Some info for brave people thinking
to start a new voyage into
their own camera setting universe ;-))))

Please sorry for my english ,
I’m writing from Italy (North Mountains).

First of all consider to buy the Service Manual
of your camera from Sony or from the link below.
It could be a good idea..

Sony uses a protocol called Lanc, able to control
all their video & camera with a Sony remote control
called RM95.

This device, used by Sony Service connects the camera
via a mini-stereo-jack plug normally jacked into
the flash plug.

This RM95 is not available from Sony, but
there are some people that emulate it via
software, for example using rm95emul & rm95dump
i.e. two dos mode routine able to dump to a file
the 16 registry pages of any Sony device and to
change-read registers settings via pc.

My research was started by a flash error
om my s70 an from the request of 180$ for
changing a byte value from sony services….
;-)))

I saw (thanks acem77) was possible to
build a parallel-minijack cable with
a couple of dollars ad use the same tools
made by people interested in enabling
the dv-in in the sony videocameras.

What we can do controlling the 16 pages of
registry ? Well first of all a lot of damages…

So the first operation is to take a dump on file
of your camera, please note any camera has different
dump, even if comparing same models.

Think about on some pages of this dump there are the
ccd faul error corrections that are specific for any ccd…

I would like to create a database of these dumps,
foe any Sony Models, so that we can help us each other
on researching useful settings….

Sony use quite a lot of similarities even in
very different models, so the reverse engineering
of settings of one model can help the rev eng of others.

What are the benefits? Well up to now I was able to fix flash
errors E:90:91 at zero cost, enabling two new formats on my S70
and introducing an icon on the menu for controlling the focus
as usually do the focus button.

I can also enabling a bar color pattern, a grey bar pattern
shooting photos via pc, changing the lcd bright, color saturation
etc etc etc……….

An important disclaimer for Mr Sony.
I like your products
My aim is just to enhance my photos,
and my beloved camera capabilities.
nothing else than this.

End Of Part 1

For the interested people please do
not esitate to contact me, but before
to do this, give a look to some links:

(Schema cable)
http://www.angelfire.com/ab2/DVinSony/

(Manuals for Sales)
http://servicemanuals.net/index.html

(Dvin-lanc stuff)
http://lea.hamradio.si/~s51kq/DV-IN.HTM
http://www.hardwareanalysis.com/action/printarticle/1464

(Programs)
http://stanza.techfocus.net/camera/rm95.zip

————————————————–
————————————————–

From what I get from the 707
dump, also in this case is possible
to change the 5 predefined photo formats
acting on five addresses on page 0d.

In this case the target
locations are
22,23,24,25,26
default values
01 04 08 8A 0A

This means the 707 uses
640×480
1280×960
2048×1536
2560 (3:2)
2560×1920

And You can pick up other stuff
following the table below…

REMEMBER TO COMPENSATE THE XOR
CHECKSUM USING a DUMMY BYTE
(3E or 3F are probably candidates)

FORMULA:
CA-New = (TA-Old XOR TA-New) XOR CA-Old

TA-Old = Target Address Old Value
TA-New = Target Address New Value
CA-Old = CheckSum Address Old value
CA-New = Chechsum Address New value

FORMAT TABLE

Hex Binary Format Type
——————————-
(00)–00000000–> NOT USED
(01)–00000001–> 640×480
(02)–00000010–> 1024×768
(03)–00000011–> 1216×912
(04)–00000100–> 1280×960
(05)–00000101–> 1472×1104
(06)–00000110–> 1600×1200
(07)–00000111–> 1920×1440
(08)–00001000–> 2048×1536
(09)–00001001–> 2304×1728
(0A)–00001010–> 2560×1920
(0B)–00001011–> 1856×1392
(0C)–00001100–> 2240×1680

(80)–10000000–> NOT USED
(81)–10000001–> 640 (3:2)
(82)–10000010–> 1024 (3:2)
(83)–10000011–> 1216 (3:2)
(84)–10000100–> 1280 (3:2)
(85)–10000101–> 1472 (3:2)
(86)–10000110–> 1600 (3:2)
(87)–10000111–> 1920 (3:2)
(88)–10001000–> 2048 (3:2)
(89)–10001001–> 2304 (3:2)
(8A)–10001010–> 2560 (3:2)
(8B)–10001011–> 1856 (3:2)
(8C)–10001100–> 2240 (3:2)

KK

——————————————
——————————————

Well ..second episode… First of all thanks to
Thaar for his bravery and the dump of a 707….
Now I can really start to focus a bit my studies,
analysing the similarities
between firmware of Cybershots Cameras…….
If someone wants to send me as gifts some
sony cameras…no problems I will appreciate it
🙂

My data will be NOW based over DSCS70 and partially the DSC707.

I’m trying to convince my friend to let me
‘operate’ over his P12 ….but he’s worried
about my strange activities….

Firmwares setting of 707 or S70 are splitted
into 16 pages… from 00 to 10hex..

Here the first draft result of my initial analysis..

First of all remember one thing:
Some of Sony Camera Setting are Persistent
even if the Battery is disconnected..some not..

Exposure level is RAM based…disconnect the battery
and You will loose the setting…….

Photo Size Format is EEPROM based…disconnect the battery
and You will NOT loose the setting……….
FLASH ERROR and ARE….EEPROM BASED
;-)))

NOTE ONUSE OF THE EMULATOR VIA LANC
CABLE AND A PC IN DOS MODE

The RM95EMUL SOFTWARE is a very simple emulator…
Just 6 buttons and a a WRITE FUNCTION

A- Move ONE PAGE DOWN
S- Move ONE PAGE UP

D-Move one Address Down
F-Move one Address Up

G-One bit Decrement of pointed address(In RAM)
H-One bit Increment of pointed address(IN RAM)

W-Write current location value into EEPROM CAMERA

HERE THE FIRST DRAFT PAGE DESCRIPTION
————————————-
Page00
Master Registry Page.
Up to now the only relevant
address on this page is the address 01
If You set it to 1 all the other pages are unlocked.
If not You cannot set any registry.

Page01
This Page is LOCKED AN IS USED
FOR REPAIR ADJUSTING PURPOSES

Page02
THIS PAGE CONTAINS MOSTLY RAM UNPERSISTENT SETTING
LIKE AE Programs, Flash Levels,Exposure Levels etc etc.
Is probably not completely mirrored in any eeprom….take away the
battery and this page is almost completely re defaulted to standard
settings….

Page03
MOSTLY UN-USED

Page04
UNKNOW

Page05
TEST FUNCTIONS?,
on my S70 , address 1F
controls the generation of
color bar monitor,grey scale etc etc…

Page06
UNKNOW

Page07
HOT PAGE DO NOT TOUCH, IT CONTAINS
FACTORY CCD WHITEBLACK ERROR compensations

Page08
EMPTY PAGE

Page09
UNKNOW

Page0A
EMPTY PAGE

Page0B
UNKNOW

Page0C
EMPTY PAGE
Page0D
THIS PAGE CONTAINS MOSTLY EEPROM PERSISTENT SETTING
LIKE PHOTO FORMAT, MENU DEFINITIONS PHOTO NUMBERS etc etc.
I waswill publish some settings for this fundamental page…

Basically you can start to play with this page, with your camera
switched on. If Youdo not press ‘W’ the change of an address content
disappear when you move to a previous or next pageaddress.
Some of this page settings are xor checksum controlled…
For instance addresses 20 21 22 23 24 selects the photo size….

Page0E
UNKNOW

Page0F
THIS PAGE Contains LensShiutter Mechanism & Withe balancing
settings and is camera dependent,every camera has different values

A lot of work still to do….
;-))

See You Soon
KK
———————————————————————
———————————————————————

Third episode…

I’m quite happy.

My initial & main purpose was to
trow a stone in the sony camera swamp…
(Italian saying) without any illegal action.

I bought my camera and I
can do whatever damage I
want to her…. It’s mine !

I think this thing is happening,
and people are beginning to having fun
starting to think their cameras
have a…beatiful mind… somewhere….

I think also Sony services will have
potentially a lot of fun with
cameras with brain damages ;-)))))))

.
..
…
Seriously ,I’m enjoying a lot the
possibility to re-discover my camera,
thinking now it’s simply ..
a ‘Unique’ piece…

Now i’m shooting at 1/2000 in 1024×768
fitting 180 photos into a 64Mb MemStick
:-))))))))))))

Generally speaking..
I will try to build a little website
collecting all the info I will
get for a creating a personal
quick reference.

Thanks to people who sent me

707
717
V1
dumps..

Remember, these dumps are not the camera firmware,
but the registry set of the firmware , i.e. like
a sort of windows registry.

Sony V1 can upload the whole firmware,
via mstick, see the Sony supportWeb site.
(At your risk 😉

I will review them but I need some help and some
spare time on it ..and most important , someone
brave enough to try the setting modifications
on his own camera from mine, or someone that
will gift me some cameras ;-))))))))))))

I would like to get S75 S85 dumps also,
very similar to s70.

I still have to verify lanc connection
availability on Px series..

There are some future plans for moving
the current Lanc interface on a serial
Win32 compatible interface, using schemas
like that:
http://www.dreamvideo.it/elettronica/sch_lanc_2.htm,
but not for the immediate…

IMPORTANT!
For changingexperimenting registry values
you need possibly the service manual,
and a dos mode pc starting the stuff via
bootable dos diskette,
and not via dos emulation.

There is a program called dv-in lite
able to work with Win95 98 , but again,
the problem is the parallel connection,
timing, always a nightmare on xp , nt
without a dedicate driver…

Remember the fundamental rule of
MAKING A DUMP before thinking to
operate on the registries.

See you soon
KKPrince

———————————————-
———————————————-