CVS Camera Software Unlock

http://www.cexx.org/dakota/

The meddlers over at the camera hacking forum have been abusing our favorite CVS product once again. You can now unlock your single use digital camera without any hardware modes. Last week [Sailpix] discovered that Pure Digital had left their FTP server wide open. He found an interesting app on it and discovered the way the challenge/response keys were generated. It was only a matter of time before other hackers like [BillW] were able to use a little brute force and create a software app to generate the correct response keys. You can download the app here. BillW wrote it based entirely on Sailpix’s description of the algo, not the original code. App works for the type-04 camcorder as well.

[thanks [removed by request]]

UPDATE: CameraHacking.com has removed the original thread at Pure Digital’s request.

49 thoughts on “CVS Camera Software Unlock

  1. the cams are pretty damn nice, excellent color rendition but they lack the features of my nikon cam(but at 1 10th the price not on sale :D) fun lil cam though $20 for 30 pics(after mod)

  2. their thread gives a quick summary, but I’m somewhat concerned about full upload/download access on an unsecured ftp. if its not fixed soon, who know what will be left of it.

  3. if you get a camcorder now, you’re pretty much gauranteed to be able to get it open, but if you wait you might get a better cam and we may discover yet another way in. i’d say get the cam now since the increases in quality havn’t been terribly drastic.

    by the way we have the 04 type keys unlocked, but there is also a brute force effort going on to get the 03 type keys unlocked as well. check it out below and join us if you’re interested.
    http://camerahacks.10.forumer.com/viewtopic.php?t=3642&postdays=0&postorder=asc&start=0

  4. danadamkof- 20 minutes is the stock, though you can get lower quality video that lasts much longer

    all those doubting the legal status of this- trust me, billw, sailpix, and all the other fine hackers on camerahacking.com make sure that they don’t even mention anything that could possibly be illegal on the forum

    shadow- the actual cvs cameras you can only get at cvs stores. pure digital does however sell these cameras to ritz cameras, so check youre local phone book if there isnt a cvs nearby.

    mastershake- unless the process has changed since last summer, buy the camera, open it up, solder a usb cable (either female plug to camera, or just a male cable to camera) to the correct pins (diagrams on camerahacking.com), and use whatever software is out at the moment. unless its changed, the latest are at the pv2tools sourceforge project.

    carpespasm- nice to see you on hackaday X)

    disclaimer: im using what i remember from 8 or more months ago on this. check camerahacking.com for more, and guarenteed accurate, information.

  5. In response to furtim, but to everyone, CVS drugstores are pretty much across the country, at least I think. We have them in Michigan and I know I’ve seen them in Las Vegas, so they have to be out that way too.

  6. You can also change the resolution from 640×480 or whatever it is, to something higher and better but of course it will take up more memory space. The higher resolution the less recording time. 2 AA batteries, sweet knock around camera. I think if you use linux you can make it a real time web cam with the sourceforge tools. Billw you’re awsome. I owe you some money dude.

  7. I’ve seen a CVS pharmacy inside my local Rite Aid that was just built, and lo-and-behold, they carried both the still and video cameras! So if you can’t locate a CVS store nearby, you might still be in luck with a Rite Aid.

    *runs to buy some cameras*

  8. The brute force effort for the 03 challenge has came to an end. We can now unlock all cameras and all camcorders, with the exception of the rare M100 camcorder’s and the soon to be common M510 camera.

  9. you have to enter that url manually.. there’s some form of referrer lockout on it. if referrer != sourceforge or referrer != “” then bailout. copy-paste the url into the address bar, then hit enter.

    and of course our old friend prdownloads.sourceforge still has the file:
    http://prdownloads.sourceforge.net/pv2devkit/CronusKey-1.3.zip?download (click the link and choose your favourite sourceforge mirror)
    there’s also -1.1 and -1.2.zip if you want the old code too – mod the url in the obvious manner…

  10. There is nothing illegal about how this app was created. They broke no laws. Pure digital broadcast their information on the internet, and the challenge/response keys were broken by someone else who had never even touched the original code.
    for downloading the app, go to mysharebox dot com and get file ID 9939777

  11. thanks for posting the sourceforge mirror sites, nearly went in my pants seeing the posts removed from the camerahack site… didn’t download then because I’m @ work. been sitting on my cvs video cameras for a couple of months now hoping for something other than the short hack…

    also so is the process suppose to be use ops, then copy the key over to the camera? please help. you guys rock

  12. Sailpix and Billw did an excellent and, IMHO, completely legal job. Sailpix described the encryption used (rc2) and billw wrote a script that called openssl with the right command-line parameters. A perfect example of clean-room engineering.

  13. which camcorder model and which still camera models will this work on (theoretically of course). Will the still/and or camcorder stream video to your PC?

    CONSPIRACY THEORY ALERT: Could Pure Digital just have “accidentally” left their server unprotected to cause a run on older version products that were getting ready to be replaced by newer version products, as evidenced by the plug for their new camera? Not a bad way to move the old inventory, especially when they had proabbaly already changed the algorithim in the new version. Just a thought.

  14. i dont supppose anyone knows the location of a mirror for the “LegendsLineApp” do they? or perhaps somone that has it wouldnt mind emailing it to me at calgar (at) cybiko (dot) eu please

  15. That’s a very nice Ops/Cronus Key application that guy developed. Now if only we could get that to work with every camera from now on, instead of those from before August 2006….

  16. Does anyone know of a hardware-based solution for unlocking the fw 33.19 CVS cameras? I saw something like that on ebay, and wonder if it’s true or a scam. Also, is there a software solution for this – OPS .13 says no known method for unlocking.
    PS I just found this site and you guy are actually very impressive – there’s a lot of really cool thinking in a lot of this stuff – keep it up! aof10@usadatanet.net
    Thanks a lot!
    Matt

Leave a Reply to mastershake916Cancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.