3.62 Only!! Hardware Method v3 - KILLS MODELS 3.7 AND UP!!

Ok, I've been trying this for 3 days now. I have a really cool USB port installed in mine. But I just can't seem to hack it. I'm sure that I have probably tried 700+ times to hack this thing. My specs are 3.7 B3 200, Xausty, I would love to see you -*test*-('") one of these and create a chart like you did for the older firmware. I'm beginning to get exausted. Any ideas? Edit: Interesting what you said about the voltage, my batteries are beginning to get a little weak, should I replace them before I continue trying to hack it? Maybe it's getting less than 1.5v

How can you tell that those are the correct pulses? My only basis for claiming that those pulses are the ones that matter are anecdotal. I know personally that if I hit the switch anytime after the beep starts it does not work. I also know that hitting the switch well early of the beep does not work. I tried about 40 times and the one that worked was when I hit the switch very briefly (perhaps 0.1 sec?) just before the beep. This seems consistent with what others have reported on this forum.

My specs are 3.7 B3 200, Xausty, I would love to see you -*test*-('") one of these and create a chart like you did for the older firmware. I do not have a 3.7 camera and wouldn't go out of my way to get one if I had a choice to get a 3.62 instead. I realize that others do not have a choice. You can make the trace yourself for less than $5 in parts and some freeware. See my Digitrace reference earlier in this thread.

Just my input... 3.62 ver B1 Took about 4 tries before the beep. Thought I would try one after the beep and was sucessfull. Also, powers off and keeps the unlock, so very happy. Probably go back and get a couple more for xmass gifts :) PS Love the forum I would not have been anywhere near sucessfull with out you guys, THANKS!!!! PPS Originally I got it to mount in RC plane/Helicopter/Blimp. I soldered a 4pin to the tabs and just hooked in a 4pin pc-speaker jack to a usb-mouse cord. Works superduper! Now to figure out how to mount to my plane....

The specs for the flash specify that 2V is the minimum voltage required to guarantee a logic "1". 1.5V would likely not do it. I have demostrated that the diode does work. If you use 1.5V and the hack does not take after 100 tries is it because of the voltage being too low or you just did not hit the "sweet spot"? I decided that 2.6V using the diode was the way to go. Interesting what you said about the voltage, my batteries are beginning to get a little weak, should I replace them before I continue trying to hack it? Maybe it's getting less than 1.5v (Or whatever is required)

Can the exact timing not be deduced by those that are able to download and understand the firmware? Aren't there some people that know exactly what instructions are happening during the boot up process?

Well, at about try 852 my camera stopped responding. I thought at first my batterys had run out so I replaced them. Now when I hit the power button, the lcd darkens for about 1 sec then turns off. I pulled the bats out to see if it just needs a rest. What do you think?

your cam is most likely dead, ive seen this many times with my cams and it usually is dead

Just my input... 3.62 ver B1 "... Also, powers off and keeps the unlock, so very happy. " Hi tomgofly, Are you saying that you've been able to hack the cam, AND get it to remain unlocked? I understood that it was fairly common to be able to hack the camera (so that it would then accept commands), but that each time you connect, you still have to "unlock" the cam with Ops. You may have something new for us...

i think he's refering to the fact that he's not having to short it each time. though if not this is odd and good news indeed

Hacking 3.70
I've now hacked two of the CVS 3.70 cameras and as much as my memory serves me, I shorted mine just after the beep. The second one I hacked took on the very first try. I then did the nerve pinch to be sure so I wouldn't have to put it back together again until I was sure it was hacked. Those of you still having problems on the 3.70 version, try to short it just after the beep! Hope this helps! Fumble! AKA Gary

I decided that 2.6V using the diode was the way to go. Can I get such a diode at Radioshack and how would it be labled/spec'd?

Any silicon diode will work (not a zener). The current involved is relatively minute. An example is Radio Shack's 1N914/4148-Type Diode Catalog #: 276-1122. See here. All you want is to get about 0.7 volts drop across the diode to drop the battery voltage from 3.3 to 2.6. Typically the end of the diode that has the band around it is the cathode. This is the end that you want to connect to R101. The anode gets attached to the positive side of the batteries.

Thanks xausty. Is there any chance of using a 2.6 vcc instead of battery power? And if so where on the schematic would be a convenient location?

Another tip for this method
Though unable to unlock for me, I found a small tip screwdriver, (phillips works best), with the wires wrapped around it from the battery is very effective. It allows stiff control of where it contacts, instead of the floppy wire I had. It also moves your fingers away from the board, lessening the chance of shorting something with them.

View Full Version: 3.62 Only!! Hardware Method v3 - KILLS MODELS 3.7 AND UP!!