How to reverse engineer dash cam metadata

Question

I'm trying to write a video player for clips from Roadhawk dash cams that shows a speedometer and map. I've got the basics covered, it plays the video and sound and extracts the raw metadata from the video.

This raw metadata includes speed, GPS coordinates and G-force. My first target is a Roadhawk DC2. Roadhawk provides software for doing this already but it is closed source. http://www.roadhawk.co.uk/roadhawk-dc2-software I may be able to reverse engineer the software, or even the camera firmware, but I wanted to know if there was a better way.

The metadata is stored in a subtitle stream in the video file. I've played a one minute file through my software and dumped all the raw data out and have looked at the same file in the existing software to get the decoded values for the first frame. (It's awkward to determine more than the first frame because of the seek resolution in the existing software. This is one reason for writing my own.)

It all appears to be printable ASCII characters (presumably a constraint of the qt-text subtitle encoding system).

When looking at all of the data, I can see that in the last third of the data frames, some of the text remains mostly constant. In the last third of the video, the car is waiting at a set of lights, this could be the gforce data. This is as far as I got with my investigation.

The frame for which I know the decoding looks like this:

.+;;;D=;-;6;;;;D;JP;4;;;=D;P?;O;;;=D=L;-HO71G>F=;;;JJF:FNJNBDL=R?F3F;;=;PDLR;;F0F;;=DRFJJ?DRJF??;J=LF;;;D;F:*59~

And decodes like this:

Gforce X = +0.108
       Y = +0.036
Lat      = 53.99020
Long     = -1.10792
Speed    = 2.0mph

Full list of captured frames is here: http://bitofahack.com/stuff/capture

I don't recognise this as any particular method of encoding. It may even have some kind of compression, although I doubt that when I consider that the frames are longer than all the data simply printed as one long string.

What should I do to further my investigation?

Answer 1

Looking at the files distributed with the software, the video playing part is done via Flowplayer, embedded in these files:

assets/webthings/local_me.html
assets/webthings/local_me_OSM.html
assets/webthings/local_me_slowmo.html
assets/webthings/local_me_with_file_select.html

These functions also control updating the UI fields - apparently flowplayer provides the subtitle (caption) data via a callback. Search for a function "parse_gps_data". In the function "zgps_decode" is the actual decoding routine which is a simple one-to-one substitution.

Implementation:

#include <stdio.h>

const char *decode_table = "#I8XQWRVNZOYPUTA0B1C2SJ9K.L,M$D3E4F5G6H7";

void decode_in_place(char *s) {
    while (*s) {
        *s = decode_table[*s-43];
        s++;
    }
}

int main(void) {
    char data[] = ".+;;;D=;-;6;;;;D;JP;4;;;=D;P?;O;;;=D=L;-HO71G>F=;;;JJF:FNJNBDL=R?F3F;;=;PDLR;;F0F;;=DRFJJ?DRJF??;J=LF;;;D;F:*59~";
    decode_in_place(data);
    printf("%s", data);
    return 0;
}
// Output: X#000.1080Y0000.0360Z0001.0620G0001.1408$GPRMC,100033,A,5359.4172,N,00106.4700,W,001.7,332.73,220314,000.0,A

The same html files contain a comment on how to interpret this data:

X0000.0000Y0000.0000Z0000.0000G0000.0000$GPRMC,UTS_Position,Status,Latitude,N/S,Longitude,E/W,Speed,Course_Over,Ground,Date,Magnetic_variation,Checksum~