Dakota PV2 Disposable Digital Camera Hack Tutorial (Revision 2) Background You'll need to make a custom cable in order to connect your Dakota PV2 to your PC. I recommend using a Palm M100 HotSync cable (See Palm M100 Cable web page included in this zip). The PV2mods page includes instructions on how to create a cable from a parallel printer cable, but if that is your chosen route, make sure the connecter you use looks like the one in the pictures. I used the wrong one, twice, before I realized the Palm M100 cable fits much more nicely and is easier to modify. This firmware was extracted from a CVS Red PV2 with the following info and was then modified: FIRMWARE 6520 HARDWARE 06 TYPEID 2B CMP TYPEID 2B ID LAMSSMAL0000 REALM ID 00 This firmware will, however, work with a red camera with TYPEID 30. Using the firmware with a red camera with TYPEID 27 will permanently disable the LCD screen on the camera. This firmware was hex edited at location 0x6910 changing 01C8 to 02C8 (permanently unlocking the camera), at location 0x6AF4 changing 2700 to 2400 (changing the Product ID), and at 0x6B30 changing 3030 to 3230 (changing checksum to account for previous changes). Figure out your firmware version by holding down the shutter and Display buttons before you press the On button, and as the camera is turning on. If you do not have firmware 6520 with either TYPEID 2B or 30, check the Firmware Hex Page (included in the zip), otherwise skip to the section entitled "Using the Hacked Firmware". If you can't find the proper hacks for your camera on the Firmware Hex Page, then download "firmware.bin" from your camera with PV2Tool (The last two paragraphs of "Using the Hacked Firmware" tell you how to use PV2Tool. Instead of clicking "Upload File" though, click "Download File"). Unzip PV2Flag into a temporary folder and move the file "firmware.bin" to that folder. Double-click on "Run PV2Flag.bat". A command prompt window should appear. This program tells you which HEX addresses need to be edited in order to hack the firmware. Check to see if your file must be changed at location 0x6910 and location 0x6AF4. Also make sure that the "Single-byte checksum" (at the bottom of the window) is 108. If either one of the locations or the Single-byte checksum are different, then you cannot use the "firmware.bin" file that I have included in this zip. Instead you must hex edit your own "firmware.bin" at the locations that PV2Flag specifies. To HEX edit your own "firmware.bin", install TinyHexer (included in the zip). Make sure you leave the command prompt window running PV2Flag open, you'll need to refer back to that as we HEX edit. In TinyHexer, open your copy of "firmware.bin" (should be in the same folder as PV2Flag at this point). You'll notice some values on the left hand side of the window, these are the addresses for the different locations of data in the file, but they only go up every 16 bytes I believe it is. If I'm correct (about the unit of measurement being bytes), then every 2 characters and/or digits makes up one byte. If the byte your looking for comes in between two of the locations on the left hand side of TinyHexer, then click on different sets of two characters until "Pos:" at the bottom of the screen displays the correct location. The location that contains the "Unlock Camera Byte" (refer to PV2Flag) will have the value 01. Change that to 02. The location containing the "Camera PID" will have the value 27. Change that value to 24. Making these changes also changes the checksum. If your checksum is different than what the camera is used to, it won't work after you upload the modified firmware back to the camera. In order to fix this, go down to the line that PV2Flag specifies as "D.i.g.i.t.a.l". Add 2 to what ever the current value is (for example, if it's 44 then make it 46). We're adding 2 to this value because of the previous two changes we've made. Since you changed the Unlock Byte by adding 1, we subtract 1 from the checksum. Since you subtracted 3 from the Camera PID, we added three to the checksum. So in total, you've really only changed the overall value of this file by subtracting 2, thus we added 2 in a place where it doesn't really matter in order balance out the checksum. Save your changes and close TinyHexer. Double-click on "Run PV2Flag.bat" again. A new command prompt will open up. This time PV2Flag should say for the Unlock Byte that "This firmware is already unlocked." and for the Camera PID, "This firmware is set to foxz2.". The Single-byte checksum should still be the same as the first time you ran PV2Flag. If it's not, you've made an error correcting the checksum at the "D.i.g.i.t.a.l" location and it must be corrected. If everything looks good, you're now ready to upload the new "firmware.bin" back to the camera. Using the Hacked Firmware Using this firmware hack will permanently unlock the camera as well as change the Product ID (PID) from 27 to 24. We originally did this so that we could use the Che-ez Foxz drivers, but those drivers are not worth while and are incredibly hard to uninstall. Instead, install the FlatFoto 2MP drivers. The FlatFoto drivers included have already been modified to add support for the Dakota PV2 with PID 24. If you hex edited your own copy of "firmware.bin", it wasn't necessary for you to change the PID, however, if you leave it as 27, you'll have to modify the FlatFoto drivers in order to recognize PID 27. The file "firmware.bin" (use your own copy of "firmware.bin" if you had to hack it yourself) must be flashed to the camera in order to switch it to the hacked firmware. The other files from the camera's flash memory are only included in the zip incase they are needed in the future, but are unmodified. Make sure you have LibUSB (libusb-win32-filter-bin-0.1.8.0.exe) installed. Extract libusb-win32-bin-0.1.8.0.zip to "C:\Program Files\libusb-win32-bin-0.1.8.0\". Plug in the camera. When it prompts you to install the drivers, chose advanced and make sure you point the hardware wizard to the "C:\Program Files\libusb-win32-bin-0.1.8.0\" folder. Open PV2Tool which is located in the "Apps" folder in the zip. Once the camera is plugged in, click "Find Camera" then "Connect" then "Unlock Reset". The program will likely say that it was unable to unlock the camera. Simply click "Disconnect" and unplug the camera. Plug it back in, and, the moment the camera beeps, click connect. Now try unlocking it. Once the camera is unlocked, the "firmware.bin" file can be uploaded. Make sure your camera is firmly plugged in and sitting on a flat, steady surface. Click "Get File Listing". Select the file "firmware.bin". Click "Upload File" and chose the modified "firmware.bin" file. It'll ask you a couple times if you're sure you want to overwrite, just say yes. After it's done uploading, click "Disconnect". Finishing Up In order to retrieve and delete pictures from the camera, you'll need the FlatFoto 2MP drivers. Make sure your camera is unplugged at this point. Before you can install those however, you must make sure that you still have LibUSB installed. If it isn't, install it now. To install the FlatFoto drivers, use a CD burning program such as Nero, and burn the "FlatFoto 2MP Installation CD (Hacked Drivers Only).iso" CD image to a CD. Better yet, get a CD image mounting program, such as DAEMON Tools (included in the zip), and mount the image as a virtual CD Drive. One the CD is inserted or mounted, there will be an autorun. Just click on the "Driver" button. If you need to modify the drivers to recognize a different PID, follow the instructions on the FlatFoto Driver Modification page included in the zip. After the install is complete, plug in the camera. In the hardware wizard, just allow Windows to search for and install the drivers on its own. This is necessary due to the fact that you're using drivers from both LibUSB and FlatFoto. Now install IrfanView (iview385.exe in the Apps folder). To save pictures to your PC, open IrfanView, go to File, Select TWAIN Source, and chose "Digital Camera 1.603 (32-32)". Now go to File, Batch Scanning, chose a destination folder and a file type to save as, and click okay. A new window will come up telling you how many pictures are on the camera and it also gives you the option of deleting the pictures after they are downloaded. Disclaimer/Acknowledgements I will not be responsible in any way for your use of this information. As far as I understand it, it is legal to modify your own property. None of the information included in this tutorial was discovered by me. I used several web sites in order to gather this info. Many of them tell you to use the Che-ez Foxz drivers, but trust me, the FlatFoto drivers produce better quality pictures. I do not claim to be the owner or creator of any of the ideas in this walkthrough nor in the included pages. I've only included the web pages of others to allow the reader quick reference. Most of my info came from these sites: http://vickers.homedns.org/PV2mods.htm (included in the zip) http://www.rkawakami.net/dakota/index.html (included in the zip) http://nystepmom.blogdns.com/phils/demanufacturing/pv2/driverx/page2.htm (included in the zip) http://mysite.verizon.net/forkboy/patches.html (included in the zip) http://www.linux-hacker.net/cgi-bin/UltraBoard/UltraBoard.pl?Action=ShowBoard&Board=cameras (A forum with great information, terrible layout/organization) http://oscar.dcarr.org/dd/ (Found PV2Flag on this site simply out of dumb luck) http://revjim.net/comments/9624 (A sort of timeline documentation of how people went about hacking the original Dakota disposable. Not really any useful info, just interesting)