Disney Flix Camcorder

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
Disney Flix Camcorder, ~2007 vintage

Surprisingly, this toy camcorder made for an interesting teardown.

Given the bare-bones simplicity and working serial port, it could be a worthwhile target to reverse engineer the Zoran Coach architecture. Zoran Coach in the late 2000s to early 2010s was the dominant camera SoC, found in many consumer point & shoot cameras. https://en.wikipedia.org/wiki/Zoran_Corporation was bought by CSR, who then later sold off its camera IP to Qualcomm.

The camera is also unique, in that it isn't a rats nest of flat flex cables, but mostly uses right-angle pin-headers as interconnect between circuit boards (the exception being the display). This will make it easy to tap into signals between image sensor and SoC, or to automate camera controls with an MCU.

Teardown pictures

Main PCB, front


Main PCB, back
Sensor PCB, front
Sensor PCB, back
Controls PCB, front
Controls PCB, back
Display PCB, back
Assembled camera, without enclosure. Note the pin-header interconnects.

Parts identification

Main PCB

U1 Zoran ZR36440BGCF Coach 6e Digital Camera Processor

U3 Elpida S6416GHTA-10-E 4Mx16b (8MB) SDRAM

U4 Hynix HY27US08121A 64Mx8b NAND Flash (under SD Card slot)

U251 Holtek HT82V735 330mW Stereo Audio Power Amp

U302 marking DE-K1L, SOT-23-5 LDO?

U??? marking DC-U06, SOT-23-5 LDO?

U??? marking D A- 9JS2Q, 6-pin package, Boost Converter?

J1 debug header (see below)

Sensor PCB

U? Silicon Optronics Inc. SOI-968 image sensor

U? JRC NJM4580M dual audio op amp

  • Likely for microphone and/or audio jack on same board

Display

Marking on flatflex: Tp037A

Boot message: LCD = TOPPLY_TP033B

Serial debug port

A serial debug port is available on four pads marked as J1:

UART parameters: 115200 8N1

Pinout (starting at J1 label): 3.3V, TX, RX, GND

Logs

Boot

Boot - VER: HW=0x62B0, FW=0x0463.19
CODE = 1042192 byte, DATA = 52888 byte
THR - Z2c Writer
LCD = TOPPLY_TP033B
CODEC = AVC
THR2 - HCE
RESIDENT = NAND (SR)
CARD = SD
RES A - OK
RES B - OK
RES C - OK
THR2 - AgentServer
THR2 - StillServer
THR2 - BrowseServer
MON> THR2 - Monitor
ÿCTLut - 92x85
Hce proc started
HceOnCreate
HceOnCreate Create Element
HceOnCreate_SD

##### Msg handled by General: [0500][00000000]-[CREATE] #####
HceOnCreate_SD
AgentOnSetMsMedia
>>>>>>>HceOnMsg: FlashCardDetect = 0
Next St = 1HceOnCreate_WaitIdle

##### Msg handled by Quene: [0700][00000000]-[FLASH_CARD_DETECT] #####
HceOnCreate_WaitIdle
Next St = 2ADC0 Value is 31
HCE_ReadFGPIOButtons 0x01
                                                         >>##>>## init capture key = 1
SENSOR - SOI968
!Kenny SOI968 sensor
Init RTC
HCE_InitOptions
HCE_ChkUSPExist USP.bin Exist!!

B:\USP.BIN restored successfully.
        Do Nothing
        END
Hce_SetFlickerFormat[1]
AeSetAgcMode 1
AeSetAeMode 1
AeSetPreviewExpLimit 45 127
AeSetCaptureExpLimit 45 127 255 255
0:(235,399)
1:(234,413)
2:(300,371)
3:(318,281)
4:(318,281)
R(234,318) B(281,413)
ulAwbLutSize(Gr,Gb) = (40,46)
I43_SetImageSize - OK
StillOnSetCompressionRatio
AeSetExpDeviation 16
HCE_SetWhiteBalance[0]
AwbSetMode 16
StillOnIsspuLs 0
StillOnIsspuClpf 1
StillOnIsspuLc 0

 **MountStorageMedia type = 0 **
I43_MountStorageMedia - 0
AgentOnSetMsMedia
:::HCE::: Media Mounted Success

 **GetStorageMediaStatus type = 0 **
I43_GetStorageMediaStatus - 0

 ## refresh photo num is true ##

 **GetStorageMediaStatus type = 0 **
I43_GetStorageMediaStatus - 0
uAviSecondsRemain[90] ulSpaceLeft[41615360]
uMovieMinSize[540672]uMovieSizeParam[451730]

 **GetStorageMediaStatus type = 0 **
I43_GetStorageMediaStatus - 0

 load ASDUI.bin
GdiLoadFont - \UI.BIN

 init osd clut
>>>>>>> HceOsd: Init - OSD

 init font color & size

 ## HCE_PAviInit ##

 ## HCE_PAudio Init ##

 >>> init ClockCheck
HCE_InitClockCheck
LCD = TOPPLY_TP033B
HceDlcdSetPins
Send Reg. Th to TP051!!
TopplyDlcdInit ...
>>>>>>> HceLcd.c: LCD mode
LCDON
GPIO_LCDONOFF =1MOFF
BATTERY STABLE [172]
AppSetMode 0x30 -1

##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####
ADC0 Value is 31
Read ADC1 Button 31
HCE_ReadFGPIOButtons 0x01
##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####
XLGPIO pressed is 6

##### Msg handled by General: [5000][00000006]-[XL_GPIO_BUTTON_NOTIFICATION] #####

##### Msg not handled: [1d00][00000000]-[MOUNT_DUPLICATED_FOUND] #####
AgentOnUsbConnect
THR - UsbAgent
THR - CmdDispatcher
NextMode: 6, ThIdle: 1
Usb Agent: Disconnect Event
2 NextMode: 6, ThIdle: 1

##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####
AsdMode_ChgModeDesed Create Element
HCE_AviConstructor
HCE_AviConstructor Create Element

                        >>>>>>>> ModeAvi.c: Setting Avi mode
BrowseOnSetAudioCompression 1
Video image size 640 480
I43_SetImageSize - OK
Video image size 640 480
I43_SetImageSize - OK
StillOnSetCompressionRatio
StillOnSetRecordingTime 65535
BrowseOnSetRecordingTime 65535
AeSetExpDeviation 16
HCE_SetWhiteBalance[0]
AwbSetMode 16
AeSetAgcMode 1
AeSetAeMode 1

 **MountStorageMedia type = 0 **
I43_MountStorageMedia - 0
AgentOnSetMsMedia
:::HCE::: Media Mounted Success
AppSetMode 0x40 -1
StillOnActive -1
THR - Store
THR - FileCreator
THR - Aaa
AAA start.
Go to view mode!!!StillOnModeStart 3 -> 0

##### Msg handled by General: [0100][00000100]-[USER] #####
StillPreviewActive

##### Msg handled by General: [0100][00000100]-[USER] #####
StillStartMode 0 0

##### Msg handled by General: [0100][00000100]-[USER] #####
StillPreviewStart

##### Msg handled by General: [0100][00000100]-[USER] #####
THR - PreviewMode

##### Msg not handled: [1d00][00000000]-[MOUNT_DUPLICATED_FOUND] #####
StillPreviewMain
THR - Sensor

##### Msg handled by General and Queue: [0800][00000040]-[NEW_MODE] #####
THR - StatAe
HceAviConst_WaitNF
HceAviConst_WaitNF
HceAviConst_WaitNF
HceAviConst_WaitNF
HceAviConst_WaitNF
_ASDM_ST_CUR_MODEID 6
HceOsdDrawBattery level 4

Power down

HCE_ReadFGPIOButtons 0x01
##### Msg handled by General: [5100][00000000]-[FG_GPIO_BUTTON_NOTIFICATION] #####

##### Msg handled by General: [0100][00000100]-[USER] #####
NextMode: 1, ThIdle: 1
2 NextMode: 1, ThIdle: 1
HceSetSwitchWorkMode WorkModeId: 1Main Power off!!
2 NextMode: 1, ThIdle: 1
HCE_AviDestructor
HCE_AviDestructor Create Element
AsdMode_ChgModeDesed Create Element
AppSetMode 0x30 0
StillOnActive 0
StillOnModeEnd 0. Next mode is 0
StillPreviewStop
StillAbort
AWB stats aborted in the middle of transaction.
AAA process terminating !!!
StillOnAaaExit
StillOnStoreExit
StillOnFileCreateExit
Main Power off!!
2 NextMode: 1, ThIdle: 1
AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!
Main Power off!!
2 NextMode: 1, ThIdle: 1
AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!
Main Power off!!
2 NextMode: 1, ThIdle: 1
AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!
Main Power off!!
2 NextMode: 1, ThIdle: 1
AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!

##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####
Main Power off!!
2 NextMode: 1, ThIdle: 1
HCE_PowerOff()
MOFF
GPIO_LCDONOFF =1HCE_PowerOff() 2
        Save Param
HCE_SaveOptions
USP saved successfully.
        END
        Set Display
LCDOFF
MON
GPIO_LCDONOFF =0

Image capture

XLGPIO pressed is 4

##### Msg handled by General: [5000][00000004]-[XL_GPIO_BUTTON_NOTIFICATION] #####
bEnableCapture: 1Capture is just pressed
TaskStill_CapImage Create Element
HceWave_PlyByEnum a:\wave\Still\shutter.wav
BrowseAudioStart
THR - Browse Audio

##### Msg handled by General: [0100][00000100]-[USER] #####
Audio Openned:
   AVC Codec: Rate - 8000, Compression - 1, Channels - 1
   File: Rate - 8000, Compression - 1, Channels - 1
THR - AudioProc

##### Msg not handled: [1b00][00000001]-[VALID_AUDIO] #####
THR - AudioCodecPlay
AVC Enable()
XLGPIO pressed is 6

##### Msg handled by General: [5000][00000006]-[XL_GPIO_BUTTON_NOTIFICATION] #####
carson -- TX_QUEUE_EMPTY
AppSetMode 0x50 0

##### Msg handled by Quene: [6100][00000000]-[WAV_OPERATION_COMPLETE] #####
StillOnModeStart 0 -> 1
StillOnModeEnd 0. Next mode is 1
StillStartMode 1 0
THR - CaptureMode

##### Msg handled by General and Queue: [0800][00000050]-[NEW_MODE] #####
AE stats aborted in the middle of transaction.
THR - Sensor
THR - Sensor

##### Msg handled by Quene: [5d00][00000000]-[CAPTURE_RAW_READY] #####
THR - StatAe

##### Msg handled by General: [0800][00000080]-[NEW_MODE] #####

##### Msg not handled: [6500][00000000]-[SEND_CONFIRM_STORE] #####
I43_ConfirmStore - 1
StillOnModeEnd 1. Next mode is 0
StillStartMode 0 0
StillPreviewStart
THR - PreviewMode
Ray ---------------Light Source is 255
StillPreviewMain

##### Msg handled by General: [0800][00000040]-[NEW_MODE] #####
Actual file size - 180696

##### Msg not handled: [1400][00000000]-[STORE_BEGIN] #####

##### Msg not handled: [5c00][00000000]-[DISPLAY_WINDOW_COMLETE] #####
Store time is 0.66 seconds (0.25 MB/sec)
Store Done

##### Msg not handled: [1600][00000000]-[BKG_STORE_COMPLETE] #####
HCE_SetWhiteBalance[0]
AwbSetMode 16
HceOsdDrawBattery level 4

 **GetStorageMediaStatus type = 0 **
I43_GetStorageMediaStatus - 0
Total Pic 5
Pic Left230

##### Msg handled by Quene: [6c00][00000000]-[STORE_FINISHED] #####

View image

Read ADC1 Button 3
Enter Pressed
ModeThumbnails_ThumNavGst 2
NextMode: 3, ThIdle: 1
2 NextMode: 3, ThIdle: 1

##### Msg handled by General and Queue: [0100][00000100]-[USER] #####
ModeThumbnails_ThumNavGst 2
AsdMode_ChgModeDesed Create Element
AppSetMode 0x30 1
BrowseOnActive
BrowseEndMode
BrowseIndexEnd
AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!

##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####
ModePlayback_PlyBckConst Create Element

                        >>>>>>>> ModePlayback.c: Setting Playback mode

 **GetStorageMediaStatus type = 0 **
I43_GetStorageMediaStatus - 0
ModePlayback_RstCurImg Create Element
MsgH_SetCurEleDGst 3
I43_GetDCFInfo
I43_GetFileAttributes - OK
AppSetMode 0x90 -1
BrowseOnActive

##### Msg handled by General: [0100][00000000]-[USER] #####
BrowseOnModeStart
BrowseEndMode
BrowseImageStart
THR - Image

##### Msg handled by General and Queue: [0800][00000090]-[NEW_MODE] #####

##### Msg handled by Quene: [1a00][00000001]-[VALID_IMAGE] #####
Read ADC1 Button 31
ModePlayback_RstCurImgEnd
BrowseOnModeEnd
MsgH_SetCurEleDGst 0
Hce_PlaybackOsd: Validity-Image[1]Audio[1]FileType[1]

                         ## jpeg file ##
HceOsdDrawBattery level 4

##### Msg handled by General and Queue: [0800][000000c0]-[NEW_MODE] #####
Hce_PlaybackOsd: Validity-Image[1]Audio[1]FileType[1]

                         ## jpeg file ##
HceOsdDrawBattery level 4

##### Msg handled by General: [0100][00000000]-[USER] #####

Change mode to "Settings"

HCE_ReadFGPIOButtons 0x04
##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####

##### Msg handled by General: [0100][00000100]-[USER] #####
HCE_ReadFGPIOButtons 0x05
##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####

##### Msg handled by General: [0100][00000100]-[USER] #####
NextMode: 7, ThIdle: 1
2 NextMode: 7, ThIdle: 1
HceSetSwitchWorkMode WorkModeId: 7AsdMode_ChgModeDesed Create Element
AppSetMode 0x30 1
BrowseOnActive
BrowseEndMode
BrowseMenuEnd

##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####
HCE_SetupMenuConstructor Create Element
AppSetMode 0x0 -1
BrowseOnActive
Go to Menu mode!!!BrowseOnModeStart
BrowseEndMode
BrowseOnModeEnd

         >>>>>> MNU_SetupListConstr
Draw Jpeg [A:\JPEG\BG_SU.JPG]
_ASDM_ST_CUR_MODEID 7
HceOsdDrawBattery level 4
Draw Jpeg [A:\JPEG\BRI_Y.JPG]
Draw Jpeg [A:\JPEG\AON_W.JPG]
Draw Jpeg [A:\JPEG\S3M_W.JPG]
Draw Jpeg [A:\JPEG\DTS_W.JPG]
Draw Jpeg [A:\JPEG\NTS_W.JPG]
Draw Jpeg [A:\JPEG\F60_W.JPG]
Draw Jpeg [A:\JPEG\LEN_W.JPG]
Draw Jpeg [A:\JPEG\VER_W.JPG]
Draw Jpeg [A:\JPEG\DEF_W.JPG]

##### Msg handled by General and Queue: [0800][00000000]-[NEW_MODE] #####

Set volume to "Low"

Read ADC1 Button 2
Right Pressed
Draw Jpeg [A:\JPEG\BRI_W.JPG]

 ## passed jpeg no. = 16 ##
Draw Jpeg [A:\JPEG\AON_Y.JPG]
Move MENU_CURITEM 1

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 31

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 3
Enter Pressed
Draw Jpeg [A:\JPEG\BG_SU.JPG]
_ASDM_ST_CUR_MODEID 7
HceOsdDrawBattery level 4
_ASDM_ST_CUR_MODEID 7
*************HCE_DrawSubMenuTitle uStartX 212, uStartY 18

##  jpeg index = 16  ##
Draw Jpeg [A:\JPEG\AON_Y.JPG]
uStartX,376 uStartY,190 uStartW,300 w,57
wreal 82
uStartX,376 uStartY,280 uStartW,300 w,53
wreal 77
uStartX,376 uStartY,370 uStartW,300 w,44
wreal 64

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 31

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 5
Down Pressed

##  jpeg index = 17  ##
Draw Jpeg [A:\JPEG\AON_Y.JPG]
uStartX,376 uStartY,190 uStartW,300 w,57
wreal 82
uStartX,376 uStartY,280 uStartW,300 w,53
wreal 77

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 31

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 3
Enter Pressed
HCE_SaveOptions
USP saved successfully.
        END

         >>>>>> MNU_SetupListConstr
Draw Jpeg [A:\JPEG\BG_SU.JPG]
_ASDM_ST_CUR_MODEID 7
HceOsdDrawBattery level 4
Draw Jpeg [A:\JPEG\BRI_W.JPG]
Draw Jpeg [A:\JPEG\AON_Y.JPG]
Draw Jpeg [A:\JPEG\S3M_W.JPG]
Draw Jpeg [A:\JPEG\DTS_W.JPG]
Draw Jpeg [A:\JPEG\NTS_W.JPG]
Draw Jpeg [A:\JPEG\F60_W.JPG]
Draw Jpeg [A:\JPEG\LEN_W.JPG]
Draw Jpeg [A:\JPEG\VER_W.JPG]
Draw Jpeg [A:\JPEG\DEF_W.JPG]

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 31

##### Msg handled by General: [0100][00000100]-[USER] #####
Retrieved from "https://wiki.recessim.com/w/index.php?title=Disney_Flix_Camcorder&oldid=1921"