please dont rip this site

Disclaimer: This description is completely unofficial, Epson even does not know about its existance. Most of the informaion presented here is discovered by me, Eugene Crosser, while snooping the serial line and by trial and error. I never had an official protocol description, have never seen any related software source code, and have never done reverse engineering of any related software. This description may be incomplete, inaccurate or completely wrong. You are warned.

Some information is taken from `camediaplay' package by Jun-ichiro Itoh <>, from the findings of Thierry Bousch <> TsuruZoh Tachibanaya <> and from other (open) sources and not checked by me.

Serial Protocol of Some Digital Cameras

Several models of digital cameras, namely Epson, Sanyo, Agfa and Olympus cameras, seem to use the same protocol for communication with the host. Follows the description of the high-level protocol they use over the serial line.

Protocol Basics

The host and the camera exchange with data packets and individual bytes. Serial line paramaters used are: 8bit, no parity. No flow control is used. All arithmetic data is transmitted least significant byte first ("little endian").

Protocol Elements

The elementary units of the protocol are:
Initialization Byte NUL 0x00
Action Complete Notification ENQ 0x05
Positive Achnowledgement ACK 0x06
Unable to Execute Command DC1 0x11
Negative Acknowledgement,
also Camera Signature
NAK 0x15
Packet Variable length sequence of bytes
Termination Byte

Packet structure

The packet has the following structure:
Offset Length Meaning
0 1 Packet type
1 1 Packet subtype/sequence
2 2 Length of data
4 variable Data
-2 2 checksum

Known packet types are:

Type Description
0x02 Data packet that is not last in sequence
0x03 Data packet that is last in sequence
0x1b Command packet

Data packets that are sent in responce to a single command are numbered starting from zero. If all requested data fits in one packet, it has type 0x03 and sequence 0.

Command packet has subtype 0x43 or 0x53. Only the first command packet in a session has subtype 0x53.

Maximum length of data field in a packet is 2048 bytes, which yields in 2054 total packet length.

Checksum is a simple 16 bit arithmetic sum of all bytes in the data field. As already mentioned above, length and checksum values are transmitted least significant byte first.

Flow of Control

A communication session flow is as follows:
Host Camera
Port speed set to 19200 baud
Host sends init byte 0x00
Camera responds with signature 0x15
Host sends command packet with subtype 0x53 and "set speed" command
Camera sends ACK 0x06
Port speed set to the new value
Host sends command
Camera responds with either ACK plus optionally "action taken" notifier or data packet sequence
Host sends ACK to every data packet
... Command - reply cycle repeated ...
Camera sends 0xff and resets after a few seconds (value is model-dependant) of inactivity

If the camera does not respond to a command in reasonable time, or responds with a NAK, the command can be resent. If the camera does not provide a complete data packet in reasonable time, or the data packet is corrupt (checksum does not match), the host can request resending of the packet by sending NAK instead of ACK.

Command format and codes

Command is a sequance of bytes sent in the data field of a command packet. Command format is as follows:
Offset Length Description
0 1 Command code
1 1 Register number or subcode
2 variable Optional argument

Five command codes are known:

Code Argument Description
0 int32 Set value of integer register
1 none Read value of integer register
2 vdata Take action unrelated to registers
3 vdata Set value of vdata register
4 none Read value of vdata register

Commands 0 and 3 are replied with a single ACK 0x06. Command 2 is replied with an ACK 0x06 followed by an "action complete" notifier 0x05. Commands 1 and 4 are replied with a sequence of data packets, each of them must be ACK'ed by the host.

Command 0 must be issued with a 4 byte argument containg the new value for the register (bytes in "LSB first" order). Command 2 typically is issued with a single zero byte as an argument. Command 3 is issued with an argument of variable number of bytes. If this is a printable string, it should not include the trailing zero byte.

Camera replies to the command 1 with a single data packet containing 4 bytes of a 32bit integer (in "LSB first" order). Camera replies to the command 4 with a sequence of data packets with variable number of data bytes. Note that if a printable string is returned, it is terminated with a zero byte, and thus may be safely printed or otherwise treated as a normal C language character string.


The following registers are known (read/writablity info is inaccurate):
No. Type R/W Description
1 int32 R/W Resolution: 1 - Std, 2 - Hi, 3 - Ext, other values possible
2 int32 R/W Clock in UNIX time_t format
3 int32 R/W Shutter speed (microseconds), 0 - auto
4 int32 W Current frame number (or animation number if hi order byte is 0xff)
5 int32 R/W Aperture: 1 - Low, 2 - Mid, 3 - Hi
6 int32 R/W Color mode: 1 - Color, 2 - B/W
7 int32 R/W Flash mode: 0 - Auto, 1 - Force, 2 - Off, 3 - Anti RedEye, 4 - Slow sync
8 int32 R/W Unknown (128)
9 int32 R/W Unknown (128)
10 int32 R No. of frames taken
11 int32 R No. of frames left
12 int32 R Length of current frame *
13 int32 R Length of current thumbnail *
14 vdata R Current frame data *
15 vdata R Current thumbnail data *
16 int32 R Battery capacity percentage
17 int32 R/W Communication speed 1 - 9600 .. 5 - 115200, 6 - 230400, 256 - 9600 .. 264 - 911600 (sync?)
18 int32 R Unknown (1)
19 int32 R/W Bright/Contrast: 0 - Normal, 1 - Bright+, 2 - Bright-, 3 - Contrast+, 4 - Contrast-
20 int32 R/W White balance: 0 - Auto, 1 - Skylight, 2 - Fluorescent, 3 - Tungsten, 255 - Cloudy
21 vdata R/W Unused
22 vdata R/W Camera I.D.
23 int32 R/W Autoshut on host timer (seconds)
24 int32 R/W Autoshut in field timer (seconds)
25 vdata R/W Serial No. (string)
26 vdata R Version
27 vdata R/W Model
28 int32 R Available memory left
29 vdata R/W Upload image data to this register
30 int32 W LED: 0 - Off, 1 - On, 2 - Blink
31 vdata R Unknown ("\0")
32 int32 R Put "magic spell" 0x0FEC000E here before uploading image data
33 int32 R/W Lens mode: 1 - Macro, 2 - Normal, 3 - Infinity/fisheye
34 int32 R Unknown (0)
35 int32 R/W LCD brightness 1 to 7
36 int32 R Unknown (3)
37 vdata R Unknown ("\0")
38 int32 R LCD autoshut timer (seconds)
39 int32 R Protection state of current frame *
40 int32 R Unknown (0)
41 int32 R/W LCD date format: 1 - 'YY MM DD, 2 - DD MM 'HH
42 vdata R Unknown ("")
43 vdata R Audio data description block *
0: expanded .wav length
1: compressed .wav length
3: Unknown (0)
4: Unknown (0)
5: Unknown (0)
6: Unknown (0)
7: Unknown (0)
44 vdata R Audio data *
45 vdata R Unknown ("")
46 vdata R Camera summary data: 32 bytes with copies of 8 other registers
0: Reg 1 (Resolution)
1: Reg 35 (LCD brightness) or Reg 7 (Flash mode)
2: Reg 10 (Frames taken) or Unknown
3: Unknown (0) or Unknown
4: Unknown (0) or Reg 16 (Battery capacity)
5: Unknown (0) or Reg 10 (Frames taken)
6: Unknown (0) or Reg 11 (Frames left)
7: Number of animations taken
47 vdata R Picture summary data: 32 bytes or 8 int32's *
0: Hi order byte: unknown, next 3 bytes: Length of current image
1: Length of current thumbnail
2: Audio data length (expanded)
3: Resolution
4: Protection state
5: TimeDate
6: Unknown (0)
7: Animation type: 1 - 10ms, 2 - 20ms
48 vdata R Manufacturer
49-52 vdata R Unknown ("")
53 int32 R/W Language: 4 - french, 5 - german, 6 - italian, 8 - spanish, 10 - dutch
54-69 vdata R Unknown ("")
70 int32 R/W Exp. meter: 2 - Center weighted, 3 - Spot, 5 - Multi element matrix
71 vdata R Unknown ("")
72 int32 R/W Bitmap: 1 - AEL/WBL, 2 - Fisheye, 4 - Wide, 8 - Digital zoom, 16 - B/W
73-76 vdata R Unknown ("")
77 int32 W Unknown (write 0x100 (or 1?) here)
78 vdata R Unknown ("")
79 vdata R Filename of current frame *
80-81 vdata R Unknown ("")
82 int32 W Unknown (enable folder features? Write 60 here)
83 int32 R/W Folder navigation
When read, return number of folders on the card.
When written without data, reset folder system (?)
Or select current folder by its number
84 vdata R Current folder name
85-90 vdata R Unknown ("")
91 vdata R Current folder I.D. and name
* Note: Marked registers only become useful for reading after setting register 4. If value of 0 assigned to register 4 after doing action 5, subsequent retrieval of picture data gives the "live preview".

For command 2, the second byte is action code not register number. The following action codes are known:

Code Argument Description
0 single zero byte Erase last picure
1 single zero byte Erase all picures (but not animations)
2 single zero byte Take picture
4 single zero byte Finish session immediately
5 single zero byte Take preview snapshot (retreivable as frame zero)
6 single byte Autofocus calibration or testing (?)
7 single zero byte Erase current frame *
8 single byte Switch LCD mode. Arg value:
1 - off
2 - viewfinder
3 - preview whole
4 - preview thumbnails)
9 single byte Set protection state of current frame to the value of parameter (binary 0 or 1)*
11 single zero byte Store freshly uploaded image into NVRAM
12 single byte LCD colours. Arg value:
0 - white
1 - gray
2 - black
3 - red
4 - green
5 - blue
6 - test pattern
* Note: actions 7 and 9 only useful after setting register 0x04. Please mail your corrections/additions to <>
See for possible updates.

file: /Techref/io/camera/SerialProtocolofSomeDigitalCameras.htm, 20KB, , updated: 2000/7/31 09:02, local time: 2024/7/20 08:25,

 ©2024 These pages are served without commercial sponsorship. (No popup ads, etc...).Bandwidth abuse increases hosting cost forcing sponsorship or shutdown. This server aggressively defends against automated copying for any reason including offline viewing, duplication, etc... Please respect this requirement and DO NOT RIP THIS SITE. Questions?
Please DO link to this page! Digg it! / MAKE!

<A HREF=""> Serial Protocol of Some Digital Cameras</A>

After you find an appropriate page, you are invited to your to this massmind site! (posts will be visible only to you before review) Just type a nice message (short messages are blocked as spam) in the box and press the Post button. (HTML welcomed, but not the <A tag: Instead, use the link box to link to another page. A tutorial is available Members can login to post directly, become page editors, and be credited for their posts.

Link? Put it here: 
if you want a response, please enter your email address: 
Attn spammers: All posts are reviewed before being made visible to anyone other than the poster.
Did you find what you needed?

  PICList 2024 contributors:
o List host: MIT, Site host, Top posters @none found
- Page Editors: James Newton, David Cary, and YOU!
* Roman Black of Black Robotics donates from sales of Linistep stepper controller kits.
* Ashley Roll of Digital Nemesis donates from sales of RCL-1 RS232 to TTL converters.
* Monthly Subscribers: Gregg Rew. on-going support is MOST appreciated!
* Contributors: Richard Seriani, Sr.

Welcome to!