In the boot, it spit out "rtos" So that's running a RTOS instance, maybe FreeRTOS :) But in 2010, i think i haven't heard about it.

One word: INTERVALOMETER. Can you please write code that can take a photo every 5 seconds? Thank you!

Any option to fix broken camera that goes in to charging cycles with this method? Camera is turning on making dirs on mc everything boot not fully boot screen start and after few second it goes down, but camera power light stay turn on.

Is there anyone that was able to reproduce this hack playing Tetris?

hi,can you add a Function For Loop recording Every 5 minutes,just like Driving record, sorry my english is poor.

Hey I have a quick question! I would really appreciate it if you could give me a quick answer. Couldn't you erase all of the stuff off of the internal flash memory and install debian Linux on it? If so how would you go about doing it? You should do it it would make a great video. You can buy them on ebay for less than $10 now and you could try it. I am aware that it would take away the video capturing funtion of the device though!

i have Kodak Zx3 Brightness Level Broken. you make collars and Brightness Level and more change mod ? :(

Respect! Your work is awesome!

What an impressive hack. If anyone carries this further, I hope you will post here my plan is to buy an extra remote and add a timer for time-lapse. Would like to know if the time out will become a problem and if I can shut down the display which is the big battery drain.

Hi sir Which pin is rx and which pin is rx??

Hello! Is there a factory reset stuf fon the pcb, my Zx3 is firmwarly dead and I've just disassemble it!

Is it possible to adjust the white balance? I use my ZX3 cameras in a 3D rig and the two have obviously different colors.

Need to enable adjustment to light sensitivity...so can make camera highly INFRARED sensitive. Ghost camera or what have ya......

hi very itresting hack. let us know just a little more about:where to find datasheet,which disassembler you are using. thanks

or is it possible to assign a button to exposure lock?

isn't it possible to change bitrate with this hack?

i have a zx3 fw 1.12 and would like to stream live from it....managed to work the Camera AP and live feed from A/V but camera does an auto shut down after 3 minutes :( how can i stop that?

me again. Another easy wish is remote record/stop by applying 5v to pin 1 of the USB rather like the Canon hacks do. It would make the construction of an underwater housing a doddle. See http://lifehacker.com/5493621/build-a-waterproof-camera-case

Would be nice to have 720p25 or 720p50. It must be easier than anything else.

Hi, I have a question about this camera and you seem to be the very right person to ask. Is it possible to hack it to have a live video output. Thanks.

Master. Tell whether it is done so that the cam recorded as inclusion charger. Impossible to do such a thing? A program ...? Sorry for my English. Regards

Ok, sorry for multiposting, but my problem is solved very easily, so people should know. I just take the SD card out, connect the usb cable, and then insert the SD card, while the camera is on. It will then pop up as a drive on the computer now, and you can delete the two files.

Ok, camera works fine. I didn\'t think about it, but I just took out the SD card, and tried, since the camera can also run without an SD card. So all I gotta do is get a card reader and remove the two files. But, it does mean the hack did not work on my cam. :(

I must warn you. Don\'t do this, if you don\'t have a card reader. I copied the files just by hooking the camera up with a USB cable. After copying the two files to the SD card, and turning on the camera, it shows the live view, but it does not respond to any keys being pressed. I couldn\'t even turn it off. I took out the battery to turn it off. Now plugging in the USB cable doesn\'t even do anything, and since I don\'t have a card reader at the moment, I can\'t delete the files again to see if that would help. Waiting to get my card reader back, so I can try. :(

You are a genius! this would allow the basic flaws of the camera to be fixed via a custom firmware. Can we please fix the basic issues with this camera first, such as: 1)this cam is crap in low light 2)no timer for turning itself off 3)battery meter 4)mic volume level doesn\'t remember its settings. if you can do some of the above, I\'m sure thousands who own this camera would call you god

savebin d:\\savedmp1 0xc0000000 l 0x1000 >> d:\\z savebin d:\\savedmp2 0xc0000000 to 0xc0000fff >> d:\\z The rules are: 1. Line end should be LF instead of CR LF. 2. Last line in autoexec.ash should be terminated with LF too. 3. HEX constants should be lowercase: zx3-hack_src.tgz/README.TXT has a value of 0xC0000000 that should be 0xc0000000

This camera need a stand-by display for save battery power... 90\" aren\'t enought... Good job, but is not useful tetris XD Regards ;)

I tried this the camera turn on, the LCD turn on but does not respond to user input. To turn off I have to remove the battery. In the ash file there is a blank line in the middle, I removed it but have the same results. Maybe you forgot a line?

Can you elaborate on the technique you used to identify the rs232 communication circuits? I need to do something similar on an old GPS I ripped apart but am not sure where to start with that. As for this tear down itself, very impressive. I have the same camera and am curious to see what new windows this opens for custom firmware. I\'d love to get time lapse on it more than anything. Oh, and your captcha is fricken impossible. I had to refresh about a dozen times before I found one that was somewhat readable, it is definitely not colourblind friendly!

I tried this and the camera does not respond to user input.

I dunno, what about it?

what about the file getfwdate ?????

Would it be possible to hack A/V inputs into this? So you could record from a different camera, or DVD player, etc? Basically, a pocket sized DVR. I have this ultra low lux camera (for a vehicle backup system), but I have nothing to plug it into and record to.

Have a look at http://goprouser.freeforums.org/the-gopro-hero-hd-bus-interface-t797-60.html where we try to get into the GoPro HD camera bus. Interesting stuff starts ca. on page 6. Jan

I also tried it on a Zi8 with no success, I looked in the firmware file (v1.06) and there are references to the autoexec.ash file as well as a autoexec.tcl file. Looks like it tries running it from drives a:, b:, c: and d: Tried creating my own file that would create a folder or something just to see if it even runs but havent had any success, perhaps the syntax is a lot different then i imagined. tried the follwing: d: mkdir test and mkdir d:\\test with no success, any clues?

Yes! Change the frame rate to europe 25fps would be a great feature.

See anything that would allow you to increase/change the video bitrate, fps, or manual controls? It would make it a interesting camera for a lot of people.

Thanks, Great Hack! On the system board did you notice anyway to add and enable a stereo audio line in?

Just tried this code on the zi8 (the non waterproof version of this camera), but it is running firmware 1.06, the latest for that camera, but the UI is identical, which makes me think it is running a simmilar but older kernel. Would do a memory dump, but the camera is not mine, and the owner of it would kill me for opening it up and hacking around inside :)

update. The camera starts,is live view, but there is no backlight on lcd, and as ND90 wrote, the device doesn\'t react to button presses. Sorry for the typos in the previous entry ;)

update. The camera starts,is live view, but there is no backlight on lcd, and as ND90 wrote, the device doesn\'t react to button presses. Sorry for the typos in the previous entry ;)

On finrmawe v.1.12 and soft v.761 it didn\'t work. The device doesn\'t iven boot.

ND90: Weird... could you contact me using the link at the very bottom of this page? I\'d like to have a memory dump of your Zx3 (I\'ll tell you how to make one) to see what\'s different from mine.

I tried this with my Zx3 (After upgrading to 1.12) and it didn\'t work. When I boot the camera with the two files present, I get to see the main screen (including the live image) but the device doesn\'t react to my button presses. The camera also cannot be attached to my computer if the two files are on the sd-card (If I remove the files everything is back to normal though). I am also interested in how you wrote that tetris proof-of-concept. Great site btw :-)

cam0: It\'s not that difficult. Most devices send out boot messages over the serial port when reset, so I just connected my digital scope to a pin and reset the device. When I got a lot of signal, I\'d check if it made sense as something that came from an uart and calculated the baud rate. Then I connected a 2nd wire to the pad next to it and send an enter: if it would come back to me, I\'d have found the Rx-pin; if not I\'d have to try another one.

I just bought one of these! Thanks!

That is what I call \"a true hack\" !! From nothing, with nothing, both hard an soft hacking !! Perfect ! I would like to do the same but completely noob in systems (ie linux and os) despite electronic skills ! Congratulation !

Man, you are good, congratulations ! I\'d be very interested in knowing in details how you figured out it was a serial port and how you found out the correct pinout (ie can you explain \"After some poking around with a scope, a FT232 and two fine wires, I was proven right.\"). Thanks and merry Christmas

this is awesome :-) btw, your website is in my rss feeds since a few month now, and i am always excited while reading your hacking adventures! and thanks for releasing your source codes, it helps me alot to understand your work :-) keep up the good work!

You both make me want to quit electronics completely and get really into it. I understand ARM assembly as well (It\'s my job) but I have no experience reverse engineering. Definitely inspiring!

Gdogg: I think all in all it\'s been a week between me getting the device and me getting Tetris to run. It helped quite a lot that I had my knowledge of arm assembly at the ready because of another project I did, and having a shell and a seemingly well-written, non-obfuscated binary helped a lot.

How long did this take you? You are incredible. I would have taken it apart, MAYBE connected to the serial (but I\'d have trouble figuring out what it was) and pretty much give up after playing around in the shell.

soooo so cool! superb hack! thanks for that! :)