I-Appliance BBS
The Official Source for Internet Appliance Upgrades and Mods
Amazon Honor System Click Here to Pay Learn More
BBS Main List | Sign In | Sign Up | Search | Help | Linux-Hacker.netReply to Thread | Printer |

Home / MISC Areas / Cameras
Questions - 1 2 many 4 all
Questions - 1 2 many 4 all

New MessageQuestions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Please feel free to seek help with understanding how to achieve previous results here.
12-04-2004 21:33:30

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
PidGin128,
Sorry you missed the thread cutoff message.
If you sent the binary string as indicated you replaced the command code 52 with 27 instead of the length code 10. Looks like you still recieved 1M back even with the wrong command but you will need to enter a length of 2,600,000 on bulkin after updating your binary string to get an uncompressed file for processing. We would really like a bright sunny outdoor shot when you try again.
12-05-2004 04:54:08

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Any legal help would be appreciated. I currently have following impressions on patent and thesis:

Patent http://patft.uspto.gov/netacgi/nph-Parser?u=/netahtml/srchnum.htm&Sect1=PTO1&Sect2=HITOFF&p=1&r=1&l=50&f=G&d=PALL&s1=6600471.WKU.&OS=PN/6600471&RS=PN/6600471

Thesis http://theses.mit.edu/Dienst/UI/2.0/ShowPage/0018.mit.theses%2f1999-310?npages=143&format=inline&page=39

I could see no reference to applying any algorithm to assemble pixel data and combine with extended gamma information in any of the 56 claims. Those claims seem to only cover the imager itself and electronics to control voltages.

I doubt that if one trained in the art of manipulating raw photograph files follows an obvious procedure to reconstruct a photograph from arrays of data that there would be any infringement.

Also there appears to be no patent marking on the camera. Perhaps one is not needed because the actual process is applied off camera by a network server. I think we can take some comfort in the following:

"In the event of failure so to mark, no damages shall be recovered by the patentee in any action for infringement, except on proof that the infringer was notified of the infringement and continued to infringe thereafter." http://www.uspto.gov/web/offices/pac/mpep/documents/appxl_35_U_S_C_287.htm

The actual bit manipulation and reconstruction of an image appears to be covered in a preceding thesis probably negating patentability.

12-05-2004 15:52:39

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
scribble had a question on how to get usbpoker working - I waisted an awful lot of time trying before achieving success myself. Here is method I followed:

Add a new entry to libusb.inf changing 24 for old blue to 28 (if new blue, 27 of new red). This time it is just a simple device - not a composite like the old blue so get rid of &MI_00 at end of line and delete the second line. Drmn4ea if you are reading perhaps you could add some documentation with your poker in the zip file pointed to in Links thread. In the long process I followed, I ended up downloading a new release of libusb but do not think it was necessary. Here is my line for a 27 PV2:
"Pure Digital PV2, Bulk Interface, Version 11/18/2004, 20041118"=LIBUSB_DEV, USB\VID_0DCA&PID_0027

When plugging device for the first time (I use XP), in response to new hardware wizard I selected manual (not automatic) and then browse, going to location of my the updated libusb.inf and then clicking ok, next and finish.

Create a binary file (I recommend XVI32 - google and download) containing:
4d 61 4d 53 1d ba ab 1d 00 00 27 00 80 00 00 52 and 15 00s for a total of 31 bytes.

Invoke usbpoker, select open, then bulkout, browse to your binary, click send it, wait for message saying write 31 bytes, then click bulkin, enter length 2600000, wait for message read 25nnnnn bytes, close it, disconnect, delete shot, rename angerRcvd.text and now your ready for another shot.

Hope all this works for you scribble, and rather than trying for green FFs, it may be more informative to follow morcheeba's latest suggestion on a controlled linear extended dynanmic range if you have a meter and other necessary equipment.

12-06-2004 06:36:02

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
morcheeba, what command code and parameters did you pass to get something other than $64 and what error did you get instead. Others may want to play and even though they do not have access to code may randomly be able to arrive at some interesting results - like mike, perhaps daBass could get his camera back in action.
12-06-2004 06:53:10

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
>> Add a new entry to libusb.inf changing 24 for old blue to 28 (if new blue, 27 of new red).

I'm confused now, wasn't the old blue's VID/PID 04FC/FFFF?

I'll shortly put up a new usbpoker build that (tries to) get a CSW and read the return code...the file will also contain a directory just for us PV2 tinkerers with a sample 31-byte command file, a quick howto on sending it and getting back the response, and a copy of libusb.inf with all the known cameras' VID/PIDs in it.

But for that I need... What are the known IDs for the blue (non-LCD) PV2s? Also, has ANYONE gotten other variants (CVS, Longs, etc.) to respond over USB? Are the IDs different, and what are they? Basically, I'm looking for a list of all known VID/PID combinations for this series of cameras.

12-07-2004 00:04:44

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Drmn4ea you are at most half as confused as I. I think the 24 came from following an earlier post on downloading Foxz2 driver (the Foxz2 is 24). Krampack has a CVS LCD : Firmware 6520, Hardware 06, Type ID 30, CMP Type ID 30, ID xxxxxxx, Realm ID 20. Bentfork has a CVS LCD : firmware 6510, hardware 06, typeid 27, cmptypeid 27, DAxxxxx, realm id 20. Interesting they decided to captilize first letters in release 6520. I think we could get more help if someone gets a CVS working.
12-07-2004 09:52:27

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) scribble
Profile
28 works fine on my 2 pv2 blues. I also have two unmodified walgreen which I can try to hook up if anyone knows their id codes.
12-07-2004 13:00:16

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
sribble, And your 2 pv2s are? Ritz?
I uploaded one of your zips to my briefcase but the other two failed with a message because of a 5MB limit. So you either need to break them further down or wait for a better web page - I have been asking and hoping someone looking for more hits will take on the task. Look for answers here or in suggestions. However I will complete this time if you break up further. You might want to watch for boodles viewer (How's that coming, good luck on your finals boodles). I like your windows pics; wonder if you can increase indoor lighting to a point where SMaL camera can see outside but another (old blue or better high end) camera can not. Such a demonstration would really pick up pace on these threads! I haven't checked but your notes on colors seem to indicate you may need a debayer routine - does anyone have links to such? Also although the patern/mask (I am leaning towards no autobrite - covered in separate posting) may look same for a single camera your cam1 window and posters starting at $1EFB00 do have minor differences:
CF F8 C8 0C CC 40 C7 8E C4 94 89 C8 E6 D6 6C CD
CE F8 C8 8C CC 44 C7 8E C4 9C 89 C8 C6 D6 6C CD
I recommned you download XVI32 open it twice and place one window high and another low. http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm
12-08-2004 01:28:16

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
dakotamod,
You asked me a question on discoveries. Are you running off track? Did you like Polar express as much as scribble? You are like that train was on ice, just sliding every which way. Yeah, I've been reading these threads.

NO! I don't do pics! I am Mathematician with a keen financial interest in these happenings. I do not have a disdain for authority. Yeah, read your photo.net biography too. If I had been your 7th grade Math teacher, I wouldn't have given you any extra credit either. Why would you have stopped at 4th perfect number if you thought you had the pattern - unless you knew more from reading a book! Check out this post:
http://www-gap.dcs.st-and.ac.uk/~history/HistTopics/Perfect_numbers.html

You have had me hopping like a white rabbit from thread to thread. As too your earlier reference to Lewis Carroll (he was a better writer, better mathematician, and a better photographer than you can even hope to be). His door mouse never said feed your head. That was Grace Slick of Jefferson Airplane singing White rabbit:
Tell 'em a hookah-smoking caterpillar has given you the call;
To call Alice, when she was just SMaL.
When the men on the chessboard get up and tell you where to go;
And you've just had some kind of mushroom,

You have sparked my interest even though you have been wrong several times; however my money is still on the other side.

12-08-2004 03:50:00

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
brite_eye, Or is it BUG_eye. Would you like to see my 1 finger salute? Read your own link idiot - How long did it take before they found the 5th perfect number? You seem to have a fascination with SMaL - why else did you change small in white rabbit lyrics? Who are you? I did not quote Lewis the last time (you falsly assumed I was quoting), this time I will add quotes: "Again, the Caterpillar demands, Who are you?."
12-08-2004 06:47:51

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) scribble
Profile
Seems like if I'm going to survive in this group I better find a copy of Alice In Wonderland. For the record, my vote for the best photographer in the Lewis Carroll era would go to Nadar with Margrette Cameron a close second.

Drmn4ea-- When I ask usbpoker to download a file larger than 2555917 from my blues I get the file I ask for but the poker reports that the file is 2555917 bytes long. Is this caused by a minor bug in usbpoker or does the program look for something like an end of file marker. If that is true, it would be very interesting to see what pure digital is trying to hide with their phony end of file marker

Dakotamod--Yes, they are newstyle ritz blues.

The windows pictures were shot late in the afternoon on a overcast day so that may be the reason there isn't much detail beyond the window. Once we have a program that produces a properly demosaiced image I might be able to find a way to charactorize the camera and sensor. The big problem is there is no exif data so I don't know the exposure.

Both photoshop and irfran should have a debayer routine built in. I'm hoping that a proper header will tell the programs what to do.

I have to warn you that after I install your hex editor on my machine, I might start pretending that I know what the numbers mean. Than I'll really be dangerous.

A minor piece of gossip--I'm going to order myself a red out of the warehouse since the local Ritz doesn't stock the cameras. I asked why and was told that Ritz has 1200 stores and they were on the list for an upgrade of their Fugi Frontier. Does anyone know if all the processing is done in the Fugi? In some older posts I remember references to a seperate Pure Digital computer.

12-08-2004 12:27:28

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
scribble, if you did not change 00 27 00 00 to 00 29 FF FF in the browsed file (I think I sent you one named ain27) then you will not get any more bytes back. I believe that is our current limit. Still waiting for someone to look at Drmn4ea's latest black to see if remnants following the compression match identically with corresponding locations in the mask - verifying that mask is simply xor'd against the black zeros and thus probably also for all other pictures. Where are the compression experts - are they all so young that finals are taking up all their time? Forget about wonderland, how about some SMaL shots Through The Looking Glass (another Carroll classic). Oh, and bug_eye the door mouse may not of said feed your head but he did tell a story about "Elsie, Lacie and Tillie who lived at the bottom of a treacle well and learned to draw things starting with an M" which probably triggered Grace's "feed your head" verse using meaning number 22 of 44: http://www.hyperdictionary.com/dictionary/draw

Someone mentioned earlier that Longs drug stores required a network connection. This may not be true for Ritz 27 and 28 models we have been using and may be part of the difficulty getting CVS models to work.

12-08-2004 13:27:01

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) scribble
Profile
dakotamod--I'm using an27. I'm downloading continious data to $27000d, the 2555917 that usbpoker reports as the file length. The last eight or so bites were identical on the 3 raw files I've looked at. Since the raw files were from both camera 1 and camera 2, I've been taking them as an EOF marker. Then there are 4000 something zeros, then the 254 bits I've been calling the signature. Then it maybe all zeros to the 2752511 limit reported earlier.

I'm using the hex editor you recomended. So far I haven't found a way to copy a block of text to the clip board or compare two files and have the differences highlighed. Is that possible?

I'll modify the an27 file and see if my signature ideas are real or just an attifact of the downloading process.


There maybe network connections between CVS, Ritz and PureDigital but I'd be surprised if it used for anything but downloading software updates and, more important, showing the 30 idiotic new hires a week what they are doing wrong when one of them frantically phones PureDigital service to say she can't get pictures out of the machine and there's this tattooed motorcycle guy glaring at her from behind the counter because she didn't have his pictures of the new Harley in one hour.

For a whole bunch of reasons which I'll post when things in the group are slow, I'm 99.48% sure that all the information needed to make a print of little Suzy splashing in the bathtub is floating around somewhere in the Pure digi camera.

12-08-2004 16:58:37

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
scribble, I have used delete from cursor and delete to cursor to extract and then save portions of a file. Under edit there is also a block mark capability similar to the old wordstar and a clipboard function that I have not tried. I am still hoping Drmn4ea will respond to a previous request for the file compare program he used on cut line blacks - or if anyone else knows of a good compare utility please post as an answer here or in suggestions.
12-08-2004 17:15:19

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
@dakotamod-

Thanks...I can assume the VID will be 0DCA for all SMaL cams, but I don't know whether the PIDs relate at all to what's displayed during a 3-finger salute or not. The Ritz camera's PID matches the TypeID, but it may be coincidental. I hope they're not planning to get too carried away playing ID mix-n-match, but if they do, we can always just go back to the libusb filter driver and connect to "anything that looks like a SMaL camera".

I'm going to pick up a red from CVS tonight (thanks Mike for the $5 off coupon link in the one-to-many thread) and see what I can pull from it.

12-08-2004 21:37:25

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Drmn4ea, no offense but I am hoping you get a 6520. mike has an older 6430(mike, correct me if I am wrong). Please post initial results along with a 3 finger salute on the separate CVS thread. I can not get my 6520 to work.
12-08-2004 22:09:11

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
You are really starting to bug me brite_eye. In response to your last discovery post, here is a moon shot from a fellow photographer: http://www.photo.net/shared/community-member?user_id=313783

3 questions: Are you trying to steer us into a black hole with your 23 509 2269 primes? Are they just self amusement for a developer? Who are YOU?

12-09-2004 07:08:01

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
Hard to say what the firmware version will be, while it's still on the shelf in a blister pak! I just picked one up at CVS on Mass. Ave, Cambridge MA (Medford CVS was fresh out!), ctrl-alt-del'd it and got the following:

FIRMWARE: 6520
HARDWARE: 06
TYPEID: 2B
CMP TYPEID: 2B
ID: DBxxxxxxxxxx
REALM ID: 20

CMP TYPEID is a new one, I haven't seen that on Ritz reds (nor REALMID for that matter). Could this be short for "Compression type" ? I'll try to USB it when I have time, but tonite a young lady has enticed me away from the lab with the promise of yummy onion soup. Results when I have them will appear in the CVS thread.

Also, a polite suggestion, would it be possible to restrict all private wars to private channels, rather than all over the public boards?

12-09-2004 16:50:31

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) morcheeba
Profile
Drmn4ea, I think it is important that you post all the details of your efforts as soon as possible. I'm talking about the lady with the onion soup, of course!

Maybe CMP TYPEID stands for "compatible type ID" ?

12-09-2004 18:16:18

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Thanks for the polite suggesting Drmn4ea. I'll gladly honor it for you. "and in a very short time the Queen was in a furious passion, and went stamping about, and shouting 'Off with his head!'" brite_eye will not be back! You can see what is left of him here: http://www.photo.net/photodb/photo?photo_id=2834686

Should I stop the Carroll quotes also? Too many late nights, not enough sleep, one can go crazy and start talking to oneself. I needed to be spurred on. It can help - see my latest compression analysis on discoveries.

12-09-2004 18:18:11

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
My camera (CVS) had one picture stored in it that I forgot to delete a few days ago. Today after playing around I managed to reset the camera so that I have 25 pictures remaining.

I am not sure the exact sequence of events. But it involved a little semi random poking with the usbpoker. Playing around continuity meter (with the batteries removed from the camera), and plugging the camera into the computer without any batteries.

Question: Has anyone else managed to reset their picture counter? Did you do anything i did?

12-10-2004 16:04:48

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Drmn4ea, in your most recent post to discoveries you indicated you did not want to LAMSMSAL another camera. Why? Does it create an inferior camera?
12-11-2004 15:52:47

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
Drmn4ea...........what command did you use .. the $80 or $52
did you try just shorting the sw and connecting to usb???????

Morcheeba
do you know of any dissassembler for the V8 that runs under windows??????

12-11-2004 16:17:19

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
@dakotamod - I don't know of any effects on picture quality / etc; I just want to keep at least 1 camera in its factory-default state, at least while trying to extract data (e.g. key blocks) from them. It's not yet fully understood what the total effects of the 'clearing' are, other than altering the ID and $80 block - they could falsely enable the camera, or disable it, or who knows what, but then I can't be sure that any procedure/result on a cleared one will be valid on a non-cleared one.

@mike - for the firmware extraction I used $80 with data length $29ffff. Most any command byte seems to behave the same way (triggers the buffer overflow) - so far I've used $00, $80, $52 and each has given me mostly SDRAM data. I did try holding the switch and connecting the camera to USB with no 'normal' power-on first, but it looks like I just got uninitialized memory back - maybe it needs that step to load the firmware into memory initially.

12-11-2004 18:06:01

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) scribble
Profile
bentfork--If I understand your proceedure, you sent an $80 command, did a read of some arbitrary number of bytes, all with the batteries out of the camera and that reset the picture counter to 25 after you installed the batteries. If I have the proceedure right, I tried it on my blue ritz and it didn't work.

I looked at your black to white gradient picture in--what shall I call it--3D compression space, and I saw a faint hyperbolic trace so the odds are the CVS is using the same compression routine. If things get slow with the firmware discoveries and you want to a pursue it further, I can send you jpgs of the type of images that make a much stronger signature in 3D compression space.

12-11-2004 21:40:38

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
@scribble: It seems that almost any usb error will mess up the camera and it will let you to delete one image. Here is my procedure:

1) Connect to USB and cause an error ( the fastest way to try and do a Bulk-In with wLenght of 0 ).
2) Disconnect camera; power it up, it will 'crash' with the 3 decending beeps. My guess is it 'self-heals' here enabling the delete function again.
3) Power it up again and press delete. You will see the thumb nail of the LAST picture you took. Press delete to confirm delete.

Repeat as necessary. I have never had the counter go below '23 remaining pictures', so I dont know how many you can delete. But I have done this many (7+) times with my CVS 6510.

As for the image formats. Has anyone looked at JPEG-LS yet? Smal does claim that they are losslessly encoding the image. I'm game to take more pictures if you send me some reference images.

12-11-2004 22:14:27

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) scribble
Profile
Your undelete trick didn't work on my cameras. Not surprising since they are model 400 Ritz blues.

I'll be sending you the knee images shortly. I've included the gray scale image I created in either photoshop or irfran, I don't remember which, and the compressed images created in 320 by yyyy and 1280 by yyyy 3D compression space using the irfram raw converter with a header length of 80. You can get a single pixel wide slice of the zzz values using ImageJ or better yet a 3D plot program tha allows you to zoom in on a specific area.

The trick is to have about a range of whites to blacks in a simple but curved image. There are close up shots of my knee when I was wearing white pants. As you can see, the 3D compressionr space images are very distictive. With linear images like your black to white, the patterns are fainter and smaller and usually found down near the bottom.

I was hoping to take the uncompressed raw image of knee3, compress it with a variety of compression programs, rename the files to raw, and then use irfran to look for similar patterns. However, if the files are encrypted as people now think, that might not be such a useful exercise. In any case the patterns are interesting and I'm certain details such as the repeated chevrons in the white areas will tell someone who knows what he's looking at something about something.

12-12-2004 11:41:33

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) morcheeba
Profile
mike - my disassembler should work under windows, if you have a compiler (there are some free ones available. It is just straight-forward command-line C; the only trick is that I don't have a makefile yet, but that depends one where you compile it. If the demand is great enough, I can just publish a binary compiled on an office windows system.
12-12-2004 12:20:21

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
I wonder if once the "cleared cam" (LAMSSMAL0000) key is known, this will be the same for all cameras and usable to extract files. Sounds like it would be a stupid backdoor to leave open, right? Maybe not.

Considering the (guesstimated) millions of these things flying off the shelves, I'm not sure that us soldering-iron-wielding hardware freaks are what the challenge-response system is trying to prevent. Sure, there are maybe one or two dozen of us lurking in this forum, then maybe on the order of a few thousands when the hack inevitably hits Slashdot.org. This is probably considered an "acceptable loss", of about the same magnitude as all the ones that get lost, broken, etc. and not returned.

I think the bigger concern is CVS being able to download a patch that lets them process Ritz cameras, or of Osco Drug, Bob's Camera Emporium, etc. being able to set up their own processing station using off-the-shelf (or off-the-internet) picture-snagging code (and become an instant competitor without eating the initial hardware cost).

I read in the other thread that sending a bad key causes picture deletion. For us, it is acceptable that we'd have to buy a camera, make it erase itself once (reset the key) and then begin using it, but Joe Consumer is going to open the blister pak and start snapping away. Losing a customer's pictures during the first extraction attempt would be unacceptable, so a unique key on from-the-factory cameras would be an effective deterrent to this.

12-12-2004 12:54:23

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
Drmn4ea and or Morcheeba I cannot get handshak proceedure correct
1) I issue bulkout filedata = LaSm.....80 00 00 00 80 00 00 80 00 00......
2) I issue bulk in and get response 76 54 32 10 00------ back
and stat LaSM ......00
3) how do I send the response ....LaSM00 and do I send 128 bytes
do I build file LaSM....80 00 00 00 00 00 00 80 00.....to byte 31 + reponse(128bytes)
and send as bulkout .....
4) I havn't a clue as to mounting a drive in windows ....good old PNP...
12-12-2004 15:51:15

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
Has anyone figured out how to identify a camera based on a USB probe yet?

@Drmn4ea I tried compiling your poker myself but I had no luck. Does anyone know how to 'port' the code to msvc6 (!.net) I haven't used any borland since eons ago.

The dis8v code ported rather easily to msvc. I can post a binary if anyone wants it. It works well. I like the function hashing. That basically does the same thing that I wanted to do with the torrent style file, but is more compatable.

Any guesses as to whether the image encoding/compression varies with the firmware?

ps: "LaSM " I was looking at that in the firmware, it was so close to 67452301, then I went to bed...

12-12-2004 16:25:37

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) scribble
Profile
Drmn4ea--Your analysis was right on but you forgot one thing--the influence of the venture capitalist. The first thing those wolves will demand to know is what's to prevent someone buying one of my precious reds and--shutter!!--shutter!! hacking it. And the only answer is we are going to use this superdooper encryption scheme that will take them a million years to decode.

What's really going to put pure digital down is the 3.2 megapixel, SX digital zoom, semidecent LCD, memory card enabled, take pictures til the buttons pop out Kodak that the local Ritz has on sale for $99.00. By the stardards I normally use to judge digital camera, the Kodak is hopelessly primitive because among many other things ironically it doesn't have a RAW mode, but at under a $100 it's broken a price barrier and is in the give-it-to-the-kids-until-they-lose-it territory.

Bentfork--There's no way my blues are both compressed and encrypted. There's a class of pictures--scribble's knee--that produces a data dependent but otherwise consistant output--chevron flecked hyperbolized S-curves. By any definition of encrytion I can think off, that proves there isn't encryption

On the other hand, that doesn't mean the reds aren't encrypted. PureDigital is a startup and mostlikely doesn't have the resources to introduce more than one camera. So they pour their resources into the reds, which costs at most $2 more than the blues, and do a big promotion a Xmas time to save what maybe a sinking venture.

I have a red on order. It should come in sometime next week. By interesting to see what that camera does.

scribble

12-12-2004 18:00:59

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
Bentfork

is that Dis8v binary for windows???? I'd like a copy if so........

12-12-2004 18:38:12

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
mike: win32 version of dis8v. You will need the file FIRMWARE.COMMENTS from morcheeba's original, and your own FIRMWARE.BIN. Place them all in the same directory and run it capturing the output to a file.


I am able to 'log into' the camera now. But I cant seem to get it to do what I want off the flash (I'm getting lots of "Overlapped I/O operation is in progress."). I have seen some intersting data that morcheeba suggested may be the NVRAM (after sending $52, LUN 0). It looks like there are a few 'one time pads' there. Each one is $FF long, the first one starts at $FF just after after two $80 length 'login keys'. I'm going to give it a try on one of the compressed file 'headers' and see what happens.

Are the command sequences that I am looking for in the USB documentation?

12-12-2004 19:13:51

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
Whatever that data was I was getting it dosn't look like it was a large XOR block to magically create a valid header.

I tried boodles raw2bmp converter. Looks like a good start. I had to change the offset for it to work correctly with my data. The images look a little blueshifted. samples: red ball, and blacktowhite fade

I am going to try to generate some interesting images like scribble knee images, and see how the compression looks.

12-12-2004 20:32:59

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
@mike - check out the lower portion of http://maushammer.com/systems/dakotadigital/lcd-usb.html , the procedure is explained there. You've got it prefect through step 2. Now just...

3) send the $80 command block again, but with the read bit cleared to make it a write.
4) Now the camera is expecting your 128-byte key, send it. (These 2 sends happen back-to-back; don't try to read the status in between).
5) Read the status from bulkin, you should get the 13 byte response with the last byte set to 00 if all went well.

Now the camera is unlocked, you can use $52 to dump contents from the flash chip (the same basic procedure as we've been doing to read RAM, but note- you have to change the LUN nibble to 01). To get something other than the first $29ffff bytes, the first 4 bytes after the $52 specify the *block* to start at in flash. If you want the whole thing, you'll have to request it in pieces and put the pieces together to form a single file.

There isn't a way to mount a file as a disk in Windows, but I have a crude program that will extract the files in the root directory (firmware, nvram, etc.). It doesn't drill down to subdirectories and grab the picture files out yet.

12-12-2004 23:27:58

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
@bentfork - Identifying the camera - For our purposes right now it should be enough to check that the device's Vendor ID is 0x0dca, this is the VID assigned to SMaL. (Hopefully none of us also has other SMaL cameras dangling off their USB port.) Releasing something to the huddled masses though, we'll probably have to start by checking for the known Product IDs (0x0027 for Ritz Red, and some others for different variants) unless they get too clever about making up random PIDs for each variant. We'll probably end up either just claiming interface on any SMaL device, sending it an $80 and see what comes back, and/or warning the user to disconnect any other SMaL cameras before the program looks at the device list.

(Or, did you mean how to tell whether it's a Ritz/CVS/Long's / red/blue over USB? I'm not sure of this myself.)

Porting the poker - you'd probably have to redo all the visual stuff if you want to keep all that - some of the visual elements are Borland components, not part of the Windows API. If you're looking to automate exchanging commands with the camera, it might be easiest to remove all the clickybutton stuff entirely and have a command-line interface to the common tasks, e.g. "send this command block and get response" or "snag entire flash chip in 64K increments". Since the interface/configuration/etc. to use is known and seems to be the same for all cameras, and it doesn't use the bulk Control transfers at all, the graphical controls to set this stuff are unnecessary.

12-12-2004 23:53:06

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
Drmn4ea I need more INPUT!!!!
3) I send $80 again LaMS....80 00 00 00 oo 00 00 80......
4) what cmd do I use to send th 128 bytes next....?
You're forgetting I,m a USB illiterate......!!
5) get status
How do I do this ? issue a getstatus setup packet 82 00 0000 0081 0200 ??????
12-13-2004 06:33:08

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
I am guessing, but after 3 bulkout change file/string to LaMS 00s... (all zeros) then 4. bulkout again followed by 5. bulkin of 128 length.
12-13-2004 07:07:23

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
I can't extract the raw images from my camera anymore. I get I/O errors when I try and read large blocks (1MB) of data from the camera.

This has happened after I shorted SW1 to extract the firmware, and sent the login command. Has anyone else tried to extract a image after doing one or both of these actions?

Is it possible that logging into the camera causes the cameras behavior to change?

12-13-2004 14:20:07

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) scribble
Profile
bendtfork

I haven't gotten inside any of the Ritz cameras but when they have acted strange turning them on and off a minimun of three times seem to have fixed the problems. Another thing to try is to take out the batteries for a while and see if there is a factory reset.

12-13-2004 14:42:34

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Drmn4ea, Help! I can only communicate (running XP SP1) using a newer libusb driver from SourceForge 20041118 listed under Snapshots. The old driver still works perfectly for original blue and will recognize new models under device manger usb controllers, but testlibusb-win does not see them. When I use the latest 11/18/2004 driver there is a new device manger entry for LibUSB-Wind32 Devices which they are listed under instead of USB controllers. Now all of that would be fine except I can not unlock my new cameras: Bulkout with getkey, bulkin 128 – works I see write 31, read 128 but then changing to sendkey and bulkout gives no response after send it and will not let me change to key_cleared eventually giving an error. Am I correct in assuming even for a reset LaMSSMaL camera I do not need to hold a sw1? Seems to be XP related. What do I try next? (I am using your latest poker).
12-14-2004 21:46:59

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
@dakotamod - I think your computer got infected with Windows XP somehow. OK, kidding - first things first, something screwy going on with your first getkey--you should receive 141 bytes (128 bytes key + 13 byte status packet). The camera seems fussy about following the MSBO protocol, you have to read out the status from the last operation before starting the next (for those which return a status; e.g. after a read, and after the data "payload" of a write).

In the current poker it's perfectly legitimate to request more bytes than you actually expect to receive; personally I just fill in the wLength field every time with '9999999'.

Otherwise this is wierd, I can't even begin guessing at what's going on, especially since it sounds like it works all right the first couple times. Some more information would be much appreciated:

1) The libusb-win32 snapshot you got, was it the STUB or the FILTER driver?
2) Are both driver versions now installed on the same machine/OS/partition?
3) What is the error message you receive?
4) How long until it appears? (15 seconds per the timeout, or significantly less than that? Stopwatch handy if you have one.)

Yikes...can't believe I just referred to debugging windows with a stopwatch (and meant it).

12-14-2004 22:48:24

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
Just slurped the flash from my CVS cam (firmware 6520)... there is an interesting line in FWCFG.DAT that wasn't in the Ritz version.

cfg.checkfirmware.ignore.NVRAM.DAT=1

Anyone else have it? Any guess as to significance? It has a valid (same as morcheeba's) keypair in NVRAM.DAT and does require unlock, and the same default (67452301 / LaMS) keypair stored in firmware.

12-14-2004 23:05:29

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) boodle
Profile
My Ritz cam (firmware 6430) has that same line in FWCFG.DAT. Also, my challenge/response 128 byte sequences are the same as morcheeba's.

I was thinking, doesn't the camera have to move this information from NVRAM.DAT into memory sometime to compare it to what it receives over usb? I've been trying to do a memory read at different times during this sequence, but I can't find the response any time in the memory.

12-14-2004 23:38:58

New MessageRE:Questions - 1 2 many 4 all (modified 1 times) Drmn4ea
Profile
@boodle - morcheeba mentioned in a post a while back, that the 'response' key from nvram.dat is indeed loaded into that $80 of memory where the dumps start - but as soon as the camera checks the incoming key and determines it doesn't match the RAM copy, it immediately overwrites that segment of memory with 0s to prevent exactly that (someone dumping out the memory and being able to extract a 'good' key from it).
12-14-2004 23:52:49

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Drmn4ea, Thanks for not leaving me in the cold (great job reading and responding to all).

morcheeba, Thanks for an ultimate high - just downloaded first memory chunk from a CVS blue. An old math professor whom I still see, once compared Mathematics to masturbation of ones mind with ejaculation being the final proof of a theorem.

My CVS blue (and others too) required an updated libusb download - scroll to snapshots and pick device-bin-20041118 version http://sourceforge.net/project/showfiles.php?group_id=78138. Any XP users having problems should try the newer software. My mistake was not adding the 13 unlucky status to my read of 128 key. I also had to reduce 29ffff to 280000 for my blue. Now the responses for a complete sequence that retrieved flash:

Wrote 31 bytes to bulk endpoint.
Read 141 bytes from bulk endpoint.
Wrote 31 bytes to bulk endpoint.
Wrote 128 bytes to bulk endpoint.
Read 13 bytes from bulk endpoint.
Wrote 31 bytes to bulk endpoint.
Read 2621453 bytes from bulk endpoint.

12-15-2004 05:19:28

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) boodle
Profile
Drmn4ea, I attempted to compile your USBPoker but I can't. It always says...

...raised exception class EAccessViolation with message 'Access violation at address...'
the line was
sprintf(message, "Looking at configuration %d...This configuration has %d interfaces.", c, dev->config[c].bNumInterfaces);

I am trying to compile it with Borland C++ Builder Personal ver 6.0. Any ideas? I think it's a problem with the dev->config[c]

12-16-2004 12:13:05

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) boodle
Profile
brite_eye: when you saw 3.14 M, I would immagine it was a de-bayered image. 1280x860x3 (widthxheightxrgb) = 3.149 M. So maybe the camera does the debayering before it sends the information. It's just a guess, but from the numbers it looks about right.
12-16-2004 14:50:11

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
boodle, you could be right and then again you might be wrong. I may be dreaming but I think I am seeing signs of an Autobrite(tm) Advantage. I doubt if I am Drmn yet - too tired - crtainly no one dreams about being tired. Hope you can monitor threads, answer questions, comment on suggestions and steer visitors to right threads while I shut my eye. I think I beat the $%#^ out of moderator dakotamod - doubt if he'll be back.
12-16-2004 15:23:58

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) boodle
Profile
Sorry Drmn4ea, there wasn't anything wrong with your code. I couldn't find anything wrong with that line, so I almost gave up. Turns out I just had to update my software.
12-16-2004 18:08:52

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
Odd about the error, I'm still using Borland 4.x without trouble (except for unnecessary bondage-and-discipline when allocating a hunk of memory, it demands to know in advance what you're storing there [zeros and ones, duh...quit bothering me about the void pointers already]). I may poke idly around DISV8 looking for an image compressor tonight (looks like same compression in the CVScam), but at the moment the only thing I'll be Drmn about is shooting a few eagles.

@brite_eye: jeez you two, get a room! (Unless you're the same person, of course).

12-16-2004 18:50:40

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Drmn4ea, thanks so much for penguin poker. After being quarantined by daBass and completing last post for my alter ego, I needed a lift. As a long time windows user I just kept poking harder and faster - boy did I get my due.
12-16-2004 21:16:57

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
I may have broken my cam. I have a feeling it may have been the picture delete thing. I recall reading something about a incrementing counter somewhere. Or possibly with the SW1 button.

These are the symptoms: Occasionally reboots after taking a picture (3beeps). The amount of data that I could read using the overflow memory request has been shrinking (CRC error, or Overlapped IO issues) (I was able to read 3 megs originally, now it seems to be less than 1 meg ). I was able to read 124K from the flash, but now It doesn't seem to work.

I have tried leaving the batteries out for a extended period of time, no luck.

I took some of Drmn4ea poker and forced it into a command line app. I was getting tired of playing with the mouse*, and wanted some scripted actions. Holy Globals BATMAN! There are enought in the poker that my code now has some globals because I got tired of removing them.

One question about reading the flash: when you read a block of data do you still get the status codes back with each packet? To calculate the next block, do you just take ((last read size)/512)+1 to calculate the next block? I'm not sure it is me or my dying cam that is having a problem getting the blocks.

My goal is to get it working so I can take a large number of compressed images with slightly varying conditions. morcheeba's $10 take picture command could come in handy here.

*I like the drag and drop, I still find that stuff cool.

12-16-2004 22:47:00

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
Nutters, it's possible that grovelling through the disassembly may not solve the compression mysteries after all - googling for some big SMaL fish finds this particularly interesting blurb: http://www.icassp2004.com/Papers/viewpapers.asp?papernum=2215

Compression in hardware? OK, at least we know there's no hardware compressor lurking in the imager, there is hope yet...

Keith Fife was also involved in a project that sounds like it used wavelet compression for video (haven't read the whole thing). Probably not relevant / helpful to us, but an interesting read. http://www-mtl.mit.edu/MEngTP/Yarosz_Thesis.pdf

@bentfork - Anti-globalization protests, I knew it! Only a matter of time, I guess. (near the beginning of poker source: /* Global declarations - I just know somebody is going to complain about this */ ) Fortunately I have a very good debugger on-hand.

There is definitely a status packet for each read. That sounds like it will work for reading out the flash; since you're automating the process in software (feel free to post a copy ) probably the easiest is to just request 512 bytes at a time to simplify the block-grabbing. (Just don't take my word on this block size; this is just from memory, and mine is much less reliable than flash, lemme tell y'all)

The incrementing counter post was probably from morcheeba re: picture deletion command - my guess is the picture counter is what's responsible for numeric portion of the (IMG_####.RAW) filenames and is not adjusted when an image is deleted--same as the old Blue Dakota, so filenames could have numbering gaps, although I don't know of any reasons that this would have a negative effect on the camera.

12-17-2004 00:26:23

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Drmn4ea, gosh shooting eagles (a bit politically incorrect but so is anti DMCA). You are not dreaming, instead you are making my head hurt with more theses. At least I can now forget about 8x8 blocks "Techniques employing wavelet compression, however, need not first divide the image into 8x8 blocks, and as a result do not suffer from blocking effects at high compression ratios." As to implementation on imager: 1. It is sold as a kit, 2. Keith's thesis defines a holy bit manipulation that still doesn't gel well in my mind, 3. The stop sign at $120000 does not look nearly as good as my recent decompressed one (it may simply be a quickly uncompressed version used to create preview), 4. We are still in the dark on Autobrite®.
12-17-2004 00:54:11

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
brite_eye, boodles -- re: smal/twain drivers

I tried replicating the poker/twain driver thing. I get a BSOD ( DRIVER_IRQL_NOT_LESS_OR_EQUAL ... bla ... uhcd.sys) when I tell the twain to Aquire the image. I'm running win2k with libusb's 0.8.1.1 snapshot. Has anyone else had a bluescreen?

To anyone that did have success, what were the steps you followed to switch to the smal drivers?

On the compression side... the foxz2 driver has the following info inside: US Patent No. 6,660,471 and patents pending. Portions based on libgd, libjpeg, libpng, zlib. So I guess if you mix all of those together add some magic code and you get Autobrite... interesting.

12-17-2004 22:14:23

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Not so brite any more! I can't get pictures off of cameras that have not been reset to ID LaMSSMaL (they do have same uncleared key and appear to unlock with status 0, but ArcSoft Photobase fails)! Reading back through it does not seem that anyone knows exactly what they did to achieve a reset. I have tried everything I can think of that I might have done to reset other cameras. I never opened either of those - just poked them with Drmn4ea's poker. I could try an earlier release of the poker, but that just seems like a waste of time at this point. I am open to any suggestions. I feel like it is poking me back and deserves a hammer from the penguin.
12-17-2004 22:14:45

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mako
Profile
Not sure where to ask this, but this _is_ the questions thread...

To those of you who have sucessfully downloaded images from your cameras, I'm interested in knowing the following:

What's the filesize of each picture? If you've taken 25, do they take up all 16MB in the flash?

Is there EXIF data?

12-19-2004 20:10:05

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
mako, All that gets saved to flash is the compressed image starting at $12000. This varies in size from about 60K to 600K. At first I thought something really odd was happening on my red flatfoto when the pictures remaining count did not drop every time, but I suspect when I am taking highly compressed saturated whites that it would not need to especially when 10 saturated ones will fit in same space of 1 600k file (but, I have lost much sleep and would need to confirm that I wasn't imagining things). The manual also gives approx counts for varions SD card sizes. The Ritz and CVS however may just count each picture and force a stop at 25 (someone should try taking 25 shots 2 inches from a piece of white paper).
12-19-2004 21:55:50

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
@boodle - In the Suggestions thread you posted a $54 cmd in action requesting a picture file. Also mentioned, the file size is sent in dCBWDataTransferLength - did you happen to catch how it gets that file size? Is there another cmd that pulls a file size or directory listing?
12-19-2004 22:17:32

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) daBass
Profile
@Drmn4ea , the file size is taken from the directory blocks of the FAT12 partition.
(The commands that are issued to the camera are first a 5e, checking properties then a
couple of 52's to build a directory tree, then a couple of 58's to change to the correct
directory followed by the 54 command).

About Autobrite(tm). I think we should stop searching for Autobrite(tm) in the compressed
raw files or in the camera code. What I read from the patent claim is that Autobrite(tm)
is totally done in hardware by controlling the voltages to the individual Bayer cells at
the time the shot is taken. It effectively (by dampening or increasing the voltages) does
a different gamma correction for different parts of the image at the time the shot is
taken.

Seeing as it is impossible to make an all black shot, but really easy to make an all white
shot, the Autobrite(tm), if implemented at all, tends to only brighten up areas.

I think the data contained in a .raw is a compressed version of only the Bayer image.

12-19-2004 22:36:29

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
daBass, did you miss Drmn4ea's cutline black - a perfect set of zeros, a black hole, even the 1284-1288 reference bytes are zero in the image at $120000. Sorry for rambling on suggestions thread but I am hoping someone else will play with those numbers primarily inspired by drmns cut line black. If it were not for the 23 extra repetitions in that black I would definitely stop seeking for where it lurks. Also with my Blue FlatFoto (software that allowed first downloaded decompressed processed images off Ritz Red) there is a feature for turning off flash - with it off inside a lead bag I hope to get more zeros. Missed you, good to have you back.
12-19-2004 22:47:46

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
I took my cameras to a friend's linux computer last night. I ain't no penguin, but he is. He received the following errors when trying to make it:
cc -g -O2 -DUSB_TOOL_MAJOR=0 -DUSB_TOOL_MINOR=3 -c -o usbtool.o
usbtool.c
cc -g -O2 -DUSB_TOOL_MAJOR=0 -DUSB_TOOL_MINOR=3 -c -o libusb.o
libusb.c
cc -o usbtool -lusb usbtool.o libusb.o
libusb.o(.text+0x4b): In function `tool_usb_init':
/usr/local/src/USBTool-0.3/libusb.c:54: undefined reference to
`usb_init'
libusb.o(.text+0x50):/usr/local/src/USBTool-0.3/libusb.c:55: undefined
reference to `usb_find_busses'

Any linux hackers on this thread? Are we on the wrong thread? Is ain't no = I is penguin?

12-21-2004 10:55:14

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
dakotamod-- You are probably missing a include somewhere. Here is a dependency graph for libusb. It looks like you dont have libhid and/or hid-usb installed.

You ran ./configure like a good little penguin right?

12-21-2004 11:44:14

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Thanks bentfork, I hope that does it. Have you tried 5 day old release of gphoto with several experimental updates for SMaL cameras? That was going to be our next step. My friend just had voom hooked up last night on his new 56" DLP. Wow what an incredible picture! Even the voom installer said it was the best HiDef he'd ever seen. http://product.samsung.com/cgi-bin/nabc/product/b2c_product_detail.jsp?eUser=&prod_id=HLP5685WX%2fXAA So instead of hacking we spent most of our time glued to Monday night football.
12-21-2004 13:17:57

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) morcheeba
Profile
woowhee! My updates for the last camera are finally incorporated! Thanks for noticing the new release.
12-21-2004 14:49:26

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
Wow, that took a while. That was hacked, lets see...over a year ago! (Otherwise, I wouldn't be freezing my nuts off in Boston right now! well, I'd still be freezing my nuts in Chicago...)
12-21-2004 16:55:20

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
From release notes it looks like they have added some experimental stuff for PV2s and other SMaL cameras.
12-21-2004 17:06:11

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Unsure about these experimental gphoto2 cameras extracted from list of 532:
Thu Dec 16 08:43:09 CET 2004
"Aiptek 1.3 mega PocketCam" (TESTING)
"Fuji Axia Eyeplate" (EXPERIMENTAL)
"Fuji Axia Slimshot" (EXPERIMENTAL)
"PockCam" (EXPERIMENTAL)
"Logitech Pocket Digital" (EXPERIMENTAL)
"Philips ESP80SXG" (EXPERIMENTAL)
"PureDigital Ritz Disposable" (TESTING)
"Radioshack Flatfoto" (EXPERIMENTAL)
"SMaL Ultra-Pocket" (EXPERIMENTAL)
12-21-2004 19:18:14

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) j94501
Profile
dakotamod:

libusb is part of the libusb-dev package on Debian type systems. What Linux distro was your friend using? You should find something called libusb.so or libusb.a under /usr/lib (or perhaps /usr/local/lib depending on the distro).

You might also be interested in the newer version which I uploaded tonight that includes support for grabbing the full 16MB image easily in a new tool. Next step is to try to get a modified mass storage driver so that I can just mount the camera directly

12-22-2004 04:50:36

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
bentfork, I am having no luck with trace - getting following error in wiadebug.log:
====================Start 'sti_ci.dll' Debug - Time: 2004/12/22 07:20:03:724====================
GetDwordFromRegistry: ERROR!! RegQueryValueEx failed. Err=0x2. Size=0x4, Type=0x1d4ce0c
NotifySTIEvent() got NULL cap list from drivers .

Also, can anyone explain why I get what looks like fat when using $54 to read FIRMWARE.BIN. I unlocked then bulkout $54 (FIRMWARE.BIN), then bulkin read 1f1fff. Has anyone been able to read files from root or subs? What sequence is required.

12-22-2004 06:30:42

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) boodle
Profile
In order to download FIRMWARE.BIN you have to first chdir to /, then request firmware.bin and put its length in the command (length can be found by looking at the fat.)
12-22-2004 10:13:26

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
boodle, How much longer before you post a program to read and return a file? I have no desire to plod through such an effort and am sure many others feel the same. From the sounds of it you could have one completed in less than an hour. If so please post unless you are working on a brite_or application - where do you stand?
12-22-2004 11:36:19

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) boodle
Profile
Yeah, I'm going to be working on a program. I have started it but I've had a bunch of other things to do lately. I'll try to get at least a quick version done today or tommorow.
12-22-2004 11:53:33

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Great Great boodle, Tweedledum and Tweedledee will be very pleased that a name so similar will post a key application soon. Of course you will include a call to your debayer routine for file types "boo", then all that remains is a firmware update to bypass compression and alter the 3 character file type. If time does not permit don't worry about unlock sequence, I think someone else will be posting one of those soon.
12-22-2004 12:45:05

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
ForkBoy posted this in suggestions.... the tool works great!!!!! and the disk image viewer works super!!!!
of course its fur windoz.........


I was able to extract images using Synor's method, but my images where all shades of blue.
http://mysite.verizon.net/forkboy/de18^0009.jpg
Any ideas?

To make the working with the camera easier I've written a user friendly utility to unlock
the camera and download the 16Meg flash.
http://mysite.verizon.net/forkboy/PV2Tool.zip

The files can be extracted from the 16Meg image using this freeware utility:
http://www.softwarium.com/divwin.html

I'll post the MSVC++ 6 source after I've cleaned it up a bit.

I'm very interested in decoding the raw images directly and being able to write to the
camera - It would be great to customize the .tft files.

ForkBoy (at)
verizon (dot)
net

12-22-2004 15:48:06

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
Thanks, mike. I overlooked that post. It will help me and others. If ForkBoy doesn't post a new release soon, I'll add to Links 4 all. The software in other versions of SMaL cameras writes jpg files to external flash cards. morcheeba has seen evidence of this capability in the PV2s and we may be able to force it to write jpg files instead of compressed raw files to internal flash - and then ForkBoy's program and the freeware utility will be all that is required to get reasonably good images out of the camera. I plan to post some examples of jpg pictures from an external flash card in my red Radioshack FlatFoto tonight. Anyone with disassembled code (method explained in threads) should post a discovery if they find and understand the logic that disallows jpg when writing to internal vs external flash.
12-22-2004 16:44:04

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
ForkBoy posted this in suggestions.... the tool works great!!!!! and the disk image viewer works super!!!!
of course its fur windoz.........


I was able to extract images using Synor's method, but my images where all shades of blue.
http://mysite.verizon.net/forkboy/de18^0009.jpg
Any ideas?

To make the working with the camera easier I've written a user friendly utility to unlock
the camera and download the 16Meg flash.
http://mysite.verizon.net/forkboy/PV2Tool.zip

The files can be extracted from the 16Meg image using this freeware utility:
http://www.softwarium.com/divwin.html

I'll post the MSVC++ 6 source after I've cleaned it up a bit.

I'm very interested in decoding the raw images directly and being able to write to the
camera - It would be great to customize the .tft files.

ForkBoy (at)
verizon (dot)
net

12-22-2004 17:19:35

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
There is a mad hatter lurking behind my windows. I run 3 instances of XP on 1 PC, one for my wife, one for my son, and one for me (actually they are all 4 me). Up until yesterday I had left my wifes instance free of these camera drivers. I began a process I thought would help uncover mysteries behind intermittent successses. I now have installed, uninstalled, roll backed ... so many times on each of the 3 that everything is clear as mud. I have avoided any install of the Blue FlatFoto drivers on my wife's XP (if I were wise, I would disallow all colors, she fears deletes and thus accumulates, and I may be seeing nasty windows memory messages momentarily). And at the same time, while I can get very nice photos from my Red Radioshack, I can't get a photo out of any other of my cameras, but have managed to reset them all to LaMSSMaL. I wanted to share my difficulties in hopes someone can answer a few questions:
1. Why do the twain options not contain identical text to that placed inside .inf files?
2. Why does windows place names from other .inf files into libUSB-Win32 if I don't religiously not search, specify a location, have disk, browse ..., to exact copy of .inf ?
3. Is there a way to wipe all camera drivers from win's lost memory?
4. Why does windows intermittently ask for reboot when I change the driver?
5. Why am I only one needing 11/18/2004 version of libUSB?
6. Should I close all my windows and install linux - which version?

For now, it appears getting quality images may depend on having once installed a Blue FlatFoto driver; Synlor where is your post for us dummies? Is his clean environment failing like mine did? Has anyone else produced a postable image? Can anyone find a SMaL driver dated later than 8/13/2004 of my Blue FlatFoto. Synlor did you buy a trial Blue FlatFoto? I suggest someone else does (Radioshack graciously allows a 30 day return - but with an added SD card these cameras are a priceless addition to a growing collection of SMaL cameras). Maybe if enough people start buying and returning just to obtain driver - they will wisely post one on their download site.

12-24-2004 02:09:19

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
ForkBoy, I just looked at your shades of blue photo and I think you also have a mad hatter behind your windows - in fact you even have a picture of him turning blue. Time to link last link on annoying thread.
12-24-2004 02:20:06

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Hondaman900
Profile
I'm having a difficult time tracing back through the fragmented postings for a clear description of how to connect and download from the red PV2. Can someone post a numbered list of steps to achieve this. I read somewhere that I can get to the point where generic TWAIN drivers will download images into an app like PaintShop Pro.

Please advise.

Thanks,

Stephen

12-24-2004 18:02:30

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Hondaman900, get on your bike and ride for awhile. The answer you seek will be posted in 1 2 many 4 all dummies, as soon as someone has succeeded in being able to document a processs and another has confirmed it. I have had success using copyrighted software only available when purchasing a $79 blue flatfoto from radioshack. Looks like mike, is running into problems repeating my process - could be due to windows level, driver version, poor communication...

As soon as I become aware of a repeatable process using freely available software, I will be sure that the originator either posts it or gives me permission to post in dummies thread. The fragmentation is a natural occurrence during hacking exercises and if you do not wish to actively participate please only place such comments in the Annoying posts thread (I do enjoy being annoyed in that thread - just look at exchange there between myself and the incompetent idiot dakotamod). I am personally trying to put most of my noncontributory remarks in that thread. I had a personal fantasy/goal to achieve success in time to allow stocking stuffers. That has not happened. I am still expecting a workable solution 4 all to take no more than 2 additional months. In addition to the dummies thread, I believe several of our software contributors will place full easily understood documentation on their sites/pages when a full hack is complete. If you have read through all the posts several times, as many of us are suffering through more than once, and believe something is working differently than described please specify your exact steps along with a Vulcan nerve pinch and if someone can help you they will.

12-24-2004 21:57:16

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
I don't like Photobase - POS ate over 100 of my pictures. I was using it on one of my XP systems which didn't have Irfan downloaded and copied some jpgs from one location to a Photobase Album, then deleted in original location. Photobase without warning apparently just placed a pointer/link or something else that does not produce a picture. I have tried some undelete recovery packages which find most of my deleted photos but either won't allow >64K or more than 1 file per day. I would appreciate any recommendations for a free undelete download that lets me do any size and number of files for atleast one day. Please help me free several snowy pictures from a walk through Lincoln Woods Nature Preserve.

I posted some photos from my Church's (where I was Baptized, received Scouting God & Country badge, and Wed my Wife) Candel light service, an annual visit for me and my lovely lady. I do not consider myself a devout Christian, having instead an open mind with great respect and admiration for all religious beliefs. Interesting numerology this year's Christmas eve date - 12 24 2004 (1 use 2 many use 4 all embedded) and an unusual aside my birthday this year was 04/04/04. Candle Light Service

12-25-2004 10:49:38

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Ansel_Adams
Profile
It seems like I'm close to getting the 25 pictures out of a full Dakota red, except for an error I made last week.

I was using the Poker, opened the camera with the 128 byte script. I set Poker to Bulk Out and wrote 13 bytes to the camera from another script by mistake. The camera still responds to the Poker and PV2tool, but now, disconnected from the computer, the camera gives a 3 descending beeps, flashes a splash screen and then shuts off when the power button is pressed. How do I fixz this?

I started with WinLib 0_8_1_0 and its 20041118 filters, with the modified libusb.inf from the poker package. Using the PV2tool, unlocked camera, then updated drivers with the Foxz2 (using modified inf with 0027). The driver update took 2 tries before it was accepted by the system; it failed without an error message the first time.

Next I went to Photo Impact 8 (similar to Photoshop) to acquire images. The Foxz interface came up, showed 25 Pixz on the camera and the download button was active. Trying to get the images, several error Boxz said "Ugh" and something or other about the format being wrong, and it would stick at loading the first image.. There was a drop-down boxz on this driver that called the camera a 'Legend' model.

My plan, if I can get those 13 bytes to clear, is to start the process again from the beginning, and document each step, and post it to a website.

System: Win 2K sp3, red Ritz Model 410, bought 5/04

12-29-2004 18:22:35

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Ansel, others have documented this problem but I can't remember whether they solved it and can't seem to find it in these tangled threads. If you can get to the legend screen again, select media tab and reformat storage. If that does not work then try Irfan View. Next remove batteries for a while (someone claimed a positive effect after removal - this may have been related to hidden button inside camera). Are you able to perform Vulcan nerve pinch (3 finger salute)? What results are displayed? And if you are gutsy try morcheebas delete command sequence documented on his pages. I have had errors with Irfan View on full cameras that rebooting disappeared upon rebooting. Also I need to select batch conversion instead of acquire when there is more than 1 picture.
12-29-2004 19:01:04

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Ansel, Another thought - My flatfotos have beeped and powered down upon power up when battery is low. The solution then was to recharge by plugging into USB port, but for Pure Digitals you may just need new batteries! The worst a bulkout write using $80 or $52 should have done is to reset cameras key from the standard 128 to 67452301 along with a new ID of LaMSSMaL (try new batteries and a Vulcan never pinch).
12-30-2004 02:19:53

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Ansel_Adams
Profile
Anyone who has a problem with their cameras turning off, what Mr. _eye said. I stole the AAs out of my penlight, replaced the ones in the camera, and there it was, camera full, return for processing. It must have been a fluke that the camera quit working right after I went at it with the Poker.

Vulcan Nerve Pinch = hold all buttons down including the shutter for a few seconds? I got:

Firmware 6410
Hardware 06
TypeId 27
ID LAMSSMAL0000

Woof, now I can get back at it, thanks for the help. Sometimes it's the simplest things right in front of your eye..

12-30-2004 03:06:51

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
I've been busy the last couple weeks, and haven't had the time to play with this lately. It looks like good progress is being made.

binaryweaver managed to extract photos without doing the driver flip!! If this is true it is huge! AFAIK he installed the libusb driver as a filter to the smal drivers. Great work!

I tried modifying my foxz inf files but I wasn't able to get it to work. I am using the latest build 041118 of libusb which has merged the flter driver into the normal drivers. When I look at the driver info in device manager libusb0.sys isn't mentioned in the list. Anyone know where to look for into on driver inf files and filter drivers?

I have some code that can unlock the camera, I have code that calls the twain driver to extract the pictures. I cant figure out the damn libusb filter stuff. If someone can figure this out we could be close.

Has anyone been able to replicate binaryweaver work on a dakota Red? What version of the drivers were you using.

01-04-2005 19:42:05

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
I have tried binaryweavers driverx.inf on winxpSP2.....I have been unable to get it to work.....
01-04-2005 20:28:27

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) binaryweaver
Profile
Driverx.inf is by no means a final solution. Even with my computer, sometimes PV2Tool crashes immediately and it takes several unplugging and replugging of the camera to get it up. Once PV2Tool loads, unlocking the camera sometimes takes a few attempts and Photoshop reports the camera in bootloader mode. Using the PV2Tool to first download the flash image usually kicks it out of bootloader mode and then the TWAIN import in Photoshop will allow me to grab the images. I can get the images off my camera everytime, but sometimes it takes me 5 to 10 minutes to get the right combination of events together to make it work. It's a learning process. That's why we're all here sharing our experiences. I'm hoping that someone could analyze driverx.inf and figure out what information in there is crap and what information works. After reading that people had success with driver switching, I had the idea of just combining the SMaL driver with LIBUSB in one single INF file. I didn't know what to expect, I was just experimenting blind.
01-04-2005 21:02:34

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
bentfork came back with what seemed an easy challenge. Now I need someone to tell me to be patient and not smash both a red and blue CVS. I have tried both on an XP SP1 and an XP SP2 instance on my PC and no luck and they seem to fail in different places - argh! I am tired of the old switcharoo and was looking forward to binaryweavers method, looks like I probably didn't say the right cuss words. When morcheeba is done with his firmware update, I think we will need to suffer through some difficulty uploading but once done we will be able to plug on any system with Foxz2 driver installed with no need for libusb or driverx.inf or pv2tool ...
01-04-2005 21:33:53

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
brite_i dont break your cameras, you'll regret it in the morning. Connecting them together and making a chimera would be cool, but probably a bad idea also.

I tried using forkboy's tool on win2k but it crashed my win2k machine. I have caused similar crashes on my own so I think I know what the problem is. I haven't had the time to grab his code and debug it to see for sure. There is some known odd behavior with win2k and USB and various windows updates. Most of it having to do with KMODE_NOT_LESSTHAN_EQUAL. Which seems to be something odd with libusb, and (win2k + various windows updates)

binaryweaver thanks for the info on the driverx behavior, that helps. Have you been able to get snoopy running on your machine? A dump of the first few hundred Kb of the transfer process could be useful.

01-04-2005 22:12:10

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) buster
Profile
It seems that so far there is no reliable solution that works for everyone. I have access to 3 different systems and was only successful on a laptop with xp pro sp2. I tried the driver switch and could not get the camera out of bootloader mode.

For those that would like to try the driverx method I can relate my experience with my reset CVS red 6520. I started by deleting all previous driver files

1) I am using default installation of only libusb filter version 0.1.8.0
2) My version of driverx works with only 4 lines added.
[SMALUSB.models]
%USB\VID_0DCA&PID_0027.DeviceDesc%=SMALUSB.Dev, USB\VID_0DCA&PID_0027
[SourceDisksFiles]
libusb0.dll=222,,
[SMALUSB.CopyWIAFiles]
libusb0.dll
[Strings]
USB\VID_0DCA&PID_0027.DeviceDesc="CVS Red Foxz2"
3)Newest PV2Tool seems to unlock more reliably than the old.
4)I could not get Irfanview to download until "unlock,unplug,reboot,plug,unlock,download"
5)ever since all I have to do is unlock and download

I would rather use a GPL driver and will continue trying other methods but this is working for me now.

01-04-2005 23:03:31

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
buster, It works in all colors and flavors - red blue sp1 sp2
My biggest problem was updating the wrong foxz2 inf file - after runing setup.exe in driver folder the files are installed to Program Files under Che-ez! Foxz/driver. buster, please post your process in "Success - 1 2 many 4 all" thread.
01-05-2005 01:07:16

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
Still trying to get binaryweaverdriverx to work ...to no avail......
Useing switch driver method...A first 4 me I finally got a download using Irfanview,,,BUT..totally BLUE
you can make out black images within the blue..this same type of download
has been posted before
01-05-2005 08:06:23

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
mike and others, I have created a new thread CVS Red & Blue - 1 2 many 4 all, with the best method I have found - it has not failed yet!
01-05-2005 08:44:39

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) virtual
Profile
Hi, long time lurker first time poster.
I was able to get 4 cvs reds that where already processed “Ready to Recycle”.
Will these work with the techniques being tried here? Is there a way to reset them, or do I need to buy fresh ones?

Like someone mentioned I thought these would make for a cheap panorama rig.
I’m an amateur sculptor and I wanted to make a rig to shoot my models from a few angles at once.
If these used cameras work I would like to get a few more so I can have a 8 camera rig but if not I won't waste my time getting the used ones and I’ll pick up a few new ones.
Thanks for any help.

01-05-2005 21:06:13

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
virtual, I doubt if there is any harm in trying. If 1 of 4 works they all should. morcheeba may have some suggestions, but he may not see your post or even mine for several days. Do they respond to a Vulcan nerve pinch (3 finger salute)? If so please post results.
01-05-2005 21:49:11

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) virtual
Profile
Here are 3 of the 4 Pinches (the 4th camera is apart right now)
I get the following with On+Display+Shutter

Camera 1
FIRMWARE 6520
HARDWARE 06
TYPEID 2B
CMP TYPEID 2B
ID DB1043827296
REALM ID 20

Camera 2
FIRMWARE 6510
HARDWARE 06
TYPEID 27
CMP TYPEID 27
ID DA6043201697
REALM ID 20

Camera 3
FIRMWARE 6510
HARDWARE 06
TYPEID 27
CMP TYPEID 27
ID DA4043201383
REALM ID 20

01-06-2005 00:34:29

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
Is anybody using FOXZ2 driver with the CVS BLUE cam??????? I get unknown cam and BLUE/black image...
examining the driver I do not see Accord type 28 [which is what flatfoto shows]...........

I finally got foxz2 drivers to work with the type 27 ....and yes the tif pictures are better
[background noise/pixels?? gone] than I extracted with flatfoto however I think they could be more defined...same for jpg except clarity is worse ,, also flat jpg=489kb foxz2 jpg=189 for same picture....the foxz2 is close but I don't think this is it......

01-06-2005 07:37:19

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
CVS Blue 28 is working fine for me with Foxz2, even my blue flatfoto works fine with Foxz2 - the drivers are almost identical with 2.0 megapixle capabilities. mike, have you slid the option jpeg % to 100? To the right of file type selection in Irfan view is an options button.
01-06-2005 09:17:49

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) paganpat999
Profile
OK I've been monitoring this thread forever, and barely know how to turn a computer on! I've had my ole blues for some time with success have taken many pictures with them. I've tried using the ole blue cable I made with the PV2 to try to unlock it. I've tried different USB ports fresh batteries everything, and using Windows XP. It use to recognize that it was a camera but it's not been doing that now, I really should have waited I guess for the smart guys to make the "idiot proof software" like with my oie blue. My question is when you guys are done making the software will it unlock automatically? I originally got my PV2 from Ritz cameras and got it right after they came out. At least I know I'm the token idiot on the site. So you should try your new software out on me when you are done. If I can make it work anyone can! LOL
01-06-2005 12:07:36

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) ygfperson
Profile
hi, i'm wondering what the usb-to-camera pinout is for the cvs blue. i'm guessing 6,8,9,10 like the original blue but i keep seeing that that hasn't worked for some people. could someone answer this clearly and possibly put the answer in some convienent place for others to see? sorry if this has been answered already and i've overlooked something
01-06-2005 13:09:46

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
brite_eye
What is the name that is shown for your CVS Blue when using FOXZ2
mine says unknown camera,,,and all I can extract is the BLUE screen with faint black images..
The FlatFoto will extract fine except for noisy pixel look....
01-06-2005 14:09:48

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Cable pinout has not changed since original blue - I think you can follow links on morcheeba's pages.

Mike, did you ever unscrew Blue case insearch of hidden buttons? I have seen the unknown, but currently do not know what it is that works fine.

01-06-2005 14:36:51

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) insomniac40
Profile
I am trying to recreate busters success 1 2 many 4 all with CVS Red. I got all the way thru his procedure to step 11 successfully (with ready light lit and beep sounded) but then when I tried step 12 to execute PV2Tool from program files\pv2Tools (the folder I extracted to) I get "Application has encountered a problem and needs to close." I have not run this program before and was hoping someone could tell me if I need to put the application in a specific location or something before I execute? Probably seems like a dumb question to all you geniuses but I was hoping to contribute to the effort to post a repeatable procedure in 1 2 many 4 all Dummies (seeing as how I'm a dummy and I had some spare time on my hands I couldn't resist trying). Hope you guys don't bash me too bad! But a response would be nice.
01-06-2005 15:25:03

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) insomniac40
Profile
paganpat999,

Look over in success and have a go if you have the cvs red. The ritz blue and the cvs blue are the same I have both in front of me right now.


insomniac40
There will be plenty of time to sleep when we're dead
01-06-2005 15:30:55

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) insomniac40
Profile
ygfperson,
Try this

http://www.chrisgood.com/rcplanes/aerial_photos/dakota.html

As was stated the wiring is same ritz/jvc blue/red new/old

01-06-2005 15:38:25

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
I did not put it anywhere special and just click on it to execute. Try with and without camera plugged in. Unplug, Reboot, keep unplugged, click on pv2tool, plug - what happens? Close pv2tool, unplug, reboot, cuss, reboot again, stop all automatically started applications, reboot again, plug, get ready to cuss, cross fingers, click on pv2tool. I have seriously followed a worse sequence. morcheeba we need your latest and greatest one time firmware update to avoid all of this - please be a living nonsleeping genius and complete this project.
01-06-2005 15:39:08

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Thanks, insomniac40. I think most use 10 (2, 7 or 10). Has anyone verified they are all equal and connected to a common ground? I am also beggining to wonder if there are cpu usb timing issues - I use a USB 2.0 port and a 2.0 Ghz celeron overclocked to 2.6 Ghz. I also have paging completely turned off with 512M of memory. Everything seems so simple after finally getting busters changes working on both XP SP1 and SP2.
01-06-2005 15:50:02

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) insomniac40
Profile
No luck rebooting but the driver still seems to be working. I tried donwloading images with photo impression but nothing. Based on all of your volume of experimenting it obviously needs to be unlocked with PV2Tool.

I am using P4 2.2Ghz with XP professional SP2. Maybe I should use my daughters computer running 98 on a P2. Or tonight I'll have to try it on my P4 laptop running XP Home. Lots to try but I have to go make dinner right now. Later!

01-06-2005 16:07:34

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
brite_eye
What is the name that is shown for your CVS Blue when using FOXZ2
mine says unknown camera,,,and all I can extract is the BLUE screen with faint black images..
The FlatFoto will extract fine except for noisy pixel look....
01-06-2005 16:28:01

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) buster
Profile
insomniac40 and others,

I have to confess that I have tried my camera on 3 different pcs and have only had success on one of them using the method I outlined.

System 1) Dell Inspiron 5150 laptop running Windows XP Professional SP2= Everything smooth and can repeat installation process.

System 2) Dell Dimension 4800S desktop running windows XP Home SP2= From time to time I can get it to download flash using PV2Tool, but always get "operation not permitted in bootloader mode" when I try to download via irfanview.

System 3) Homemade 800MHZ Pentium Tower also Windows XP Home SP2= Seems similar to your results. When the camera is plugged in I cannot start pv2tool without program error asking to report problem to microsoft. PV2Tool launches fine without the camera connected, alas no pictures.

Rest assured I am trying to make sense of all this. I am no expert in debugging but my error message on system #3 does output more details on an address where pv2tool.exe failed. My programming is quite rusty and my eyes spin at streams of hex numbers but I have patience and persistence and the source code on my side. I will find out how to make system #2&3 work.

brite_eye- are you on XP professional or home edition?

01-06-2005 17:44:39

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
mike, I thought your unknown question would be a snap, but what a bunch of crap - first all of sudden pv2tool is crashing, Ok I reinstalled flatfoto this morning for some color bar decompression shots - so figured I needed to remove it - it is stubborn and after many failures I just deleted directly from windows/system32, but still pv2tool was crashing, and I couldn't get my "CVS Blue 27 bust" string no matter what - lots of CVS Blues and CVS 28s from earlier attempts but my most recent bust was hiding - so control panel repair che-ez, no luck, so control panel remove che-ez, then run downloaded Che-ez setup again - pv2tool still crashing, unplugged camera and happened to see HP scanner on pv2tool screen - $#!t my wife left the all in one printer, copier, scanner turned on. Turned it off and no more problems - was all the above completely fruitless? Oh well I have an answer mike - it is unknown. All others I highly recommend turning off all other USB devices!

mike, I debated whether to even begin trying to answer your question since while scrolling down to see morcheeba's latest additions to discoveries (boy scrolling is slow) I noticed one of your prior posts - Are you sure you didn't fry your blue? That was all I going to say, but after noticing morcheeba's credit to your $80 observation I felt you deserved to know my unknown. I still think you may have fried your blue when you:
Notes on new blue..... Did all black [covered lens] black? data appears to start at e0000 and stopped 1eed7f
could not determine where compressed data is ...... tried poking around with usb cmds leaving len 270000
$80 returned 269 bytes and 00 status others most of time dumped same as $52
tried $19 with firmware.bin noticed nothing unusual...


insomniac40, I'd rather not answer such personal questions about my XP but if it helps it was a pre-release Corp Pro last beta basically complete that an MS employee posted in wrong place which I only use for educational hacking.

01-06-2005 20:50:47

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Slight mistake above it should have been "CVS Blue 28 buster". The two che-ez foxz2 photos for CVS Blue of my basement floor look very good - perhaps better than any of my others. I wonder if Blues without LCD hardware have less electronic noise buzzing about. Again in summary on future attempts turn off all usb devices, control panel remove, delete from windows/system32, run foxz2 setup remove, then run setup again, create driverx.inf and if it works let us know.
01-06-2005 21:08:37

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
Looking at Morcheeba's modfile's 6410 remove $80 and change Pid

Looks like.....Others verify please
Firmware.bin Morcheeba 6410 CVS_Blue = 6430 CVS_Red = 6520
$80 change ABS Addr> 6912 = e0 01 ABS Addr> 68F8 = e0 01 ABs Addr> 690f = e0 01
6914 = c8 21 0f 68fa = c8 f5 0e 6911 = c8 f5 0e
6917 = b9 68fd = b9 6914 = b9
change 6913 = 02 68f9 = 02 6910 = 02
CS 1f1ef old = CS 1f1ef old = CS 1f1ef old = 49 DA
new = new = new = 4A DA
CS 3ffe old = CS 3ffe old = CS 3ffe old = 84 67
new = new = new = 84 67

Pid byte 6af7 = 27 [Not understand this 6add = 27] 6af4 = 27
[ see no ref 0dca 0028 ] need look more..

Morcheeba... do we need to change the CS @ 3ffe ?????? I'm unclear about this.......

Forkboy...how about addin mod to pvtool to be able to select 3 buffers to write
...lower cs block, changed block, upper cs block
...I can hand patch the blocks...

01-08-2005 08:13:07

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
Looking at Morcheeba's modfile's 6410 remove $80 and change Pid

Looks like.....Others verify please verify
Firmware.bin Morcheeba 6410
$80 change ABS Addr> 6912 = e0 01
6914 = c8 21 0f
6917 = b9
change 6913 = 02
CS 1f1ef old =
new =
CS 3ffe old =
new =

Pid byte 6af7 = 27

Firmware.bin CVS_Blue = 6430
$80 change ABS Addr> 68F8 = e0 01
68fa = c8 f5 0e
68fd = b9
68f9 = 02
CS 1f1ef old =
new =
CS 3ffe old =
new =

Pid byte [Not understand this 6add = 27]
[ see no ref 0dca 0028 ] need look more..


Firmware.bin CVS_Red = 6520
$80 change ABs Addr> 690f = e0 01
6911 = c8 f5 0e
6914 = b9
6910 = 02
CS 1f1ef old = 49 DA
new = 4A DA
CS 3ffe old = 84 67
new = 84 67

Pid byte 6af4 = 27

Morcheeba... do we need to change the CS @ 3ffe ?????? I'm unclear about this.......

Forkboy...how about addin mod to pvtool to be able to select 3 buffers to write
...lower cs block, changed block, upper cs block
...I can hand patch the blocks...

01-08-2005 08:25:16

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) insomniac40
Profile
B.E.,
Thanks for info about other USB devices crashing PV2Tool. I'll give it another go with my other devices disconnected and report on my findings with CVS red.
insomniac40
There will be plenty of time to sleep when we're dead
01-08-2005 10:28:47

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Verified, Mine is identical to mike's (assuming he has fat fingers - 1f1fe instead of 1f1ef, for 49 DA).
I suggest that the 6520 CVS Red receive the most attention. It is the most popular and it is available with $5 coupon http://www.cvs.com/CVSApp/cvs/gateway/promotion?pid=5735 good till end of this month (add indicates instore coupon - I printed one and used one from stack in store to obtain 2 of my Reds). good work mike. morcheeba doesn't need any more compliments from me (I have called him a living genius at least 3 times). I am willing to risk a fry as soon as a firmware block update verson of pv2tool is available.

Drmn4ea, I had been thinking the ulimate solution would include either a firmware upgrade decompress, or software download decompress. But if anyone can finish what you have started and interface an imager to another chip - there will be no need for Fife's confusing patents - certainly the utlimate solution.

01-08-2005 10:56:58

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) insomniac40
Profile
I never realized how many dern USB devices I had connected untill I started disconnecting them! 6 at last count. The HP photosmart printer was the hardest of my USB devices to uninstall because when I disconnected it I kept getting the NTLDR missing message everybody hates so much. But I just reconnected and kept uninstalling everything and now ureaka the PV2Tool works. FYI if you run the Libusb test you should see no devices found with everything disconnected. Now I'm starting at the beginning of the buster procedure for CVS Red posted over in success. Thanks to Brite_eye for info on USB conflict.
01-08-2005 12:10:56

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) morcheeba
Profile
I'd be all over the cvs camera, except they only put them in sucky states. OK, I may be a little biased. I just moved to MST from the east coast, so it'll be a while before the novelty wears off.
01-08-2005 17:01:04

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) taytrr
Profile
There's plenty of both at the local Longs here in Sacramento -- I'd be glad to help you get some. There are no coupons here though, 9.99 and 19.99 last time I went. Maybe someone in one of the areas with coupons could help? e-mail me at my id at comcast dot net, my id is taytrr, if I can be of help.
01-08-2005 17:12:26

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) tux_va
Profile
I am reading all about to download the red CVS camera however I have followed the links given to unlock the CVS red but when I try them on my Ritz Red camera I get unlock failed using the PV2Tool program. Firmware 6410 HW 06 Type 27 ID daa041901038. Any suggestions?
01-09-2005 19:37:25

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) insomniac40
Profile
Thank you everybody!! I have finally downloaded repeatably images off the CVS Red (picture post in success)on both my XP Pro P4 2.2G USB 1.1 and now my Win 98 P2 machines (see /https://home.comcast.net/~petermac/Picture2f.jpg ) using busters procedure. Only thing is Irfanview is not working with Win 98. So I am using Kodak Picture Easy 3.1 (which has less than desireable compression algorythm)and Foxz2 driver. Anybody else working with Win 98 platform? I like it better because I have no usb devices on it, no reboot issues/usb conflicts (and I can get my printer back on line). You definately need to get the usb bus clear of all other devices as brite_eye observed using busters approach. As mention already somewhere else you want to run the libusb test to make sure no other usb devices come up or at least that's been my experience so far. I am running USB 1.1 just FYI. On my XP Pro I have this HP photoprinter that is boot configured (I haven't figured it out yet) and I have to work around it by booting with it plugged in (or else I get an NTLDR missing error) and then disconnecting it before XP loads (this way it doesn't try to plug and play) and libusb will recognize camera as first USB device. With this setup I have to uninstall libusb each time (only because of my boot loaded usb printer)but it's pretty easy because the uninstall seems to work without having to go manually searching for remnants. Next step will be trying to obtain enough info from the geniuses to get the CVS and Ritz blues working (I have one of each). Just a side note I am waiting on a servo switch (the shutterbug switch)so I can get this sucker airborne to get some aerial photos. I might mount two of them to get a panorama view. Anyway, that's my purpose and the reason I got involved in the first place. morcheeba, you want a CVS red. I'll get you one, my pleasure. Just let me know.
01-09-2005 21:24:15

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) insomniac40
Profile
tux_va,
I am a dummy. That said, what I am going to do is insert 28's (for blues)where busters procedure shows 27 (for reds)in lines added to the smalunhj.inf. If I under stand it correctly, you then say a prayer to the one and only your choice (to be politically correct) and let it roll. Sounds like you got PV2Tool to work so probably no usb conflicts. When I had additional usb devices recognized (i.e. my HP printer) as such by libusb I could not open PV2Tool at all just like Brite_eye suggested. Hope that inspires you to keep trying because not too many blue pictures published yet. I really like the images downloaded using Irfanview and would like to use that on my 98 machine to avoid the conflict. Please help.
01-09-2005 21:40:50

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) insomniac40
Profile
Oh, just an observation to those reporting that they can only get a couple of images off before it hangs. I have not had that problem with XP Pro usb1.1 and irfanview but I did observe it hang during download on the Win98 machine (old usb version)when trying to get images off using kodak picture easy 3.1. But when it prompted me to try again, no problem. Just FWIW. So maybe usb speed / other usb traffic could produce variable outcomes. Also for those saying images not deleted, I had no problem with that. And I just cranked the filter output resolution up to 100%. Nice images for a 1.3Mpix. I can't wait to get it airborne.
01-09-2005 21:55:41

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) stk966
Profile
hi all,
I'm just wondering.... has anyone gotten the che-ez foxz2 drivers working with win2k?
Checking the dependencies of the smal*.dll's seems to indicate it expects to use
WIASERVC.DLL instead of the sti stuff.
01-09-2005 22:12:05

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) morcheeba
Profile
My "modify the camera, not the driver" hack was only tested with W2k & the Fox z2 driver. That's not much info, but there don't seem to be W2k/Foxz2 incompatibilities.
01-10-2005 01:00:28

New MessageIncompatibility with Original Dakota (modified 0 times) chiusano
Profile
While attempting to use the procedures descrbied for the PV2, I have noticed that the foxz2 and libusb driver methods for the PV2 seem to make the original dakota camera unrecognizable for windows application for the original Dakota camera.

What am I doing wrong?

01-11-2005 14:08:01

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) ygfperson
Profile
Hi, If the camera is full (i'm using the cvs blue), does that cause problems? I pushed the power button and I got a half-second beep, without anything turning on. I'm guessing it's the camera's way of telling me that it's full, but i want reassurance since i did a bit of resoldering and i want to make sure i didn't damage anything.

When I plug the camera in, I get the same beep, followed a second later by a higher-pitched, shorter-duration beep, and windows recognition. It's different from the regular two-beeps with the same duration each. I can't seem to unlock it with pv2tool. (It recognizes the camera, it just never unlocks.) Would this result from it being full?

01-11-2005 23:51:54

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
ygfperson at rpi, You might just need new batteries.
01-12-2005 00:00:48

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) ygfperson
Profile
tried fresh ones, no difference.

what does the camera do when you've taken the 25 pictures? does it show a 0-pictures-left in the lcd display, or does it not turn on, or something different?

01-12-2005 01:41:28

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
ygf, just took another 25 whiteouts on my CVS Blue. Wait a minute ygf - do we have a rpi young girl female success? Boy that room was mess, probably not. My Blue showed "00 remaining" and a "return for prints", no green light, powers on and off just fine, and downloads without any difficulty. I still suspect bad batteries, a short, or maybe you got to close to a cold fusion bubble. "According to the new data, the observed neutron emission was several orders of magnitude greater than background and had extremely high statistical accuracy." from http://www.rpi.edu/web/News/press_releases/2004/lahey.htm . When you do get a new Blue working please provide some extended dynamic range pictures of bubbles at temperatures of 100 million Kelvin.
01-12-2005 03:11:03

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Hold on, didn't morcheeba ask to tangentlly join the lovein? Assuming he meant tangentially (probably misspelled due to over excitement) join a lovein, I think he has even expressed his desired geometrical relation with a Young Good-looking Female.
01-12-2005 03:45:25

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bobhope
Profile
Is it normal to get 2 listings in the top left hand box of PV2Tool while the camera is connected, or is my cable wrong? I run PV2Tool with no camera connected and nothing shows up. then I close it plug my camera in and two cameras show up. the first one will unlock but the 2nd will not, it fails. on a 2000 laptop. can't get PV2Tool to run on a XP tower, shuts down the whole computer as soon as I launch it. just wondering if any one else has encountered this. I have seen some posts that come close but the same, and I am stumped.
01-12-2005 10:01:52

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) bentfork
Profile
bobhope - That seems to be normal. The camera says that two end points are available.

I had some success today. I took out a virgin camera I had, tacked some wires to it and Zooom. I was able to extract the flash. Some time ago (mid/late december) I must have toasted my older red. I could unlock it, but download the flash or do anything else. The new camera is working fine. Its really annoying as I thought that my code was broken.

I used forkboys PV2Tool build from source with the latest usblib.

01-12-2005 13:28:05

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) ygfperson
Profile
I guess i did short something out, although i don't know how. The only things i messed with were the usb pins. Eh, I'll just get another one, possibly a red if i can find it. This time around I'm getting a palm iii cradle so if anything shorts out, it's in that.

Sorry to disappoint, I'm a male. The ygf doesn't stand for anything. I just hit my keyboard and those three letters appeared, and I tacked 'person' to the end of it.

01-12-2005 14:11:53

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
You must have keyed in reverse - fgy short for foggy-person. Currently so thick here in Detroit, I can't see Canada. I am not disappointed - already have my once, twice, three times a lady. Hope Drmn4ea, morcheeba, and others are not disappointed at lack of a brilliant young good-looking f.

This should be last post to this long thread. Please use new Bits Bytes & Beyond thread from this point forward for difficult technical questions. For simpler CVS issues continue using CVS Red & Blue thread. Be sure to keep posts brief with minimal white space.

01-12-2005 15:00:00

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dakotamod
Profile
brite_eye, put your glasses on and face the river - Canada is on the other side! I'll just take my glasses of and ignore your silly thread rules.

Ah, my turn now since the Ritz Dakota belongs to me and brite_eye is stupid as $#!+ (just love the way those symbols imitate real letters). I want to code a 1 block patch and need a Windows version of morcheeba's disv8. I vaguely recall someone posting a windows compile but cannot find it. If necessary I can dig up an old MS C complier and make a make, but time is short even when using a stupid clone slave. Oh and after the initial 1 block training, I plan to overlay delete button function with a focus aid display. But before that can work I must twist and twiddle through Fife's bits. Darn, I had hoped to sail instead of losing sleep on that - sailpix must have blown out sails. All of mine are blown out too - anybody else have time to decompress?

01-15-2005 07:35:22

New MessageRE:Questions - 1 2 many 4 all (modified 1 times) sailpix
Profile
Sails are fine here... but wind of new ideas has faded away. I'm in the lee of lack of lucidity.

I'm still hacking at reproducing the compression of white images - but I can't reconcile bits of variation in the compressed .RAW file data with less varied bitstream which comes from "following" patent app's vague compression concepts. I'm about to switch to analyzing the TWAIN or WIA drivers for decompression routines there - would provide puff that gets us to the mark.

- sailpix _/)

01-15-2005 15:33:45

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
which way do I move the Lens to get the ultra closeup's ,,,toward the imager or away from the imager
What is being used to hold the shutter onto the lens ?? doublesidded scotch tape??
what appears to be the best lens position ,,flush with housing,,recessed into housing,,x screwthreads
above housing????
..Is there any way to attach an external lens to get the good closeups???
01-15-2005 20:19:12

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
mike, I completely unscrewed lens, then used dust off. Hey sailpix that could puff out your paren (\_ C\_ .

If my memory is right, I screwed lens back in just a couple of turns before taking picture of my eye with camera inside. http://www.photo.net/photodb/photo?photo_id=2980060 . There was not much glue and I jammed shutter assembly between black blob and lens holder. Also cut away flange over lens on case, screwed it all back together and am using a binder clip pictured in my photo.net portfolio to manually focus. http://www.photo.net/photodb/photo?photo_id=2980053

For even close closeups on old blue dakota I created a small plastic cylinder to hold reversed lens over imager.

01-15-2005 23:10:07

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) sailpix
Profile
For now I've put aside trying to figure out SMaL's compression from the patent app - there's just not enough info there. If we ever get any more tidbits of information, then I should be able to quickly test out that new knowledge, but it's not there yet.

So... in the interest of finding new knowledge about the camera's image compression, I've been digging into disassembled listings of the code the supply. The files I've looked at the most so far are the FlatFoto TWAIN driver DLL (flatfotoTwain.ds) and the Foxz WIA driver (smalcnhj.dll).

Since this is assembly language, there's not much to go on. My x86 assembly skills are marginal at best - but getting better every day. What seems most helpful - so far - is observing which strings in the code are being used. This can often give me an idea about whether I'm looking at U-I code (which I don't really want to study), whether I'm looking at code for a linked in library (they seem to libraries included for JPEG, BMP, TIFF, PNG, PCX, and other stuff - makes sense for writing these), or whether I might be near the decompression code.

I've formulated several questions from my explorations - any help is appreciated:
1. I really need to better understand the exact sequence of the data flow. I know the images are in SMaL's .RAW format on the camera. For use they end up as .BMP or .JPG on your disk - or fed straight into an app via the TWAIN API. I need to figure out a bit more about what happens in the middle.
Particularly - is the .RAW data from the camera pulled to the PC and stored as .RAW files anywhere? Or, does this all happen straight through memory?

2. The FlatFoto TWAIN driver has strings to write out what looks like debug logs - anyone notice any log files when using this kind of TWAIN driver? Filenames I've seen in the code are: "c:\twsrc.log" and "c:\ancillary.txt" Do these show up for anyone? If so, please post the files here! Perhaps I'll have to dig more to find out the magic registry keys to set that enable this logging.

3. One thing that gets logged is the camera's serial # - I assume this is the DAAxxxx number. Are there any links here where there is a .RAW file (or full memory dump) which came from camera where the serial number is clearly identified? (yep, this would have to be before yer serial got "reset") I suspect that some of the unknown areas in the .RAW header might contain the serial number, but I don't have the pieces to look for this.

I have a Pure Digital PV2 from Wolf Camera (owned by Ritz), but I haven't yet gone down the path of wiring it for USB and wading through the USB drivers/FLASH/etc. chaos which others are slowly sorting out. But, I think this might be in my future soon in order to sort things out.


- sailpix _/)
01-17-2005 11:59:33

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Has anyone in Windows world compiled morcheeba's disassembler? If so please post a link in "Links - 1 2 many 4 all" to an executable. Otherwise could someone with an installed C compiler please compile and post a link.
01-18-2005 13:11:09

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
sombody compiled it,, there is a link somewhere,,I downloaded it ,,sort of tried it,,but have forgotten filename and where I saved it...
01-18-2005 14:25:21

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
mike, are you sure you tried it (sort of tired tried it maybe?). Perhaps you did the same as I and just downloaded morcheeba's firmware.comments to see his mind in action. Please if anyone has compiler and a half hour - use it and provide a link to an executable.
01-18-2005 15:03:12

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
see bentfork here.... 12-12-2004 18:38 or search win32
01-18-2005 15:58:16

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Drmn4ea
Profile
I made a win32 port of disv8, and I know someone else did too. But both are returning the identical (incorrect) results, and I haven't yet figured out why (or had time to really look into it). Only bits and pieces of the code actually disassemble using the windows-ized versions. I'll post an .exe once I can get it working with correct results.
01-18-2005 18:37:05

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) boojiboy
Profile
Drmn4ea,

I saw the same thing when compiling disv8 for Linux. The problem is in disassemble_pass_zero().
Apparently Apple madde their version of memcpy smart enough to handle overlapping source and destinations.
other implementations copy memory in chunks, and corrupt memory in the process. Fortunately, this is an easy fix:

change:
memcpy(&mem[m1], &mem[m2], m3); // security risk!

to:
{char *tmp; tmp=(char*)malloc(m3); // create temp buffer
memcpy(tmp,&mem[m2],m3); // copy from memory array to temp buffer
memcpy(&mem[m1],tmp,m3); // copy from temp buffer back to memory array
free(tmp);] // destroy temp buffer

and you should be golden.

01-19-2005 12:21:42

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) morcheeba
Profile
Guess I should have used memmove instead of copy. When I wrote the code I knew that I wanted the one that handles overlaps, but my manpages weren't working & I wasn't connected to the internet at the time so I didn't look it up. Yeah, yeah, excuses, excuses.
01-20-2005 21:59:36

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
Has anyone pursued I2C to extract bootloader from the camera....???? I havn't found any good tools/hdw yet
to see if other pins 1-6 may be for I2C...just a thought.....
01-21-2005 18:17:21

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) binaryweaver
Profile
If anyone is interested, here is a link to TI. It's a 8-bit I/O Expander for I2C. I ordered a few free samples about a year ago when I was playing around with Micromints Domino modules.

http://focus.ti.com/docs/prod/folders/print/pcf8574.html

01-21-2005 18:38:10

New MessageRE:Questions - 1 2 many 4 all (modified 1 times) buster
Profile
I have been doing some tinkering with my soldering iron inside my CVS red t27, 6520. I managed accidentally to break it so that it would not turn off. After some more tinkering I was able to get almost everything working normally. I am not sure if this is the way it worked before but the shutter is now open the entire time the poower is on. It closes as soon as the power is off. I didn't notice that before. Is that the way it is supposed to function? I want a reality check before I do some more damage.

About the flash bulb circuit: It seems relatively easy to put an on/off switch on the top of the case to either short or break a connection. I am not too familiar with flash circuits to know where a safe and effective place in the circuit would be to wire the switch. Here are some ideas someone may be able to comment on.
1) shorting the primary of the transformer I see near the big cap.
2) in series with one of the wires to the flash bulb to take it out of the circuit.
3) in series with one of the leads of the capacitor?

02-02-2005 08:37:19

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) tango
Profile
buster - I have two T27-6520. They both open the lens cover when the power is on, close it when powered down.

Not sure about the flash circuit question.

I do not believe you want to try and interrupt the high voltage from the capacitor to the flash device.
I think disconnecting the flash charging circuit would not give the desired effect (the flash may charge before you decide to disable it)

I think you want to switch the signal that triggers the flash discharge. I have not looked at the flash circuit myself, so I cannot give you any guidance on locating it.

02-02-2005 09:54:20

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) ThaLizard
Profile
I believe there was some mention of this in one of the earlier threads, but I was in a CVS yesterday and they had one of the Pure Digital (TM) returnable digital camcorders for $ 29.99. The packaging said it would record up to 20 minutes of video, and of course you had to return it to them for processing to get a DVD of your grand production. The packaging made sure to mention that you did not get the cam back with the DVD. It was a bit larger than either of the still cameras, but I could see this hanging from a kite or on board an RC plane. Or suspended a couple of inches from the road's surface underneath your car. Many other normally cost prohibitive uses are easily imagined. Just when you thought it was safe to stop hacking hardware.....
There's one born every clock cycle nowadays....
02-03-2005 22:16:39

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Ansel_Adams
Profile
Wow, the CVS stores here in Pittsburgh have no OTU digital cameras, let alone camcorders. I went to 5 stores to check (and try to use the $5 coupon), but they didn't even have the developing stations for the cameras.. As for the OTU camcorders, I'll be surprised if the video is that good. It would take lots of compression one way or another to get 20 minutes of video into a cheap cam, it seems to me.
02-04-2005 04:08:40

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) dialupsux
Profile
Went to Staples today to look for a Centronics cable and a usb cable do to you know what with and was shocked to see the cheapest centronics cable was 30$ and cheapest usb was 18$. Needless to say I'm going to the dump tomorrow. Whats the best cable to modify?
02-04-2005 16:56:47

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) binaryweaver
Profile
ThaLizard - What city did you see the disposable video camera? I checked a few of the larger CVS stores in my area and they haven't even heard of them before but one manager said he can try to obtain one if he knew what city it came from. Can someone post a photo of one of these things if they see it in the wild? Does the interface connector look the same as with the cameras?
02-04-2005 18:40:30

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) codeknowbi
Profile
Some Info on CVS OTU Video

Clerk at Store told me that only California; Phoenix, AZ; and Alanta GA have cameras and processing set up now. The rest of the country will follow after test run in those areas. Not all of the stores in Phoenix have them, although will soon. He claimed the video was great but, couldn't show me. Use is same as the still cameras, you can only veiw or delete the last clip. Clip that he showed me on the camera looked very good.

What I have found

- Has 2 AA energizer lithiums
- HAs 4 screws under label to dissasemble (not tried yet)
- Same connector as the rest
- USBSniff shows ID as Vid 04C5 2003 rev_0100
- lcd view finder shows live video and it looks like it will produce video with normal to low light (might actually be able to lower lights for birthday candle shot)

What I intend to do next

- Take it apart to 'google' the chips to see if anybody else is using it.
- If other cameras have been based on the same chip, try those drivers.

Finally, my questions

- What next?
- Do I alter the usblib inf to see the camera?
- Suggestions?

02-04-2005 18:44:52

New MessageOne use Camcorders (modified 0 times) ThaLizard
Profile
The CVS that I saw it in was in the Atlanta, GA. area. It was on a display rack with the one use digitals and the one use film cameras and such. The package is similar in design to the other Pure Digital (TM) cameras, but is a bit larger, as is the camcorder. I remember it being mostly silver in color. I couldn't get it off the rack without tearing the top of the package and the store employees were all busy so I didn't get a good look at the back of the package. Couldn't see any connector, but I'm sure it is covered with a peel off vinyl sticker like the still cameras. These things will probably be a bear to fiqure out, as I'm sure they have developed their very own streaming video compression method because at $29.99 a pop they certainly don't have the leeway to license someone else's compression algorithyms. At least they probably won't have the computing horsepower on board to encrypt the video stream while compressing it. Either that, or they were forced to use off the shelf hardware that someone else may have designed and built which may have the manufacturers info commonly available. That'd be too good....
There's one born every clock cycle nowadays....
02-04-2005 22:57:14

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) taytrr
Profile
ForkBoy - I'm still getting flash errors on one camera during download with the new (206) tool. The resulting file is 0x2E0000 in length. Can you add some debug info to help me resolve it, or allow a selectable download block size for testing? I'm also still having the reboot after I use the embedded tft viewer -- after selecting an image, preview on camera, pushing button on camera, then hitting ok in app, the system automatically reboots.
02-05-2005 10:00:33

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
Long time lurker, first time poster. Thanks to all for a great job with these new PV2s and the original Dakota blues. I have been playing with the original Dakotas for some time and decided to try a few of the CVS Reds. I picked up two last week. Both with the same nerve pinch:

FIRMWARE: 6520
HARDWARE: 06
TYPEID: 2B
CMP TYPEID: 2B
ID: DBxxxxxxxxxx
REALM ID: 20

I used Tango's great instructions and was successful at unlocking and retrieving the pictures from both. I filled and removed the pictures from both cameras several times last week. Everything was fine until two day ago. Now when I plug in either camera, nothing. No green ready light, no Windows (XP SP2) USB beeps. Nothing shows in the Device Manager. Testlibusb-win shows nothing. PV2Tool (all versions) cannot find camera. Same on several different computers all Win XP SP2 (one with a fresh install). I assume my cable is OK since it still works with the original Dakota blues. Tried plugging the cameras in while turned on and off. Tried several different USB ports on all the computers. Still nothing. Any clues? Are the cameras toast? Help! Thanks again for all the great work and keep it going.

02-10-2005 08:48:48

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) ygfperson
Profile
batteries maybe?
02-10-2005 14:40:39

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) billw
Profile
Anybody else have libusb-win32 1.8.0 result in a bluescreens whenever you try *anything*? This happened on both my work and home computer, both W2k sp4.

It looks like a libusb problem with certain usb controllers... http://article.gmane.org/gmane.comp.lib.libusb.devel.windows/5

Indeed, installing a later CVS version (20041118) made the bluescreen go away, but I think having to use the later version has screwed some things up for me.

The libusb test shows the camera fine, the camera shows up in Windows hardware, and it's also available and unlockable in usbpoker, though I can't seem to dl more than 2M of the 16M flash. (problem #1) After retrieving the 2M, any further attempt to use usbpoker freezes the program.

All versions of PV2Tool crash when I try to "Find Camera" - the application error is "The instruction at 0x100023e5 referenced memory at "0x0000021d. The memory could not be 'read'" (problem #2)

Forkboy - is there something that PV2Tool is doing that might be version specific to 1.8.0? Some additional information - if I choose to debug, at the point of the crash the first item on the Call Stack is "libusb0.dll!100023e5()". Definitely sounds like some API call going bad.

If anybody has any ideas about either problem, I'd be grateful to hear them! Also, has anybody sucessfully used PV2Tool with a version of libusb-win32 later than 1.8.0?

02-10-2005 14:40:42

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
billw, Did you fully remove the previous 1.8.0 version of libusb (control panel remove programs)? I had to with XP before 11/18 version would work. You may have other USB drivers for printers, scanners, cameras ... that are interfering.
02-10-2005 17:59:13

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Mehoff, "I filled and removed the pictures from both cameras several times last week" - Batteries definitely unless you have already replaced them! Very common to most digital cameras - if you can avoid using flash on these SMaL imager cameras the actual power used is much smaller than other imagers.
02-10-2005 18:15:01

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) billw
Profile
brite_eye, yeah I removed the 1.8.0 version prior to the 11/18 version install.

I'll have a go at purging any other usb stuff. There's a Palm driver and a Mass storage keychain in there, at the very least. Thanks for the idea.

02-10-2005 20:42:33

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
ygfperson & brite_eye, fresh batteries in both cameras. Still nothing.
02-11-2005 04:40:05

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) billw
Profile
I removed every USB device I could find, looked (in vain) for any reminants of the old 1.8.0 libusb install, but still no joy. Also, ignore my "problem #1" - I missed the fact that you have to download the flash in small chunks using usbpoker. So really I only have a problem doing a "find camera" in PV2Tool.

I could use usbpoker to get the flash, but downloading in 128k chunks sounds fairly painful and user-error prone.

Forkboy - any chance I could get a hold of the source to PV2Tool to further track down the error? It would be nice to be able to get a libusb error code or something a bit more helpful than the program dumping out with an application error. I do occasional VC++ coding at work and know how to work the debugger, so I'm not a total noob.

02-11-2005 10:23:36

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Mehoff, sorry (I did not carefully read your post), I should have asked more about camera when it is not plugged in to computer. If you can successfully perform vulcan nerve pinch and take pictures, then I doubt if anything is wrong with your cameras (my fried ones wont even turn on - just beep beep then nothing). If you are using a modified printer cable, you may have worn off contacts in camera - or cable may have shorted between 2 contacts killing cameras. I started with printer cable which worked fine for my Old Dakotas but gave me grief with new SMaL cameras, so I switched to Palm method which also has problems. I am about ready to try soldering on connectors but that is unacceptable for many that want to take advantage of these cameras.
02-11-2005 17:40:29

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) ForkBoy
Profile
billw,

Please send me an email at forkboy -at- verizon -dot- net
and I'll reply with the latest source. Provided you provide me with any fixes of course

02-11-2005 18:11:41

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
brite_eye, contacts look OK on both cameras. I dissected one of the cameras to get a better look. I'm using a Palm method cable also. Been using it with the old Blue Dakotas since last Spring without a problem. I didn't mention that both cameras still work when not connected to the computer. I can take pictures and delete the last one as before. Vulcan nerve pinch still works (with same results) but still nothing when connected. They both make a two tone (low then high) beep when first unplugged and the green light flashes briefly. I stopped by the local CVS today and snagged a couple of Blues, Model 400. If I'm going to keep frying cameras I might as well save a few $ in the process. The Vulcan nerve pinch is 65 10 28 28 20 on one and 65 20 28 28 20 on the other. Haven't done anything else yet. Maybe later this evening. I'll keep you posted. Thanks for the reply.
02-12-2005 15:56:38

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
2 ALL, Mehoff your symptoms are very different than any others reported. I would recommend more caution on firmware changes - particularly those changing 30s to balance checksum (note my last firmware posting is a one instruction one block change using morcheeba's pv2mod that is working fine for me). If you do not want to risk frying, there really is no need to permanently unlock camera by writing to flash - it only takes a few extra minutes to manually unlock before downloading pictures. Eventually (after sailpix celebrates a victory), I suspect we may end up with an open source program that smoothly unlocks and downloads pictures without any firmware changes. Another thought is that maybe you have maxed out picture counter - I have been unchecking automatic delete and performing a reset storage to get internal counter back to 0 (1 or 6 depending on software and camera). The fact that upon removal you see a brief green light flash still makes me suspicious of your cable connection (when I have had a bad connection - I can get intermittent flashes and beeps just by jiggling cable).
02-12-2005 17:54:27

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) morcheeba
Profile
Mehoff-

Sounds a bit strange, but my best guess is that something went wrong applying the patches. Are you sure you modified FIRMWARE.BIN like tango said? (I haven't verified his 6420 instructions, but they look right). It would be easy to mess up the camera so that picture-taking works but USB doesn't -- that's because the mods are to the USB area of the code that doesn't get called unless the connector is plugged in. But, interestingly, you didn't mess up the checksum (otherwise picture mode wouldn't work), so you must have been close.

02-12-2005 22:11:38

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
morcheeba, reasonably sure I have things correct. I saved the original and modded flash images. Double checked them yesterday and everything is correct. I would be suspicious too if the cameras hadn't worked for a few days before going belly-up. At least I have a couple of cameras for spare parts and 4 extra batteries. I did manage to have some success with a couple of CVS Blues and some semi-failures (blue images) with 2 CVS Reds. I'll post the results in the appropriate threads when I get a chance. Thanks.
02-14-2005 05:16:14

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Mehoff, are your "blue hue" CVS Reds the newer type 30s (nerve pinch)? I think you'll need to acquire FlatFoto driver (available only from Radioshack with $79 Blue FlatFoto camera - returnable within 30 days). To my knowledge we do not have confirmation that flatfoto driver works with type 30 reds (only with type 2F blues). I fear that sailpix's initial solution may only work with the older types, although if someone produces open source from his final analysis it may not be difficult to extend to the newer types.
02-14-2005 06:09:08

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) gorgonzola
Profile
I have a newish CVS Blue (65 20 2F 2F 20), and I too am suffering from all-blue pictures using libusb/foxz2. Since the newer FlatFoto drivers don't seem to be available, my question is this: would it be possible to get the firmware from an older Blue (a 6520-28 for example), and upload it to my 2F, or would that likely fry the camera? Could I then use the older drivers to get good (non-blue) pictures from it?
02-14-2005 20:18:55

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) sailpix
Profile
Yep... I'm interested to see how the decompression I figure out works against .RAW files from a newer camera.

1. Can someone post a .RAW file that "turns blue" when processed with the Cheez Foxz2 TWAIN drivers? Maybe I can see something initially since I've looked at the hex for a bunch of SMaL image files.

2. Has anyone compared the hardware (i.e. the chips) between all these different camera variations? If it's the same hardware then I would expect the firmware from an old camera to work - if not...


- sailpix _/)
02-14-2005 20:32:57

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
taytrr did some experimentation with T30 in "bits bytes and beyond" - loading T2B produced green missing top images instead of blue. I suspect the asic chip connected to the imager is doing something different with autobrite processing and causing a different compressed image with different "bins". I had hoped that sailpix and taytrr would collaborate. Do you want some blue hue boo hoo images sailpix? If necessary to preserve privacy, I am willing to coordinate through my borg12of48 at yahoo dot com.
02-14-2005 20:48:30

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) binaryweaver
Profile
Taking firmware from an old camera and flashing it to a new will not work. I tried that back in January and had some strange results. See for yourself:

http://www.demanufacturing.com/pv2/photogallery/images/clock.jpg
http://www.demanufacturing.com/pv2/photogallery/images/clock2.jpg

The first clock was shot with a new camera with old firmware using Che-ez! Foxz drivers, the second (clock2) was shot with the same modified camera and pulled out with the FlatFoto2 drivers. Unfortunately, at the present time, you will need to find the FlatFoto2 drivers until another solution is found.

02-14-2005 21:00:49

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Mehoff, while switching drivers to send a blue to sailpix I have come across some strange happenings. I can no longer switch anymore - control panel, system, hardware is ok but clicking on device manager just flashes and disappears. Since switching didn't work I did notice before removing libusb (my last switch to allow PV2Tool download of raw picture) that the green light would not come on when camera was plugged in. After control panel remove program libusb the green light did come on when camera was plugged in and I can download pictures. So Mehoff what is your current driver and does it point to an inf file with your changed type? I suspect that changing from a 27 to 24 may have disabled some of your drivers that may need to be removed before your camera is recognized again. One thing good about a successful firmware change is that you no longer need to switch drivers (unless you buy more cameras which is hard to resist). I think I have maxed out windows driver switching on one of my XP SP1 instances - nothing I do now seems to be able to reinstate device manager. I can't even run regedit - just flashes and disappears. Time for Linux?
02-14-2005 23:35:40

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
My windows problem is cured - I taskkill killed msngmsngr32.exe from task list, deleted it and removed it from regedit. I think my son somehow accidentally loaded it from somewhere. Too many driver switches had nothing to do with the nasty bug/virus.
02-15-2005 01:59:50

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
brite_eye, don't think it's a driver issue since I tried both cams on a clean install of XP Pro SP2 with no USB peripherals ever installed. Never saw a LibUSB driver. Same as the other 2 computers I tried. No USB beeps and Windows does not even bring up the found new hardware wizard.
The CVS Reds with the Blue pictures are both 6520-06 type 30. I tried to uploading the modded flash image from a working Red (6520-06 type 2B) and as others have said it did not work. The pictures had a more ‘natural’ color (still not correct) and the top third was all black. After flashing the modded 6520-06 type 30 image back the camera went back to the Blues again. Would uploading just the modded firmware.bin file instead of the complete image make a difference? Until a better plan is available I will try and get my hands on the FlatFoto2 drivers.
I will post my success with the CVS Blues (along with a couple of pictures) in the Success thread as soon as I get a chance. Also, I have a friends CVS Red 6520-06 type 30 that appears to have been recycled. Just out of the sealed package and there are scratches on the LCD and several cuts (maybe from fingernails) on the front label. Will investigate more when time permits.
02-15-2005 10:47:09

New MessageRed CVS and a Mac... (modified 0 times) nilloc
Profile
hey,
i'm new to this but have built the usb cable and get successful connections with osx's developer USB probe, but i really don't know where to go from there. I've partially modified the Che-ez drivers (changed the vid and pid ids only) and now iPhoto launches when i plug in the camera.

I tried to use the pv2mod on john maushammer's page but don't know enough and it just runs without doing anything (says same "help" message after running). i know i'm missing a step but i don't have access to a XP machine and i don't know what step i'm missing. John's site just lists step 2 as "run pv2mod" and do the $80 and pid/vid mod. but as i said i get nothing back after doing that, the camera isn't being accessed...

any help would be great, i don't know much about scripting/comand line but can read, so keep that in mind. thanks

02-17-2005 02:28:08

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
nilloc, if you do not have a original serial 6410 from Ritz/Wolf you will need to review "2 4 hex 8 Firmware" thread. Note that the command on morcheeba's page (links) incorrectly specifies vid=0x0027 instead of -pid=0x0027 after which you need to specify modfile. Only add -write when everything in log file (I use ">pv2mod.log") looks ok. For a minimal change on CVS cameras check out my last one instruction change entry on Firmware (have downloaded several times afterwards).
02-17-2005 06:55:24

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) morcheeba
Profile
Sounds like good advice brite_eye - it seems like the modfile is missing. You might also want to try the "-verbose" flag before the modfile; this might give a little more information. Thanks also for the catch on the mixed-up vid/pid - I think I also messed up the help file in the program, too. I'll fix these this weekend, but in the meantime, it doesn't affect operation.
02-18-2005 10:16:18

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
As I said in my last post, I have what appears to be a recycled CVS Red. Front label and LCD cover on back have many scratches and the edge connector has some wear marks. Nerve pinch:
FIRMWARE: 6520
HARDWARE: 06
TYPEID: 30
CMP TYPEID: 30
ID: DDxxxxxxxxxx
REALM ID: 20
It will not unlock. Windows sees the camera (usual USB beeps) and shows up in TestLibUSB as Digital Camera 0DCA/0027. PV2Tool (all versions) will find and connect to camera but will not unlock. PV2Mod will not work with challenge/response (error code 0xb9) from a working 6520-T30 or one with reset serial#. Any suggestions?
02-20-2005 09:23:29

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Mehoff, I think you may need a different challenge response for recycled cameras. Way back in an earlier thread (Discoveries) Drmn4ea and others were able to short hidden sw1 to read out correct response - but sw1 does not exist on new CVS cameras. What modfile script are you using? You will need to change VerifyCRCs based on output of prior Printbuffer and also change offsets from morcheeba's 6410 values (I have posted offsets for T27/2B CVS Red T28 Blue in Firmware thread). Please post more details in failures thread on errors in pv2mod log. In the lower right corner on back label you should see a version number like V6-03.04. What is on your labels?
02-20-2005 11:17:28

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
brite_eye, label info is v6-03.04 (same as working 6520-06-T30s). The modfile I used is one I scratched together from what I was able to glean from these threads and morcheeba’s web page. I used the challenge/response from NVRAM.DAT from a working 6520-06-T30. I’m not very adept at this scripting stuff and I’m sure I have offsets and block# wrong but it never gets that far. The error is in the SendResponse cmd: 'sendResponse failed; error code 0xb9'. The mode file is:
GetChallenge; PrintBuffer; VerifyBufferCRC 0xaeb8babd; SetBuffer 0 14371d0fce2915a27ad8d2400ce38a9a84932daeefc199ab6c85eff7d94da15e2a4067f20fff
be462d2fc5c9edc00cfc6eecccf8e1eb2c0364df1da3b30b42fc40be07191cacc4e293ed3a04
5531f39223f765fb597ce0b697d3782fb170b504819aa27975e4ba120f496b21094daac69802
93e9aa7ccb24a539b08a634c4b79; SendResponse; ResetChecksum; ReadFileBlock FIRMWARE.BIN 0x30; PrintBuffer; VerifyBufferCRC 0xecfb4b60; SetBuffer 0x19e e002; PrintBuffer; WriteFileBlock. I can send the logfile and modfile if you like. Just give me an address. You can send back corrected file to mercyman at verizon dot net if needed. Thanks for all your help and thanks to everyone here for all the great work.
02-21-2005 07:53:07

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) billw
Profile
Mehoff, you're using the response to a Ritz PV2 challenge. If I understand correctly, your camera is an unreset CVS camera, so this won't work - the Ritz cameras use a different challenge/response than the CVS cameras (likely to keep CVS centers from processing Ritz cameras, and visa versa).

Unfortunately the response to the challenge for CVS Reds is unknown, and nobody has an easy method to obtain it yet, short of soldering off the flash and putting it in a special flash/eprom reader. The usual way around this is to reset the camera so the ID reads "LAMSSMAL..." and then use the "reset" response to the challenge, but I've done a number of things to try to reset my CVS 6520-06-T30 to no avail. I'm beginning to suspect that they've fixed whatever bug was allowing the reset. With my Ritz PV2, I practically sneezed on it and it reset to the LAMSSMAL ID. Anybody manage to reset one of these yet?

This weekend I'm going to pick up another Ritz PV2 (I gave the other one to my son) and do a bit of circuit tracing and find where the SW1 leads. Perhaps I'll get lucky and find on the CVS that they removed the SW1 button, but left the logic in there... if so, then we'll have a way to get the key using Drmn4ea's SW1-short method. A big if, but I'm out of ideas otherwise.

02-21-2005 09:22:15

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
billw, I know the response is the same as the Ritz PV2 6410 but I pulled it out of the NVRAM.DAT file from an unreset CVS Red 6520-06-T30. The odd thing is the same response has worked on two other CVS Red 6520-06-T30s. Ritz and CVS must be sharing some secrets. I do have a CVS Red 6520-06-T30 with a reset ID but it was that way right out of the package. The response for a reset ID worked fine with that one. Hope you have some luck this weekend. Thanks for the reply.
02-21-2005 11:25:51

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) billw
Profile
Mehoff, interesting. Perhaps CVS and Ritz send the recycled cameras back to the same place for processing, and human error has caused some to be reset with the wrong keys. In any case, I can confirm that my CVS Red 6520-06-T30 doesn't unlock with the Ritz PV2 Red response.

Your factory reset CVS gives me some hope. I'll keep poking at it, maybe I've just been unlucky. Thanks for the info!

02-21-2005 12:37:07

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Paperboy4828
Profile
mehoff, billw, I can only assume the response for the Ritz PV2 and CVS red are the same. Forkboy's unlocking tool works equally well for ether one. Pretty important not to take any pictures until the camera is unlocked...taking pictures seems to change the FIRMWARE.BIN file, and the areas to be modified change (possibly the unlock response required as well). I had three of the CVS reds, two virgins, one with three pic's, all 6520 firmware... the virgins unlocked without a hitch, the one with pictures, is still not right. In some way, shape or form I managed to get the firmware off, but when uploading, it got about 85% complete and burped. Now there are some files missing that were there before, and the available tools will only replace files of the same size, or files that pre-exist. Maybe by changing the file order in the .ISO file, I can get the missing files downloaded first, and purposly crash the upload before it runs over the other files....Hummmmm I'll let you know!
02-21-2005 18:19:17

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) billw
Profile
Paperboy4828, thanks for the reply. I did take a few pics on my CVS, but I'm still not convinced that's the cause. It just seems strange that taking pics would change NVRAM.DAT (it certainly didn't do that with my Ritz PV2). I guess the way to be sure would be to unlock a new CVS (if possible), snap a few pics, and see if it's still unlockabe. I just don't feel like sacrificing another $20 to the camera gods for an answer that will eventually come out of the firmware analysis.

The challenge on my CVS Red right now is definitely different than the Ritz ones. If anybody is also having trouble with a CVS, let's compare challenges. Mine begins 02 DC 59 E0 ...

02-22-2005 19:24:15

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Paperboy4828
Profile
Changing the order of upload, and crashing the program did nothing as far as I can tell.

I say the firmware changes because of the following: On virgin CVS the following is presented in FIRMWARE.BIN

0x6910 02C8 F50E B9E8 18F7 6490 03BC AA39 E818

The same line after taking three pictures is completely different. Additionally, the CRC-32 checksum fails when I try to upload an image of a known working firmware, or even the saved copy of the virgin firmware. Somewhere, the firmware must track how many pictures have been taken, how many are remaining, and the memory allocation. Additionally, a TFT file appears in the folder RAW after taking a picture, which I assume is a TFT of the last image that gets displayed on the LCD. I have had 100% success with right out of the box CVS reds(three cameras), and 0% (one camera)when anything is touched. One other interesting pint, I managed to delete the CAMCALB.BIN file off the camera, and it seems to work just fine except the LCD shows nothing even at boot and/or shutdown. Other than that, the camera works fine.

02-22-2005 20:02:02

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
paperboy4828, I don’t think taking pictures is the cause of the problem. I have 4 CVS Reds 6520-06-T30, all virgins, all purchased from the same store over a two week period. Three with unreset ID#s and one with a reset ID#. The reset one and two of the unreset ones unlocked fine with PV2Tool206 but the last one will not unlock. Tried all versions of PV2Tool and also PV2Mod. The challenge/response is obviously different right out of the package on some of the CVS T30 cameras. Maybe resetting the ID is the way to go but I have no idea how to accomplish this. I’ll keep my fingers crossed that billw has some luck finding a way to use Drmn4ea's SW1-short method to get the NVRAM.DAT file off these un-lockable ones.
02-23-2005 05:03:22

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) teslafreak
Profile | Email
ive reset my reds and figured how mine were done
i installed liusb and ifranview with foxz2 driver modded the inf file
installed camera "coumputer found the device and then i clicked on device manager
and removed the camera from the hardware list
unplugged camera and found the camera was reset
i have repeated this to my other red and it was repeatable
you may try this to reset your cam and use the reset key in pv2tool
my cameras were cvs 6510's with a little luck the bug may still work
i think leaving the cam plugged up wile uninstalling the driver does it
02-23-2005 09:06:06

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) billw
Profile
Teslafreak, I'll give it a shot. Last night I had a solder joint break on my palm-cable, so once I fix that your trick will be the first thing I try - it sounds close to what I did (among a lot of other things) when I accidentally reset my Ritz. I'll cross my fingers that they haven't closed this up on the latest CVS Reds.

Mehoff, when PV2Tool fails to unlock a camera, it reports the challenge key it recieved from the camera in it's debug window. Does yours begin with 02 DC 59 E0 ?

02-23-2005 09:28:04

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
billw, the debug window shows the challenge key starting with 02 69 B5 A8 3D 64... when PV2Tool206 fails. Let me know if you want the entire key.
02-23-2005 18:58:24

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
Please start using Challenges thread for problems and solutions concerning new challenge keys. For other questions if there is no other thread that seems to apply continue using this one. Has anyone found a way to just retrieve last few messages? I like UltraBoard search facility that shows only topics updated based on number of days - but it seems you still need to pull a complete topic. I occasionally use my palm I-330 sprint phone and it stops after about 60 messages.
02-23-2005 19:49:31

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) billw
Profile
Mehoff, our challenges don't match, so it's a safe be that they've decided to create multiple challenge/responses. That said...

..I managed to reset my camera to LAMSSMAL using teslafreak's procedure, and it unlocks just fine now. Teslafreak, thank you!!! The whole thing took about 1 minute.

Mehoff, Follow the procedure and I bet yours will reset too.

02-23-2005 20:22:21

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
brite_eye, one last post to this thread. billw, you beat me to the punch. Thanks to teslafreak I was able to reset mine also. Then PV2Tool unlocked with the reset key. I was not able to download the entire flash however. Failed after ~10%. I was able to download the firmware, change it and upload it without a hitch. Changed 0x6910 01 to 02; 0x6AF4 27 to 24; 6B30 30 to 32. Now everything works perfectly. Thanks again to teslafreak.
02-23-2005 21:08:32

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) tweak
Profile
Got a 6410, after trying to hack the firmware, I get three low beeps when trying to turn on the camera, or when connected to usb. Running the PV2Mod util when I connect I get one beep, but no light... I am unable to unlock... Any suggestions on how I can fix this? Also, what changes need to be made on the 6410 27 firmare.bin file?
03-03-2005 09:25:10

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) fizznotch
Profile
I'm new here so apologies ahead of time if this is a dumb question. I've got an old style dakota, have installed libusb and been very successful using it with sucr.exe
yesterday i bought a new blue dakota (slim case, no picture display). It doesn't have 'PV2' stamped on it though. When i due the threefingered thing with it i get 65 10 28 28 16.
When i tried to connect it to the usb port it didn't recognize it and wouldn't install the driver that i had been using for the other older camera. I'm using winxp.
Looking through the information here i'm not sure what i should be looking for in order to make this version work .. is it a CVS version, or a walgreens or what, or does it not matter.
Any help would be appreciated.
Fizz
03-09-2005 19:17:16

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
fizznotch, you need to download cheez driver for foxz2 and follow busters procedure at start of "CVS Red & Blue" thread creating a driverx.inf file from the smalunhj.inf file then run setup.exe downloaded with cheez. When new device install comes up you need to select driverx.inf.
03-10-2005 01:16:14

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
teslafreak, billw, Mehoff. Did you use 4 line driverx.inf mod to foxz2 when following teslafreak's repeatable reset procedure?
03-10-2005 01:58:55

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) billw
Profile
I used a 2 line mod. To [SMALUSB.models] I added:
%USB\VID_0DCA&PID_0027.DeviceDesc%=SMALUSB.Dev, USB\VID_0DCA&PID_0027

And to [Strings] I added:
USB\VID_0DCA&PID_0027.DeviceDesc="Unreset CVS Red"

03-10-2005 06:22:40

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Mehoff
Profile
I didn't add any lines to smalunhj.inf. Since all my 'working' cameras are reset to type 24, I just changed the three 0023s to 0027s, updated the driver to point to smalunhj.inf then did the driver uninstall to reset the camera. After the camera was reset I just changed the 0027s back to 0023s and updated the driver back to the libusb.inf that already had the type 27 and 28 added and used PV2Tool206 to unlock. Worked like a charm on two different cameras.
An update: a friend gave me his still-in-package CVS Red yesterday to unlock. It was obviously a recycled one (6520-T30 unreset ID). Would not unlock with PV2Tool206 so I tried to reset ID as before. Would not work. Tried updating to FlatFoto2 driver (smaluslx.inf with type 27 added), then the uninstall. Still would not reset. Uninstalled all drivers and installed just libusb (with type 27 and 28 added to libusb.inf). Plugged the camera in and pointed to libusb. Then with camera still plugged in, uninstalled from Device Manager. Unplugged the camera and voila, reset to LaMSSMaL. Unlocked with PV2Tool206, changed firmware.bin (6910 01->02; 6AF4 27->24; 6B30 30->32).
MD5 Checksums:ccb952eb7f6f2f09781e27b721b9b8c4 *FIRMWARE.BIN.orig
5b6bd7b07c7780f178d19728be3d9883 *FIRMWARE.BIN.unlock
Everything working fine.
03-10-2005 08:52:53

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) Steveo
Profile
I have "libusb" installed and working with the "Old Blue". I would like to play around with a Ritz RED PV2 ( 6430 type 27 ) My question is how can I keep the old blue working and use some of the hacks for the pv2?
03-27-2005 08:12:59

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) billw
Profile
Steveo, if you're running 1.8.0 libusb/0.05 sucr, you should be set to experiment, since forkboy's pv2tool is compiled against the same 1.8.0 libusb version.

You should be able to just follow one of the tutorials and just skip the 1.8.0 libusb filter installation, since it's already installed. (but be sure to install/unpack the 1.8.0 libusb device.) Everything else shouldn't perturb the libusb device distributed with sucr.

Thats the theory anyway. Anybody care to confirm this anecdotally?

03-28-2005 08:05:17

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) MicronEye
Profile
Both will operate fine. Please see 3/10 MicronEye post under the success thread. Your download usb port for your old blue(b&s) will also be your download port for the red cvs. You will utilize another usb port to do the unlocking though. For my situation, I had a working old blue configuration (though I was 1 sucr release behind current). During the red cvs unlock process things got a little stalled. Later, I had taken some pictures and found the old blue app non-working too. Finally, getting the red unlocked with the latest sw allowed both the red and old blue to operate fine on the same platform.
03-29-2005 16:18:24

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) binaryweaver
Profile
Here is a question for anyone who actually has a RadioShack FlatFoto 2 camera: What is the PID # from a stock camera?
04-10-2005 11:55:10

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) brite_eye
Profile
From Irfanview Download screen Info tab(I can't figure out a vulcan pinch - too many buttons):
Software 3.0.5.1
Hardware v0006
Firmware v6620
Type 0x0029
04-10-2005 13:58:15

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) binaryweaver
Profile
The INF file for the driver has 25, 29, 2A, 2C, 2D, and 40 listed. "Type" probably denotes the PID. I want to mod one of my CVS blues to match the stock PID of an actual FlatFoto 2 to see if it works on MACOSX (I don't own a Mac but may have access to one soon). I'll post the results when and if I can get my hands on that Mac.
04-10-2005 15:45:29

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) savmac
Profile
I think the Libusb "Test" program will also tell you the PID for the original cam?
04-10-2005 17:01:57

New MessageRE:Questions - 1 2 many 4 all (modified 0 times) mike
Profile | Email
I've set all my cams ,,both red/blue cvs to 29 ,,,and all works well....
04-12-2005 06:18:00

Reply to Thread | Printer |
All times are PSTPowered by UltraBoard v1.62



Copyright © 2000, Netmake Inc. All Rights Reserved.
See Terms and Conditions for more information.




i-opener opener laptop notebook computer help drivers dll free windows dos repair fix linux mac macintosh 2000 95 98 nt pc configure hardware software sound video netscape explorer network networking lan wan software cmos fat bios printer card mouse modem ide scsi cd rom controllers scanner tape hard drive cgi scripts source code mp3