experimental study to extend lifespan of DxO One camera
As of July 2019, DxO One, is still awesome. But it has discontinued more than a year ago. https://www.digitaltrends.com/photography/dxo-one-discontinued/
There is an official website of open-source oriented project exist, but it seems inactive. https://openone.dxo.com/
As openone project is not serving any resources, I tried some stuff.
- DxO One (iOS connector)
- 4GB microSD card
- iFixit Jimmy ( https://ko.ifixit.com/Store/Tools/Jimmy/IF145-259 )
- Ubuntu VM
- Firmware file (DXOCARD_3.2.0.ecef5ef809.BIN, MD5 : 2e6ee13da79cc8963cacb2854281a2fb, can be extractred during firmware update process on iOS App; or ask DxO to get one)
- it seems DxO One has Ambarella A9 series SoC https://www.goprawn.com/forum/ambarella-cams/14041-dxo-one-ambarella-a9s35-sony-imx183
- GoPro Hero (=<5) series has Ambarella SoCs too, and custom scripts are available, known as autoexec.ash
- Ambarella SoC works as a two seperated parts; RTOS(ThreadX) and a Linux system to support wifi and more
- Looking for a debug pin To open this, you have to poke wide and thin blade between black and silver gaps, the enclonsure hold each other with clap-on latch. Keep spudger above silver part and below black part. I hoped I could found debug pins on PCBs, but I couldnt' find any.
- I could name IC partnames after opening up metal shield.
part | purpose |
---|---|
ADAU 1382BCPZ | audio codec? |
SPANSION ML04G200BH100 | NAND storage, guess only stores Linux system |
SAMSUNG K4P8G304E0-AGC2 | DRAM |
Ambarella A9-A1-RH S1433 N93WA-D ANM1N1 A9S35 | SoC |
- binwalk couldn't extract partitions.
- fwparster in gopro-fw-tools ( https://github.com/evilwombat/gopro-fw-tools ) seperated firmware file to 5 sections (0 - 4)
- ubi_reader ( https://github.com/jrspruitt/ubi_reader ) extracted internal Linux partiton from section_4
- Linux system has limited features, mainly to support Wi-Fi connection between smartphone and DxO One
- modifying filesystem and repack, then upload to device will allow you to connect camera, but I didn't tried.
- run 'strings' to get some clues inside firmware files worked, many potential commands and device-specfic commands in RTOS found.
- if there is a file named 'autoexec.ash' exists, RTOS tries to run this script on built-in shell (known as AmbaShell)
- as we have no screen or uart output, we have to redirect them.
- in AmbaShell, storage management is dos-like. c:\ is your SDcard root, a:\ and b:\ are where internal data stored (possibly device-specific calibration files?)
- you can write commands in autoexec.ash, but you may want to redirect output to file like this : help > c:\help.log
- it doesn't work with 't dxo something' commands; it requires different approach; write 't dxo console 8' to autoexec.ash to redirect all output to sdcard:\console_debug.txt
- By default, SSH server(dropbear) is enabled when Wi-Fi connection is running
- firmware has full linux partition, and reveals user id/pw, but password login is turned off when dropbear starts
- before running dropbear, system checks whether microSD has some folder and authorized_keys and authorized_keys.sign in it, if files are exist, tries to decode signing keys with preloaded public key, then it matches, system copies authorized_keys into /root/.ssh/, allowing ssh connection.
- getting private key from public key is not feasible(at least as of year 2019)
- flashing modified firmware may bypass this security function.
assuming you downloaded firmawre file
- format a micro SD card via your computer. You will have to downgrade the firmware of your camera via the micro SD Card. Here are the steps to install it:
- Download on your computer the downgraded firmware.
- From your computer, copy/paste the firmware to the root directory of the micro SD Card.
- Put the micro SD card inside the camera.
- Press the button on the top of the camera and let your finger rest on the button (a long press)
- Slide the lens cover to open. Let your finger rest on the button (long press) until the OLED changes to display a progression bar.