NX500 - tethered shooting - simple "hack"

Started Feb 8, 2016 | Discussions
otto k Senior Member • Posts: 2,211
NX500 - tethered shooting - simple "hack"
14

Hi. To best of my knowledge NX500 is not supposed to be used tethered by USB to PC, that was left as a domain of NX1 as professional model. When you connect it via USB cable to PC it automatically switches SD card to mass storage mode and disables any camera operation (at least my NX500 does when connected to Linux).

What follows is a very simple "hack" (it's not really a hack) that enables the use of camera via PTP/MTP protocol - enabling use of camera while still having access to all image files (and possibly remote control, see later) in real time.

First of all thanks to tecnoworld for providing old versions of firmware that proved easier to work with when compared to current versions.

Second thanks goes to Samsung engineers that made many nice things in firmware I'm trying to access. You guys rock. Your management guys - not so much.

To use NX500 (might work for other recent-ish models - looking for volunteers - I don't see how this could damage the camera in any way) in PTP/MTP mode:

1. Create text file with just a line break (CR/LF - simple enter in Notepad will do) named info.tgw in the root of the SD card.

2. Insert SD card in camera

3. Connect camera via USB cable to PC

4. Turn on camera

That's it.

You should see a series of green dots on the left side of the camera indicating factory/development/custom mode is active (see picture).

Series of green dots on the left indicates special mode

info.tgw file instructs the camera to start the daemon process in background and wait for PTP/MTP commands from the computer.

Under Linux I can easily access the DCIM folder with any file browser and see how the files are being written to the card in real time (I use a slow class 4 card and shot RAW files - you can see the size increasing). This enables one to automatically copy files off camera (at ~18MB/s for this card) to PC for further editing. Only difference I found was that photo size was grayed out in the menu (it's 28MP) - JPG works, RAW, works, modes work, even video files (BTW, they are written down 4MB at a time - nice for streaming offload to PC).

Unfortunately, I can't trigger shooting or any other setting from command line (neither gphoto nor libptp support Samsung) - maybe Lightroom or other program could also control the camera - volunteers wanted.

Here is output of gphoto:

gphoto2 --port usb: --abilities
Abilities for camera : USB PTP Class Camera
Serial port support : no
USB support : yes
Capture choices :
: Image
: Preview
Configuration support : yes
Delete selected files on camera : yes
Delete all files on camera : no
File preview (thumbnail) support : yes
File upload support : yes

So, it should support full remote control but I lack any software that works with samsung cameras.

That's it for now, I'm still trying to get the camera to CS Mode to remove video limit (and play with other things) but that DOWN-OK-UP-OK-RIGHT-EXP+OK shortcut from service manual does not work at all in any configuration (it's possible it was dropped for production firmwares or that is requires some special software).

I would like to hear:

1. Does this work under windows?

2. Does this work with NX1/NX300/NX2000/NX3000 (Tizen based cameras)?

3. Does remoting work under windows?

Cheers,

Otto

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
Samsung NX1 Samsung NX500
If you believe there are incorrect tags, please send us this post using our feedback form.
ttbek Veteran Member • Posts: 4,869
Re: NX500 - tethered shooting - simple "hack"

For question 2, I thought the NX500 was also Tizen based.

 ttbek's gear list:ttbek's gear list
Canon PowerShot SX10 IS Canon EOS 5D Samsung NX300 Canon EOS Rebel SL1 Samsung NX30 +37 more
OP otto k Senior Member • Posts: 2,211
Re: NX500 - tethered shooting - simple "hack"

It is, it works on nx500 so I was guessing it should on others too. All this is based on data present in NX1 firmware and then tested on NX500 (as that's what I have).

Edit, as I remember you use Linux and have nx1 ? Could you run gphoto2 --summary and post the output or send it via pm? After the info.tgw is on the card.

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
ttbek Veteran Member • Posts: 4,869
Re: NX500 - tethered shooting - simple "hack"

Yep, will do when I get a chance. It would be pretty awesome to have the tether working in Darktable (I think uses gphoto on the backend) instead of having to rely on the Samsung software.

 ttbek's gear list:ttbek's gear list
Canon PowerShot SX10 IS Canon EOS 5D Samsung NX300 Canon EOS Rebel SL1 Samsung NX30 +37 more
OP otto k Senior Member • Posts: 2,211
Re: NX500 - tethered shooting - simple "hack"

Darktable is my primary motivator for this

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
ArendjeF New Member • Posts: 24
Re: NX500 - tethered shooting - simple "hack"

2. Does this work with NX1/NX300/NX2000/NX3000 (Tizen based cameras)?

It works on NX30 and I get the same output on my Linux computer with GPhoto2.

That's all.

OP otto k Senior Member • Posts: 2,211
Re: NX500 - tethered shooting - simple "hack"

Could you try

gphoto2 --port usb: --summary

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
ArendjeF New Member • Posts: 24
Re: NX500 - tethered shooting - simple "hack"

yes the following message:

$ gphoto2 --port usb: --summary

*** Error ***
PTP I/O error

*** Error ***
An error occurred in the io-library ('Unspecified error'): The supplied vendor or product id (0x0,0x0) is not valid.
*** Error (-1: 'Unspecified error') ***

For debugging messages, please use the --debug option.
Debugging messages may help finding a solution to your problem.
If you intend to send any error or debug messages to the gphoto
developer mailing list <gphoto-devel@lists.sourceforge.net>, please run
gphoto2 as follows:

env LANG=C gphoto2 --debug --debug-logfile=my-logfile.txt --port usb: --summary

Please make sure there is sufficient quoting around the arguments.

tecnoworld
tecnoworld Veteran Member • Posts: 7,232
Re: NX500 - tethered shooting - simple "hack"

Great!! Thx for the acknowledgment btw

Btw, ooc, I always wondered. There is a sdk available for pc to develop an app for nx1. Why nobody cared to use it? There even are commands for focus so focus bracketing would be possible.

 tecnoworld's gear list:tecnoworld's gear list
Samsung TL500 Samsung NX100 Samsung NX200 Samsung NX300 Samsung NX1 +15 more
lamer01 Junior Member • Posts: 48
Re: NX500 - tethered shooting - simple "hack"

tecnoworld wrote:

Great!! Thx for the acknowledgment btw

Btw, ooc, I always wondered. There is a sdk available for pc to develop an app for nx1. Why nobody cared to use it? There even are commands for focus so focus bracketing would be possible.

Where is this SDK you speak of?

OP otto k Senior Member • Posts: 2,211
Re: NX500 - tethered shooting - simple "hack"

You're welcome, it's not like you didn't earn it

People who received the SDK had to sign the NDA and cannot release it to other people without breaking the NDA (and I wouldn't want them to even if they were willing).

Good news is that remote studio is based on the same code so I can analyze that.

I also found another hidden menu with option to enable automation via PTP but still cannot access it.

Cheers, Otto

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
OP otto k Senior Member • Posts: 2,211
Re: NX500 - tethered shooting - simple "hack"

Did you put info.tgw file containing just on the root of SD card?

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
tecnoworld
tecnoworld Veteran Member • Posts: 7,232
Re: NX500 - tethered shooting - simple "hack"

The sdk was released to whoever asked for it. I don't know about nda: I'm sure it applied to sdk itself, but what about products based on it? I guess you can still sign to get it if you want...

 tecnoworld's gear list:tecnoworld's gear list
Samsung TL500 Samsung NX100 Samsung NX200 Samsung NX300 Samsung NX1 +15 more
ArendjeF New Member • Posts: 24
Re: NX500 - tethered shooting - simple "hack"

otto k wrote:

Did you put info.tgw file containing just on the root of SD card?

Yes I did. I made the file with Notebook++ and I see the green dots.

PimousseFRNL New Member • Posts: 1
Re: NX500 - tethered shooting - simple "hack"

I would like to hear:

1. Does this work under windows?

2. Does this work with NX1/NX300/NX2000/NX3000 (Tizen based cameras)?

3. Does remoting work under windows?

Hi Otto,

Thanks for the tip

1. Yes it work under Windows as a MTP (yeah!)
2. Test on my NX2000 - Firmware 1.15 (Repackaged)
3. Didn't test yet but i'm confident.

Cheers

PS: Where can you sign to get the SDK? I'm really interested

Rajminster Junior Member • Posts: 43
Re: NX500 - tethered shooting - simple "hack"
2

I tried it on my NX1 and it worked as well.

With factory/development/custom mode active, what are the possibilities for us? Obviously since Samsung is not going to improve the camera, we should figure out how to do it ourselves.

Do you guys know of anyone who has made progress in hacking Tizen/NX cameras?

 Rajminster's gear list:Rajminster's gear list
Canon EOS 60D Samsung NX1 Canon EF 28mm f/1.8 USM Samsung NX 30mm F2 Pancake Samsung NX 45mm F1.8 +1 more
OP otto k Senior Member • Posts: 2,211
Re: NX500 - tethered shooting - simple "hack"
2

Samsung made hacking the firmware quite complicated with non standard layout and non standard compression (or stripping the headers or similar) and if you make a mistake it means bricked device. With them pulling out of various markets it could be permanently bricked as it voids warranty.

So, I prefer going the sd card route, if something is broken, remove the card and your camera is back to normal. That said, their engineers are quite thorough and they have removed a possible attack vector present in initial firmware and closed obvious entry points. This means more work for me, but I do not give up easily and will try to at least remove video recording limit and enable control via PTP (though the Holy grail would be running ssh server on the camera).

I made some progress but all it does is performs a full diagnostic test of wifi for certification needs - not really useful for us...

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
Vaga Forum Member • Posts: 66
Re: NX500 - tethered shooting - simple "hack"

http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=T&menu_item=photography&classification1=digital%20cameras

Here is a link that was posted on the EosHD forum that is following various hacking initiatives for NX cameras. It contains some type of code for the camera. Not sure if you've seen this already.

Forum link: http://www.eoshd.com/comments/topic/19099-petition-for-samsung-nx1-hack/?page=7

OP otto k Senior Member • Posts: 2,211
Re: NX500 - tethered shooting - simple "hack"

Yes, it's open source code that is a part of various Samsung cameras (for example, most newer cameras are based on Tizen Linux). But, everything interesting in camera is done by closed source software that is not available, documented, anything.

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
Pavel Masek Regular Member • Posts: 110
Re: NX500 - tethered shooting - simple "hack"

Thank yo uvery much for your effort. My brother told me same thing after he checked source code of NX1 available on the web - that some parts are open and available but rest is closed.

Do you think there is some little chance we could change eg. bitrate via these "SD cards apps"? Magic Lantern is also on the card and user can change bitrate...

Unfortunately it seems the NX1 is more closed than Canons...

 Pavel Masek's gear list:Pavel Masek's gear list
Samsung NX1 Canon EF 135mm F2L USM Samsung NX 50-200mm F4-5.6 OIS Sigma 8-16mm F4.5-5.6 DC HSM Canon EF 24-105mm f/4L IS USM +3 more
Keyboard shortcuts:
FForum MMy threads