Eachine E58 Drone — SPI Flash Dump & Firmware Reverse Engineering

Detailed reverse engineering report, memory map specification, automated carving scripts, and disassembly guides for the 512KB SPI flash dump (flash_dump.bin) extracted from an Eachine E58 FPV Drone Wi-Fi camera board.

---

1. Project Overview & Hardware Specification

The target device is the Wi-Fi camera module from an Eachine E58 FPV drone. The firmware binary (flash_dump.bin) was dumped using an external ESP32-S3 UART/SPI programmer.

Technical Target Breakdown

Parameter	Technical Specification
Dump File	flash_dump.bin (524,916 bytes total)
Flash Hardware	512 KB (4 Mbit) SPI Flash IC (XMC XM25QH40, JEDEC ID: 5E 32 13)
Processor Core	ARM Cortex-M4 (32-bit Little-Endian, Thumb-2 instruction set)
SoC Vendor	Allwinner / XRadio Technologies (XR871 / XR872 / XR819 SoC family)
Container Format	AWIH (AllWinner Image Header — 64-byte container structures)
Operating System	FreeRTOS kernel
Network Stack	LwIP (Lightweight IP) + XRadio WPA Supplicant driver
Wi-Fi AP SSID	WiFiUFO_xxxxxx (Default Access Point for drone FPV stream)
Camera Sensors	Dual-camera input support: GC0328C, SP0A19, HI704 CMOS sensors
Peripheral Bus	I2C (SCCB bus for camera control), CSI (Camera Serial Interface), Hardware Audio Codec
Dumper Preamble	ESP32-S3 flasher UART log stored in preamble bytes 0x0000..0x0145

Note

Flasher Preamble Notice: The first 325 bytes (0x0000..0x0145) of flash_dump.bin contain ASCII UART console logs emitted by the ESP32-S3 programming hardware (ESP-ROM:esp32s3... Starting dump...). The actual target microcontroller firmware payload begins cleanly at offset 0x0145.

---

2. Memory Map & Partition Table (AWIH Container Analysis)

The firmware uses Allwinner's AWIH (AllWinner Image Header) container format. Each section starts with a 64-byte (0x40) structured header defining load addresses, entry points, payload sizes, and compression flags.

Flash Offset	Clean Payload Offset	Section / Output File	Payload Size	SRAM Load Address	Entry Point	Flags / Compression
0x00000	0x00145	00_bootloader.bin	9,988 B	0x00268000	0x00268101	Uncompressed Secondary Bootloader
0x08000	0x08145	01_app_boot.bin	37,328 B	0x00201000	0x00201101	Uncompressed App Bootloader / Pre-kernel
0x11400	0x11545	02_kernel_section.bin	325,980 B	0xFFFFFFFF	0xFFFFFFFF	LZMA Compressed Main Kernel & Application Code
0x61000	0x61145	03_config_section.bin	2,288 B	0xFFFFFFFF	0xFFFFFFFF	System & Wi-Fi Configuration
0x61C00	0x61D45	04_system_data.bin	29,716 B	0xFFFFFFFF	0xFFFFFFFF	Driver Parameters & Network State
0x69400	0x69545	05_certs_section.bin	792 B	0xFFFFFFFF	0xFFFFFFFF	Security Certificates / Calibration Data

Important

Thumb-2 Addressing: In AWIH entry points (e.g., 0x00201101), the least significant bit (LSB = 1) is an ARM architecture flag denoting Thumb Mode execution. When configuring disassembly tools, set the execution entry address to 0x00201100 and enable Thumb state (T=1).

---

3. Extracted Artifacts & Key Strings

Static analysis of extracted ASCII/UTF-8 strings revealed critical driver identifiers, network configuration strings, and system log symbols:

Network & Wi-Fi Identifiers

• Default SoftAP SSID Prefix: WiFiUFO_
• Wi-Fi Driver Stack: AP-XRADIO, HW_TYPE_XRADIO
• Embedded IP Addresses: 192.168.28.10, 192.168.28.2

Video & Camera Sensor Drivers

• CMOS Camera Drivers: GC0328C Init Done, SP0A19 Init Done, main camera select_camera_hi704
• Dual-Camera Switch Logic: camera select CAMERA_MAIN, camera select CAMERA_SUB
• Video Interfaces: HAL_I2C_Init (SCCB control), CAMERA: csi jpeg init failed, camera_mem_create malloc sram failed
• Audio Codec Driver: xradio_internal_codec_sound_card

---

4. How to Run Extraction & Analysis Scripts

1️⃣ Run Deep Dump Inspection (analyze.py)

Performs preamble extraction, validates ESP32 signatures, parses all AWIH headers, searches for string indicators, and generates an architecture summary.

python analyze.py

2️⃣ Carve & Extract Partitions (extract_partitions.py)

Strips the 325-byte ESP32-S3 flasher preamble and carves clean partition binaries into the extracted_partitions/ directory.

python extract_partitions.py

Generated Partition Directory Structure:

extracted_partitions/
├── clean_flash_512k.bin      # 512KB raw SPI flash binary without preamble
├── 00_bootloader.bin         # Secondary bootloader binary (SRAM 0x00268000)
├── 01_app_boot.bin           # Application startup binary (SRAM 0x00201000)
├── 02_kernel_section.bin     # LZMA kernel payload section
├── 03_config_section.bin     # System configuration section
├── 04_system_data.bin        # Driver parameters & hardware settings
└── 05_certs_section.bin      # Security certificates & calibration data

---

5. Reverse Engineering Setup Guide (Ghidra & IDA Pro)

To analyze carved application binaries (01_app_boot.bin or 00_bootloader.bin), configure disassembly tools with the following parameters:

🐍 Ghidra Loading Instructions

1. Import File: Navigate to File -> Import File and select extracted_partitions/01_app_boot.bin.
2. Language Configuration:
   • Processor: ARM
   • Variant: v7 or Cortex
   • Endianness: Little
   • Size: 32-bit
   • Instruction Set: Thumb
3. Memory Block Configuration:
   • Block Name: RAM_APP
   • Base RAM Address: 0x00201000 (For 00_bootloader.bin, set base address to 0x00268000).
4. Entry Point: Set entry point to 0x00201100 (Bit 0 of 0x00201101 indicates Thumb mode).

---

🪟 IDA Pro Loading Instructions

1. New File: Load extracted_partitions/01_app_boot.bin.
2. Processor Type: Select ARM Little-endian [ARM], then pick sub-architecture ARMv7-M or Cortex-M4.
3. Memory Segments:
   • ROM Start Address: 0x00201000
   • Loading Offset: 0x0
   • RAM Start Address: 0x00200000
4. Disassembly & Thumb Mode: Go to address 0x00201100, press Alt+G, set T register value to 1 (Thumb state), and press C to disassemble code.

---

6. GitHub Repository Deployment

To push changes to your GitHub remote repository:

# 1. Ensure primary branch name is main
git branch -M main

# 2. Add remote origin URL
git remote add origin https://github.com/d7main/dump_eachine_e58.git

# 3. Push initial commit
git push -u origin main