Disclaimer: This description is completely unofficial. Most of the information presented here is discovered by me, Eugene Crosser, while snooping the serial line and by trial and error. I never had an official protocol description, have never seen any related software source code, and have never done reverse engineering of any related software. This description may be incomplete, inaccurate or completely wrong. You are warned.

Some information is taken from `camediaplay' package by Jun-ichiro Itoh <itojun@itojun.org>, from the findings of Thierry Bousch <bousch%linotte.uucp@topo.math.u-psud.fr> TsuruZoh Tachibanaya <tsuruzoh@butaman.ne.jp> and from other (open) sources and not checked by me.

Serial Protocol of Some Digital Cameras

Several models of digital cameras, namely Epson, Sanyo, Agfa and Olympus cameras, seem to use the same protocol for communication with the host. Follows the description of the high-level protocol they use over the serial line.

Protocol Basics

The host and the camera exchange with data packets and individual bytes. Serial line paramaters used are: 8bit, no parity. No flow control is used. All arithmetic data is transmitted least significant byte first ("little endian").

Protocol Elements

The elementary units of the protocol are:
Initialization ByteNUL 0x00
Action Complete NotificationENQ 0x05
Positive AchnowledgementACK 0x06
Unable to Execute CommandDC1 0x11
Negative Acknowledgement,
also Camera Signature
NAK 0x15
PacketVariable length sequence of bytes
Termination Byte

Packet structure

The packet has the following structure:
01Packet type
11Packet subtype/sequence
22Length of data

Known packet types are:
0x02Data packet that is not last in sequence
0x03Data packet that is last in sequence
0x1bCommand packet

Data packets that are sent in responce to a single command are numbered starting from zero. If all requested data fits in one packet, it has type 0x03 and sequence 0.

Command packet has subtype 0x43 or 0x53. Only the first command packet in a session has subtype 0x53.

Maximum length of data field in a packet is 2048 bytes, which yields in 2054 total packet length.

Checksum is a simple 16 bit arithmetic sum of all bytes in the data field. As already mentioned above, length and checksum values are transmitted least significant byte first.

Flow of Control

A communication session flow is as follows:
Port speed set to 19200 baud
Host sends init byte 0x00
Camera responds with signature 0x15
Host sends command packet with subtype 0x53 and "set speed" command
Camera sends ACK 0x06
Port speed set to the new value
Host sends command
Camera responds with either ACK plus optionally "action taken" notifier or data packet sequence
Host sends ACK to every data packet
... Command - reply cycle repeated ...
Camera sends 0xff and resets after a few seconds (value is model-dependant) of inactivity

If the camera does not respond to a command in reasonable time, or responds with a NAK, the command can be resent. If the camera does not provide a complete data packet in reasonable time, or the data packet is corrupt (checksum does not match), the host can request resending of the packet by sending NAK instead of ACK.

Command format and codes

Command is a sequence of bytes sent in the data field of a command packet. Command format is as follows:
01Command code
11Register number or subcode
2variableOptional argument

Five command codes are known:
0int32Set value of integer register
1noneRead value of integer register
2vdataTake action unrelated to registers
3vdataSet value of vdata register
4noneRead value of vdata register

Commands 0 and 3 are replied with a single ACK 0x06. Command 2 is replied with an ACK 0x06 followed by an "action complete" notifier 0x05. Commands 1 and 4 are replied with a sequence of data packets, each of them must be ACK'ed by the host.

Command 0 must be issued with a 4 byte argument containg the new value for the register (bytes in "LSB first" order). Command 2 typically is issued with a single zero byte as an argument. Command 3 is issued with an argument of variable number of bytes. If this is a printable string, it should not include the trailing zero byte.

Camera replies to the command 1 with a single data packet containing 4 bytes of a 32bit integer (in "LSB first" order). Camera replies to the command 4 with a sequence of data packets with variable number of data bytes. Note that if a printable string is returned, it is terminated with a zero byte, and thus may be safely printed or otherwise treated as a normal C language character string.


The following registers are known (read/writablity info is inaccurate):
1int32R/WResolution: 1 - Std, 2 - Hi, 3 - Ext, other values possible
2int32R/WClock in UNIX time_t format
3int32R/WShutter speed (microseconds), 0 - auto
4int32 WCurrent frame number (or animation number if hi order byte is 0xff)
5int32R/WAperture: 0 - Auto, 1 - Low, 2 - Med, 3 - ?, 4 - Hi
6int32R/WColor mode: 1 - Color, 2 - B/W
7int32R/WFlash mode: 0 - Auto, 1 - Force, 2 - Off, 3 - Anti RedEye, 4 - Slow sync
8int32R/WUnknown (128)
9int32R/WUnknown (128)
10int32R No. of frames in current folder
11int32R No. of frames left
12int32R Length of current frame *
13int32R Length of current thumbnail *
14vdataR Current frame data *
15vdataR Current thumbnail data *
16int32R Battery capacity percentage
17int32R/WCommunication speed 1 - 9600 .. 5 - 115200, 6 - 230400, 256 - 9600 .. 264 - 911600 (sync?)
18int32R Unknown (1)
19int32R/WBright/Contrast: 0 - Normal, 1 - Contrast+, 2 - Contrast-, 3 - Brightnes+, 4 - Brightnes-
20int32R/WWhite balance: 0 - Auto, 1 - Sunny, 2 - Incandescent, 3 - Fluorescent, 5 - Flash, 6- White preset, 255 - Cloudy
22vdataR/WCamera I.D.
23int32R/WAutoshut on host timer (seconds)
24int32R/WAutoshut in field timer (seconds)
25vdataR/WSerial No. (string)
26vdataR Version
28int32R Available memory left
29vdataR/WUpload image data to this register
30int32 WLED: 0 - Off, 1 - On, 2 - Blink
31vdataR Unknown ("\0")
32int32R Put "magic spell" 0x0FEC000E here before uploading image data
33int32R/WFocus mode: 1 - Macro, 2 - Normal, 3 - Infinity/fisheye
34int32R Operation mode: 1 - Off, 2 - Record, 3-Play, 6-Thumbnail
35int32R/WLCD brightness 1 to 7
36int32R Unknown (3)
37vdataR Unknown ("\0")
38int32R LCD autoshut timer (seconds)
39int32R Protection state of current frame *
40int32R True No. of frames taken
41int32R/WLCD date format: 1 - 'YY MM DD, 2 - DD MM 'HH
42vdataR Unknown ("")
43vdataR Audio data description block *
0: expanded .wav length
1: compressed .wav length
3: Unknown (0)
4: Unknown (0)
5: Unknown (0)
6: Unknown (0)
7: Unknown (0)
44vdataR Audio data *
45vdataR Unknown ("")
46vdataR Camera summary data: 32 bytes with copies of 8 other registers
0: Reg 1 (Resolution)
1: Reg 35 (LCD brightness) or Reg 7 (Flash mode)
2: Reg 10 (Frames taken) or Unknown
3: Unknown (0) or Unknown
4: Unknown (0) or Reg 16 (Battery capacity)
5: Unknown (0) or Reg 10 (Frames taken)
6: Unknown (0) or Reg 11 (Frames left)
7: Number of animations taken
47vdataR Picture summary data: 32 bytes or 8 int32's *
0: Hi order byte: unknown, next 3 bytes: Length of current image
1: Length of current thumbnail
2: Audio data length (expanded)
3: Resolution
4: Protection state
5: TimeDate
6: Unknown (0)
7: Animation type: 1 - 10ms, 2 - 20ms
48vdataR Manufacturer
49vdataR Unknown ("")
50int32R Unknown (0)
51int32R/WCard detected: 1 - No, 2 - Yes
52vdataR/WUnknown ("")
53int32R/WLanguage: 3 - english, 4 - french, 5 - german, 6 - italian, 8 - spanish, 10 - dutch
54-59vdataR Unknown ("")
60int32R True No. of frames taken
61-68vdataR Unknown ("")
69vdataR Exposure Compensation 8 bytes
0: compensation value -20 to +20
1: 0
2: 0
3: 0
4: 10
5: 0
6: 0
7: 0
70int32R/WExp. meter: 2 - Center weighted, 3 - Spot, 5 - Multi element matrix
71vdataR/WEffective zoom in tenths of millimeters: 8 bytes
0: LSB
1: MSB
2: 0
3: 0
4: 10
5: 0
6: 0
7: 0
72int32R/WBitmap: 1 - AEL/WBL, 2 - Fisheye, 4 - Wide, 8 - Manual zoom, 16 - B/W, 256 - 1.25x, 512 - 1.6x, 768 - 2.0x, 1024 - 2.5x, 1280 - off
73-76vdataR Unknown ("")
77int32 WSize of data packet from camera
(default 0x800)
78vdataR Unknown ("")
79vdataR Filename of current frame *
80-81vdataR Unknown ("")
82int32 WUnknown (enable folder features? Write 60 here)
83int32R/WFolder navigation
When read, return number of folders on the card.
When written without data, reset folder system (?)
Or select current folder by its number
84vdataR/WCurrent folder name (may read or set)
85vdataR Unknown ("")
86int32R/WDigital zoom; 0 - 1X, otherwise zoom factor x 100 (i.e. in percent)
87-90vdataR Unknown ("")
91vdataR Current folder I.D. and name
* Note: Marked registers only become useful for reading after setting register 4. If value of 0 assigned to register 4 after doing action 5, subsequent retrieval of picture data gives the "live preview".

For command 2, the second byte is action code not register number. The following action codes are known:
0single zero byteErase last picure
1single zero byteErase all picures (but not animations)
2single zero byteTake picture
4single zero byteFinish session immediately
5single zero byteTake preview snapshot (retreivable as frame zero)
6single byteCalibration / testing. Arg value:
1 Calibrate autofocus
3 Test zoom/exposure
4-6 Store 0 in Reg 32
9 Load LCD Brightness (0-31) from Reg 32
10 Load LCD size (25 for Nikon Coolpix 950) from Reg 32
11 LCD Saturation (0-32) from Reg 32
13 LCD Red-Green (0-32) from Reg 32
14 LCD Blue (0-32) from Reg 32
15 Store -1 in Reg 32
16 Multi shot (locks up if lcd is on)
17 Take picture
18 Store -1 in Reg 32
20-23 locks up if lcd is on
24-255 Store -1 in Reg 32
7single zero byteErase current frame *
8single byteSwitch LCD mode. Arg value:
1 - Off
2 - Record
3 - Play (show current frame fullscreen)
4 - preview thumbnails (?)
5 - Thumbnail view (smaller?)
6 - Thumbnail view (larger?)
7 - Next
8 - Previous
9single byteSet protection state of current frame to the value of parameter (binary 0 or 1)*
11single zero byteStore freshly uploaded image into NVRAM (see appendix A)
12single byteLCD test. Arg value:
0 - white
1 - gray
2 - black
3 - red
4 - green
5 - blue
6 - test pattern
* Note: actions 7 and 9 only useful after setting register 0x04.

Appendix A

Date: Sun, 14 Jul 2002 01:28:39 +0200 (CEST)
From: =?iso-8859-1?Q?Peter_=C5strand?= <astrand(at)lysator.liu.se>
To: allyn(at)fratkin.com, <wolfgang(at)charlotte.wsrcc.com>, <crosser(at)average.org>
Subject: Upload on Olympus C-860L


Tonight, I've been struggling with uploading arbitrary pictures to my 
Olympus C-860L. I've finally found out that for the camera to accept the 
picture, to two conditions must be met:

1) The subsampling must be 2x1, 1x1, 1x1
2) The EXIF info must be just like the pictures the camera itself 

So, I've made a small script to fix this. Feel free to include it in FAQs 
and/or photopc dists. 

/more/data/pics/olympus-reference-pic.jpg is just some picture taken with 
the camera. 



TMPFILE=`mktemp /tmp/photopc-upload.XXXXXX` || exit 1

for file in $@; do 
    echo Converting $file...
    djpeg $file | cjpeg -sample 2x1 > $TMPFILE
    jhead -te /more/data/pics/olympus-reference-pic.jpg $TMPFILE
    echo Uploading $file...
    photopc upload $TMPFILE
    sleep 2;

rm -f $TMPFILE

/Peter Åstrand <astrand(at)lysator.liu.se>

Appendix B

Some Nikon models support an extension to the protocol described above, specifically designed for remote control units. This protocol allows to control zoom, emulate half-depress of the shutter release button, bulb operation and possibly more. <vladimir.vyskocil(at)wanadoo.fr> compiled a partial description of this protocol, available here.

Please mail your corrections/additions to <crosser at average dot org>
See http://photopc.sourceforge.net/ for possible updates.