lets hack the "One Time Use" digital camera

Dakota PV2 from CVS

 

intro:

None of this would have been possible if not for the work of many other people. Please see the bottom of this page to see a list of links of people and places that made it possible to get this far.

 

It has been discovered that if you hold down the display and shutter button while powering on a Dakota it dumps its firmware version and a serial number to its LCD screen

Before messing with my camera it said this: 

FIRMWARE 6510
HARDWARE 06
TYPEID 27
CMP TYPEID 27
ID DA5044320xxxx
REALM ID 20

Now is just says: 
FIRMWARE 6510
HARDWARE 06
TYPEID 27
CMP TYPEID 27
ID LAMSSMAL0000
REALM ID 00

I don't know what causes this to happen, but it occured while I was trying to attach a cable to the camera. I could have shorted a few of the pins, or send weird data to the cameras ground. No one has figured it out yet...

 

 

 

extracted images:

2004-12-09

Using the usbpoker tool I have been able to extract a few images from the camera
the raw USB dumps from the usbpoker are black-to-white and poutine shot for both dumps image data starts at 0xE000.

the data was massaged into images with the help of freeware tools tiny hexer and IrfanView

 

 

All of the images have been converted into JPG's to save on bandwith and to help your browsers view them. The lowest compression possible has been used.

Click on the images to see a larger version
 

A black-to-white image.
Shot against a projection screen, at a steep angle		 Image with the RGB layers not merged:

and merged:

The same black-to-white image, this time processed as a grey scale. You can even see the slight ripples of the screen in the shadows

 

A picture of a Poutine
It is resting on a newspaper		 The image without the colors merged:

The same poutine image, this time merged: notice the vertical lines, any guesses how this could be happening? It isn't caused by the jpg compression I am using, it is somewhere in the image data

The poutine image this time as a grey scale. I think it looks great, and there are no vertical bands, but i really miss the color

 
 

auto processed image:
2004-12-12

 

Boodle released a program to convert raw (bayer) images into bmp files. I had to modify the image starting location to 0xE0000 to make it work with my dumps. It was able to produce a good image. The color tables are a little off but it is a good start.

This raw file produced the following (click for a larger image)

It is a large red 'exercise' ball that was near my computer.

 

Here is the Poutine image reprocessed with boodles raw2bmp code:

 

The image above with the gamma set to 2, and red enhanced 15%

Mmm makes my mouth water. We are getting close!
 

A few guesses about the compression
2004-12-13

 

After staring a compressed file thinking about curves I came up with a idea. I isn't all worked out, but I think it is a start. Read it here.

Links:

 

The web BBS Camera section where a lot of discussion is going on talking about this camera family and some others. A thread talking about the CVS version of the camera

Some great info on the hardware at Morcheeba's Site.

Some more info on the new PV2 and the older 'blue' version is available here
There is a great tool called the USB Bulk device angering utility usbpoker for win32

Morcheba has a tool that can dissassemble the cameras firmware. Here is a binary of it compiled for windows. You will need the original archive for the latest FIRMWARE.COMMENTS file.

 

My email address is: bentfork at gmail dot com
.