Hi everyone.
I have 3 cameras of 2 kinds. One camera uses 365cam apk, two cameras - V720 apk. 365cam works with datenstau/A9_PPPP solution (thanks to author btw). 365cam camera have FinSH with a lot of useful commands. One of them is fal, second - flash_dump. flash_dump just prints hexdump of whatever you want address up to 256 bytes. fal requires probe to partition and then allows to read/write probed partition. fal should prints a list of partitions, but developers broke this function. Anyway i found a names of all partitions when experimented with flash_dump.
There is one important thing I known from my experiments - bekken chips have two kinds of how address flash memory: physical - is how cpu see memory, app starts at 0x00010000, virtual - mixed with 2 bytes of crc after every 32 bytes of real bytes, app starts at 0x00011000. I read about it on a russian website.
fal command works with physical memory
flash_dump command works with virtual memory
Here is examples:
msh />fal read 0 64
Read data success. Start from 0x00000000, size is 64. The data is:
Offset (h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
[00000000] C5 00 00 EA 14 F0 9F E5 14 F0 9F E5 14 F0 9F E5 ................
[00000010] 14 F0 9F E5 14 F0 9F E5 14 F0 9F E5 14 F0 9F E5 ................
[00000020] 24 06 00 00 B8 05 00 00 34 06 00 00 44 06 00 00 $.......4...D...
[00000030] 54 06 00 00 C8 05 00 00 D8 05 00 00 EF BE AD DE T...............
msh />flash_dump 0 64
flash_dump 0x00000000 64
00000000: C5 00 00 EA 14 F0 9F E5 14 F0 9F E5 14 F0 9F E5 ................
00000010: 14 F0 9F E5 14 F0 9F E5 14 F0 9F E5 14 F0 9F E5 ................
00000020: 38 DA 24 06 00 00 B8 05 00 00 34 06 00 00 44 06 8.$.......4...D.
00000030: 00 00 54 06 00 00 C8 05 00 00 D8 05 00 00 EF BE ..T.............
I wrote a tool in python which uses fal command and saves a dump of partition.
Here is partitions table of 365cam camera
--------------------------------------------------------------
| addr | last addr | len | partition |
--------------------------------------------------------------
| 0x00000000 | 0x0000efff | 61440 | bootloader |
| 0x00010000 | 0x0018ffff | 1572864 | app |
| 0x00132000 | 0x001fdfff | 835584 | download |
| 0x001fe000 | 0x001fefff | 4096 | EasyFlash |
| 0x001ff000 | 0x001fffff | 4096 | param2 |
--------------------------------------------------------------
I tried to disassemble bootloader+app using ghidra. Found encryption table used in A9_PPPP, encrypt/decrypt functions. I had an idea - this encryption is just xor operation, if i replace table by zeros encryption will be disabled. Cheked this idea and have failed with fal command. fal write is not working.
Later I start experiments with uartprogram from OpenBekenIOT/hid_download_py. And this tool works great with both types of my cameras. This tool works with virtual addresses, created dump includes crc bytes. And bin file you want to flash should contain crc bytes. Partition app starts from 0x00011000. This tool can extract bin without crc bytes. I did not understand that fact, i thought that address 0x00011000 is a mistake, or my camera is unique and flash my dump into 0x00010000, camera got bricked.
uartprogram works simple. It awaits that bekken chip starts in bootloader. When bekken start OS rtthread this tool sends command reboot to FinSH. If tool canât reboot chip you need to do it manually - connect CEN pin to ground or just turn off and on power supply (in my case i pressed a button on the power bank). If bootloader partition is ok chip can be flashed by this tool.
When I realized my mistake with addresses i simply restore app partition from backup. I tried to flash bootloader partition from backup made by fal.
Previously I flashed backup of app to virtual address 0x00010000. It writes to physical addresses 0x0000f000-0x00010000. In partitions this area is unused but looks like it stores some calibrations. Now my 365cam camera starts with strange wifi config, i have to configure mac and wifi in terminal on every restart.
I tried to flash modified (without encryption) app_crc.bin - camera starts but, apk/A9_PPPP canât connect.
I tried to flash app_365cam_crc.bin to V720 camera - bootloader starts, os not (I didnât check second uart interface, 365cam have only one uart pins). Restored app from backup - works fine.
There is one more tool which adds crc bytes to binary file: https ://github.com/ghsecuritylab/tysdk_for_bk7231/tree/master/toolchain/encrypt_crc
My backups: https://file.io/Kf0iUTWo3VqA
Then I think basically all pieces are in place for actually making something that works with Home Assistant.
My first delivery in this venture is a working WireShark dissector for âencryptedâ PPPP traffic.
