MD-80 vs. Clone

[Team Seneca]

It is not clear yet how this image data is formatted for use in the camera, but at least we can confirm that there is font data in the files. Taking a step back and looking at the "big picture" will make the fonts obvious. You can even see what appear to be multiple copies of the font and even what looks like Chinese fonts as well.

Suggestion:

Maybe replace the "9-0/" ranges with whitespace would make the font invisible?

Christian

That was the general idea. I've been trying to rid this camera of the date stamp ever since I got it and I found there are many different types of these little cameras on the market and some people have done what you suggested with those cameras, but the same files do not work in the MD-80 clone or the Gum Stick camera.

I think the gum stick camera is also a clone, by the way. I think there is an original and then many copies of that one.

[Team Seneca]

just so anyone knows,

aircommand is working on a similar solution.
we're kept updated via the yahoo forum.

he's got some progress done, he posted some stuff which i dont get (cos i dont need this camera, lol)

Bill's approach is certainly the right way to go to remove the date at the source before it is overlayed on the video rather than after it is embedded in the video like what I am trying with a filter. Bill's probably trying this approach already, but since the font data he provided in the file does not appear to be encoded I'd try to change the font data for a single character to see if the change is reflected in the recorded video. If that works, then you should be able to just clear all the font data in the bin file, so the date is still displayed in the final video, except it's all clear characters. Interesting though that the font is repeated a number of times, and there could always be some sort of a checksum on the file that may prevent tampering. It will be interesting to see where Bill gets with it.

Bill: Was this data file for the MD-80 clone or the gumstick camera?

Though the post production filter approach is not ideal, it should be possible to apply it to existing video or for those cameras that can't have their code updated.

That camera would really help us go higher, bit that graphic overlay would make it worthless when we went to create one of our trademarked aerial Panorama images.

USWR: I think you could still use the cam for your panoramas without any modification. If you just crop the bottom 30 pixels of the images from the video, then there should still be plently of coverage from the video sequence to re-assemble into your great panoramas.

The binary came from the gumstick camera on philfifi's website. Someone else attempted to use a filter to get rid of the time display a while ago and posted the result to youtube and it looked horrible. Worse than the date code itself!

[Team Seneca]

One more thing:

In my research on this camera and the other ones like it (the yellow timestamp on the bottom right of the screen) I noticed a lot of people complain about the camera working for a while and then quitting. The symptom is usually that the camera stops responding to keypresses and will not show up as a drive when plugged into USB. I origianlly thought this was due to the abuse these cameras take (they are being flown on all sorts of rockets and aircraft models) and they are being shaken until they brake.

However, my clone camera died the same way when I was doing a test to see how long it would record for. After a couple long videos were made, it died.

I suspect that these guys put in a "lifetime" counter. You know that movie "Blade Runner"? Well, these cameras may be programmed to "die" after a certain amount of recording time.

This is just speculation on my part.... but it seems feasible.

[spinner]

>This is just speculation on my part.... but it seems feasible.

They come with really cheap batteries. Maybe it died. Or maybe there is (or was) a short circuit in the camera (e.g. where the power-leads are soldered on.) Chuck described something like this here: http://www.chucklohr.com/808/images/num ... _small.jpg

Source: http://www.chucklohr.com/808/
(16 Dec 2009 - #3 Tear Down, V2 and V4. Internal Short Circuit Problem.)

[philfifi]

Hello Bill,
I didn't target a specific section to disassemble, but the full dump. And I didn't recognize any ARM code in it. Now that we know a bit more were stuff are in this full dump (JPEGs, waves, fonts, etc ...) we can dress a more precise map.

[Team Seneca]

Hey everyone!

Spinner and philfifi were able to take my image manipulation idea to the next step and were able to erase the time stamp in the gum stick camera. We need to figure out how to do this in the AEE MD-80 Camera clone next. Mine is dead, so I am getting another one. I am going to take the memory chip out of the dead one so I can make a programmer for it to try the same method on the MD-80 clone. I bet anything that the file has the same font changes in it because the video files from the two cameras match and the font color matches.

[Team Seneca]

>This is just speculation on my part.... but it seems feasible.

They come with really cheap batteries. Maybe it died. Or maybe there is (or was) a short circuit in the camera (e.g. where the power-leads are soldered on.) Chuck described something like this here: http://www.chucklohr.com/808/images/num ... _small.jpg

Source: http://www.chucklohr.com/808/
(16 Dec 2009 - #3 Tear Down, V2 and V4. Internal Short Circuit Problem.)

I'm just speculating about the "self destruct" timer in te cameras. Of course it could just be faulty parts.

I have noticed that the part numbers on my gumstick camera have been etched off. I wonder if this means they are fakes or rejects?

[Team Seneca]

Hello Bill,
I didn't target a specific section to disassemble, but the full dump. And I didn't recognize any ARM code in it. Now that we know a bit more were stuff are in this full dump (JPEGs, waves, fonts, etc ...) we can dress a more precise map.

One more thing I was just thinking of... I wonder if the camera with the blank font file will have a better framerate. If they optimized the code that prints the pixels to the image, it should skip over empty pixels and save a R/M/W to memory. In theory it should be faster.

[Spaceman Spiff]

You guys are amazing! Thanks for hacking this camera. If you can figure out how to load the new firmware easily into the cameras without special hardware then everyone will be able to use this camera.

[philfifi]

I don't think the "transparent font" will change the framerate. Seeing all the "garbage" in the firmware, I really don't think chinese are optimising this
Did you see more duplicate frames when displaying "8" instead of "1" ? Nevertheless, it would be really funny to dissassemble the firmware code portion, just to "see" !

[Team Seneca]

What we need to see now is how to activate the code in this firmware. If you look at the string table embedded in this binary, it looks like there must be a special "factory test" mode that they run at the manufacturing plant to test the cameras and load the firmware.

If you look closely, there are some strings referring to pathnames of files included in the binary that could possibly be magic files that are loaded in to perform a firmware upgrade.

If we can figure out how they trigger a firmware update, then we can make this modification possible for everyone with a camera. Removing the chips and reprogramming them is not a good solution for everyone.

[Tim Chen]

Great work, you guys! Keep at it!

[philfifi]

First info, the CPU inside is a 8051 ! A disassembly on it worked very well !
I agree with the strange "strings", and give a try to put the raw firmware with a file named "fw.bin", "1528.bin", "ispkey.bin" like in the strings. But nothing happened ...
Hopefully some people good at 8051 could have a look and find out something.

[Tim Chen]

First info, the CPU inside is a 8051 ! A disassembly on it worked very well !
I agree with the strange "strings", and give a try to put the raw firmware with a file named "fw.bin", "1528.bin", "ispkey.bin" like in the strings. But nothing happened ...
Hopefully some people good at 8051 could have a look and find out something.

Are you sure that the processor is an 8051? I looked on Wikipedia and that chip is pretty old. How can it run a camera? Same for the 6502? Those chips were born before I was!

[philfifi]

I am pretty sure it is a 8051 architecture, because the disassembly show normal code. Technically, before you were born, the 8051 was a real component, with some RAM and ROM. Today, only the CPU architecture is kept, and is implemented inside the ASIC. This datasheet is from another SPCA componant, and quote a 8032 CPU inside : http://mxhaard.free.fr/spca50x/Doc/Sunp ... minary.pdf