ITB-100HD firmware modification (bitrate)

[Tommy]

Hey there,

First of all, I am not a very technical person when it comes to software (I not a programmer nor anything related).

I've been trying for months to pay someone to increase the bitrate of my dashcams. I am sure it can be done.

Now, 1) the manufacturer (iTronics) blew me off in a second 2) I haven't managed to get get a reply from the russian guys that made the BlackVue or FineVu modifications 3) here on the forum, someone wasn't going to test on their own cam.

So I had to take this into my own hands.

Step 1

From the Russian forum, and these two other links ( http://f.redflagdeals.com/showthread.ph ... type=basic + viewtopic.php?f=6&t=6&start=50) it seems that after decompressing the firmware for the BlackVue cameras, the settings need to be modified in the av_server.sh file.

Problem is, after decompressing the iTronics latest firmware (2.1) : http://ipassmall.co.kr/ipassblack/down_ ... 3%29%2Ezip, I don't have that av_server.sh file. I have pretty much a very similar structure (since both cameras use Linux and bot cameras need a similar software structure for the DR368 or similar Texas Instruments processor).

I used http://sourceforge.net/projects/hexplorer/ to search for the config parameters needed to change the bitrate. Something like :

av_server.out DM368 %sAEWB TI2A %s %s %d VBR AUTO %d MENUOFF &

After decompressing the firmware.bin I get two files:

itb100_fw.bin and itb100_kernel.bin

After further decompressing itb100_fw.bin (because itb100_kernel.bin has nothing relevant to setting the bitrate, after searching with a full text HEX tool), I further get a folder called IPNC, and inside of it:

As you can see, there is no av_server.sh file, like BlackVue has. After searching file by file with: http://www.sowsoft.com/search.htm, for "av_server.out", the only two files containing that string are the av_server.out itself and a test file (which is probably used for testing, not for actual parameters).

The content of the modified av_server.sh file from the modified BlackVue firmware is:

#!/bin/sh

SIZE=1080P
#SIZE=5MP
# other possible resolution options:
#2MP
#3MP
#5MP - does not work - not enough memory
#720P_MAX
BITRATE="15000000"
# Default bitrate is 5000000

exec /mnt/nand/System/wrap/av_server.out DM368 AUDIO 8000 AAC 24000 AEWB TI2A $SIZE H264 $BITRATE 1 VBR AUTO $((BITRATE + 500000)) MENUOFF

I have also extensively searched Google for related information, like:

https://www.google.com/search?q=av_serv ... _HAQQhsr6w

If someone can help further, I would appreciate it.

 

[mrkookm]

I've pm'd yakpimp about trying to to do this for 100HD SP since it is evident he has the skills to do it if it's possible. Pm him and see what he says.

 

[Tommy]

Pm him and see what he says.

by yakpimp » Mon Apr 08, 2013 7:01 pm

I've looked at it a bit, but I'm not really sure I want to experiment on my new camera. If I had another one lying around I might be more likely to actually fiddle with the bitrate.

I am more than comfortable to test what he found out, on my own dashcams, if he can find anything.

 

[Mitch]

I'm sure Itronics has its own files for storing the configuration information and this is stored somewhere. The hardware are eprom which means to say they are erasable and reprogrammable via firmwares.

 

[vibeone]

I'll be following this with interest, and would be very happy to pay for the modified firmware (same as speedo mph change!).

 

[Tommy]

There's pretty much nothing to follow.

I think it will die here, unless Mio can get on this. I am clueless how to go further.

 

[yakpimp]

There are a couple interesting things in the firmware.

I found two pieces of code that I believe may be the key to what you are trying to do.

The first one is the function that sets the bitrate.

The second is the caller of the first function.

I haven't taken the time to dissect each of these yet to figure out which parameter the bitrate actually is. Feel free to do that. Once we know that I should be able to manually patch the binary.

 

[Tommy]

It's totally beyond my expertise at this point.

My initial post is literally, the best I could do with the limited experience I have.

But I will try to fiddle with it more.

PS: What is that reader you used ? I use Hexchat and it doesn't seem so powerful.

 

[yakpimp]

IDA.

https://www.hex-rays.com/products/ida/index.shtml

 

[Mtz]

Oh man, you will "kill" Tommy with IDA... :mrgreen: this is very advanced stuff and without some aditional files needed by IDA is very hard to work.
I hope you will discover more and share.

enjoy,
Mtz

 

[yakpimp]

Come on, give him some credit, he got the thing unpacked. Which is pretty good.

 

[Tommy]

Yeah, I had a look over some screenshots of IDA. It's probably a tool for programmers, which I am not.

 

[Tommy]

Tried it. And yep, it's too advanced.

I'll just leave this to someone else. Yak, Mio, etc.

 

[vibeone]

Now its sunny over here in the UK, I'm starting to see major problems with the bitrate in 'busy' videos.

Will knocking it down to 720p help matters or not? I'm not sure how bitrate is calculated - but smaller res = small bitrate but with less info to share between? RIght?

Anyway, I hope someone can get it unlocked for us - the camera is great bu the bitrate is becoming a bad limitation

 

[Tommy]

720p won't help, sadly. The bitrate drops accordingly.

Some cameras (not the high-end ones) maintain their bitrate at all resolutions. If you had one of those, it might help.

 

[dashingthrusnow]

In search of a bitrate hack myself...

autorun.sh

#echo "2" > /proc/cpu/alignment
sleep 1
./boa -c /etc &
/usr/sbin/avahi-autoipd --no-drop-root --no-chroot -D eth0
/usr/sbin/avahi-daemon --no-drop-root --no-chroot -D
/usr/sbin/avahi-dnsconfd -D

Loading boa into a hex editor gives the following:

Usage: %s [-c serverroot] [-r chroot] [-d] [-b] [-q bitrate]

So, would it be safe to say that adding the -q <bitrate> to the autorun.sh line is the solution?

./boa -c /etc -q <bitrate> &

Some google searching reveals that BOA for linux is a webserver... perhaps the itronics people customized the boa to act as the streaming video server.

Edited the file and repacked the tar/gzip. The itb100hd isn't accepting my repackaged tar/gzip. I've been using 7zip under Windows 7. Maybe a checksum error or file size issue...

 

[dashingthrusnow]

./boa -c /etc -q <bitrate> &

Ok... I tried the following bitrates without success:

10000000
800000
70000
900

I had to unpack-repack the firmware in linux. 7zip wasn't working.

It went to recording at 500 kbps.

Makes me wonder if there's a config file under /etc ...

 

[dashingthrusnow]

http://e2e.ti.com/support/dsp/davinci_d ... 42542.aspx

I am attaching rcS file that exists in <IPNC DIR>/ipnc_app/root_filesys/etc/init.d/rcS. If you look at this file, following commands are called at the end

# Load the dsplink and cmem kernel modules
cd $DVEVMDIR
$DVEVMDIR/av_capture_load.sh
cd /dev
ln -s rtc0 rtc
cd $DVEVMDIR
mount -t jffs2 /dev/mtdblock4 /mnt/nand
sleep 1
./system_server &
$DVEVMDIR/loadkmodules.sh
$DVEVMDIR/loadmodules_ipnc.sh
ifconfig lo 127.0.0.1
./boot_proc 1
# Start the demo application
cd $DVEVMDIR
$DVEVMDIR/autorun.sh

This rcS file is copied into filesystem when the IPNC application is built using "make" command. The file is copied into /etc/init.d/rcS. If you are using TI's filesystem that is released with the IP Camera Reference design, you can directly refer to the file /etc/init.d/rcS in the target filesystem. You would see the same commands.

This rcS file is executed when the init operation is called. If you look at the commands, we call system_server from the rcS file and at the end we call autorun.sh. The contents of autorun.sh are the same that you listed in your post.

system_server --> This starts the complete application which reads the environment variables from the NAND and then start av_server based on those environment variable settings.

av_server --> This is the core audio video engine to do audio and video capture.

boa --> Open source Web server which takes message from our PC side GUI and pass the messages to system_server, which in turn passes the message to av_server.

wis-streamer --> RTSP streaming application using open source LIVE555

upnp-scanip --> uPnP client

So you need to run system_server for overall system to work, boa for web browser interface, wis-streamer for enabling RTSP streaming.

I hope this gives you enough detail about the booting mechanism.

The configurations are probably buried in the Kernel... May need to kill everything and restart system_server in the autostart.sh file...

This may be helpful:
http://www.appropho.com/NewWeb/DOC_DM36 ... dGuide.pdf

 

[dashingthrusnow]

Awesome. Was able to pull the directory structure off the device... this is exciting as now I can copy all the config files, etc. and then I can upload my own config files ... soon!

drwxrwxrwx    1 avahi    244          1260 Jan  1 00:00 bin
drwxr-xr-x   16 root     root         1520 Jan  1 00:00 dev
drwxrwxrwx    1 avahi    244           848 Jan  1 00:00 etc
lrwxrwxrwx    1 avahi    244             9 Jan  1 00:00 init -> sbin/init
drwxrwxrwx    1 avahi    244          1176 Jan  1 00:00 lib
lrwxrwxrwx    1 avahi    244            12 Jan  1 00:00 linuxrc -> /bin/busybox
drwxrwxrwx    1 avahi    244            52 Jan  1 00:00 mnt
drwxr-xr-x    1 502      501          2048 Jun  4  2013 opt
dr-xr-xr-x   43 root     root            0 Jan  1 00:00 proc
drwxrwxrwx    1 avahi    244            40 Jan  1 00:00 root
drwxrwxrwx    1 avahi    244          1048 Jan  1 00:00 sbin
drwxr-xr-x   11 root     root            0 Jan  1 00:00 sys
drwxrwxrwt    2 root     root           60 Jan  1 00:00 tmp
drwxrwxrwx    1 avahi    244            88 Jan  1 00:00 usr
drwxrwxrwx    1 avahi    244            64 Jan  1 00:00 var

 

[dashingthrusnow]

viewtopic.php?f=5&t=1538

Finished the mod for 12 Mbps video ...