The meddlers over at the camera hacking forum have been abusing our favorite CVS product once again. You can now unlock your single use digital camera without any hardware modes. Last week [Sailpix] discovered that Pure Digital had left their FTP server wide open. He found an interesting app on it and discovered the way the challenge/response keys were generated. It was only a matter of time before other hackers like [BillW] were able to use a little brute force and create a software app to generate the correct response keys. You can download the app here. BillW wrote it based entirely on Sailpix’s description of the algo, not the original code. App works for the type-04 camcorder as well.
[thanks [removed by request]]
UPDATE: CameraHacking.com has removed the original thread at Pure Digital’s request.
I might buy one of these now, what’s the quality?
Of course, it figures that the Red and Blue I had that I couldn’t get to easily work I tossed in the garbage about 3 weeks ago…
eliot, the summary says “BillW wrote it based entirely on Sailpix
the cams are pretty damn nice, excellent color rendition but they lack the features of my nikon cam(but at 1 10th the price not on sale :D) fun lil cam though $20 for 30 pics(after mod)
Yes, BillW makes a point to say:
“NOTE: this program was created by a chinese-wall reverse-engineering of the Legends application. My code was based solely on sailpix’s description of the algorithm, and I imagine it looks quite different from the real PD code.”
http://en.wikipedia.org/wiki/Chinese_wall
their thread gives a quick summary, but I’m somewhat concerned about full upload/download access on an unsecured ftp. if its not fixed soon, who know what will be left of it.
So does this mean we should all run out and buy one of these cameras now while we still can before they change the algorithm used in future cameras?
if you get a camcorder now, you’re pretty much gauranteed to be able to get it open, but if you wait you might get a better cam and we may discover yet another way in. i’d say get the cam now since the increases in quality havn’t been terribly drastic.
by the way we have the 04 type keys unlocked, but there is also a brute force effort going on to get the 03 type keys unlocked as well. check it out below and join us if you’re interested.
http://camerahacks.10.forumer.com/viewtopic.php?t=3642&postdays=0&postorder=asc&start=0
Sorry if I’m being a n00b, but once I buy one, what do I do to unlock it?
Time to buy another cvs camcorder. I was bummed that I only got one last time but it looks like I get another chance.
Also, does this work on all versions?
Anyone know where they sell these cameras/camcorders? I’ve been checking my local Walmart and Fred Meyers but haven’t had any luck.
After hacking these, how many minutes of video can they typically store?
shadow, CVS is a separate chain of drug stores. I think it might be only an East Coast thing, but I’m not sure. If all else fails, I wouldn’t be surprised if somebody has these on eBay.
danadamkof- 20 minutes is the stock, though you can get lower quality video that lasts much longer
all those doubting the legal status of this- trust me, billw, sailpix, and all the other fine hackers on camerahacking.com make sure that they don’t even mention anything that could possibly be illegal on the forum
shadow- the actual cvs cameras you can only get at cvs stores. pure digital does however sell these cameras to ritz cameras, so check youre local phone book if there isnt a cvs nearby.
mastershake- unless the process has changed since last summer, buy the camera, open it up, solder a usb cable (either female plug to camera, or just a male cable to camera) to the correct pins (diagrams on camerahacking.com), and use whatever software is out at the moment. unless its changed, the latest are at the pv2tools sourceforge project.
carpespasm- nice to see you on hackaday X)
disclaimer: im using what i remember from 8 or more months ago on this. check camerahacking.com for more, and guarenteed accurate, information.
master shake its ok ur not a noob just a dick head LOVE STEVE
In response to furtim, but to everyone, CVS drugstores are pretty much across the country, at least I think. We have them in Michigan and I know I’ve seen them in Las Vegas, so they have to be out that way too.
You can also change the resolution from 640×480 or whatever it is, to something higher and better but of course it will take up more memory space. The higher resolution the less recording time. 2 AA batteries, sweet knock around camera. I think if you use linux you can make it a real time web cam with the sourceforge tools. Billw you’re awsome. I owe you some money dude.
Sour grapes steve sour grapes, no one on here like you or you crappy little comments.
With a CVS just down the street I may have to pick up one.
I’ve seen a CVS pharmacy inside my local Rite Aid that was just built, and lo-and-behold, they carried both the still and video cameras! So if you can’t locate a CVS store nearby, you might still be in luck with a Rite Aid.
*runs to buy some cameras*
The brute force effort for the 03 challenge has came to an end. We can now unlock all cameras and all camcorders, with the exception of the rare M100 camcorder’s and the soon to be common M510 camera.
admins, please delete this topic, at puredigital’s request
No.
the nice guys at HEANET still have the cronuskey app online for anyone that wants it:
http://heanet.dl.sourceforge.net/sourceforge/pv2devkit/
god bless sourceforge mirror sites!
no they dont
you have to enter that url manually.. there’s some form of referrer lockout on it. if referrer != sourceforge or referrer != “” then bailout. copy-paste the url into the address bar, then hit enter.
and of course our old friend prdownloads.sourceforge still has the file:
http://prdownloads.sourceforge.net/pv2devkit/CronusKey-1.3.zip?download (click the link and choose your favourite sourceforge mirror)
there’s also -1.1 and -1.2.zip if you want the old code too – mod the url in the obvious manner…
There is nothing illegal about how this app was created. They broke no laws. Pure digital broadcast their information on the internet, and the challenge/response keys were broken by someone else who had never even touched the original code.
for downloading the app, go to mysharebox dot com and get file ID 9939777
#28
wow! what a nice little random generator… wow!!! what do ya know, if I use it on my camera, it unlocks it… what a coincidence :P
But the download appears to be corrupt… at least on this machine :p
digitalpure: that file’s corrupted…
btw, i’d love to get my hands on one or two of the cameras/camcorders to play with, but i’m a few thousand miles away from the nearest CVS.. if anyone feels like parting with one, please contact zerofox@castlecore.com.
does anyone know where to downloasd the files now?
thanks for posting the sourceforge mirror sites, nearly went in my pants seeing the posts removed from the camerahack site… didn’t download then because I’m @ work. been sitting on my cvs video cameras for a couple of months now hoping for something other than the short hack…
also so is the process suppose to be use ops, then copy the key over to the camera? please help. you guys rock
rapidshare.de/files/27028138/CronusKey-1.3.zip.html
http://prdownloads.sourceforge.net/pv2devkit/CronusKey-1.3.zip?download
^the dl link again (copy and paste it to address bar)
This is awesome, I’ll have to pull mine out, I did the hack forever ago when the first one came out, then I kinda forgot about it.
Sailpix and Billw did an excellent and, IMHO, completely legal job. Sailpix described the encryption used (rc2) and billw wrote a script that called openssl with the right command-line parameters. A perfect example of clean-room engineering.
anyone got a copy of that website before it was pulled? i’m not trying to do anything illegal, i just want to read it.
which camcorder model and which still camera models will this work on (theoretically of course). Will the still/and or camcorder stream video to your PC?
CONSPIRACY THEORY ALERT: Could Pure Digital just have “accidentally” left their server unprotected to cause a run on older version products that were getting ready to be replaced by newer version products, as evidenced by the plug for their new camera? Not a bad way to move the old inventory, especially when they had proabbaly already changed the algorithim in the new version. Just a thought.
remove all the old inventory and the group who is hacking them too :-0
wait a second….
CONSPIRACY!!!!
lol
What happened was that someone left a secruity hole in their server open and some of the guys over at camerahacking forums got in there. Pure Digital then left a message in the forums asking carpespasm and the others to stop releasing the program used to unlock the camcorders to the public.
http://camerahacks.10.forumer.com/viewtopic.php?p=30305&highlight=#30305
i dont supppose anyone knows the location of a mirror for the “LegendsLineApp” do they? or perhaps somone that has it wouldnt mind emailing it to me at calgar (at) cybiko (dot) eu please
i keep searching the web to buy that camera and i cant find it anywhere on the net. not eBay not Froogle anywhere, please direct me to a site where i can buy it online. Thank
halfon123@gmail.com
whats sad is the ftp is still open i checked its kinda sad
Send me a link or the file itself please:
reckel02@gmail.com
thanks
CronusKey-1.3.zip
This site has cronuskey 1.1, 1.3, and instructions!
http://freelowell.com/downloads/camcorderpage/Camerahacking.html
All files are mirrored here, along with a howto. Hack away!
That’s a very nice Ops/Cronus Key application that guy developed. Now if only we could get that to work with every camera from now on, instead of those from before August 2006….
Does anyone know of a hardware-based solution for unlocking the fw 33.19 CVS cameras? I saw something like that on ebay, and wonder if it’s true or a scam. Also, is there a software solution for this – OPS .13 says no known method for unlocking.
PS I just found this site and you guy are actually very impressive – there’s a lot of really cool thinking in a lot of this stuff – keep it up! aof10@usadatanet.net
Thanks a lot!
Matt
China’s hackers had some nuts to attempt to hack Google. I know that we will be able to prevent additional infilatrations.
I need to know where I can take my cvs camcorder to get put on dvd I went into store they said they don’t do it so can someone please help me