man, this has been one of my favorite videos of yours thus far, dave. i'm a software guy, so seeing you pretty effortlessly transform (what looks to me) a messy plotline into actual data was like watching someone perform magic.
Too bad I ran across this video 5 years later. There is a Sony LANC remote that has an LCD display that displays the record/play time counter. It has all of the control buttons and works on both Sony and Canon. By adding a jumper it becomes a servicing remote allowing adjustment most of the operating parameters like color balance etc. One of the LCD indicators is "REC" while the camera is recording. So the information you seek is there. I fixed this stuff for 23 years.
looks like you can see different amplitude pulses depending on which end the data is coming from - adding some series R in a 1-wire line can make it a lot easier to see which end data is coming from.
Very enjoyable! Shows uses of the scope as well. Encourages the fact that failure is an option in electronics and start thinking about the workaround...
I kinda like the idea of using an arduino to control the camera. Sure would give incredible control over the camera that way since you could output any command you wish. Build a shield that interfaces with the LANC and use a controller of your own design. In-fact a foot remote would be handy for controlling the camera when you don't have a free hand. You could also read the bus and output the counter to a display so you know how long you've been recording. Pretty cool idea someone suggested.
You could use a video monitor placed under the camera. Better way to check focus and a bigger red record circle. Also I would think a medium sized display could be easily attached to a tripod.
I have not seen that hot shoe light myself, but I assumed it just sucked the power and had a manual on/off switch? In any case, it's not that easy to tap the hot shoe
Or maybe you should try to connect second scope channel probe directly to Rec/Stop button pin, switch the scope to one-shoot mode and set triggering based on second channel. You press Rec/Stop button, it makes scope to do one shot. You analyze this shot.
Maybe you can reverse the approach and instead of reading the state of the camera just detect record/stop commands sent by remote.That way you'll only need to check the system when you turn it on and then (assuming the camera doesn't miss any commands sent by remote) you should get the correct state at all times.
I wonder if there's a way you could use software to get an output (maybe even over LANC) when you start recording and use that to trigger the on air sign. That way, even if you're not using your remote you have the possibility of an on air light.
Great little RE vid :) Since the bus is UART compatible, you could hook up the bus to a PC, and compare the data when recording. Also, while you're hacking the Lan-C bus, maybe you could make a nice zoom/focus puller with rotary encoders and a µC. A focus puller would be really nice to have so you can easily do closeups without waiting for the AF You can already use the remote without hacking, but 'absolute' knobs could be nicer to use.
I did a similar thing to allow me to control a camera that was in a backpack which was in turn connected to a cheap pen camera. You can see the build on Instructables. Just search for LANC
Try byte 7 low nybble. I think the servo/mechanics on would be analogous to RECORD. Of course this means it's a wee bit harder to pickout your data. You would have to mask that byte.
Hey, I'm looking to use a custom LANC-based RCP to control a Sony or Canon LANC camera remotely. What I can’t find is the full list of statuses that the camera can send back to the master (control) unit on bytes 2-7 of the LANC transfer. I see that the common status updates are “record mode” “tape position” etc, but I can’t find out if the camera is able to output such statuses as: current IRIS, current Shutter speed, current Gain, etc? Any insight would be amazing
You could duct tape a light sensor to the "rec" LED. Another idea is to use a coil to "sniff" the electro magnetic field and look for a useable signal during record.
Actually, that won't give you the data he is looking for. He is looking for the byte that contains the rec status data. If you trigger off the button, you will keep getting "ALL" the bytes present when the button is pushed but no indication as to only which bytes are relevant. Since the camera doesn't seem to output it's rec status to the bus, he may have to resort to decoding the controller's rec/pause/stop codes instead. It should work fine but not if the camera's control buttons are used.
I was wondering if you might use the capabilities of the "Mini Advanced Accessory Shoe" on this camera to control your "on air" sign much the same way that it ( the shoe) might control the VL-5 video light accessory. I've looked all over but can't find specifics on what the camera controlled shoe does to the light.
Looks like remote wall plugs, they have nearly the same code: 0.5ms control bit, 0.5 for 0 and 1ms for 1, XXXXX 5 bits for the securtiy code, XXXXX 5 for the Letter that will be pressed and 2 bits for On or off (01 or 10) and at the end a 350ms sync delay 101110100010 is plug 1-3-4-5(on), Button B, On
How can you tell there was no bits toggling in those bytes that were flickering between each telegram? Didn't ever see you capture every telegram and compare it to button-press-state. There is a start/stop recording button on the remote, there must be a change in the telegram somewhere! (which is not reading camera state as you first said, but reading button state)
Also, I hate to be the one asking: Were you maybe pressing the record on/off on the camera instead of the remote, while capturing? :P If you were going to sniff at the bus somewhere between the remote and the camera either way, I would just use the actual hard button press signal (if you totally give up the bus sniffing).
Dave, why don't you simply build a switch (or large button) that outputs the START RECORD on the camera via LANC and also turns the light on. When you toggle the switch the camera pauses/stops and the light would be off. SIMPLE! :) That would actually be a cool video to watch to see how you would do it.
Hey Dave, I just bought myself a Rigol 1054Z which has the option to decode data after you pay for it (or hack it). Will that oscilloscope also decode this data the same way? In other words, is it worth paying for this decode function? (I don't wanna hack and maybe loose my guaranty)
You won't lose your warranty if you're in the U.S. Here it's illegal for a manufacturer to void your warranty simply because you modified your property. The manufacturer must prove that the modifications you performed caused the problem for which you're seeking warranty service. The relevant law is the Magnuson-Moss Warranty Act. If you're not in the U.S., check the laws in your country for similar protection.
I suppose you could make that an IR switch then. Have another little transmitter going to a small control box on a different frequency than the camera. Again, would be a cool tutorial on how to build a small circuit like that. Knowing you, you could build that in about 30 min. :) If you don't want to do that how about a foot switch you could toggle on the floor?
Nevermind... I stopped for a taco break and totally missed that part. Guess i should watch the whole thing before replying... I have a sony and canon camcorders, I might have a go at it time permitting.
Anyway, you are not able to catch one (single!) unusual packet just looking on "dancing" waveform on your scope. That works for repeating bytes of zoom-control-commands, but for non-repeating single status byte, which appears on the screen JUST for 6 ms... oh... it's impossible. You need to capture full exchange and analyze it.
Can anyone explain to me how he calculated the 9600 baud rate from the 1,25 ms? Im struggling a bit (pun intendet) with the difference between bit rate and baud rate.
why would tact switches matter in a studio with loud guitars , bass , drums or vocals? most real studio's (music and tv ) have a live room and a control room. plus a tact switch is no louder then a computer keyboard witch are in every studio, still fun vid dave
If you say there's a light on the camera, just in a crappy position, is there nothing you could do with a light sensor and a bit of electric tape for the ultimate in bodge? ;)
Great video, but disappointing because I'm using Canon cameras. My Varizoom wired remote for zoom/rec control does have a little tally light which works with SONY camcorders. The light DOES work on the new CANON HF G30 I bought. I'm not sure about the G20. As with your G10, the tally light does not work with the VIXIA HF S200 which I also have. I think if you put a G30 on your scope you'll see the tally signal.
Necro of this video, to add info for people searching for protocol documentation of LANC See this URL: www.boehmel.de/lanc The device status (REC) that Dave wanted is within "Byte 4".
man, this has been one of my favorite videos of yours thus far, dave. i'm a software guy, so seeing you pretty effortlessly transform (what looks to me) a messy plotline into actual data was like watching someone perform magic.
Absolutely love the reverse engineering videos, you always learn a lot in one go!
You have excellently mastered that scope, Dave! I'm impressed by how you operate this beast!
Using trigger Holdoff can also be useful for waveforms like this.
Thanks man. Appreciate your teardowns!
Too bad I ran across this video 5 years later. There is a Sony LANC remote that has an LCD display that displays the record/play time counter. It has all of the control buttons and works on both Sony and Canon. By adding a jumper it becomes a servicing remote allowing adjustment most of the operating parameters like color balance etc. One of the LCD indicators is "REC" while the camera is recording. So the information you seek is there. I fixed this stuff for 23 years.
what is the remote model number please as I am looking for a remote that can change exposure via LANC when in the manual mode. Thanks for your reply
Good stuff Dave, I'd love to see more of these types of exploration/messing around vids
Thank you Dave i can learn something new with almost all your videos.
looks like you can see different amplitude pulses depending on which end the data is coming from - adding some series R in a 1-wire line can make it a lot easier to see which end data is coming from.
Excellent video Dave!
Dave,
This was a great video. Would love to see more like it. Thanks.
Very enjoyable! Shows uses of the scope as well. Encourages the fact that failure is an option in electronics and start thinking about the workaround...
one of most the best vid's you've made! definitely you should post more reverse eng. stuff!
I love this kind of engineering! Excellent!
You sir, are my electronics hero!
DSP looks like so much fun. Good stuff.
I need to detect the output from the camera not the button on the remote, sorry, didn't make that clear.
You can isolate data txing by the remote hocking at the transistor base (the open colector output).
I collected some LANC notes a while back... I believe Byte 4: A4 is the Tally Light from the camera in the Sony protocol.
I kinda like the idea of using an arduino to control the camera. Sure would give incredible control over the camera that way since you could output any command you wish. Build a shield that interfaces with the LANC and use a controller of your own design. In-fact a foot remote would be handy for controlling the camera when you don't have a free hand. You could also read the bus and output the counter to a display so you know how long you've been recording. Pretty cool idea someone suggested.
thx,dave for the video.
Great idea! Love it!
You could use a video monitor placed under the camera. Better way to check focus and a bigger red record circle. Also I would think a medium sized display could be easily attached to a tripod.
I did that once! 15min of EPIC Duct-Tape bodging ,a little soldering and done. Looked like a bomb!
AWESOME scope
You should do a video on an Etch-A-Sketch Animator. I haven't got the screwdriver for it myself, but from the looks of your electronic lab, you do!!
Please do more reverse engineering vids like this!... great stuff
b) I also use the manual REC button on the back.
that scope is awesome I was thinking of getting a 2000 series. but the protocol analysis..drool too much for me !
Cool video. I liked it but it was a bummer you were not able to do what you wanted it to do.
The "On Air" display will remind you whenever you sleep in a video and when you'll wake up it you'll look at it and say : "Damn SHIT! I was ON AIR!"
you can improve the brightness of the sign by painting the edges with silver paint to prevent the light from "spilling" out the edges.
I have not seen that hot shoe light myself, but I assumed it just sucked the power and had a manual on/off switch? In any case, it's not that easy to tap the hot shoe
Or maybe you should try to connect second scope channel probe directly to Rec/Stop button pin, switch the scope to one-shoot mode and set triggering based on second channel. You press Rec/Stop button, it makes scope to do one shot. You analyze this shot.
great reverse enginneing video. Now I know where to begin
I need to capture the button the camcorder, as I rarely use the remote in practice.
Maybe you can reverse the approach and instead of reading the state of the camera just detect record/stop commands sent by remote.That way you'll only need to check the system when you turn it on and then (assuming the camera doesn't miss any commands sent by remote) you should get the correct state at all times.
Ahhh that scope does it all!
I wonder if there's a way you could use software to get an output (maybe even over LANC) when you start recording and use that to trigger the on air sign. That way, even if you're not using your remote you have the possibility of an on air light.
Because I don't always use the IR remote. And it would get out of sync...
a) it's the same code/button for ON/OFF
Great little RE vid :)
Since the bus is UART compatible, you could hook up the bus to a PC, and compare the data when recording.
Also, while you're hacking the Lan-C bus, maybe you could make a nice zoom/focus puller with rotary encoders and a µC.
A focus puller would be really nice to have so you can easily do closeups without waiting for the AF
You can already use the remote without hacking, but 'absolute' knobs could be nicer to use.
I did a similar thing to allow me to control a camera that was in a backpack which was in turn connected to a cheap pen camera.
You can see the build on Instructables. Just search for LANC
Try byte 7 low nybble. I think the servo/mechanics on would be analogous to RECORD. Of course this means it's a wee bit harder to pickout your data. You would have to mask that byte.
Really nice video. Do more reverse engineering!
Because I normally use my IR remote.
Hey, I'm looking to use a custom LANC-based RCP to control a Sony or Canon LANC camera remotely. What I can’t find is the full list of statuses that the camera can send back to the master (control) unit on bytes 2-7 of the LANC transfer. I see that the common status updates are “record mode” “tape position” etc, but I can’t find out if the camera is able to output such statuses as: current IRIS, current Shutter speed, current Gain, etc? Any insight would be amazing
You could duct tape a light sensor to the "rec" LED. Another idea is to use a coil to "sniff" the electro magnetic field and look for a useable signal during record.
Actually, that won't give you the data he is looking for. He is looking for the byte that contains the rec status data. If you trigger off the button, you will keep getting "ALL" the bytes present when the button is pushed but no indication as to only which bytes are relevant. Since the camera doesn't seem to output it's rec status to the bus, he may have to resort to decoding the controller's rec/pause/stop codes instead. It should work fine but not if the camera's control buttons are used.
Dave why not have an IR sensor on the on air sign so that when you start the camera with the remote it also turns the sign on/off
I didnt know a scope could decode data like that! Make sense now after seeing just a "few lines of code" for a digital scope. But thats cool!
Why not to capture full sequence of repeating bytes (last ones in 'telegramm') and to see whether its suffer small changes?
I was wondering if you might use the capabilities of the "Mini Advanced Accessory Shoe" on this camera to control your "on air" sign much the same way that it ( the shoe) might control the VL-5 video light accessory. I've looked all over but can't find specifics on what the camera controlled shoe does to the light.
Could the 0.7V over on the power rail be to compensate for a diode? Just a guess based on the use of a jack connector.
Looks like remote wall plugs, they have nearly the same code:
0.5ms control bit, 0.5 for 0 and 1ms for 1, XXXXX 5 bits for the securtiy code, XXXXX 5 for the Letter that will be pressed and 2 bits for On or off (01 or 10)
and at the end a 350ms sync delay 101110100010 is plug 1-3-4-5(on), Button B, On
Do Panasonic professional/prosumer camcorders use the same LANC protocol as Sony?
If you use the IR remote to go to REC, why not build an IR receiver that will operate the ON AIR light? One xmtr, two rcvrs.
At 17:00
Philosophical question of the day:
At how many positions does a rotary switch become a rotary *encoder*?
10?
A 100?
:)
359 propably..
never because they work differently.
its called a "TALLY Light" (in broadcast cams show u witch cams are ON) : )
How can you tell there was no bits toggling in those bytes that were flickering between each telegram? Didn't ever see you capture every telegram and compare it to button-press-state. There is a start/stop recording button on the remote, there must be a change in the telegram somewhere! (which is not reading camera state as you first said, but reading button state)
Also, I hate to be the one asking: Were you maybe pressing the record on/off on the camera instead of the remote, while capturing? :P If you were going to sniff at the bus somewhere between the remote and the camera either way, I would just use the actual hard button press signal (if you totally give up the bus sniffing).
Dave, why don't you simply build a switch (or large button) that outputs the START RECORD on the camera via LANC and also turns the light on. When you toggle the switch the camera pauses/stops and the light would be off. SIMPLE! :) That would actually be a cool video to watch to see how you would do it.
GREAT JOB DAVE! MORE HARDWARE HACKING PLEASE!
Lightweight!
I've done a video on how that works.
Hey Dave, I just bought myself a Rigol 1054Z which has the option to decode data after you pay for it (or hack it).
Will that oscilloscope also decode this data the same way? In other words, is it worth paying for this decode function?
(I don't wanna hack and maybe loose my guaranty)
You won't lose your warranty if you're in the U.S. Here it's illegal for a manufacturer to void your warranty simply because you modified your property. The manufacturer must prove that the modifications you performed caused the problem for which you're seeking warranty service. The relevant law is the Magnuson-Moss Warranty Act. If you're not in the U.S., check the laws in your country for similar protection.
...or could you use a photodiode to detect the led (assuming you don't want to tear in to the camera).
I suppose you could make that an IR switch then. Have another little transmitter going to a small control box on a different frequency than the camera. Again, would be a cool tutorial on how to build a small circuit like that. Knowing you, you could build that in about 30 min. :) If you don't want to do that how about a foot switch you could toggle on the floor?
What about using the output from the camera "recording" LED to trigger a transistor?
Because there is non, just an onscreen indicator.
It would be easier to measure the power input current to the camera which is greater when recording.
Nevermind... I stopped for a taco break and totally missed that part. Guess i should watch the whole thing before replying... I have a sony and canon camcorders, I might have a go at it time permitting.
You were looking at the 5th byte, not the 4th.
Why don't you get a arduino to interrupt the ir turn on signal to switch on the on air sign
Why not tape a photodiode over the "Recording" diode on the camera? Maybe even make it wireless with some simple IR.
Anyway, you are not able to catch one (single!) unusual packet just looking on "dancing" waveform on your scope. That works for repeating bytes of zoom-control-commands, but for non-repeating single status byte, which appears on the screen JUST for 6 ms... oh... it's impossible. You need to capture full exchange and analyze it.
The cord is about 50cm long. That instantly puts it right next to the internal or external shotgun mic. Who'
Take the video out signal from the camera, and create something to look for the red circle
Finally a rant time!
Can anyone explain to me how he calculated the 9600 baud rate from the 1,25 ms? Im struggling a bit (pun intendet) with the difference between bit rate and baud rate.
Oh, got it - use the 104 microseconds and you get 9600.
ahh ok I missed that detail as a studio tech and a EE I was confused (lol was)
why would tact switches matter in a studio with loud guitars , bass , drums or vocals?
most real studio's (music and tv ) have a live room and a control room. plus a tact switch is no louder then a computer keyboard witch are in every studio, still fun vid dave
If you say there's a light on the camera, just in a crappy position, is there nothing you could do with a light sensor and a bit of electric tape for the ultimate in bodge? ;)
Quite ironic if you forgot to press record when you were filming the intro shot.
02:07 It allows you to zoom in and out *camera zooms in and out* and it let´s you to start and sto... ; )
Great video, but disappointing because I'm using Canon cameras. My Varizoom wired remote for zoom/rec control does have a little tally light which works with SONY camcorders. The light DOES work on the new CANON HF G30 I bought. I'm not sure about the G20. As with your G10, the tally light does not work with the VIXIA HF S200 which I also have. I think if you put a G30 on your scope you'll see the tally signal.
Does not work on G20 either
You just saved me from wasting a bunch of time, thank you!
Sweet
Fun stuff...
nice hacking, I was looking into this some time ago, and was thinking of bit banging it with an arduino to send commands to the camera.
put a light detector transistor on the record light with duct tape.
I'm not about to hack my $1500 camera with wires hanging out of it. I'm not that desperate for a REC LED!
could you use a light sensor and just stick it to the front.
Dave, why not have a micro just read the line and look for the record button press, soft de-bounce it and make it latch on and off. Simple enough no?
Why don't you hack the camera itself and connect the ON AIR sign to the record LED with interface circuitry. BTW, nice triggering technique!
Yeah, "packet sniffing" on a scope just won't give you the information that
REing is soo fun.
Interesting, but what a letdown!
any other cams to try, cheap old sony trvXXX etc.....
Do you have the solution? Please post if you do.
Necro of this video, to add info for people searching for protocol documentation of LANC
See this URL: www.boehmel.de/lanc
The device status (REC) that Dave wanted is within "Byte 4".
I tried googling for "Canon LANC bus". First nine results out of ten contained the word EEVblog