Lane Departure Microscope
A device with nothing to say about itself
The unit was sold as a “Tomlov 7”. It arrived with no markings of any kind — no model number on the case, no silkscreen, no sticker. The only self-identification anywhere in the product was a line buried in a settings menu: firmware 20220905 V1 .
The goal was small and entirely cosmetic: replace the boot splash. That turned out to require the firmware image, and the firmware image turned out to require knowing what the device actually was.
USB was the obvious first move, and it was a dead end in an interesting way. The device presents three different personalities depending on how you plug it in, and two of them are lies.
USB identity by mode<br>Verified on device
Mass storage 1b3f:8301 Generalplus MSC + live vendor command channel<br>PC camera 05e3:f12b "GENERAL - UVC" UVC only, no extension unit<br>Charging does not enumerate nothing at all
05e3 belongs to Genesys Logic — a vendor ID the manufacturer does not own, borrowed from a USB bridge chip. Searching by vendor ID in camera mode leads somewhere entirely unrelated to the actual device.
So the USB descriptors were useless for identification. What was left was the data the device produces.
Where the dashcam angle actually started
Not with a guess about the product. With three identifiers, none of which mention a microscope, all of which point at the same silicon vendor.
The first came from the device's own recordings. Every video the microscope captures is stamped by whatever code muxed it, and that stamp reads:
Fingerprint 1 · the AVI muxer<br>Verified on device
RIFF AVI hdrl avih strl strf JUNKGP$322 Generalplus AviPackerV3 20140916movi
Present in every captured .avi, and at 0x05d8e4 in the firmware itself. Generalplus is a Taiwanese SoC vendor. Nothing here says Tomlov, and nothing says microscope.
The second came from the mass-storage identity. A SCSI INQUIRY returns 44 bytes that are pure boilerplate — a generic disk name and a build tag, with no product string at all:
Fingerprint 2 · SCSI INQUIRY<br>Verified on device
GENPLUS USB-MSDC DISK A 1.00GP-PROD.
Later found to match a reference implementation's SCSIInquiryData[] array byte for byte . The manufacturer never edited it.
The third was a working vendor command channel: a private SCSI extension gated by a two-byte signature, 'G' and 'P' at fixed offsets in the command block. The same command succeeds with those bytes and is rejected without them — confirmed live on the device.
Three independent identifiers, one conclusion: this is a Generalplus part. And that is the moment the investigation forked, because of what happens when you go looking for Generalplus source code.
There is essentially one public Generalplus codebase
It is a GitHub repository called ZTKVR — a complete SDK for a product line identified in its own headers as 326B_CVR. CVR stands for Car Video Recorder.
It is a car dashcam SDK . Not a microscope SDK. Nobody has published a microscope SDK, because at the time it looked like nobody had ever built one.
The dashcam angle didn't start as a theory about the product. It started as the only map anyone had, and it was a map of the wrong vehicle.
Everything then known about the device came out of that repository: the resource container format, the boot splash loading path, the firmware update mechanism, the vendor command table. All of it read out of code written for a device that bolts to a windscreen.
Which meant every conclusion carried an asterisk, and the asterisks were load-bearing. The update path this SDK describes has no signature, no checksum, no magic number and no version check . It erases and rewrites SPI flash from offset zero with whatever bytes it finds in a file. If the dashcam assumption was wrong anywhere that mattered, the first write would be the last one.
So the working notes were split into two columns — verified on device and inferred from SDK — and nothing was written to the hardware while the second column contained anything important.
What the wrong map cost
Reasoning from a sibling product generates confident, plausible, wrong answers. These each burned real time before collapsing.
GP$322Read as a part number. It is a build tag inside the SDK's own source, not a die marking. Searching for it as silicon returns nothing because it is not silicon.
GPCV1322 / GPL32680Two plausible reconstructions of a real Generalplus part number from that tag. Both wrong, both chased.
SPCA…A whole family of chips that look like they belong to this vendor. They are Sunplus — a different company entirely. Generalplus parts are GPCV and GPL.
fvvlstore.comThe download mirror referenced for this chip family. Dead domain.
05e3:f12bThe webcam-mode USB ID, which belongs to Genesys Logic and describes a bridge chip rather than the product.
Four emails
The other route was to simply ask the manufacturer for a copy of the firmware already running on the device. This proved...