Hacking the Canon Powershots

What's new

2004-10-05: A75 and S230 versions tested. Both work, though file corruption has been reported for sizes exceeding 180 seconds.
2004-10-06: Added instructions for flashing the A70 back to the original firmware.
2004-10-07: Added instructions for modifying the S230 and returning the original firmware to the A75 and S230.
2004-10-12: Some more test reports received, all successful.
2004-11-22: Version 2 of the A75 hack added. The SD100 version is currently being tested.
2005-01-08: Powershot Pro1 version added. FAQ added. Pages refactored.
2005-01-14: Updated the FAQ and moved it to a more prominent place. I haven't heard back from the guy who promised to try the SD100 version. If there's anyone else who wants to try it, drop me an email. -- Thanks, already done.
2005-02-05: A Hungarian translation of this page is now available.
2005-02-05: Received a successful test report on the SD100 version, and published it.

FAQ

Q: Could you port this to model such-and-such?
A: Not until Canon releases a firmware update for it. I don't currently know of any other safe procedure for patching the firmware than modifying the official updates.
Q: But can't you simply extract the firmware from the camera, modify it and flash it back?
A: Not at this moment, at least. There may be a way to extract the firmware and then flash it back, but developing such a procedure is risky and mistakes would be made along the way which would render the camera inoperable. Since I don't have any device for reflashing a dead camera, nor an unlimited supply of free cameras at my disposal, I will not attempt this.
Q: Can you please send me the original firmware files/ready-made modified firmwares/instructions on how to use a hex editor/an explanation of what MD5 means?
A: No.

Introduction

The firmware of some Canon cameras has some limitations that seem completely arbitrary. For example, with many models you can take at most 180 seconds of video at resolutions 320x240 and 160x120, and at most 30 seconds of video at resolution 640x480. Marketing reasons, maybe?

Well, anyway. I managed to make a firmware modification that increases the 30 second limit of 640x480 resolution video to 180 seconds. The mod is currently available for the following cameras:

Canon Powershot A70
Canon Powershot A75
Canon Powershot S230 (also known as Canon Digital IXUS v3)
Canon Powershot Pro1
Canon Powershot SD100 (also known as Canon Digital IXUS II)

I have personally tested only the A70 version of this mod. Videos under 30 seconds seem to be unaffected as far as I can tell. The camera's own playback mode refuses to open any 640x480 video that is over 30 seconds and just shows the thumbnail and the text "Unidentified image". The video files will work just fine when transferred to the computer; it's just the camera's playback mode that refuses to recognize overly long files. I'm trying to remove that limitation also.

I've been informed that playback of these extended videos is possible with the S230, so there is hope that other cameras could also do that.

I'm not a lawyer, but I think it's legal to perform this modification and to distribute the instructions on how to do it. You bought the camera, so it's yours and you should have the right to do whatever you want to it. Do note that distributing the complete modified firmware probably is illegal, so don't do that if you want to stay on the safe side.

And to all my fans at Canon: I'm just improving your products here - please don't sue me :)

Update instructions

Consider whether or not you are willing to risk damaging your camera for a minor gain in functionality. You are doing this ON YOUR OWN RISK. This mod will probably VOID THE WARRANTY OF YOUR CAMERA and may even BREAK YOUR CAMERA. I won't assume any responsibility for any direct or indirect damage, data loss or emotional scarring caused by this modification. No one has reported any ill effects from these modifications yet, but it is possible that the flashing process itself could fail, rendering your camera useless.
Read the instructions through. If you don't understand something, stop now.
Obtain the proper version of the original Canon firmware update package. No, I'm not going to tell you where to find them and no, I'm not going to send them to you.
Unpack the archive. It should containg the actual firmware update file something.FIR.
Check that the MD5 sum of that firmware update file is correct. If your checksum differs, you have the wrong file.
Using a hex editor (or whatever tool you prefer), make the given changes at the given offsets.
Check that the MD5 sum of the changed file is correct. DO NOT try to update if the checksum doesn't match.
Transfer the modified .FIR file to the root directory of a memory card using either the camera USB cable or a memory card reader.
Check that the camera has fresh batteries or is connected to an AC adapter. If the firmware update is interrupted or fails for some other reason, your camera may well become just an expensive paperweight.
Insert the card into the camera, switch the camera to playback mode and turn it on.
Press MENU, select "Firm Update".
Cross your fingers and select OK. Wait until the camera completes the update and turns itself off. The process takes a few minutes. DO NOT interrupt it! If you do, there's a good chance your camera will be dead.
Turn the camera back on.
Test and enjoy! Also, please send me an email and tell me if you were successful or not, so I know how much testing has been done. Preferably test the maximum length of all resolutions, and report:
- Counter value reached before recording stopped
- Actual length of the produced file in seconds
- Was the file corrupted in any way?
- What PC player software did you use for testing?

Available hacks

The hacks are distributed as human-readable binary patches. If anyone wants to hack together a script that automates applying these patches, then please go ahead.

A70

a70hack1: Extends video recording at 640x480 to 180 seconds. I've tested this myself.
a70restore: Restore original firmware.

A75

There are two versions of this hack. One version extends video recording to about 192 seconds, and the other to 180 seconds. The produced file may be corrupted if the length exceeds 180 seconds. I've been told that the file can be repaired by opening and re-saving them with VirtualDub. All files produced by the 180 second version should be fine.

a75hack1: Extends video recording at 640x480 to 192 seconds, The file may be slightly corrupted if the length exceeds 180 seconds.
a75hack2: Extends video recording at 640x480 to 180 seconds, The files should be intact.
a75restore: Restore original firmware.

S230

s230hack1: Extends video recording at 640x480 to 180 seconds. I've been told that the files are intact and even playable on the camera.
s230restore: Restore original firmware.

Pro1

pro1hack1: Extends video recording at 640x480 to 180 seconds.

SD100

sd100hack1: Extends video recording at 640x480 to 180 seconds.

Thanks to...

Alex Bernstein for the firmware decrypter. I probably wouldn't have bothered to try this if I had had to reverse engineer the encryption myself.
The brave people who tested the updates for the cameras I don't have.

Feedback

Comments? Questions? Success stories? Failure stories?

--> jplauril at cc dot hut dot fi.