BillW's Resurrection Method - leaving bootloader mode

BillW's Resurrection Method - leaving bootloader mode
BillW's Resurrection Method Forward: The method has been updated. As of PV2Tool 2.0.8, I believe it should work with EVERY bootloadered camera, save those with real hardware problems. The fact that the new pv2tool was now universal was discovered by brite_eye. If you can bring the dead back to life, credit him! Requires: -a camera flash image that contains a properly checksummed FIRMWARE.BIN. Use pv2patch if you're not sure. The firmware.bin's hardware number should be correct for your fried camera. If it doesn't match, you will likely have trouble with flash upload. -a permanently unlocked FIRMWARE.BIN, for this camera's hardware number as well. -PV2tool 2.0.8 or greater. Download from https://sourceforge.net/projects/pv2devkit/ Steps: -Make a copy of your FIRMWARE.BIN named FIRMWARE.PV2. -Ensure the camera has good batteries in it. The last part of flash update doesn't complete unless the camera has it's own power. -Connect the camera to your computer. -Run PV2Tool -Hit the "Open camera" button -Hit the "Run PV2 code" button -Browse to the FIRMWARE.PV2 (yes, we're actually "running" the firmware. This will get the camera in a normal state so we can fix it) -Wait 2 seconds -Hit the "open camera" button -Hit the "Upload Flash" button -Browse to your good flash image. -Wait for the Flash to update -Remove camera, turn it on, it should be fixed. Variations: -Some SMaL cameras really don't like flash updates for some reason. If flashing seems to work but leaves you in bootloader mode still, instead try the "format" button, do a file listing, select the "/" directory and upload all of the files from inside your flash image instead Problems/Solutions: Problem: Camera still has 3 chimes in descending order when turned on. Solution: That's not bootloader mode. Descending chimes means "battery low" Problem: Can't connect to camera after playing around Solution: Check the Windows Device manager, and make sure the camera shows up. Also check the libusb -*test*-('") program. Make sure your libusb device driver works for whatever PID shows up in the -*test*-('") program. Limitations: -Unknown. It's worked with *every* SMaL camera I've thrown at it, including 6410's and ff2's. How Does It Work? Resurrector uses the $26 command to run a program, the working firmware, on the camera. It was previously thought that $26 didn't work in bootloader mode. I believe in bootloader mode, that $26 first loads the incoming program into SDRAM at $400, and then transfers it into SRAM before execution. I think this is how bank switching still appears to work under this method. I also believe SMaL uses this same method to bootstrap their development cameras. It's too straighforward and purposeful not to be by design.

Updated - should now work for *every* type of bootloader problem! Please post successes and failures here. If you had a failed resurrection in the past, try it again!

Can this be used to activate a locked 6550? Or will that require a $19 or $28 or temporary cut line to flash?

Can this be used to activate a locked 6550? Or will that require a $19 or $28 or temporary cut line to flash? I posted something along these lines to binaryweaver once - suggesting that resurrection might be a way to crack his stubborn camera. His was incorrectly updated with wrong rev firmware, but alas, he threw it away in favor of marrital bliss. We're on the same page here. In fact, you must have used your time machine to spy me at work on my weekend plans. I have a stubborn cam, not a 6550, but it will do. If I succeed in my plan, I am going to start harvesting new PV2 keys. The method I'm going to use to throw the cam into bootloader mode is to temporarily jumper two of the data lines on the flash chip together. I'll hook it up to usb (booting it), gently disconnect the jumper, and run a firmware. After that, I should be able to download the flash image, NVRAM.DAT and all. I could of course, reflash the cam instead, but it will serve us all better if I harvest the key and put it into pv2tool. As well, it may prove to Pure Digital the futility of changing keys on us if we can harvest them easily enough. So tell me Mr. Time Lord, do I succeed?

Answer already found out. The above method works. We can now break in to locked cameras. I separated this into it's own howto in the "HOWTOs and Methods" section

I'm anxiously awaiting the new update to pv2tool so that I can try this on my as-yet-unlocked 6550. When you say For now, you need a firmware.bin that matches the hardware level of the camera you want to break in to. (eg. firmware.bin from a 2B camera to break into a locked 2B camera). Next release of pv2tool will be enhanced to lift this requirement. Do you mean that I will not need a firmware.bin file at all, or just not one that matches the hardware level? Since the only cameras I have are 6550's, I'm not in the position to be able to extract a firmware.bin to use.

You'll still need a firmware.bin file from any *SMaL* camera. Sorry, that won't help if you only own locked cameras.

jaredforshey, I'll gladly ship my devastated debayered 6410 after receiving a 6550 from you (contact borg12of48 at yahoo dot com). Note while it can't take pictures it does connect to usb port and allow a firmware download. You'll not only get camera that historically produced first successful image, but also a sensor with protective glass cover removed. Note offer only good to jared unless he refuses. If you've been reading all my crazy posts, I had previously offered it to sailpix but he has refused as he already owns a 6410. He also appears not easily detracted by value of cheap historical plastic cameras. Hopefully he will still compile a version of decompressor that creates a raw CFA/Bayer file.

Thanks for the offer, but I'm going to decline. I stopped by a local CVS today and found they had finally started carrying PV2's. Lo and behold: a whole rack of cameras with with the paperclip hole battery covers instead of the screw-type. I picked up one and got a 6520 2B with an ID other than the lamssmal one. After an hour of trying all the unlock methods, I still had a stubborn camera. I started probing with my meter to make sure my cable was connected properly, then I found a usb pinout on the net and check the color of the wires against the the plug pinout. According to the diagram, my +5 and ground wires were reversed. I switched them around, plugged it in, and nothing. Now my camera won't respond to being plugged into the usb port at all, even with the wires back to their original configuration. The camera will still turn on and everything; it looks like I damaged the usb comm ciruitry. I guess that's what I get for following random pinout information from the internet. In any case, that was a quick 20 bucks down the drain just trying to get my hands on some valid firmware (which I of course have, but it's locked away in a camera that can't communicate via usb anymore). As a poor-ish college student, I really can't afford to put any more money towards this endeavor.

In any case, that was a quick 20 bucks down the drain just trying to get my hands on some valid firmware (which I of course have, but it's locked away in a camera that can't communicate via usb anymore). As a poor-ish college student, I really can't afford to put any more money towards this endeavor. Your 20 buck may not be down the drain. My first attempt at a 'Centronics' type cable fried the USB comm circuitry on a CVS Red. The camera still took pictures just fine so I filled it with 25 pictures and returned it to CVS for processing. They could not communicate with the camera either so they replaced it with a new camera no questions asked. Give it a try.

I had a 6410 and for some reason it wouldn't take the backup flash image I had, but I fouind a work around. Basically I would take the and send it the firware instruction set, connect unlock, then using the new pv2tool I would format the camera. Once it was formatted I manually uploaded all of the files into the base directory. Works perfectly now. Thanks.

i have one question about the hardware #, does it need to match the cameras PID or the cameras original hardware number. i have one that was 24, and now bootloaded 00 2b. i got it to download the flash but when i upload a good flash file it says bad block at location 0000, upload failed

Re: BillW's Resurrection Method - leaving bootloader mode
BillW's Resurrection Method Steps: -Make a copy of your FIRMWARE.BIN How?

You need to have downloaded the FIRMWARE.BIN file using from a previously unlocked camera, using one of the pv2tool file/flash retrieval buttons. If this is your first camera, then the legal method is your only hope.

I had success with this method. I think I had tried to repatch too many things too many times (specifically resetting PID), and killed the camera. It wouldn't turn on, just giving a long beep when the on/off button was pushed. It also wouldn't accept any Flash uploads of my backups. I used this method and it's back to normal, I was able to first of all revert to my original flash image and then upload my saved copy of mods and it works great. Thanks!

View Full Version: BillW's Resurrection Method - leaving bootloader mode