the new and then firmfl accept the modified file for flashing!
I modified a jpg file and a string in the drives utility of the built-in command(for testing purpose).
I was able to reflash the 2 modified bin files without bricking my camera and the changes are on the camera.

Next step I want to correctly extract the files in the .bin ,modify or add files and repack the .bin for reflash.
I am not a firmware hacking guru so I will need help and knowledge to correctly extract all the files..
It must be a better way than an hex editor and binwalk.. must exist some kind of utility to extract files from a binary file!
If someone here can help.
I will try on the CHDK forum.

Thanks

Jean-Pierre