Latest GoPro HERO is actually a GoPro HERO5

We purchased a GoPro HERO (2018) the other day and after some cursory inspection we realized this camera is actually a GoPro HERO5 with the firmware crippled. To confirm our hypothesis, we decided to trick the camera to loading the GoPro HERO5 software. It loaded properly and all the features were unlocked. Even GPS and 4K at 30fps work great!

Some people were worried that we're overclocking the parts. After inspecting the device tree, we can confirm the processors and DSPs between the two products are set to the same clock rate. 

If you look at their FCC ID (CNFASST1) for this camera, it's the same as the GoPro HERO5. So either they are in clear violation of this report, or the GoPro HERO (2018) is in fact a GoPro HERO5. I've found it's the latter, there is no difference between a GoPro HERO and a GoPro HERO5 hardware-wise. 

None the less, this patch easily done with only a few tweaks of the GoPro HERO5 firmware. 

Why did GoPro do this?

We can surmise that GoPro created this cheaper version of the GoPro HERO5 to reduce component inventory without having to pay pricing reimbursements to their dealers. With very little firmware changes, and a two resistor Bill of Material change, they came up with a very sneaky way to reduce inventory before the launch of the GoPro HERO6+ / GoPro HERO7 Black / GoPro HERO7 White. 

Samples

version.txt contents

"info version":"2.0",
"firmware version":"HD5.02.02.60.00", <-- GoPro HERO5 Firmware 
"wifi mac":"0441697a5a0a",
"camera type":"HERO5 Black",
"camera serial number":"C3321324556376" <-- GoPro HERO 2018 serial (C33)

More Tidbits

• GPS works and since same FCC report, assume the antenna is populated
• Connectivity to my iphone works.
• Accessories work

How do I get this?

Legally we can not send you this patch so please don't ask. We could possibly produce a patching utility, but we've determined the legal risk makes it not worth it. Please use this information at your own risk, we are not liable if you brick a camera.

Technical Details

There are many ways to skin this cat, but for the quick test we took the GoPro HERO5 firmware (v2.60) "camera_firmware.bin" and...

1. Instead of compatible id "18" GoPro HERO5 Silver we changed this to "34" GoPro 2018 so that the camera would accept the HERO5 black software software. This is offset 8 of the firmware. 
2. We merged in the Smoky MP SDT with target, id of 0x2a06. This is the check the loader will do do make sure this firmware is supported. It will then program this device tree into NAND. You can extract the Smoky SDT from section 0 of the HERO 2018 update. The SDT section really just needs Smoky MP and Streaky MP SDT sections. Read up on device tree tables and note each section starts with 0xD00DFEED.
3. In hal_target_is_a9se_init and hal_info_init functions we hard coded the sdt reads to return 0x2f39 - GoPro HERO5 Black Streaky MP
4. We hard coded the GoPro HERO 2018 firmware id (0x22) so you can revert back to the original software. 
5. Finally we recalculate the crc's for section0 and section 3 and the whole firmware.
6. We changed 'hd5_update.txt' to CAMLOAD:0 so it wouldn't update the firmware loader. We made a copy to "fwupdate.txt" and then let it rip.
   Resulting fwupdate.txt & hd5_update.txt will look like:
   CAMLOAD:0
   CAMERA:1
   HIBER:1

For step 3 here are my changes

"mod_string":"hal_target_is_a9se_init",
"mod_address":"A49779CC",
"mod_orig":"E1A03000",
"mod_change":"E3023f39"

 

"mod_string":"hal_info_init",
"mod_address":"A4978994",
"mod_orig":"E1A02000",
"mod_change":"E3022f39"

"mod_string":"update_revert",
"mod_address":"A49AF5A8",
"mod_orig":"EBFF0D65",
"mod_change":"E3A00022"

CRC Complete original 0x38B55990
CRC Complete after 0x359f27a6 

Resulting CRC section0: 0x98C5E361 (Smoky MP replaces Australia EDB2 in SDT)
Resulting CRC section3: 0x23E2527B 
SHA1 of resulting firmware: 87 8c 49 7d fb 32 ea 80 4c f6 b6 0b a8 01 c2 9f 92 46 46 67

Double check with bsdiff: h5to2018.diff
UPDATED: h5_2.70_for_h2018.diff

Final Thoughts

My guess is GoPro will eventually unlock the HERO5 feature set for customers that want more power. If not, the customer base should pressure them. IMHO, this whole product is a tad shady. I get the feeling most people within the company didn't realize how little was changed. As far as I can tell, only two resistor values were modified. 

None-the-less, we put enough information on this blog for some enterprising individual to create a patcher for customizing their own hardware. 

Postscript

At the end of the day, we really wish they would just open up their developer program. It baffles us that they lock people out from making accessories for their products. The knowledge used to create this patch was only acquired from the research done to make our hardware work with the GoPro HERO5/6. 

Drop us a line if you need custom POV Camera solutions for your application.

Again, do not contact us for this mod! We've been contacted by Konrad to STOP contacting them about performing this mod. None of us want to touch it for legal reason, please respect that!

LEGAL: This product and/or service is not affiliated with, endorsed by, or in any way associated with GoPro Inc. or its products and services. GoPro, HERO, and their respective logos are trademarks or registered trademarks of GoPro, Inc. HEROBUS and BACPAC are trademarks of GoPro Inc.