This Repo has logs, utilities, and legally extracted assests for various GoPro Cameras. Older camera's assets are in their own unique repos within Hypoxic's Github.
GoPro HERO13 Teardown
GoPro HERO12 Teardown
GoPro HERO11 Teardown
GoPro HERO10 Teardown
GoPro HERO9 Teardown
GoPro HERO MAX Physical Teardown
GoPro HERO8 Teardown
GoPro HERO7 Silver & White Research
GoPro HERO7 Teardown | HERO7 Repo
GoPro HERO6 Teardown
GoPro HERO (2018 Research)
GoPro HERO5 Physical Teardown | HERO5 Repo
Socionext GP2 Research
Socionext GP1 / SC2000a Research
Micronesia (Security Enclave) Research
GoPro Media Mod Teardown
Anti Cloning Technology on the GoPro HEROBUS(tm) 2.0
GoPro HEROBus(tm) Research
GoPro HERO[5-9] Interfaces
Please create a pull request if you have any changes or additions
| Camera | Model # | Code Name | Camera | FCC ID | Processor | Sensor | Wifi/BT | Notes |
|---|---|---|---|---|---|---|---|---|
| ???? | 67 | Stones | Might be transcoder | |||||
| HERO (2024) | 66 | Fraction | H24.03 | AMFR1 | Ambarella H22 | Sony IMX688? | BCM43456 | Chicony Whitelabelled |
| HERO13 Black | 65 | Shipstern | H24.01 | CPSS1 | Socionext GP2 | Sony IMX677L | BCM4381 | |
| Max2 | 64 | Pebbles | CPPB1 | Socionext GP2 | Sony IMX677L | |||
| HERO12 Black | 62 | Red Bluff | H23.01 | SPBL1 | Socionext GP2 | Sony IMX677L | QCA9377 | |
| HERO11 Mini | 60 | Pismo | H22.03 | CPPM1 | Socionext GP2 | Sony IMX677L | QCA9377 | |
| HERO11 Black | 58 | Sultans | H22.01 | SPBL1 | Socionext GP2 | Sony IMX677L | QCA9377 | |
| HERO10 Black | 57 | Kongs | H21.01 | SPBL1 | Socionext GP2 | Sony IMX677 | QCA9377 | |
| HERO9 Black | 55 | Boilers | HD9.01 | SPBL1 | Socionext GP1 | Sony IMX677 | QCA9377 | |
| Max | 51 | Coconuts | H19.03 | SPCC1 | Socionext GP1 | Sony IMX577 | QCA9377 | |
| HERO8 | 50 | JBay | HD8.01 | SPJB1 | Socionext GP1 | Sony IMX277 | QCA9377 | |
| HERO (2018) | 34 | Smoky | H18.01 | ASST1 | Ambarella A9SE7 | Sony IMX117 | QCA9377 | |
| HERO7 Silver | 33 | Badger | H18.03 | SPTM1 | Qualcomm APQ8053-Pro | Sony IMX458 | ||
| HERO7 White | 32 | Boomer | H18.02 | SPTM1 | Qualcomm APQ8053-Lite | Sony IMX458 | ||
| HERO7 | 30 | Tavarua | HD7.01 | SPCH1 | Socionext GP1 | Sony IMX277 | QCA9377 | |
| HERO6 | 24 | Chopes | HD6.01 | SPCH1 | Socionext GP1 | Sony IMX277 | QCA9377 | |
| Fusion | 22 | Superbank | FS1.04 | SBDC1 | Ambarella A9SE7 | QCA9377 | ||
| HERO5 Session | 21 | Margaret River | HD5.03 | HWMR1 | Ambarella A9SE7 | Sony IMX117 | QCA9377 | |
| HERO5 | 19 | Streaky | HD5.02 | ASST1 | Ambarella A9SE7 | Sony IMX117 | QCA9377 | |
| HERO+ | 17 | Himalayas | HD3.22 | HWHM1 | ||||
| HERO4 Session | 16 | Rocky Point | HX1.01 | HWRP1 | Ambarella A7 | Sony IMX117 | QCA6134X | |
| HERO+ LCD | 15 | Haleiwa | HD3.21 | HWHM1 | ||||
| HERO | 14 | Bolina | HD3.20 | XXXXX | ||||
| HERO4 Black | 13 | Pipe | HD4.02 | XXXXX | Ambarella A9 | Sony IMX117 | QCA6134X | |
| HERO4 Silver | 12 | Backdoor | HD4.01 | XXXXX | Ambarella A9 | Sony IMX117 | QCA6134X | |
| HERO3+ Black | 11 | Bawa | HD3.11 | XXXXX | Ambarella A7 | Sony IMX117 | ||
| HERO3+ Silver | 10 | Uluwatu | HD3.10 | XXXXX | Ambarella A7 | |||
| HERO3 Black | 4 | Todos | HD3.03 | XXXXX | Ambarella A7 | Sony IMX117 | ||
| HERO3 Silver | 3 | Blacks | HD3.02 | XXXXX | Ambarella A5S | MY9F002 | ||
| HERO3 White | 2 | Shores | HD3.01 | XXXXX | Ambarella A5S | MT9P001 | ||
| HERO2 | 1 | NONE | HD2.01 | XXXXX | Ambarella A5S | MY9F002 | ||
| HERO | Ambarella A2S | MT9P006I12STC |
Various tools to extract data from the firmware images.
GoPro HERO 10 and up.
Tools and scripts for GP2 based cameras
Works with GoPro HERO[6-9]
- unpackh6 - Breaks up the firmware into it's various binary blobs
- binldr.py - IDA loader for RTOS straight from update file
- busybox - Compiled busybox with all the components such as telnetd
- decompress.py - used to decompress Embedded Wizard content
- extract_read8.bin.py - Extracts the various binaries from a read image. Useful for research with variables in memory.
- extracth8dtb.py - Extracts the Device tree from the image. Requires FdtBlobParse & glob
- extract8rom.py - Extracts the rom files from the HERO8/MAX image
- extractXromfs.py - Extracts the rom files from the HEROX image. Note, it's not precise as the memory size is now in code. A warning is given when the memory bounds do not match.
- extracthbmpd - Extracts the display's bitmaps from front and back
- gp1dropper - rewrites memory in the rtos from linux for code execution in the the rtos
- memdump_h8 - linux based utility to read all of the RTOS memory space and dump it to a file. Useful for research with global data initialized.
- readldr.py - IDA loader for a read in binary. Use memdump_h8 within linux os, then use this loader on resulting binary.
- replace_rom_file.py - Replaces a rom file with an external rom file and recalculates the crcs. Must be the same size. Replace the original files with the resulting files
- replace_section_file - Replaces an extracted section with the one passed. Usefull for patching linux to add your own hook.
- gp1info - A tool which loads a binary from Linux into RTOS memory space and then overwrites a test command. Allows me to run my own code in the RTOS. The complimentary RTOS code allows me to run MCR's to get information on the Socionext GP1 processor. It also has some calls to inspect the eMMC prior to phyiscally removing the device.
Various public dumps, logs, and musings from our research on these various cameras.
GoPro HERO 11
GoPro HERO 10
GoPro HERO 9
GoPro MAX
GoPro HERO 8
GoPro HERO 7
GoPro HERO 5
GoPro HERO 4 Session