Samsung WB210 firmware info & eastereggs

CYBERYOGI -CO-Windler

4
CAMS:Ixus 800IS,Sams. WB210,Many cheap non-zoom

Samsung WB210 firmware info & eastereggs

« on: 14 / February / 2013, 21:20:51 »

Advertisements

The Samsung WB210 from 2011 is a compact digicam with fully touch screen operated smartphone-style GUI, great 21mm wide angle mode and many gimmicks - basically a cheaper non-wireless predecessor of the (in)famous Samsung Galaxy Camera. I especially like the sharp TFT with its easy accessible album mode, but this camera has also some quirks. Most annoying to me is the too dark lowlight video and the missing VGA (50KB) photo mode.

My old Jenoptik 4.1 x z3 started to fall apart, so despite I was almost sure to buy a Canon (due to CHDK programmability) bridge camera with NiMH AA batteries and big enough to rest well in my hands, I ended up with something completely different.

Because a main purpose of my digicam is a visual notebook/diary to document electronics (I collect old music keyboards, sound toys, videogames and such things and often repair or modify them), I tend to take hundreds of tiny pictures of wirings, screw lengths etc. those I need to view and re-access easily - not least as an aid to put things back together. So I always wanted a kind of tablet PC with built-in zoom camera and *without* radio transmitters (I strictly refuse to become irradiated and spied out by that brain destroying scrap) - which yet doesn't exists - at least I wanted a non-wifi digicam with big screen. In a MediaMarkt store the Samsung WB210 had the biggest and was reduced to 130€. Canons had smaller screens and I worried about their wide-angle of only 28mm, so I bought it.

I wrote a long and detailed review about its features and flaws on Steve's Digicams:
Samsung WB210 review (big touchscreen,wide angle,non-wifi|Hacking?)

It's a Samsung and the touchscreen-GUI looks very smartphone-like, so it wouldn't surprise me if already existing apps may be installable after some jailbreak or rooting procedure. I would love to see it supported by CHDK or a similar firmware extension. This is what I found out about the hard- and firmware.

hardware info

The objective is labelled: "Schneider-KREUZNACH, VARIOPLAN 3.5/4.0-48.0mm 1:3.4/2.9-5.9 21mm/24mm". The maximum resolution is 4320x3240 (14MP) while the 7.76mm CCD sensor has technically 16.4MP (the rest is likely used for stabilizer). Video uses H264. Photos are stored as JPEG files at 3 different compression rates. Some people complain that there was too much snow because of "too high compression" even at maximum quality setting. Seeing the large file size, I suspect that rather the opposite is true; while other cameras blur their snow by lossy compression, the WB210 compresses less and so keeps it visible. It also may do less aggressive post-processing (by slower CPU?).

Exciting is that the chipset is Zoran COACH (likely 12 or 13), which predecessors were used in many (often poorly working) cheap Aiptek and no-name mini camcorders, including early disposable cameras those have been well examined by firmware hackers. So it may be possible to port something like CHDK to the WB210 to overcome annoying restrictions. Not least because COACH is nowadays used in many name brand cameras (including Samsung, Casio, Fujifilm, Olympus), porting CHDK to the COACH platform would make a lot of sense. On the WB210 GUI zoom effects look less smooth than with modern smartphones and there are no animated rotations, which makes me conclude that the chip has no hardware 3D acceleration. On the CD that comes with the WB210 are beside manuals in many languages the following copyright notice files:

Code: [Select]

COACHOpenSource_Index.pdf
- (libpng, mscellaneous, zcam, libjpeg, gnu stdc++, ffmpeg)
COACHOpenSource_Introduction.pdf
- ("COACH Firmware package by Zoran Microelectronics Limited")
OpenSourceInfo.pdf
- (zlib)

On my memory card is a file /SYSTEM/DEVICE.XML that contains (among others) these entries:

Code: [Select]

        <ModelName 	  value="SAMSUNG CAMERA" />
        <BaseModelName   value="SAMSUNG WB210" />
        ...
        <Platform	    value="Zoran" lab="C12mHD" />
        ...
        <FirmwareUpdate  value="TURE">
        ...
            <CurrentVersion	  value="1108261" />
            <ProductionPlace  value="Global" />
            <Variation 	   value="" />
        </FirmwareUpdate >
        <VID	 value="1256" />
        <PID	 value="4890" />

A quite similar camera with wifi remote control through Samsung Android smartphones (but cheapish with boring 5x zoom lens) is the Samsung SH100. Possibly its control software may be useful to research the WB210 operating system. The GUI looks like Samsung's proprietary TouchWiz interface, which also exists on Samsung smartphones with various operating systems including Samsung's Bada or Android.

firmware:

The USA and EU version of the WB210 seem to differ, or at least take different firmware (due to HDMI regional codes??). I downloaded from Samsung the following versions:

Code: [Select]

WB210_DSP_U_SR_F1108264.zip (56MB, for US-version)

model: EC-WB210ZBPRUS
   Upgrade File (Firmware) (ver.1108264)  
   All OS   09.02.2012   MULTI LANGUAGE   55.24

   1. Title [WB210] The latest F/W (ver.1108264)
   2. Applicable Model WB210
   3. Carrier or Corporate Customer Open Market
   4. Description
      - This is the latest F/W for WB210 camera.
      - Improved video recording and HDMI.
      - Only USA released model.
      - You should use intelli-studio for upgrading firmware

Code: [Select]

WB210_DSP_G_SR_F1108261.zip (56MB, for non-US version)

model: EC-WB210ZBPBE3
   1. Title
   [WB210] The latest F/W (ver.1108261)
   2. Applicable Model
   WB210
   3. Carrier or Corporate Customer
   Open Market
   4. Description
   - This is the latest F/W for WB210 camera.
   - Improved video recording and HDMI.
   - Do not use USA released model.
   - You should use intelli-studio for upgrading firmware

The contents is intended to be placed in the root directory on the memory card in the camera and shall start automatically when disconnected from PC and powered on. (Updating the firmware may possibly delete the memory card, thus backup it before you proceed.)

Each firmware ZIP contains a ELF binary file (about 101MB)

WB210-DSP-1108261-full.elf
or
WB210-DSP-1108264-full.elf
and
FWUP.txt (string "upgrade dsp", likely starts the update process)

US and non-US version differ in many places and not just a single spot. A hex editor reveals in the ELF files plenty of unencrypted text, including copyright notices, many error and function names, but no onscreen messages or menu texts from the camera, so they may be compressed. But possibly these firmware upgrades are only partial, because the "Samsung WB2000 Firmware analysis" website mentions beside "dsp" plenty of other files with corresponding FWUP.txt update commands.

Logged

MAY THE SOFTWARE BE WITH YOU!

CYBERYOGI Christian Oliver(=CO=) Windler
(teachmaster of LOGOLOGIE - the first cyberage-religion!)
!
ABANDON=THE=BRUTALITY
{http://weltenschule.de/e_index.html}

CYBERYOGI -CO-Windler

4
CAMS:Ixus 800IS,Sams. WB210,Many cheap non-zoom

Samsung WB210

« Reply #1 on: 14 / February / 2013, 21:27:02 »

possible electronic component names in firmware:

SENSOR - SONY682_ADDI9004
LCD = SAMSUNG_AMFR001
SAMSUNG.SAMSUNG PL150 / VLUU PL150 / SAMSUNG TL210 / SAMSUNG PL151
SAMSUNG.SAMSUNG PL170,PL171 / VLUUPL170,PL171

A large portion of the about 100MB huge ELF files (56MB compressed) takes the "Intelli-Studio" virtual CDROM partition. I don't see a string "Android", but various references to "Google Maps" and "MySpaceIM" (part of "Intelli-Studio"?). Possibly existing hacks for Samsung mobile phone or tablet products may be adaptable to access this camera or install additional apps. Here are some websites to start:

Samsung WB2000 Firmware analysis
http://www.unternet.org/wiki/Firmware/Camera/Samsung_WB2000

CameraHacking forum (Zoran COACH)
http://camerahacks.10.forumer.com

eastereggs:

WARNING: The following hidden modes and menus were discovered by personal experimentation and internet search. I am not associated with Samsung and can not guarantee that they won't do harm to your camera. Samsung keeps them secret because they are not intended for end users and any damage by misusing them is not covered by warranty. Use them solely at your own risk.

With the described operations generally the correct order of holding controls matters, i.e. first (pressing and) holding 'tele' and then (pressing and) holding 'shutter' is different from holding 'shutter' and then 'tele'. Also the timing may be important. All entries start with the camera powered off.

silent mode

Holding 'playback' for 5s powers the camera on with all sound muted. (This is an official mode that is safe and documented in the user manual.)

reset all

With memory card inserted, holding 'wide' (zoom out), then 'shutter' and then pressing 'power' displays a short text, but the screen quickly goes blank; press now 'power' again without releasing 'wide' and 'shutter'. This turns the camera off and resets all settings (including time and language) to factory defaults and deletes all photos and videos on the internal memory (but *not* the card). Powering on will now restart the initial setup menu.

orange dot

There is a strange orange circular dot on the initial setup screen. Touching it does nothing. It may be a mouse pointer from a non-touch-screen (mouse?) based debug input mode.

service mode

Without memory card, holding 'wide' (zoom out), then 'shutter' and then pressing 'power on' displays firmware info (and makes stabilizer noise).

My camera shows here:

Code: [Select]

FW : 1108261-G(1202.0234.019a)


OIS_Ver :2.32
FULL   SR
S/N: ************


D0 : 1060 OK               PD0 : 4   OK
D1 : 2516 OK               PD1 : 12  OK
L0 : 1201 OK               L1 : 1201 OK

DANGER!: The following procedures may permanently mess up your camera's fine tuning or do other harm (in worst case up to permanent damage that may make it unusable!). Although mine survived without bad side effects, I can not take responsibility for undesired results, so do not continue unless you know what you are doing. (If in doubt, press 'power' to exit.)

Pressing here 'playback' shows:

Code: [Select]

One Card Step 7
Wide - Reduce
Tele - Increase
Shutter1 - Initialize

The number behind "One Card Step" changes between 0 and 254 with the zoom lever (above 254 it flips over to 0, but you can not step below 0 to flip back to 254). Pressing 'shutter' changes the number to 0. I don't know what this does. Each number may reset one of 255 items to its factory default or what ever. Perhaps it can even format something, thus be careful and better do not press 'shutter' until it has been investigated what this is for.

Pressing here 'tele'(zoom in) for one second shows:

Code: [Select]

Ptp Adj disabled


To toggle

press Right or Left

'wide' or 'tele' toggle here the word "disabled" into "enabled".

The following mode looks like a really dirty hack to adjust something like brightness and colour of the image sensor. Possibly this can fix the overexposed photo problem mentioned on the internet, but it also may be just a harmless test mode for something, or even a jump into dead code fragments those are not functional anymore in the released version.

Once you select "Ptp Adj enabled" and power off, powering on with the 'playback' button (important!) enters a strange faulty "P Mode" (aka poo mode) that shows an empty info box and a floating small English text "P Mode" (even in German language version, where the regular one is named "P-Modus").

The entire mode is a big mess full of flicker and anomalies; it looks like when it causes all kinds of race conditions and other realtime atrocities like violently intercepting interrupts and throwing wrenches into running tasks. You can not even exit with the 'home' button. Zoom, shutter and most icons do nothing ('timer' icon looks like a 2nd 'flash auto' icon).

The menu here only contains 'Photo Size' and 'Timer'; selecting any of them and tapping 'ok' enters a new mode with unknown icon (tapping it shows an empty info box) and across the live preview 2 horizontal sliders labelled "brightness" and "color", those end icons (coloured fruit photos) have to be tapped to move the sliders (you can not simply drag them).

Both sliders have a barely visible center mark to indicate a default position. Possibly they can tweak the image sensor behaviour or such things, but you can't take photos in this mode, and the live preview image looks the same. The slider settings are saved, so they reappear at their positions when this mode is visited later. If they do anything to the sensor, then changes are very subtle (photos don't look different, and it won't fix lowlight issues). It also may be that the sliders have no designed purpose at all, but are only side effect of a wrong subroutine address table or debug data spoiling return addresses on a CPU stack. Because the 'home' button doesn't work, to get back to the app icons press 'playback' to see the album mode, from where you can exit with the 'home' button. From here the behaviour looks normal. (Pressing 'playback' again enters the regular "P Mode"). Powering off with 'power' button quickly displays in the top row "PM END...POWER OFF". (But this won't change the camera behaviour back to normal).

Powering on with 'power' button causes a non-working touch screen (home screen icons etc. don't work at all).

WARNING!: The *only* proper way to permanently exit this broken mode is to go into the service mode again and select "Ptp Adj disabled". (Battery removal or reset doesn't help here!)

Samsung_WB210_serviceMode.jpeg (4.81 kB, 497x319 - viewed 187 times.)

Samsung_WB210_pooMode1.jpeg (15.77 kB, 512x323 - viewed 183 times.)

Logged

MAY THE SOFTWARE BE WITH YOU!

CYBERYOGI Christian Oliver(=CO=) Windler
(teachmaster of LOGOLOGIE - the first cyberage-religion!)
!
ABANDON=THE=BRUTALITY
{http://weltenschule.de/e_index.html}

CYBERYOGI -CO-Windler

4
CAMS:Ixus 800IS,Sams. WB210,Many cheap non-zoom

Samsung WB210

« Reply #2 on: 14 / February / 2013, 21:38:58 »

Also other Samsung cameras seem to suffer of this poo mode (websearch "P mode" + "PM END" + "POWER OFF"). In forums people suggest that this may be a debug mode, and that it sometimes turns itself on when a Samsung camera got wet. So far I understand, it can be only terminated by entering the hidden service mode and setting "Ptp Adj disabled". (Hold 'wide', hold 'shutter', press power, release all and press 'tele' for 1 second, use zoom lever to toggle it, exit with 'power'.) To make it clear, you do *not* need new firmware to fix this, and the poo mode (despite it displays the word "P Mode") has nothing to do with the regular "P Mode" (which is a great feature of the normal Samsung user interface for manual shooting mode control).

I read on the internet that the abbreviation "ptp" may stand for "Picture Transfer Protocol" (used to sends pictures to computer or printers - e.g. for remote capture commands), so "Ptp Adj" may be originally intended to adjust something related. However another interpretation of "PTP" is "Precision Time Protocol", which is used to synchronize clocks through a computer network, which e.g. can be the timing between realtime processors needed for proper hardware multitasking. Messing this up would explain erratic behaviour with flicker and touch screen fail, and if code bank switching fails or interrupts collide, it would also explain the menu mess.

I first got panic and thought I had bricked it when during experimentation suddenly the camera did not power on anymore and only showed a flashing green LED, but it turned out that only the battery was empty.

unknown 1

With memory card inserted, holding 'tele' (zoom in), then 'shutter' and then pressing 'power' makes the green LED flicker but TFT stays off and no response. Also 'playback' does nothing. 'power' exits this mode. (This only seems to work after reset when no photo mode was selected yet, else it starts in that photo mode.)

unknown 2

With memory card inserted, holding 'tele' (zoom in), then 'shutter' and then pressing playback makes the green LED flicker but TFT stays off and no response. Also 'playback' does nothing. 'power' exits this mode.

(I don't know how dangerous the hidden modes are. I have no WB210 service manual but only read one of the Samsung S630/S730 compact camera from 2007 (COACH 8 CPU, no touch screen GUI). Despite it has a service mode (accessed from its voice recording mode), any dangerous internal adjustments are not done from there, but by placing on its memory card a TXT file with fixed special name ("STS373ADJ.txt") that can contain many different batch file commands and is automatically executed (and then deleted?) when the S630 is powered on. The adjustment process consists of placing the camera on a special test bench (with controlled light setups, charger voltages etc.) and powering on the camera for each adjustment with a different "STS373ADJ.txt" copied to its card. Thus without such a file nothing bad should happen with a S630, but I don't know if the service mode is also safe with the WB210. At least I see many of the scripting language commands also in the downloaded WB210 firmware, which suggests that the WB210 is likely adjusted through a similar batch file mechanism (here "FWUP.txt"?) rather than hidden menu items those damage things accidentally.

The S630 service manual is mainly about schematics and replacing mechanical parts; it does not explain the scripting language except containing the individual batch files for adjustment (of dead sensor pixels, lens shading, strobe timing, battery voltage sensor etc.). On an intact camera no hobbyist should ever mess with these, because most adjustments need a special test bench without that you can not put things back to defaults to make the camera work properly - doing so *will for sure void warranty*. Most commands seem to immediately write changed settings into flash rom. The command "adj_check e2p_read start address, end address" apparently can backup the "EEPROM" (i.e. flash rom??) contents to the memory card. I don't know if there is a command for executing external programs like CHDK. Interesting is that beside the normal firmware update mode there is the "FULL firmware1" upgrade that can be used when the camera is bricked so badly that it doesn't turn on anymore. The service technician performs this by shorting 3 special pins on the PCB and powering on with inserted memory card containing this firmware (waiting until power consumption drops from 200mA to 0 to see when it is finished). After this he has to execute the LENS SHADING and CCD DEFECTIVE CELL adjustment procedures. I am neither a Samsung technician nor own a S630, so everything you may do with this info is solely at your own risk.)

upgrade wishes

These are my improvement wishes for the Samsung WB210 (items sorted by priority).

what it really needs:
- selectable 50KB VGA photos in "P Mode" & editor resize
- working lowlight video (setting higher ISO/EV)
- QVGA video in "SD Video" mode
- selectable scene modes in "Easy Mode"

other suggestions:
- "Super Wide Shot" in "P Mode" & video
- disable strobe in "Easy Mode"
- video recording in "P Mode"
- 25fps video for smooth PAL playback
- faster video zoom (despite motor noise)
- playback zoom when rotated
- playback zoom by 2-finger pinch or by double-tap+dragging
- playback compare photos while zoomed (e.g. by momentum scroll)
- compensate bluish black at high ISO
- in lowlight use digital zoom before optical
- nameable photo files & folders
- fix poor translations ("possierlich" etc.)
- downloadable apps (Samsung could make money with these!)
- theme support/ customizable GUI
- webcam mode
- eBook reader (offline HTML browser+PDF, e.g. for viewing schematics)
- paint program
- flashlight app (plain white or coloured TFT light)
- colorimeter program? (monitor adjustment)
- use focus LED + image sensor as *optical* wifi ;-)
- music player?? (is sound output stereo?)

Has anybody the Samsung WB210 service manual to explain its hidden modes?

Samsung_WB210_pooMode2.jpeg (14.96 kB, 514x316 - viewed 1325 times.)

Samsung_WB210_hiddenModePicts.zip (64.02 kB - downloaded 68 times.)

Logged

MAY THE SOFTWARE BE WITH YOU!

CYBERYOGI Christian Oliver(=CO=) Windler
(teachmaster of LOGOLOGIE - the first cyberage-religion!)
!
ABANDON=THE=BRUTALITY
{http://weltenschule.de/e_index.html}