CVS camcorder usably hacked!

CVS camcorder usably hacked!

Cvs-Camcorder-1MAKE pal John Maushammer sent us some great news! The CVS Disposable Camcorder (mentioned about a month ago) has now been usably hacked so that videos can be downloaded over USB – no need to desolder the flash memory. Finally, some healthy free-market competition to CVS’s expensive development service, just like in the analog world. Here are the details!…A lot of progress on the CVS camcorder this last week. This weekend I figured out how to unlock the camera, and then daBass found a USB command that downloaded the most recently recorded video. By deleting that video after saving it, you can download all the videos. Lots of other people filled in with code to combine our discoveries. It’s been an amazing group effort — I’ve tried to summarize it–

The CVS Disposable Camcorder (mentioned about a month ago) has now been usably hacked so that videos can be downloaded over USB – no need to desolder the flash memory. Finally, some healthy free-market competition to CVS’s expensive development service, just like in the analog world. Last week, dakotamod and mconsidine were able to coax mystery responses back from the camera. I found what looked like a set of challenge & response packets stored in memory, and then traced the firmware until I found where they was accessed. I thought I had found a locking mechanism, but wasn’t sure until I realized that it only allowed the commands dakotamod & mconsidine had found were accessible… we were on to something! I figured out what the commands did and how to use them to how to unlock the camera. The community took it from there… daBass figured out the USB command to download the most recent video, and CorscariaBillW quickly released tools. When unlocked, it seems that many standard windows drivers can be used with slight tweaks, including enabling full VGA resolution recording @ reduced frame rate (as opposed to the 1/4 VGA default). There are now a lot more sample videos. And, lastly, this removable memory hack is awesome.

Interestingly, there seems to be a flaw in the code Pure Digital wrote. You can request the 128-byte challenge by sending a specific USB command with an index number of 0-127. But, if you send an index number between 128 and 255, you’ll get back the secret response it is looking for that’s needed to unlock. It looks like the firmware tried to prevent this by performing an “AND” operation with the value 0xFFFFFEFF, but that doesn’t do it — a value of 0xFFFFFF7F would be needed. Or, maybe it was on purpose :-) we’ll see if (or how fast) Pure Digital closes that door.

I’m still trying to document the protocol, and my plans are to see if I can unlock the Mass Storage mode so that it can be accessed like an external flash drive. If I can make the change permanent it would simplify things greatly and I’d consider the hack done.

Software app here.

20 thoughts on “CVS camcorder usably hacked!

  1. jonmaddox says:

    OMG, this is awesome. It took them no time at all.

    The “Future Hack” checklist is one more bullet longer.

  2. mreddygbr says:

    Anyone know if these can be acquired in the UK?

  3. Tandilyn says:

    This is soo fawesome! I can’t wait to try it out. For those of you not near a CVS, try ebay! They have ’em!

  4. mrbill says:

    Mine is working great. Pictures of cable construction here, some sample videos here.

  5. airforcetodd says:

    i would b happy to send u one n Britain, a CVS store is right next door to my apt, they r small and would b easy to ship, e me if u wish ——-> airforcetodd @ canada.com
    im n ohio usa for a college quarter FYI

    Todd Wiseman

  6. Mathew11 says:

    If you still need a camcorder mreddygbr heres someone on ebay selling them with a usb connector added right on the camera:

    http://cgi.ebay.com/CVS-Digital-Camcorder-with-USB-cable-Firmware-3-4_W0QQitemZ7547675412QQcategoryZ64332QQssPageNameZWDVWQQrdZ1QQcmdZViewItem

  7. boromakot says:

    Note to all of my fellow hackers who have no clue where to find a CVS store: Rite Aid carries them too. Look on the Pure Digital (the actual manufacturer) website for more stores as well.

  8. Dshorrosh says:

    I’m so close! My computer can see the camera and the driver loaded, but I can’t unlock it. My camera says FW-Version: 53.05, Realm ID 16. Are there any updated
    hacks to open the camera so I can download, change resolution, etc. as per the original hack?

    Any response is appreciated!

    Thanks,

    David

  9. rhombu says:

    There are links to CronusKey a program used to unlock the camcorders with firmware version up to 55.13

    http://drknife.com/macbook/index.php?itemid=10

  10. brianmay27 says:

    Ok i need help. i tryed the program but cant get it to work. i have a 53.05 can some one help me

Comments are closed.

Discuss this article with the rest of the community on our Discord server!
Tagged

current: @adafruit - previous: MAKE, popular science, hackaday, engadget, fallon, braincraft ... howtoons, 2600...

View more articles by Phillip Torrone

ADVERTISEMENT

Maker Faire Bay Area 2023 - Mare Island, CA

Escape to an island of imagination + innovation as Maker Faire Bay Area returns for its 15th iteration!

Buy Tickets today! SAVE 15% and lock-in your preferred date(s).

FEEDBACK