Disposable Digital Camera Interfacing

Pure Digital's Ritz Camera Dakota PV2 LCD variant

[camera pic]

Introduction
This is Pure Digital's second attempt at the low-cost "disposable" digital camera market.  The original version version was relatively costly to manufacture, was not really designed to be recycled easily, and had poor image quality; this version seems to be an attempt to fix those problems. The new PV2 cameras come in two versions: a blue one that is functionally similar to the original, and an LCD version that allows you to view the last picture taken on a small screen.

This webpage goes into a lot of detail, so I've put together a quick summary.

Disassembly
Here's a photo gallery of the disassembly of my unit. I didn't desolder the flash/battery board, but people who have report that the camera won't start up properly without it. Be careful - this version of the camera doesn't have the glob of glue on it to protect you from being shocked by the 600V capacitor (which will still hold a good charge even after firing the flash).

The back of the unit is held on by three screws located under the instructional sticker - two by the connector, and one by the battery door.

The lens has an electronically-operated mechanical shutter to protect the sensor from being burnt by the sun. This should improve the quality of the returns and make it more reusable. The body is now replaceable (you still need to remove 3 screws, but it's not that hard), and the use of a non-painted gray plastic should hide scratches and reduce the need to do this

The LCD does not act as a live viewfinder; it only shows the most recently taken image. You may can delete that image, but you will not be able to see the image taken before that (and you won't be able to delete that image, either).  The screen is a 1.5" TFT au optronics A015AN02V1 measuring 280 x 220 pixels. It looks particularly easy to interface with, so it could be used in other projects.

The two chips behind the LCD are a Samsung K9F2808U0B-YCBO 16Mx8 NAND FLASH and a Micron Technologies 48LC4M16A2TG-75F 4Mx16 SDRAM. The FLASH uses an interesting interface that multiplexes the address lines onto the data lines, resulting in a lower pin count (about half of the pins in that big package are unconnected).

Using a microscope, you can see some writing on the imager chip. Besides saying "SMAL CAMERA" twice, it has two other labels. "KGF" is probably a lot number, reticle position, or mask revision. The most interesting number is probably a part number: "SCT-M033F"  SMaL seems to keep their part numbers to themselves, and I didn't find any information on google -- the only other known part number I could find was for a VGA imager name the SCT-00VC (SCT stands for SMaL Camera Technologies).

Using a more powerful microscope, I was able to see the bayer filters and measure the resolution. The pixels looked square, and I measured 3.9 micrometers per pixel (and by pixel, I mean an individual single-color sensor in the bayer matrix). I had far less precise equipment to measure the active area of the sensor (I basically used a calibrated SOIC and eyeballed it). The area was about 0.2" x 0.1583", so that would yield an imager size of 1302 x 1031 pixels. It looks like it's the Ultrapocket 3 chipset -- the dimensions are close: (1280x960, 4 micrometer square pixels, 0.202" x 0.163"). The camera automatically crops the picture down to 1280 x 860, which makes the aspect ratio much closer to that of the images shown on the screen (which, for simplicity, uses the bottom line to display how many more picture can be taken).

Drmn4ea of Cexx.org has made significant advances in probing the signals to the imager chip.  He has been able to cut the clock signal to the chip so that a pure-black picture can be taken & the data produced used to help analysis of the compression routine.


Preliminary Analysis
I found that pressing the shutter and display buttons while turning on the camera yields a special diagnostic page. Mine said:

     INFO
FIRMWARE   6410
HARDWARE     06
TYPEID       27
ID DAA#########


The ID number seems similar to the serial number used in the older model Dakota. As both cameras use FLASH memory provided by the same manufacturer, this is probably the default format that Samsung pre-programs into its flash memory.  Type ID matches the USB Product ID.

Probing the chip-select lines of the SDRAM and the FLASH indicate that when the camera is on and the screen off, neither chip is active. (on the older camera, the code flash was active). This means that the processor has some sort of memory (flash, cache, or sram) or is halted and awaiting an interrupt from the shutter.

When there is an image on the screen, the SDRAM is active. This makes sense because the screen requires a whopping 60KB of information - too expensive to include in the ASIC.

In the older model camera, only the picture-reading commands were restricted with a special access code. This model may have the same restriction, or they may think that the proprietary file format will be too hard to decipher.

FLASH Memory Analysis
I removed the flash memory from the board and hooked it up to a custom-made FLASH memory reader. Commercial versions are available, but costly. Instead, I used a USB I/O 24 adapter connected to an Ironwood PA-SO48-S-01W SOIC adapter (although this adapter is much much cheaper), and ran this software I wrote (note: the software should be easy to port to different operating systems and adapters)

To lower costs, this FLASH chip contains the firmware that runs the camera, and it stores the pictures that have been taken. The images look encrypted, so even removing the flash memory isn't a viable way to recover pictures (nor is it too practical). I've got two descriptions of the memory: An analysis of the file structure and most files and an analysis of the file "FIRMWARE.BIN".

Hardware Analysis
Based on disassembling FIRMWARE.BIN, I'm figuring out the details of the hardware. There are a lot of registers that control various aspects of the camera - these are totally undocumented, but I'm trying to figure out what they do.

USB Command/Packet Analysis
 Gibby reports that the LCD version is based on a SMaL chipset. It connects with the same pinout and appears on the USB bus as:
/proc/bus/usb/devices:
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  2
P:  Vendor=0dca ProdID=0027 Rev= 0.01                                  [seems to be SMaL's vendor ID]
S:  Manufacturer=SMaL
S:  Product=Digital Camera
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=200mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
C:  #Ifs= 1 Cfg#= 2 Atr=80 MxPwr=100mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms

I've been analyzing the USB commands in more detail - it's a major project, and, although we've gotten it to respond, we're still working on getting useful data back.

SMaL Family Analysis
Another approach to analysis of this unknown camera is to examine similar cameras. While the driver software that PureDigital uses to access the camera is a closely held secret, the same SMaL chipset is sold to a vast number of other manufacturers who have a different sales model and freely distribute their drivers. Each camera is a slightly different mix of standard features (sensor, LCD, memory), but there is a good chance that they share many things in common with the PV2.  In fact, it was this approach that daBass used to get the first response from the camera.

To Do:
- Determine camera resolution and quality. ~500KB native files are generated, so my guess was about 1.3 megapixels like the previous version. PureDigital representatives have been saying 2.0 megapixels, but I haven't seen that number officially published.  daBass found clues in the header file that points to 1280x860 (1.1 megapixel). [done: I borrowed time on an über-microscope - see above]

- Determine location of the firmware. Is it in the SMaL chip, or is it stored in the FLASH? [looks like a bootloader capable of reading the FAT filesystem resides on the ASIC, while the main firmware image is in a file on the FLASH]

- Determine how to connect to a personal computer. (Is that legal? Yes.) [done.]

- Find a recycled camera for testing. I haven't found a recycled version of the older camera, so I can't analyze privacy concerns (if not done properly, there is a possibility that you may be able to recover the images taken by a previous owner of the camera). This needs to be a camera that has been reconditioned by Ritz/PureDigital, not one that has been simply used.


Speculation leading up to the PV2
The Beeb had an older article saying that a version of this camera with an LCD preview screen should be available for less than $20 in November of 2003.  That's close to what actually happened - it's $18.99 and came out six months later.

PC Magazine has a review of the original camera where they mention my work in interfacing it. They say:
As you might expect, we discovered several sites dedicated to creating a USB connection for the camera, letting you reuse it and eliminate the cost of image processing. This is one way to get more for your money, but Pure Digital claims that images it processes will be of higher quality, and that, in any case, it will shortly release a model that incorporates stronger security measures aimed at preventing this sort of hacking.

I correctly guessed that the LCD version will use a completely different chipset, so none of my previous work is be applicable.  Both versions have the promised anti-home-use measures, and it could potentially be very good.  Although I would like to interface these cameras to my computer, I applaud the fact that they are using technological measures to limit their product's uses rather than with legal means (which, if enacted, would have much further-reaching consequences for society).

Similar Cameras
You can get a souped-up camera with the same chipset for about $99. It features rechargeable lithium-ion batteries (instead of AA alkaline), and the camera resolution may be different.

Some of the cheaper cameras available, such as the $45 Argus DC1730, have a lower-contrast passive LCD screen and provide only VGA resolution pictures.


Site Directory
My HTML style is a bit free form; I like to link to lots of other sites and to my own material, so it may be hard to find all the information I have on my site. Here's a quick cheat-sheet of my major PV2 pages:
main pv2 page (this page)
summary - FAQ's
disassembly (dissection pictures)
flash memory (internal files stored in the camera)
firmware (contains my disassembler & extensive code annotations)
pv2mod (utility to modify the firmware)
usb commands (includes an analysis of the authentication mechanism)
hardware (memory maps & registers)
nvram (a particular file in the camera that stores important stuff)
dmca (a legal analysis)

Something Really Cool
A group of people used the original non-LCD version of this camera to take some incredible high-altitude pictures. See my short blurb, or go directly to their UX-1 site.

Related
I'm also working the CVS disposable digital camcorder.

Resources
The most current discussion has recently moved to the Camera Hacking message board.  The bulk of the older discussion can be found on the Dakota PV2 discussion board (generously hosted by the I-Appliance BBS, of iOpener fame). Someone started posting links to copyrighted material on the old board -- the members of the community (including me) felt that this was improper and didn't want to be associated copyright infringement.  The new message boards allow the editors to remove inappropriate material and, if necessary, ban repeat offenders.

cexx.org (the guy who also did a lot of work with the original, including a windows port of the reader) has a PV2-specific webpage.

Forkboy has a couple of PV2 tools including a nice GUI to unlock the camera, read firmware, or display a TFT. He also has a program that converts graphic files to the TFT format.

Binaryweaver's page has a walk through of how to use the fox z2 driver with a CVS camera, and sample pictures. Tom Vickers also as an excellent walkthrough.

daBass has an excellent analysis of the .RAW file headers, plus a disassembler and simulator for the V8-uRISC processor.

Sailpix has been working on understanding the decompression algorithm and has made excellent progress tracing the windows driver code.

Blue Donkey PV2 page has some good analysis, especially of the USB interface. Has a handy tool for experimentation.

Slashdot article on the introduction of this camera, with a link to some cexx.org goodness.

USA Today article linked to by slashdot article, describing how the camera will sell nationwide for $20. (This article is about 10x longer than their typical print article)

contact me: my email address is my first name (john) at my last name (maushammer) dot com.

Info on the original non-LCD version of this camera
other systems I've played with
visit my homepage