NX500 - tethered shooting - simple "hack"

Hi. To best of my knowledge NX500 is not supposed to be used tethered by USB to PC, that was left as a domain of NX1 as professional model. When you connect it via USB cable to PC it automatically switches SD card to mass storage mode and disables any camera operation (at least my NX500 does when connected to Linux).

What follows is a very simple "hack" (it's not really a hack) that enables the use of camera via PTP/MTP protocol - enabling use of camera while still having access to all image files (and possibly remote control, see later) in real time.

First of all thanks to tecnoworld for providing old versions of firmware that proved easier to work with when compared to current versions.

Second thanks goes to Samsung engineers that made many nice things in firmware I'm trying to access. You guys rock. Your management guys - not so much.

To use NX500 (might work for other recent-ish models - looking for volunteers - I don't see how this could damage the camera in any way) in PTP/MTP mode:

1. Create text file with just a line break (CR/LF - simple enter in Notepad will do) named info.tgw in the root of the SD card.

2. Insert SD card in camera

3. Connect camera via USB cable to PC

4. Turn on camera

That's it.

You should see a series of green dots on the left side of the camera indicating factory/development/custom mode is active (see picture).

Series of green dots on the left indicates special mode

info.tgw file instructs the camera to start the daemon process in background and wait for PTP/MTP commands from the computer.

Under Linux I can easily access the DCIM folder with any file browser and see how the files are being written to the card in real time (I use a slow class 4 card and shot RAW files - you can see the size increasing). This enables one to automatically copy files off camera (at ~18MB/s for this card) to PC for further editing. Only difference I found was that photo size was grayed out in the menu (it's 28MP) - JPG works, RAW, works, modes work, even video files (BTW, they are written down 4MB at a time - nice for streaming offload to PC).

Unfortunately, I can't trigger shooting or any other setting from command line (neither gphoto nor libptp support Samsung) - maybe Lightroom or other program could also control the camera - volunteers wanted.

Here is output of gphoto:

gphoto2 --port usb: --abilities
Abilities for camera : USB PTP Class Camera
Serial port support : no
USB support : yes
Capture choices :
: Image
: Preview
Configuration support : yes
Delete selected files on camera : yes
Delete all files on camera : no
File preview (thumbnail) support : yes
File upload support : yes

So, it should support full remote control but I lack any software that works with samsung cameras.

That's it for now, I'm still trying to get the camera to CS Mode to remove video limit (and play with other things) but that DOWN-OK-UP-OK-RIGHT-EXP+OK shortcut from service manual does not work at all in any configuration (it's possible it was dropped for production firmwares or that is requires some special software).

I would like to hear:

1. Does this work under windows?

2. Does this work with NX1/NX300/NX2000/NX3000 (Tizen based cameras)?

3. Does remoting work under windows?

Cheers,

Otto

For question 2, I thought the NX500 was also Tizen based.

It is, it works on nx500 so I was guessing it should on others too. All this is based on data present in NX1 firmware and then tested on NX500 (as that's what I have).

Edit, as I remember you use Linux and have nx1 ? Could you run gphoto2 --summary and post the output or send it via pm? After the info.tgw is on the card.

Yep, will do when I get a chance. It would be pretty awesome to have the tether working in Darktable (I think uses gphoto on the backend) instead of having to rely on the Samsung software.

Darktable is my primary motivator for this

Could you try

gphoto2 --port usb: --summary

Great!! Thx for the acknowledgment btw

Btw, ooc, I always wondered. There is a sdk available for pc to develop an app for nx1. Why nobody cared to use it? There even are commands for focus so focus bracketing would be possible.

You're welcome, it's not like you didn't earn it

People who received the SDK had to sign the NDA and cannot release it to other people without breaking the NDA (and I wouldn't want them to even if they were willing).

Good news is that remote studio is based on the same code so I can analyze that.

I also found another hidden menu with option to enable automation via PTP but still cannot access it.

Cheers, Otto

Did you put info.tgw file containing just on the root of SD card?

The sdk was released to whoever asked for it. I don't know about nda: I'm sure it applied to sdk itself, but what about products based on it? I guess you can still sign to get it if you want...

I tried it on my NX1 and it worked as well.

With factory/development/custom mode active, what are the possibilities for us? Obviously since Samsung is not going to improve the camera, we should figure out how to do it ourselves.

Do you guys know of anyone who has made progress in hacking Tizen/NX cameras?

Samsung made hacking the firmware quite complicated with non standard layout and non standard compression (or stripping the headers or similar) and if you make a mistake it means bricked device. With them pulling out of various markets it could be permanently bricked as it voids warranty.

So, I prefer going the sd card route, if something is broken, remove the card and your camera is back to normal. That said, their engineers are quite thorough and they have removed a possible attack vector present in initial firmware and closed obvious entry points. This means more work for me, but I do not give up easily and will try to at least remove video recording limit and enable control via PTP (though the Holy grail would be running ssh server on the camera).

I made some progress but all it does is performs a full diagnostic test of wifi for certification needs - not really useful for us...

Yes, it's open source code that is a part of various Samsung cameras (for example, most newer cameras are based on Tizen Linux). But, everything interesting in camera is done by closed source software that is not available, documented, anything.

Thank yo uvery much for your effort. My brother told me same thing after he checked source code of NX1 available on the web - that some parts are open and available but rest is closed.

Do you think there is some little chance we could change eg. bitrate via these "SD cards apps"? Magic Lantern is also on the card and user can change bitrate...

Unfortunately it seems the NX1 is more closed than Canons...