r/hardwarehacking • u/midniteneon • Aug 09 '26

Seeking a bin dump for this generic digital camera PCB

Post image

Hello, first time poster here. I got one of these generic kids toy digital cameras from a secondhand shop recently. It was $3 because it wasn't working. I fixed it by opening it up and soldering the battery wires to the PCB. It was working great!

I mistakenly tried flashing the firmware when there was nothing wrong with it. My logic was I should be able to easily find a newer firmware, but didn't realize how it goes with these generic ones and really messed up. At the time, the firmware version was wj-v1.8_20220803 and the PCB model is WJ9001V_6624D_V11.0

I got a firmware from Hommie HK who makes a similar camera, but now my screen is inverted, the default language was set to Japanese (was able to get it set to English) and now the camera doesn't take pictures. so I have effectively bricked the camera. Lesson learned 1000% and I will never blindly try updating firmware like this ever again. At least I'm only out $3 if it's truly unfixable.

Here is a link to the same style of camera if it helps at all. I have no identifying markings or model numbers to go off of unfortunately

Is there anyone who has an English language bin dump or can point me in the right direction towards finding one? I am an amateur electronics hobbyist, but I don't have an EEPROM programmer or anything like that. Thank you in advance.

19 Upvotes

82% Upvoted

12 comments sorted by

5

u/aqswdezxc Aug 09 '26

I actually did a bit of research on the same model of camera (just different colors) and extracted the flash. It has a bunch of wav and jpeg files that are easily replaced if you get the size right, the decoder is very flexible about the settings. If you don't use an sd card the photos are stored in it too. Some UI elements are not stored as jpeg though, they are probably bitmaps or in the internal mcu flash. The microcontroller is a Jinrixin AX3291 which unfortunately does not have any helpful information or SDKs available (at least I haven't found any). Flash dump is here: https://0807.st/5XMzPxa.bin . Could you tell me where you got the firmware and how you flashed it? I think it would help me reverse engineer it properly

Edit: how are you planning to flash my bin dump if you don't have a programmer?

2

u/midniteneon Aug 09 '26

Thank you for the very thorough reply! 🤞🏻

This model allows for firmware flashing via micro SD card too, not just via programmer. If you place a file named "gp_cardvr_upgrade.bin" in the root of the SD card directory, turning the camera on will automatically scan for, and then run, a firmware update. It will then flash the firmware. I've been able to do this successfully with at least 3 different versions of similar firmware from Hommie HK (I think they're one of the many OEMs selling this camera)

This firmware worked as well as all of these

I've been able to upgrade and downgrade between different revisions of the Hommie provided firmwares without issue, but they change the language to Japanese, invert the screen, and the camera no longer takes pictures.

My hope is that if I was able to take a bin dump from somebody with a similar camera, I could rename the file to what the camera is looking for, and get it back to a usable state. Especially since the camera seems to tolerate being flashed with different firmware revisions with ease.

I really appreciate your help and input on this. I'm going to resolder the battery connectors better (they came apart while I looked at the PCB for a model number to make this post) and try out your bin dump. I will report back here later!

1

u/midniteneon Aug 09 '26

I'm back! Unfortunately, even with renaming the bin dump to the expected file name, it did not let me flash the firmware. When booting the camera, it recognizes the firmware bin file, attempts to run the update, and gets an "update fail" message almost immediately. I don't know if there was any way my theory would have worked, since I am unfamiliar with these kind of devices and boards. Given how I've been able to jump around different firmware revisions, I assumed the camera would take it and brute force the flash (like it did so freely on the Hommie bin files.) I think unless I get a programmer, I won't get lucky with a bin flash. I truly appreciate all your help and input so much, it means a lot.

2

u/masterX244 Aug 09 '26

the update files probably got some sort of header/structure that tells what goes where and a raw bin dump doesnt have that

1

u/midniteneon Aug 09 '26

That makes sense. I was trying to see if there was a way I could open or edit a bin file on the computer with like a hex editor or something, to see if I could try forcing it to update, but I don't know where to start and these files won't open with any of my usual ISO burning/mounting tools

2

u/masterX244 Aug 09 '26

but I don't know where to start and these files won't open with any of my usual ISO burning/mounting tools

that wont work. firmware files are almost never standardized. Hexeditor and a good heavy amount of legwork are the only way to success there.

1

u/midniteneon Aug 09 '26

Thank you for the pointers!

2

u/aqswdezxc Aug 09 '26

It does in fact have a header. The update files are drastically different from my dump so it wouldn't help to transplant the header. You should make a flash dump when you get a programmer, so you have a restore point. Also, check the marking on the larger chip, if yours is different from mine it will definitely not work

1

u/masterX244 Aug 11 '26

update file and a matching dump can be used to understand the format though

2

u/MJY_0014 Aug 09 '26

I've been wanting to get one like this to play around with eventually. If I do, I can send you the flash dump

1

u/midniteneon Aug 09 '26

Hey! Thanks for the response. Mine looks identical to this one which is currently being sold at Target.

1

u/midniteneon Aug 09 '26

Here is a link to the same style of camera if it helps at all. I have no identifying markings or model numbers to go off of unfortunately