Bounty Censored.
Secret broken.
Since inception of DV & Firewire central, we offered a bounty of $5000
for information leading to the apprehension of a procedure that unlocks
the hidden PAL DV record on European DV camcorders. We haven't paid this
bounty, and we also withdraw the offer.
The Bad News.
The bad news is that lawyers at both sides of the Atlantic have warned
us that we could be heading into major trouble should we pay the bounty
and should the information be used by someone for commercial purposes.
This website is a labor of love. We aren't making any money off it. And
we definitely don't want to spend our time and money with lawyers. So,
no more bounty. Especially not for a secret that could be used by someone
else for commercial purposes while we pay the legal bills.
The Good News.
The good news is that we have reason to believe that the secret has been
broken by an independent party. According to information available to
us, PAL DV Record has been broken with at least one DV camcorder using
a special remote control. The switch is persistent, i.e. it will not go
away after the camcorder has been turned off. We are currently tracking
this story and will reveal the source whenever the source is ready. The
person who has broken the secret is currently deliberating how to go about
it and what to do with the secret. We will keep you posted. |
The Secret is Toast!
Codes to un-nEUter PAL DV input available on the 'net. Arik triumphs after
all.
When we first reported that Arik Drori had cracked the secret of DV input
for Sony’s PAL DV camcorders (see
story below) he was ridiculed in newsgroups, and we were basically
told to get a life. When the story of the odd VCM shenanigans (see
story) was published, Arik decided to come forward with his findings.
See his website. Whole Europe ows him a big THANK YOU and
the flamerz owe him an apology. Arik is a true hero of high technology.
And, we can't help to mention, the procedure pretty much works like what
we assumed in May in our initial
story on the subject.
Here is how it works:
The Sony DV camcorders have pages of data which are stored in NVRAM (non
volatile RAM). The data are organized a bit like the (in)famous modepages
in SCSI drives. Pages contain data with one-byte addresses and one-byte
data, lookup-table style. The trick is to write the right data to the
right addresses.
Tools of the trade.
To
change data in your camcorder’s pages, you need to be able to access them.
This is generally be done with a RM-95 remote control. Important: There
are two kinds of RM-95. One is a handy remote with all the buttons (even
zoom & focus) and a LCD display that shows timecode etc. It plugs into
your camcorder or VCR via the LANC port. It’s nice to have anyway, for
instance for those tripod shots. According to reports, this unit has been
discontinued in 1993, so if Sony says that they aren’t making it anymore,
they aren’t necessarily lying. But they do have another version.
It’s basically a modified RM-95 (see picture). The genuine article will
have a little label on it’s back that read "Remote commander for Adjustment."
It is a tool for service technicians and its serial # is J-6082-053-B .
The most important part is the "Hold" switch at the upper left, which has
been modified to switch from normal operation to adjustment mode (see picture).
How to use the RM-95.
Connect the RM-95 to the LANC port of your camcorder. For the PC7, you
need the VMC-LM7 21-pin adapter. This will also give you audio inputs.
The use of the RM-95 is described in detail in the service manual for your
camcorder (see: "Availability of tools".) Here just the nitty-gritties:
When the RM-95 goes into adjustment mode, the timecode display actually
shows the data for the values in the individual pages. The format is
p:dd:aa, where p is the page, dd is the data and aa is the address. Values
are displayed in hex.
-
Increment/decrement the page with the search+/search- buttons.
-
Increment/decrement the data with the play and stop buttons.
-
Increment/decrement the address with the FF and REW buttons.
-
To write the data into NVRAM, hit PAUSE on
the RM-95
Kids, don’t try this at home.
Please be notified that writing the wrong data into NVRAM can seriously
impede the health and usability of your DV camcorder. Know what you
are doing, always note the initial values in case you goof. Do exploratory writing of data at your own peril. Your camcorder may die in
the name of science. You have been warned.
Availability of tools.
In the US,
both the remote and the service manuals are available, but it usually takes
some asking around. Sony doesn’t seem to be interested in turning this
into a big business. Going through a helpful dealer or 3rd party service
center usually does the trick. For this, it helps to have established good
relationships beforehand. DV-L correspondent David Clarridge Zartman writes: "Any Sony-authorized shop, and independent shops too, have these
devices. Go to them and ask to use their RM-95 to
adjust your camcorder. A couple of guys here were interested in the
procedure since they had yet to work on digital cameras that way, and told
me to come on by. Never hurts to ask. Get the vibe of the service tech
and decide how much info you want to divulge about what you want to do. It
helps to sound like you know what the heck you're talking about. Talk the
talk. If they've never done a dig cam before, don't let them do it now
unless you feel confident that they can figure it out correctly." He's right. See above.
A proper service manual is extremely helful.
It explains the use of the RM-97 in detail, it also gives you the (documented) NVRAM settings.
Tinkerers will immediately zero-in on the undocumented stuff. Manual # 9-973-919-11 for instance covers
the PC7 in all its variants, PAL, NTSC, even the infamous PAL "Tourist
Model" (the one that records). Manual # 9-973-814-11 covers the all
VX 1000 models. Outside of the US, these tools may be hard or impossible
to get, depending on where you are and who you ask. Try different approaches,
we've heard stories of the RM-95 not being available in the UK, but
in Belgium they had five. With these reports hitting the net hard,
it's totally possible that the unit might disappear totally for a while.
What’s the
code?
For the code to unlock DV in on a PAL PC7, please
refer to Arik’s website. I’m sure the codes will be lifted from his
site and shot around the globe in no time, but credit where credit is due. Important: The procedure given at Arik's site works only for the PC7. Use the procedure on another camera and kiss it good-bye. We mean it!
The future.
Now that the code is out, it’s open season. For a short time, the limited
availability of the RM-95 will make things hard, but it’s a LANC controller
and it can be easily replicated. Serial-to-LANC adapters are
readily available. Arik could write a little shareware program that
unlocks one or two features and that gives you the whole shebang for, say,
$49. That’s more like it than the $500 the folks in Munich ask.
Secret of nEUtered PAL units finally
broken. Quick-change artists turn a fast Deutschmark.
Have your PAL VX1000, VX9000,
PC7 enabled to record via Firewire. If you don't mind the clumsy cloak
& dagger routine.
As we all know, the case of the nEUtered Firewire inputs, and activities
concerning it’s successful demise are dear to our heart. Many have
cheered us on, some (who, quite coincidentally work for companies who profit
from this sad state of affairs) told us: "Forget it, enabled Firewire record
on camcorders will never happen in Europe. Never."
We don’t think so. For quite some time already, the theoretical
possibility of enabling REC in PAL DV camcorders sold in Europe has been
beyond question. If you ask the right person at Sony, even they will confirm
that it can be done. All you need is the right code. Which Sony treats
as a state secret. Sony banks on nobody finding the needle in a haystack
of 3 x 255 x 255 combinations. Harder codes have been broken. And it was
just a matter of time for this one. The time has come.
DV-L subscriber Christian Rogge reports from Munich: "Today I visited
a Video Club in Munich and they showed me a European VX1000 with DV-IN
enabled. For recording DV they used a cheap no name remote control where
you must put in a vendor code. Then a DV cable with signal on it must be
plugged to the DV-Connector. On the Display appear the two words: "DV IN".
And it works." Roger reports that the club offered to "modify my camera
for $ 300 in a backroom within 10 Minutes. They said that the camera will
not be opened."
No need to fiddle with the innards of the VX1000: What the "club" is
using is most likely a unit offered by a German company called
"VCM Geraetemarkt." They were known as a low-key broker for used video
equipment. Recently, they started advertising a "DV IR-Remote
to enable DV-Input for VX1000/9000, PC7." The unit is offered at around
$450 with the price going up to $500 after July 15th.
Sony is well advised to keep an eye on these developments. It’s
not good for their business when customers are driven into dark alleys
and "clubs" that want to turn customers’ predicament into quick Deutschmarks
or Dollars . Sony usually donesn't leave money on the table if they can
help it.
Latest humint on VCM and who's behind them. Addresses, fax and telephone
numbers provided by our spies in Munich.
Latest developments, reported by our agents dispatched to Bavaria:
The Munich „VCM Geraetemarkt" which offers "DV IR-Remote to enable
DV-Input for VX1000/9000, PC7" either smartened up (remotes
can be cloned - duh!) or they are engaged in a little deceptive advertising
- you be the judge.
Anyway: When you order one of these remotes that purportedly enable
PAL DV input, VCM eventually tells you that they „have changed their mind"
and that there is now a different procedure: You have to send them your
camcorder, they change it, and then they give you a remote that operates
the record function, it doesn’t enable it. They enable it. Price:
Same as advertised before. Around $500.
The „VCM Geraetemarkt" is an odd outfit. It consists of a faxback
number (+49 89 780 9887) which sends you their pricelist automatically
when you poll their fax (list is in German, but content is pretty obvious).
They also have a telephone number (+49 89 755 3208), but that goes to an
answering machine which announces that you should get current info from
the faxback number. If you want to talk to a human, you are required to
call - get this - „on every Wednesday after 6pm. This is also when we meet
at the familiar location." In Germany, where until recently every
shop had to close at 6:30 pm by law (after 50 years of discussion, they
extended it to 8 pm ...), opening on Wednesdays only, and after 6pm,
could be considered appropriate for a swinger's club, but not for a market
for video equipment.
Hmmm, do we detect slightly hackish behavior here? We’re
currently trying to confirm that VCM is the very Video Club
in Munich which Christian Rogge mentioned in his report, but due
to VCM’s spartan availability on the phone, this will have to wait a while.
It’s a pretty good assumption though.
And maybe it’s a front. Eagle-eyed DV-L subscribers in
Germany remembered that they had seen a similar telephone number
in an ad that appeared in the German magazine „Kameramann." That number
was +49 89 755 9867 - only slightly different than VCM’s faxback number.
The advertised number belongs to the Munich firm „Video Systeme Hoehnleitner,"
which resides in Bayerbrunner Str. 22 81379 Muenchen.
We called them and asked „We understand you have a device that switches
VX 1000 into record mode?" They said: „That’s correct." When asked
to divulge details, the nice lady manning the telephone said: „Our technicians
are not around. Could you please send us a fax with your telephone number
so that we can call you back?" Hmmm, an odd routine, what’s wrong with
writing down our number? When we asked her for their fax number, the lady
said: „Munich 780 9887." Same fax as that odd VCM outfit that
meets only on Wednesdays after 6pm „at the familiar location." Looks
like whoever operates that DV switcheroo service is trying to cloak their
activities somewhat, but they should stick to electronics and leave the
spycraft to professionals. Or maybe they've watched too many videos?
Anyway: You can send your record neutered PAL VX1000, VX9000 or PC7,
to „Video Systeme Hoehnleitner" and for the paltry sum of around
$500, they will enable record and send it back to you, along with a
remote that operates the thing. Forget cloning that remote, because
it only works the record function, it doesn’t enable it.
The saga continues....
PS: For those who don't already have a DV camcorder, "VCM Geraetemarkt"
also offers VX 1000 and VX 9000 with PAL record enabled,
although at somewhat higher prices. A "3 week old demo model" of
an rec enabled VX1000 goes for approx $3300, they sell a "new"
model for $150 less. Expect this to turn into a trend with
rec enabled camcorders sold under the counter, "for a slight surcharge"
and most probably with a voided warranty. Sony, are you reading
this?
Euros Riled About nEUtered
DV Gear, Threaten to Kick Butt.
As Firewire boards are becoming available in Europe (available: FAST
DVMaster, soon to be available: Spark, FireMax, MotoDV et al) European
DV enthusiasts are getting increasingly riled about the lack of DV input
in their camcorders. Like modern day Marie Antoinettes, the DV camcorder
makers say to their Firewire-impoverished European populace: "Let them
eat cake." Or rather "let them buy expensive DVCRs" at $4000 a pop.
At a recent press conference, where Panasonic announced that they will
finally equip some of their DV wares with Firewire, Panasonic’s
announcement that their EU Firewire will be one-way only (as it is the
- well - custom in Europe) was met with loud expressions of disgust, emanating
from an otherwise well-behaved crowd of journalists.
Marie Antoinette ended on the guillotine of the French Revolution. And
already, video-revolutionaries like Bob Crabtree, Editor of the new UK
Magazine Computer Video, are openly recommending bodily harm as the solution
to the problem: "I'll be slipping on my hobnails, in preparation for giving
camcorder makers a swift boot up the behind,“ announces Crabtree in the
editorial of Computer Video’s July issue. "Huge, supposedly wise, multinational
companies haven't the wit to kick-start this new-age properly in Europe
- one of their prime markets - by ensuring that the digital camcorders
they sell have digital inputs.“ Bob's magazine even coined
a new and extremely befitting expression for the different classes of DV
camcorders: "Neutered“ and "Intact.“
Let's hope that the days of nEUtered DV camcorders are numbered. Otherwise,
history may repeat itself.
26year old Tel Aviv student: "I have cracked the secret
of enabling DV input" in DV PAL camcorders.
As
described below, Sony has disabled
the record capability in their European PAL models. Sony claims this is
to avoid substantial customs surcharges. Many customers would be more than
willing to pay an extra 15% for a PAL VX-1000 that also records. But "no
dice," says Sony.
Sony better re-evaluate their policy, because Ariel "Arik" Drori, a
26 year old student of electronics who lives with his wife in Tel-Aviv,
Israel, claims that he cracked the recording capability of DV PAL camcorders.
What's more, Arik promises to unlock a whole panoply of features at the
push of a LANC controller:
-
Enable 16x9 on all models.
-
Make your NTSC camcorder work in PAL, or vice versa
-
Improve light sensitivity.
-
Prevent drop in quality when using electronic "steadyshot" in low light,
and more.
According to Arik, he has been hacking analog camcorders for years, enabled
locked analog inputs, added features etc. In several telephone conversations
with DV & Firewire Central, Arik Drori claimed that he successfully
cracked a Sony PC7, using the LANC connection via a Sony VMC-LM7 Lanc &
audio adapter.
DV & Firewire Central immediately arranged for a demonstration of
the capability. The meeting never happened. As indicated in the sidebar,
lawyers in the US and Europe counseled against money changing hands in
exchange for an industry secret. The meeting was called off and we could
not verify the claims. Said
Arik in his website: "There was a prize for the first one to find [the
secret], but the sponsors chickened out on me!" You bet we did. Better
chicken than a chicken without a head.
Arik, who ended his 5 year career in the Israeli Defense Forces as
a Sergeant Major, is hoping to commercialize his findings. For more details,
check
Arik's website. He offers to modify your camcorder after you send the
unit to Israel, but so far, he didn't have any takers.
Said one VX-1000 owner in the US who contacted Arik Drori to have 16:9
enabled: "He did offer to perform the conversions for me, but that would
have meant sending him my camcorders, so I wasn't willing to take that
risk to see if the theory was true." Instead, the VX-1000 owner contacted
several Sony service centers in the Seattle area for service manuals, but
no luck: "After talking to the Sony Service Center, I got the impression
that this is indeed a well-kept Sony secret."
Despite his claim that "The secret of DV Input for the European market
is OUT," Arik is playing his cards close to his chest. So far he resisted
pleas to publish his findings. Arik indicated that he is willing to sell
his knowledge for commercial exploitation, but according to legal and
industry experts consulted by DV & Firewire Central, it is highly unlikely
that this knowledge will ever go commercial:
-
Modifying DV units would violate the rules of the "CE" label, the European
cousin of the FCC or UL label. Modified units would be illegal to operate
within the boundaries of the EU. This may be a technicality, but many lawsuits
are lost or won on technicalities.
-
Changing new PAL or even NTSC units into Recording PAL units would immediately
turn them into "used" equipment without warranty.
-
Selling a gizmo that would plug into the LANC socket could be defensible
from a legal standpoint, but LANC codes sent to the camcorder could be
easily intercepted and the unit could be cloned by anybody. Said an industry
insider contacted by DV & Firewire Central: "The secret would have
a lifetime of 5 minutes. Nobody in his right mind will invest money in
such a venture."
-
And whatever you do, there's always the possibility of Sony suing for damages.
They may not prevail, but not too many companies or individuals look forward
to a protracted legal battle with a 500 pound gorilla.
So there you have it. The key to enabling PAL record and possibly a number
of other highly interesting features of your DV camcorders sits in a
small apartment in Tel-Aviv. If you are interested, send
Arik some mail.
While Arik Drori is pondering what to do with his secret, relief is
on its way in a manner that is less likely to attract legal beagles: Sony
DV camcorders with PAL record capability have been sighted in non-EU countries
such as Hungary, Romania, Dubai, and even in Arik's Israel. First batches
are already winding their way through the walls of Fortress Europe.
And for those of you who don't want to buy a second DV camcorder: There's
always the possibility of hooking a computer controlled LANC unit to
your camcorder and do some "War Games" style dialing. Details about
the LANC protocol, the hardware and software needed can be found at Adrian
Verity's Control-L Homepage. And there's the faint hope that Arik may
go public with his information some day.
Importers of Rec-Enabled
PAL DV Cams Complain about Sony Strongarm Tactics.
Several European dealers and distributors have attempted to import Sony
DV PAL camcorders which can record via Firewire. (For more background on
the missing capability, see below.)
None of the would-be importers have succeeded so far. Their stories
all sound the same. "I had no problem locating the PAL camcorders in Japan,"
reports one German dealer who placed an order for 70 PAL VX1000's with
a Japanese distributor. The distributor took the order, but a few weeks
later, says the German dealer, the order was declined. Reports the angry
German importer: "The distributor was notified that should one of the record-enabled
camcorders be traced to the EU, this would be the last product he would
ever receive from Sony." The German dealer is now looking into alternative
sources.
Secret Switchcraft.
The best known "secret" VX1000 trick is the "hidden" colorbar trick.
In case you don't already know, here's how:
On your VX1000, turn the red start/stop
button to "lock" with the camera/vtr knob turned to "camera." Press one
finger down on the rec/start/stop button to
"lock" with the camera/vtr knob turned to "camera." Keep one finger on
the rec/start/stop button on top of the camera and another finger down
on the "photo" button next to the zoom controls. Now, while keeping those
two buttons depressed, turn the red start/stop buttons to standby,. And
you'll have color bars. To reset, turn the camcorder off and back on. One
DV-L correspondent noted by the way that this trick does not work on the
VX700. Gosh, they even strip hidden features! No shame.
Also works on DSR-200:
According to DV-L list correspondent Richard of VantagePoint Imaging,
Inc., "the color bar activation sequence also works on the DVCAM
DSR-200 except you press the record button on the front of the camcorder."
How to unlock the locked audio "feature" on the DSR-30.
If you try to edit from a DV unit (VX1000 etc.) to
Sony's DSR-30 (the DVCAM variant of
the DHR1000) via Firewire, you will find out: It doesn't work.
Why? DV works in unlocked audio, DVCAM works in locked audio. The DSR-30
refuses to take footage with unlocked audio. But it can be talked into
it at the touch of two buttons:
The DSR-30 can be put into a mode that will allow
it to record UnLocked or Non-Standard Audio.
All you have to do is power off, then hold both the REC
and PAUSE buttons down and power up, you should hear a long tone and
then presto, you can now feed it locked or unlocked
audio and it will record. The deck is
reset when you power down.
An apPALling situation. And pointers
how to fix it (some day).
If you live in PAL territory and if you think you can simply copy
DV back & forth between the computer and your VX1000 or PC7, as explained
in DV & Firewire
editing workflow, then you'll quickly find out: You can output
through Firewire on your PAL units, but you can't input. The reason behind
this is that in the EU, anything that inputs video is classified as a VCR.
If it doesn't record video, it's classified as a camera. What's the difference?
Around 10% higher import duty. Some people have argued that DV isn't video,
but simply digital data, but apparently, the European customs official
didn't buy that line (if it ever was officially offered).
What you have to do is buy a DHR1000
DVCR just to be able to record your edited video Your friends in NTSC territory
can happily use their camcorder for that purpose.
What's worse, even countries which are not part of the EU, but have
PAL as their standard, are affected. In Australia and NZ for instance,
VX-1000s cannot record, but the PC7
can.
Report from the UK: "It's the remote control."
David Bryant writes from the UK: "I have spent a long time and a lot of
research tracking down information about DV in enabled camcorders and sources
of the PAL version outside the UK. I was even getting somewhere
with the possibility of getting a DV enabled DSR-200 until Sony phoned
Japan and had the company policy laid down to them. It seems inevitable
that Broadcasters and commercial clients over here are going to demand
the option of DV in now the firewire cards are out. From what I already
know the cameras seem to boot up similar to a computer and carry all the
relevant setup in a bios of some sort."
David relates an interesting conversation which "took place between
myself and a Sony Broadcast person who had better remain nameless" on the
subject of importing a DV in enabled DSR-200 camera into the UK:
SBP..." I have spoken to Japan and there is no way they can divert one
of the enabled PAL models from Dubai into Europe even if you are prepared
to pay the duty. You see they are not C.E.(Council of Europe) safety stamped....."
Me....."Ok well in that case why can't you take the case off one
of the ones you have and switch the jumper and I'll give you the
£400 import duty then."
SBP..."Well it's the remote control not a jumper but at the moment this
is just not an issue we can even consider.... now maybe we should reconsider
the warranty arrangements if you do go ahead and get them from the
Sony dealer in Dubai....."
Factoids:
A Sony person confirmed that "it can be done in seconds if you know
how."
European developers who bought Sony's DVBK-1 hardware CODEC chipset
have been told how to change the camcorders so that they can test
their products. These folks have been sworn to secrecy and probably threatened
with an immediate loss of their supply if word comes out. No leaks so far.
There have been several reported cases where VX-1000 or PC7 were
"taken into a room", "taken behind the curtain at a trade show" by Sony
people, and voila, when they came out, they recorded PAL. Usually,
they lost that capability when the unit was switched off.
Assumptions, rumors:
There is a well guarded diagnostic unit in Europe that allows Sony technicians
to change the units. That must be one of the reasons why most work
on Sony DV camcorders must be done at the factory. It is unclear whether
this diagnostic unit is attached via Firewire or via that mysterious connector
that's hidden under a cover in the battery compartment of the VX1000.
There is a country table embedded in all Sony DV units that has all
pertinent info (such as video system, record, non record etc.) associated
with the individual country or region. Find access to that table and you
have the key to nirvana. Note: Supposedly, Sony DV models are identical
, i.e. there are no functional differences between PAL or NTSC units etc.,
all differences are programmed through the country table.
Temporary enabling of the PAL record function can be done with
a switch sequence during startup. This switch sequence is presently
unknown, but it's something similar to the well published enable colorbars
sequence. Hint: For this sequence to function, the firewire
cable must be inserted into the camcorder and it must be activated.
Sony is understandably paranoid about any information leaking out. As it
appears, they don't want to force you into buying a DHR1000 (although they
may welcome the side effect), what they are most worried about is that
they may have to retroactively pay the higher customs duty on all
DV units exported to Europe. DV unit sales in Europe have been estimated
to be around 1 Million units since shipments had begun in late 95, so payments
could be considerable.
Any further insights into these matters would be highly welcome.
|
|