Pure Digital / CVS Disposable Camcorder Flash Analysis

Camcorder Flash Memory Analysis

Pure Digital's Camcorder for CVS

Storage format
The built-in 128MB Hynix flash (datasheet) uses the standard Smart Media format used in the first version of the still camera. As per the standard, every 512 bytes of data has an additional 16 bytes allocated it to help manage bad blocks. The ECC field and Block Address fields are used, so I used the same conversion program I wrote for the older camera -- flashdump2iso.c.

Partitions
Once the Smart Media format has been stripped, the flash contains five volumes. I've only identified them by sight, so I'm not sure if there is a formal partition table like those found on hard drives.

The flash memory is divided like this:

start	end	size	Format	Drive	Description
0	3FF		?	-	Unknown - partition table?
400	5FF	512 B		-	volume header for firmware partition
600	139BFF	1253 KB	ELF	-	Firmware
139c00	1BBFFF	521 KB	FAT12	A:	"ResourcesA" - general system resources
1BC000		~112 MB	FAT16	I:	"NO_NAME" - user data
7008000*	706FFF0*			-	unknown; could be part of user data or ResourcesB.
736C000*			FAT12	B:	"ResourcesB" - serial number
7788000*			FAT12	C:	"ResourcesC" - application-specific resources

* Absolute location in FLASH, not after smartmedia wear-leveling algorithm. I accidently overwrote my ECC data while doing that analysis, so now it's impossible to find out the correct address.

The "Resource" volumes are referred to internally with MS-DOS style drive letters.

Firmware
The firmware is not in a unique file (as it was on the PV2). Instead, it is just a section of flash memory near the beginning, about 1255 kB big.

I have reverse-engineered a lot of information about the firmware.

ResourcesA Partition
This part of the FLASH memory starts (on my camera) at offset 0x139c00 - 1bbfff (about 521kB total). It is a standard FAT12 DOS partition named "ResourcesA".

The files contained in this partition are:

-rwxrwxrwx      64 Jul 31 1971 YLUT.BIN
-rwxrwxrwx      44 Jul 31 1971 WAVEXIF.BIN
-rwxrwxrwx      38 Jul 31 1971 VIDSIZE.BIN
-rwxrwxrwx      46 Jul 31 1971 USBSTRINGS.BIN
-rwxrwxrwx      28 Jul 31 1971 USBMSINQSTR.BIN
-rwxrwxrwx      36 Jul 31 1971 USBMODEDESC.BIN
-rwxrwxrwx       6 Jul 31 1971 USBDEVDESC.BIN
-rwxrwxrwx      12 Jul 31 1971 TGCFG.BIN
-rwxrwxrwx     782 Jul 31 1971 TG1.BIN
-rwxrwxrwx     782 Jul 31 1971 TG.BIN
-rwxrwxrwx    3320 Jul 31 1971 P.BIN
-rwxrwxrwx   59268 Jul 31 1971 MOTOFONT.BIN
-rwxrwxrwx      50 Jul 31 1971 MEDIAFORMAT.BIN
-rwxrwxrwx     512 Jul 31 1971 LCLUT0.BIN
-rwxrwxrwx     928 Jul 31 1971 I.BIN
-rwxrwxrwx    2159 Jul 31 1971 GRAYCHART.JPG
-rwxrwxrwx    4252 Jul 31 1971 GPP.BIN
-rwxrwxrwx     960 Jul 31 1971 GAMMALUT9.BIN
-rwxrwxrwx     960 Jul 31 1971 GAMMALUT8.BIN
-rwxrwxrwx     960 Jul 31 1971 GAMMALUT7.BIN
-rwxrwxrwx     960 Jul 31 1971 GAMMALUT6.BIN
-rwxrwxrwx     960 Jul 31 1971 GAMMALUT5.BIN
-rwxrwxrwx     960 Jul 31 1971 GAMMALUT4.BIN
-rwxrwxrwx     960 Jul 31 1971 GAMMALUT3.BIN
-rwxrwxrwx     960 Jul 31 1971 GAMMALUT2.BIN
-rwxrwxrwx     960 Jul 31 1971 GAMMALUT1.BIN
-rwxrwxrwx     960 Jul 31 1971 GAMMALUT0.BIN
-rwxrwxrwx     256 Jul 31 1971 GAMMADDE1.BIN
-rwxrwxrwx      64 Jul 31 1971 EPS_XSCL.BIN
-rwxrwxrwx     124 Jul 31 1971 EPS_GCP0.BIN
-rwxrwxrwx      64 Jul 31 1971 DLUT.BIN
-rwxrwxrwx    7844 Jul 31 1971 CTLUT1.BIN
-rwxrwxrwx   10460 Jul 31 1971 COMIC.BIN
-rwxrwxrwx   17328 Jul 31 1971 COLORCHART.JPG
-rwxrwxrwx     128 Jul 31 1971 BASENLGF0.BIN
-rwxrwxrwx    4592 Jul 31 1971 B.BIN
-rwxrwxrwx      24 Jul 31 1971 AWBSETTINGS.BIN
-rwxrwxrwx      54 Jul 31 1971 AWBCFG.BIN
-rwxrwxrwx      38 Jul 31 1971 AVISTRLSTR.BIN
-rwxrwxrwx      16 Jul 31 1971 AVIMODELSTR.BIN
-rwxrwxrwx      13 Jul 31 1971 AGCCFG.BIN
-rwxrwxrwx     263 Jul 31 1971 AGC1.BIN
-rwxrwxrwx     263 Jul 31 1971 AGC.BIN
-rwxrwxrwx      72 Jul 31 1971 AF.BIN
-rwxrwxrwx     224 Jul 31 1971 AEGAIN.BIN
-rwxrwxrwx     220 Jul 31 1971 AE.BIN
-rwxrwxrwx     898 Jul 31 1971 ADC.BIN

COLORCHART.JPG is a rather poor 320x240 representation of the standard Macbeth color chart. It's actually a screenshot of a windows program with the title "The Macbeth ColorChecker®", and at the bottom it says "©2002 GretagMacbeth". Since it's a JPEG picture of a geometric chart, the compression results in some ugly artifacts. It's usable for a production test, but I don't know if that would require a license from Macbeth.

The file COMIC.BIN starts with the string "Comic Sans MS" -- the font is used for the firmware page (power on while pressing record and delete). While Microsoft used to distribute this for free, the license (faq) prohibits redistribution in modified form and in commercial products, so this must have been licensed to be legal. The file MOTOFONT.BIN starts with "jopa\0 Sans MS", but the spacing of the last 8 characters matches that of "Comic Sans MS". There are clearly some other bit-mapped fonts in there, too.

The contents of the 4 USB-specific configuration files is:

UsbDevDesc.BIN: 00000000 7b 16 80 30 01 00	167b is the Vendor ID (VID)
UsbModeDesc.BIN: 00000000 01 01 02 00 03 00 ff ff 00 00 00 00 ff ff 00 00 00000010 00 00 ff ff 00 00 00 00 ff ff 02 00 03 00 02 20 00000020 02 00 04 00	0101 is the Product ID (PID)
UsbMSInqStr.BIN: 00000000 5a 4f 52 41 4e 20 20 20 ZORAN Vendor Information 00000008 43 4f 41 43 48 36 20 28 COACH6 (I62) Product Identification 00000010 49 36 32 29 20 20 20 20 00000018 31 2e 31 30 1.10 Product Revision Level	These are the strings from the "INQUIRY" command (see the USB UFI spec, Table 10). MS refers to "Mass Storage". This is good evidence that the camera can appear like a memory stick and videos downloaded without any special drivers!
UsbStrings.BIN: 00000000 50 75 72 65 20 44 69 67 69 74 61 6c 20 49 6e 63 \|Pure Digital Inc\| 00000010 2e 00 53 61 74 75 72 6e 20 00 50 53 30 30 30 30 \|..Saturn .PS0000\| 00000020 30 31 30 00 50 53 35 30 30 30 30 31 30 00 \|010.PS5000010.\|	Manufacturer : Pure Digital Inc. Product : Saturn Serial Number: PS0000010 (these are null-terminated as used in C, not the format used by USB)

ResourcesB Partition
This partition contains a single file:

-rwxrwxrwx 2052 Jun 24 04:45 USP.BIN

The time is interesting because the camera updated it either when I turned off the camera or last recorded a video (which was, according to STATFILE.TXT below, June 24 4:44:46).

This file contains the camera's serial number, lock/unlock codes, and operating parameters (such as resolution and recording time limits). It is covered in more detail here.

ResourcesC Partition
I lost the ECC data for this partition, too, so I couldn't inspect the files closely.

It looks like this contains the file that makes the camera unique to CVS and Pure Digital:

The files in this partition are:

-rwxrwxrwx     956 Nov 25 1961 DEFECTIVEPIXEL0.BIN
drwxrwxrwx    5120 Dec 27 1970 ZBM
-rwxrwxrwx    3508 Jul 31 1971 SOUND8.WAV
-rwxrwxrwx 7994 Jul 31 1971 SOUND2.WAV
-rwxrwxrwx    3186 Jul 31 1971 SOUND1.WAV
-rwxrwxrwx 998 Jul 31 1971 SOUND0.WAV
-rwxrwxrwx   24552 Jul 31 1971 PROCESSED.JPG
-rwxrwxrwx    7994 Jul 31 1971 PLAYBACK.WAV
-rwxrwxrwx    2052 Jul 31 1971 FSP.BIN
-rwxrwxrwx   24634 May 12 22:35 SPLASH.JPG
-rwxrwxrwx   18274 May 12 22:35 SHUTDOWN.JPG
-rwxrwxrwx   14705 May 12 22:35 LOGO.JPG

The ZBM directory seems to contain bitmaps. I recovered the file list by hand:

STATTIMER-7.ZBM
STATTIMER-8.ZBM
STATTIMER-COL.ZBM
STATTIMER-E.ZBM
STATUSBARTEXT.ZBM
VIDEO-LENGTH.ZBM
VIDEO-NUMBER.ZBM
VIDEO-SAVED.ZBM

The file "FSP.BIN" is covered in more detail here.

User Data (videos) Partition
This part of the FLASH memory starts (on my camera) at offset 1bc000. It is a standard FAT16 DOS partition named "NO_NAME"

The files contained in this partition are: (before downloading a video, look at the text descriptions below - the first two are boring)

-rwxrwxrwx     1268 Jun 24 04:44 STATFILE.TXT
drwxrwxrwx    16384 Jun 24 17:20 DCIM

drwxrwxrwx    16384 Jun 24 17:20 DCIM/100COACH

-rwxrwxrwx    75404 Jun 24 02:01 DCIM/100COACH/PICT0001.AVI
-rwxrwxrwx    68630 Jun 24 02:01 DCIM/100COACH/PICT0002.AVI
-rwxrwxrwx 1392036 Jun 24 02:02 DCIM/100COACH/PICT0003.AVI
-rwxrwxrwx   500212 Jun 24 02:25 DCIM/100COACH/PICT0004.AVI
-rwxrwxrwx   767770 Jun 24 04:44 DCIM/100COACH/PICT0005.AVI

The file STATFILE.TXT is a log of every operation performed with the camera. Most interesting is that the camera has been factory-set with the correct date and time! The timezone wasn't Mountain Time, but that's understandable.

**REBOOT
**REBOOT
REC,PICT0001.AVI,2005, 6,23,22,26,14, 143,30,   190802, 42
DEL,PICT0001.AVI,2005, 6,23,22,26,14
**REBOOT
...
REC,PICT0001.AVI,2005, 6,24,02,01,10, 114,30,    75404, 42
REC,PICT0002.AVI,2005, 6,24,02,01,58,   96,30,    68630, 42

Besides the action (REC or DEL) and the filename, the year, month, date, hours, minutes, and seconds are recorded. The next field looks like the number of frames * 2, and the field after that (always 30) is the number of frames per second. Lastly comes the filesize (in bytes), and then a constant "42". I'm guessing the 42 is a codec or firmware version.

The 5 short videos I recorded appear in the filesystem. They are non-encrypted 320x240 resolution XviD movies. The maximum data rate is 417 kb/sec. (Note, this quarter-VGA, not full VGA quality as reported in the SFGate article. I don't know where they got that figure, but since they interviewed PureDigital's CEO Jonathan Kaplan, I assume it came from the top. Or maybe it is still technically true - they say the sensor captures that resolution; not that the camera actually records it).

Because I didn't know if the recording format was going to be proprietary or encrypted, the first two movies are test movies:

PICT0001.AVI (75KB) is an all-white movie.
PICT0002.AVI (70KB) is a movie of pitch black (it will not win any awards).
PICT0003.AVI (1.4MB) is the dragon guarding my cubicle (here's more information about it, including a .pdf so you can make your own)
PICT0004.AVI (500KB) is an outdoor shot of the beautiful Rocky Mountains & evening sky. It then pans to my bike. It's recorded at about 417 kbits/sec.
The guys at the office thought the camera would be useful to capture their mountain bike exploits in Moab - they wanted helmet cams on everyone that could take a face-plant. I was trying to think of a good example movie, so I tried to record some of my X-treme motorcycle racing action like they have on late-night television commercials. Kawasaki Ninja 250cc, baby*! I can get into 6th gear in the parking lot (30mph)! I recorded about 5 minutes of me heading down the road. A co-worker of mine saw me leaving and caught up to me on his bicycle -- oh, the shame! I thought it would make a good video, but afterwards I found that the camera angle shows only my left hand dutifully operating the turn signals in a perfectly non-deviant behavior. So, I deleted it.
PICT0005.AVI (750KB) is a bonus video. In the event that the videos were encrypted or in a proprietary format, this was to be a reward to anyone who could make sense of it. But since it's a standard file, it's not too difficult to decipher! Don't expect much - it's a tour of the setup I used for the disassembly photos.

For comparison, here's how the Adam Preble's videos looked after the "official" CVS development process. This NPR story has two more sample videos, downloadable directly from Pure Digital.

Main CVS Camcorder discussion board - lots more info from others!

My main CVS Camcorder analysis page
Info on the PV2 still disposable digital camera (also with LCD screen)
other systems I've played with
visit my homepage

* Actually, the Ninja 250 is a great learner bike, and it's a blast to ride. The official model number is "250EX", but the sales guys call it the "250R". Guess that sounds sexier, but I think "999" sounds even better. One piece of advice I read about selecting a beginner bike was not to pick a model with an "R" in it - this bike goes against that rule.