Go Back   Steve's Digicams Forums > Digital Cameras (Point and Shoot) > Sony

Thread Tools Search this Thread
Old Aug 24, 2003, 3:12 PM   #1
Junior Member
Join Date: Aug 2003
Posts: 16
Default Cracking Sony Camera

I will try to explain how to change
some internal setting on dscS70.

Even if these steps are not part
of any service manual, I suppose
s75 s85 and others sony camera
will be pretty similar and
with some experiments I and
memory dumps I think this procedure
will apply also to other sony cameras.
(828 is coming...with same stupid formats)

For modifying these internal values you need
a lanc cable , a dos mode PC, a program called
rm95emul and rm95dump ... and some availability
to do risky business.......

of Your camera...........ABSOLUTELY

My purpose is to change the standard resolution
on my camera entering a new hidden format, 1024:768
substituting the photo sizing 2048(3:2).

The S70 menu-predefined photo choices are 5
and are internally associated with 5 addresses
values on page 0D:

frmt1: address 20, val 01 (640x480)
frmt2: address 21, val 04 (1280x1960)
frmt3: address 22, val 06 (1600x1200)
frmt4: address 23, val 88 (2048(3:2))
frmt5: address 24, val 08 (2048x1536)

The format definition is coded
following this association table:

Hex Binary Format Type
(00)--00000000--> NOT USED
(01)--00000001--> 640x480
(02)--00000010--> 1024x768
(03)--00000011--> 1216x912
(04)--00000100--> 1280x960
(05)--00000101--> 1472x1104
(06)--00000110--> 1600x1200
(07)--00000111--> 1920x1440
(08)--00001000--> 2048x1536
(09)--00001001--> 2304x1728
(0A)--00001010--> 2560x1920
(0B)--00001011--> 1856x1392
(0C)--00001100--> 2240x1680

(80)--10000000--> NOT USED
(81)--10000001--> 640 (3:2)
(82)--10000010--> 1024 (3:2)
(83)--10000011--> 1216 (3:2)
(84)--10000100--> 1280 (3:2)
(85)--10000101--> 1472 (3:2)
(86)--10000110--> 1600 (3:2)
(87)--10000111--> 1920 (3:2)
(88)--10001000--> 2048 (3:2)
(89)--10001001--> 2304 (3:2)
(8A)--10001010--> 2560 (3:2)
(8B)--10001011--> 1856 (3:2)
(8C)--10001100--> 2240 (3:2)

As You can see, the camera is able
to give Us up to 24 possible photo formats
you cannot define your own format..you
can just pick up 5 from the 24..
re-specifying 5 byte values on page d,
address 20,21,22,23,24 (hex).


The D page is controlled by a checksum
XOR formula.... so if We change a value of
the original setup the camera will goes
in lock state (battery indicator flashing).

If this happen, you need to force the camera
back to life changing:
address 01 on page 00 from 0 to 1
address 1b on page 02 from 03 hex to 00 (or 02 in pal)
and refit the original values on page 0d...
or going to Sony service... ;-))))))))

For avoiding this lock, I will simply compensate
any change on registers acting on a dummy address
located on page 0d.
This address(16hex) will balance my change,
you can probably use also the address 14 & 15.

In my example I will replace format4 , controlled
by address 23 hex ,introducing the new format 1024x768.
(In fact I do not use the 2048(3:2)......)

This will mean to CHANGE the original value on address 23
from 88hex to 02hex (See the table association).

For doing this, You need to recalculate the checksum
modifying the value specified on address 16hex,page 0d.

In my original setting this value was 01hex, but in
your camera will be for sure different...

Here is the formula for recalculating the value.

TA-Old = Target Address Old Value (In my example 88, address 23)
TA-New = Target Address New Value (In my example 02, address 23)
CA-Old = CheckSum Address Old value (In my example 01, address 16)
CA-New = Chechsum Address New value (Value to be recalculated)

CA-New = (TA-Old XOR TA-New) XOR CA-Old

In my example


This result is 8B hex and
is the value to be inserted
into checksum address 16x.

So finally we need to
change two values on page 0d:

address 16 from 01 hex to 8B hex
address 23 from 88 hex to 02 hex

This was working fine on my camera.

I'm working with same principles
for enabling other hidden functions...

kkprince is offline   Reply With Quote
Sponsored Links
Old Aug 24, 2003, 10:20 PM   #2
Junior Member
Join Date: Aug 2003
Posts: 5

Whew! Very interesting stuff... how about cracking the DSC-P8? Is it poassible to tweak the P8 so that it will allow 2 second shutter speed on program (P) mode? The current default shutter speed in P mode is only 1 second. But if you use the twilight mode, the shutter speed will go down to 2 second. The reason why I want to use P mode is because the ISO can be manually adjusted up to 400 in P mode, but problem is the shutter will go down to 1 second only. In twilight mode, shutter will go down to 2 second but you cannot change the ISO, it is fixed at 100. The night capture ability of the P8 will greatly improve if it can go ISO 400 at 2 second shutter, the noise could be higher but I think P8's noise reduction will do its job to minimize the noise.

Thanks, please keep up the good work! 8)
fnvillafuerte is offline   Reply With Quote
Old Aug 25, 2003, 10:36 AM   #3
Senior Member
UrbanPhotos's Avatar
Join Date: Aug 2002
Posts: 382

Wow, I've always wondered if it was possible to "tweak" the programming in a digicam. I wonder what kind of adjustments are possible with the F717. It would be cool if I could make 4 megapixel resolution an option. I've occasionally reduced the resolution to make room for more photos, and it would nice to not have to reduce all the way to 3 megapixel size. I've noticed how the camera was capable of "understanding" other resolutions: when I put in a memory stick with photos from my P31, it's able to recognize the size of the photos as 1600.
UrbanPhotos is offline   Reply With Quote
Old Aug 25, 2003, 11:32 AM   #4
Senior Member
Klaus DK's Avatar
Join Date: Aug 2002
Posts: 2,216

I'm sure this will make you take a lot of good shots in the future. Go for it! :lol: :lol: :lol:
Klaus DK is offline   Reply With Quote
Old Aug 29, 2003, 6:00 AM   #5
Junior Member
Join Date: Aug 2003
Posts: 5
Default rm95dump


where could we find this software and what is a lanc cable

i will test it on my 707 where i need to have exposure tume up to 1mn

Thaar is offline   Reply With Quote
Old Sep 13, 2003, 11:53 AM   #6
Junior Member
Join Date: Sep 2003
Posts: 1
Default Sony V1 modding

Do you think it would be possible to add a "B" shutter speed option, so it would be open until i am pressing on the button? If there is any chance, i would put some effort in it, and try if it worked.
atus is offline   Reply With Quote

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off

All times are GMT -5. The time now is 1:16 AM.