Hi check out this cool on air uh display light I scored on eBay It's really quite neat. It's one of these um, etched, uh, polycarbonate? um surfaces like this so it's actually etched in the back there. It's actually routed in there and it just lights it up on the edge and it's really quite neat. I Thought you know it' be nice thing to stick on the wall and have it when I'm actually recording.

Makes it feel like a professional recording studio. you know, fantastic because one of the more annoying aspects of my Canon Hfg10 video camera I'm using to record this blog is that there's no light on top to tell me when it's actually recording. especially not like right in line with the lens. So I'm looking at the lens instead of looking at the screen like this because what it? uh, all it has.

You've seen these video cameras very common. They've only got a little record light, one of those little red circles. it's only tiny. It's on the LCD when I hit record that pops up.

Sure enough, it's telling me it's recording. but sometimes I sit here yapping away in front of the camera for 5 minutes and I realize I haven't hit record or I well I pressed it and it didn't register or I I pressed it and accidentally stopped instead of start a recording and occasionally I lose uh, info. It's really annoying. So I thought it'd be nice to maybe hack in this thing into the camera.

I'm obviously not going to stick this on top of the camera, it would just be a fun thing to have up on the wall, but it'd be nice if was synchronized to my video camera to the actual record function in the video camera. So I thought maybe, is there some way I can hack it into the Uh camera itself and um I I don't know if it's possible. so that's what this video is going to be about. A start of an investigation into the Lanc wireless standard.

This is one of these wide remote controls I've got for my camera. It's not a genuine Canon one, but uh, it allows you to zoom in and zoom out and change the rate of how fast you zoom in and zoom out and stuff like that and allows you to start and stop recording as well. This and uh, set the focus. It's got a few other features which don't work on this Canon camera cuz um, the protocol is called Lan C Lnc and I believe it's originally it's mostly on Sony cameras, but the Canon ones do have it too.

and uh, it. it is a bit of a standard, but not all cameras Implement all functions and I've heard that apparently. uh, not only can you send signals to the camera to start, stop, and do stuff like that, but I think it actually sends out data on this one wire bus as well. it's a one wire, it's a five I believe it's a 5V one wire bus I haven't actually uh checked it yet I've just done a little bit of Googling and apparently it might actually send out some data.

So if it does send out a data saying I'm recording, maybe I can tap into that and turn on an LED or something like that. you'll light up or switch a Reay which you know lights up this sign or something. So I thought I'd just have a look. take this thing apart and uh, try and capture the data on this land SE bus and see what I get.

let's give it a go. Hang on. Oh I'll show you a really annoying look rant time. Okay, you design one of these.

Okay, you're in a quiet recording studio. Okay, and look, you can hear the tactile button. It's ridiculous. Why use tacked buttons? Why not use the soft rubber ones so you can't hear them? It's bloody ridiculous.

I'm going to press stop now now. this is actually a bank brand one. It's just one of these cheap you know eBay uh imitation ones and there are a couple of screws on the back and annoying. a couple of screws under the uh under the overlay on the top there and I had to peel that back and get the screws out.

But anyway, we are in in like Flynn. Here we go there we go. Tada and we got one chip on the back and that's it. Let's take a look at it and there's not much on here at all.

We've got a Holte brand uh, micro controller here there. reasonably common in like very extremely low cost, uh, consumer gear. We've got a resonator here and we've got looks like a some sort of regulator there and a couple of electrolytic caps and a few um so 23s and Dodes and other stuff. Got a bit more than what I thought would be in there, but anyway, yeah, there's not, uh, not much at all.

We've got the um, we've got the soft button uh switches down here, which of course the overlay goes on top. They've got the, you know, the carbonized um uh bit on the bottom of the rubber, the conductive uh bit there which just shorts out the two tracks on the board. We've got these annoying tacked switches why generate too much noise ridiculous, and um, we've got a rotary uh encoder switch here to choose the different Um values for the uh, speed control and that's about it. Anyway, um, we've only got the it looks like we've got um, three wires coming in, so one is presumably power ground and the other's data obviously based on the colors I'd say white your data and Red's your power and blacks your ground.

So you should be able to hook the scope onto this thing and capture the data Well coming out of this thing into the camera, but more importantly, to see if anything's coming out of The camera. into this board so that we can, possibly, uh, design our own little widget and uh, capture that data. All right, let's do some measurements here. First off, we've got our our ground is on the side of the cap there, so same as the input pins, but it's easier to probe the solder pads there and we get in.

Hey, 5.68 That's rather unusual. That's what we got coming in on the red and the black wires. Why? that's not 5 Vols It's clearly not. You know your regular 5 Vols plus minus 5% it's not your normal 5V Supply rail.

So that's rather odd. and let's measure the Um. Presumably this electrolytic here is on the output of this voltage regulator. so I don't even need to know the pin out of the regulator.

And hey, no surprises at all. 3.3 Vol rail. So um, it looks like the microcontrol is power from the 3.3 Vol Rail and uh, presumably that little I'm going to guess that that transistor there is the open collector switching transistor for the bus Which pulls that bus line low. That would be my guess.

and I've just solded a quick and dirty lead onto there so that I can attach my scope probe onto here. and uh, you know, because you don't want to be trying to hold it. you know, probe it on there and operate the scope. When you're trying to reverse engineer these things and hack them, it's just.

it's just not good. So let's hook that up the scope and see if we can capture anything. And sure enough, we are getting something on there. We're getting in multiple data packets.

Look at that. No problems at all. Now one of the uh problems with my Uh Agilant 3000 Series scope here is that it doesn't. It's got really good uh signal.

um, like many different uh triggering modes like a Serial decode modes. but it doesn't have um, one wire. Buss So um, it's You know it's just really annoying. So I'll just decode this manually.

but what? I like I can just you know, sing single shot, capture that and have a look. but you'll notice that the triggering is not that stable. it jumps around. So what I'm going to do is just try and just for the fun of it.

Not that I really need to, but I'm going to try and get a stable trigger based on the Dead period in there where it's high. So to do that, what we do is we capture it here and we can see we're getting about 10 milliseconds per division here. so it's roughly 10 milliseconds that that. Well, it's actually slightly less than 10 milliseconds by looks of it, where it's high.

So what we want to do is we want to go into our trigger menu here. and instead of our regular Edge trigger, we want to set a pulse width trigger and we want the sources channel one of course. But and we want it to be high so we choose the high one there for greater than so not less than, but greater than 20. NCS We want it greater than let's say 6 milliseconds, 5 or 6 milliseconds or to do it because is there's nothing else in there A getting fussy now 6.0 milliseconds, let's try that and so when it detects a 6 millisecond High period like that it will trigger.

So now we should get a very stable trigger. Hopefully fingers crossed, let's try it. There we go. Perfect! Bingo And that's a way to get nice steady triggering on your scope in order to see those packets.

Beautiful! So now we can actually singleshot capture this. and at first I thought oh okay, this is you know these are individual packets like this, but uh, zooming in because I I knew that it was, uh, supposed to be like a Um 8 bit. uh, field there, supposed to be a start bit and then a stop bit at the end of it. It just didn't seem right.

And what's actually happening is this entire packet here is not one packet of data. It's actually 1, 2, 3, 4, 5, 6, seven, or eight I think eight packets of data. Now this seems to be matching the information on the way I found on a website. Uh, precisely.

We've got one bunch of information here, which they call a telegram apparently. So one telegram of information contains those eight individual packets of one start bit, eight Dat bits, and one stop bit. And the distance between two telegrams. uh, varies depending on the type of camera now.

I'm in Australia So I've got a Pal camera I didn't import this one. it's an Australian version, so it uses the Power standard and it apparently has 20 milliseconds between. it's not quite. I I haven't got the cursor right in there I Could go in there and set it up, but it's supposed to have 20 milliseconds between the Uh telegrams there and the Ntsc version has 16.6 milliseconds.

So I'm certainly getting very close to my 20 there. And each individual packet 1, 2, 3, 4, 5, 6, seven, eight of them here. Um, the distance between those is supposed to be supposed to be uh, 100. Uh, 1.2 milliseconds to 1.4 I Believe.

So there you go. I'm getting 1 point we can get in there I'm getting 1.26 or thereabouts, 1.25 milliseconds between the individual packets. And one of the good things about and with each bit by the way, being 104 microc. so if we go in there and have a look at that, we can now.

is it 104? It is Bingo 100 and 4 or pretty close to it. And the good thing about this is that apparently the timing is exactly the same as Rs232 at 9600 boards. So maybe I can actually, uh, use my serial decode feature after all. So if we go into our serial trigger mode here, we can set it up for RS art Rs232 and we can set the signals up.

Channel one is our receive. We're not worrying about our trans MIT we don't have it and our bus uh configuration. We can set it up eight data bits. uh, no.

parody the board rate 9600 bits per second. so we're right there. and the uh bit Auto least significant bit first. So Bit Zero First, when you zoom in there, it'll be Bit Zero first 1, 2, 3, 4, 5, 6, 78.

So let's give that a go and we should be able to decode that. and there it is. and it doesn't like that at all. It's decoding the odd bit.

but I think we've got our polarity idle low. Incorrect here. We're idling high so we need to switch that to idle high and let's single shot trigger that again. Bingo There you go.

We now have our decoded data. beautiful and we can see that changing in real time. Fantastic because this scope actually does Hardware decoding of this uh, serial interface in real time so we can even trigger off um, certain data bits if we or certain bites if we want to. Now, because this is continually changing like this and I'm not pressing any buttons on the remote control, then I'm going to presume that.

uh, the uh, the controller. The wide remote control doesn't actually send any information until you press a button it I It just wouldn't make sense to do that. I could be wrong, but uh, gut feel says it's not going to do that. So clearly data is changing here.

So this indicates that this is changing data being output from the camera. So I think the camera is well and truly outputting some sort of data either a Time code or something like that which I've read. it actually might do. Um, so cuz that almost looks like it's doing some sort of counting.

You know, very fast, some sort of uh counting thing as it goes up or something like that. It's certainly outputting some sort of information. and then we're getting this: BLiP BLiP BLiP BLiP BLiP BLiP thing happening here I'm not sure what's going on there all right now. Let's see what happens here.

if I press the zoom button bang. Look at that. The first two bites there are first two packets are changing. the other ones seem to be continuing on their merry way.

and if I hold it down, let's zoom into those first two packets. Shall We There We go. So we're in there. Let's turn off the cursors for a minute and let's press the down the zoom out I Think it is.

Bingo. Look at that. Those two bits certainly changing and so what it looks like Happening Here is that. some like the first two bites are input bites.

so they're input bites to the camcorder, whereas these ones over here seem to be output bytes that are outputting information so the first one. So if I press the zoom out I believe there's that consistent pattern there. There it is. and if I do the other one zoom in Bingo it's exactly the same.

The first bite's exactly the same if I alternate between the two. but you'll notice that this second one here that zoom out and zoom in doesn't have that Bingo that works really well. So it goes from FF to so we're looking at uh D7 uh there the in HEX of course uh D7 and FD is the zoom in I believe and then zoom out. Aha look the datab bits changing cuz I've changed my rotor encoder so it is now zooming in and zooming out as I press those buttons.

but if I put my rotor encoder to a certain spot, I can get it. so it actually ah, look yeah, it's changing. Okay, so there's not. Doesn't look like there's a fixed code based on just the zoom in.

zoom out. It's a code based on what level of zoom in and zoom out you have. So if I hold, let's say if I hold down, zoom out and I change the rotor encoder. It's not a rotor encoder, it's a switch.

There we go. So I'm turning the switch. and it's cycling through Bingo There you go. It's got a different command, so there it is as I I press these switches and so I hold in the zoom and I can touch the switch faster faster faster slower to a point where I can actually get it to.

yeah, it's tiny so you hardly even notice I'm holding that and it's slowly zooming out. There we go. So that's uh, that's rather neat. We're certainly capturing this data and it looks like it is outputting here.

Then that's really what we're interested in. and what I'm doing quickly now is just pressing the record off and on. Obviously, I can't capture the screen the same time as I'm not recording. but I can't see any differences in these packets here.

These bites here. these three which are after the first two. so that's B uh, uh, 2, three and four. I can't see anything in there when I start and stop the record button I can't see anything change so there's nothing happening there.

And of course I don't have to. uh, dick around trying to reverse engineer this because somebody else has already done it for me and the info is on that uh website and but it doesn't mean it's going to be specific to this particular camera though because not all cameras, especially canons don't Implement everything. But it basically says that the uh, fourth packet here. the fourth bite is the one that contains the status information coming from the camera.

So we've got uh b01 2, 3, 4 so that one in there with the double bit, that's the one. the double low there. that's the one we're interested in. that's the one we want to see and we'll see if it changes.

So I'm going to press, uh, stop here and see if it there's any difference. No, unfortunately not. I pressed, uh, stop. And that packet did not change at all.

That individual bite didn't change, Not a sausage. didn't see it. Damn thing. That's disappointing.

That's supposed to be the status coming from the camera. So maybe this whole idea is shut down right there. Maybe this Canon camera just does not output. its.

uh, record, stop, you know, play pause status. Bummer. And these last three packets here I'm not seeing any change there at all. We're getting data out of it.

but I'm I'm not. Don't care too much about that. I'm pressing, stop and start and record here and I'm not seeing. it's just you know, it's just outputting a whole bunch of data which might be some sort of time code, but I can't see any like fixed individual bit change in there when I press start and stop.

So this is not looking at all promising. What a bummer. Well I think I've had enough for today I can't find it I expected to see at least one of those bits in there. sort of toggle um when I pressed the record button but unfortunately I'm not seeing that at all.

I'm going to have to review the footage again, play around with it some more. but I think I'll call it quits for now. But anyway, that was a an interesting first investigation anyway into the L Sea Bus and uh, what it outputs from this Canon HF G10 camera. So I it's worthy of a bit more investigation.

So if you noticed uh, something on the video or you know something more about it specifically for this uh, Canon or Canon cameras in general, um, please let me know, jump on over to the Uh Forum or put it in the comments or something like that. So I hope you enjoyed that. Just a quick little uh, sort of hack debugging video there. and as always, if you like the video, please give it a thumbs up and I'll catch you next time.

Um.