Chicken: typos

2023-10-02T04:01:20Z

typos

Chicken: page created

2023-10-02T03:53:08Z

page created

New page

[[File:Disney Flix Camcorder.jpg|none|thumb|Disney Flix Camcorder, ~2007 vintage]]
Surprisingly, this toy camcorder made for an interesting teardown.

Given the bare-bones simplicity and working serial port, it could be a worthwhile target to reverse engineer the Zoran Coach architecture. Zoran Coach for a while was the dominant SoC found in many consumer point & shoot cameras of the late 2000s to early 2010s. https://en.wikipedia.org/wiki/Zoran_Corporation was bought by CSR, who was then later sold off its camera IP to Qualcomm.

The camera is also unique, in that it isn't a rats nest of flat flex cables, but mostly uses right-angle pin-headers as interconnect between circuit boards (the exception being the display). This will make it easy to tap into signals between image sensor and SoC, or to automate camera controls with an MCU.

== Teardown pictures ==
[[File:Disney Flix Camcorder Main PCB Front.jpg|none|thumb|Main PCB, front]]
<br />
[[File:Disney Flix Camcorder Main PCB back.jpg|none|thumb|Main PCB, back]]
[[File:Disney Flix Camcorder Sensor PCB Front.jpg|none|thumb|Sensor PCB, front]]
[[File:Disney Flix Sensor PCB back.jpg|none|thumb|Sensor PCB, back]]
[[File:Disney Flix Camcorder Controls PCB front.jpg|none|thumb|Controls PCB, front]]
[[File:Disney Flix Camcorder Controls PCB Back.jpg|none|thumb|Controls PCB, back]]
[[File:Disney Flix Camcorder Display PCB back.jpg|none|thumb|Display PCB, back]]
[[File:Disney Flix Camcorder Construction.jpg|none|thumb|Assembled camera, without enclosure. Note the pin-header interconnects.]]

== Parts identification ==

=== Main PCB ===
U1 Zoran '''ZR36440BGCF''' Coach 6e Digital Camera Processor

U3 Elpida '''S6416GHTA-10-E''' 4Mx16b (8MB) SDRAM

U4 Hynix '''HY27US08121A''' 64Mx8b NAND Flash (under SD Card slot)

U251 Holtek '''HT82V735''' 330mW Stereo Audio Power Amp

U302 marking '''DE-K1L''', SOT-23-5 LDO?

U??? '''m'''arking '''DC-U06''', SOT-23-5 LDO?

U??? marking '''D A- 9JS2Q''', 6-pin package, Boost Converter?

J1 debug header (see below)

=== Sensor PCB ===
U? Silicon Optronics Inc. '''SOI-968''' image sensor

* 1.3MPixel (SXGA), CMOS
* Datasheet [https://web.archive.org/web/20231002032056/http://file1.dzsc.com/product/13/05/14/854235_135052437.pdf available]

U? JRC '''NJM4580M''' dual audio op amp

* Likely for microphone and/or audio jack on same board

=== Display ===
Marking on flatflex: Tp037A

Boot message: LCD = TOPPLY_TP033B

== Serial debug port ==
A serial debug port is available on four pads marked as J1:

UART parameters: 115200 8N1

Pinout (starting at J1 label): 3.3V, TX, RX, GND

=== Logs ===

==== Boot ====
<syntaxhighlight lang="c">
Boot - VER: HW=0x62B0, FW=0x0463.19
CODE = 1042192 byte, DATA = 52888 byte
THR - Z2c Writer
LCD = TOPPLY_TP033B
CODEC = AVC
THR2 - HCE
RESIDENT = NAND (SR)
CARD = SD
RES A - OK
RES B - OK
RES C - OK
THR2 - AgentServer
THR2 - StillServer
THR2 - BrowseServer
MON> THR2 - Monitor
ÿCTLut - 92x85
Hce proc started
HceOnCreate
HceOnCreate Create Element
HceOnCreate_SD

##### Msg handled by General: [0500][00000000]-[CREATE] #####
HceOnCreate_SD
AgentOnSetMsMedia
>>>>>>>HceOnMsg: FlashCardDetect = 0
Next St = 1HceOnCreate_WaitIdle

##### Msg handled by Quene: [0700][00000000]-[FLASH_CARD_DETECT] #####
HceOnCreate_WaitIdle
Next St = 2ADC0 Value is 31
HCE_ReadFGPIOButtons 0x01
>>##>>## init capture key = 1
SENSOR - SOI968
!Kenny SOI968 sensor
Init RTC
HCE_InitOptions
HCE_ChkUSPExist USP.bin Exist!!

B:\USP.BIN restored successfully.
Do Nothing
END
Hce_SetFlickerFormat[1]
AeSetAgcMode 1
AeSetAeMode 1
AeSetPreviewExpLimit 45 127
AeSetCaptureExpLimit 45 127 255 255
0:(235,399)
1:(234,413)
2:(300,371)
3:(318,281)
4:(318,281)
R(234,318) B(281,413)
ulAwbLutSize(Gr,Gb) = (40,46)
I43_SetImageSize - OK
StillOnSetCompressionRatio
AeSetExpDeviation 16
HCE_SetWhiteBalance[0]
AwbSetMode 16
StillOnIsspuLs 0
StillOnIsspuClpf 1
StillOnIsspuLc 0

**MountStorageMedia type = 0 **
I43_MountStorageMedia - 0
AgentOnSetMsMedia
:::HCE::: Media Mounted Success

**GetStorageMediaStatus type = 0 **
I43_GetStorageMediaStatus - 0

## refresh photo num is true ##

**GetStorageMediaStatus type = 0 **
I43_GetStorageMediaStatus - 0
uAviSecondsRemain[90] ulSpaceLeft[41615360]
uMovieMinSize[540672]uMovieSizeParam[451730]

**GetStorageMediaStatus type = 0 **
I43_GetStorageMediaStatus - 0

load ASDUI.bin
GdiLoadFont - \UI.BIN

init osd clut
>>>>>>> HceOsd: Init - OSD

init font color & size

## HCE_PAviInit ##

## HCE_PAudio Init ##

>>> init ClockCheck
HCE_InitClockCheck
LCD = TOPPLY_TP033B
HceDlcdSetPins
Send Reg. Th to TP051!!
TopplyDlcdInit ...
>>>>>>> HceLcd.c: LCD mode
LCDON
GPIO_LCDONOFF =1MOFF
BATTERY STABLE [172]
AppSetMode 0x30 -1

##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####
ADC0 Value is 31
Read ADC1 Button 31
HCE_ReadFGPIOButtons 0x01
##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####
XLGPIO pressed is 6

##### Msg handled by General: [5000][00000006]-[XL_GPIO_BUTTON_NOTIFICATION] #####

##### Msg not handled: [1d00][00000000]-[MOUNT_DUPLICATED_FOUND] #####
AgentOnUsbConnect
THR - UsbAgent
THR - CmdDispatcher
NextMode: 6, ThIdle: 1
Usb Agent: Disconnect Event
2 NextMode: 6, ThIdle: 1

##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####
AsdMode_ChgModeDesed Create Element
HCE_AviConstructor
HCE_AviConstructor Create Element

>>>>>>>> ModeAvi.c: Setting Avi mode
BrowseOnSetAudioCompression 1
Video image size 640 480
I43_SetImageSize - OK
Video image size 640 480
I43_SetImageSize - OK
StillOnSetCompressionRatio
StillOnSetRecordingTime 65535
BrowseOnSetRecordingTime 65535
AeSetExpDeviation 16
HCE_SetWhiteBalance[0]
AwbSetMode 16
AeSetAgcMode 1
AeSetAeMode 1

**MountStorageMedia type = 0 **
I43_MountStorageMedia - 0
AgentOnSetMsMedia
:::HCE::: Media Mounted Success
AppSetMode 0x40 -1
StillOnActive -1
THR - Store
THR - FileCreator
THR - Aaa
AAA start.
Go to view mode!!!StillOnModeStart 3 -> 0

##### Msg handled by General: [0100][00000100]-[USER] #####
StillPreviewActive

##### Msg handled by General: [0100][00000100]-[USER] #####
StillStartMode 0 0

##### Msg handled by General: [0100][00000100]-[USER] #####
StillPreviewStart

##### Msg handled by General: [0100][00000100]-[USER] #####
THR - PreviewMode

##### Msg not handled: [1d00][00000000]-[MOUNT_DUPLICATED_FOUND] #####
StillPreviewMain
THR - Sensor

##### Msg handled by General and Queue: [0800][00000040]-[NEW_MODE] #####
THR - StatAe
HceAviConst_WaitNF
HceAviConst_WaitNF
HceAviConst_WaitNF
HceAviConst_WaitNF
HceAviConst_WaitNF
_ASDM_ST_CUR_MODEID 6
HceOsdDrawBattery level 4

</syntaxhighlight>

==== Power down ====
<syntaxhighlight lang="c">
HCE_ReadFGPIOButtons 0x01
##### Msg handled by General: [5100][00000000]-[FG_GPIO_BUTTON_NOTIFICATION] #####

##### Msg handled by General: [0100][00000100]-[USER] #####
NextMode: 1, ThIdle: 1
2 NextMode: 1, ThIdle: 1
HceSetSwitchWorkMode WorkModeId: 1Main Power off!!
2 NextMode: 1, ThIdle: 1
HCE_AviDestructor
HCE_AviDestructor Create Element
AsdMode_ChgModeDesed Create Element
AppSetMode 0x30 0
StillOnActive 0
StillOnModeEnd 0. Next mode is 0
StillPreviewStop
StillAbort
AWB stats aborted in the middle of transaction.
AAA process terminating !!!
StillOnAaaExit
StillOnStoreExit
StillOnFileCreateExit
Main Power off!!
2 NextMode: 1, ThIdle: 1
AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!
Main Power off!!
2 NextMode: 1, ThIdle: 1
AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!
Main Power off!!
2 NextMode: 1, ThIdle: 1
AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!
Main Power off!!
2 NextMode: 1, ThIdle: 1
AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!

##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####
Main Power off!!
2 NextMode: 1, ThIdle: 1
HCE_PowerOff()
MOFF
GPIO_LCDONOFF =1HCE_PowerOff() 2
Save Param
HCE_SaveOptions
USP saved successfully.
END
Set Display
LCDOFF
MON
GPIO_LCDONOFF =0

</syntaxhighlight>

==== Image capture ====
<syntaxhighlight lang="c">
XLGPIO pressed is 4

##### Msg handled by General: [5000][00000004]-[XL_GPIO_BUTTON_NOTIFICATION] #####
bEnableCapture: 1Capture is just pressed
TaskStill_CapImage Create Element
HceWave_PlyByEnum a:\wave\Still\shutter.wav
BrowseAudioStart
THR - Browse Audio

##### Msg handled by General: [0100][00000100]-[USER] #####
Audio Openned:
AVC Codec: Rate - 8000, Compression - 1, Channels - 1
File: Rate - 8000, Compression - 1, Channels - 1
THR - AudioProc

##### Msg not handled: [1b00][00000001]-[VALID_AUDIO] #####
THR - AudioCodecPlay
AVC Enable()
XLGPIO pressed is 6

##### Msg handled by General: [5000][00000006]-[XL_GPIO_BUTTON_NOTIFICATION] #####
carson -- TX_QUEUE_EMPTY
AppSetMode 0x50 0

##### Msg handled by Quene: [6100][00000000]-[WAV_OPERATION_COMPLETE] #####
StillOnModeStart 0 -> 1
StillOnModeEnd 0. Next mode is 1
StillStartMode 1 0
THR - CaptureMode

##### Msg handled by General and Queue: [0800][00000050]-[NEW_MODE] #####
AE stats aborted in the middle of transaction.
THR - Sensor
THR - Sensor

##### Msg handled by Quene: [5d00][00000000]-[CAPTURE_RAW_READY] #####
THR - StatAe

##### Msg handled by General: [0800][00000080]-[NEW_MODE] #####

##### Msg not handled: [6500][00000000]-[SEND_CONFIRM_STORE] #####
I43_ConfirmStore - 1
StillOnModeEnd 1. Next mode is 0
StillStartMode 0 0
StillPreviewStart
THR - PreviewMode
Ray ---------------Light Source is 255
StillPreviewMain

##### Msg handled by General: [0800][00000040]-[NEW_MODE] #####
Actual file size - 180696

##### Msg not handled: [1400][00000000]-[STORE_BEGIN] #####

##### Msg not handled: [5c00][00000000]-[DISPLAY_WINDOW_COMLETE] #####
Store time is 0.66 seconds (0.25 MB/sec)
Store Done

##### Msg not handled: [1600][00000000]-[BKG_STORE_COMPLETE] #####
HCE_SetWhiteBalance[0]
AwbSetMode 16
HceOsdDrawBattery level 4

**GetStorageMediaStatus type = 0 **
I43_GetStorageMediaStatus - 0
Total Pic 5
Pic Left230

##### Msg handled by Quene: [6c00][00000000]-[STORE_FINISHED] #####

</syntaxhighlight>

==== View image ====
<syntaxhighlight lang="c">
Read ADC1 Button 3
Enter Pressed
ModeThumbnails_ThumNavGst 2
NextMode: 3, ThIdle: 1
2 NextMode: 3, ThIdle: 1

##### Msg handled by General and Queue: [0100][00000100]-[USER] #####
ModeThumbnails_ThumNavGst 2
AsdMode_ChgModeDesed Create Element
AppSetMode 0x30 1
BrowseOnActive
BrowseEndMode
BrowseIndexEnd
AsdMode_ChgModeDesed Create Element Fail: This Element already exist!!

##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####
ModePlayback_PlyBckConst Create Element

>>>>>>>> ModePlayback.c: Setting Playback mode

**GetStorageMediaStatus type = 0 **
I43_GetStorageMediaStatus - 0
ModePlayback_RstCurImg Create Element
MsgH_SetCurEleDGst 3
I43_GetDCFInfo
I43_GetFileAttributes - OK
AppSetMode 0x90 -1
BrowseOnActive

##### Msg handled by General: [0100][00000000]-[USER] #####
BrowseOnModeStart
BrowseEndMode
BrowseImageStart
THR - Image

##### Msg handled by General and Queue: [0800][00000090]-[NEW_MODE] #####

##### Msg handled by Quene: [1a00][00000001]-[VALID_IMAGE] #####
Read ADC1 Button 31
ModePlayback_RstCurImgEnd
BrowseOnModeEnd
MsgH_SetCurEleDGst 0
Hce_PlaybackOsd: Validity-Image[1]Audio[1]FileType[1]

## jpeg file ##
HceOsdDrawBattery level 4

##### Msg handled by General and Queue: [0800][000000c0]-[NEW_MODE] #####
Hce_PlaybackOsd: Validity-Image[1]Audio[1]FileType[1]

## jpeg file ##
HceOsdDrawBattery level 4

##### Msg handled by General: [0100][00000000]-[USER] #####

</syntaxhighlight>

==== Change mode to "Settings" ====
<syntaxhighlight lang="c">
HCE_ReadFGPIOButtons 0x04
##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####

##### Msg handled by General: [0100][00000100]-[USER] #####
HCE_ReadFGPIOButtons 0x05
##### Msg handled by General: [5100][00000010]-[FG_GPIO_BUTTON_NOTIFICATION] #####

##### Msg handled by General: [0100][00000100]-[USER] #####
NextMode: 7, ThIdle: 1
2 NextMode: 7, ThIdle: 1
HceSetSwitchWorkMode WorkModeId: 7AsdMode_ChgModeDesed Create Element
AppSetMode 0x30 1
BrowseOnActive
BrowseEndMode
BrowseMenuEnd

##### Msg handled by General and Queue: [0800][00000030]-[NEW_MODE] #####
HCE_SetupMenuConstructor Create Element
AppSetMode 0x0 -1
BrowseOnActive
Go to Menu mode!!!BrowseOnModeStart
BrowseEndMode
BrowseOnModeEnd

>>>>>> MNU_SetupListConstr
Draw Jpeg [A:\JPEG\BG_SU.JPG]
_ASDM_ST_CUR_MODEID 7
HceOsdDrawBattery level 4
Draw Jpeg [A:\JPEG\BRI_Y.JPG]
Draw Jpeg [A:\JPEG\AON_W.JPG]
Draw Jpeg [A:\JPEG\S3M_W.JPG]
Draw Jpeg [A:\JPEG\DTS_W.JPG]
Draw Jpeg [A:\JPEG\NTS_W.JPG]
Draw Jpeg [A:\JPEG\F60_W.JPG]
Draw Jpeg [A:\JPEG\LEN_W.JPG]
Draw Jpeg [A:\JPEG\VER_W.JPG]
Draw Jpeg [A:\JPEG\DEF_W.JPG]

##### Msg handled by General and Queue: [0800][00000000]-[NEW_MODE] #####
</syntaxhighlight>Set volume to "Low"<syntaxhighlight lang="c">
Read ADC1 Button 2
Right Pressed
Draw Jpeg [A:\JPEG\BRI_W.JPG]

## passed jpeg no. = 16 ##
Draw Jpeg [A:\JPEG\AON_Y.JPG]
Move MENU_CURITEM 1

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 31

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 3
Enter Pressed
Draw Jpeg [A:\JPEG\BG_SU.JPG]
_ASDM_ST_CUR_MODEID 7
HceOsdDrawBattery level 4
_ASDM_ST_CUR_MODEID 7
*************HCE_DrawSubMenuTitle uStartX 212, uStartY 18

## jpeg index = 16 ##
Draw Jpeg [A:\JPEG\AON_Y.JPG]
uStartX,376 uStartY,190 uStartW,300 w,57
wreal 82
uStartX,376 uStartY,280 uStartW,300 w,53
wreal 77
uStartX,376 uStartY,370 uStartW,300 w,44
wreal 64

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 31

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 5
Down Pressed

## jpeg index = 17 ##
Draw Jpeg [A:\JPEG\AON_Y.JPG]
uStartX,376 uStartY,190 uStartW,300 w,57
wreal 82
uStartX,376 uStartY,280 uStartW,300 w,53
wreal 77

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 31

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 3
Enter Pressed
HCE_SaveOptions
USP saved successfully.
END

>>>>>> MNU_SetupListConstr
Draw Jpeg [A:\JPEG\BG_SU.JPG]
_ASDM_ST_CUR_MODEID 7
HceOsdDrawBattery level 4
Draw Jpeg [A:\JPEG\BRI_W.JPG]
Draw Jpeg [A:\JPEG\AON_Y.JPG]
Draw Jpeg [A:\JPEG\S3M_W.JPG]
Draw Jpeg [A:\JPEG\DTS_W.JPG]
Draw Jpeg [A:\JPEG\NTS_W.JPG]
Draw Jpeg [A:\JPEG\F60_W.JPG]
Draw Jpeg [A:\JPEG\LEN_W.JPG]
Draw Jpeg [A:\JPEG\VER_W.JPG]
Draw Jpeg [A:\JPEG\DEF_W.JPG]

##### Msg handled by General: [0100][00000100]-[USER] #####
Read ADC1 Button 31

##### Msg handled by General: [0100][00000100]-[USER] #####

</syntaxhighlight>

@@ Line 2: / Line 2: @@
 Surprisingly, this toy camcorder made for an interesting teardown.
-Given the bare-bones simplicity and working serial port, it could be a worthwhile target to reverse engineer the Zoran Coach architecture. Zoran Coach for a while was the dominant SoC found in many consumer point & shoot cameras of the late 2000s to early 2010s. https://en.wikipedia.org/wiki/Zoran_Corporation was bought by CSR, who was then later sold off its camera IP to Qualcomm.
+Given the bare-bones simplicity and working serial port, it could be a worthwhile target to reverse engineer the Zoran Coach architecture. Zoran Coach in the late 2000s to early 2010s was the dominant camera SoC, found in many consumer point & shoot cameras. https://en.wikipedia.org/wiki/Zoran_Corporation was bought by CSR, who then later sold off its camera IP to Qualcomm.
 The camera is also unique, in that it isn't a rats nest of flat flex cables, but mostly uses right-angle pin-headers as interconnect between circuit boards (the exception being the display). This will make it easy to tap into signals between image sensor and SoC, or to automate camera controls with an MCU.
-== Teardown pictures ==
+==Teardown pictures==
 [[File:Disney Flix Camcorder Main PCB Front.jpg|none|thumb|Main PCB, front]]
 <br />
@@ Line 17: / Line 17: @@
 [[File:Disney Flix Camcorder Construction.jpg|none|thumb|Assembled camera, without enclosure. Note the pin-header interconnects.]]
-== Parts identification ==
+==Parts identification==
-=== Main PCB ===
+===Main PCB===
 U1 Zoran '''ZR36440BGCF''' Coach 6e Digital Camera Processor
@@ Line 36: / Line 36: @@
 J1 debug header (see below)
-=== Sensor PCB ===
+===Sensor PCB===
 U? Silicon Optronics Inc. '''SOI-968''' image sensor
-* 1.3MPixel (SXGA), CMOS
+*1.3MPixel (SXGA), CMOS
-* Datasheet [https://web.archive.org/web/20231002032056/http://file1.dzsc.com/product/13/05/14/854235_135052437.pdf available]
+*Datasheet [https://web.archive.org/web/20231002032056/http://file1.dzsc.com/product/13/05/14/854235_135052437.pdf available]
 U? JRC '''NJM4580M''' dual audio op amp
-* Likely for microphone and/or audio jack on same board
+*Likely for microphone and/or audio jack on same board
-=== Display ===
+===Display===
 Marking on flatflex: Tp037A
 Boot message: LCD = TOPPLY_TP033B
-== Serial debug port ==
+==Serial debug port==
 A serial debug port is available on four pads marked as J1:
@@ Line 58: / Line 58: @@
 Pinout (starting at J1 label): 3.3V, TX, RX, GND
-=== Logs ===
+===Logs===
-==== Boot ====
+====Boot====
 <syntaxhighlight lang="c">
 Boot - VER: HW=0x62B0, FW=0x0463.19
@@ Line 243: / Line 243: @@
 </syntaxhighlight>
-==== Power down ====
+====Power down====
 <syntaxhighlight lang="c">
 HCE_ReadFGPIOButtons 0x01
@@ Line 296: / Line 296: @@
 </syntaxhighlight>
-==== Image capture ====
+====Image capture====
 <syntaxhighlight lang="c">
 XLGPIO pressed is 4
@@ Line 370: / Line 370: @@
 </syntaxhighlight>
-==== View image ====
+====View image====
 <syntaxhighlight lang="c">
 Read ADC1 Button 3
@@ Line 429: / Line 429: @@
 </syntaxhighlight>
-==== Change mode to "Settings" ====
+====Change mode to "Settings"====
 <syntaxhighlight lang="c">
 HCE_ReadFGPIOButtons 0x04

Disney Flix Camcorder - Revision history

Chicken: typos

Chicken: page created