Ritz Dakota Digital Camera

Disposable Digital Camera Interfacing

Pure Digital's Ritz Camera Dakota variant

Introduction
The Dakota Digital is a low-cost digital camera, adapted for a specialized business model. For $11, you get a 25-shot 1.2 megapixel digital camera that is intended to be processed where you purchased it, at an additional cost of $11. The problem is that the quality is considerably less than normal film-based disposable cameras (see these sample pictures taken by andy888, which seem to suffer from a misaligned lens), and at $1/picture, also considerably more expensive. The other problem is that this machine is neither cheap to produce, nor easy to recycle. It has a zillion parts, including 24 screws of about 5 different types, and flash memory that seems needlessly oversized. Unlike disposable film cameras that are built on an internal frame and come encased in a replaceable cover, this camera is built on its external plastic case - a case that, when becomes damaged, requires an unreasonable amount of labor to replace.

Pure Digital is the original manufacturer for Ritz Camera, and also has been supplying cameras for a much more limited test in various Wisconsin-area Walgreens stores. The Walgreens camera is based on a different chipset (more info about that camera here), and while it hasn't been interfaced to a computer yet, it has been modified by codeman to accept smartmedia cards (picture).

Project Goals

To interface this camera to standard personal computer photo software so that a user may retrieve their own pictures from the camera. This allows the full benefits most digital cameras offer: instant processing, the ability to view pictures and only print the good ones, and the convenience of not having to go to a photo store to get prints.
To fully analyze how the pictures are stored in memory to see if there are any important privacy concerns users should be aware of. I hope that the memory is completely erased between users so that the recipient of a recycled camera cannot retrieve the previous users' pictures.
To write a program flash extractor so that other people can disassemble the code contained in their cameras. By documenting the SPCA504B's registers more fully, others can write new original software to make the camera more functional. For example, by lowering the quality of pictures taken, more to be stored memory. Other possible improvements include time-lapse photography, or a modem interface for remote picture taking.
Since the lens is relatively cheap and seems to be the camera's biggest weakness, I'd like to attach a Nikon F-mount so that I can use professional-quality lenses. Dave Arney documented his Nikon mount with a more expensive camera. Downloading pictures in real-time is essential for alignment and adjusting focus, or there might be some sort of factory test routine that could help out.

Procedure
The processor used in this camera is a custom chip manufactured by Sunplus labeled "SPCA504B". Since it is based on a not-too-powerful industry-standard Intel 8051 processor, most of the work involving the large amounts of picture data is handled by specialized hardware - the processor just orchestrates data movement. The integrated peripherals include a CMOS image sensor controller, an SDRAM scratch-pad memory controller that holds pre-compressed images, a JPEG compression engine, a FLASH memory for picture storage, and a USB communication interface to a personal computer.

This camera uses a different FLASH memory for code storage than the one used for picture storage. Like programs stored on floppy disk can be read with a disk drive, a suitable off-the shelf reader can read this flash once it has been removed from the board. The result is a raw binary image of the code. I then used Mark Hopkins' freeware disassembler "Dis8051" to translate the binary code to human-readable format (I fixed a major bug and added improvements - download here). Although more readable, this disassembly listing does not contain any function or variable names, and does not contain any description of how the various peripheral-control registers are used. Most of my information comes from painstakingly tracing and annotating the disassembled firmware contained in this chip.

Linux-compatible drivers have been written for similar cameras by observing how a Windows-compatible driver interacts with the camera, but since the only drivers for this camera are not publicly available, this technique cannot be used. However, existing open-source drivers for similar chips have been very helpful.

Analysis (and the bulk of info on this website)
Hardware documentation, including internal registers and wiring.

How to build a USB cable to interface to your computer for $6.86 (or less!). Dennis Lou provided two more detailed rewiring how-to's: a palm cradle and standard Centronics printer connector.

First method of retrieving pictures: Low level reading of flash data over USB is slow, but works.

Second method of retrieving pictures: Understanding the low-level USB commands allows high-speed bulk transfer of pictures.

An analysis of the flash storage format is a first step towards evaluating privacy concerns.

Downloads: Data Dumps & Software for Exploration
The code stored in FLASH memory is copyrighted, so it's unavailable for redistribution on this website. I'm working on a way for users to retrieve the code out of their cameras and then merge in my commentary.

Tim of cexx.org dumped the external RAM memory space. This helped generally map out how RAM, registers, and ROM are placed in the processor's memory space.

I wrote a program called flashdump to do a raw dump of the picture flash memory. This outputs both the main and ECC data areas, as they are required to extract data stored in the Smart Media format. This provides the same results that you'd achieve by desoldering the picture flash from the board and reading it in a compatible memory reader.

I have two data dumps of my picture flash available for inspection. My first data dump (216KB) contains one real picture and one deleted picture, and has been analyzed byte-by-byte. My second data dump (1.9MB) is the result of taking two more pictures, removing power accidently, and then taking one more. I have not completed my analysis of the second dump yet.

The program flashdump2iso.c will convert a picture flash dump into a file system image ready for mounting. The result of running my second data dump through this program is this flash-dump.iso (2.0MB) file -- mount at your own risk; using read-only permissions is strongly suggested. See the notes at the top of flashdump2iso.c for a more detailed description of the hazards. This file mounts perfectly under Mac OS, but apparently you need to remove the first cluster (containing the disk partition) for use under Linux (use "dd skip=32 if=flash-dump.iso of=out.iso" to remove the first cluster, 32 * 512 bytes). If you don't want to mount the iso, you can download my pictures directly:


DSC_0003.JPG 88 kB	DSC_0008.JPG 560 kB	DSC_0009.JPG 556 kB	DSC_0010.JPG 708 kB

Although my lens shows significant distortion at the corners, it is much better than andy888's.

Downloads: Actual Useful Software
High-speed bulk transfer software has been written to support a variety of platforms:

Macintosh: Pureread is a command line application allows reading of pictures and low-level exploration of the camera - download the source and executable here. As of December 30th, I added routines to play with the camera's LCD. And, as of Feb 18th, I added a picture-taking trigger. Loren Brichter has written a gui-based version of pureread that most people will probably find easier to use. Eventually there should be a iPhoto plug-in, but I haven't gotten around to that yet.

Linux / Solaris / Un*x-like: An application called gPhoto already supports nearly 400 cameras; my addition will hopefully push it closer. The portion of this program that contains the camera interface functions is called libgphoto2, and version 2.1.5 was the first version that incorporates support for this camera. You can also download the essential portion of my modified source based on a slightly-older 2.1.2 version (note: this version doesn't support the "take a picture now" command, while the gPhoto version does.)

Compiling gPhoto from source code can be somewhat painful, so I've provided an alternative. If you already have gPhoto installed, you can copy these pre-compiled libraries (150kB) to either /usr/lib/gphoto2/2.1.2/ or /usr/local/lib/gphoto2/2.1.2/ depending on where gPhoto is installed. One user running Fedora Core 1 (based on RedHat) had gphoto 2.1.2 installed by default in /usr/lib/gphoto2/2.1.1 -- he renamed libgphoto2_spca50x.so to saveme before copying in my precompiled library. To test it out, try running "gphoto2 -L" (you may need to be superuser if the permissions on the USB port aren't set correctly).

Another alternative is to use these pre-built debian packages kindly built by Russ Knize.

Windows: Ok, this is the one you were waiting for. Tim ported my mac version and has a nice windows GUI at his site.

Firmware Upload
Rodrigo Balerdi has figured out how to perform a firmware upload to make modifications to the built-in software. He's made a number of improvements to his camera, including removing the 25-picture limit and fixing a bug in the default software. It's great work.

The DMCA
What I'm doing is totally within my rights as a consumer, but some companies have been brandishing a new law in order to limit how consumers can use their products once sold. I've bought the camera and am downloading my own pictures, but companies have used their lawyers to protect ill-conceived business models. I have no idea how Ritz and/or Pure Digital will react to my interoperability software, but I've written up a description and analysis of the DMCA and cases brought so far. (wow, it's the first hit on google for "firmware dmca"!)

Other Versions
I've figured out how to interface the second and third generations of this camera. The second generation has an LCD sceen and is named the "PV2". The third generation is the CVS Disposable Camcorder. This was hard work because they are totally different systems.

Something Amazing

A couple of guys mounted a Dakota camera to a weather balloon and launched it. It rose to 52,000 feet and took some incredible pictures. Wow, just beautiful - way to go!

Here's one of the pictures that people could only dream of 75 years ago.

Resources
RevJim's PureDigital Wiki has the most complete development notes, including many of mine. The I-Appliance BBS (of iOpener fame) also has a Dakota discussion board and a Walgreens discussion board.

Besides doing a lot of research and porting pureread to windows, cexx.org has more sample pictures and focus-adjustment experimentations. Warning: if you have an ugly wallpaper phobia, don't follow that link! (not that it's any worse than what's in my bathroom, though). Tim has also been working on getting a web-cam mode working.

Rodrigo Balerdi has figured out how to perform a firmware upload to make modifications to the built-in software. He's made a number of improvements to his camera, and has some amazing documentation on his page!

Electrical datasheet for the camera's main chip: spca504bv01.pdf (thanks to gentlenews, one of the first places hackers started gathering to compare notes). This datasheet contains pinouts, timing, and block diagrams, but has practically no information on programming.

Gphoto is a popular open-source program that interfaces to many similar cameras. It is included in most major Linux distributions, and includes both command-line and GUI interfaces. Thanks to Mustek, which documented the interface to its cameras.

The people at Portelligent did a professional 50-page dissection of this camera. You can order the full report from them, or you can read a summary (including block diagram) at E.E. Times. This is one of my favorite columns in that magazine.

Walter Mossberg's camera review at the Wall Street Journal. A kindred spirit! He took apart his camera to see if it contained a standard memory card he could read on his computer (answer: no).

Jeremy Pavleck's MSN HackingTheRitzDigitalDisposable Group has a good set of documentation. He also maintains an archive of useful information at his site.

I first found out about this camera from this slashdot a rticle. The page includes hundreds of comments from slashdot readers.

I got slashdotted!! Check out my server stats from that day and week - the blip at the far left at 20:00 Wednesday night is me; the larger blip from early Thursday morning to Friday evening is my server's weekly backup. The crush of slashdot readers following links in a new story is often enough to overwhelm most websites, but cubesoft's capable server easily sustained the extra traffic without causing delays for the other sites hosted on the same machine – I've been with them for years and recommend them to other geeks.

Thanks to Roy, Tim, Farris, RevJim, and everyone who contributed to the revjim wiki!

contact me: my email address is my first name (john) at my last name (maushammer) dot com.

other systems I've played with
visit my homepage