As the USB access did not work as intended, I got a little bit frustrated and started to poke around on the K2 to see if I can find something interesting. And well...I did :-)
First of all...you can access the K2 with your browser. Simply connect your laptop, tablet, phone or what else to your K2 and go to:
This will give you access to your sd card.
Another URL I found is:
This will give you access to the live view
Looks like this
Well...this is nice, but I wanted at least the same access the App has, so I poked more. Which means I captured the network traffic between the App and the K2 to see what the App is doing. Sadly the App isn't very stable, so I had to start over the whole process every some seconds, causing me only to get some of the commands the App sends to the K2.
But, on the positive side, now as I knew some commands, I was able to simply ask Google if there is something about that in the net. And yes...I found the complete wifi-command user guide for the Novatek NT9666x. Sometimes things are easy :-)
So what is possible with these commands?
First of all, you can do the same as the App does. Means switching GPS on/off, settings G-Sensor sensitivity, select resolution, etc. But there are some more interesting things.
Set time and date
Something the App does automatically. Now you can do it manually.
Delete all files
Allows you to delete all files. No more need to format the card to remove all files.
Change PIP style
Allows you to change the style of the live view (front only, rear, only, front major, rear major)
Helps a little bit when aligning the cameras.
Change bitrate
Allows you to change the bitrate of the front cam. Rear cam seems to keep its default bitrate.
Change Wifi-Connection mode
Allows you to set the K2 in station mode to connect to your home wlan.
And yes...that works, but transfer speed is still awfull. Your wlan password must not contain special characters. At least the = character is not allowed.
Here is a screenshot of my K2 in my home wlan.
When the K2 is in your home wlan, the App isn't working anymore, as the K2 does not offer a wlan anymore. Changing wifi mode takes three commands (set ssid and password / set wifi mode / start wifi-reconnect)
How is it done?
The commands must be send as an URL to the K2. The syntax is...
http://192.168.1.254/?custom=1&cmd=xxx&par=yyy
xxx = the function you would like to active or change
yyy = the value you would like to set
(see Wifi Command guide)
For exampe:
http://192.168.1.254/?custom=1&cmd=2001&par=0
will stop recording. While..
http://192.168.1.254/?custom=1&cmd=2001&par=1
..will start recording
http://192.168.1.254/?custom=1&cmd=4004
will delete all files (there is no "par" here)
You will find the Novatek Wifi-Command List in my Dropbox share
https://www.dropbox.com/sh/o3xnk8u4alospta/AAAX67-ELsL6KDDt92-F1SQTa?dl=0
All settings commands are instantly effective, but will only be saved when the K2 shuts down properly. Means you can play around without the worry to mess something up. For example, if you change the wlan mode and it is not working, you can simply cut of power to the K2 to revert back to the old settings.
To go more into details, here is what to enter into your browser to change some settings.
All settings are only saved when the K2 shuts down properly. So if you just cut off power, nothing is saved. Means there is always a way back if you messed something up.
Change PIP style of live view
http://192.168.1.254/?custom=1&cmd=3028&par=0 => Front Cam only
http://192.168.1.254/?custom=1&cmd=3028&par=1 => Rear Cam only
http://192.168.1.254/?custom=1&cmd=3028&par=2 => Fron Cam major, Rear cam small (default)
http://192.168.1.254/?custom=1&cmd=3028&par=3 => Rear Cam major, Front cam small
Change bitrate of front cam
http://192.168.1.254/?custom1&cmd=2013&str=1450 => sets bitrate to 12 MBit (default)
http://192.168.1.254/?custom1&cmd=2013&str=2450 => sets bitrate to 20 MBit
The value for "str" is kb/sec.
Let K2 join your home wlan
This needs three steps.
1) Set Name and Password of your home wlan
http://192.168.1.254/?custom1&cmd=3032&str=SSID:password
SSID = The Name of your wlan.
password = The Password of your wlan.
So if your wlan is named "MyHomeWLAN" and its password is "verysecretpassword123",
you have to type...
http://192.168.1.254/?custom1&cmd=3032&str=MyHomeWLAN:verysecretpassword123
As these parameters are send as an URL, the name and password must not contain special characters. Something like =, % or &. And I guess that the name is case sensitive.
2) Change Wifi mode to station mode
Next step is changing the Wifi mode of the K2 from AP mode (where the K2 acts as an AccessPoint) to station mode (where the K2 acts as a wifi client).
http://192.168.1.254/?custom1&cmd=3033&par=1 => 0 = AP mode (default) / 1 = station mode
3) Restart Wifi
Last step is to restart Wifi on the K2.
http://192.168.1.254/?custom1&cmd=3018
Now the K2 will try to join your home wlan. You should take a look at your home router the check what IP address it got.
If it does not work, cut off power to the K2 to make it revert back to AP mode.
Dont let it shutdown properly in that case, as this would make the K2 to save the (non functional) settings and you won't be able to access the K2 anymore.
Query current settings
http://192.168.1.254/?custom=1&cmd=3014
This will give you a list of all settings, which looks like this
<Cmd>2001</Cmd> => Function 2001 means "Recording"
<Status>1</Status> => Current value is 1, which means ON.
<Cmd>2011</Cmd> => Function 2011 means "G-sensor sensitivity"
<Status>2</Status> => Current value is 2, which means "medium"
Take a look in the Novatek wifi command guide for more info.
More features I still have to check are:
- Enable movie HDR/WDR Per default it is disabled.
- Movie EV Haven't figured out yet what this setting is good for.
- Notify Status. This makes the K2 report error messages on port 3333. Still have to check this.
- Check whether stopping recording and live view will speed up video download or not
Wow - awesome find, Frostie! Thanks for passing this along!!
Great work!
N.
Next Update
- Enable movie HDR/WDR (cmd=2004) Per default it is disabled.
This feature does not seem to work. When setting it to 1 (on), the value is not saved.
That's a pity. WDR would be an improvement when facing direct sunlight or at night.
- Movie EV (cmd=2005)
These are the brightness settings. Parameters are:
0 => +2
1 => +5/3
2 => +4/3
3 => +1
4 => +2/3
5 => +1/3
6 => 0 (default)
7 => -1/3
etc.
- Notify Status.
The K2 sends status reports on port 3333. Simply telnet to port 3333. If you, for example, stop recording (cmd=2001&par=0), in will report status 2, which means "Record is stop" (see Wifi command guide)
- Check whether stopping recording and live view will speed up video download or not
Stopping recording and live view speeds up data transfer on wifi a little bit. But I was not able to get above 2,3 MB/sec.
There are still some commands for which I haven't figured out what they are good for.
2022 with value 8000
8003
8004
etc.
I will keep testing.
Now we need a clever person to build a desktop app around these commands :)
N.
That´s not my business. I am not a developer. :-)
My Intention for this is/was to find a way to make usb access work without the need to unplug a cam, because I am still convinced that this is not a power-, but a firmware issue. But I am afraid that I cannot analyse (and maybe solve) this problem without shell access to the K2. Well..this isn´t impossible, but it requires to solder some cables at the DSP. Abd that is something I would only do on a spare K2, :-)
Maybe Rock would like to send me one :-)
I think sending you a development K2 would be a good reward for the value you have added here on the forums!
N.
@Neil Maltby Wow, that’s for sure!
For sure, We will send you a set of K2.
Just sent you email asking for shipping address.
Ok. Sounds like the K2 does not save the wifi settings. Or at least the wifi mode settings.
The problem that would arise with a firmware that is fixed on station mode is, that there would be no way for you to enter your ssid and password. Means I would have to make an individual firmware for you with your ssid and password.
Let me see if I can find the necessary values within the firmware.
Great :-) Currently testing my alpha version of the software:
Today the spare K2, Rock kindly provided to me, has arrived and I started to play around with it.
At first I did a list of all wifi commands the App uses to configure the K2.
I will also make a list of hidden commands and will test whether they get saved or not. Unfortunately some don't get saved during shutdown (e.g brightness).
The next thing was to test what @Flemming Nielsen wrote about joining the home wlan.
Unfortunately he is absolutely right. The K2 joins the home wlan, but after a reboot all values (ssid, password, wifi mode) resets to the default values. I guess that the save command does not simply save all settings to flash, but only what the developer of the firmware selected. Maybe that's why the command is called "save menu items" and not "save settings".
I will dig a little bit more about that. In the firmware I found some references to config files which (I guess) can be placed on the sd card to configure some things.
@Frostie Awesome :-) Keep up the good work A config-file for wifi settings would be awesome. Otherwise i could extend my program to - Join the K2 wifi - Set wifi settings - Join regular wifi - scan for K2 device
and then download files.
But i foresee that it would be hard to get those extra steps 100% stabile. Especially if i have to make them work across multiple version of windows..
Next Part.
First the hidden features. Unfortunately most of them are quite useless, as they will not be saved by the save command or during shutdown.
Now the control commands. Maybe interesting for developers :-)
I also found some commands which are accepted by the K2, but does not work. These are:
TV Format (always stays at PAL)
HDR (always disabled)
Auto Recording (can be set and saved, but gets ignored)
There are still some commands where I don't know what they are good for. So the work isn't done yet.
Of course I also took a screwdriver to take a look inside the K2. This is what it looks like.
I am quite sure I already found the UART pads, where (I hope) I can get shell access to the K2. But as they are too small for my soldering tip, I first need to get a special tool (or another soldering tip)
This is huge, thank you so much for digging into this. I've had an idea for auto-downloading videos from my K2 when I park my bike. Here's my plan:
* Get a RaspberryPi
* Hook it up to my home LAN via ethernet
* Have it auto-connect to the wifi network created by the K2
* Download all new videos from the DVR
* Upload those video files to the NAS on my LAN
I had the same idea, but I want to connect the Raspi via USB to the K2. Using wifi would be much easier, but the wifi of the K2 is bloddy slow. Even when stopping recording and live view,
I can't get more than 2,8 MB/sec. And it does not matter whether I use my iPhone/Raspi or let the K2 join my home wlan. The transfer rate is always devastating and far too low for transfering more than one short clip.
So the idea was to use USB Auto-Mount on the Raspi to make him mount the K2 automatically. After that, I could access the mounted K2 via FTP, SCP or whatever protocol I prefer. But unfortunately USB access is a little bit buggy at the moment (see other Thread).
Yes, the wifi connection is slow, but USB connection is a non-starter for me as the DVR is mounted underneath my seat, which I have no easy access to. Even if I had easy access to the DVR, I think I would take the convenience of a wireless connection over the speed of USB. I'm not really in a huge hurry to transfer the videos since I can have it run while my bike is charging (it's electric).
Ooh nice one on the electric bike... how are you finding it.
@Neil Maltby Love it. Zero SR. It's a little bit awkward since I don't have direct access to the a battery for things like the K2, so I have to rely on switched accessory power only.
Today I tested the two pads on the K2, which I supposed are the UART pads. And I was right.
Left Pad is RX, Right Pad is TX. GND can easily be found at the USB housing.
Soldering the cables on the pads really is no fun. There is absolutely no space for mistakes. That's the reason I did not want to try this at my K2. Thanks again to Rock for sending me a spare K2 to do all these tests.
Using an USB UART you can get shell access to the K2. Connect parameters are 115200, 8N1.
Looks like this...
Now I have to poke around to figure out what the commands do, how I can change settings and how I can dump the memory to find out where these settings are located in the firmware file.
I am thinking of creating a firmware which defaults to station mode and joins the home wlan instead of creating one itself.
Wow.... great work!
You're the man!
Just as an update to @phinnaeus
I am working on a firmware which defaults to join the home wlan instead of creating an AP.
I already found the ssid and password within the firmware and successfully changed these values. One point I still have to fiddle about is, that there is some code which always appends the last four digits of the serial number to the ssid in AP mode. So currently when my K2 starts up, it creates a wlan called "K2-Test026a". Switching to Station Mode, the K2 joins my "K2-Test" wlan.
Currently I am searching for the Wifi Mode settings. I already discovered the value within the memory by comparing different memory dumps, but to my dissapointment it is a simple 00 and 01.
00000000 = AP Mode
00000001 = Station Mode
Now I have to find these value within the firmware to change them, which will not be easy, because there is no special pattern I can search in the firmware. 00000000 is VERY common within the firmware, so I have to spot around the wifi settings within the firmware if I can find a suspicious area. At the end this will be a lot of try-and-error.
Regarding me efforts to make the K2 startup Wifi in STA mode, I am at a dead point. Though I located the bytes responsible for the wifi mode within the memory, it is impossible for me to locate this byte within the firmware. So I have asked in another forum for help, as there are pepple with much more experience in programming than I have. I also asked Rock if he would be willing to send me the source files of the firmware. I am not sure I this files would help me, as I have no experience in programming this kind of devices, but I would like to give it a try.
I am very interesting in your great work. Now talking with Novatek the authorization for source code.
I am anxious what they will reply. I can imagine that they need some kind of declaration of commitment before giving the source code and the necessary libraries to anyone on the internet :-)
- Added new Wifi Timer parameter in Command List
It had been a long time since I poked around in the firmware, due to a surgery and a lot of work because of Covid-19. But now I´ve started a new attempt.
I switched over to a new tool (GHidra), to analyze the firmware and find the data fields I am looking for.
As a first try and warm-up, I searched (and have found) the volume settings. But to my disappointment, increasing the volume does not really has an effect on the audio volume of the videos. Seems that the K2 is already recording at the maximum volume.
Then I switched over to my last effort regarding the Wifi Mode. I still want the K2 to directly boot up in STA (Station) mode, where it connects to my home Wifi, instead of the AP (AccessPoint) Mode, where it offers its own INNOVV_K2_xxxx wifi.
Till now I achieved a partial success. I was able finding the function which is responsible for the Wifi Mode and changing it in a way that STA and AP Mode switches sites. So Mode 0 (the default AP Mode) now is the STA Mode, while Mode 1 (STA) now is the AP Mode. Means the K2 boots up in STA Mode. But this way is not elegant, so I will continue my search for the data field.
Just a short update.
I tested my patched firmware and it reliably connects to my home wifi. But as the way I patched it isn't very elegant, it cannot switch back to AP mode anymore. To be more precise: It switches to AP mode, but will not let any device connect to it, as some functions are still running in STA mode. That's why I still tracing the functions back to the wifi settings.
If anybody is interested... this is what the function responsible for the wifi mode looks like.
The red box marks the if-then clause for the wifi mode. If Wifi Mode is 0 (AP) go this way, otherwise go that way. Now I have to trace the value back thru the caller functions.
Finally, I was able to track down the Wifi Mode setting within the firmware.
For unknown reasons, they do not use a data field for this, like they do for e.g the volume. Instead, they hardcoded it in a function, together with many other values.
Here is the function and the command, which sets the wifi mode to 0 (AP mode).
It simply writes "zero" to an address in RAM. Later, when the wifi function starts, it will read this address to start wifi in the correct mode.
This is from the V70, but I also checked the V67 and V64 firmwares, and the value is all the same.
So now I make the K2 to start up in STA mode instead of AP mode and connect to my home wifi (or any other) by default.
Now to the negative side.
I already verified this in the original firmware and I don't know if it is a bug or not.
If you switch the K2 from AP mode to STA mode (e.g. the http commands I mentioned earlier) and then back to AP mode, no device can connect. In the console of the K2 I see the error "A STA is rejected by 802.1x daemon".
As my modified firmware would always start in STA mode and the AP mode is necessary for the App to connect to the K2, I would not be able use the App anymore to configure the K2. Well....you can't have everything.
Next step will be to identify all the other values in this function to see, which default values I can change there.