Reverse Engineering/CVS Camera
From Wikibooks, the open-content textbooks collection
There is a live, ongoing effort to reverse engineer the CVS® ONE-TIME-USE VIDEO CAMCORDER. Buy one at a CVS pharmacy for $25 to $30. You'll need a USB connection. One can simply solder a cable to the board. Some people make a plug from a Palm Pilot cradle or by cutting up a printer cable. Some people add a USB socket.
Graphical camera control software has been written for Windows, Linux and MacOS X. So far, you can:
- download the flash (help needed reverse engineering this!)
- download and upload files including
- video clips (*.avi, Xvid codec)
- an undocumented binary config file
- a log file
- other strange stuff
- patch the code in memory
- odds and ends (power off, get clock, etc.)
Patching the code in memory lets us hijack a button press event handler to jump to some code that turns the camera into a USB storage device until the camera is powercycled. This gives access to partition 1, where the videos are stored. We'd love to eliminate the need to press a button, and we'd love to start a new thread so that we don't lose access to the rest of the device until a powercycle. Getting this kind of access to the other partitions would be nice too.
The device has a MIPS CPU running the ThreadX OS. Reversing is done via 2-pass disassembly. First, GNU binutils is run on the binary. Second, the dismipper program (a custom hack) parses that to add useful comments for tracking data in the registers and for useful labels. We share data to provide the labels.
See Maushammer's site and the Camerahacking forum if you would like to participate.
[edit] Further reading
- "Disposable Digital Camera Interfacing" by John Maushammer
