The traveler slimline x5 is a camera sold at aldi. from
traveler.
based on the zoran camera on a chip ( COACH )
the camera is manufactured by premier image tech corporation.
the model is DS5341
analyzing the rom contents
on the traveler service site there is a downloadable rom. it is a zip file containing a rom image.
the image file name is 'ds5341'
the image is structured as follows:
| start | end | size | sectornr | nr sectors | description |
|---|
| 00000000 | 00000200 | 00000200 | | | header |
| 00000200 | 00040000 | 0003fe00 | | | first elf mips image |
| 00040000 | 00040040 | 00000040 | | | header |
| 00040040 | 00040240 | 00000200 | 0000 | 0001 | header |
| 00040240 | 00040440 | 00000200 | 0001 | 0001 | header |
| 00040440 | 00040640 | 00000200 | 0002 | 0001 | partition table |
| 00040640 | 00217240 | 001d6c00 | 0003 | 0eb6 | second elf mips image |
| 00217240 | 004b0040 | 00298e00 | 0eb9 | 14c7 | first fat filesystem A: |
| 004b0040 | 004c0040 | 00010000 | 2380 | 0080 | second fat filesystem B: |
the elf images contain a MIPS realtime operating system by Express Logic,
named ThreadX, with their
FileX filesystem driver.
they can be easily disassembled using ida
firmware monitor
there is a firmware monitor, like the one described on this page.
i think it can be activated by inserting an sdcard, and powering on while pressing the 'take-picture'-button.
but don't know yet how to interact with it.
disks
| A: | first fat image |
| B: | second fat image |
| C: | internal?? |
| I: | sdcard |
disk A:
contains language resources, and bitmap resources.
plus some configuration files
found in rom:
| A:\2-2_03.WAV | |
| A:\3-BEEP.WAV | |
| A:\ADC.BIN | |
| A:\AE.BIN | |
| A:\AF.BIN | |
| A:\AGC.BIN | |
| A:\AGCCFG.BIN | |
| A:\AVIMODELSTR.BIN | |
| A:\AVISTRLSTR.BIN | |
| A:\AVISTRNSTR.BIN | |
| A:\AWBCFG.BIN | |
| A:\AWBSETTINGS.BIN | |
| A:\B.BIN | |
| A:\BASENLGF0.BIN | |
| A:\BASENLGF1.BIN | |
| A:\CTLUT1.BIN | |
| A:\DATAPRINT.BIN | |
| A:\DLUT.BIN | |
| A:\ENGLISH.BIN | |
| A:\ENGLISH.BST | |
| A:\EPS_GCP0.BIN | |
| A:\EPS_XSCL.BIN | |
| A:\FRANCH.BIN | |
| A:\FRANCH.BST | |
| A:\GAMMADDE1.BIN | |
| A:\GAMMALUT0.BIN | |
| A:\GAMMALUT1.BIN | |
| A:\GERMAN.BIN | |
| A:\GERMAN.BST | |
| A:\GPP.BIN | |
| A:\I.BIN | |
| A:\ITALIANO.BIN | |
| A:\ITALIANO.BST | |
| A:\JAPAN.BIN | |
| A:\JAPAN.BST | |
| A:\LCLUT0.BIN | |
| A:\MAIN.SORT.TXT | |
| A:\MEDIAFORMAT.BIN | |
| A:\P.BIN | |
| A:\SCHINESE.BIN | |
| A:\SCHINESE.BST | |
| A:\SHUTTER.WAV | |
| A:\SPAIN.BIN | |
| A:\SPAIN.BST | |
| A:\TCHINESE.BIN | |
| A:\TCHINESE.BST | |
| A:\TG.BIN | |
| A:\TGCFG.BIN | |
| A:\USBDEVDESC.BIN | |
| A:\USBMODEDESC.BIN | |
| A:\USBMSINQSTR.BIN | |
| A:\USBSTRINGS.BIN | |
| A:\VIDSIZE.BIN | |
| A:\WAVEXIF.BIN | |
| A:\YLUT.BIN | |
| A:\BMP\ | directory with bitmaps |
| A:\J.PEG\ | directory with jpg images |
referenced in code:
| A:\AGC1.BIN | |
| A:\b2u.dat | |
| A:\BASENLGF* | |
| A:\CTLUT%d.BIN | |
| A:\Eps_GCPN.BIN | |
| A:\FRAMESDB.BIN | |
| A:\GAMMALUT* | |
| A:\LCLUT* | |
| A:\TG1.BIN | |
| A:\u2b.dat | |
| A:\UtgCfg%d.bin | |
| A:\UtgFrm%d.bin | |
| A:\UtgSeq%d.bin | |
disk B:
found in rom:
| B:\START_0.JPG | |
| B:\USP.BIN | |
referenced in code:
| B:\IMG00001.JPG | |
| B:\IMG%05ld.JPG | |
| B:\start_0.jpg | |
| B:\start_1.jpg | |
| B:\start_2.jpg | |
| B:\start_3.jpg | |
| B:\start_4.jpg | |
| B:\start_5.jpg | |
| B:\start_6.jpg | |
| B:\start_7.jpg | |
disk C:
referenced in code:
| c:\CAL.bin | |
| C:\DefectivePixel.BIN | |
| C:\DefectivePixel0.BIN | |
| C:\DefectivePixVd0.BIN | |
| C:\FSP.BIN | |
| C:\LSCLUT | |
disk I:
I think this disk is used for changing various settings in the camera, using
files placed on the sdcard, and booting.
referenced in code:
| I:\AgcPerEv.txt | |
| I:\BrightPixel.txt | |
| I:\Cal.txt | |
| I:\DarkD.txt | |
| I:\DarkP.txt | |
| I:\DefectPixel.txt | |
| I:\DS5341.elf | rom update image |
| I:\Flash.txt | |
| I:\Focus06M.txt | |
| I:\FocusBackRush.txt | |
| I:\FocusTest.txt | |
| I:\IRIS.txt | |
| I:\ISO100Agc.txt | |
| I:\MShutter.txt | |
| I:\MS_RG.txt | |
| I:\OverRun.txt | |
| I:\TDS5341.elf | |
| I:\WideAdjust.txt | |
| I:\ZoomSpeed.txt | |
other disk??
other file paths found in code, without drive letter
| DCIM\100COACH | |
| \AVI\hdrl\avih | |
| \AVI\hdrl\strl\.\strl\strh | |
| \AVI\hdrl\strl\strd | |
| \AVI\hdrl\strl\strh | |
| \AVI\hdrl\strl\strn | |
| \AVI\idx1 | |
| \AVI\INFO\ISFT | |
| \AVI\movi | |
| \DCIM\100COACH | |
| \MISC\AUTPLAY0.MRK | |
| \MISC\AUTPRINT.MRK | |
| \MISC\AUTPRINT.MRK | |
| \MISC\AUTXFER.MRK | |
| \WAVE\data | |
| \WAVE\exif\emnt | |
| \WAVE\fact | |
| \WAVE\fmt | |