vmax1145 / BitrateEditor

17 stars 0 forks source link

Not all the CRC32 checksums are updated in Ambarella H22 firmwares #7

Open RigacciOrg opened 2 years ago

RigacciOrg commented 2 years ago

I have a SJCAM SJ8 Pro, based on the Ambarella H22 SoC. Using BitrateEditor I was able to edit some firmware parameters (GOP and YUV values) and the camera flashed the customized file OK. I did some reverse engeneering on the firmware file and I discovered that there is an header of 560 bytes, which contains an overall CRC32 code and a table of sections. In that table there is another CRC32 code for each section (these codes are calculated as "rolling" CRC32 and they are stored with negated bits!); these CRC32 codes are not properly updated by BitrateEditor. I wrote two Python programs which can do proper unpack and re-pack of the firmware, updating all the CRC32 codes. You can find them here: https://github.com/RigacciOrg/ambarella-h22-firmware-tools I tested my programs on SJ8 Pro and Firefly X Lite firmwares. Unfortunately to properly handle SJ10 Pro firmwares I need to change a constant definition into the Python scripts, because the Ambarella ROMFS sections have a different layout that I was unable to autodetect.

TheBug233 commented 1 year ago

Hello, I have an insta360 x3, which is also an H22 SOC, but it cannot be flashed into the system after being packaged with your tool. It should be related to CRC32. What parts should I modify?