Collected from CVS Red after successful battery drop bootloadering: S mattwhitt-6550-2b C 02410b6796f116359dca082e8ea79e26b92e3710150238d0cd3ab04afc1338bf C b5e11e59474cc204bfb83f80ae054eb42c7968461cfa2b68b281fff533cbf9bc C fc52001cc67b2ed12811780d5df292ca48080d5fb57bc352e225746e3e47b115 C 707af9d79be82343e1bbfbfc26d6301016c36e8669edc736651057dea5ed2871 R 7ae8e79df6ab555470bcf2ec18b177ca339dc4228bcf72e16ec5898212e3a6e6 R c932243088352c6b78593df32f636eb0653bb6d9cd17271ab152bcc799b26924 R 662b1abab499557bb963a584558203788d62fcc1de87fea6bec690f20cb5adfd R b118a51fcfadf69d68032d2ccbcd5298760c7c6542f9204237f77ff826c778fa

Some more to crunch: S Stupid C 02c717da2c5b8b2f5796e6392b870e15dddc058ca34abe9721302f222477a711 C 93bc6281a3b15b5049c061dff5f26d167d1033a95708f79a0c91a200e9121506 C f8c0bd362f0767f8e62c56558f309301a1f78599d5aac129955923f1b1e51e69 C 551d508238275a2f1522ee245f092add31da24e384f8c64ba4cedc7fe5b66b41 R 5D961ab52c7590381a34e9077f1a1bdfb3d7871970f368d1eb2363ab817a2602 R 784ab356d8ada9f29dc2782d2d5549c14bdd8d5e2528805cdd3be727aa980e1a R 23caab1593ecd972f2a36af3b8f8023092c90d851bd6def7de588cd12ef3aa08 R 419f3f1d3c475316c11c414add650da7514372b9aa0319941442b7fd141a0f42 S Stupid2 C 02eabdffb60fbb01007dcb059bfba7ac31d57b466282f49872859add3e91610a C 75f07a5604266ffad2d16f35aed3e79486b35270d94151b86e79fef147aa7d7a C d1d8d5155d5efea3d3d73c2fa53fab2e03561a054e451cccce845d52a7fb3361 C 09687543a80090846c59d7fa69871b0311867c0ea8d87e5df96e600948cca946 R d022884c9864abd3d2ef06a67cd27286d8995ca2fb563611bec4c4def27ad471 R 502d9544357ed666f2c3319cae8e0f66168d67569f6986e33d6f4e4cd348ea69 R 220ed9af23d62d2e1c550bc4dbadc90a73f58cb27c30930a4026cfa59a758ed3 R 1e90bbc3f3503fbc43980166078bf9bf3283bac5fd67718011b36141628ac065 Note that so far all challenges start with "02" (except for reset). Why? Please post if you have a challenge that starts with other than "02" even if you have not obtained a response.

Thanks for 2 more keys - Stupid? "Stupid is as stupid does" (Forest Gump). Stupid to think someone else might succeed using one of those - but maybe someone can figure out an algorithm. All I need is the first 4 bytes - since I now have a method to extract last 124 bytes from a new unlocked camera (awaiting confirmation). Do all responses sum to a restrained value? Can anyone come up with a way to reduce possiblities for first 4 bytes from over 4 billion to something that could be programmed to complete over one night? If so there will be no need for battery drops or illegal software!

No Luck Yet - Q on Foxz Driver
My Camera: FIRMWARE 6550 HARDWARE 06 TYPEID 2B CMP TYPEID 2B ID DB5051700359 Realm ID 20 I Tried the 9 keys I found here with no luck :( S mattwhitt S RayM S mpho01-6520-2B-02 S RayM-6550-2b S mpho01-6550-2B-03 S WebcoW-6550-2B S mattwhitt-6550-2b S Stupid S Stupid2 Twice! one at a time, then all as a group. The PV2tool2: PV2Tool2_libusb-cvs20041118.exe reported(Debug): Requesting challenge from camera No challenge recieved. Could not unlock the camera with any of the known keys. Question: I loaded the Foxz driver with mods: What should I see in Driver File Details? Device Manager > Imaging devices > PV2 Red Digital Camera > Driver Tab > Driver Details I Have: C:\Windows\system32\drivers\libusb0.sys C:\Windows\System32\DRIVERS\smalidt.sys Thanx to all -dp BTW: The PV2 red here in Phoenix,AZ has gone on sale CVS for 19.95$ with a 10.00$ off in store price: i.e it's now 9.95 (+tax).

I suggest trying without the cheez - all you need is libusb (la-*test*-('") release works find for me). I think you should install both device and filter of libusb. You should at least see your challenge key listed in the log or a note that it matches one of the others.

Hi here's another ID: DB70 5240 0871 S mpho01-6550-2B-04 C 0226F92B85D43CB624771C00C845C41990F5DC9512D4523B42155A029668B339 C 67CF2C059BAD68108120DE80FC912326E48A6CF8A9C74FC2398FC9182445858F C FE3A5B2D06C5181D04967DA778478A60F034FC9EBA8D142FBBA99A4B9F9D22C6 C 330E8E8A0E43D445777E015F838D7E2F7E9C926E8C4D29EC900BD4814D9B1047 R BF5CFED6FD4197F97870D82D8DE4243C780D73852F6097296E335FA449B5B6D9 R 8D0C82BA8305E1EADD8317094FBDF3D62706549F6A5BB606E176F09323564EAF R 255A0A36C80C13A42C2934DACF9E693C4402FAB16D893484383A364AE3FD15C2 R C636FB1C3E7B97A364F01735CA848098BAB7B09F70D2639AE23742BB881640F3

Mine: S Put_Your_Name_Here C 025a342506b5650c2324fecb8857812dde21063d167b2c67ffcc55db18681332 C a356dd54fa5607992622f12eaef57ebbad4ac74227e6114b9d18fd3edf40ff10 C 228e1121520ca965aadfe8c381ca14ba67f3484a70ea6a12d0e75eb6a8537983 C 208a3956b6e033b9d6e24c50aade2c7433a5f01d998f1f05bfc0e00a1baa6ad4 R 6f9f9a13c6acf35a4cb5fd180b25897bda3a9ba780d395228f4bac9efa574f4c R 4b99478d5f10a2994841fe775b2cc585e19e571169b22dda6ff68cace913aaba R 12beca8fc06be45b51efeef776d8e3e195bea24fba6c72193ec7d50ffdb827a7 R ef9c14ac8120a84ea17231437d85a8a580edf7f5c6e66e910bcc4fdbd6aa5445 Was my key for Firmware 6550 Hardware 06 Type ID 2B CMP ID 2B RealmID 20 ID DB1045036647 Looks like ID-> Key. But hey at least I can safely say if key begins with 02 it is a key ^_^

All challenge keys begin with 02 - beyond that they look like random numbers to my untrained eye. :?: Early cameras each had a different ID, but all had the same challenge and response keys. So, I think that these two pieces of information are not directly related, though both are stored in the NVRAM.DAT file.

If you take all of the numbers in all of the "real" challenges and responses and arrange them by frequency, the numbers appear non-uniformly. Perhaps Sailpix, your hope for a function isn't in vain. (or perhaps PD is using a *really* crappy random number generator - I'm still thinking this is the case) Here's the breakdown, in case the more mathematically inclined are interested in analyzing existing keys. Understandable that 02 shows up a lot more than other numbers, since it appears to be special, but why does d9 or 6e show up 5x more frequently than 17? count value 04 17 05 20 05 5f 05 94 05 ff 06 1b 06 31 06 4f 06 54 06 a0 06 e0 06 fa 07 28 07 3c 07 5a 07 77 07 9f 07 b7 07 d4 08 13 08 25 08 2a 08 2b 08 34 08 51 08 5b 08 5d 08 60 08 6d 08 88 08 9c 08 af 08 b6 08 c8 08 e3 08 e8 08 ee 09 00 09 19 09 1d 09 1f 09 39 09 3f 09 45 09 4e 09 6c 09 76 09 8d 09 90 09 a1 09 b0 09 b2 09 d0 09 f0 10 05 10 06 10 10 10 14 10 18 10 35 10 37 10 3d 10 3e 10 49 10 4a 10 53 10 66 10 6a 10 6f 10 71 10 73 10 74 10 7b 10 89 10 8c 10 92 10 95 10 96 10 9e 10 a4 10 a8 10 b4 10 bf 10 cd 10 cf 10 db 10 dc 10 de 10 e2 10 e9 10 ef 11 07 11 0b 11 16 11 1e 11 21 11 27 11 3b 11 4c 11 50 11 58 11 59 11 64 11 68 11 79 11 7f 11 83 11 9b 11 ac 11 b9 11 cb 11 d2 11 d5 11 d6 11 d8 11 e5 11 e6 11 ed 11 fb 12 09 12 0e 12 0f 12 15 12 2f 12 32 12 33 12 41 12 44 12 46 12 57 12 63 12 7c 12 7e 12 81 12 82 12 87 12 a2 12 a3 12 a5 12 bd 12 c3 12 cc 12 d7 12 da 12 e1 12 eb 12 f3 12 f4 12 f5 12 fd 13 01 13 04 13 11 13 29 13 36 13 3a 13 40 13 43 13 48 13 4d 13 5c 13 5e 13 61 13 6b 13 8b 13 8f 13 97 13 99 13 9a 13 a6 13 a9 13 ad 13 b8 13 ba 13 c5 13 ca 13 ec 13 f6 13 fe 14 08 14 12 14 30 14 47 14 55 14 56 14 62 14 65 14 69 14 72 14 75 14 84 14 85 14 86 14 8a 14 8e 14 91 14 aa 14 ab 14 b5 14 bc 14 c0 14 c7 14 d3 14 f1 14 f2 14 f9 15 0a 15 22 15 4b 15 52 15 7d 15 93 15 9d 15 bb 15 c1 15 c2 15 c4 15 c6 15 c9 15 dd 15 e4 15 ea 15 f7 16 0d 16 1c 16 38 16 70 16 78 16 a7 16 ae 16 b3 16 ce 16 fc 17 2e 17 67 17 80 17 b1 18 23 18 2c 18 2d 18 42 18 7a 18 be 18 d1 18 df 19 0c 19 24 19 98 20 03 20 f8 21 1a 21 26 21 e7 22 6e 22 d9 24 02

I am guessing that pattern is due to involvement of ID/Serial number - which all start with DB followed by numbers which change more frequently as one progresses to low order of serial number.

S From friends 6550 C 0265a0607813c88b52bd6df63faac4d4374992a941d33f092c2b2ba38009457f C b457d984a1dba93d371740dd6f6d8380808789b356f6ac374019e002e9414487 C 8912f7375c2d2d48540c82b50b2c8e86fb72b951f1c85001bf07d9d63119a4ad C 435fa38291507b330f63db86fa2f0d6e0fd1cb8afa8f53ef11bbbe2742d98d79 R dfa5156c084c16a6c6d6266a3aa08b484d2ad2d784e1398f3e2a7edeae7f0c3e R 83d021d0f75c8e4059553660092fcad891debada9e1d93c31a7046299bdc52e3 R 096f60cb7c1218dbc1e03956bbba124e57d980d75220f0a5e286704ed82365d4 R 7d8e42a30771237328fb1d6e5975113ec6e4dd2736ce01474775e9af46434c9d

new key
Here is the key from by 6550/2B S Tobrew.1 C 02934acdbb3bd2fd199e77e23047eb76e227ad4d45872e25ec4133bf69307aed C 0fe5a0edfd9b42f5586d630fd7c70d27851b3b62c2d5f7b28b90c0a8fc8a2e89 C 1355d9a3b7d076e1f956439e9935a6b7cc6210e43c6b284851ac2646afc67c97 C 004dbc99f3c1b6ea84c0e0367f79fc4d3f64f479bc31090ec5fe2c4289ccac3f R df48fb0732e2b346ef41d58f97005b356b1e994d8c4f4394ceb7807527ac72cf R 86fb44fb621adf522dcc67e7344c7d1078ab927e534e14d0352b6f10c33fc2c9 R 6a7d7328e0adbef9a9b64c491a9555ef348000ada2cce74e79cd9cd0ac72c324 R 0ee407a1554f79804103c589e221abce5cd4b87b493241af86a481f724a64e15 *thanks for the heads up Ray

Mine: 6550 2B 2B DBxxxxxxxxxx 20 S URAMetroid's db3051700773 C 0253d1a4b39f8311284f8afbae30ccbfffa37add6b4ff14fd513de1afe3ea622 C 060305422f27f59ce5fdd12efb94baa7382f3a7812f5272db9eacafe571e41a1 C 9625226364c66177f3f7748e030ab4a863210729b5e7bc2f7382b6232fc3cd8e C 1fa0712ed8e5904a5a26ba424df8846a8a612a18dd8c78fc09c1eab00d951290 R 9bd25bfd9caf02fa7e63336c57ea3ff7ebccdf172c818592059800df31f60222 R a9c42fc065118b42c6c04cd49e3965239883350f9f664285ebe2ebebeb21dde7 R 2e875b0a2a16cea924f47e035ca1b60c70f026e73bd4789af0120b5265c3aec3 R 646991859e44b2adfdb785d7cd8c8fb1e7d7a29e0e867ffaf85f022eac923aff S URAMetroid's db2044601542 C 024fcb8e8ee3555f0ae04cf136fa66ad220fd58e3500cc8dccc0405c23aaec56 C 791897b76f319908b2029cded9d1a0c491ad4276f74a3d50450c3105b162a394 C 92554578c561781f4f83109e439357a3e7d454ab12ca4d75d84b8ab669d95c0e C 372f5e3b571afb8d2a8a30993ce993326cab95954e2704e4cda5d4d615b81eac R c1205cc87b8e9905e8fdee6d01b0226623247e2c0b1a72412671fbab6e4e44fd R af382a92e169ef73bc7d4955d82f18c8b3191401dbe79ef16dd0c6fb2e9ec1c1 R beef2f4bad9c438a9eef9ab4a9fa40d8c555de3441df048f22caa791882226c9 R 1e22bbcb471d0ca27dabf5f61e2c9f85953a4f0a0fd66cde20639268ace679b1

Using keys
Forgive the naivity, I'm more of a hardware person, how would one go about trying these keys in PV2Tools? Do they need to be included in a DLL or .txt file, or can they be entered manually while the program is running? Thanx for the info.

Ooops ...
Sorry, forgot to add, when I run PV2Tools, it informs me that none of the challenges work, and then spits out the following code; 02 58 25 AC 01 39 1D 3A 33 4A 2F 76 72 F7 2A BB 38 1F 81 86 A3 BB 5A 36 25 C1 E3 10 7D 48 E5 86 E6 EC 9B B9 8E 74 C4 3C 49 B2 F7 1B 87 AB 37 1C 84 F8 C7 44 BE 6C 3F 9D AC F7 E0 37 AD CA 25 6D 3F BC 9A 69 71 ED F1 EB 9B A9 53 45 4C 8F F4 AB 84 F2 EA A9 23 7F 3F F5 A2 20 45 67 01 21 29 46 00 92 CB C5 92 EC CD CD 8F F7 EB FD A9 EA 8A F0 A1 D4 93 BE BB 3C 81 C5 6F 04 B9 A9 61 94 1A 99 And, for the record, my camera is: Firmware - 6550 Hardware - 06 Type ID - 2B CMPType ID - 2B ID - DB8052100804 Realm ID - 20