3.62 Only!! Hardware Method v3 - KILLS MODELS 3.7 AND UP!!

Seems like I did everything right on a 3.7, but when I open the program it gives me this error Failed at 0xfe write (set response read index) Any help with that?

I've gotten that when using a USB hub. If you're using a hub, try going right to the computer with the cable. That fixed my error. I'm just plugging straight into the comp. I've got the blank screen or just number screen every single time and I always get the error. Then I upgraded to the .13 and it said failed to unlock. I'm not pulling batteries out or rebooting the camera, as soon as I get the blank screen I just plug it into my dock and connect to the program and try to unlock.

Re: 3.62 Hardware Method v3 - minimal disassembly
This method no longer works on new 3.7 or 33.04 cameras because both USP.BIN and FSP.BIN use the same unknown key. Added by brite_eye 2/17/06. This method is based on work done by: Brite_Eye - who first suggested corrupting USP.BIN with a hardware short BillW - running with the idea, coming up with the forumer.com/viewtopic.php?t=1176>original hardware hack of shorting the I/O on the flash to corrupt USP.BIN Gyro - who realized a similar result could be had by forumer.com/viewtopic.php?p=12724#12724>shorting the Chip Enable to the battery + to disable the flash, and MUOTUC - who forumer.com/viewtopic.php?t=812&highlight=schematic>published the schematic that allowed me to trace pin 9 to an easier location on the board. carpespasm - who put all the software pieces together into the QuickInstaller that makes our lives easier. I'm just the gatherer of information... With this method, all you have to do is open the back of the CVS Camcorder, have a steady hand and a fair sense of timing (and probably some luck). Apparently, this is much safer than the 6-7 short, less chance of ending up with a dead camera, and any existing videos on the camera are recoverable. 0) First things first! <*>Download and install the QuickInstaller. This includes the USB library files, the camera driver files, and Ops that talks to the camera and allows you to download videos and change settings. <*>Do a Vulcan Nerve Pinch on the camera to see what version you have (hold down Record & Delete buttons, then press Power button): Model 200: 3.40 - Nice! Stop here. Simply plug your cam in and use Ops! 3.62 - Carry on... 3.70 - Carry on with patience... May take more short attempts to get the sweet spot. Model 220: 33.04 - Not hacked yet. Stay tuned! 1) Open the battery case by releasing the latch with a paperclip or whatever.

2) Slide the battery holder out of the case.

3) Lift the 4 corners of the sticker and unscrew the 4 silver fasteners.

4) GENTLY pry the case open. 2 catches at the bottom of the battery case, and 1 on either side in line with the screen.

5) Here's what you're looking at on an unhacked camera: The video preview screen shows the status text and time remaining.

6) Cut yourself about a 6" length of wire. On one end, strip as little insulation as you can. This will be the end you touch to the circuit board, so you don't want a lot of bare metal flapping around in there.

7) Pop the lower battery out, slide the long end of the wire behind the spring contact on the positive side (+) and pop the battery back in to secure it.

8) Now, your target is the tiny resistor R101 below the flexible cable of the LCD screen. It's not next to it's text, but closer to the top left corner of SW2. It will have "103" printed on top (if your eyes are that good). You want the side that's facing SW2. According to MUOTUC's schematic (and verified), this is connected directly to Pin 9 (CE) on the flash chip. You may need to clean the solder joint at the end of the resistor of the oxide layer (a thin, nonconductive film that forms over the solder that may prevent your wire end from touching metal). Use a pencil eraser (if you can get in there), or scuff it up with an Xacto (careful!).

9) Now the tricky motor skills vs. timing part. BE CAREFUL. When you press the power button (SW1), about 1/2 second later the unit will beep and the screen will light up with the CVS welcome. You want to touch the stubby end of the wire to the right side of the resistor RIGHT before the beep. It will probably take you several tries. <Update> There's some evidence that for 3.62's the sweet spot is right before the beep, and for 3.70's it's right after the beep. Either way, you don't need it on there for very long.

10) If you get it right, the preview screen will come up with no status or time text (looks black here because it's face down on the table. Will show video preview). If not, power off and try again. After 250 trys on a 3.70 and no video preview without status, Dino reports success by plugging in with dark gray/black screen. Also others have had better luck soldering wire to resistor and touching battery contact instead of trying to hit resistor each time. edited by b_e

At this point, I was able to connect the unit directly to the computer and use OPS 0.13 to Open and Unlock the camera (see forumer.com/viewtopic.php?t=556>Applications, Quickinstaller). Others have reported they had to power down first, then connect to the computer. Good luck and let me know if there are any corrections needed! Awesome hack. It worked perfectly for me. Slight recomendation. I used a -*test*-('") wire with alligator clips attached to a precision screwdriver to short out the resistor. I got it on the third try. Not bad for a 46 yo fart w not the best vision anymore.... Keep up the great work...

I've been following this thread since February and finally got my hands on a cam yesterday. It's a 3.70 rev b3 with toshiba batts. Only took about 25-30 jabs to get the "Not Initialized" camera id :D The successful unlock came as I hit the resistor right at the very end of the beep and got the blank preview screen. Pulled a battery and the nerve pinch verified I was successful. Now I just need to make a cable. Since this is going in a r/c plane, I think I'll try to find a centronics/palm cable to plug it in (can't find any in town though).

A question.. and a couple of quotes... Hi, I have ver 3.7 Could someone explain me what the \\"short attempt\\" is? Thanks a lot in advance Dong dong, look in the howtos section at the top \\"hardware hack version 3\\", follow those directions except short the cam just after or right on the beep instead of just before it M230- Same methods apply as the 3.7's and all M220's. FW-VER: 53.05 So will this method work on the M230 if I short just after or on the beep? And which resistor do I short? On my M230, there's one vertical resistor right next to SW2 labeled R5. Do I short the lower end?... I would take a picture with another camera, but it's charging... And also, I absolutely cannot brick this camera because it is the only one I have, and I do not live in the US. Thanks in advance. edit:I finally have unlocked my 3.7 b3 unit but it will not be unlocked when I turn the unit off then back on. What do I have to do to keep it unlocked. I even downloaded a movie after unlocking it and the video looked great. But when powering the unit backup I couldn't download again. I have unlocked the unit about 4 time now. Very frusterating. Well, you'll always have to hit the unlock button after plugging the cam in, if that's what you mean. The unlock is a \"session unlock\" - it doesn't modify the cam or anything. So will the Mac program work with my M230 if I do get it unlocked? Thanks again

Do NOT attempt the short method on a M230. It will not work.

what will show on the cam when it is finally unlocked? i got a new m200 3.70 fw with duracell battery whats the diffrence between the batterys and what should the nerve pinch show?

hi, i have two questions. the wires that you used in this methos is from a usb cable, right? i cut one side of an old usb cable i no longer need(not the part that goes in the computer) and stripped the casing of it. but there are 4 small wires inside.. white, red, green and black. which two of these 4 wires do i use? and i have a 3.70. what is the probability that i will lose videos that are currently on my camera? these videos are pretty important to me, so im kind of scared to lose them. thank you.

Do not perform this hack any longer. Take your time to read the forums and use the more current way to unlock this camera. Do not expect a full \"walk through\" though, you will have to read, draw your own conclusions and use Google.

View Full Version: 3.62 Only!! Hardware Method v3 - KILLS MODELS 3.7 AND UP!!