Fake a panasonic battery to revive camera to copy photos from internal memory
Allright, finally we done it! @KalleMP had the eye opener, however this was a slightly different battery (DMW-BLG10E instead of the DMW-BCG10E and it is fore sure another "valid and safe battery detection method"). It is not enough to fool a temperature sensor, you really need the battery IC (whatever it might be) to get it working. Also great thanks go to @SamGibson.
Purchased a cheap second hand original battery (doesn't know it will work either), just for three euro's, to use it as a donor battery, to reuse the circuitry inside this battery.
After disassembling the battery very carefully, I solder the salvaged board on a micro USB connector board for two reasons:
- Easy and stiff connection;
- It might be possible to use it on 5V because the camera is rated 5.1V (see experiment later on).
The first try didn't work, for some reason the board outputs only 0.7 volts when connected to a battery (3.7v). First thoughts:
- It has something to do with smart failure detection/registration by disconnect the original battery (power disconnect = failure)
- The circuitry was already in a failure state;
- Heating up the board by soldering damaged the internals of the board.
By connecting the battery directly to the camera inputs and the circuitry (in fact in parallel) there was life! Now we are able to copy the data to SD-card, it works perfectly.
USB Power possible? (warning: Just for science, use at own risk!)
After copying (for sure) all data we tried an experiment, just for science, connect it directly to USB (5V) because the camera is rated 5.1V. After a few hours the camera is still running fine, works great! I think it is still usable as photo/film camera with external battery or USB 5V powersource, neat.
This project is a success
Thanks to you all, really awesome, happy faces at the beginning of 2018 ;-)
Experience update/hotsnot update
When using a battery or USB power connection, be sure the power source can handle peaks of 550mA when using camera mode. It seems that the lens motor requires some juice when lens moving out or in. If it is not possible for the camera to get required current, the camera shuts down and lens stay open. When this happens, turn off the camera and switch it to view mode and wait the camera correct the situation.
Same will happen when using a low voltage battery (or empty battery) or message "this battery cannot be used" can randomly appear. Possible reason for this is that we bypass the battery protection circuit of the salvaged board (see first try explanation above).
We got the best operating experience using a protected high current powerbank, a high current charger or a computer USB socket. This is because there is a low voltage drop and will never be lower than 4v because of the DC/DC converter inside.
I put the circuit and connector (wrapped in plastic) permanently in the battery compartment with some hotsnot (hot glue, not a fan anyway). Not a beauty but hey, the camera is still usable with almost any power source! In fact it is some kind of DC Coupler. Maybe some idea for others that want to reuse/revive the camera for still pictures of components or other inhome purposal.
I know you may not like my conclusion, but here is my analysis:
They talk about "ID BAT DQ" (qualifier?) and later on "ID BATT DO". But what does it mean (unreg and DQ for example)?
The schematics in the linked service manual do not include any components on the main PCB - details stop at the connectors on that PCB. However based on what is shown in the partial schematics, public info about similar battery packs and the naming conventions used for the 4 connections, my hypothesis is:
- 1.UNREG+ = Battery +ve
- 2.BAT_THERMO = Likely thermistor connection, probably the other end goes to to battery -ve
- 3.ID_BATT_DQ = Likely "1-wire" or similar data connection to an "authentication IC" in the battery pack (as Ignacio Vazquez-Abrams already commented). "DQ" is a common designator for data connection to a 1-wire device.
- 4.UNREG- = Battery -ve
("1-wire", originally developed by Dallas Semiconductor, now part of Maxim Integrated, is a data bus which uses only 1 wire (and Gnd) for bi-directional communication between devices.)
Without a battery, you would have to guess at the value of a resistor which simulates the thermistor at room temperature. However I doubt that you would do any permanent damage to the camera if you guess wrongly, and you have already received suggestions about likely values to try from Asmyldof.
However you have no information at all about the data being sent to authenticate the battery pack, and you currently have no battery pack to investigate or dismantle. Therefore the only realistic plan I can see, is to buy a battery pack (at least one which is compatible with the camera - it doesn't have to be an original, which are much more expensive). Over here in the UK, compatible battery packs equivalent to that part number, are available at <£10.
Then you could either:
- a. spend time with an oscilloscope and/or logic analyser to reverse-engineer what is happening on that data line, to reverse-engineer the authentication process, if you really want to try to do that (and if that's allowed to do in your country - for example, in the USA, I believe the DMCA might apply) or;
- b. dismantle the battery pack, leaving just the thermistor & authentication chip, and attach your external battery to provide the power itself. If you had a dead but previously working suitable battery pack, this might be something to consider, or;
- c. simply use the purchased battery pack to power the camera while you get the photos copied off that camera.
Even if you did find someone who would reveal details of previous reverse-engineering of that specific battery authentication process, you would need to buy (and perhaps program) whatever device they used to simulate the original authentication device used in a battery pack. The cost (in time and components) of doing that, could easily exceed the cost of a cheap, compatible battery pack for your one-off requirement.
Therefore the difference between buying a battery pack and not buying one, is not the whole cost of the battery pack, since any alternative would have its own costs too.
Panasonic also provides an AC-adapter with a case that fits inside the battery compartment, in fact a fake battery. I think there must be a (simple) trick (maybe a resistor or something, 'shorts' D and T for example) to let the camera think it is an AC-adapter.
I doubt that. I believe that such an AC adapter will also have an equivalent authentication IC, like a battery does, which is why the camera stays powered-on when the AC adapter is used.
If you were looking to learn all about the battery authentication protocol for education purposes, you might choose option (a). However for your stated "one-off" requirement, option (c) seems more sensible.