Slashdot Mirror

Cool! This reminds me of John Maushammer's Pong Watch.

I'm a big fan of keynote.. it just blows the doors off of powerpoint. My favorite feature is the ability to cut the subject out of a picture so that you don't have a distracting background (example). Apple isn't really selling in to a captive market -- I also own powerpoint for the mac and windows.

Your post is dripping with contempt for the people who actually make stuff. 'so-called inventors' is a great example.

I'm a Computer Engineer. I design (proprietary) hardware. In my spare time, I'm a Software Engineer. I design (open-source) software. I am perfectly well aware of how difficult the design process is from both sides of the equation, and have no contempt what so ever for the hard-working individuals who work night and day so us geeks can have new toys to play with.

Who did invent the mentioned nintendo games console then? you? your mates?

The aforementioned hard-working individuals did. And you know what? They often hold neither the patents nor copyrights to their work (since their development time has been bought) so I fail to see how the actual developers factor into this discussion. The contempt that drips from me is specifically towards "so-called" inventors. Individuals or groups of individuals that claim incredibly obvious or non-original ideas as their own, and end up owning them due to slip-ups in the way the current intellectual property system is structured.

However, you're steering this discussion away from where we started from. I do not believe that anyone (not the inventor, developer, financer, or any other group) has the right to tell me what I can and cannot do with their product (except re-distribution in the case of easily reduplicated products, but copyright covers this).

If they want to impose restrictions above and beyond those which are already offered by copyright and trademarks (NDAs are very common with commercial hardware development packages), these restrictions must be agreed to and signed by both parties before the time of sale.

If modifying hardware breaks someone's business model, they can 1) adapt with a better business model, such as charging more up-front, or 2) cease to manufacture the good.

For a great example of a very poor business model that's been destroyed by hardware modifications, check out Pure Digital / CVS Disposable Camcorders. You are supposed to buy them (cheap), use them, and return them (for resale). I bought 5 of them and modified them to have USB ports (=added/enabled extra functionality, exactly like the modchips we are discussing here) and have no intention of returning them.

Is it your view that I've done something wrong here? I paid them what they asked for the camera, but once I walked out of the store with it.. it's mine.

get into some real hacking.

Get something like this (hint: there's a much cheaper one with backlight that costs only about 50 bux), read this, lean to program the MCU, add some Flash memory, learn to hack the BPU and get goin' already.

No wonder the military too are going COTS, they can't hack up anything themselves anymore unless millions of dollars are dumped into the project.

Heck, even the famous voting machine scanner from the Netherlands was in fact a hacked TomTom navigator (you can prolly find them by the roadside by the dozens, tossed out the window by some bored SUV cowboys)

Re: nobody out there that makes development for their platform as easy as MS

I've been really happy with Apple's tools. They have some advantages -- I hack USB drivers, and OSX+Xcode can do this user-space or kernel-space. MS requires an expensive "driver add-on" to visual studio because windows can only do kernel-space USB drivers. (Thankfully there are is a FOSS solution that essentially provides a tunnel so that you don't have to buy this driver add-on). Also, Apple's Core Data is a gui that lets you design your data structures, and then helps manage the structures. Xcode is free, too, and has neat features like distributed compilation.

Not exactly. Archive.org doesn't store large binary files. I found this out when downloading tools for an obscure processor - they had the smaller tools, but not the larger ones.

Try to download it from archive.org -- http://www.oldversion.com/downloadx/itunes41.exe"> http://web.archive.org/web/20060307125009/http://w ww.oldversion.com/downloadx/itunes41.exe -- it won't work. But, if you strip off the beginning of the URL, you can find out where oldversion.com used to store it -- in /dowloadx/itunes41.exe. It turns out oldversion.com still has it at this location and you can still download it from them.

I don't know about Rite-Aid ones, but the CVS ones are indeed hackable. The first generation required you just to build a cable; later generations have added some attempts at locking out hackers, but these have also been defeated via some clever tricks. I have two of these little CVS guys and they're a lot of fun.

Uh, excuse me, there is me. I thought I was in the clear, but today I've been reading up on this to see if this will affect people who do the reverse engineering and publish it. Hopefully it's still allowable - by all reasonable measures, it should be. I've had my fuji E-6 film developed by kodak for a long time.

Uh, excuse me, there is me. I thought I was in the clear, but today I've been reading up on this to see if this will affect people who do the reverse engineering and publish it. Hopefully it's still allowable - by all reasonable measures, it should be. I've had my fuji E-6 film developed by kodak for a long time.

This is the third camera from the same company that I've reverse engineered and made reusable. So far, no lawsuit. While I wouldn't want a lawsuit, I think this would be an excellent test case for a few reasons:
- Numero uno, I am not breaking the DMCA. Hopefully people only sue when a law is violated, but, sadly, that's not always the case.
- I am accessing my own pictures, to which I have the copyright. The DMCA only protects rights-owners (me).
- I am reverse-engineering for interoperability, which is permitted. Some judges think this only applies to personal computers and not "other" computers (like printer controllers, like in the Lexmark case) -- but I'm interfacing to a plain old PC.
- Cameras have direct parallels to the "analog world". People have been developing kodak film with fuji chemicals for ages. It's a case that judges and juries can understand.
- The courts have found for the defendants even in much less clear-cut cases (like Lexmark).

Here's my webpage about the DMCA and these cameras.

One very good trick Pure Digital has that keeps people out of their cameras is changing the architecture. The three cameras have had 3 different processors (8051, 8-bit RISC, MIPS), 3 kinds of toolsets (one big program, mini-OS, and full-blown embedded OS), and 3 IP vendors. This means the work I don on one camera doesn't apply to the next one... and will eventually tire me out -- it's a lot of work to do, and it takes them less effort to modify an existing camera than it does me to unlock it.

(p.s. my Make submission contained essentially the same text as my earlier, rejected slashdot submission

I've been working a project that uses the MIPS-I compatible Lexra 4180, and in my research I found they were basically sued out of business by MIPS for creating a clone. This link -- the Lexra story -- is a good summary. From that article: MIPS Technologies claimed that because an exception handler could be created to emulate the function of unaligned loads and stores in software with many other instructions Lexra's processors infringed the patent. It was claimed to basically be a patent infringement case because the instruction set used the patented unaligned load feature. (I just coded this into my mips disassembler -- it takes two instructions to process, but the benefit is that it looks like it would be much easier to implement in hardware)

Ha ha! Ok, you've shamed me into it! I reduced the palette to 32 colors and posted it as a png. It looks a lot better, thanks. It's also only 7628 bytes.

Apple had a lot of decoration in the window - antialiasing, plus textured background, plus multi-colored candy buttons that ate up colors. Normally I would have thought PNG would have been better, but guis are getting more picturesque all the time.

Is it really too much to ask that people know when to use JPEG and when to use PNG? The person behind this article ought to know, but... I mean, just look at it, it's the Screenshot From Hell.

The PV2 still camera I mentioned above would be great for that. It's $18 and you can send images to it over the USB. sample image. The firmware beeps for each new picture and requires a button press, but I modded it so it is silent and operates like another screen. The only drawback is a about a 1/2 second refresh time. The firmware can be optimized to eliminate the slow double-buffering, but you're not going to be able to play asteroids like that. (maybe on the built-in firmware). Of course, a text-only interface would be much faster.

As pointed out yesterday on engadget, these cameras have been out a few months -- it's just that the press release came out recently. Yep, it's from the same company that made the hacked still camera.

The community working on hacking this new camcorder is located at:http://camerahacks.10.forumer.com/viewforum.php ?f=13

These cameras seem to have an external program memory, so it might not be too hard to hack. The forum above also has dissection pictures.

BTW, last summer PureDigital came out with a still camera called the PV2. Unlike the one that was previously mentioned on slashdot, this new one has an LCD post-view screen and it's based on a completely different chipset. It has also been hacked. I figured out the authentication mechanism on this and most of the communications. Others got the camera to work with standard drivers and are figuring out the proprietary raw format. I wrote a disassembler and have published commentary on the built-in firmware, but you'll need a camera & firmware file to make sense of it. The firmware is protected by a checksum, but that was easy to find and correct.

main pv2 forums
PV2 FAQ from the forum - a great starting place
my FAQ's
unofficial devkit for writing your own programs.

As pointed out yesterday on engadget, these cameras have been out a few months -- it's just that the press release came out recently. Yep, it's from the same company that made the hacked still camera.

The community working on hacking this new camcorder is located at:http://camerahacks.10.forumer.com/viewforum.php ?f=13

These cameras seem to have an external program memory, so it might not be too hard to hack. The forum above also has dissection pictures.

BTW, last summer PureDigital came out with a still camera called the PV2. Unlike the one that was previously mentioned on slashdot, this new one has an LCD post-view screen and it's based on a completely different chipset. It has also been hacked. I figured out the authentication mechanism on this and most of the communications. Others got the camera to work with standard drivers and are figuring out the proprietary raw format. I wrote a disassembler and have published commentary on the built-in firmware, but you'll need a camera & firmware file to make sense of it. The firmware is protected by a checksum, but that was easy to find and correct.

main pv2 forums
PV2 FAQ from the forum - a great starting place
my FAQ's
unofficial devkit for writing your own programs.

As pointed out yesterday on engadget, these cameras have been out a few months -- it's just that the press release came out recently. Yep, it's from the same company that made the hacked still camera.

The community working on hacking this new camcorder is located at:http://camerahacks.10.forumer.com/viewforum.php ?f=13

These cameras seem to have an external program memory, so it might not be too hard to hack. The forum above also has dissection pictures.

BTW, last summer PureDigital came out with a still camera called the PV2. Unlike the one that was previously mentioned on slashdot, this new one has an LCD post-view screen and it's based on a completely different chipset. It has also been hacked. I figured out the authentication mechanism on this and most of the communications. Others got the camera to work with standard drivers and are figuring out the proprietary raw format. I wrote a disassembler and have published commentary on the built-in firmware, but you'll need a camera & firmware file to make sense of it. The firmware is protected by a checksum, but that was easy to find and correct.

main pv2 forums
PV2 FAQ from the forum - a great starting place
my FAQ's
unofficial devkit for writing your own programs.

As pointed out yesterday on engadget, these cameras have been out a few months -- it's just that the press release came out recently. Yep, it's from the same company that made the hacked still camera.

The community working on hacking this new camcorder is located at:http://camerahacks.10.forumer.com/viewforum.php ?f=13

These cameras seem to have an external program memory, so it might not be too hard to hack. The forum above also has dissection pictures.

BTW, last summer PureDigital came out with a still camera called the PV2. Unlike the one that was previously mentioned on slashdot, this new one has an LCD post-view screen and it's based on a completely different chipset. It has also been hacked. I figured out the authentication mechanism on this and most of the communications. Others got the camera to work with standard drivers and are figuring out the proprietary raw format. I wrote a disassembler and have published commentary on the built-in firmware, but you'll need a camera & firmware file to make sense of it. The firmware is protected by a checksum, but that was easy to find and correct.

main pv2 forums
PV2 FAQ from the forum - a great starting place
my FAQ's
unofficial devkit for writing your own programs.

I've done lots of driver development on various machines (linux, solaris, OSX, vxWorks), and my favorite for general hacking has been OSX. Besides the traditional OS-level drivers, it also allows user-level USB drivers. I use the user-level access for my projects and it provides simple no-hassle operation. The code is still limited by the user's permissions, but I don't need access to other system resources. The windows equivalents need to rely on libusb, a generic os-level driver that passes user-level commands through to the USB device. Because of window's USB driver model, though, libusb can only work for one device type and must have the VID/PID's set before installation. OSX is much simpler when you need to write a hack that modifies a device's PID - it doesn't need another driver installation to continue talking with the device.

Actually, vxworks was the easiest to write drivers for, but since it is an embedded OS with no distinction between user code and OS (they share the same namespace!), it doesn't really count.

... not every processor is documented. In fact, the documentation for a lot of high volume processors isn't available. I'd like PSP docs, or docs on the processor in the ipod, or even the processor in the disposable digital cameras or the VMU game system -- but none of these docs are publicly available. The hardware manual for the G5 PowerPC was finally published last November, over a year after apple started selling the hardware.

So, no, the documentation doesn't always get released.

... not every processor is documented. In fact, the documentation for a lot of high volume processors isn't available. I'd like PSP docs, or docs on the processor in the ipod, or even the processor in the disposable digital cameras or the VMU game system -- but none of these docs are publicly available. The hardware manual for the G5 PowerPC was finally published last November, over a year after apple started selling the hardware.

So, no, the documentation doesn't always get released.

Sample chapters are available from this book's webpage on O'Reilly's website -- you can even read about my hacking on the sega dreamcast VMU in chapter 52 or from my (outdated) website.

I work at a company that makes LCOS devices (liquid crystal on silicon), so we've got some fancy microscopes custom-made for looking at pixel arrays under a wide variety of lighting conditions. I also happen to be hacking the PV2 disposable digital camera and didn't know the sensor resolution. So, we popped it in and found it was a 1.3 megapixel camera, even though it was claimed to provide 2 megapixel quality.

We've got a laser that can cut metal traces in IC's; I've been dying to find a use for it. Or the NMR machine.

I also used to work at a small startup company that decided, for some interesting good reasons, instead of programming, they should play Civilization on-line 8 hours a day, for 2 months. So, if you lost to three really good players in early 2002, they weren't cheating -- just really determined and on company time. Too bad that was a couple months before I started there.

It's not a technical question -- those can be solved -- but, rather, it's a legal question.

It's not a technical question -- those can be solved -- but, rather, it's a legal question.

Ah, thanks. The time I transitioned must have been more of a factor than the platform. The II+ came with the assembly, and the //c had it in the additional (~$50) technical reference manual. I still have both of mine, in the basement somewhere.

off topic... your name looks familiar... oh yeah, you hacked the old garmins - great work! I reverse-engineered the protocol too, but I wasn't on the web at the time so I didn't have a good way to get out the details. Things have changed since then! I didn't open up my gps45 and hack the rom like you did, but I've done that to plenty of other things.

The arstechnica article says...

Additionally, while the court ruled that the Toner Loading Program is not copyrightable, it agreed that the Printer Engine Program was a copyrighted work. However, the argument that SCC's Smartek chip provided unauthorized access to the Printer Engine Program was dismissed on the basis that it was the consumers' purchase of the printer that established such access, and the program in question was freely available to read electronically in memory. SCC's actions thus constitute a legal replacement of Lexmark's Toner Loading Program.

If that's actually what the judge said (I'll have to read the case when the EFF publishes it), that would set a very interesting precedent. Essentially, it seems it would make hymn perfectly legitimate. In hymn's case, the user has purchased the player and the music, and is authorized to play the music. iTunes has an EULA that Lexmark didn't, so I suspect that will come into play, too.

Here's my writeup about the DMCA, which I wrote because a project of mine might have been subject to its restrictions.

The arstechnica article says...

Additionally, while the court ruled that the Toner Loading Program is not copyrightable, it agreed that the Printer Engine Program was a copyrighted work. However, the argument that SCC's Smartek chip provided unauthorized access to the Printer Engine Program was dismissed on the basis that it was the consumers' purchase of the printer that established such access, and the program in question was freely available to read electronically in memory. SCC's actions thus constitute a legal replacement of Lexmark's Toner Loading Program.

If that's actually what the judge said (I'll have to read the case when the EFF publishes it), that would set a very interesting precedent. Essentially, it seems it would make hymn perfectly legitimate. In hymn's case, the user has purchased the player and the music, and is authorized to play the music. iTunes has an EULA that Lexmark didn't, so I suspect that will come into play, too.

Here's my writeup about the DMCA, which I wrote because a project of mine might have been subject to its restrictions.

A little tip from when I wrote 8-bit embedded code...

Our c compiler had an output format that would list the c code and resulting assembly language intermixed. I wrote a quick little program that would read this, count the bytes of code per line, strip the assembly, and then just print out each line of C with the byte count at the beginning of the line.

This was easier to look over and you could see if some c expression was really bloated - I'd then go and simplify the code.

For example, I've been disassembling this little project and I can tell that the source firmware has this mistake:

U88 a;
U32 b;

bad: b = b & a;
good: b = (U32) ((U8) b & a);

The bad way hard codes in a lot of "& 00" instructions for this little 8-bit processor, while more selective casting (while ugly) can overcome the problem. Repeat 10 times, and you'll save 200 bytes, or almost 3% of memory.

I haxored my camera - it's the new version of the disposable digital camera I hacked last year. This version took more work, mainly because it uses an obscure processor & has a complicated banked-memory scheme (128K of code in 16K window). I've been able to modify the firmware so that I can use the standard windows driver for another camera with this one -- so we can get images off of it. I'm working on other mods - hopefully a "picture frame mode" and maybe a kite-camera timer. Other people are developing camera "skins".

my main PV2 camera page

I haxored my camera - it's the new version of the disposable digital camera I hacked last year. This version took more work, mainly because it uses an obscure processor & has a complicated banked-memory scheme (128K of code in 16K window). I've been able to modify the firmware so that I can use the standard windows driver for another camera with this one -- so we can get images off of it. I'm working on other mods - hopefully a "picture frame mode" and maybe a kite-camera timer. Other people are developing camera "skins".

my main PV2 camera page

I haxored my camera - it's the new version of the disposable digital camera I hacked last year. This version took more work, mainly because it uses an obscure processor & has a complicated banked-memory scheme (128K of code in 16K window). I've been able to modify the firmware so that I can use the standard windows driver for another camera with this one -- so we can get images off of it. I'm working on other mods - hopefully a "picture frame mode" and maybe a kite-camera timer. Other people are developing camera "skins".

my main PV2 camera page

Your camera already works, so why fix something that's not broken? I couldn't imagine tinkering with the code or hardware of a late-model digital camera -- it'd be way too complex. Most of the functions are probably implemented in hardware, too, so modifying any sort of firmware is unlikely to get you anywhere. The level of integration is sure to be extremely high.

The only cameras that have been looked at and disassembled are the Dakota Digital/CVS "one-time-use" cameras. It's because they're cheap, and hold the promise of extended reuse. They don't have very many features, and probably can't have any more added to them. The attraction is the challenge of breaking a "closed" system, and getting something for (close to) nothing.

The original blue Dakota was based on a custom Sunplus chip. So far there's been one modified firmware release that fixes bugs and extends the picture limit. This model has been discontinued, however. More info here, here, and here.

The newer models have been looked at in depth as well, and they're based on SMaL chipsets. So far methods of reading and writing have been uncovered, and a method of downloading pictures via hacked drivers is documented. The eventual goal is a GPL driver and sofware, and possibly firmware upgrades. Current progress here, and background info here and here.

Your camera already works, so why fix something that's not broken? I couldn't imagine tinkering with the code or hardware of a late-model digital camera -- it'd be way too complex. Most of the functions are probably implemented in hardware, too, so modifying any sort of firmware is unlikely to get you anywhere. The level of integration is sure to be extremely high.

The only cameras that have been looked at and disassembled are the Dakota Digital/CVS "one-time-use" cameras. It's because they're cheap, and hold the promise of extended reuse. They don't have very many features, and probably can't have any more added to them. The attraction is the challenge of breaking a "closed" system, and getting something for (close to) nothing.

The original blue Dakota was based on a custom Sunplus chip. So far there's been one modified firmware release that fixes bugs and extends the picture limit. This model has been discontinued, however. More info here, here, and here.

The newer models have been looked at in depth as well, and they're based on SMaL chipsets. So far methods of reading and writing have been uncovered, and a method of downloading pictures via hacked drivers is documented. The eventual goal is a GPL driver and sofware, and possibly firmware upgrades. Current progress here, and background info here and here.

I've been following this case and glad to hear this. SCC has been prevented from selling their product for about 8 months now ... will lexmark have to reimburse them for their lost sales? or, how about customers, who have been deprived of a legal cheaper product?

Since you *are* a professional photographer (and can therefore use the acronym "IAAPP"), what do you think of a new $8k gadget? It seems like the business side would trump the "cool gadget" side, especially if your existing equipment gets the results you want.

You're right about the march of technology, but who *are* the "early adopters" who go and buy this sort of thing? Myself, I'm the opposite... I only got a digital camera just this year, after the family started playing with a hacked-up Ritz.

Mt. Asama in Japan (near Nagano) has been erupting the last few weeks. Check out this short video of a continuous stream of ash leaving the top. Some of it reached Tokyo!

I've got an analysis of the flash memory posted -- interesting stuff.

http://www.maushammer.com/systems/dakotadigital/pv 2-disassembly.html

Two AAs, it looks like. They don't make it too easy to get in, but...

The quality of the picture is mostly determined by the lens and by the quality of the individual RGB cells on the sensor - not by whether there are 2 million or 4 million of them or whatever. A 2 megapixel image is still higher resolution than you can view on anything but an expensive display (at 3:2 aspect ratio it would be roughly 1731x1154 pixels).

Some people do try to attach decent lenses to disposable camera bodies; I am tempted to troll by saying that you would get better images by spending $20 on the body and $230 on the lens than by spending $250 on a 'decent camera', but I suspect that's not really true except for specialized applications. Still, it is worth emphasizing that the number of megapixels doesn't mean much if your images will be mostly viewed on screen. Even for making prints it doesn't matter if they are small ones.

No, that's the EUCD (european union copyright directive), which is far worse than the DMCA. Here's my DMCA analysis on the old camera.

So far, I've got a lot of respect for the legal department at PureDigital: they have not threatened anyone, with the DMCA or otherwise. By my reading of the DMCA, writing drivers for interoperability purposes is legal (and, IMHO, fair use of purchased hardware). The new camera so far seems to be locked down tighter (i.e. no one's gotten any message at all back from it yet; we presume it's waiting for the right password). I am glad to see PD using technological measures rather than trying to find a judge that will turn the DMCA into a blunt instrument.

It's already well on its way.

Take a look at some of the images. You can see an edge connector along one side of the PCB. Odds are this is there data is pulled from. Since they (the hackers) claim to have been able to update the firmware, I would assume that they are close to being able to pull data off as well.

I did the original hack on the old camera, and, of course, I'm working on the new one... here's my web page on it.

The next step is a ROM dump -- then we can see if there is any code in the flash memory, or if it's stored on the ASIC. I suspect that there is a bootloader on the ASIC and the bulk of the code (certainly the pre-programmed images) is on the flash. Don't know if it's encrypted or scrambled yet.

We're still working on the resolution of the sensor. I read the part number last night, but didn't return any google hits. We can't really rely on the size of the pictures one would get back from processing because, in the past, they've upscaled it.

The DMCA allows an exception "solely for the purpose of enabling interoperability of an independently created computer program with other programs, and to the extent that doing so does not constitute infringement under this title or violate applicable law other that this section" 17 U.S.C 1201(f)(3). (emphasis mine)

The judge in the SCC/Lexmark case read this very narrowly and said that since the algorithm came on a chip, it was non-exempt hardware instead of software. This case isn't allowing software/software interoperability (like Wine offers), but it's data/software interoperability. Big difference; if the DMCA allowed that, then DVD-playing would be legal (same interoperability, except in reverse)

Functionally similar, but different. The bmw uses the I-BUS for communications, while Alpine uses its own Ai-Net. I know a bit about this since I'm building such an interface from scratch, except it won't emulate the cd changer (it'll use the AUX input instead). I'd love to know what new output the ipod uses to indicate the current track.

Streaming itunes wirelessly is nice but you still need to go back to your computer to change a song.
a quick google turned up iTunes Remote. There were many other hits, so check others if this X-10 option doesn't float your boat.

One thing missing from this device is a real optical out.
The picture labels the audio port as analog AND digital. It's possible they are using an "enhanced" 1/8 plug like they do on my 3rd gen iPod's jack. The iPod can take a normal headphone with 3 connections(left, right, ground), while the remote control(plugs into the same jack and includes a pass-thru headphone jack) has 4 connections on it. You can see a picture of it here under the section titled Generation 3. It's possible Apple used the same concept with the Airport Express and the digital out has extra connectors on the 1/8 jack that carry the a digital audio signal elimating any need for analog to digital conversion.

A $10 disposable digital camera has a dirt cheap computer inside. They have a 1.2 megapixel LCD sensor, 8MB of flash memory, an 8-bit Intel 8051 processor clone, a SDRAM chip and USB interface. Each of these computer parts is less than a $1.

I ordered one friday... from what already been found, it's looking good. Having the processor completely documented helps a lot - but I'll have to wait 'till I get mine to judge for sure. The firmware upload format looks like it may be ELF-based!