Page 3 of 3 FirstFirst 123
Results 51 to 72 of 72

Thread: Canon xha1s hack

  1. #51

    Default

    Quote Originally Posted by nxb View Post
    Then this thing can just be copied.
    The tape does not appear to display a copyright notice, however, copying would probably require specialized equipment. I wonder if one 60 minute tape could be cut into pieces to make 60 one minute tapes?

  2. #52
    Forum Mogul nxb's Avatar
    Join Date
    Nov 2008
    Posts
    653

    Default

    Why specialized equipment? Just find/make a program that captures raw data from the tape.

  3. #53
    Junior Member
    Join Date
    Dec 2009
    Posts
    28

    Default

    As you see there are gold contacts. If i close em servise menu is not accessable. So the thing in on this contacs or in mix of tape and contacs.

  4. #54
    Emperor of Rep Seo's Avatar
    Join Date
    Jun 2009
    Location
    Cupertino, California
    Posts
    2,641

    Default

    It's only logical that Canon would make some sort of copy protection...

    So you can't copy it. Where'd you get it again?

  5. #55

    Default

    hello rz77! how are you? and how is everything?

    I just want to ask kindly is it possible to make a copy of that tape? I know such software that is able to extract data (literally) from a tape and vice-versa

    If that is the problem, then maybe i can help you with that? Would like to hear back though!

  6. #56
    HV20.com's Resident Hacker
    Join Date
    Dec 2008
    Location
    Canada
    Posts
    578

    Default

    I think the mechanism to switch to service mode is all due to the logic behind the contacts, and not in the tape.

    What I mean is that the contacts are likely connected to some logic that respond in a specific way to the camera when the camera tries to read data out of the chip in the tape.

    The tape itself likely contains predefined known signals that can be used to adjust the camera sensors and parameters.

    If we get one of those tapes we can duplicate it by reading the communication signals that go through the gold contact points.

    Jolly

  7. #57

    Default

    Now your talking, this may open some new doors for A1's and the hv30. I dont think this guy is coming back any time soon though. anyone know his email address?
    I'm feeling frisky!

  8. #58
    HD Shorts Moderator Shigeta's Avatar
    Join Date
    Oct 2009
    Posts
    2,148

    Default

    I see this guy on regularly. Anyone wanna shot him a PM?

  9. #59
    Dr. T's Avatar
    Join Date
    Dec 2009
    Location
    Long Island
    Posts
    175

    Default

    Is anybody else getting a creepy X-Files conspiracy vibe from this thread? He probably hasn't come back because Canon has found and silenced him.

  10. #60
    HV20.com's Resident Hacker
    Join Date
    Dec 2008
    Location
    Canada
    Posts
    578

    Default

    After looking at the DV standard it is clear that the contacts on the tape lead to a serial EEPROM which implements the i2c standard.

    What this means is that on tape insert the camera probably polls the tape memory using the i2c bus and if the tape EEPROM contains a specific set of values the service mode is activated.

    Reading the i2c bus is very easy, so if we can get one tape we should be able to intercept the communication between the camera and the tape (as we know the protocol) and then duplicate its behavior.

  11. #61
    Junior Member
    Join Date
    Dec 2009
    Posts
    28

    Default

    May be you right, may be not. Service engeneer from our tv said me that the entrance to service menu is mix of contacts an signals from tape. Besides he said about different camcorder, not canon.

  12. #62
    HV20.com's Resident Hacker
    Join Date
    Dec 2008
    Location
    Canada
    Posts
    578

    Default

    I understand, this is good to know and maybe the service engineer is right, but the only way of knowing for sure is to analyze the tape... tracing the signals from the i2c bus is obviously possible, recording the content of the tape should also be possible, so we might be able to "copy" the service tape.

    Could you please tell us where did you buy the HL service manual and the service tape? As you know we are looking for the tape, and as you say the XL service manual helped you navigate the service mode menu more than with the HVXX service manual, so it would be great if you could help us finding both.

    Thanks!
    Last edited by jollyrogerxp; 2010 February 23rd at 09:53.

  13. #63
    Forum Mogul nxb's Avatar
    Join Date
    Nov 2008
    Posts
    653

    Default

    Cleaning tapes must have an eeprom too since they have gold contacts.

  14. #64
    HV20.com's Resident Hacker
    Join Date
    Dec 2008
    Location
    Canada
    Posts
    578

    Default

    Very likely the cleaning tape has an EEPROM to count the number of times it has been used, and inform the user accordingly...

  15. #65
    Tropical Legend cgbier's Avatar
    Join Date
    Jul 2009
    Location
    Saipan, USA
    Posts
    12,086

    Default

    Can the HV even read/write data on the EEPROM? Thought this was another "pro" feature!?!
    "It is dark the other side. Very dark!" - "Oh, shut up and eat your toast!"

  16. #66
    HV20.com's Resident Hacker
    Join Date
    Dec 2008
    Location
    Canada
    Posts
    578

    Default

    The DV standard has a chapter on MIC, and in theory most of the DV equipment has the hardware to read/write the EEPROMs.

  17. #67
    HV20.com's Resident Hacker
    Join Date
    Dec 2008
    Location
    Canada
    Posts
    578

    Default

    I have acquired the XL-H1 service manual and I can confirm what rz77 says, there is a specific mention in the service mode menu section that explains the procedure to change the frame rate mode between PAL (50i) and NTSC (60i).

    Jolly

  18. #68
    Newbie Member
    Join Date
    Jun 2010
    Posts
    1

    Default

    hey
    i got screwed over when i bought my xh a1 in a dutch store. I was a n00b back then but it turns out to be a frggn NTSC camera. how's progress on hacking the xh a1?

    is the service tape the only way? i've read a big part over the HV30/20 hack thread too, but i didn't see anything about the xh a1

    thanks for any help en apologies if i missed something

  19. #69
    Emperor of Rep Seo's Avatar
    Join Date
    Jun 2009
    Location
    Cupertino, California
    Posts
    2,641

    Default

    No need to hack bud, you only need to take it to the Canon store and pay a fee of 500 to switch. Or you could try and secure one of those tapes and switch it yourself.

    No need to "hack" the XH A1 to switch.

  20. #70
    Howdy, pilgrim! Duke's Avatar
    Join Date
    Nov 2007
    Location
    CA & FL
    Posts
    2,407

    Default

    I haven't seen it on the XH-A1 but on the XH-G1 I saw a conversion by Canon and you could switch it back and forth, making it worth the $500. The G1 is identical to the A1 except it has the break out box.
    Last edited by Duke; 2010 June 5th at 12:58.

  21. #71
    Newbie Member
    Join Date
    Nov 2011
    Location
    Ekaterinburg
    Posts
    1

    Default

    Привет! Где достать эту кассету? Как это сделать? Не ужели это сделал один человек??? Я не могу поменять в сервисном центре NTSC формат даже за 500$! Предлагают менять плату... Нужно перевести Sony HDR-FX1, Canon XH A1, Panasonic DVX100 в формат PAL.

    Hi! Where can I get that tape? How do I do? Not it possible that this was done by one person??? I can not change the service center in NTSC format even for $ 500! Propose to change the fee ... Need to translate Sony HDR-FX1, Canon XH A1, Panasonic DVX100 format PAL.
    Last edited by Бронекрылок; 2011 November 12th at 13:45.

  22. #72
    Newbie Member
    Join Date
    Jun 2011
    Posts
    1

    Default

    Hello Fellows,

    here you can get the Service Mode Cassette Tape

    www.tomtech.de -> D - 63517 Rodenbach

    serach for: "DY9-1386-000" without the ""

    I also need some help with the Flange Back Adjustment for my XH A1s

    There is a "very simple" procedure for the adjusment. Somthing like
    - Enter Serice Mode with Tape and Remote
    - Push the button xy on your remote
    - Drive Zoom to max. -> Focus it
    - Push the button xy on your remote
    - Drive Zoom back to min -> Focus it
    - Push the button xy on your remote
    - Save it in EEprom by pressing button xy

    Is there anybody out there ;-) Who knows the exact
    procedure? Please share it with us!!

    Cheers

    Newbit

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •