CVS camera software unlock

posted Jul 24th 2006 12:15am by Eliot Phillips
filed under: digital cameras hacks

The meddlers over at the camera hacking forum have been abusing our favorite CVS product once again. You can now unlock your single use digital camera without any hardware modes. Last week [Sailpix] discovered that Pure Digital had left their FTP server wide open. He found an interesting app on it and discovered the way the challenge/response keys were generated. It was only a matter of time before other hackers like [BillW] were able to use a little brute force and create a software app to generate the correct response keys. You can download the app here. BillW wrote it based entirely on Sailpix’s description of the algo, not the original code. App works for the type-04 camcorder as well.

[thanks [removed by request]]

UPDATE: CameraHacking.com has removed the original thread at Pure Digital’s request.

Read

Comments [48]

Reader Comments

I might buy one of these now, what’s the quality?

Posted at 12:49 am on Jul 24th, 2006 by mastershake916

Of course, it figures that the Red and Blue I had that I couldn’t get to easily work I tossed in the garbage about 3 weeks ago…

Posted at 1:27 am on Jul 24th, 2006 by jc

eliot, the summary says “BillW wrote it based entirely on Sailpix

Posted at 1:30 am on Jul 24th, 2006 by steve

the cams are pretty damn nice, excellent color rendition but they lack the features of my nikon cam(but at 1 10th the price not on sale :D) fun lil cam though $20 for 30 pics(after mod)

Posted at 1:35 am on Jul 24th, 2006 by Frogz

Yes, BillW makes a point to say:

“NOTE: this program was created by a chinese-wall reverse-engineering of the Legends application. My code was based solely on sailpix’s description of the algorithm, and I imagine it looks quite different from the real PD code.”

http://en.wikipedia.org/wiki/Chinese_wall

Posted at 1:35 am on Jul 24th, 2006 by Eliot Phillips

their thread gives a quick summary, but I’m somewhat concerned about full upload/download access on an unsecured ftp. if its not fixed soon, who know what will be left of it.

Posted at 1:42 am on Jul 24th, 2006 by Hotice

So does this mean we should all run out and buy one of these cameras now while we still can before they change the algorithm used in future cameras?

Posted at 1:48 am on Jul 24th, 2006 by Christopher

if you get a camcorder now, you’re pretty much gauranteed to be able to get it open, but if you wait you might get a better cam and we may discover yet another way in. i’d say get the cam now since the increases in quality havn’t been terribly drastic.

by the way we have the 04 type keys unlocked, but there is also a brute force effort going on to get the 03 type keys unlocked as well. check it out below and join us if you’re interested.
http://camerahacks.10.forumer.com/viewtopic.php?t=3642&postdays=0&postorder=asc&start=0

Posted at 2:46 am on Jul 24th, 2006 by carpespasm

Sorry if I’m being a n00b, but once I buy one, what do I do to unlock it?

Posted at 3:17 am on Jul 24th, 2006 by mastershake916

Time to buy another cvs camcorder. I was bummed that I only got one last time but it looks like I get another chance.

Posted at 4:10 am on Jul 24th, 2006 by hcker2000

Also, does this work on all versions?

Posted at 4:52 am on Jul 24th, 2006 by mastershake916

Anyone know where they sell these cameras/camcorders? I’ve been checking my local Walmart and Fred Meyers but haven’t had any luck.

Posted at 5:21 am on Jul 24th, 2006 by Shadow

After hacking these, how many minutes of video can they typically store?

Posted at 5:45 am on Jul 24th, 2006 by DanAdamKOF

shadow, CVS is a separate chain of drug stores. I think it might be only an East Coast thing, but I’m not sure. If all else fails, I wouldn’t be surprised if somebody has these on eBay.

Posted at 7:04 am on Jul 24th, 2006 by furtim

danadamkof- 20 minutes is the stock, though you can get lower quality video that lasts much longer

all those doubting the legal status of this- trust me, billw, sailpix, and all the other fine hackers on camerahacking.com make sure that they don’t even mention anything that could possibly be illegal on the forum

shadow- the actual cvs cameras you can only get at cvs stores. pure digital does however sell these cameras to ritz cameras, so check youre local phone book if there isnt a cvs nearby.

mastershake- unless the process has changed since last summer, buy the camera, open it up, solder a usb cable (either female plug to camera, or just a male cable to camera) to the correct pins (diagrams on camerahacking.com), and use whatever software is out at the moment. unless its changed, the latest are at the pv2tools sourceforge project.

carpespasm- nice to see you on hackaday X)

disclaimer: im using what i remember from 8 or more months ago on this. check camerahacking.com for more, and guarenteed accurate, information.

Posted at 7:05 am on Jul 24th, 2006 by maicroDrop

master shake its ok ur not a noob just a dick head LOVE STEVE

Posted at 2:47 pm on Jul 24th, 2006 by steve

In response to furtim, but to everyone, CVS drugstores are pretty much across the country, at least I think. We have them in Michigan and I know I’ve seen them in Las Vegas, so they have to be out that way too.

Posted at 3:45 pm on Jul 24th, 2006 by AndrewNeo

You can also change the resolution from 640×480 or whatever it is, to something higher and better but of course it will take up more memory space. The higher resolution the less recording time. 2 AA batteries, sweet knock around camera. I think if you use linux you can make it a real time web cam with the sourceforge tools. Billw you’re awsome. I owe you some money dude.

Posted at 5:03 pm on Jul 24th, 2006 by steve hendrix

Sour grapes steve sour grapes, no one on here like you or you crappy little comments.

Posted at 6:12 pm on Jul 24th, 2006 by mastershake916

With a CVS just down the street I may have to pick up one.

Posted at 8:05 pm on Jul 24th, 2006 by BloatedBunny

I’ve seen a CVS pharmacy inside my local Rite Aid that was just built, and lo-and-behold, they carried both the still and video cameras! So if you can’t locate a CVS store nearby, you might still be in luck with a Rite Aid.

*runs to buy some cameras*

Posted at 8:54 pm on Jul 24th, 2006 by oneiric_prophecy

The brute force effort for the 03 challenge has came to an end. We can now unlock all cameras and all camcorders, with the exception of the rare M100 camcorder’s and the soon to be common M510 camera.

Posted at 11:53 pm on Jul 24th, 2006 by CamCam

admins, please delete this topic, at puredigital’s request

Posted at 4:38 pm on Jul 25th, 2006 by Duggasco

No.

Posted at 4:40 pm on Jul 25th, 2006 by Eliot Phillips

the nice guys at HEANET still have the cronuskey app online for anyone that wants it:
http://heanet.dl.sourceforge.net/sourceforge/pv2devkit/
god bless sourceforge mirror sites!

Posted at 5:21 pm on Jul 25th, 2006 by zerofox

no they dont

Posted at 5:40 pm on Jul 25th, 2006 by Duggasco

you have to enter that url manually.. there’s some form of referrer lockout on it. if referrer != sourceforge or referrer != “” then bailout. copy-paste the url into the address bar, then hit enter.

and of course our old friend prdownloads.sourceforge still has the file:
http://prdownloads.sourceforge.net/pv2devkit/CronusKey-1.3.zip?download (click the link and choose your favourite sourceforge mirror)
there’s also -1.1 and -1.2.zip if you want the old code too – mod the url in the obvious manner…

Posted at 6:22 pm on Jul 25th, 2006 by zerofox

There is nothing illegal about how this app was created. They broke no laws. Pure digital broadcast their information on the internet, and the challenge/response keys were broken by someone else who had never even touched the original code.
for downloading the app, go to mysharebox dot com and get file ID 9939777

Posted at 6:28 pm on Jul 25th, 2006 by digitalpure

#28
wow! what a nice little random generator… wow!!! what do ya know, if I use it on my camera, it unlocks it… what a coincidence :P

But the download appears to be corrupt… at least on this machine :p

Posted at 7:07 pm on Jul 25th, 2006 by trebuchet03

digitalpure: that file’s corrupted…
btw, i’d love to get my hands on one or two of the cameras/camcorders to play with, but i’m a few thousand miles away from the nearest CVS.. if anyone feels like parting with one, please contact zerofox@castlecore.com.

Posted at 7:08 pm on Jul 25th, 2006 by zerofox

does anyone know where to downloasd the files now?

Posted at 7:41 pm on Jul 25th, 2006 by chris

thanks for posting the sourceforge mirror sites, nearly went in my pants seeing the posts removed from the camerahack site… didn’t download then because I’m @ work. been sitting on my cvs video cameras for a couple of months now hoping for something other than the short hack…

also so is the process suppose to be use ops, then copy the key over to the camera? please help. you guys rock

Posted at 8:21 pm on Jul 25th, 2006 by djericho

rapidshare.de/files/27028138/CronusKey-1.3.zip.html

Posted at 8:55 pm on Jul 25th, 2006 by digitalpure

http://prdownloads.sourceforge.net/pv2devkit/CronusKey-1.3.zip?download
^the dl link again (copy and paste it to address bar)

This is awesome, I’ll have to pull mine out, I did the hack forever ago when the first one came out, then I kinda forgot about it.

Posted at 8:56 pm on Jul 25th, 2006 by tired2

Sailpix and Billw did an excellent and, IMHO, completely legal job. Sailpix described the encryption used (rc2) and billw wrote a script that called openssl with the right command-line parameters. A perfect example of clean-room engineering.

Posted at 1:04 am on Jul 27th, 2006 by morcheeba

anyone got a copy of that website before it was pulled? i’m not trying to do anything illegal, i just want to read it.

Posted at 1:36 am on Jul 27th, 2006 by james

which camcorder model and which still camera models will this work on (theoretically of course). Will the still/and or camcorder stream video to your PC?

CONSPIRACY THEORY ALERT: Could Pure Digital just have “accidentally” left their server unprotected to cause a run on older version products that were getting ready to be replaced by newer version products, as evidenced by the plug for their new camera? Not a bad way to move the old inventory, especially when they had proabbaly already changed the algorithim in the new version. Just a thought.

Posted at 3:40 pm on Jul 28th, 2006 by sTANMAN

remove all the old inventory and the group who is hacking them too :-0
wait a second….
CONSPIRACY!!!!

lol

Posted at 12:14 am on Jul 29th, 2006 by duggasco

What happened was that someone left a secruity hole in their server open and some of the guys over at camerahacking forums got in there. Pure Digital then left a message in the forums asking carpespasm and the others to stop releasing the program used to unlock the camcorders to the public.

http://camerahacks.10.forumer.com/viewtopic.php?p=30305&highlight=#30305

Posted at 10:05 pm on Jul 30th, 2006 by Ninja_Ray

i dont supppose anyone knows the location of a mirror for the “LegendsLineApp” do they? or perhaps somone that has it wouldnt mind emailing it to me at calgar (at) cybiko (dot) eu please

Posted at 11:35 am on Jul 31st, 2006 by calgar

i keep searching the web to buy that camera and i cant find it anywhere on the net. not eBay not Froogle anywhere, please direct me to a site where i can buy it online. Thank
halfon123@gmail.com

Posted at 12:46 pm on Jul 31st, 2006 by Randor

whats sad is the ftp is still open i checked its kinda sad

Posted at 10:17 pm on Aug 3rd, 2006 by justin

Send me a link or the file itself please:
reckel02@gmail.com

thanks

Posted at 2:15 am on Aug 4th, 2006 by Ginsu

CronusKey-1.3.zip

This site has cronuskey 1.1, 1.3, and instructions!

Posted at 6:53 pm on Aug 6th, 2006 by Jim

http://freelowell.com/downloads/camcorderpage/Camerahacking.html

All files are mirrored here, along with a howto. Hack away!

Posted at 6:57 pm on Aug 6th, 2006 by Alternate file source

That’s a very nice Ops/Cronus Key application that guy developed. Now if only we could get that to work with every camera from now on, instead of those from before August 2006….

Posted at 9:34 pm on Aug 9th, 2006 by Ninja_Ray

Does anyone know of a hardware-based solution for unlocking the fw 33.19 CVS cameras? I saw something like that on ebay, and wonder if it’s true or a scam. Also, is there a software solution for this – OPS .13 says no known method for unlocking.
PS I just found this site and you guy are actually very impressive – there’s a lot of really cool thinking in a lot of this stuff – keep it up! aof10@usadatanet.net
Thanks a lot!
Matt

Posted at 4:07 am on Aug 17th, 2006 by Matt

China’s hackers had some nuts to attempt to hack Google. I know that we will be able to prevent additional infilatrations.

Posted at 2:53 pm on Feb 5th, 2010 by after pregnancy weight loss