Camcorder Firmware Monitor Analysis

Pure Digital's Camcorder for CVS

[camcorder pic]


Firmware Monitor
Although I haven't been able to actually use it yet, there is software evidence that the camera contains a firmware monitor.

This program allows a number of diagnostic commands to be entered, typically over a serial port. I suspect that some of the camera's unlabeled pins (maybe under the glob of glue) are serial port connectors. I might be wrong -- the monitor could disabled or it could use the USB port.

A lot of debug messages have been found, and they may also go to this port. They are not necessarily enabled by default.

The monitor offers 180 commands, and breaks them down into related groups.


This looks like the minimal set of commands related to the monitor:
help <name> Prints function help
ls Prints all avaliable functions help
quit Quits the monitor
prompt <string> Set new prompt

This looks like some interesting debug stuff:
cr <compression ratio> Set compression ratio
ei <op> <p1> <p2> <p3> <p4> Edit Image
getexp Get exposure
setexp <New exposure> Set current exposure
wbs <R> <G> <B> Set WB (white balance) scalers
wbm <Mode> Set AWB mode
aem <Mode> Set AE mode
wbosd <1/0> Turn AWB debug OSD on/off
aeosd <1/0> Turn AE debug OSD on/off
afosd <1/0> Turn AF debug OSD on/off
wbosdmove <move> Slide AWB debug OSD up/down
aeosdmove <move> Slide AE debug OSD up/down
afosdmove <move> Slide AF debug OSD up/down
wbdisplay <1/0> [element] Turn AWB debug display on/off
wbdisplaymove <move> Slide AWB debug display u/d/r/l
afdisplay <1/0> Turn AF debug display on/off
afdisplaymove <move> Slide AF debug display u/d/r/l
aedisplay <1/0> Turn AE debug display on/off
aedisplaymove <move> Slide AE debug display u/d/r/l
afwinget Get window AF values
afwinset Set window AF dimensions
wbcalib (White balance calibration?)
stat <pattern> Set statistics pattern
statdebug <on/off> Print statistics on/off

This may be low-level hardware configuration, plus motor control (obviously not on this camera):
utg_set_cfg <cclkout driven> <cclk freq int>
<cclk freq frac> <half freqc> <force low> <edges>
Set UTG configuration
utg_load_cfg <index of res file> Load UTG configuration from res file
utg_start_dcu Start DCU UTG client
utg_reg_frame <index of res file> Load and register UTG frame from res file
utg_set_seq <requests>
< <frame id> <sub line> <sub cnt> <repeat> >*
Set UTG sequence
utg_load_seq <index of res file> Load UTG sequence from res file
utg_set_phase <id> <rise (qnano)> <fall (qnano)> Set phase of high-res signal
utg_set_global <phase (qnano)> Set global phase of high-res signal
utg_set_drive <id> <mA> Set drive of high-res signal
utgsetdp
utgsp <MinusShift> <Range> <Step>
utgs1p <SignalID> <Rising> <Falling>
utgsetdd
motor_shutter open/close 0 - open; 1 - close
motor_iris big/small 0 - big; 1 - small
sony_iris move iris motor (o - open, c - close)
fh Move focus to home position
fmove Move focus
fs <SearchRange> Search for correct focus position
fm
Enter manual foucus
zhome Move zoom to home position
zmove Move zoom
zmanual
Enter manual zoom
emanual
Enter manual exposure
lens_open
1 - open, 0 - close
strobe
Set strobe mode
sp <PortID> <Data> send TG(0)/AGC(1) sp data
spsharp <Data> send TG(0) sp data
getsharptg <Part> Get TG sp data
sdsharp Search sharp phase
sdadsharp Search adclk sharp phase
sddksharp Search dclk sharp phase
agcsp
sdsp
sdspfine
praw
utgasphase
zm
focus_temp
sonysp
read_delay
j_test get edge info
faf_mode set faf mode
gpioset (low level general purpose I/O?)

Most of these look like they are default ThreadX functions:
mi [pool] Get Max Alloc Size
rl <addr> [dec/bin/hex] Read 32 bit address
wl <addr> <data> Write 32 bit address
rv <name> [dec/bin/hex] [width=1/2/4] [index] Read a variable value or array index
wv <name> <data> [width=1/2/4] [index] Write a variable value or array index
rg <addr> [dec/bin/hex] Read 16bit GPP RAM address
fc <addr> [param]+ Call a function
mf <addr> <size> <fill> Fill memory with a value
dump <c/u><addr><size> Dump memory to screen
dumpx <addr><size> Dump DRAM to screen. Hex Input
sum <mode> I43_SetUsbMode
hqd Host queue dump
casio Switch to Casio LCD
Causes the screen to flicker for a split second.
viewc View on Casio LCD
setp <prmid> <value> Set parameter
getp <prmid> Get parameter
mode <mode id> Set functional mode
cc <id> <value> I43_ConfigCapture
tt [fullinfo] Dump thread table
txt Dump threadX table
tmrt Dump timer table
mt [fullinfo] [pool] Dump Alloc table
mxt [pool] Dump pool structure
qt Dump queue table
qi <queue id> Dump queue info
et Dump events table
smt Dump mutex and semaphore table
dumpf <addr> <size> <file> Dump memory to file
Confirmed, but doesn't seem to work if address=0.
playerdump Dump player info
getsr Dump status registers Sr1 & Sr2
cgut Dump CGU table
mips [MillOps] Get available MIPS
ver Get version number
prof <0/1 StartAdd EndAdd> Profiling tool
cmdcr <file name> Command file create
cmdex <file name> Command file execute
sci <cur img> I43_SetCurrentImage
sfc I43_SetFormatConvert
wav <file name> Play Wav file
dramsize Print dram size
pcc I43_PlaybackClipCommand
mpeg4 Swich to MPEG4 video
wmv Swich to WMV video


Transcoder functions// Monitor functions in list @ 8013072c:
trans <input_obj> <ext> <start_time> <end_time> (start transcoder?)
tkill <> Exit transcoder
tgop <gop size> Set transcoder gop size
text <extension> Set transcoder file extension
trb <max b frames> Set max b frames
tvbr <Si> <Sp> <Sb> Set constant quality scalers
tcbr <Bit rate> Set constant bitrate value
twin <Window size> Set brc window size
tcnst <on/off> Set const frame type
trate <Rate> Set conversion rate
tsb <on/off> Enable/Disable stabilizer
tmode <stab/norm> Set transcoder mode
tbrc <level> Set bitrate level control

Looks like a left-over example function from ThreadX:
custom <var 1> <var 2> Print the input numbers

Media commands (some may be default FileX commands):
set_media <media_name> Choose media types
smed <media_name> Choose media types
format <media> Format a media
mount <media> Mount a media
mountdram Create and Mount Dram media
flush Flush the media
gms Get media status
delall Delete all DCF objects
delete <object number> Delete an object
lock <object number> Lock an object
unlock <object number> Unlock an object
copy <object number> Copy an object
move <object number> Move an object
copyto <media> <object number> Copy an object to another drive
dcfdump [media] DCF dump
cfread <sector number> [num of sectors] (low level read?)
sdread <sector number> [num of sectors] (low level read?)
msread <sector number> [num of sectors] (low level read?)
ssfdcread <sector number> [num of sectors] (low level read?)
nandread <sector number> [num of sectors] (low level read?)
nandreadp <sector number> [num of sectors] (low level read?)
nandnsread <sector number> [num of sectors] (low level read?)
noraread <sector number> [num of sectors] (low level read?)
noriread <sector number> [num of sectors] (low level read?)
cd <Path> Change directory
cdc Change dir to first DCF folder
dir <Path> List directory's contents
ren <Source Path> <Dest Path> Renames a file/directory
mkdir <Path> Create a directory
del <Path> Delete a file/directory
cfflush <sector number> [num of sectors] Flushes contents into file
msflush <sector number> [num of sectors] Flushes contents into file
msflushp <sector number> [num of sectors] Flushes physical contents into file
nandflush <sector number> [num of sectors] Flushes contents into file
nandnsrflush <sector number> [num of sectors] Flushes contents into file
burstmode 1(On) or 0(Off) Switches read operations mode
msextra <number of blocks> <FileName> Flushes extra bytes into file
nandextra <number of blocks> <FileName> Flushes extra bytes into file
ssfdcextra <number of blocks> <FileName> Flushes extra bytes into file
cferase <sector number> [num of sectors] Erase CF sectors
nanderase Erase the whole Nand media
ssfdcerase Erase the whole SSFDC media
norerase Erase the whole Nor media
ssfdcreadp <sector number> [num of sectors] Read physical sectors
ssfdcwritep <sector number>
[num of sectors] [data value] [extra value]
Write physical sectors
ssfdcreset Reset SSFDC
msreadp <sector number> [num of sectors] Read physical sectors

Unknown, but interesting functions:
fc2c (unknown)
fccc (unknown)







Back to the CVS Camcorder Firmware Analysis page

My main CVS Camcorder analysis page

other systems I've played with
visit my homepage