This article concludes the experiment made with my camera in order to remove the timestamp. After one week of work, described here [teardown and hacking gumpack camera], I managed to get a solution to completely remove the insertion of the timestamp in theses 808 micro camera. The method described here requires you to have good (de-)soldering skills and appropriate tools. I use a home made circuit with a programmed Atmel AVR micro-controller to extract and reprogram the camera firmware. The standard disclaimer applies here. If you burn your camera, hurt yourself, or anything else : it’s not my fault! I applied this method to my camera, and put it here for you to take advantage of it. You are doing it at your own risk.

Procedure

In order to remove the timestamp from you camera, you have to follow theses steps:

  1. Desolder the flash chip from you camera
  2. Connect it to a spi reader-writer (this article explains how to build your own)
  3. Dump the firmware to your computer
  4. Hack the firmware to remove the font
  5. Flash the hacked firmware to the flash chip
  6. re-solder the flash chip on the camera
  7. Enjoy !

SPI reader-writer

I made my own tool to be able to dump the flash memory through it’s SPI port. I used a board I had on the table with a RS232 connection to my PC. Many AVR could suit your needs. It just need to have an hardware serial port and a few IOs to connect to the flash memory. Mine is a AT90S2313 (yes, an old one 🙂 ). The recent ones like ATMEGA88 will be perfect. I suppose you have some knowledge of AVR µC and you are able get a board. Maybe the Arduino could work, but I don’t have one to test.

You’ll have to connect the pins CLK/DI/DO/CS between the flash memory and the AVR. Don’t forget to configure src/hardware.h to select the correct pins. Configure here also the CPU frequency and the UART baud rate. You should apply 3.3V to VCC, and the ground to VSS. The pin WP# should be high, and the pin HOLD# also. Be careful, the pin DO for the flash should be connected to DI of the AVR and vice-versa.

The AVR soft should be compiled with avr-gcc, or winavr. Edit the Makefile and set the variables at the top of the file to configure your target. The PC connects to the AVR with it’s serial port. Make sure the configuration of the pins are correct.

PC software

Hopefully you managed to build, flash and connect your AVR board to your computer. You should now launch the PC software and test if all is working. The soft is in tools/ and is called spi_reader_writer.py. It is written in python, and I only tested it on Linux, but should also work on Windows, provided you have installed the pyserial library. You can first check the size of the memory:

$ ./spi_reader_writer.py check_size

You can select the communication port with the option –port. Then dump the memory. The process last roughly 10 minutes, so be patient !

$ ./spi_reader_writer.py read my_camera_firmware.raw

Now you can use the tool that remove the font from the firmware. It produces a extract of the firmware is a file called [0x138000-0x13d000_no_font.raw]

$ ./hack_firmware.py my_camera_firmware.raw

Reprogram this part to the flash memory:

$ tools/spi_reader_writer.py write_at 0x138000 0x138000-0x13d000_no_font.raw

Here is the archive :
spi_reader-v0.2.1.tar.bz2 (34KB)

Please post a comment if it was useful for you 😉