Kodak DC26x/DC290 ROM Dumper/Patcher
by Ralf Brown

v1.04 - 09 July 2000
=======================================

DGTAROM is a program which can show you the variable tables contained
in the firmware image of a Kodak DC220, DC260, DC265, or DC290 camera
(and probably the Minolta 1500EX and other Digita-based cameras) and
allows you to change certain of the standard limits for those variables.
MODIFYING YOUR CAMERA'S FIRMWARE MAY CAUSE IT TO OPERATE INCORRECTLY OR
MALFUNCTION ENTIRELY, AND WILL PROBABLY VOID YOUR WARRANTY.  Make
changes at your own risk only!

Installation: put the executable DGTAROM.EXE somewhere on your hard
disk, preferably on your search path so that it can be run from
anywhere.  (If you don't understand these instructions, you shouldn't
be messing around with your camera's firmware).  DGTAROM is a DOS
program, so you will be running it from a DOS window if you are using
Microsoft Windows.

Running: DGTAROM has three basic modes of operation -- test, display,
and patch.

Test Mode:
---------
The test mode can be applied to either of the two files comprising a
copy of the firmware (DC*.BIN and RS*.BIN), and simply verifies that
the firmware files have not obviously been corrupted by computing the
file's checksums and comparing it against the two stored checksums.  To
use the test mode, run the program as
	DGTAROM -t DC260107.BIN
(replacing the DC260107.BIN by the name of the firmware image file you
want to check).  The program will display a variety of technical info
about the file, ending with a line that indicates whether or not the
file appears to be valid.

Sample output from the test mode:
   Kodak DigitaOS ROM Image Dumper v1.01   Copyright 2000 Ralf Brown

   File type CODE, data starts at 0x00000010, ends at 0x000A35CC
           stored data checksum = 0x05546125, computed checksum = 0x05546125
           firmware version 1.0.7.0
           CCS Version = 1.0.0.0
           INSV = 1.0.0.0
           Region Code = 1 (USA)
           VendorID = Eastman Kodak Company
           ProductID = KODAK DIGITAL SCIENCE DC260
           minimum serial number = 0
           maximum serial number = 4294967295
           stored file checksum = 0x05548F00, computed checksum = 0x05548F00
   The image file appears to be OK

Most of the values displayed above are used to ensure that the firmware
file is being applied to the correct hardware.

Display Mode:
------------
Display mode allows you to dump either of two tables contained in the
resource file (RS*.BIN) -- the script variable table and the image tag
table.	By default, DGTAROM will scan the file for the desired table,
but you can also explicitly specify an offset within the file in case a
new revision of the firmware adds variables prior to the ones the
program looks for (or worse yet, drops those variables).

To dump the script variables, run the program as
	DGTAROM RS260107.BIN
Since the output is several pages long, you will want to redirect the
output into a file or a file-viewer program such as Vern Buerg's
LIST.COM:
	DGTAROM RS260107.BIN | LIST /S
To dump the image tags instead of script variables, add the -i flag:
	DGTAROM -i RS260107.BIN | LIST /S

A portion of the script variable dump:
	Kodak DigitaOS ROM Image Dumper v1.03	Copyright 2000 Ralf Brown

	found tag 'aagc' at offset 0x00008A3C

	'aagc'  Analog AGC Specification         unsigned int (u)
		flags = 000C0000 (not available on this camera?)
		min = 0, max = 0, default = 0
	'acpd'  AC Power Down Timeout            unsigned int (u)
		flags = 000F0000
		min = 5, max = 65535, default = 600
	'acse'  AC Sleep Timeout Enable          unsigned int (u)
		flags = 000F0000
		  (def) 0       Disabled
	'actc'  AC Sleep Timeout                 unsigned int (u)
		flags = 000F0000
		min = 5, max = 65535, default = 600
	'aelk'  AE Lock Mode                     unsigned int (u)
		flags = 000F0000
		  (def) 2       AE Locked
	'aflk'  AF Lock Mode                     unsigned int (u)
		flags = 000F0000
		  (def) 2       AF Locked
	'aper'  Aperture                         unsigned int (u)
		flags = 000F0000
		min = 300, max = 1600, default = 300
	'bccl'  Burst Capture Color Mode         unsigned int (u)
		flags = 000F0000
		  (def) 1       Full
	'bccr'  Burst Capture Rate               unsigned int (u)
		flags = 000C0000 (not available on this camera?)
			1       1/sec
		  (def) 2       2/sec
			3       3/sec
			5       5/sec
			10      10/sec
	'bcpn'  Burst Capture Compression        unsigned int (u)

The first thing which is displayed is the offset at which the table
was found; this is the number which you would give to the -o flag to
manually specify the table location.  If, in some future revision,
more variables are added prior to 'aagc', you would need to use -o
to see them; in that case, you would use a hex viewer to look at the
addresses just prior to 0x8A3C (in this case), which should make it
obvious which address to use:
	DGTAROM -o0x8A3C RS260107.BIN

Next, the variables follow.  The first line for each variable gives
its name and description, followed by its data type and the type letter
used in declaring it in a Digita script.  The second line indicates the
flags for the variable; these have not yet been completely
reverse-engineered, so you will see question marks next to many of the
descriptions shown for the flags.

The third and any following lines for the variables indicate the valid
values and default setting.  If the variable is a simple range, you
will see
        min = 5, max = 65535, default = 600
For enumerated types, you will see each valid value along with its
description and a (def) if it is the default setting.  String variables
are shown with their default value, as are simple (non-range,
non-enumerated) integer variables.  Finally, for a few known variables
that represent versions, the human-readable form of the version number
is shown in parentheses next to the integer value.

A portion of the image tag dump:
   Kodak DigitaOS ROM Image Dumper v1.03   Copyright 2000 Ralf Brown

   found tag 'imiv' at offset 0x0002A574

    Tag    Size    Offset     Flags        Type
   imiv      4     0x0000  0x00000000      unsigned int (u)
   imis      4     0x0004  0x00000000      unsigned int (u)
   vdid     32     0x0008  0x00000000      string (s)
   ptid     32     0x0028  0x00000000      string (s)
   ...
   impn      4     0x007C  0x00000000      unsigned int (u)
   imcn      4     0x0080  0x00000000      PName
   ...
   ucrc      4     0x0134  0x01000000      unsigned int (u)
                           writeable

Again, the first thing which is displayed is the location at which the
table was found.  As with script variables, you can specify the offset
manually using -o.  All image tags are stored in a single block of
memory located in the MakerNote tag (tag number 0x927C) in the ExIF
image header for JPEG files generated by the camera.  For the DC260 and
DC265, this block of memory is 1024 bytes in length -- now you know
what that long string of hex numbers shown by ExIFRead really is!  (As
an important note, the values reported by ExIFRead or similar programs
based on the standard ExIF tags will differ from the true values used
by the camera, because the DC26x apparently uses the nearest
"traditional" value for such things as shutter speed and f-stop -- i.e.
1/60 second reported where 1/74 was actually used, because the next
"traditional" value is 1/125, or an impossible-for-this-camera f/2.8)

Back to the dump....  For each image tag, DGTAROM prints the tag's
name, the size of its data in bytes, its offset within the MakerNote
data block, flags, and variable type (along with the Digita script
declaration type code letter when known).  If the flags are non-zero,
a second line is printed with an explanation of the flags which have
been set; on the DC260, the only flag which is present is 'writeable',
indicating that that image tag can be modified via a script.


Patch Mode:
----------
This is the most powerful mode, and also the only potentially dangerous
one.  You may patch either the limits and default for a range variable,
or the image file's version marker (which allows you to downgrade your
firmware or re-apply the same firmware).

If all you want to do is patch the version marker, you need to apply
the *same* patch to *both* files.  You will usually want to specify
the same version as is currently installed in the camera (which is
displayed when you switch your Kodak's mode dial to Info); DGTAROM
automatically increments the number just enough to make the upgrade
installation program accept the firmware as a new version.  To set
the version such that you can downgrade from 1.0.7 to 1.0.6, for
example, you would use
	DGTAROM -v1.0.7 DC260106.BIN
	DGTAROM -v1.0.7 RS260106.BIN
which will make the installation software think you are upgrading from
1.0.7 to 1.0.7.1, even though you are actually installing the older 1.0.6.
You can verify correct modification of the files using the test mode,
as described above.

The final operation that DGTAROM is capable of is by far the most
powerful, and must be used with caution.  Remember: PATCHING THE
FIRMWARE COULD CAUSE INCORRECT OPERATION OR COMPLETE FAILURE.  You do
so AT YOUR OWN RISK.  Having said that, I have successfully patched my
DC260 to reduce the minimum manual shutter time from 0.5 to 0.2 seconds
and the increase the maximum to 32 seconds.  Unfortunately, there are
other checks in the firmware in addition to the variable table, because
with the DC260 v1.0.7, any shutter times less than 0.2 seconds are
forced to 0.2 seconds and any manual focus distances less than 50cm are
forced to 50cm (the latter is a real shame, considering that autofocus
goes down to 30cm).  There is one cosmetic bug with really long
exposure times -- the top display doesn't show times greater than 28
seconds correctly (30s shows 30s momentarily but then changes to 4.4s,
and 32s immediately changes to 6.4s)

OK, back to how to patch your firmware.  You need to give one or more
patch specifications to DGTAROM, which consist of a variable name
followed by an equal sign and three comma-separated values (any of
which may be empty to preserve the current setting).  The three values
are the minimum allowable for the variable, the maximum, and the
default.  For example, to change the limits on manual shutter times to
minimum of 0.2 seconds, maximum of 32 seconds, and keep the default
unchanged, the patch specification would be
	shut=200000,32000000,
(shutter times are specified in microseconds).  The patches I currently
have installed on my DC260 were generated via
	DGTAROM -p RS260107.BIN shut=200000,32000000, tldy=30,,
which changes the shutter times as described above and reduces the
minimum value for the time delay to 30 seconds.  If you wish to be
certain that the resulting file has not been corrupted, you can request
that the test mode be run after patching by using -pt instead of -p:
	DGTAROM -pt RS260107.BIN shut=200000,32000000, tldy=30,,

Note that any extended limits will likely require scripts to access, as
the menus are more or less hardwired for the factory limits (i.e. the
Long Exposure Time setup menu will always jump to 0.5s when attempting
to increase the value if it is already 16 seconds or more, and will
jump to 16s if trying to decrease any value that is already 0.5s or
less).   Go to www.digitacamera.com to get my Shutter Speed script to
take advantage of extended limits on exposure times.


=======================================
Version History

v1.00	18sep99 First public release.
v1.01	25jan00 Minor tweaks for DC290, renamed from DC26xROM to DGTAROM.
v1.02		(unreleased)
v1.03	13feb00 Fixed problem when patching a variable using the current
		value of the minimum, additional DC290 tweaks, misc other
		tweaks; added -pt option
v1.04	09jul00 fixed incompatibility with DC290 v1.0.4 firmware files
		(data size in RS290104.BIN is not a multiple of 4).

	 -=- End of File -=-

