Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add specification for Reolink firmware files #667

Open
wants to merge 7 commits into
base: master
Choose a base branch
from

Conversation

armijnhemel
Copy link
Collaborator

This is a spec to parse firmware files for IP cameras from the brand Reolink: https://reolink.com/

I have tested with several firmware files.

@KOLANICH
Copy link
Contributor

IMHO id shouldn't be just reolink

@KOLANICH
Copy link
Contributor

It should be clear to which data crc applies. Also the exact flavour of crc. #625 can be helpful.

@KOLANICH
Copy link
Contributor

license: GPL-3.0 is ambigious, it should be either license: GPL-3.0-only or license: GPL-3.0-or-later.

@KOLANICH
Copy link
Contributor

(64 + 76) should be sizeofs.

@armijnhemel
Copy link
Collaborator Author

(64 + 76) should be sizeofs.

How? No partition has been parsed at this point yet (and this value is needed to be able to find out where partitions start) so how can a size be computed? Maybe I am missing something obvious.

@generalmimon
Copy link
Member

@KOLANICH:

license: GPL-3.0 is ambigious

Yes. SPDX treats it (https://spdx.org/licenses/GPL-3.0.html) as a deprecated alias of GPL-3.0-only, but I guess it was deprecated exactly for the reason you mentioned.

@armijnhemel
Copy link
Collaborator Author

@KOLANICH:

license: GPL-3.0 is ambigious

Yes. SPDX treats it (https://spdx.org/licenses/GPL-3.0.html) as a deprecated alias of GPL-3.0-only, but I guess it was deprecated exactly for the reason you mentioned.

I am simply oldskool!

@generalmimon
Copy link
Member

generalmimon commented Apr 27, 2023

@armijnhemel:

No partition has been parsed at this point yet (and this value is needed to be able to find out where partitions start) so how can a size be computed? Maybe I am missing something obvious.

Probably not obvious, but sizeof operators currently work only at compile time (they always evaluate to an integer known at compile time, which is only substituted in the resulting expression).

@KOLANICH
Copy link
Contributor

How? No partition has been parsed at this point yet (and this value is needed to be able to find out where partitions start) so how can a size be computed? Maybe I am missing something obvious.

(sizeof<section> + sizeof<partition>) I guess.

@armijnhemel
Copy link
Collaborator Author

crc32

Which one?

name	id	size	polynomial	init	xor_out	reflect_in	reflect_out	check_value	applications
XFER	crc32_xfer	32	0xaf	0	0x0	0	0	0xbd0be338	XFER
POSIX	crc32_posix	32	0x4c11db7	0	0xffffffff	0	0	0x765e7680	CKSUM, POSIX
MPEG-2	crc32_mpeg_2	32	0x4c11db7	0xffffffff	0x0	0	0	0x376e6e7	MPEG-2
JAMCRC	crc32_jamcrc	32	0x4c11db7	0xffffffff	0x0	1	1	0x340bc6d9	JAMCRC
BZIP2	crc32_dect_b	32	0x4c11db7	0xffffffff	0xffffffff	0	0	0xfc891918	BZIP2, AAL5, DECT-B
	crc32	32	0x4c11db7	0xffffffff	0xffffffff	1	1	0xcbf43926	zlib, ISO-HDLC, ADCCP, V-42, XZ
Castagnoli	crc32_castagnoli	32	0x1edc6f41	0xffffffff	0xffffffff	1	1	0xe3069283	ISCSI, BASE91-C, INTERLAKEN
CD-ROM-EDC	crc32_cd_rom_edc	32	0x8001801b	0	0x0	1	1	0x6ec2edc4	CD-ROM-EDC
AIXM	crc32_aixm	32	0x814141ab	0	0x0	0	0	0x3010bf7f	AIXM
BASE91-D	crc32_base91_d	32	0xa833982b	0xffffffff	0xffffffff	1	1	0x87315576	BASE91-D
AUTOSAR	crc32_autosar	32	0xf4acfb13	0xffffffff	0xffffffff	1	1	0x1697d06a	AUTOSAR

I have absolutely no idea.

@KOLANICH
Copy link
Contributor

If you have a sample and know a range of bytes, it can be brute-forced. And there are tools for it.

@armijnhemel
Copy link
Collaborator Author

How? No partition has been parsed at this point yet (and this value is needed to be able to find out where partitions start) so how can a size be computed? Maybe I am missing something obvious.

(sizeof<section> + sizeof<partition>) I guess.

This worked.

@armijnhemel
Copy link
Collaborator Author

If you have a sample and know a range of bytes, it can be brute-forced. And there are tools for it.

https://github.com/hn/reolink-camera/blob/master/unpack-novatek-firmware.pl#L101

https://reolink.com/download-center/

Knock yourself out, I am not going to invest time into something that is not relevant to me at all.

@KOLANICH
Copy link
Contributor

According to the look-up table in the script it seems to be the ordinary variant of CRC-32.

@hn
Copy link

hn commented May 2, 2023

I have just found that pakler is a more advanced tool for working with pak files (and probably has all missing info for the file structure).

@vmallet @AT0myks

firmware/reolink.ksy Outdated Show resolved Hide resolved
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants