CVS camera software unlock

The meddlers over at the camera hacking forum have been abusing our favorite CVS product once again. You can now unlock your single use digital camera without any hardware modes. Last week [Sailpix] discovered that Pure Digital had left their FTP server wide open. He found an interesting app on it and discovered the way the challenge/response keys were generated. It was only a matter of time before other hackers like [BillW] were able to use a little brute force and create a software app to generate the correct response keys. You can download the app here. BillW wrote it based entirely on Sailpix’s description of the algo, not the original code. App works for the type-04 camcorder as well.

[thanks [removed by request]]

UPDATE: has removed the original thread at Pure Digital’s request.


  1. I might buy one of these now, what’s the quality?

  2. jc says:

    Of course, it figures that the Red and Blue I had that I couldn’t get to easily work I tossed in the garbage about 3 weeks ago…

  3. steve says:

    eliot, the summary says “BillW wrote it based entirely on Sailpix

  4. Frogz says:

    the cams are pretty damn nice, excellent color rendition but they lack the features of my nikon cam(but at 1 10th the price not on sale :D) fun lil cam though $20 for 30 pics(after mod)

  5. Yes, BillW makes a point to say:

    “NOTE: this program was created by a chinese-wall reverse-engineering of the Legends application. My code was based solely on sailpix’s description of the algorithm, and I imagine it looks quite different from the real PD code.”

  6. Hotice says:

    their thread gives a quick summary, but I’m somewhat concerned about full upload/download access on an unsecured ftp. if its not fixed soon, who know what will be left of it.

  7. Christopher says:

    So does this mean we should all run out and buy one of these cameras now while we still can before they change the algorithm used in future cameras?

  8. carpespasm says:

    if you get a camcorder now, you’re pretty much gauranteed to be able to get it open, but if you wait you might get a better cam and we may discover yet another way in. i’d say get the cam now since the increases in quality havn’t been terribly drastic.

    by the way we have the 04 type keys unlocked, but there is also a brute force effort going on to get the 03 type keys unlocked as well. check it out below and join us if you’re interested.

  9. Sorry if I’m being a n00b, but once I buy one, what do I do to unlock it?

  10. hcker2000 says:

    Time to buy another cvs camcorder. I was bummed that I only got one last time but it looks like I get another chance.

  11. Also, does this work on all versions?

  12. Shadow says:

    Anyone know where they sell these cameras/camcorders? I’ve been checking my local Walmart and Fred Meyers but haven’t had any luck.

  13. DanAdamKOF says:

    After hacking these, how many minutes of video can they typically store?

  14. furtim says:

    shadow, CVS is a separate chain of drug stores. I think it might be only an East Coast thing, but I’m not sure. If all else fails, I wouldn’t be surprised if somebody has these on eBay.

  15. maicroDrop says:

    danadamkof- 20 minutes is the stock, though you can get lower quality video that lasts much longer

    all those doubting the legal status of this- trust me, billw, sailpix, and all the other fine hackers on make sure that they don’t even mention anything that could possibly be illegal on the forum

    shadow- the actual cvs cameras you can only get at cvs stores. pure digital does however sell these cameras to ritz cameras, so check youre local phone book if there isnt a cvs nearby.

    mastershake- unless the process has changed since last summer, buy the camera, open it up, solder a usb cable (either female plug to camera, or just a male cable to camera) to the correct pins (diagrams on, and use whatever software is out at the moment. unless its changed, the latest are at the pv2tools sourceforge project.

    carpespasm- nice to see you on hackaday X)

    disclaimer: im using what i remember from 8 or more months ago on this. check for more, and guarenteed accurate, information.

  16. steve says:

    master shake its ok ur not a noob just a dick head LOVE STEVE

  17. AndrewNeo says:

    In response to furtim, but to everyone, CVS drugstores are pretty much across the country, at least I think. We have them in Michigan and I know I’ve seen them in Las Vegas, so they have to be out that way too.

  18. steve hendrix says:

    You can also change the resolution from 640×480 or whatever it is, to something higher and better but of course it will take up more memory space. The higher resolution the less recording time. 2 AA batteries, sweet knock around camera. I think if you use linux you can make it a real time web cam with the sourceforge tools. Billw you’re awsome. I owe you some money dude.

  19. Sour grapes steve sour grapes, no one on here like you or you crappy little comments.

  20. BloatedBunny says:

    With a CVS just down the street I may have to pick up one.

  21. oneiric_prophecy says:

    I’ve seen a CVS pharmacy inside my local Rite Aid that was just built, and lo-and-behold, they carried both the still and video cameras! So if you can’t locate a CVS store nearby, you might still be in luck with a Rite Aid.

    *runs to buy some cameras*

  22. CamCam says:

    The brute force effort for the 03 challenge has came to an end. We can now unlock all cameras and all camcorders, with the exception of the rare M100 camcorder’s and the soon to be common M510 camera.

  23. Duggasco says:

    admins, please delete this topic, at puredigital’s request

  24. No.

  25. zerofox says:

    the nice guys at HEANET still have the cronuskey app online for anyone that wants it:

    god bless sourceforge mirror sites!

  26. Duggasco says:

    no they dont

  27. zerofox says:

    you have to enter that url manually.. there’s some form of referrer lockout on it. if referrer != sourceforge or referrer != “” then bailout. copy-paste the url into the address bar, then hit enter.

    and of course our old friend prdownloads.sourceforge still has the file: (click the link and choose your favourite sourceforge mirror)
    there’s also -1.1 and if you want the old code too – mod the url in the obvious manner…

  28. digitalpure says:

    There is nothing illegal about how this app was created. They broke no laws. Pure digital broadcast their information on the internet, and the challenge/response keys were broken by someone else who had never even touched the original code.
    for downloading the app, go to mysharebox dot com and get file ID 9939777

  29. trebuchet03 says:

    wow! what a nice little random generator… wow!!! what do ya know, if I use it on my camera, it unlocks it… what a coincidence :P

    But the download appears to be corrupt… at least on this machine :p

  30. zerofox says:

    digitalpure: that file’s corrupted…
    btw, i’d love to get my hands on one or two of the cameras/camcorders to play with, but i’m a few thousand miles away from the nearest CVS.. if anyone feels like parting with one, please contact

  31. chris says:

    does anyone know where to downloasd the files now?

  32. djericho says:

    thanks for posting the sourceforge mirror sites, nearly went in my pants seeing the posts removed from the camerahack site… didn’t download then because I’m @ work. been sitting on my cvs video cameras for a couple of months now hoping for something other than the short hack…

    also so is the process suppose to be use ops, then copy the key over to the camera? please help. you guys rock

  33. digitalpure says:

  34. tired2 says:

    ^the dl link again (copy and paste it to address bar)

    This is awesome, I’ll have to pull mine out, I did the hack forever ago when the first one came out, then I kinda forgot about it.

  35. morcheeba says:

    Sailpix and Billw did an excellent and, IMHO, completely legal job. Sailpix described the encryption used (rc2) and billw wrote a script that called openssl with the right command-line parameters. A perfect example of clean-room engineering.

  36. james says:

    anyone got a copy of that website before it was pulled? i’m not trying to do anything illegal, i just want to read it.

  37. sTANMAN says:

    which camcorder model and which still camera models will this work on (theoretically of course). Will the still/and or camcorder stream video to your PC?

    CONSPIRACY THEORY ALERT: Could Pure Digital just have “accidentally” left their server unprotected to cause a run on older version products that were getting ready to be replaced by newer version products, as evidenced by the plug for their new camera? Not a bad way to move the old inventory, especially when they had proabbaly already changed the algorithim in the new version. Just a thought.

  38. duggasco says:

    remove all the old inventory and the group who is hacking them too :-0
    wait a second….


  39. Ninja_Ray says:

    What happened was that someone left a secruity hole in their server open and some of the guys over at camerahacking forums got in there. Pure Digital then left a message in the forums asking carpespasm and the others to stop releasing the program used to unlock the camcorders to the public.

  40. calgar says:

    i dont supppose anyone knows the location of a mirror for the “LegendsLineApp” do they? or perhaps somone that has it wouldnt mind emailing it to me at calgar (at) cybiko (dot) eu please

  41. Randor says:

    i keep searching the web to buy that camera and i cant find it anywhere on the net. not eBay not Froogle anywhere, please direct me to a site where i can buy it online. Thank

  42. justin says:

    whats sad is the ftp is still open i checked its kinda sad

  43. Ginsu says:

    Send me a link or the file itself please:


  44. Jim says:

    This site has cronuskey 1.1, 1.3, and instructions!


    All files are mirrored here, along with a howto. Hack away!

  46. Ninja_Ray says:

    That’s a very nice Ops/Cronus Key application that guy developed. Now if only we could get that to work with every camera from now on, instead of those from before August 2006….

  47. Matt says:

    Does anyone know of a hardware-based solution for unlocking the fw 33.19 CVS cameras? I saw something like that on ebay, and wonder if it’s true or a scam. Also, is there a software solution for this – OPS .13 says no known method for unlocking.
    PS I just found this site and you guy are actually very impressive – there’s a lot of really cool thinking in a lot of this stuff – keep it up!
    Thanks a lot!

  48. China’s hackers had some nuts to attempt to hack Google. I know that we will be able to prevent additional infilatrations.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


Get every new post delivered to your Inbox.

Join 96,380 other followers