3.62 Only!! Hardware Method v3 - KILLS MODELS 3.7 AND UP!!
This method no longer works on new 3.7 or 33.04 cameras because both USP.BIN and FSP.BIN use the same unknown key. Added by brite_eye 2/17/06.
Updated camcorder model and firmware versions on 7/18/06 by GotAnMP3.
This method is based on work done by:
Brite_Eye - who first suggested corrupting USP.BIN with a battery drop
BillW - running with the idea, coming up with the forumer.com/viewtopic.php?t=1176>original hardware hack of shorting the I/O on the flash to corrupt USP.BIN
Gyro - who realized a similar result could be had by forumer.com/viewtopic.php?p=12724#12724>shorting the Chip Enable to the battery + to disable the flash, and
MUOTUC - who forumer.com/viewtopic.php?t=812&highlight=schematic>published the schematic that allowed me to trace pin 9 to an easier location on the board.
carpespasm - who put all the software pieces together into the QuickInstaller that makes our lives easier.
I'm just the gatherer of information...
With this method, all you have to do is open the back of the CVS Camcorder, have a steady hand and a fair sense of timing (and probably some luck).
Apparently, this is much safer than the 6-7 short, less chance of ending up with a dead camera, and any existing videos on the camera are recoverable.
0) First things first!
<*>Download and install the QuickInstaller. This includes the USB library files, the camera driver files, and Ops that talks to the camera and allows you to download videos and change settings.
<*>Do a Vulcan Nerve Pinch on the camera to see what version you have (hold down Record & Delete buttons, then press Power button):
Model 200:
3.40 - Nice! Stop here. Simply plug your cam in and use Ops!
3.62 - Carry on...
3.70 - Carry on with patience... May take more short attempts to get the sweet spot.
23.82 - CAN NOT be hacked using this method.
Model 220:
33.04 - No firmware versions of this camcorder are hackable using this method.
33.17 - "
33.19 - "
Model 230:
53.05 - No firmware versions of this camcorder are hackable using this method.
1) Open the battery case by releasing the latch with a paperclip or whatever.
2) Slide the battery holder out of the case.
3) Lift the 4 corners of the sticker and unscrew the 4 silver fasteners.
4) GENTLY pry the case open. 2 catches at the bottom of the battery case, and 1 on either side in line with the screen.
5) Here's what you're looking at on an unhacked camera: The video preview screen shows the status text and time remaining.
6) Cut yourself about a 6" length of wire. On one end, strip as little insulation as you can. This will be the end you touch to the circuit board, so you don't want a lot of bare metal flapping around in there.
7) Pop the lower battery out, slide the long end of the wire behind the spring contact on the positive side (+) and pop the battery back in to secure it.
8) Now, your target is the tiny resistor R101 below the flexible cable of the LCD screen. It's not next to it's text, but closer to the top left corner of SW2. It will have "103" printed on top (if your eyes are that good). You want the side that's facing SW2. According to MUOTUC's schematic (and verified), this is connected directly to Pin 9 (CE) on the flash chip.
You may need to clean the solder joint at the end of the resistor of the oxide layer (a thin, nonconductive film that forms over the solder that may prevent your wire end from touching metal). Use a pencil eraser (if you can get in there), or scuff it up with an Xacto (careful!).
9) Now the tricky motor skills vs. timing part. BE CAREFUL. When you press the power button (SW1), about 1/2 second later the unit will beep and the screen will light up with the CVS welcome. You want to touch the stubby end of the wire to the right side of the resistor RIGHT before the beep. It will probably take you several tries.
<Update> There's some evidence that for 3.62's the sweet spot is right before the beep, and for 3.70's it's right after the beep. Either way, you don't need it on there for very long.
10) If you get it right, the preview screen will come up with no status or time text (looks black here because it's face down on the table. Will show video preview). If not, power off and try again. After 250 trys on a 3.70 and no video preview without status, Dino reports success by plugging in with dark gray/black screen. Also others have had better luck soldering wire to resistor and touching battery contact instead of trying to hit resistor each time. edited by b_e
At this point, I was able to connect the unit directly to the computer and use OPS 0.13 to Open and Unlock the camera (see forumer.com/viewtopic.php?t=556>Applications, Quickinstaller). Others have reported they had to power down first, then connect to the computer.
Good luck and let me know if there are any corrections needed!
2) Slide the battery holder out of the case.
3) Lift the 4 corners of the sticker and unscrew the 4 silver fasteners.
4) GENTLY pry the case open. 2 catches at the bottom of the battery case, and 1 on either side in line with the screen.
5) Here's what you're looking at on an unhacked camera: The video preview screen shows the status text and time remaining.
6) Cut yourself about a 6" length of wire. On one end, strip as little insulation as you can. This will be the end you touch to the circuit board, so you don't want a lot of bare metal flapping around in there.
7) Pop the lower battery out, slide the long end of the wire behind the spring contact on the positive side (+) and pop the battery back in to secure it.
8) Now, your target is the tiny resistor R101 below the flexible cable of the LCD screen. It's not next to it's text, but closer to the top left corner of SW2. It will have "103" printed on top (if your eyes are that good). You want the side that's facing SW2. According to MUOTUC's schematic (and verified), this is connected directly to Pin 9 (CE) on the flash chip.
You may need to clean the solder joint at the end of the resistor of the oxide layer (a thin, nonconductive film that forms over the solder that may prevent your wire end from touching metal). Use a pencil eraser (if you can get in there), or scuff it up with an Xacto (careful!).
9) Now the tricky motor skills vs. timing part.
10) If you get it right, the preview screen will come up with no status or time text (looks black here because it's face down on the table. Will show video preview). If not, power off and try again.
At this point, I was able to connect the unit directly to the computer and use OPS 0.13 to Open and Unlock the camera (see forumer.com/viewtopic.php?t=556>Applications, Quickinstaller). Others have reported they had to power down first, then connect to the computer.
Good luck and let me know if there are any corrections needed!