From brief analysis of the file it looks that the Insta360 One
camera is based on or variant of the Ambarella A9 SoC. So lets assume for the moment that we are dealing with Ambarella camera itself and its firmware as it's pretty hard IMO to develop your own HD camera HW and SW stack from scratch. There are some substantial evidence for that if one check strings in the firmware file:
/home/users/vincent/Insta360_ONE/insta360_one_u05/ambalink_sdk_3_10/output.oem/a12_ambalink/build/dbus-1.8.16/dbus/.libs
AmbarellaInc A9 Platform
Some further googling revealed that this SoC is also used in other products, among which is DJI Mavic drone. Following that lead, the following repo popped up with the tools that could be of help with your research: dji-firmware-tools
Before going further into file extraction, some words about the bin file itself. It is divided into several parts because I think of how the camera SoC loads things into RAM. Some parts are actually ELF files (part 00) and others are UBIFS partitions which you can inspect with the help of ubi_reader. So moving on to examples.
By using amba_fwpak.py
, amba_romfs.py
, arm_bin2elf.py
it was possible to:
slice firmware into parts
/ubidump/dji-firmware-tools # ./amba_fwpak.py -s -vv -m /Research/Insta360FW.bin
/Research/Insta360FW.bin: Opening for search
/Research/Insta360FW.bin: Extracting entry 0, pos 252, len 6919456 bytes
/Research/Insta360FW.bin: Entry 0 checksum B77204FE
/Research/Insta360FW.bin: Extracting entry 1, pos 6919964, len 5079040 bytes
/Research/Insta360FW.bin: Entry 1 checksum F1EC7657
/Research/Insta360FW.bin: Extracting entry 2, pos 11999260, len 7266304 bytes
/Research/Insta360FW.bin: Entry 2 checksum F525FC58
/Research/Insta360FW.bin: Extracting entry 3, pos 19265820, len 6002936 bytes
/Research/Insta360FW.bin: Entry 3 checksum 13FB09E6
/Research/Insta360FW.bin: Extracting entry 4, pos 25269012, len 12976128 bytes
/Research/Insta360FW.bin: Entry 4 checksum 03A65A19
extract binaries - it's from one file, others have much more:
/ubidump/dji-firmware-tools/file # ../amba_romfs.py -vv -s -p /Research/insta/Insta360FW_part_01.a9s
/Research/insta/Insta360FW_part_01.a9s: Opening for search
/Research/insta/Insta360FW_part_01.a9s: Extracting entry 0: orccode.bin, 4376293 bytes
/Research/insta/Insta360FW_part_01.a9s: Extracting entry 1: orcme.bin, 432320 bytes
/Research/insta/Insta360FW_part_01.a9s: Extracting entry 2: default_binary.bin, 262144 bytes
converts one of the parts into a ELF file for static research - the base address comes from Insta360FW_part_00.a9h file:
/ubidump/dji-firmware-tools # ./amba_sys2elf.py -vv -e -l 0xA0001000 -p /Research/insta/Insta360FW_part_00.a9s
/Research/insta/Insta360FW_part_00.a9s: Opening for conversion to ELF
/Research/insta/Insta360FW_part_00.a9s: Opening /Research/insta/Insta360FW_part_00.a9h
/Research/insta/Insta360FW_part_00.a9s: Memory base address set to 0xa0001000
/Research/insta/Insta360FW_part_00.a9s: Searching for sections
/Research/insta/Insta360FW_part_00.a9s: Matching '.ARM.exidx' section at 0x0054af80: 1 exception entries
/Research/insta/Insta360FW_part_00.a9s: Set '.ARM.exidx' section at file pos 0x0054af80, size 0x00000008
/Research/insta/Insta360FW_part_00.a9s: Set '.text' section at file pos 0x00000000, size 0x0054af80
/Research/insta/Insta360FW_part_00.a9s: Set '.data' section at file pos 0x0054af88, size 0x0014e598
/Research/insta/Insta360FW_part_00.a9s: Set '.bss' section at file pos 0x00699520, size 0x9f967ae0
/Research/insta/Insta360FW_part_00.a9s: ELF template 'amba_sys2elf_template.elf' copied to 'Insta360FW_part_00.elf', 5140 bytes
/Research/insta/Insta360FW_part_00.a9s: Section '.text' memory address set to 0xa0001000, alignment 0x40
/Research/insta/Insta360FW_part_00.a9s: Section '.ARM.exidx' memory address set to 0xa054bf80, alignment 0x40
/Research/insta/Insta360FW_part_00.a9s: Section '.data' memory address set to 0xa054bf88, alignment 0x08
/Research/insta/Insta360FW_part_00.a9s: Section '.bss' memory address set to 0xa069a520, alignment 0x20
/Research/insta/Insta360FW_part_00.a9s: Updating entry point and section headers
/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.text' from binary pos 0x00000000
/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.ARM.exidx' from binary pos 0x0054af80
/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.data' from binary pos 0x0054af88
/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.bss' from binary pos 0x00699520
/Research/insta/Insta360FW_part_00.a9s: Writing changes to 'Insta360FW_part_00.elf'
And UBI partition looks similar to the following:
/ubidump # ubireader_display_info /Research/insta/Insta360FW_part_04.a9s
UBI File
---------------------
Min I/O: 2048
LEB Size: 126976
PEB Size: 131072
Total Block Count: 99
Data Block Count: 97
Layout Block Count: 2
Internal Volume Block Count: 0
Unknown Block Count: 0
First UBI PEB Number: 0
Image: 891379931
---------------------
Image Sequence Num: 891379931
Volume Name:linux
PEB Range: 0 - 98
Volume: linux
---------------------
Vol ID: 0
Name: linux
Block Count: 97
Volume Record
---------------------
alignment: 1
crc: '0xeae44dff'
data_pad: 0
errors: ''
flags: 0
name: u'linux'
name_len: 5
padding: u'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
rec_index: 0
reserved_pebs: 389
upd_marker: 0
vol_type: 'dynamic'
So I think this should be enough for you to get started.
Good luck and have fun!
strings
command and abinwalk
signature scan reveal a tremendous amount of information. If you can locate the firmware image entry point you can disassemble the code in the firmware. – julian♦ Jul 8 '18 at 15:18