Z-Camera-E2-Reverse-Engineering

Here you can find my Z-CAM E2 firmware reverse-engineering results.

Original Firmwares

Z-CAM very often delete links to old firmware versions on the official website, so I have to make copies for you in order not to lose them forever.

Version	E2	E2C	E2-M4	E2G	E2-S6	E2-F6	E2-F8	E2-S6G
0.81	E	X	X	X	X	X	X	X
0.82 beta	E	X	X	X	X	X	X	X
0.82	E	X	X	X	X	X	X	X
0.83	DL	X	X	X	X	X	X	X
0.84	E	X	X	X	X	X	X	X
0.86	E	X	X	X	X	X	X	X
0.87	DL	X	X	X	X	X	X	X
0.88	DL	U	X	X	X	X	X	X
0.89	E	E	X	X	X	X	X	X
0.93	DL	E	X	E	E	E	E	X
0.94	DL	E	X	E	E	E	E	X
0.95	DL	E	X	E	E	E	E	X
0.96	DL	E	E	X	E	E	E	X
0.97	DL	DL	DL	DL	DL	DL	DL	X
0.97.1	DL	DL	DL	DL	DL	DL	DL	X
0.98	E	E	E	E	E	E	E	E
0.98.1	E	X	E	X	X	X	X	X
0.98.2	E	X	E	X	X	X	X	X

Legend

DL : firmware file download link

X : does not exist

E : exists, but no download link for now

U : I don't know if it exists or not

Custom firmwares

Panasonic-like recording indicator (based on Z-CAM E2 FW v0.93): https://drive.google.com/file/d/1GijjGMIjitrbCn3K4gdk3OxCYkQl__Sf

E2-M4 0.98.2 (alpha0) with old true ZRAW: https://drive.google.com/file/d/18BHAqMg6at47HqWfkrDi-7cbxiMOozbV/view?usp=sharing

AES encryption

Z-CAM use AES (128-bit) CFB encryption for main firmware data ZIP-archive (update_data.bin).

E2 firmware version	AES key (hex bytes)	AES initial vector (hex bytes)
0.83	X	X
0.87 0.88 0.93	53 7E 15 16 28 AE D2 A6 AB F7 15 88 09 CF 22 3C	00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
0.96 0.97 0.97.1 0.98 0.98.1 0.98.2	CF 55 5B B7 BF 0E 45 6E 94 10 D0 15 D7 5F E3 5B	00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

Legend

X : encryption is not used

Passwords for archives in firmware

Here are passwords that are user for each encrypted ZIP-archive (for example, recovery.zip or update_data.zip):

Version	ZIP password
0.83 0.87 0.93	gmi!!emoclew
0.94 0.95 0.96 0.97 0.97.1 0.98 0.98.1 0.98.2	1234564698742

Hardware

Model	SoC	Sensor
E2	HiSilicon Hi3559A V100	Sony IMX299
E2C	HiSilicon Hi3559A V100	Sony IMX159
E2G	HiSilicon Hi3559A V100	Sony IMX344
E2-S6	HiSilicon Hi3559A V100	Sony IMX571
E2-F6	HiSilicon Hi3559A V100	Sony IMX410
E2-F8	HiSilicon Hi3559A V100	Sony IMX455

Partitions

Partition	Description
mmcblk0p1	Boot partition
mmcblk0p2	Environment data partition
mmcblk0p3	Recovery
mmcblk0p4	nv (mounted as /tmp/nv)
mmcblk0p5	Linux Kernel
mmcblk0p6	RootFS
mmcblk0p7	pref (mounted as /tmp/data)
mmcblk0p8	data (mounted as /tmp/storage)
mmcblk0p9	hibernate (???)

How to make your own firmware?

On Linux:

Warning!

All next actions must be done in case-sensitive filesystem, that supports symbolic links!

1. Download official firmware file

You can find firmware file links on Z-CAM official web-site or on this page (watch "Original Firmwares" section above).

2. Unpack firmware file as ZIP-archive

mkdir update

unzip update.zip -d update

rm update.zip

cd update

3. Decrypt update_data.bin file to update_data.zip

Use my update_data_crypter tool to decrypt update_data.zip for your firmware version.

Example:

/<path_to_crypter>/crypter -d -v0.93 -i update_data.bin -o update_data.zip

4. Unpack update_data.zip using password you can find above

Don't forget to use escaping for special characters. For example, password gmi!!emoclew must be converted to gmi\!\!emoclew in terminal.

mkdir update_data

unzip -P <place_password_here> update_data.zip -d update_data

rm update_data.zip

cd update_data

5. Unpack RootFS

mkdir rootfs

tar -xzf rootfs.tar.gz -C rootfs

rm rootfs.tar.gz

6. Make any changes in unpacked RootFS you want

You know what to do here :)

7. Pack RootFS

cd rootfs

tar -czvf ./../rootfs.tar.gz *

cd ..

rm -rf rootfs

8. Pack update_data.zip

zip -P <place_password_here> -0 -r ../update_data.zip *

cd ..

rm -rf update_data

9. Encrypt update_data.zip file to update_data.bin

Use my update_data_crypter tool to encrypt update_data.zip for your firmware version. Important: DO NOT use old name update_data.bin because this file is needed for signature checking.

Example:

/<path_to_crypter>/crypter -e -v0.93 -i update_data.zip -o update_data_new.bin

rm update_data.zip

10. Patch install_binary executable file to bypass signature checking

A bit complicated to explain here.

11. Recalculate MD5 for all files, listed in md5.txt

md5sum version.txt update_data.bin install_binary update.script > md5.txt

12. Pack firmware to normal deflate-compressed ZIP

zip -r ../update.zip *

cd ..

rm -rf update

Ready! Now you can flash your firmware to your camera and test it!

Camera bootup process

U-Boot

U-Boot is started from eMMC memory (partition 1). At this moment splash screen is shown on E2 screen (Z-CAM logo).

If power and record buttons are pressed - recovery OS starts.

Otherwise - main Linux Kernel starts.

Recovery

This contains own Linux Kernel and LZO-compressed filesystem.