PV Camera Hacking Glossary
AutoBrite - Patented (US #6,600,471) system built into SMaL image sensor which allows capturing a wider range of light levels than some other sensors. Bayer Filter - Array of alternating color filters used to record red, green and blue color levels (at adjacent pixel locations) using image sensor that can only record single light-level for each pixel. Requires use of demosaicing algorithm to assemble into RGB image. SMaL image sensors have a Bayer filter where the even rows are blue and green values (i.e. BGBGBG...) and odd rows are green and red values (i.e. GRGRGR...). Green is often repeated more often in a Bayer filter pattern since human eyes are most sensitive to green light. More info here http://en.wikipedia.org/wiki/Bayer_filter Bootloader Mode - An operational mode of some SMaL cameras where the camera can only load new programs into memory. Cameras will enter bootloader mode when it encounters certain kinds of memory corruption. CFA - (aka Bayer Image) Array of image-like data containing a single value at each pixel location. This is the data from a monochromatic (i.e. light-level only) image sensor with a Bayer filter. Challenge - 128 byte sequence supplied by Pure Digital One-time-use cameras as part of standard unlock sequence. Application software must provide corresponding response to unlock camera. Checksum - the PV2 firmware contains 2 simple additive checksums to detect firmware corruption and/or tampering. CVS Red - Red labelled one-time-use camera with LCD display sold by CVS Pharmacy stores. CVS Blue - Blue labelled one-time-use camera without LCD display sold by CVS Pharmacy stores. Dakota Digital - Brand name on one-time-use Pure Digital cameras. Demosaicing - Algorithm to "reassemble" a Bayer-filtered color array into an image with all RGB values at each pixel. Demosaicing algorithms can be quick with various chromatic errors or lengthy with better chromatic correction. When pixels in a demosaic-ed image that should be white are colored then this is an error or limitation in the demosaicing algorithm. Edge Connector - 10-finger PCB connector in cameras and camcorders developed by Pure Digital. Four of these contacts provide connections for USB interface to camera. FF1 - Abbreviation for "RadioShack FlatFoto Camera" FF2 - Abbreviation for "RadioShack FlatFoto 2 Camera" FF3 - Abbreviation for "RadioShack FlatFoto 3 Camera" http://www.radioshack.com/product.asp?catalog%5Fname=CTLG&product%5Fid=16-3844 Firmware - Program which runs on internal processor to controls most camera operations. Stored in file named FIRMWARE.BIN on flash. Flash - Flash memory in camera. Flash memory is non-volatile which means that it retains data when the power is turned off. The flash memory in a SMaL-based drive is formatted as a FAT12 file system. FlatFoto - SMaL chipset cameras sold by Radio Shack. Models are the original "FlatFoto" at 1.3 megapixels, "FlatFoto 2" (aka FF2) at 2 megapixels, and the "FlatFoto 3" (aka FF3) at 3 megapixels Foxz2 - Che-ez! Foxz2 camera sold by NHJ corporation. Built on 1.3 megapixel SMaL chipset. Image Sensor - CMOS integrated circuit which can create electronic image by detecting light levels focused on rectangular sensor array. Usually contains Bayer filter for digtal cameras. LaMSSMaL - See "Reset State" NVRAM - Abbreviation for "Non-Volatile Random Access Memory". SMaL cameras implement NVRAM using a file named NVRAM.DAT stored on camera's internal flash memory. Original Dakota Blue - First one-time-use digital camera. Created by Pure Digital. First camera to use Pure Digital Edge Connector. Did not use SMaL-based chipset. Sold through Wolf/Ritz Camera stores. Thoroughly hacked. PCB - Abbreviation for Printed Circuit Board. Permanently Unlocked - Modifications to firmware on one-time-use camera so that challenge/response sequence is no longer needed for communication with the camera. Product ID, PID - 2-byte identification number for a USB product. PIDs are only unique when combined with the VID. One-time-use cameras use 0x0027 when not in bootloader mode. Pure Digital - San Francisco, CA company which developed one-time-use cameras using SMaL chipsets. http://www.puredigitalinc.com PV2 - Part of brand name on 2nd generation of Pure Digital one-time-use cameras. Hackers here use "PV2" to refer to the whole one-time-use camera arena. RAW File - In general use a RAW file is a digital camera image file which contains the original CFA data from the sensor without any post-processing - this is generally available only on medium to high-end digital cameras (like DSLRs). For SMaL cameras, the image CFA data is stored in a file with the extension .RAW. These files contain unprocessed image CFA data so they fit the general use definition also. Reset State - One-time-use SMaL camera where NVRAM has been "reset". ID shows LaMSSMaL0000 and the challenge/response sequences have been reset to known default values. The only known mechanism for resetting a one-time-use camera is to delete or rename the NVRAM.DAT file. Early one-time-use cameras could be switched to reset state through basic interactions - though this mechanism was never completely understood. Response - 128 byte sequence which application software must send to camera after challenge to unlock one-time-use camera communications. There is a specific response sequence for each challenge sequence. Ritz/Wolf Red - Red labelled one-time-use camera with LCD display sold by Ritz/Wolf Camera stores. Ritz/Wolf Blue - Blue labelled one-time-use camera without LCD display sold by Ritz/Wolf Camera stores. SD Card - Secure Digital flash memory card. Most reusable SMaL-based cameras have a SD card slot to extend the camera's memory. SDRAM - The 8Mb of memory used to back the camera's display screen, capture data from the image sensors, etc. Shutter - Many SMaL one-time-use cameras have a shutter to protect the lens/sensor. The shutter will open when the camera is turned on and will close when the camera is turned off. It appears that this shutter is designed to protect the lens/sensor assembly when the camera is not in use and has nothing at all to do with the traditional shutter operation used by some cameras to frame the light sensing process. SMaL - SMaL Camera Technologies, company in Waltham, MA. http://www.smalcamera.com Purchased in February 2005 by Cypress Semiconductor http://www.cypress.com. SMaL develops imaging sensors and applications. SRAM - The 64k of memory the camera's CPU can directly address Two Finger Salute - See "Vulcan Nerve Pinch" Ultra-Pocket - Name for digital camera product development kits developed by SMaL. Ultra-Pocket 3 is kit for 1.3 megapixel camera, Ultra-Pocket 4 for 2.0 megapixel camera and Ultra-Pocket 5 for 3.0 megapixel camera. Unlocked - Operational mode for one-time-use camera where USB communications are supported to retrieve image data from camera. Commercial SMaL-based cameras are never locked (and thus are always unlocked). Vendor ID, VID - 2-byte USB identification number assigned to a specific product vendor. SMaL's VID is 0x0DCA. Vulcan Nerve Pinch, VNP - Pure Digital cameras will display a screen of identifying information when certain camera buttons are held down during the power-on sequence. For PV2/CVS cameras, hold down the "Display" and shutter buttons when also pressing the On/Off key to power on. If you don't understand why we call this process the Vulcan Nerve Pinch then you haven't watched nearly enough of the original Star Trek television series. Updated 6/22/05 with additions from BillW. Please send me any additions or corrections - Sailpix _/)