So, what did I do with it? I could have made a gazillion interesting and useful programs, but I decided that for a proof-of-concept, something more whimsical would do just fine:

If you have a Zx3 (ith firmware version 1.12), you can try playing Tetris yourself. Just ungzip/untar this file, copy autoexec.ash and hackapp.bin to the root of an SD-card, insert card into Zx3 and do what I did in the video. The hack won't damage your camera in any way: all that's modified is the code running in RAM and when you remove both files from the SD-card and reboot, the hack will be completely gone.

As usual: the source code for the hack is downloadable here and licensed under the GPLv3. Do with it what you want: stuff like a full-on CHDK-suite for Ambarella-based devices is in theory possible. I'm probably not gonna start that, though: I have my DSLR for pictures and N900 for image hacking, so I'm happy with only recording HD-movies with my Zx3... and playing the occasional game of Tetris ofcourse.

« Prev 4 


zoomx wrote at 28 Apr 2015, 11.17:

Is there anyone that was able to reproduce this hack playing Tetris?

Vincent wrote at 15 Dec 2013, 13.42:

hi,can you add a Function For Loop recording Every 5 minutes,just like Driving record, sorry my english is poor.

Zachary wrote at 6 Dec 2013, 18.18:

Hey I have a quick question! I would really appreciate it if you could give me a quick answer. Couldn't you erase all of the stuff off of the internal flash memory and install debian Linux on it? If so how would you go about doing it? You should do it it would make a great video. You can buy them on ebay for less than $10 now and you could try it. I am aware that it would take away the video capturing funtion of the device though!

Zx3 broken. wrote at 9 Sep 2013, 2.33:

i have Kodak Zx3 Brightness Level Broken. you make collars and Brightness Level and more change mod ? :(

Edoardoo wrote at 21 Aug 2013, 14.44:

Respect! Your work is awesome!

Andy E. wrote at 20 Aug 2013, 4.33:

What an impressive hack. If anyone carries this further, I hope you will post here my plan is to buy an extra remote and add a timer for time-lapse. Would like to know if the time out will become a problem and if I can shut down the display which is the big battery drain.

bds wrote at 22 Jul 2013, 17.42:

Hi sir Which pin is rx and which pin is rx??

Kenelito wrote at 5 Feb 2013, 0.51:

Hello! Is there a factory reset stuf fon the pcb, my Zx3 is firmwarly dead and I've just disassemble it!

carsindepth.com wrote at 23 Oct 2012, 9.49:

Is it possible to adjust the white balance? I use my ZX3 cameras in a 3D rig and the two have obviously different colors.

clockdryve wrote at 19 Sep 2012, 21.39:

Need to enable adjustment to light sensitivity...so can make camera highly INFRARED sensitive. Ghost camera or what have ya......

mike wrote at 9 Aug 2012, 22.42:

hi very itresting hack. let us know just a little more about:where to find datasheet,which disassembler you are using. thanks

burak soysal wrote at 14 Jul 2012, 14.54:

or is it possible to assign a button to exposure lock?

burak soysal wrote at 14 Jul 2012, 14.38:

isn't it possible to change bitrate with this hack?

Kriz wrote at 6 May 2012, 22.42:

i have a zx3 fw 1.12 and would like to stream live from it....managed to work the Camera AP and live feed from A/V but camera does an auto shut down after 3 minutes :( how can i stop that?

Paul N wrote at 23 Apr 2012, 22.54:

me again. Another easy wish is remote record/stop by applying 5v to pin 1 of the USB rather like the Canon hacks do. It would make the construction of an underwater housing a doddle. See http://lifehacker.com/5493621/build-a-waterproof-camera-case

Paul N wrote at 23 Apr 2012, 21.21:

Would be nice to have 720p25 or 720p50. It must be easier than anything else.

jettie wrote at 4 Apr 2012, 0.07:

Hi, I have a question about this camera and you seem to be the very right person to ask. Is it possible to hack it to have a live video output. Thanks.

luq wrote at 8 Feb 2012, 22.12:

Master. Tell whether it is done so that the cam recorded as inclusion charger. Impossible to do such a thing? A program ...? Sorry for my English. Regards

Peter wrote at 26 Nov 2011, 14.43:

Ok, sorry for multiposting, but my problem is solved very easily, so people should know. I just take the SD card out, connect the usb cable, and then insert the SD card, while the camera is on. It will then pop up as a drive on the computer now, and you can delete the two files.

Peter wrote at 26 Nov 2011, 14.41:

Ok, camera works fine. I didn't think about it, but I just took out the SD card, and tried, since the camera can also run without an SD card. So all I gotta do is get a card reader and remove the two files. But, it does mean the hack did not work on my cam. :(

Peter wrote at 26 Nov 2011, 14.38:

I must warn you. Don't do this, if you don't have a card reader. I copied the files just by hooking the camera up with a USB cable. After copying the two files to the SD card, and turning on the camera, it shows the live view, but it does not respond to any keys being pressed. I couldn't even turn it off. I took out the battery to turn it off. Now plugging in the USB cable doesn't even do anything, and since I don't have a card reader at the moment, I can't delete the files again to see if that would help. Waiting to get my card reader back, so I can try. :(

rigger wrote at 30 May 2011, 15.09:

You are a genius! this would allow the basic flaws of the camera to be fixed via a custom firmware. Can we please fix the basic issues with this camera first, such as: 1)this cam is crap in low light 2)no timer for turning itself off 3)battery meter 4)mic volume level doesn't remember its settings. if you can do some of the above, I'm sure thousands who own this camera would call you god

tehnicaorg wrote at 7 May 2011, 19.30:

savebin d:\savedmp1 0xc0000000 l 0x1000 >> d:\z savebin d:\savedmp2 0xc0000000 to 0xc0000fff >> d:\z The rules are: 1. Line end should be LF instead of CR LF. 2. Last line in autoexec.ash should be terminated with LF too. 3. HEX constants should be lowercase: zx3-hack_src.tgz/README.TXT has a value of 0xC0000000 that should be 0xc0000000

Keren wrote at 22 Mar 2011, 0.04:

This camera need a stand-by display for save battery power... 90" aren't enought... Good job, but is not useful tetris XD Regards ;)

zoomx wrote at 24 Feb 2011, 17.57:

I tried this the camera turn on, the LCD turn on but does not respond to user input. To turn off I have to remove the battery. In the ash file there is a blank line in the middle, I removed it but have the same results. Maybe you forgot a line?

FettesPS wrote at 22 Feb 2011, 22.15:

Can you elaborate on the technique you used to identify the rs232 communication circuits? I need to do something similar on an old GPS I ripped apart but am not sure where to start with that. As for this tear down itself, very impressive. I have the same camera and am curious to see what new windows this opens for custom firmware. I'd love to get time lapse on it more than anything. Oh, and your captcha is fricken impossible. I had to refresh about a dozen times before I found one that was somewhat readable, it is definitely not colourblind friendly!

shaun wrote at 2 Feb 2011, 20.19:

I tried this and the camera does not respond to user input.

Sprite_tm wrote at 31 Jan 2011, 9.54:

I dunno, what about it?

jackonapsp wrote at 29 Jan 2011, 1.09:

what about the file getfwdate ?????

bob wrote at 21 Jan 2011, 0.21:

Would it be possible to hack A/V inputs into this? So you could record from a different camera, or DVD player, etc? Basically, a pocket sized DVR. I have this ultra low lux camera (for a vehicle backup system), but I have nothing to plug it into and record to.

JanMartin wrote at 19 Jan 2011, 19.41:

Have a look at http://goprouser.freeforums.org/the-gopro-hero-hd-bus-interface-t797-60.html where we try to get into the GoPro HD camera bus. Interesting stuff starts ca. on page 6. Jan

rdjman wrote at 29 Dec 2010, 21.44:

I also tried it on a Zi8 with no success, I looked in the firmware file (v1.06) and there are references to the autoexec.ash file as well as a autoexec.tcl file. Looks like it tries running it from drives a:, b:, c: and d: Tried creating my own file that would create a folder or something just to see if it even runs but havent had any success, perhaps the syntax is a lot different then i imagined. tried the follwing: d: mkdir test and mkdir d:\test with no success, any clues?

kris wrote at 29 Dec 2010, 14.45:

Yes! Change the frame rate to europe 25fps would be a great feature.

trentos wrote at 28 Dec 2010, 20.55:

See anything that would allow you to increase/change the video bitrate, fps, or manual controls? It would make it a interesting camera for a lot of people.

Jon wrote at 26 Dec 2010, 16.38:

Thanks, Great Hack! On the system board did you notice anyway to add and enable a stereo audio line in?

iamdigitalman wrote at 26 Dec 2010, 0.59:

Just tried this code on the zi8 (the non waterproof version of this camera), but it is running firmware 1.06, the latest for that camera, but the UI is identical, which makes me think it is running a simmilar but older kernel. Would do a memory dump, but the camera is not mine, and the owner of it would kill me for opening it up and hacking around inside :)

kris wrote at 25 Dec 2010, 19.26:

update. The camera starts,is live view, but there is no backlight on lcd, and as ND90 wrote, the device doesn't react to button presses. Sorry for the typos in the previous entry ;)

kris wrote at 25 Dec 2010, 19.26:

update. The camera starts,is live view, but there is no backlight on lcd, and as ND90 wrote, the device doesn't react to button presses. Sorry for the typos in the previous entry ;)

kris wrote at 25 Dec 2010, 13.16:

On finrmawe v.1.12 and soft v.761 it didn't work. The device doesn't iven boot.

Sprite_tm wrote at 25 Dec 2010, 12.01:

ND90: Weird... could you contact me using the link at the very bottom of this page? I'd like to have a memory dump of your Zx3 (I'll tell you how to make one) to see what's different from mine.

ND90 wrote at 25 Dec 2010, 10.58:

I tried this with my Zx3 (After upgrading to 1.12) and it didn't work. When I boot the camera with the two files present, I get to see the main screen (including the live image) but the device doesn't react to my button presses. The camera also cannot be attached to my computer if the two files are on the sd-card (If I remove the files everything is back to normal though). I am also interested in how you wrote that tetris proof-of-concept. Great site btw :-)

Sprite_tm wrote at 25 Dec 2010, 9.20:

cam0: It's not that difficult. Most devices send out boot messages over the serial port when reset, so I just connected my digital scope to a pin and reset the device. When I got a lot of signal, I'd check if it made sense as something that came from an uart and calculated the baud rate. Then I connected a 2nd wire to the pad next to it and send an enter: if it would come back to me, I'd have found the Rx-pin; if not I'd have to try another one.

Yerok wrote at 25 Dec 2010, 3.47:

I just bought one of these! Thanks!

Arutan wrote at 25 Dec 2010, 2.34:

That is what I call "a true hack" !! From nothing, with nothing, both hard an soft hacking !! Perfect ! I would like to do the same but completely noob in systems (ie linux and os) despite electronic skills ! Congratulation !

cam0 wrote at 24 Dec 2010, 19.13:

Man, you are good, congratulations ! I'd be very interested in knowing in details how you figured out it was a serial port and how you found out the correct pinout (ie can you explain "After some poking around with a scope, a FT232 and two fine wires, I was proven right."). Thanks and merry Christmas

eddy wrote at 23 Dec 2010, 11.06:

this is awesome :-) btw, your website is in my rss feeds since a few month now, and i am always excited while reading your hacking adventures! and thanks for releasing your source codes, it helps me alot to understand your work :-) keep up the good work!

Gdogg wrote at 22 Dec 2010, 23.50:

You both make me want to quit electronics completely and get really into it. I understand ARM assembly as well (It's my job) but I have no experience reverse engineering. Definitely inspiring!

Sprite_tm wrote at 22 Dec 2010, 23.43:

Gdogg: I think all in all it's been a week between me getting the device and me getting Tetris to run. It helped quite a lot that I had my knowledge of arm assembly at the ready because of another project I did, and having a shell and a seemingly well-written, non-obfuscated binary helped a lot.

Gdogg wrote at 22 Dec 2010, 23.36:

How long did this take you? You are incredible. I would have taken it apart, MAYBE connected to the serial (but I'd have trouble figuring out what it was) and pretty much give up after playing around in the shell.

trainspotter wrote at 22 Dec 2010, 20.31:

soooo so cool! superb hack! thanks for that! :)

Leave a comment:

Your name:

What does this picture say?
Sorry, this is a captcha

Your comment:

© 2006-2014 Sprite_tm - Contact