Once again my sloppy cleaning habits have proved useful. I still have packaging form the 6550 - 30 camera. There are no stickers on the package. Also it has the paperclip battery door. The package UPC lists it as ITEM 274180 - 0 50428 06296 8. The PCB is exactly the same as my 6550 - 2B camera except the last number on the silkscreen which looks like a serial number, and that R1 & R2 do not have 100K resistors installed. Both cameras have exactly the same hardware number (06) during a pinch. The "Beeps" during the power cycle and the trashed sdram data seam to show that there is something important different but I don't know what it is yet. Is there another way to get the NVRAM.DAT out? I'm an SMT rework expert. Lifting a few pins is a piece of cake but I don't want to have to pull out any ships I don't have too. BTW, I'm new to these cameras, should I use PV2tool to "Fix the firmware" on the 6550-2B camera so that I don't have to unlock it each time? I want to make a setup that is as easy to use as possible for a non technical friend. -R

6520/30
I just bought a CVS red after rooting through their pile that turned out to be: 6520 06 30 30 DD5043409646 20 I am hoping it will hack easilly but i need to make the cable first... I believe you were saying that this is a better imager...

The second DD ID and both are typeid 30 with 2mp imagers. Odd that this one is a 6520. I wonder if they are giving new IDs but leaving in old firmware. Rocky are you still having problems with unlocking your DD?

Very first post in this topic links to a photo showing difference: 2F is on left, 28 is on right. http://www.demanufacturing.com/pv2/www/brite_eye/blu2f.jpg Be sure to try current procedure with batteries, after renaming your pv2keys.txt file. Then post a copy of pv2tool log.

I can't believe how busy I am with all this fun - such a difference from working at job where every path I want to take is blocked. After a bit of discouragement of having to pay a full $10 for PhotoCD, I went to another one of the 27 CVSs in my area - no one at photo counter (usually if I can't judge person ahead of time I just leave). But I asked a busy clerk and she phoned store manager (oh oh), I complained that I'd been having difficulty getting a 2mp imager since you don't know until you open up the package. I asked if I could exchange for a 2mp used/already processed camera. She looked around couldn't find any and said I could open and check a new one. Since I already had spotted some clip style battery doors, I grabbed one, opened it showed her the vulcan pinch - woweeee a 6550 DD type 30. As I handed her a unused but opened 6550 2B, I think she indicated she now had a camera to take some -*test*-('") shots with. :D

After over an hour I was able to unlock my new 6550 DD type 30 using Single camera legal method. However the 6550 30 seems to be much more difficult and I may have just been lucky. I could not get more than one key. That key was an extraneous key block immediately following end of firmware in excess area allocated to firmware on flash. After several failures I took a picture, hotplugged camera, shorted, unplugged replugged, heard 1 beep, open, sdram keyscan, unlock failed (oops not following procedure), unplug replug, open, unlock worked with reset key. :shock: Then I downloaded NVRAM.DAT - which was garbage :?: until I unplugged replugged, open, unlocked, downloaded again and finally showed the reset key. I then tried to replicate using a 2B loaded with virgin flash from 30 camera. I managed to get 3 beeps instead of one that continued even after unplugging - so somehow I manged to corrupt flash or maybe with batteries still in camera wasn't resetting for some odd reason. I was also able to get 1 beep 1 time, but had no luck getting 2B with 30 flash to update nvram.dat with reset key. Following normal method without hotplugging after a picture I received 2/4 keys with a good one in position 2 several times on 2B loaded as a 30 (full flash loaded pinch still shows type as 2B and cmptype as 30). I'd try some more on 30 but due to its rarity I do not want to risk destruction - oddly at one point there was a large spark/flash while I had probe held tightly between pins on 30. I was happy when everything still worked - strobe was probably triggered by flipped out firmware.

After further thought - it might be that all 30s are older boards and will reset in random fashion when using teslafreaks method or one of the others that were posted long ago. None of my cameras before new key changes ever reset when I was trying - it always seemed random/accidental. IIRC Rocky posted a log showing reset key - it may just have been in memory about ready to be written but needed an unplug at a magical moment. Rocky - the beeps were different practically every time (even hissed and snapped a couple of times). Most of the time double beep came right after replug without needing to wait 15 secs.

I suggest just buying a screwed battery cover Blue to obtain a working unlocked firmware.pv2 file that can then be used following single camera method, substituting sdram keyscan with run pv2 code, open, download virgin flash from 6550 30s. Then extract nvram.dat from img file and use nvramparser to create a pv2keys.txt that works. You will then have a Blue to load with your favorite shots for better processing by CVS (after gutting all that is not needed for USB connection). :wink:

See, I'm not crazy! I have a working 6550-2B camera that the single camera process works fine on. Can you elaberate just a little on the steps you listed? Have you tried the 2B code on the 30? -R

No. No. I am not crazy either (to do either). Please try to understand, reread, then carefully spend several hours attempting to follow various alternatives with a final post to questions about particular issues. I am only able to spend about 1 minute per every 2 hundred a new member spends. Thanks for your understanding in advance. I'd be very interested in how your experimenting works using 2B firmware on a 30 - even without loading flash you should be able to experiment running a 2B unlocked firmware.pv2 on 30 (either bootloadered or unlocked), open, take a pic and see what happens. You might just get upper 1.3mp corner of 2mp imager instead of middle.

2B OR NOT 2B - 30 works
brite_eye, It worked like a charm. Not a wasted move. There were a few things I didn't know that could be done, but it worked straight through. I will post a note in the "Legal Single Camera Hack" about how to do it this way for cameras that won't work, if you think it would help others. -R

Please do! And list your challenge response keys in "post/find new camera keys" topic under applications (unless it was reset key 67452301).