---

Disclaimer: This description is completely unofficial. Most of the information presented here is discovered by me, Eugene Crosser, while snooping the serial line and by trial and error. I never had an official protocol description, have never seen any related software source code, and have never done reverse engineering of any related software. This description may be incomplete, inaccurate or completely wrong. You are warned.

Some information is taken from `camediaplay' package by Jun-ichiro Itoh <itojun@itojun.org>, from the findings of Thierry Bousch <bousch%linotte.uucp@topo.math.u-psud.fr> TsuruZoh Tachibanaya <tsuruzoh@butaman.ne.jp> and from other (open) sources and not checked by me.

---

Serial Protocol of Some Digital Cameras

Protocol Basics

Protocol Elements

Packet structure

Known packet types are:

Type	Description
0x02	Data packet that is not last in sequence
0x03	Data packet that is last in sequence
0x1b	Command packet

Data packets that are sent in responce to a single command are numbered starting from zero. If all requested data fits in one packet, it has type 0x03 and sequence 0.

Command packet has subtype 0x43 or 0x53. Only the first command packet in a session has subtype 0x53.

Maximum length of data field in a packet is 2048 bytes, which yields in 2054 total packet length.

Checksum is a simple 16 bit arithmetic sum of all bytes in the data field. As already mentioned above, length and checksum values are transmitted least significant byte first.

Flow of Control

If the camera does not respond to a command in reasonable time, or responds with a NAK, the command can be resent. If the camera does not provide a complete data packet in reasonable time, or the data packet is corrupt (checksum does not match), the host can request resending of the packet by sending NAK instead of ACK.

Command format and codes

Five command codes are known:

Code	Argument	Description
0	int32	Set value of integer register
1	none	Read value of integer register
2	vdata	Take action unrelated to registers
3	vdata	Set value of vdata register
4	none	Read value of vdata register

Commands 0 and 3 are replied with a single ACK 0x06. Command 2 is replied with an ACK 0x06 followed by an "action complete" notifier 0x05. Commands 1 and 4 are replied with a sequence of data packets, each of them must be ACK'ed by the host.

Command 0 must be issued with a 4 byte argument containg the new value for the register (bytes in "LSB first" order). Command 2 typically is issued with a single zero byte as an argument. Command 3 is issued with an argument of variable number of bytes. If this is a printable string, it should not include the trailing zero byte.

Camera replies to the command 1 with a single data packet containing 4 bytes of a 32bit integer (in "LSB first" order). Camera replies to the command 4 with a sequence of data packets with variable number of data bytes. Note that if a printable string is returned, it is terminated with a zero byte, and thus may be safely printed or otherwise treated as a normal C language character string.

Registers

For command 2, the second byte is action code not register number. The following action codes are known:

Code	Argument	Description
0	single zero byte	Erase last picure
1	single zero byte	Erase all picures (but not animations)
2	single zero byte	Take picture
4	single zero byte	Finish session immediately
5	single zero byte	Take preview snapshot (retreivable as frame zero)
6	single byte	Calibration / testing. Arg value: 1 Calibrate autofocus 3 Test zoom/exposure 4-6 Store 0 in Reg 32 9 Load LCD Brightness (0-31) from Reg 32 10 Load LCD size (25 for Nikon Coolpix 950) from Reg 32 11 LCD Saturation (0-32) from Reg 32 13 LCD Red-Green (0-32) from Reg 32 14 LCD Blue (0-32) from Reg 32 15 Store -1 in Reg 32 16 Multi shot (locks up if lcd is on) 17 Take picture 18 Store -1 in Reg 32 20-23 locks up if lcd is on 24-255 Store -1 in Reg 32
7	single zero byte	Erase current frame *
8	single byte	Switch LCD mode. Arg value: 1 - Off 2 - Record 3 - Play (show current frame fullscreen) 4 - preview thumbnails (?) 5 - Thumbnail view (smaller?) 6 - Thumbnail view (larger?) 7 - Next 8 - Previous
9	single byte	Set protection state of current frame to the value of parameter (binary 0 or 1)*
11	single zero byte	Store freshly uploaded image into NVRAM (see appendix A)
12	single byte	LCD test. Arg value: 0 - white 1 - gray 2 - black 3 - red 4 - green 5 - blue 6 - test pattern

* Note: actions 7 and 9 only useful after setting register 0x04.

Date: Sun, 14 Jul 2002 01:28:39 +0200 (CEST)
From: =?iso-8859-1?Q?Peter_=C5strand?= <astrand(at)lysator.liu.se>
To: allyn(at)fratkin.com, <wolfgang(at)charlotte.wsrcc.com>, <crosser(at)average.org>
Subject: Upload on Olympus C-860L


FYI. 

Tonight, I've been struggling with uploading arbitrary pictures to my 
Olympus C-860L. I've finally found out that for the camera to accept the 
picture, to two conditions must be met:

1) The subsampling must be 2x1, 1x1, 1x1
2) The EXIF info must be just like the pictures the camera itself 
produces. 

So, I've made a small script to fix this. Feel free to include it in FAQs 
and/or photopc dists. 

/more/data/pics/olympus-reference-pic.jpg is just some picture taken with 
the camera. 

photopc-upload-all:

#!/bin/sh

TMPFILE=`mktemp /tmp/photopc-upload.XXXXXX` || exit 1

for file in $@; do 
    echo Converting $file...
    djpeg $file | cjpeg -sample 2x1 > $TMPFILE
    jhead -te /more/data/pics/olympus-reference-pic.jpg $TMPFILE
    echo Uploading $file...
    photopc upload $TMPFILE
    sleep 2;
done

rm -f $TMPFILE


-- 
/Peter Åstrand <astrand(at)lysator.liu.se>

Some Nikon models support an extension to the protocol described above, specifically designed for remote control units. This protocol allows to control zoom, emulate half-depress of the shutter release button, bulb operation and possibly more. <vladimir.vyskocil(at)wanadoo.fr> compiled a partial description of this protocol, available here.

Please mail your corrections/additions to <crosser at average dot org>
See http://photopc.sourceforge.net/ for possible updates.