ok i fig out the driver part got it to recon the cam but i am geting the Failed to unlock camcorder with key retrieved from memory! even tho i get no number or words on screen does the cam id have to be blank for this to work? Tommy btw i am on fw3.7 pcb ver: 3b

3.7
If you can get the cam to open then the driver and cable are fine. Doing the hardware hack you have to wait after the beep to short, but probably just after, and only for a short while. I've tried a series of short pulses seems to work. Usually you'll see a short delay in the screen coming up. Check the nerve pinch and instead of a serial number it will say uninitialized if you're successful.

My camera says uninitialized, but I'm still getting the black screen when I record. Anyone know what's going on? Is this common?

Father-in-law just "had to have one". So he bought one, and it was a 3.62. Awesome. Successfully hacked my second one. Now, there's two people at work that "have to have one". Glad I'm two for two. Thanks again for this fun little project! BTW, got the 2nd hacked in about 10 attempts... perhaps because it was a 3.62 or perhaps because I lucked out. My 3.70 took 250 attempts.

Great howto. I unlocked my 3.62 last night. When I did it, the "Ready" status did not shown on the screen, but the numbers did not completely disappear from the screen, it looked like: 1 1 2 Which was pretty weird, but I plugged it into my usb, and Ops was able to unlock it. Just thought I'd mention this that the screen doesn't have to be totally void of display to indicate that it worked.

I found that the odd staggered numbers do not seem to indicate "unlockability" on 3.70s, as far as I could tell. I couldn't unlock until I got a camera id of "uninitialized".

nerve pinch??
I am trying this hack and I can pretty much get a preview screen with no text every time, but I can't get it unlocked. I have seen reference to a nerve pinch where the camera id is uninitalized if the hack was successful. How do you do the nerve pinch?

It's in the FAQ... forumer.com/viewtopic.php?t=319" target="_blank">http://camerahacks.10.forumer.com/viewtopic.php?t=319

Procedure
I am being patient, but I want to make sure I'm not wasting my time. (shorting all alround the beep, before, during after, long shorts, short shorts, single shorts, multiple shorts) Most of the time if I short just after beep I do get the screen with no text. I try about 10 times in a row then do the pinch to see if the ID is unitialized. (not even trying to unlock). Does this sound like a good plan?

Brick
Well that was a waste of $30 and about 4 hours of work. After trying this method I woud guess around 100 times it will not power on anymore. Not via battery or USB. I will not be attempting this again. Anyone around Kansas City want the left overs?

Try and do the "nerve pinch" (hold record and delete and then hit the power button) and see if the camera comes on, if so you might still have a camera.

still dead
Tried the pinch. Still doesn't work, though I did notice that after hitting the power button the screen gets slightly darker for about 2 seconds.

don't think it'll help, but you can try leaving out the batteries for a while. there's a slight chance the cam could regain it's sanity

Just hacked my 1st cvs cam, due completely to all the help I've found on the board. Thanks for all those that have botched cameras (I give no names for fear of leaving someone out) and made it possible for me to give a fantastic Christmas present to someone very special :D (female usb b connector, fw version 3.62, took about 10 tries to corrupt usp.bin after soldering a wire to R101 and connecting through a switch to battery terminal) Thanks again!!

Thanks everyone that did all the hard work on this effort. I successfully hacked my 3.62 B3 camera recently. I now have custom screens and take all vids at 640x480 24fps. Thought I would share this trace taken from the camera circuitry. Channel 2 is one of the lines going to the camera speaker. That is the "beep-beep" you see at 1.14 seconds after power on. Channel 3 is the flash chip-enable - taken from a line soldered to R101. As you can see you have a "window" that is about 0.2 seconds before the beep when you need to make contact and release. I noticed that the camera would power-up more quickly than 1.58 seconds on occasion. Looks like someone could come up with a mini-circuit of a couple of 555 timers or a simple counter and make a hack machine. It took me about 40 tries before I got it. FYI - I opted to use a diode (see simple circuit below) to limit how much energy is injected into the Zoran. This hack of hitting the CE with VCC is going to be stressful to the Zoran. It is designed to take a certain amount of this kind of abuse but you don't want to stress is any more than you have to. The diode still guarantees that you will force a logic "1" on CE but reduces how much energy you are injecting into the Zoran. Another FYI - Digitrace is an excellent bit of freeware that uses your parallel port to implement a poorman's logic analyzer. See here http://www.xs4all.nl/~jwasys/old/diy2.html